To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 226
- compare with another revision
- download diff
- download tarball
- view history from revision 226
- Committer: Teddy Hogeborn
- Date: 2008-10-04 20:09:53 UTC
- Revision ID: teddy@fukt.bsnet.se-20081004200953-7j0fjlq6fqsxs9t2
* Makefile (DOCS): Added "plugins.d/askpass-fifo.8mandos".
(install-client-nokey): Also install
"plugins.d/askpass-fifo.8mandos".
(uninstall-client): Also uninstall "plugins.d/askpass-fifo.8mandos".
* plugins.d/askpass-fifo.xml: New.
(install-client-nokey): Also install
"plugins.d/askpass-fifo.8mandos".
(uninstall-client): Also uninstall "plugins.d/askpass-fifo.8mandos".
* plugins.d/askpass-fifo.xml: New.
- files added:
- debian/mandos-client.config
- files removed:
- NEWS
- files modified:
- INSTALL
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
31
30
# Contact the authors at <mandos@fukt.bsnet.se>.
32
31
#
33
32
34
from __future__ import division, with_statement, absolute_import
33
from __future__ import division
35
34
36
35
import SocketServer
37
36
import socket
38
import optparse
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
56
55
import logging
57
56
import logging.handlers
58
57
import pwd
59
from contextlib import closing
60
58
61
59
import dbus
62
import dbus.service
63
60
import gobject
64
61
import avahi
65
62
from dbus.mainloop.glib import DBusGMainLoop
66
63
import ctypes
67
64
import ctypes.util
68
65
69
version = "1.0.8"
66
version = "1.0"
70
67
71
68
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
78
74
logger.addHandler(syslogger)
79
75
80
76
console = logging.StreamHandler()
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
' %(message)s'))
83
79
logger.addHandler(console)
84
80
85
81
class AvahiError(Exception):
86
def __init__(self, value, *args, **kwargs):
82
def __init__(self, value):
87
83
self.value = value
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
84
super(AvahiError, self).__init__()
85
def __str__(self):
86
return repr(self.value)
91
87
92
88
class AvahiServiceError(AvahiError):
93
89
pass
113
109
a sensible number of times
114
110
"""
115
111
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768,
118
protocol = avahi.PROTO_UNSPEC):
112
servicetype = None, port = None, TXT = None, domain = "",
113
host = "", max_renames = 32768):
119
114
self.interface = interface
120
115
self.name = name
121
116
self.type = servicetype
122
117
self.port = port
123
self.TXT = TXT if TXT is not None else []
118
if TXT is None:
119
self.TXT = []
120
else:
121
self.TXT = TXT
124
122
self.domain = domain
125
123
self.host = host
126
124
self.rename_count = 0
127
125
self.max_renames = max_renames
128
self.protocol = protocol
129
126
def rename(self):
130
127
"""Derived from the Avahi example code"""
131
128
if self.rename_count >= self.max_renames:
132
129
logger.critical(u"No suitable Zeroconf service name found"
133
130
u" after %i retries, exiting.",
134
131
self.rename_count)
135
raise AvahiServiceError(u"Too many renames")
132
raise AvahiServiceError("Too many renames")
136
133
self.name = server.GetAlternativeServiceName(self.name)
137
134
logger.info(u"Changing Zeroconf service name to %r ...",
138
135
str(self.name))
139
syslogger.setFormatter(logging.Formatter
140
('Mandos (%s) [%%(process)d]:'
141
' %%(levelname)s: %%(message)s'
142
% self.name))
136
syslogger.setFormatter(logging.Formatter\
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
143
139
self.remove()
144
140
self.add()
145
141
self.rename_count += 1
151
147
"""Derived from the Avahi example code"""
152
148
global group
153
149
if group is None:
154
group = dbus.Interface(bus.get_object
155
(avahi.DBUS_NAME,
150
group = dbus.Interface\
151
(bus.get_object(avahi.DBUS_NAME,
156
152
server.EntryGroupNew()),
157
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
158
154
group.connect_to_signal('StateChanged',
159
155
entry_group_state_changed)
160
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
161
157
service.name, service.type)
162
158
group.AddService(
163
159
self.interface, # interface
164
self.protocol, # protocol
160
avahi.PROTO_INET6, # protocol
165
161
dbus.UInt32(0), # flags
166
162
self.name, self.type,
167
163
self.domain, self.host,
174
170
# End of Avahi example code
175
171
176
172
177
def _datetime_to_dbus(dt, variant_level=0):
178
"""Convert a UTC datetime.datetime() to a D-Bus type."""
179
return dbus.String(dt.isoformat(), variant_level=variant_level)
180
181
182
173
class Client(object):
183
174
"""A representation of a client host served by this server.
184
175
Attributes:
185
name: string; from the config file, used in log messages and
186
D-Bus identifiers
176
name: string; from the config file, used in log messages
187
177
fingerprint: string (40 or 32 hexadecimal digits); used to
188
178
uniquely identify the client
189
secret: bytestring; sent verbatim (over TLS) to client
190
host: string; available for use by the checker command
191
created: datetime.datetime(); (UTC) object creation
192
last_enabled: datetime.datetime(); (UTC)
193
enabled: bool()
194
last_checked_ok: datetime.datetime(); (UTC) or None
195
timeout: datetime.timedelta(); How long from last_checked_ok
196
until this client is invalid
197
interval: datetime.timedelta(); How often to start a new checker
198
disable_hook: If set, called by disable() as disable_hook(self)
199
checker: subprocess.Popen(); a running checker process used
200
to see if the client lives.
201
'None' if no process is running.
179
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); object creation, not client host
182
last_checked_ok: datetime.datetime() or None if not yet checked OK
183
timeout: datetime.timedelta(); How long from last_checked_ok
184
until this client is invalid
185
interval: datetime.timedelta(); How often to start a new checker
186
stop_hook: If set, called by stop() as stop_hook(self)
187
checker: subprocess.Popen(); a running checker process used
188
to see if the client lives.
189
'None' if no process is running.
202
190
checker_initiator_tag: a gobject event source tag, or None
203
disable_initiator_tag: - '' -
191
stop_initiator_tag: - '' -
204
192
checker_callback_tag: - '' -
205
193
checker_command: string; External command which is run to check if
206
194
client lives. %() expansions are done at
207
195
runtime with vars(self) as dict, so that for
208
196
instance %(name)s can be used in the command.
