To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 221
- compare with another revision
- download diff
- download tarball
- view history from revision 221
- Committer: Teddy Hogeborn
- Date: 2008-10-01 15:29:01 UTC
- Revision ID: teddy@fukt.bsnet.se-20081001152901-fh30whl3m4vb7m24
* debian/changelog: New Debian revision.
* debian/mandos-client.lintian-overrides: Added comments.
* debian/mandos.lintian-overrides: - '' -
* debian/mandos-client.lintian-overrides: Added comments.
* debian/mandos.lintian-overrides: - '' -
- files added:
- debian/mandos-client.config
- files removed:
- NEWS
- files modified:
- .bzrignore
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
#
33
32
34
from __future__ import division, with_statement, absolute_import
33
from __future__ import division
35
34
36
35
import SocketServer
37
36
import socket
38
import optparse
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
56
55
import logging
57
56
import logging.handlers
58
57
import pwd
59
from contextlib import closing
60
58
61
59
import dbus
62
import dbus.service
63
60
import gobject
64
61
import avahi
65
62
from dbus.mainloop.glib import DBusGMainLoop
66
63
import ctypes
67
64
import ctypes.util
68
65
69
try:
70
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
71
except AttributeError:
72
try:
73
from IN import SO_BINDTODEVICE
74
except ImportError:
75
# From /usr/include/asm/socket.h
76
SO_BINDTODEVICE = 25
77
78
79
version = "1.0.8"
66
version = "1.0"
80
67
81
68
logger = logging.Logger('mandos')
82
syslogger = (logging.handlers.SysLogHandler
83
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
84
address = "/dev/log"))
85
syslogger.setFormatter(logging.Formatter
86
('Mandos [%(process)d]: %(levelname)s:'
87
' %(message)s'))
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
88
74
logger.addHandler(syslogger)
89
75
90
76
console = logging.StreamHandler()
91
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
92
' %(levelname)s: %(message)s'))
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
' %(message)s'))
93
79
logger.addHandler(console)
94
80
95
81
class AvahiError(Exception):
96
def __init__(self, value, *args, **kwargs):
82
def __init__(self, value):
97
83
self.value = value
98
super(AvahiError, self).__init__(value, *args, **kwargs)
99
def __unicode__(self):
100
return unicode(repr(self.value))
84
super(AvahiError, self).__init__()
85
def __str__(self):
86
return repr(self.value)
101
87
102
88
class AvahiServiceError(AvahiError):
103
89
pass
108
94
109
95
class AvahiService(object):
110
96
"""An Avahi (Zeroconf) service.
111
112
97
Attributes:
113
98
interface: integer; avahi.IF_UNSPEC or an interface index.
114
99
Used to optionally bind to the specified interface.
124
109
a sensible number of times
125
110
"""
126
111
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
127
servicetype = None, port = None, TXT = None,
128
domain = "", host = "", max_renames = 32768,
129
protocol = avahi.PROTO_UNSPEC):
112
servicetype = None, port = None, TXT = None, domain = "",
113
host = "", max_renames = 32768):
130
114
self.interface = interface
131
115
self.name = name
132
116
self.type = servicetype
133
117
self.port = port
134
self.TXT = TXT if TXT is not None else []
118
if TXT is None:
119
self.TXT = []
120
else:
121
self.TXT = TXT
135
122
self.domain = domain
136
123
self.host = host
137
124
self.rename_count = 0
138
125
self.max_renames = max_renames
139
self.protocol = protocol
140
126
def rename(self):
141
127
"""Derived from the Avahi example code"""
142
128
if self.rename_count >= self.max_renames:
143
129
logger.critical(u"No suitable Zeroconf service name found"
144
130
u" after %i retries, exiting.",
145
131
self.rename_count)
146
raise AvahiServiceError(u"Too many renames")
132
raise AvahiServiceError("Too many renames")
147
133
self.name = server.GetAlternativeServiceName(self.name)
148
134
logger.info(u"Changing Zeroconf service name to %r ...",
149
135
str(self.name))
150
syslogger.setFormatter(logging.Formatter
151
('Mandos (%s) [%%(process)d]:'
152
' %%(levelname)s: %%(message)s'
153
% self.name))
136
syslogger.setFormatter(logging.Formatter\
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
154
139
self.remove()
155
140
self.add()
156
141
self.rename_count += 1
162
147
"""Derived from the Avahi example code"""
163
148
global group
164
149
if group is None:
165
group = dbus.Interface(bus.get_object
166
(avahi.DBUS_NAME,
150
group = dbus.Interface\
151
(bus.get_object(avahi.DBUS_NAME,
167
152
server.EntryGroupNew()),
168
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
169
154
group.connect_to_signal('StateChanged',
170
155
entry_group_state_changed)
171
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
172
157
service.name, service.type)
173
158
group.AddService(
174
159
self.interface, # interface
175
self.protocol, # protocol
160
avahi.PROTO_INET6, # protocol
176
161
dbus.UInt32(0), # flags
177
162
self.name, self.type,
178
163
self.domain, self.host,
185
170
# End of Avahi example code
186
171
187
172
188
def _datetime_to_dbus(dt, variant_level=0):
189
"""Convert a UTC datetime.datetime() to a D-Bus type."""
190
return dbus.String(dt.isoformat(), variant_level=variant_level)
191
192
193
173
class Client(object):
194
174
"""A representation of a client host served by this server.
195
196
175
Attributes:
197
name: string; from the config file, used in log messages and
198
D-Bus identifiers
176
name: string; from the config file, used in log messages
199
177
fingerprint: string (40 or 32 hexadecimal digits); used to
200
178
uniquely identify the client
201
secret: bytestring; sent verbatim (over TLS) to client
202
host: string; available for use by the checker command
203
created: datetime.datetime(); (UTC) object creation
204
last_enabled: datetime.datetime(); (UTC)
205
enabled: bool()
206
last_checked_ok: datetime.datetime(); (UTC) or None
207
timeout: datetime.timedelta(); How long from last_checked_ok
208
until this client is invalid
209
interval: datetime.timedelta(); How often to start a new checker
210
disable_hook: If set, called by disable() as disable_hook(self)
211
checker: subprocess.Popen(); a running checker process used
212
to see if the client lives.
213
'None' if no process is running.
179
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); object creation, not client host
182
last_checked_ok: datetime.datetime() or None if not yet checked OK
183
timeout: datetime.timedelta(); How long from last_checked_ok
184
until this client is invalid
185
interval: datetime.timedelta(); How often to start a new checker
186
stop_hook: If set, called by stop() as stop_hook(self)
187
checker: subprocess.Popen(); a running checker process used
188
to see if the client lives.
189
'None' if no process is running.
214
190
checker_initiator_tag: a gobject event source tag, or None
215
disable_initiator_tag: - '' -
191
stop_initiator_tag: - '' -
216
192
checker_callback_tag: - '' -
217
193
checker_command: string; External command which is run to check if
218
194
client lives. %() expansions are done at
219
195
runtime with vars(self) as dict, so that for
220
196
instance %(name)s can be used in the command.
221
current_checker_command: string; current running checker_command
197
Private attibutes:
198
_timeout: Real variable for 'timeout'
199
_interval: Real variable for 'interval'
200
_timeout_milliseconds: Used when calling gobject.timeout_add()
201
_interval_milliseconds: - '' -
222
202
"""
223
def timeout_milliseconds(self):
224
"Return the 'timeout' attribute in milliseconds"
225
return ((self.timeout.days * 24 * 60 * 60 * 1000)
226
+ (self.timeout.seconds * 1000)
227
+ (self.timeout.microseconds // 1000))
228
229
def interval_milliseconds(self):
230
"Return the 'interval' attribute in milliseconds"
231
return ((self.interval.days * 24 * 60 * 60 * 1000)
232
+ (self.interval.seconds * 1000)
233
+ (self.interval.microseconds // 1000))
234
235
def __init__(self, name = None, disable_hook=None, config=None):
203
def _set_timeout(self, timeout):
204
"Setter function for 'timeout' attribute"
205
self._timeout = timeout
206
self._timeout_milliseconds = ((self.timeout.days
207
* 24 * 60 * 60 * 1000)
208
+ (self.timeout.seconds * 1000)
209
+ (self.timeout.microseconds
210
// 1000))
211
timeout = property(lambda self: self._timeout,
212
_set_timeout)
213
del _set_timeout
214
def _set_interval(self, interval):
215
"Setter function for 'interval' attribute"
216
self._interval = interval
217
self._interval_milliseconds = ((self.interval.days
218
* 24 * 60 * 60 * 1000)
219
+ (self.interval.seconds
220
* 1000)
221
+ (self.interval.microseconds
222
// 1000))
223
interval = property(lambda self: self._interval,
224
_set_interval)
225
del _set_interval
226
def __init__(self, name = None, stop_hook=None, config=None):
236
227
"""Note: the 'checker' key in 'config' sets the
237
228
'checker_command' attribute and *not* the 'checker'
238
229
attribute."""
239
self.name = name
240
230
if config is None:
241
231
config = {}
232
self.name = name
242
233
logger.debug(u"Creating client %r", self.name)
243
234
# Uppercase and remove spaces from fingerprint for later
244
235
# comparison purposes with return value from the fingerprint()
245
236
# function
246
self.fingerprint = (config["fingerprint"].upper()
247
.replace(u" ", u""))
237
self.fingerprint = config["fingerprint"].upper()\
238
.replace(u" ", u"")
248
239
logger.debug(u" Fingerprint: %s", self.fingerprint)
249
240
if "secret" in config:
250
241
self.secret = config["secret"].decode(u"base64")
251
242
elif "secfile" in config:
252
with closing(open(os.path.expanduser
253
(os.path.expandvars
254
(config["secfile"])))) as secfile:
255
self.secret = secfile.read()
243
secfile = open(config["secfile"])
244
self.secret = secfile.read()
245
secfile.close()
256
246
else:
257
247
raise TypeError(u"No secret or secfile for client %s"
258
248
% self.name)
259
249
self.host = config.get("host", "")
260
self.created = datetime.datetime.utcnow()
261
self.enabled = False
262
self.last_enabled = None
250
self.created = datetime.datetime.now()
263
251
self.last_checked_ok = None
264
252
self.timeout = string_to_delta(config["timeout"])
265
253
self.interval = string_to_delta(config["interval"])
266
self.disable_hook = disable_hook
254
self.stop_hook = stop_hook
267
255
self.checker = None
268
256
self.checker_initiator_tag = None
269
self.disable_initiator_tag = None
257
self.stop_initiator_tag = None
270
258
self.checker_callback_tag = None
271
self.checker_command = config["checker"]
272
self.current_checker_command = None
273
self.last_connect = None
274
275
def enable(self):
259
self.check_command = config["checker"]
260
def start(self):
276
261
"""Start this client's checker and timeout hooks"""
277
self.last_enabled = datetime.datetime.utcnow()
278
262
# Schedule a new checker to be started an 'interval' from now,
279
263
# and every interval from then on.
280
self.checker_initiator_tag = (gobject.timeout_add
281
(self.interval_milliseconds(),
282
self.start_checker))
264
self.checker_initiator_tag = gobject.timeout_add\
265
(self._interval_milliseconds,
266
self.start_checker)
283
267
# Also start a new checker *right now*.
284
268
self.start_checker()
285
# Schedule a disable() when 'timeout' has passed
286
self.disable_initiator_tag = (gobject.timeout_add
287
(self.timeout_milliseconds(),
288
self.disable))
289
self.enabled = True
290
291
def disable(self):
292
"""Disable this client."""
293
if not getattr(self, "enabled", False):
269
# Schedule a stop() when 'timeout' has passed
270
self.stop_initiator_tag = gobject.timeout_add\
271
(self._timeout_milliseconds,
272
self.stop)
273
def stop(self):
274
"""Stop this client.
275
The possibility that a client might be restarted is left open,
276
but not currently used."""
277
# If this client doesn't have a secret, it is already stopped.
278
if hasattr(self, "secret") and self.secret:
279
logger.info(u"Stopping client %s", self.name)
280
self.secret = None
281
else:
294
282
return False
295
logger.info(u"Disabling client %s", self.name)
296
if getattr(self, "disable_initiator_tag", False):
297
gobject.source_remove(self.disable_initiator_tag)
298
self.disable_initiator_tag = None
283
if getattr(self, "stop_initiator_tag", False):
284
gobject.source_remove(self.stop_initiator_tag)
285
self.stop_initiator_tag = None
299
286
if getattr(self, "checker_initiator_tag", False):
300
287
gobject.source_remove(self.checker_initiator_tag)
301
288
self.checker_initiator_tag = None
302
289
self.stop_checker()
303
if self.disable_hook:
304
self.disable_hook(self)
305
self.enabled = False
290
if self.stop_hook:
291
self.stop_hook(self)
306
292
# Do not run this again if called by a gobject.timeout_add
307
293
return False
308
309
294
def __del__(self):
310
self.disable_hook = None
311
self.disable()
312
313
def checker_callback(self, pid, condition, command):
295
self.stop_hook = None
296
self.stop()
297
def checker_callback(self, pid, condition):
314
298
"""The checker has completed, so take appropriate actions."""
299
now = datetime.datetime.now()
315
300
self.checker_callback_tag = None
316
301
self.checker = None
317
if os.WIFEXITED(condition):
318
exitstatus = os.WEXITSTATUS(condition)
319
if exitstatus == 0:
320
logger.info(u"Checker for %(name)s succeeded",
321
vars(self))
322
self.checked_ok()
323
else:
324
logger.info(u"Checker for %(name)s failed",
325
vars(self))
326
else:
302
if os.WIFEXITED(condition) \
303
and (os.WEXITSTATUS(condition) == 0):
304
logger.info(u"Checker for %(name)s succeeded",
305
vars(self))
306
self.last_checked_ok = now
307
gobject.source_remove(self.stop_initiator_tag)
308
self.stop_initiator_tag = gobject.timeout_add\
309
(self._timeout_milliseconds,
310
self.stop)
311
elif not os.WIFEXITED(condition):
327
312
logger.warning(u"Checker for %(name)s crashed?",
328
313
vars(self))
329
330
def checked_ok(self):
331
"""Bump up the timeout for this client.