209
current_checker_command: string; current running checker_command
197
Private attibutes:
198
_timeout: Real variable for 'timeout'
199
_interval: Real variable for 'interval'
200
_timeout_milliseconds: Used when calling gobject.timeout_add()
201
_interval_milliseconds: - '' -
210
202
"""
211
def timeout_milliseconds(self):
212
"Return the 'timeout' attribute in milliseconds"
213
return ((self.timeout.days * 24 * 60 * 60 * 1000)
214
+ (self.timeout.seconds * 1000)
215
+ (self.timeout.microseconds // 1000))
216
217
def interval_milliseconds(self):
218
"Return the 'interval' attribute in milliseconds"
219
return ((self.interval.days * 24 * 60 * 60 * 1000)
220
+ (self.interval.seconds * 1000)
221
+ (self.interval.microseconds // 1000))
222
223
def __init__(self, name = None, disable_hook=None, config=None):
203
def _set_timeout(self, timeout):
204
"Setter function for 'timeout' attribute"
205
self._timeout = timeout
206
self._timeout_milliseconds = ((self.timeout.days
207
* 24 * 60 * 60 * 1000)
208
+ (self.timeout.seconds * 1000)
209
+ (self.timeout.microseconds
210
// 1000))
211
timeout = property(lambda self: self._timeout,
212
_set_timeout)
213
del _set_timeout
214
def _set_interval(self, interval):
215
"Setter function for 'interval' attribute"
216
self._interval = interval
217
self._interval_milliseconds = ((self.interval.days
218
* 24 * 60 * 60 * 1000)
219
+ (self.interval.seconds
220
* 1000)
221
+ (self.interval.microseconds
222
// 1000))
223
interval = property(lambda self: self._interval,
224
_set_interval)
225
del _set_interval
226
def __init__(self, name = None, stop_hook=None, config=None):
224
227
"""Note: the 'checker' key in 'config' sets the
225
228
'checker_command' attribute and *not* the 'checker'
226
229
attribute."""
227
self.name = name
228
230
if config is None:
229
231
config = {}
232
self.name = name
230
233
logger.debug(u"Creating client %r", self.name)
231
234
# Uppercase and remove spaces from fingerprint for later
232
235
# comparison purposes with return value from the fingerprint()
233
236
# function
234
self.fingerprint = (config["fingerprint"].upper()
235
.replace(u" ", u""))
237
self.fingerprint = config["fingerprint"].upper()\
238
.replace(u" ", u"")
236
239
logger.debug(u" Fingerprint: %s", self.fingerprint)
237
240
if "secret" in config:
238
241
self.secret = config["secret"].decode(u"base64")
239
242
elif "secfile" in config:
240
with closing(open(os.path.expanduser
241
(os.path.expandvars
242
(config["secfile"])))) as secfile:
243
self.secret = secfile.read()
243
secfile = open(os.path.expanduser(os.path.expandvars
244
(config["secfile"])))
245
self.secret = secfile.read()
246
secfile.close()
244
247
else:
245
248
raise TypeError(u"No secret or secfile for client %s"
246
249
% self.name)
247
250
self.host = config.get("host", "")
248
self.created = datetime.datetime.utcnow()
249
self.enabled = False
250
self.last_enabled = None
251
self.created = datetime.datetime.now()
251
252
self.last_checked_ok = None
252
253
self.timeout = string_to_delta(config["timeout"])
253
254
self.interval = string_to_delta(config["interval"])
254
self.disable_hook = disable_hook
255
self.stop_hook = stop_hook
255
256
self.checker = None
256
257
self.checker_initiator_tag = None
257
self.disable_initiator_tag = None
258
self.stop_initiator_tag = None
258
259
self.checker_callback_tag = None
259
self.checker_command = config["checker"]
260
self.current_checker_command = None
261
self.last_connect = None
262
263
def enable(self):
260
self.check_command = config["checker"]
261
def start(self):
264
262
"""Start this client's checker and timeout hooks"""
265
self.last_enabled = datetime.datetime.utcnow()
266
263
# Schedule a new checker to be started an 'interval' from now,
267
264
# and every interval from then on.
268
self.checker_initiator_tag = (gobject.timeout_add
269
(self.interval_milliseconds(),
270
self.start_checker))
265
self.checker_initiator_tag = gobject.timeout_add\
266
(self._interval_milliseconds,
267
self.start_checker)
271
268
# Also start a new checker *right now*.
272
269
self.start_checker()
273
# Schedule a disable() when 'timeout' has passed
274
self.disable_initiator_tag = (gobject.timeout_add
275
(self.timeout_milliseconds(),
276
self.disable))
277
self.enabled = True
278
279
def disable(self):
280
"""Disable this client."""
281
if not getattr(self, "enabled", False):
270
# Schedule a stop() when 'timeout' has passed
271
self.stop_initiator_tag = gobject.timeout_add\
272
(self._timeout_milliseconds,
273
self.stop)
274
def stop(self):
275
"""Stop this client.
276
The possibility that a client might be restarted is left open,
277
but not currently used."""
278
# If this client doesn't have a secret, it is already stopped.
279
if hasattr(self, "secret") and self.secret:
280
logger.info(u"Stopping client %s", self.name)
281
self.secret = None
282
else:
282
283
return False
283
logger.info(u"Disabling client %s", self.name)
284
if getattr(self, "disable_initiator_tag", False):
285
gobject.source_remove(self.disable_initiator_tag)
286
self.disable_initiator_tag = None
284
if getattr(self, "stop_initiator_tag", False):
285
gobject.source_remove(self.stop_initiator_tag)
286
self.stop_initiator_tag = None
287
287
if getattr(self, "checker_initiator_tag", False):
288
288
gobject.source_remove(self.checker_initiator_tag)
289
289
self.checker_initiator_tag = None
290
290
self.stop_checker()
291
if self.disable_hook:
292
self.disable_hook(self)
293
self.enabled = False
291
if self.stop_hook:
292
self.stop_hook(self)
294
293
# Do not run this again if called by a gobject.timeout_add
295
294
return False
296
297
295
def __del__(self):
298
self.disable_hook = None
299
self.disable()
300
301
def checker_callback(self, pid, condition, command):
296
self.stop_hook = None
297
self.stop()
298
def checker_callback(self, pid, condition):
302
299
"""The checker has completed, so take appropriate actions."""