332
333
This should only be called when the client has been seen,
334
alive and well.
335
"""
336
self.last_checked_ok = datetime.datetime.utcnow()
337
gobject.source_remove(self.disable_initiator_tag)
338
self.disable_initiator_tag = (gobject.timeout_add
339
(self.timeout_milliseconds(),
340
self.disable))
341
314
else:
315
logger.info(u"Checker for %(name)s failed",
316
vars(self))
342
317
def start_checker(self):
343
318
"""Start a new checker subprocess if one is not running.
344
345
319
If a checker already exists, leave it running and do
346
320
nothing."""
347
321
# The reason for not killing a running checker is that if we
352
326
# checkers alone, the checker would have to take more time
353
327
# than 'timeout' for the client to be declared invalid, which
354
328
# is as it should be.
355
356
# If a checker exists, make sure it is not a zombie
357
if self.checker is not None:
358
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
359
if pid:
360
logger.warning("Checker was a zombie")
361
gobject.source_remove(self.checker_callback_tag)
362
self.checker_callback(pid, status,
363
self.current_checker_command)
364
# Start a new checker if needed
365
329
if self.checker is None:
366
330
try:
367
# In case checker_command has exactly one % operator
368
command = self.checker_command % self.host
331
# In case check_command has exactly one % operator
332
command = self.check_command % self.host
369
333
except TypeError:
370
334
# Escape attributes for the shell
371
335
escaped_attrs = dict((key, re.escape(str(val)))
372
336
for key, val in
373
337
vars(self).iteritems())
374
338
try:
375
command = self.checker_command % escaped_attrs
339
command = self.check_command % escaped_attrs
376
340
except TypeError, error:
377
341
logger.error(u'Could not format string "%s":'
378
u' %s', self.checker_command, error)
342
u' %s', self.check_command, error)
379
343
return True # Try again later
380
self.current_checker_command = command
381
344
try:
382
345
logger.info(u"Starting checker %r for %s",
383
346
command, self.name)
388
351
self.checker = subprocess.Popen(command,
389
352
close_fds=True,
390
353
shell=True, cwd="/")
391
self.checker_callback_tag = (gobject.child_watch_add
392
(self.checker.pid,
393
self.checker_callback,
394
data=command))
395
# The checker may have completed before the gobject
396
# watch was added. Check for this.
397
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
398
if pid:
399
gobject.source_remove(self.checker_callback_tag)
400
self.checker_callback(pid, status, command)
354
self.checker_callback_tag = gobject.child_watch_add\
355
(self.checker.pid,
356
self.checker_callback)
401
357
except OSError, error:
402
358
logger.error(u"Failed to start subprocess: %s",
403
359
error)
404
360
# Re-run this periodically if run by gobject.timeout_add
405
361
return True
406
407
362
def stop_checker(self):
408
363
"""Force the checker process, if any, to stop."""
409
364
if self.checker_callback_tag:
421
376
if error.errno != errno.ESRCH: # No such process
422
377
raise
423
378
self.checker = None
424
425
379
def still_valid(self):
426
380
"""Has the timeout not yet passed for this client?"""
427
if not getattr(self, "enabled", False):
428
return False
429
now = datetime.datetime.utcnow()
381
now = datetime.datetime.now()
430
382
if self.last_checked_ok is None:
431
383
return now < (self.created + self.timeout)
432
384
else:
433
385
return now < (self.last_checked_ok + self.timeout)
434
386
435
387
436
class ClientDBus(Client, dbus.service.Object):
437
"""A Client class using D-Bus
438
439
Attributes:
440
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
441
"""
442
# dbus.service.Object doesn't use super(), so we can't either.
443
444
def __init__(self, *args, **kwargs):
445
Client.__init__(self, *args, **kwargs)
446
# Only now, when this client is initialized, can it show up on
447
# the D-Bus
448
self.dbus_object_path = (dbus.ObjectPath
449
("/clients/"
450
+ self.name.replace(".", "_")))
451
dbus.service.Object.__init__(self, bus,
452
self.dbus_object_path)
453
def enable(self):
454
oldstate = getattr(self, "enabled", False)
455
r = Client.enable(self)
456
if oldstate != self.enabled:
457
# Emit D-Bus signals
458
self.PropertyChanged(dbus.String(u"enabled"),
459
dbus.Boolean(True, variant_level=1))
460
self.PropertyChanged(dbus.String(u"last_enabled"),
461
(_datetime_to_dbus(self.last_enabled,
462
variant_level=1)))
463
return r
464
465
def disable(self, signal = True):
466
oldstate = getattr(self, "enabled", False)
467
r = Client.disable(self)
468
if signal and oldstate != self.enabled:
469
# Emit D-Bus signal
470
self.PropertyChanged(dbus.String(u"enabled"),
471
dbus.Boolean(False, variant_level=1))
472
return r
473
474
def __del__(self, *args, **kwargs):
475
try:
476
self.remove_from_connection()
477
except LookupError:
478
pass
479
if hasattr(dbus.service.Object, "__del__"):
480
dbus.service.Object.__del__(self, *args, **kwargs)
481
Client.__del__(self, *args, **kwargs)
482
483
def checker_callback(self, pid, condition, command,
484
*args, **kwargs):
485
self.checker_callback_tag = None
486
self.checker = None
487
# Emit D-Bus signal
488
self.PropertyChanged(dbus.String(u"checker_running"),
489
dbus.Boolean(False, variant_level=1))
490
if os.WIFEXITED(condition):
491
exitstatus = os.WEXITSTATUS(condition)
492
# Emit D-Bus signal
493
self.CheckerCompleted(dbus.Int16(exitstatus),
494
dbus.Int64(condition),
495
dbus.String(command))
496
else:
497
# Emit D-Bus signal
498
self.CheckerCompleted(dbus.Int16(-1),
499
dbus.Int64(condition),
500
dbus.String(command))
501
502
return Client.checker_callback(self, pid, condition, command,
503
*args, **kwargs)
504
505
def checked_ok(self, *args, **kwargs):
506
r = Client.checked_ok(self, *args, **kwargs)
507
# Emit D-Bus signal
508
self.PropertyChanged(
509
dbus.String(u"last_checked_ok"),
510
(_datetime_to_dbus(self.last_checked_ok,
511
variant_level=1)))
512
return r
513
514
def start_checker(self, *args, **kwargs):
515
old_checker = self.checker
516
if self.checker is not None:
517
old_checker_pid = self.checker.pid
518
else:
519
old_checker_pid = None
520
r = Client.start_checker(self, *args, **kwargs)
521
# Only if new checker process was started
522
if (self.checker is not None
523
and old_checker_pid != self.checker.pid):
524
# Emit D-Bus signal
525
self.CheckerStarted(self.current_checker_command)
526
self.PropertyChanged(
527
dbus.String("checker_running"),
528
dbus.Boolean(True, variant_level=1))
529
return r
530
531
def stop_checker(self, *args, **kwargs):
532
old_checker = getattr(self, "checker", None)
533
r = Client.stop_checker(self, *args, **kwargs)
534
if (old_checker is not None
535
and getattr(self, "checker", None) is None):
536
self.PropertyChanged(dbus.String(u"checker_running"),
537
dbus.Boolean(False, variant_level=1))
538
return r
539
540
## D-Bus methods & signals
541
_interface = u"se.bsnet.fukt.Mandos.Client"