300
now = datetime.datetime.now()
303
301
self.checker_callback_tag = None
304
302
self.checker = None
305
if os.WIFEXITED(condition):
306
exitstatus = os.WEXITSTATUS(condition)
307
if exitstatus == 0:
308
logger.info(u"Checker for %(name)s succeeded",
309
vars(self))
310
self.checked_ok()
311
else:
312
logger.info(u"Checker for %(name)s failed",
313
vars(self))
314
else:
303
if os.WIFEXITED(condition) \
304
and (os.WEXITSTATUS(condition) == 0):
305
logger.info(u"Checker for %(name)s succeeded",
306
vars(self))
307
self.last_checked_ok = now
308
gobject.source_remove(self.stop_initiator_tag)
309
self.stop_initiator_tag = gobject.timeout_add\
310
(self._timeout_milliseconds,
311
self.stop)
312
elif not os.WIFEXITED(condition):
315
313
logger.warning(u"Checker for %(name)s crashed?",
316
314
vars(self))
317
318
def checked_ok(self):
319
"""Bump up the timeout for this client.
320
This should only be called when the client has been seen,
321
alive and well.
322
"""
323
self.last_checked_ok = datetime.datetime.utcnow()
324
gobject.source_remove(self.disable_initiator_tag)
325
self.disable_initiator_tag = (gobject.timeout_add
326
(self.timeout_milliseconds(),
327
self.disable))
328
315
else:
316
logger.info(u"Checker for %(name)s failed",
317
vars(self))
329
318
def start_checker(self):
330
319
"""Start a new checker subprocess if one is not running.
331
320
If a checker already exists, leave it running and do
338
327
# checkers alone, the checker would have to take more time
339
328
# than 'timeout' for the client to be declared invalid, which
340
329
# is as it should be.
341
342
# If a checker exists, make sure it is not a zombie
343
if self.checker is not None:
344
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
345
if pid:
346
logger.warning("Checker was a zombie")
347
gobject.source_remove(self.checker_callback_tag)
348
self.checker_callback(pid, status,
349
self.current_checker_command)
350
# Start a new checker if needed
351
330
if self.checker is None:
352
331
try:
353
# In case checker_command has exactly one % operator
354
command = self.checker_command % self.host
332
# In case check_command has exactly one % operator
333
command = self.check_command % self.host
355
334
except TypeError:
356
335
# Escape attributes for the shell
357
336
escaped_attrs = dict((key, re.escape(str(val)))
358
337
for key, val in
359
338
vars(self).iteritems())
360
339
try:
361
command = self.checker_command % escaped_attrs
340
command = self.check_command % escaped_attrs
362
341
except TypeError, error:
363
342
logger.error(u'Could not format string "%s":'
364
u' %s', self.checker_command, error)
343
u' %s', self.check_command, error)
365
344
return True # Try again later
366
self.current_checker_command = command
367
345
try:
368
346
logger.info(u"Starting checker %r for %s",
369
347
command, self.name)
374
352
self.checker = subprocess.Popen(command,
375
353
close_fds=True,
376
354
shell=True, cwd="/")
377
self.checker_callback_tag = (gobject.child_watch_add
378
(self.checker.pid,
379
self.checker_callback,
380
data=command))
381
# The checker may have completed before the gobject
382
# watch was added. Check for this.
383
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
384
if pid:
385
gobject.source_remove(self.checker_callback_tag)
386
self.checker_callback(pid, status, command)
355
self.checker_callback_tag = gobject.child_watch_add\
356
(self.checker.pid,
357
self.checker_callback)
387
358
except OSError, error:
388
359
logger.error(u"Failed to start subprocess: %s",
389
360
error)
390
361
# Re-run this periodically if run by gobject.timeout_add
391
362
return True
392
393
363
def stop_checker(self):
394
364
"""Force the checker process, if any, to stop."""
395
365
if self.checker_callback_tag:
407
377
if error.errno != errno.ESRCH: # No such process
408
378
raise
409
379
self.checker = None
410
411
380
def still_valid(self):
412
381
"""Has the timeout not yet passed for this client?"""
413
if not getattr(self, "enabled", False):
414
return False
415
now = datetime.datetime.utcnow()
382
now = datetime.datetime.now()
416
383
if self.last_checked_ok is None:
417
384
return now < (self.created + self.timeout)
418
385
else:
419
386
return now < (self.last_checked_ok + self.timeout)
420
387
421
388
422
class ClientDBus(Client, dbus.service.Object):
423
"""A Client class using D-Bus
424
Attributes:
425
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
426
"""
427
# dbus.service.Object doesn't use super(), so we can't either.
428
429
def __init__(self, *args, **kwargs):
430
Client.__init__(self, *args, **kwargs)
431
# Only now, when this client is initialized, can it show up on
432
# the D-Bus
433
self.dbus_object_path = (dbus.ObjectPath
434
("/clients/"
435
+ self.name.replace(".", "_")))
436
dbus.service.Object.__init__(self, bus,
437
self.dbus_object_path)
438
def enable(self):
439
oldstate = getattr(self, "enabled", False)
440
r = Client.enable(self)
441
if oldstate != self.enabled:
442
# Emit D-Bus signals
443
self.PropertyChanged(dbus.String(u"enabled"),
444
dbus.Boolean(True, variant_level=1))
445
self.PropertyChanged(dbus.String(u"last_enabled"),
446
(_datetime_to_dbus(self.last_enabled,
447
variant_level=1)))
448
return r
449
450
def disable(self, signal = True):
451
oldstate = getattr(self, "enabled", False)
452
r = Client.disable(self)
453
if signal and oldstate != self.enabled:
454
# Emit D-Bus signal
455
self.PropertyChanged(dbus.String(u"enabled"),
456
dbus.Boolean(False, variant_level=1))
457
return r
458
459
def __del__(self, *args, **kwargs):
460
try:
461
self.remove_from_connection()
462
except org.freedesktop.DBus.Python.LookupError:
463
pass
464
dbus.service.Object.__del__(self, *args, **kwargs)
465
Client.__del__(self, *args, **kwargs)
466
467
def checker_callback(self, pid, condition, command,
468
*args, **kwargs):
469
self.checker_callback_tag = None
470
self.checker = None
471
# Emit D-Bus signal
472
self.PropertyChanged(dbus.String(u"checker_running"),
473
dbus.Boolean(False, variant_level=1))
474
if os.WIFEXITED(condition):
475
exitstatus = os.WEXITSTATUS(condition)
476
# Emit D-Bus signal
477
self.CheckerCompleted(dbus.Int16(exitstatus),
478
dbus.Int64(condition),
479
dbus.String(command))
480
else:
481
# Emit D-Bus signal
482
self.CheckerCompleted(dbus.Int16(-1),
483
dbus.Int64(condition),
484
dbus.String(command))
485
486
return Client.checker_callback(self, pid, condition, command,
487
*args, **kwargs)
488
489
def checked_ok(self, *args, **kwargs):
490
r = Client.checked_ok(self, *args, **kwargs)
491
# Emit D-Bus signal
492
self.PropertyChanged(
493
dbus.String(u"last_checked_ok"),
494
(_datetime_to_dbus(self.last_checked_ok,
495
variant_level=1)))
496
return r
497
498
def start_checker(self, *args, **kwargs):
499
old_checker = self.checker
500
if self.checker is not None:
501
old_checker_pid = self.checker.pid
502
else:
503
old_checker_pid = None
504
r = Client.start_checker(self, *args, **kwargs)
505
# Only emit D-Bus signal if new checker process was started
506
if ((self.checker is not None)
507
and not (old_checker is not None
508
and old_checker_pid == self.checker.pid)):
509
self.CheckerStarted(self.current_checker_command)
510
self.PropertyChanged(
511
dbus.String("checker_running"),
512
dbus.Boolean(True, variant_level=1))
513
return r
514
515
def stop_checker(self, *args, **kwargs):
516
old_checker = getattr(self, "checker", None)
517
r = Client.stop_checker(self, *args, **kwargs)
518
if (old_checker is not None
519
and getattr(self, "checker", None) is None):
520
self.PropertyChanged(dbus.String(u"checker_running"),
521
dbus.Boolean(False, variant_level=1))
522
return r
523
524
## D-Bus methods & signals
525
_interface = u"se.bsnet.fukt.Mandos.Client"
526
527
# CheckedOK - method
528
CheckedOK = dbus.service.method(_interface)(checked_ok)
529
CheckedOK.__name__ = "CheckedOK"
530
531
# CheckerCompleted - signal
532
@dbus.service.signal(_interface, signature="nxs")
533
def CheckerCompleted(self, exitcode, waitstatus, command):
534
"D-Bus signal"
535
pass
536
537
# CheckerStarted - signal
538
@dbus.service.signal(_interface, signature="s")
539
def CheckerStarted(self, command):
540
"D-Bus signal"
541
pass
542
543
# GetAllProperties - method
544
@dbus.service.method(_interface, out_signature="a{sv}")
545
def GetAllProperties(self):
546
"D-Bus method"
547
return dbus.Dictionary({
548
dbus.String("name"):
549
dbus.String(self.name, variant_level=1),
550
dbus.String("fingerprint"):
551
dbus.String(self.fingerprint, variant_level=1),
552
dbus.String("host"):
553
dbus.String(self.host, variant_level=1),
554
dbus.String("created"):
555
_datetime_to_dbus(self.created, variant_level=1),
556
dbus.String("last_enabled"):
557
(_datetime_to_dbus(self.last_enabled,
558
variant_level=1)
559
if self.last_enabled is not None
560
else dbus.Boolean(False, variant_level=1)),
561
dbus.String("enabled"):
562
dbus.Boolean(self.enabled, variant_level=1),
563
dbus.String("last_checked_ok"):
564
(_datetime_to_dbus(self.last_checked_ok,
565
variant_level=1)
566
if self.last_checked_ok is not None
567
else dbus.Boolean (False, variant_level=1)),
568
dbus.String("timeout"):
569
dbus.UInt64(self.timeout_milliseconds(),
570
variant_level=1),
571
dbus.String("interval"):
572
dbus.UInt64(self.interval_milliseconds(),
573
variant_level=1),
574
dbus.String("checker"):
575
dbus.String(self.checker_command,
576
variant_level=1),
577
dbus.String("checker_running"):
578
dbus.Boolean(self.checker is not None,
579
variant_level=1),
580
dbus.String("object_path"):
581
dbus.ObjectPath(self.dbus_object_path,
582
variant_level=1)
583
}, signature="sv")
584
585
# IsStillValid - method
586
@dbus.service.method(_interface, out_signature="b")
587
def IsStillValid(self):
588
return self.still_valid()
589
590
# PropertyChanged - signal
591
@dbus.service.signal(_interface, signature="sv")
592
def PropertyChanged(self, property, value):
593
"D-Bus signal"
594
pass
595
596
# ReceivedSecret - signal
597
@dbus.service.signal(_interface)
598
def ReceivedSecret(self):
599
"D-Bus signal"
600
pass
601
602
# Rejected - signal
603
@dbus.service.signal(_interface)
604
def Rejected(self):
605
"D-Bus signal"
606
pass
607
608
# SetChecker - method
609
@dbus.service.method(_interface, in_signature="s")
610
def SetChecker(self, checker):
611
"D-Bus setter method"
612
self.checker_command = checker
613
# Emit D-Bus signal
614
self.PropertyChanged(dbus.String(u"checker"),
615
dbus.String(self.checker_command,
616
variant_level=1))
617
618
# SetHost - method
619
@dbus.service.method(_interface, in_signature="s")
620
def SetHost(self, host):
621
"D-Bus setter method"
622
self.host = host
623
# Emit D-Bus signal
624
self.PropertyChanged(dbus.String(u"host"),
625
dbus.String(self.host, variant_level=1))
626
627
# SetInterval - method
628
@dbus.service.method(_interface, in_signature="t")
629
def SetInterval(self, milliseconds):
630
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
631
# Emit D-Bus signal
632
self.PropertyChanged(dbus.String(u"interval"),
633
(dbus.UInt64(self.interval_milliseconds(),
634
variant_level=1)))
635
636
# SetSecret - method
637
@dbus.service.method(_interface, in_signature="ay",
638
byte_arrays=True)
639
def SetSecret(self, secret):
640
"D-Bus setter method"
641
self.secret = str(secret)
642
643
# SetTimeout - method
644
@dbus.service.method(_interface, in_signature="t")
645
def SetTimeout(self, milliseconds):
646
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
647
# Emit D-Bus signal
648
self.PropertyChanged(dbus.String(u"timeout"),
649
(dbus.UInt64(self.timeout_milliseconds(),
650
variant_level=1)))
651
652
# Enable - method
653
Enable = dbus.service.method(_interface)(enable)
654
Enable.__name__ = "Enable"
655
656
# StartChecker - method
657
@dbus.service.method(_interface)
658
def StartChecker(self):
659
"D-Bus method"
660
self.start_checker()
661
662
# Disable - method
663
@dbus.service.method(_interface)
664
def Disable(self):
665
"D-Bus method"
666
self.disable()
667
668
# StopChecker - method
669
StopChecker = dbus.service.method(_interface)(stop_checker)
670
StopChecker.__name__ = "StopChecker"
671
672
del _interface
673
674
675
389
def peer_certificate(session):
676
390
"Return the peer's OpenPGP certificate as a bytestring"