542
543
# CheckedOK - method
544
CheckedOK = dbus.service.method(_interface)(checked_ok)
545
CheckedOK.__name__ = "CheckedOK"
546
547
# CheckerCompleted - signal
548
@dbus.service.signal(_interface, signature="nxs")
549
def CheckerCompleted(self, exitcode, waitstatus, command):
550
"D-Bus signal"
551
pass
552
553
# CheckerStarted - signal
554
@dbus.service.signal(_interface, signature="s")
555
def CheckerStarted(self, command):
556
"D-Bus signal"
557
pass
558
559
# GetAllProperties - method
560
@dbus.service.method(_interface, out_signature="a{sv}")
561
def GetAllProperties(self):
562
"D-Bus method"
563
return dbus.Dictionary({
564
dbus.String("name"):
565
dbus.String(self.name, variant_level=1),
566
dbus.String("fingerprint"):
567
dbus.String(self.fingerprint, variant_level=1),
568
dbus.String("host"):
569
dbus.String(self.host, variant_level=1),
570
dbus.String("created"):
571
_datetime_to_dbus(self.created, variant_level=1),
572
dbus.String("last_enabled"):
573
(_datetime_to_dbus(self.last_enabled,
574
variant_level=1)
575
if self.last_enabled is not None
576
else dbus.Boolean(False, variant_level=1)),
577
dbus.String("enabled"):
578
dbus.Boolean(self.enabled, variant_level=1),
579
dbus.String("last_checked_ok"):
580
(_datetime_to_dbus(self.last_checked_ok,
581
variant_level=1)
582
if self.last_checked_ok is not None
583
else dbus.Boolean (False, variant_level=1)),
584
dbus.String("timeout"):
585
dbus.UInt64(self.timeout_milliseconds(),
586
variant_level=1),
587
dbus.String("interval"):
588
dbus.UInt64(self.interval_milliseconds(),
589
variant_level=1),
590
dbus.String("checker"):
591
dbus.String(self.checker_command,
592
variant_level=1),
593
dbus.String("checker_running"):
594
dbus.Boolean(self.checker is not None,
595
variant_level=1),
596
dbus.String("object_path"):
597
dbus.ObjectPath(self.dbus_object_path,
598
variant_level=1)
599
}, signature="sv")
600
601
# IsStillValid - method
602
@dbus.service.method(_interface, out_signature="b")
603
def IsStillValid(self):
604
return self.still_valid()
605
606
# PropertyChanged - signal
607
@dbus.service.signal(_interface, signature="sv")
608
def PropertyChanged(self, property, value):
609
"D-Bus signal"
610
pass
611
612
# ReceivedSecret - signal
613
@dbus.service.signal(_interface)
614
def ReceivedSecret(self):
615
"D-Bus signal"
616
pass
617
618
# Rejected - signal
619
@dbus.service.signal(_interface)
620
def Rejected(self):
621
"D-Bus signal"
622
pass
623
624
# SetChecker - method
625
@dbus.service.method(_interface, in_signature="s")
626
def SetChecker(self, checker):
627
"D-Bus setter method"
628
self.checker_command = checker
629
# Emit D-Bus signal
630
self.PropertyChanged(dbus.String(u"checker"),
631
dbus.String(self.checker_command,
632
variant_level=1))
633
634
# SetHost - method
635
@dbus.service.method(_interface, in_signature="s")
636
def SetHost(self, host):
637
"D-Bus setter method"
638
self.host = host
639
# Emit D-Bus signal
640
self.PropertyChanged(dbus.String(u"host"),
641
dbus.String(self.host, variant_level=1))
642
643
# SetInterval - method
644
@dbus.service.method(_interface, in_signature="t")
645
def SetInterval(self, milliseconds):
646
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
647
# Emit D-Bus signal
648
self.PropertyChanged(dbus.String(u"interval"),
649
(dbus.UInt64(self.interval_milliseconds(),
650
variant_level=1)))
651
652
# SetSecret - method
653
@dbus.service.method(_interface, in_signature="ay",
654
byte_arrays=True)
655
def SetSecret(self, secret):
656
"D-Bus setter method"
657
self.secret = str(secret)
658
659
# SetTimeout - method
660
@dbus.service.method(_interface, in_signature="t")
661
def SetTimeout(self, milliseconds):
662
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
663
# Emit D-Bus signal
664
self.PropertyChanged(dbus.String(u"timeout"),
665
(dbus.UInt64(self.timeout_milliseconds(),
666
variant_level=1)))
667
668
# Enable - method
669
Enable = dbus.service.method(_interface)(enable)
670
Enable.__name__ = "Enable"
671
672
# StartChecker - method
673
@dbus.service.method(_interface)
674
def StartChecker(self):
675
"D-Bus method"
676
self.start_checker()
677
678
# Disable - method
679
@dbus.service.method(_interface)
680
def Disable(self):
681
"D-Bus method"
682
self.disable()
683
684
# StopChecker - method
685
StopChecker = dbus.service.method(_interface)(stop_checker)
686
StopChecker.__name__ = "StopChecker"
687
688
del _interface
689
690
691
class ClientHandler(SocketServer.BaseRequestHandler, object):
692
"""A class to handle client connections.
693
694
Instantiated once for each connection to handle it.
388
def peer_certificate(session):
389
"Return the peer's OpenPGP certificate as a bytestring"
390
# If not an OpenPGP certificate...
391
if gnutls.library.functions.gnutls_certificate_type_get\
392
(session._c_object) \
393
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
394
# ...do the normal thing
395
return session.peer_certificate
396
list_size = ctypes.c_uint()
397
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
398
(session._c_object, ctypes.byref(list_size))
399
if list_size.value == 0:
400
return None
401
cert = cert_list[0]
402
return ctypes.string_at(cert.data, cert.size)
403
404
405
def fingerprint(openpgp):
406
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
407
# New GnuTLS "datum" with the OpenPGP public key
408
datum = gnutls.library.types.gnutls_datum_t\
409
(ctypes.cast(ctypes.c_char_p(openpgp),
410
ctypes.POINTER(ctypes.c_ubyte)),
411
ctypes.c_uint(len(openpgp)))
412
# New empty GnuTLS certificate
413
crt = gnutls.library.types.gnutls_openpgp_crt_t()
414
gnutls.library.functions.gnutls_openpgp_crt_init\
415
(ctypes.byref(crt))
416
# Import the OpenPGP public key into the certificate
417
gnutls.library.functions.gnutls_openpgp_crt_import\
418
(crt, ctypes.byref(datum),
419
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
420
# Verify the self signature in the key
421
crtverify = ctypes.c_uint()
422
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
423
(crt, 0, ctypes.byref(crtverify))
424
if crtverify.value != 0:
425
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
426
raise gnutls.errors.CertificateSecurityError("Verify failed")
427
# New buffer for the fingerprint
428
buf = ctypes.create_string_buffer(20)
429
buf_len = ctypes.c_size_t()
430
# Get the fingerprint from the certificate into the buffer
431
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
432
(crt, ctypes.byref(buf), ctypes.byref(buf_len))
433
# Deinit the certificate
434
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
435
# Convert the buffer to a Python bytestring
436
fpr = ctypes.string_at(buf, buf_len.value)
437
# Convert the bytestring to hexadecimal notation
438
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
439
return hex_fpr
440
441
442
class TCP_handler(SocketServer.BaseRequestHandler, object):
443
"""A TCP request handler class.