677
391
# If not an OpenPGP certificate...
678
if (gnutls.library.functions
679
.gnutls_certificate_type_get(session._c_object)
680
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
392
if gnutls.library.functions.gnutls_certificate_type_get\
393
(session._c_object) \
394
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
681
395
# ...do the normal thing
682
396
return session.peer_certificate
683
list_size = ctypes.c_uint(1)
684
cert_list = (gnutls.library.functions
685
.gnutls_certificate_get_peers
686
(session._c_object, ctypes.byref(list_size)))
687
if not bool(cert_list) and list_size.value != 0:
688
raise gnutls.errors.GNUTLSError("error getting peer"
689
" certificate")
397
list_size = ctypes.c_uint()
398
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
399
(session._c_object, ctypes.byref(list_size))
690
400
if list_size.value == 0:
691
401
return None
692
402
cert = cert_list[0]
696
406
def fingerprint(openpgp):
697
407
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
698
408
# New GnuTLS "datum" with the OpenPGP public key
699
datum = (gnutls.library.types
700
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
701
ctypes.POINTER
702
(ctypes.c_ubyte)),
703
ctypes.c_uint(len(openpgp))))
409
datum = gnutls.library.types.gnutls_datum_t\
410
(ctypes.cast(ctypes.c_char_p(openpgp),
411
ctypes.POINTER(ctypes.c_ubyte)),
412
ctypes.c_uint(len(openpgp)))
704
413
# New empty GnuTLS certificate
705
414
crt = gnutls.library.types.gnutls_openpgp_crt_t()
706
(gnutls.library.functions
707
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
415
gnutls.library.functions.gnutls_openpgp_crt_init\
416
(ctypes.byref(crt))
708
417
# Import the OpenPGP public key into the certificate
709
(gnutls.library.functions
710
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
711
gnutls.library.constants
712
.GNUTLS_OPENPGP_FMT_RAW))
418
gnutls.library.functions.gnutls_openpgp_crt_import\
419
(crt, ctypes.byref(datum),
420
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
713
421
# Verify the self signature in the key
714
422
crtverify = ctypes.c_uint()
715
(gnutls.library.functions
716
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
423
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
424
(crt, 0, ctypes.byref(crtverify))
717
425
if crtverify.value != 0:
718
426
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
719
427
raise gnutls.errors.CertificateSecurityError("Verify failed")
721
429
buf = ctypes.create_string_buffer(20)
722
430
buf_len = ctypes.c_size_t()
723
431
# Get the fingerprint from the certificate into the buffer
724
(gnutls.library.functions
725
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
726
ctypes.byref(buf_len)))
432
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
433
(crt, ctypes.byref(buf), ctypes.byref(buf_len))
727
434
# Deinit the certificate
728
435
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
729
436
# Convert the buffer to a Python bytestring
740
447
741
448
def handle(self):
742
449
logger.info(u"TCP connection from: %s",
743
unicode(self.client_address))
744
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
745
# Open IPC pipe to parent process
746
with closing(os.fdopen(self.server.pipe[1], "w", 1)) as ipc:
747
session = (gnutls.connection
748
.ClientSession(self.request,
749
gnutls.connection
750
.X509Credentials()))
751
752
line = self.request.makefile().readline()
753
logger.debug(u"Protocol version: %r", line)
754
try:
755
if int(line.strip().split()[0]) > 1:
756
raise RuntimeError
757
except (ValueError, IndexError, RuntimeError), error:
758
logger.error(u"Unknown protocol version: %s", error)
759
return
760
761
# Note: gnutls.connection.X509Credentials is really a
762
# generic GnuTLS certificate credentials object so long as
763
# no X.509 keys are added to it. Therefore, we can use it
764
# here despite using OpenPGP certificates.
765
766
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
767
# "+AES-256-CBC", "+SHA1",
768
# "+COMP-NULL", "+CTYPE-OPENPGP",
769
# "+DHE-DSS"))
770
# Use a fallback default, since this MUST be set.
771
priority = self.server.settings.get("priority", "NORMAL")
772
(gnutls.library.functions
773
.gnutls_priority_set_direct(session._c_object,
774
priority, None))
775
776
try:
777
session.handshake()
778
except gnutls.errors.GNUTLSError, error:
779
logger.warning(u"Handshake failed: %s", error)
780
# Do not run session.bye() here: the session is not
781
# established. Just abandon the request.
782
return
783
logger.debug(u"Handshake succeeded")
784
try:
785
fpr = fingerprint(peer_certificate(session))
786
except (TypeError, gnutls.errors.GNUTLSError), error:
787
logger.warning(u"Bad certificate: %s", error)
788
session.bye()
789
return
790
logger.debug(u"Fingerprint: %s", fpr)
791
792
for c in self.server.clients:
793
if c.fingerprint == fpr:
794
client = c
795
break
796
else:
797
logger.warning(u"Client not found for fingerprint: %s",
798
fpr)
799
ipc.write("NOTFOUND %s\n" % fpr)
800
session.bye()
801
return
802
# Have to check if client.still_valid(), since it is
803
# possible that the client timed out while establishing
804
# the GnuTLS session.
805
if not client.still_valid():
806
logger.warning(u"Client %(name)s is invalid",
807
vars(client))
808
ipc.write("INVALID %s\n" % client.name)
809
session.bye()
810
return
811
ipc.write("SENDING %s\n" % client.name)
812
sent_size = 0
813
while sent_size < len(client.secret):
814
sent = session.send(client.secret[sent_size:])
815
logger.debug(u"Sent: %d, remaining: %d",
816
sent, len(client.secret)
817
- (sent_size + sent))
818
sent_size += sent
819
session.bye()
820
821
822
class ForkingMixInWithPipe(SocketServer.ForkingMixIn, object):
823
"""Like SocketServer.ForkingMixIn, but also pass a pipe.
824
Assumes a gobject.MainLoop event loop.
825
"""
826
def process_request(self, request, client_address):
827
"""This overrides and wraps the original process_request().
828
This function creates a new pipe in self.pipe
829
"""
830
self.pipe = os.pipe()
831
super(ForkingMixInWithPipe,
832
self).process_request(request, client_address)
833
os.close(self.pipe[1]) # close write end
834
# Call "handle_ipc" for both data and EOF events
835
gobject.io_add_watch(self.pipe[0],
836
gobject.IO_IN | gobject.IO_HUP,
837
self.handle_ipc)
838
def handle_ipc(source, condition):
839
"""Dummy function; override as necessary"""
840
os.close(source)
841
return False
842
843
844
class IPv6_TCPServer(ForkingMixInWithPipe,
845
SocketServer.TCPServer, object):
846
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
450
unicode(self.client_address))
451
session = gnutls.connection.ClientSession\
452
(self.request, gnutls.connection.X509Credentials())
453
454
line = self.request.makefile().readline()
455
logger.debug(u"Protocol version: %r", line)
456
try:
457
if int(line.strip().split()[0]) > 1:
458
raise RuntimeError
459
except (ValueError, IndexError, RuntimeError), error:
460
logger.error(u"Unknown protocol version: %s", error)
461
return
462
463
# Note: gnutls.connection.X509Credentials is really a generic
464
# GnuTLS certificate credentials object so long as no X.509
465
# keys are added to it. Therefore, we can use it here despite
466
# using OpenPGP certificates.
467
468
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
469
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
470
# "+DHE-DSS"))
471
priority = "NORMAL" # Fallback default, since this
472
# MUST be set.
473
if self.server.settings["priority"]:
474
priority = self.server.settings["priority"]
475
gnutls.library.functions.gnutls_priority_set_direct\
476
(session._c_object, priority, None)
477
478
try:
479
session.handshake()
480
except gnutls.errors.GNUTLSError, error:
481
logger.warning(u"Handshake failed: %s", error)
482
# Do not run session.bye() here: the session is not
483
# established. Just abandon the request.
484
return
485
try:
486
fpr = fingerprint(peer_certificate(session))
487
except (TypeError, gnutls.errors.GNUTLSError), error:
488
logger.warning(u"Bad certificate: %s", error)
489
session.bye()
490
return
491
logger.debug(u"Fingerprint: %s", fpr)
492
client = None
493
for c in self.server.clients:
494
if c.fingerprint == fpr:
495
client = c
496
break
497
if not client:
498
logger.warning(u"Client not found for fingerprint: %s",
499
fpr)
500
session.bye()
501
return
502
# Have to check if client.still_valid(), since it is possible
503
# that the client timed out while establishing the GnuTLS
504
# session.
505
if not client.still_valid():
506
logger.warning(u"Client %(name)s is invalid",
507
vars(client))
508
session.bye()
509
return
510
sent_size = 0
511
while sent_size < len(client.secret):
512
sent = session.send(client.secret[sent_size:])
513
logger.debug(u"Sent: %d, remaining: %d",
514
sent, len(client.secret)
515
- (sent_size + sent))
516
sent_size += sent
517
session.bye()
518
519
520
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
521
"""IPv6 TCP server. Accepts 'None' as address and/or port.
847
522
Attributes:
848
523
settings: Server settings
849
524
clients: Set() of Client objects
857
532
if "clients" in kwargs:
858
533
self.clients = kwargs["clients"]
859
534
del kwargs["clients"]
860
if "use_ipv6" in kwargs:
861
if not kwargs["use_ipv6"]:
862
self.address_family = socket.AF_INET
863
del kwargs["use_ipv6"]
864
535
self.enabled = False
865
536
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
866
537
def server_bind(self):
880
551
u" bind to interface %s",
881
552
self.settings["interface"])
882
553
else:
883
raise
554
raise error
884
555
# Only bind(2) the socket if we really need to.
885
556
if self.server_address[0] or self.server_address[1]:
886
557
if not self.server_address[0]:
887
if self.address_family == socket.AF_INET6:
888
any_address = "::" # in6addr_any
889
else:
890
any_address = socket.INADDR_ANY
891
self.server_address = (any_address,
558
in6addr_any = "::"
559
self.server_address = (in6addr_any,
892
560
self.server_address[1])
893
561
elif not self.server_address[1]:
894
562
self.server_address = (self.server_address[0],
906
574
return super(IPv6_TCPServer, self).server_activate()
907
575
def enable(self):
908
576
self.enabled = True
909
def handle_ipc(self, source, condition, file_objects={}):
910
condition_names = {
911
gobject.IO_IN: "IN", # There is data to read.
912
gobject.IO_OUT: "OUT", # Data can be written (without
913
# blocking).
914
gobject.IO_PRI: "PRI", # There is urgent data to read.
915
gobject.IO_ERR: "ERR", # Error condition.