444
Instantiated by IPv6_TCPServer for each request to handle it.
695
445
Note: This will run in its own forked process."""
696
446
697
447
def handle(self):
698
448
logger.info(u"TCP connection from: %s",
699
unicode(self.client_address))
700
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
701
# Open IPC pipe to parent process
702
with closing(os.fdopen(self.server.pipe[1], "w", 1)) as ipc:
703
session = (gnutls.connection
704
.ClientSession(self.request,
705
gnutls.connection
706
.X509Credentials()))
707
708
line = self.request.makefile().readline()
709
logger.debug(u"Protocol version: %r", line)
710
try:
711
if int(line.strip().split()[0]) > 1:
712
raise RuntimeError
713
except (ValueError, IndexError, RuntimeError), error:
714
logger.error(u"Unknown protocol version: %s", error)
715
return
716
717
# Note: gnutls.connection.X509Credentials is really a
718
# generic GnuTLS certificate credentials object so long as
719
# no X.509 keys are added to it. Therefore, we can use it
720
# here despite using OpenPGP certificates.
721
722
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
723
# "+AES-256-CBC", "+SHA1",
724
# "+COMP-NULL", "+CTYPE-OPENPGP",
725
# "+DHE-DSS"))
726
# Use a fallback default, since this MUST be set.
727
priority = self.server.gnutls_priority
728
if priority is None:
729
priority = "NORMAL"
730
(gnutls.library.functions
731
.gnutls_priority_set_direct(session._c_object,
732
priority, None))
733
734
try:
735
session.handshake()
736
except gnutls.errors.GNUTLSError, error:
737
logger.warning(u"Handshake failed: %s", error)
738
# Do not run session.bye() here: the session is not
739
# established. Just abandon the request.
740
return
741
logger.debug(u"Handshake succeeded")
742
try:
743
fpr = self.fingerprint(self.peer_certificate(session))
744
except (TypeError, gnutls.errors.GNUTLSError), error:
745
logger.warning(u"Bad certificate: %s", error)
746
session.bye()
747
return
748
logger.debug(u"Fingerprint: %s", fpr)
749
750
for c in self.server.clients:
751
if c.fingerprint == fpr:
752
client = c
753
break
754
else:
755
ipc.write("NOTFOUND %s\n" % fpr)
756
session.bye()
757
return
758
# Have to check if client.still_valid(), since it is
759
# possible that the client timed out while establishing
760
# the GnuTLS session.
761
if not client.still_valid():
762
ipc.write("INVALID %s\n" % client.name)
763
session.bye()
764
return
765
ipc.write("SENDING %s\n" % client.name)
766
sent_size = 0
767
while sent_size < len(client.secret):
768
sent = session.send(client.secret[sent_size:])
769
logger.debug(u"Sent: %d, remaining: %d",
770
sent, len(client.secret)
771
- (sent_size + sent))
772
sent_size += sent
773
session.bye()
774
775
@staticmethod
776
def peer_certificate(session):
777
"Return the peer's OpenPGP certificate as a bytestring"
778
# If not an OpenPGP certificate...
779
if (gnutls.library.functions
780
.gnutls_certificate_type_get(session._c_object)
781
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
782
# ...do the normal thing
783
return session.peer_certificate
784
list_size = ctypes.c_uint(1)
785
cert_list = (gnutls.library.functions
786
.gnutls_certificate_get_peers
787
(session._c_object, ctypes.byref(list_size)))
788
if not bool(cert_list) and list_size.value != 0:
789
raise gnutls.errors.GNUTLSError("error getting peer"
790
" certificate")
791
if list_size.value == 0:
792
return None
793
cert = cert_list[0]
794
return ctypes.string_at(cert.data, cert.size)
795
796
@staticmethod
797
def fingerprint(openpgp):
798
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
799
# New GnuTLS "datum" with the OpenPGP public key
800
datum = (gnutls.library.types
801
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
802
ctypes.POINTER
803
(ctypes.c_ubyte)),
804
ctypes.c_uint(len(openpgp))))
805
# New empty GnuTLS certificate
806
crt = gnutls.library.types.gnutls_openpgp_crt_t()
807
(gnutls.library.functions
808
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
809
# Import the OpenPGP public key into the certificate
810
(gnutls.library.functions
811
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
812
gnutls.library.constants
813
.GNUTLS_OPENPGP_FMT_RAW))
814
# Verify the self signature in the key
815
crtverify = ctypes.c_uint()
816
(gnutls.library.functions
817
.gnutls_openpgp_crt_verify_self(crt, 0,
818
ctypes.byref(crtverify)))
819
if crtverify.value != 0:
820
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
821
raise (gnutls.errors.CertificateSecurityError
822
("Verify failed"))
823
# New buffer for the fingerprint
824
buf = ctypes.create_string_buffer(20)
825
buf_len = ctypes.c_size_t()
826
# Get the fingerprint from the certificate into the buffer
827
(gnutls.library.functions
828
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
829
ctypes.byref(buf_len)))
830
# Deinit the certificate
831
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
832
# Convert the buffer to a Python bytestring
833
fpr = ctypes.string_at(buf, buf_len.value)
834
# Convert the bytestring to hexadecimal notation
835
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
836
return hex_fpr
837
838
839
class ForkingMixInWithPipe(SocketServer.ForkingMixIn, object):
840
"""Like SocketServer.ForkingMixIn, but also pass a pipe.
841
842
Assumes a gobject.MainLoop event loop.
843
"""
844
def process_request(self, request, client_address):
845
"""Overrides and wraps the original process_request().
846
847
This function creates a new pipe in self.pipe
848
"""
849
self.pipe = os.pipe()
850
super(ForkingMixInWithPipe,
851
self).process_request(request, client_address)
852
os.close(self.pipe[1]) # close write end
853
# Call "handle_ipc" for both data and EOF events
854
gobject.io_add_watch(self.pipe[0],
855
gobject.IO_IN | gobject.IO_HUP,
856
self.handle_ipc)
857
def handle_ipc(source, condition):
858
"""Dummy function; override as necessary"""
859
os.close(source)
860
return False
861
862
863
class IPv6_TCPServer(ForkingMixInWithPipe,
864
SocketServer.TCPServer, object):
865
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
866
449
unicode(self.client_address))
450
session = gnutls.connection.ClientSession\
451
(self.request, gnutls.connection.X509Credentials())
452
453
line = self.request.makefile().readline()
454
logger.debug(u"Protocol version: %r", line)
455
try:
456
if int(line.strip().split()[0]) > 1:
457
raise RuntimeError
458
except (ValueError, IndexError, RuntimeError), error:
459
logger.error(u"Unknown protocol version: %s", error)