916
gobject.IO_HUP: "HUP" # Hung up (the connection has been
917
# broken, usually for pipes and
918
# sockets).
919
}
920
conditions_string = ' | '.join(name
921
for cond, name in
922
condition_names.iteritems()
923
if cond & condition)
924
logger.debug("Handling IPC: FD = %d, condition = %s", source,
925
conditions_string)
926
927
# Turn the pipe file descriptor into a Python file object
928
if source not in file_objects:
929
file_objects[source] = os.fdopen(source, "r", 1)
930
931
# Read a line from the file object
932
cmdline = file_objects[source].readline()
933
if not cmdline: # Empty line means end of file
934
# close the IPC pipe
935
file_objects[source].close()
936
del file_objects[source]
937
938
# Stop calling this function
939
return False
940
941
logger.debug("IPC command: %r\n" % cmdline)
942
943
# Parse and act on command
944
cmd, args = cmdline.split(None, 1)
945
if cmd == "NOTFOUND":
946
if self.settings["use_dbus"]:
947
# Emit D-Bus signal
948
mandos_dbus_service.ClientNotFound(args)
949
elif cmd == "INVALID":
950
if self.settings["use_dbus"]:
951
for client in self.clients:
952
if client.name == args:
953
# Emit D-Bus signal
954
client.Rejected()
955
break
956
elif cmd == "SENDING":
957
for client in self.clients:
958
if client.name == args:
959
client.checked_ok()
960
if self.settings["use_dbus"]:
961
# Emit D-Bus signal
962
client.ReceivedSecret()
963
break
964
else:
965
logger.error("Unknown IPC command: %r", cmdline)
966
967
# Keep calling this function
968
return True
969
577
970
578
971
579
def string_to_delta(interval):
972
580
"""Parse a string and return a datetime.timedelta
973
581
974
582
>>> string_to_delta('7d')
975
583
datetime.timedelta(7)
976
584
>>> string_to_delta('60s')
1028
636
elif state == avahi.ENTRY_GROUP_FAILURE:
1029
637
logger.critical(u"Avahi: Error in group state changed %s",
1030
638
unicode(error))
1031
raise AvahiGroupError(u"State changed: %s" % unicode(error))
639
raise AvahiGroupError("State changed: %s", str(error))
1032
640
1033
641
def if_nametoindex(interface):
1034
642
"""Call the C function if_nametoindex(), or equivalent"""
1035
643
global if_nametoindex
1036
644
try:
1037
if_nametoindex = (ctypes.cdll.LoadLibrary
1038
(ctypes.util.find_library("c"))
1039
.if_nametoindex)
645
if_nametoindex = ctypes.cdll.LoadLibrary\
646
(ctypes.util.find_library("c")).if_nametoindex
1040
647
except (OSError, AttributeError):
1041
648
if "struct" not in sys.modules:
1042
649
import struct
1045
652
def if_nametoindex(interface):
1046
653
"Get an interface index the hard way, i.e. using fcntl()"
1047
654
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1048
with closing(socket.socket()) as s:
1049
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1050
struct.pack("16s16x", interface))
655
s = socket.socket()
656
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
657
struct.pack("16s16x", interface))
658
s.close()
1051
659
interface_index = struct.unpack("I", ifreq[16:20])[0]
1052
660
return interface_index
1053
661
return if_nametoindex(interface)
1077
685
1078
686
1079
687
def main():
1080
1081
######################################################################
1082
# Parsing of options, both command line and config file
1083
1084
parser = optparse.OptionParser(version = "%%prog %s" % version)
688
parser = OptionParser(version = "%%prog %s" % version)
1085
689
parser.add_option("-i", "--interface", type="string",
1086
690
metavar="IF", help="Bind to interface IF")
1087
691
parser.add_option("-a", "--address", type="string",
1088
692
help="Address to listen for requests on")
1089
693
parser.add_option("-p", "--port", type="int",
1090
694
help="Port number to receive requests on")
1091
parser.add_option("--check", action="store_true",
695
parser.add_option("--check", action="store_true", default=False,
1092
696
help="Run self-test")
1093
697
parser.add_option("--debug", action="store_true",
1094
698
help="Debug mode; run in foreground and log to"
1101
705
default="/etc/mandos", metavar="DIR",
1102
706
help="Directory to search for configuration"
1103
707
" files")
1104
parser.add_option("--no-dbus", action="store_false",
1105
dest="use_dbus",
1106
help="Do not provide D-Bus system bus"
1107
" interface")
1108
parser.add_option("--no-ipv6", action="store_false",
1109
dest="use_ipv6", help="Do not use IPv6")
1110
708
options = parser.parse_args()[0]
1111
709
1112
710
if options.check:
1122
720
"priority":
1123
721
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1124
722
"servicename": "Mandos",
1125
"use_dbus": "True",
1126
"use_ipv6": "True",
1127
723
}
1128
724
1129
725
# Parse config file for server-global settings
1132
728
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1133
729
# Convert the SafeConfigParser object to a dict
1134
730
server_settings = server_config.defaults()
1135
# Use the appropriate methods on the non-string config options
1136
server_settings["debug"] = server_config.getboolean("DEFAULT",
1137
"debug")
1138
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
1139
"use_dbus")
1140
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
1141
"use_ipv6")
1142
if server_settings["port"]:
1143
server_settings["port"] = server_config.getint("DEFAULT",
1144
"port")
731
# Use getboolean on the boolean config option
732
server_settings["debug"] = server_config.getboolean\
733
("DEFAULT", "debug")