460
return
461
462
# Note: gnutls.connection.X509Credentials is really a generic
463
# GnuTLS certificate credentials object so long as no X.509
464
# keys are added to it. Therefore, we can use it here despite
465
# using OpenPGP certificates.
466
467
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
468
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
469
# "+DHE-DSS"))
470
priority = "NORMAL" # Fallback default, since this
471
# MUST be set.
472
if self.server.settings["priority"]:
473
priority = self.server.settings["priority"]
474
gnutls.library.functions.gnutls_priority_set_direct\
475
(session._c_object, priority, None)
476
477
try:
478
session.handshake()
479
except gnutls.errors.GNUTLSError, error:
480
logger.warning(u"Handshake failed: %s", error)
481
# Do not run session.bye() here: the session is not
482
# established. Just abandon the request.
483
return
484
try:
485
fpr = fingerprint(peer_certificate(session))
486
except (TypeError, gnutls.errors.GNUTLSError), error:
487
logger.warning(u"Bad certificate: %s", error)
488
session.bye()
489
return
490
logger.debug(u"Fingerprint: %s", fpr)
491
client = None
492
for c in self.server.clients:
493
if c.fingerprint == fpr:
494
client = c
495
break
496
if not client:
497
logger.warning(u"Client not found for fingerprint: %s",
498
fpr)
499
session.bye()
500
return
501
# Have to check if client.still_valid(), since it is possible
502
# that the client timed out while establishing the GnuTLS
503
# session.
504
if not client.still_valid():
505
logger.warning(u"Client %(name)s is invalid",
506
vars(client))
507
session.bye()
508
return
509
sent_size = 0
510
while sent_size < len(client.secret):
511
sent = session.send(client.secret[sent_size:])
512
logger.debug(u"Sent: %d, remaining: %d",
513
sent, len(client.secret)
514
- (sent_size + sent))
515
sent_size += sent
516
session.bye()
517
518
519
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
520
"""IPv6 TCP server. Accepts 'None' as address and/or port.
867
521
Attributes:
522
settings: Server settings
523
clients: Set() of Client objects
868
524
enabled: Boolean; whether this server is activated yet
869
interface: None or a network interface name (string)
870
use_ipv6: Boolean; to use IPv6 or not
871
----
872
clients: Set() of Client objects
873
gnutls_priority GnuTLS priority string
874
use_dbus: Boolean; to emit D-Bus signals or not
875
525
"""
876
def __init__(self, server_address, RequestHandlerClass,
877
interface=None, use_ipv6=True, clients=None,
878
gnutls_priority=None, use_dbus=True):
526
address_family = socket.AF_INET6
527
def __init__(self, *args, **kwargs):
528
if "settings" in kwargs:
529
self.settings = kwargs["settings"]
530
del kwargs["settings"]
531
if "clients" in kwargs:
532
self.clients = kwargs["clients"]
533
del kwargs["clients"]
879
534
self.enabled = False
880
self.interface = interface
881
if use_ipv6:
882
self.address_family = socket.AF_INET6
883
self.clients = clients
884
self.use_dbus = use_dbus
885
self.gnutls_priority = gnutls_priority
886
SocketServer.TCPServer.__init__(self, server_address,
887
RequestHandlerClass)
535
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
888
536
def server_bind(self):
889
537
"""This overrides the normal server_bind() function
890
538
to bind to an interface if one was specified, and also NOT to
891
539
bind to an address or port if they were not specified."""
892
if self.interface is not None:
540
if self.settings["interface"]:
541
# 25 is from /usr/include/asm-i486/socket.h
542
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
893
543
try:
894
544
self.socket.setsockopt(socket.SOL_SOCKET,
895
545
SO_BINDTODEVICE,
896
self.interface + '\0')
546
self.settings["interface"])
897
547
except socket.error, error:
898
548
if error[0] == errno.EPERM:
899
549
logger.error(u"No permission to"
900
550
u" bind to interface %s",
901
self.interface)
551
self.settings["interface"])
902
552
else:
903
raise
553
raise error
904
554
# Only bind(2) the socket if we really need to.
905
555
if self.server_address[0] or self.server_address[1]:
906
556
if not self.server_address[0]:
907
if self.address_family == socket.AF_INET6:
908
any_address = "::" # in6addr_any
909
else:
910
any_address = socket.INADDR_ANY
911
self.server_address = (any_address,
557
in6addr_any = "::"
558
self.server_address = (in6addr_any,
912
559
self.server_address[1])
913
560
elif not self.server_address[1]:
914
561
self.server_address = (self.server_address[0],
915
562
0)
916
# if self.interface:
563
# if self.settings["interface"]:
917
564
# self.server_address = (self.server_address[0],
918
565
# 0, # port
919
566
# 0, # flowinfo
920
567
# if_nametoindex
921
# (self.interface))
922
return SocketServer.TCPServer.server_bind(self)
568
# (self.settings
569
# ["interface"]))
570
return super(IPv6_TCPServer, self).server_bind()
923
571
def server_activate(self):
924
572
if self.enabled:
925
return SocketServer.TCPServer.server_activate(self)
573
return super(IPv6_TCPServer, self).server_activate()
926
574
def enable(self):
927
575
self.enabled = True
928
def handle_ipc(self, source, condition, file_objects={}):
929
condition_names = {
930
gobject.IO_IN: "IN", # There is data to read.
931
gobject.IO_OUT: "OUT", # Data can be written (without
932
# blocking).
933
gobject.IO_PRI: "PRI", # There is urgent data to read.
934
gobject.IO_ERR: "ERR", # Error condition.
935
gobject.IO_HUP: "HUP" # Hung up (the connection has been
936
# broken, usually for pipes and
937
# sockets).
938
}
939
conditions_string = ' | '.join(name
940
for cond, name in
941
condition_names.iteritems()
942
if cond & condition)
943
logger.debug("Handling IPC: FD = %d, condition = %s", source,
944
conditions_string)
945
946
# Turn the pipe file descriptor into a Python file object
947
if source not in file_objects:
948
file_objects[source] = os.fdopen(source, "r", 1)
949
950
# Read a line from the file object
951
cmdline = file_objects[source].readline()
952
if not cmdline: # Empty line means end of file
953
# close the IPC pipe
954
file_objects[source].close()
955
del file_objects[source]
956
957
# Stop calling this function
958
return False
959
960
logger.debug("IPC command: %r", cmdline)
961
962
# Parse and act on command
963
cmd, args = cmdline.rstrip("\r\n").split(None, 1)
964
965
if cmd == "NOTFOUND":
966
logger.warning(u"Client not found for fingerprint: %s",
967
args)
968
if self.use_dbus:
969
# Emit D-Bus signal
970
mandos_dbus_service.ClientNotFound(args)
971
elif cmd == "INVALID":
972
for client in self.clients:
973
if client.name == args:
974
logger.warning(u"Client %s is invalid", args)
975
if self.use_dbus:
976
# Emit D-Bus signal
977
client.Rejected()
978
break
979
else:
980
logger.error(u"Unknown client %s is invalid", args)
981
elif cmd == "SENDING":
982
for client in self.clients:
983
if client.name == args:
984
logger.info(u"Sending secret to %s", client.name)
985
client.checked_ok()
986
if self.use_dbus:
987
# Emit D-Bus signal
988
client.ReceivedSecret()
989
break
990
else:
991
logger.error(u"Sending secret to unknown client %s",
992
args)
993
else:
994
logger.error("Unknown IPC command: %r", cmdline)
995
996
# Keep calling this function
997
return True
998
576
999
577
1000
578
def string_to_delta(interval):
1001
579
"""Parse a string and return a datetime.timedelta
1002
580
1003
581
>>> string_to_delta('7d')
1004
582
datetime.timedelta(7)
1005
583
>>> string_to_delta('60s')
1057
635
elif state == avahi.ENTRY_GROUP_FAILURE:
1058
636
logger.critical(u"Avahi: Error in group state changed %s",
1059
637
unicode(error))
1060
raise AvahiGroupError(u"State changed: %s" % unicode(error))
638
raise AvahiGroupError("State changed: %s", str(error))
1061
639
1062
640
def if_nametoindex(interface):
1063
641
"""Call the C function if_nametoindex(), or equivalent"""
1064
642
global if_nametoindex
1065
643
try:
1066
if_nametoindex = (ctypes.cdll.LoadLibrary
1067
(ctypes.util.find_library("c"))
1068
.if_nametoindex)
644
if_nametoindex = ctypes.cdll.LoadLibrary\
645
(ctypes.util.find_library("c")).if_nametoindex
1069
646
except (OSError, AttributeError):
1070
647
if "struct" not in sys.modules:
1071
648
import struct
1074
651
def if_nametoindex(interface):
1075
652
"Get an interface index the hard way, i.e. using fcntl()"
1076
653
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1077
with closing(socket.socket()) as s:
1078
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1079
struct.pack("16s16x", interface))
654
s = socket.socket()
655
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
656
struct.pack("16s16x", interface))
657
s.close()
1080
658
interface_index = struct.unpack("I", ifreq[16:20])[0]
1081
659
return interface_index
1082
660
return if_nametoindex(interface)
1084
662
1085
663
def daemon(nochdir = False, noclose = False):
1086
664
"""See daemon(3). Standard BSD Unix function.
1087
1088
665
This should really exist as os.daemon, but it doesn't (yet)."""
1089
666
if os.fork():
1090
667
sys.exit()
1107
684
1108
685
1109
686
def main():
1110
1111
######################################################################
1112
# Parsing of options, both command line and config file
1113
1114
parser = optparse.OptionParser(version = "%%prog %s" % version)
687
parser = OptionParser(version = "%%prog %s" % version)
1115
688
parser.add_option("-i", "--interface", type="string",
1116
689
metavar="IF", help="Bind to interface IF")
1117
690
parser.add_option("-a", "--address", type="string",
1118
691
help="Address to listen for requests on")
1119
692
parser.add_option("-p", "--port", type="int",
1120
693
help="Port number to receive requests on")
1121
parser.add_option("--check", action="store_true",
694
parser.add_option("--check", action="store_true", default=False,
1122
695
help="Run self-test")
1123
696
parser.add_option("--debug", action="store_true",
1124
697
help="Debug mode; run in foreground and log to"
1131
704
default="/etc/mandos", metavar="DIR",
1132
705
help="Directory to search for configuration"
1133
706
" files")
1134
parser.add_option("--no-dbus", action="store_false",
1135
dest="use_dbus",
1136
help="Do not provide D-Bus system bus"
1137
" interface")
1138
parser.add_option("--no-ipv6", action="store_false",
1139
dest="use_ipv6", help="Do not use IPv6")
1140
707
options = parser.parse_args()[0]
1141
708
1142
709
if options.check:
1152
719
"priority":
1153
720
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1154
721
"servicename": "Mandos",
1155
"use_dbus": "True",
1156
"use_ipv6": "True",
1157
722
}
1158
723
1159
724
# Parse config file for server-global settings
1162
727
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1163
728
# Convert the SafeConfigParser object to a dict
1164
729
server_settings = server_config.defaults()
1165
# Use the appropriate methods on the non-string config options
1166
server_settings["debug"] = server_config.getboolean("DEFAULT",
1167
"debug")
1168
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
1169
"use_dbus")
1170
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
1171
"use_ipv6")
1172
if server_settings["port"]:
1173
server_settings["port"] = server_config.getint("DEFAULT",
1174
"port")
730
# Use getboolean on the boolean config option
731
server_settings["debug"] = server_config.getboolean\
732
("DEFAULT", "debug")
1175
733
del server_config
1176
734
1177
735
# Override the settings from the config file with command line
1178
736
# options, if set.
1179
737
for option in ("interface", "address", "port", "debug",
1180
"priority", "servicename", "configdir",
1181
"use_dbus", "use_ipv6"):
738
"priority", "servicename", "configdir"):
1182
739
value = getattr(options, option)
1183
740
if value is not None:
1184
741
server_settings[option] = value
1185
742
del options
1186
743
# Now we have our good server settings in "server_settings"
1187
744
1188
##################################################################
1189
1190
# For convenience
1191
745
debug = server_settings["debug"]
1192
use_dbus = server_settings["use_dbus"]
1193
use_ipv6 = server_settings["use_ipv6"]
1194
746
1195
747
if not debug:
1196
748
syslogger.setLevel(logging.WARNING)
1197
749
console.setLevel(logging.WARNING)
1198
750
1199
751
if server_settings["servicename"] != "Mandos":
1200
syslogger.setFormatter(logging.Formatter
1201
('Mandos (%s) [%%(process)d]:'
1202
' %%(levelname)s: %%(message)s'
752
syslogger.setFormatter(logging.Formatter\
753
('Mandos (%s): %%(levelname)s:'
754
' %%(message)s'
1203
755
% server_settings["servicename"]))
1204
756
1205
757
# Parse config file with clients
1206
758
client_defaults = { "timeout": "1h",
1207
759
"interval": "5m",
1208
"checker": "fping -q -- %%(host)s",
760
"checker": "fping -q -- %(host)s",
1209
761
"host": "",
1210
762
}
1211
763
client_config = ConfigParser.SafeConfigParser(client_defaults)
1212
764
client_config.read(os.path.join(server_settings["configdir"],
1213
765
"clients.conf"))
1214
1215
global mandos_dbus_service
1216
mandos_dbus_service = None
1217
766
1218
767
clients = Set()
1219
768
tcp_server = IPv6_TCPServer((server_settings["address"],
1220
769
server_settings["port"]),
1221
ClientHandler,
1222
interface=
1223
server_settings["interface"],
1224
use_ipv6=use_ipv6,
1225
clients=clients,
1226
gnutls_priority=
1227
server_settings["priority"],
1228
use_dbus=use_dbus)
770
TCP_handler,
771
settings=server_settings,
772
clients=clients)
1229
773
pidfilename = "/var/run/mandos.pid"
1230
774
try:
1231
775
pidfile = open(pidfilename, "w")
1232
except IOError:
776
except IOError, error:
1233
777
logger.error("Could not open file %r", pidfilename)
1234
778
1235
try:
1236
uid = pwd.getpwnam("_mandos").pw_uid
1237
gid = pwd.getpwnam("_mandos").pw_gid
1238
except KeyError:
1239
try:
1240
uid = pwd.getpwnam("mandos").pw_uid
1241
gid = pwd.getpwnam("mandos").pw_gid
1242
except KeyError:
1243
try:
1244
uid = pwd.getpwnam("nobody").pw_uid
1245
gid = pwd.getpwnam("nogroup").pw_gid
1246
except KeyError:
1247
uid = 65534
1248
gid = 65534
1249
try:
779
uid = 65534
780
gid = 65534
781
try:
782
uid = pwd.getpwnam("mandos").pw_uid
783
except KeyError:
784
try:
785
uid = pwd.getpwnam("nobody").pw_uid
786
except KeyError:
787
pass
788
try:
789
gid = pwd.getpwnam("mandos").pw_gid
790
except KeyError:
791
try:
792
gid = pwd.getpwnam("nogroup").pw_gid
793
except KeyError:
794
pass
795
try:
796
os.setuid(uid)
1250
797
os.setgid(gid)
1251
os.setuid(uid)
1252
798
except OSError, error:
1253
799
if error[0] != errno.EPERM:
1254
800
raise error
1255
801
1256
# Enable all possible GnuTLS debugging
1257
if debug:
1258
# "Use a log level over 10 to enable all debugging options."
1259
# - GnuTLS manual
1260
gnutls.library.functions.gnutls_global_set_log_level(11)
1261
1262
@gnutls.library.types.gnutls_log_func
1263
def debug_gnutls(level, string):
1264
logger.debug("GnuTLS: %s", string[:-1])
1265
1266
(gnutls.library.functions
1267
.gnutls_global_set_log_function(debug_gnutls))
1268
1269
802
global service
1270
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1271
803
service = AvahiService(name = server_settings["servicename"],
1272
servicetype = "_mandos._tcp",
1273
protocol = protocol)
804
servicetype = "_mandos._tcp", )
1274
805
if server_settings["interface"]:
1275
service.interface = (if_nametoindex
1276
(server_settings["interface"]))
806
service.interface = if_nametoindex\
807
(server_settings["interface"])
1277
808
1278
809
global main_loop
1279
810
global bus
1286
817
avahi.DBUS_PATH_SERVER),
1287
818
avahi.DBUS_INTERFACE_SERVER)
1288
819
# End of Avahi example code
1289
if use_dbus:
1290
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1291
1292
client_class = Client
1293
if use_dbus:
1294
client_class = ClientDBus
1295
clients.update(Set(
1296
client_class(name = section,
1297
config= dict(client_config.items(section)))
1298
for section in client_config.sections()))
820
821
def remove_from_clients(client):
822
clients.remove(client)
823
if not clients:
824
logger.critical(u"No clients left, exiting")
825
sys.exit()
826
827
clients.update(Set(Client(name = section,
828
stop_hook = remove_from_clients,
829
config
830
= dict(client_config.items(section)))
831
for section in client_config.sections()))
1299
832
if not clients:
1300
logger.warning(u"No clients defined")
833
logger.critical(u"No clients defined")
834
sys.exit(1)
1301
835
1302
836
if debug:
1303
837
# Redirect stdin so all checkers get /dev/null
1312
846
daemon()
1313
847
1314
848
try:
1315
with closing(pidfile):
1316
pid = os.getpid()
1317
pidfile.write(str(pid) + "\n")
849
pid = os.getpid()
850
pidfile.write(str(pid) + "\n")
851
pidfile.close()
1318
852
del pidfile
1319
853
except IOError:
1320
854
logger.error(u"Could not write to file %r with PID %d",
1335
869
1336
870
while clients:
1337
871
client = clients.pop()
1338
client.disable_hook = None
1339
client.disable()
872
client.stop_hook = None
873
client.stop()
1340
874
1341
875
atexit.register(cleanup)
1342
876
1345
879
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1346
880
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1347
881
1348
if use_dbus:
1349
class MandosDBusService(dbus.service.Object):
1350
"""A D-Bus proxy object"""
1351
def __init__(self):
1352
dbus.service.Object.__init__(self, bus, "/")
1353
_interface = u"se.bsnet.fukt.Mandos"
1354
1355
@dbus.service.signal(_interface, signature="oa{sv}")
1356
def ClientAdded(self, objpath, properties):
1357
"D-Bus signal"
1358
pass
1359
1360
@dbus.service.signal(_interface, signature="s")
1361
def ClientNotFound(self, fingerprint):
1362
"D-Bus signal"
1363
pass
1364
1365
@dbus.service.signal(_interface, signature="os")
1366
def ClientRemoved(self, objpath, name):
1367
"D-Bus signal"
1368
pass
1369
1370
@dbus.service.method(_interface, out_signature="ao")
1371
def GetAllClients(self):
1372
"D-Bus method"
1373
return dbus.Array(c.dbus_object_path for c in clients)
1374
1375
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1376
def GetAllClientsWithProperties(self):
1377
"D-Bus method"
1378
return dbus.Dictionary(
1379
((c.dbus_object_path, c.GetAllProperties())
1380
for c in clients),
1381
signature="oa{sv}")
1382
1383
@dbus.service.method(_interface, in_signature="o")
1384
def RemoveClient(self, object_path):
1385
"D-Bus method"
1386
for c in clients:
1387
if c.dbus_object_path == object_path:
1388
clients.remove(c)
1389
c.remove_from_connection()
1390
# Don't signal anything except ClientRemoved
1391
c.disable(signal=False)
1392
# Emit D-Bus signal
1393
self.ClientRemoved(object_path, c.name)
1394
return
1395
raise KeyError
1396
1397
del _interface
1398
1399
mandos_dbus_service = MandosDBusService()
1400
1401
882
for client in clients:
1402
if use_dbus:
1403
# Emit D-Bus signal
1404
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1405
client.GetAllProperties())
1406
client.enable()
883
client.start()
1407
884
1408
885
tcp_server.enable()
1409
886
tcp_server.server_activate()
1410
887
1411
888
# Find out what port we got
1412
889
service.port = tcp_server.socket.getsockname()[1]
1413
if use_ipv6:
1414
logger.info(u"Now listening on address %r, port %d,"
1415
" flowinfo %d, scope_id %d"
1416
% tcp_server.socket.getsockname())
1417
else: # IPv4
1418
logger.info(u"Now listening on address %r, port %d"
1419
% tcp_server.socket.getsockname())
890
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
891
u" scope_id %d" % tcp_server.socket.getsockname())
1420
892
1421
893
#service.interface = tcp_server.socket.getsockname()[3]
1422
894
1432
904
1433
905
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1434
906
lambda *args, **kwargs:
1435
(tcp_server.handle_request
1436
(*args[2:], **kwargs) or True))
907
tcp_server.handle_request\
908
(*args[2:], **kwargs) or True)
1437
909
1438
910
logger.debug(u"Starting main loop")
1439
911
main_loop.run()
1440
912
except AvahiError, error:
1441
logger.critical(u"AvahiError: %s", error)
913
logger.critical(u"AvahiError: %s" + unicode(error))
1442
914
sys.exit(1)
1443
915
except KeyboardInterrupt:
1444
916
if debug:
1445
print >> sys.stderr
1446
logger.debug("Server received KeyboardInterrupt")
1447
logger.debug("Server exiting")
917
print
1448
918
1449
919
if __name__ == '__main__':
1450
920
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0