1145
734
del server_config
1146
735
1147
736
# Override the settings from the config file with command line
1148
737
# options, if set.
1149
738
for option in ("interface", "address", "port", "debug",
1150
"priority", "servicename", "configdir",
1151
"use_dbus", "use_ipv6"):
739
"priority", "servicename", "configdir"):
1152
740
value = getattr(options, option)
1153
741
if value is not None:
1154
742
server_settings[option] = value
1155
743
del options
1156
744
# Now we have our good server settings in "server_settings"
1157
745
1158
##################################################################
1159
1160
# For convenience
1161
746
debug = server_settings["debug"]
1162
use_dbus = server_settings["use_dbus"]
1163
use_ipv6 = server_settings["use_ipv6"]
1164
747
1165
748
if not debug:
1166
749
syslogger.setLevel(logging.WARNING)
1167
750
console.setLevel(logging.WARNING)
1168
751
1169
752
if server_settings["servicename"] != "Mandos":
1170
syslogger.setFormatter(logging.Formatter
1171
('Mandos (%s) [%%(process)d]:'
1172
' %%(levelname)s: %%(message)s'
753
syslogger.setFormatter(logging.Formatter\
754
('Mandos (%s): %%(levelname)s:'
755
' %%(message)s'
1173
756
% server_settings["servicename"]))
1174
757
1175
758
# Parse config file with clients
1176
759
client_defaults = { "timeout": "1h",
1177
760
"interval": "5m",
1178
"checker": "fping -q -- %%(host)s",
761
"checker": "fping -q -- %(host)s",
1179
762
"host": "",
1180
763
}
1181
764
client_config = ConfigParser.SafeConfigParser(client_defaults)
1182
765
client_config.read(os.path.join(server_settings["configdir"],
1183
766
"clients.conf"))
1184
1185
global mandos_dbus_service
1186
mandos_dbus_service = None
1187
767
1188
768
clients = Set()
1189
769
tcp_server = IPv6_TCPServer((server_settings["address"],
1190
770
server_settings["port"]),
1191
771
TCP_handler,
1192
772
settings=server_settings,
1193
clients=clients, use_ipv6=use_ipv6)
773
clients=clients)
1194
774
pidfilename = "/var/run/mandos.pid"
1195
775
try:
1196
776
pidfile = open(pidfilename, "w")
1197
except IOError:
777
except IOError, error:
1198
778
logger.error("Could not open file %r", pidfilename)
1199
779
1200
try:
1201
uid = pwd.getpwnam("_mandos").pw_uid
1202
gid = pwd.getpwnam("_mandos").pw_gid
1203
except KeyError:
1204
try:
1205
uid = pwd.getpwnam("mandos").pw_uid
1206
gid = pwd.getpwnam("mandos").pw_gid
1207
except KeyError:
1208
try:
1209
uid = pwd.getpwnam("nobody").pw_uid
1210
gid = pwd.getpwnam("nogroup").pw_gid
1211
except KeyError:
1212
uid = 65534
1213
gid = 65534
1214
try:
780
uid = 65534
781
gid = 65534
782
try:
783
uid = pwd.getpwnam("mandos").pw_uid
784
except KeyError:
785
try:
786
uid = pwd.getpwnam("nobody").pw_uid
787
except KeyError:
788
pass
789
try:
790
gid = pwd.getpwnam("mandos").pw_gid
791
except KeyError:
792
try:
793
gid = pwd.getpwnam("nogroup").pw_gid
794
except KeyError:
795
pass
796
try:
797
os.setuid(uid)
1215
798
os.setgid(gid)
1216
os.setuid(uid)
1217
799
except OSError, error:
1218
800
if error[0] != errno.EPERM:
1219
801
raise error
1220
802
1221
# Enable all possible GnuTLS debugging
1222
if debug:
1223
# "Use a log level over 10 to enable all debugging options."
1224
# - GnuTLS manual
1225
gnutls.library.functions.gnutls_global_set_log_level(11)
1226
1227
@gnutls.library.types.gnutls_log_func
1228
def debug_gnutls(level, string):
1229
logger.debug("GnuTLS: %s", string[:-1])
1230
1231
(gnutls.library.functions
1232
.gnutls_global_set_log_function(debug_gnutls))
1233
1234
803
global service
1235
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1236
804
service = AvahiService(name = server_settings["servicename"],
1237
servicetype = "_mandos._tcp",
1238
protocol = protocol)
805
servicetype = "_mandos._tcp", )
1239
806
if server_settings["interface"]:
1240
service.interface = (if_nametoindex
1241
(server_settings["interface"]))
807
service.interface = if_nametoindex\
808
(server_settings["interface"])
1242
809
1243
810
global main_loop
1244
811
global bus
1251
818
avahi.DBUS_PATH_SERVER),
1252
819
avahi.DBUS_INTERFACE_SERVER)
1253
820
# End of Avahi example code
1254
if use_dbus:
1255
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1256
1257
client_class = Client
1258
if use_dbus:
1259
client_class = ClientDBus
1260
clients.update(Set(
1261
client_class(name = section,
1262
config= dict(client_config.items(section)))
1263
for section in client_config.sections()))
821
822
def remove_from_clients(client):
823
clients.remove(client)
824
if not clients:
825
logger.critical(u"No clients left, exiting")
826
sys.exit()
827
828
clients.update(Set(Client(name = section,
829
stop_hook = remove_from_clients,
830
config
831
= dict(client_config.items(section)))
832
for section in client_config.sections()))
1264
833
if not clients:
1265
logger.warning(u"No clients defined")
834
logger.critical(u"No clients defined")
835
sys.exit(1)
1266
836
1267
837
if debug:
1268
838
# Redirect stdin so all checkers get /dev/null
1277
847
daemon()
1278
848
1279
849
try:
1280
with closing(pidfile):
1281
pid = os.getpid()
1282
pidfile.write(str(pid) + "\n")
850
pid = os.getpid()
851
pidfile.write(str(pid) + "\n")
852
pidfile.close()
1283
853
del pidfile
1284
854
except IOError:
1285
855
logger.error(u"Could not write to file %r with PID %d",
1300
870
1301
871
while clients:
1302
872
client = clients.pop()
1303
client.disable_hook = None
1304
client.disable()
873
client.stop_hook = None
874
client.stop()
1305
875
1306
876
atexit.register(cleanup)
1307
877
1310
880
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1311
881
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1312
882
1313
if use_dbus:
1314
class MandosDBusService(dbus.service.Object):
1315
"""A D-Bus proxy object"""
1316
def __init__(self):
1317
dbus.service.Object.__init__(self, bus, "/")
1318
_interface = u"se.bsnet.fukt.Mandos"
1319
1320
@dbus.service.signal(_interface, signature="oa{sv}")
1321
def ClientAdded(self, objpath, properties):
1322
"D-Bus signal"
1323
pass
1324
1325
@dbus.service.signal(_interface, signature="s")
1326
def ClientNotFound(self, fingerprint):
1327
"D-Bus signal"
1328
pass
1329
1330
@dbus.service.signal(_interface, signature="os")
1331
def ClientRemoved(self, objpath, name):
1332
"D-Bus signal"
1333
pass
1334
1335
@dbus.service.method(_interface, out_signature="ao")
1336
def GetAllClients(self):
1337
"D-Bus method"
1338
return dbus.Array(c.dbus_object_path for c in clients)
1339
1340
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1341
def GetAllClientsWithProperties(self):
1342
"D-Bus method"
1343
return dbus.Dictionary(
1344
((c.dbus_object_path, c.GetAllProperties())
1345
for c in clients),
1346
signature="oa{sv}")
1347
1348
@dbus.service.method(_interface, in_signature="o")
1349
def RemoveClient(self, object_path):
1350
"D-Bus method"
1351
for c in clients:
1352
if c.dbus_object_path == object_path:
1353
clients.remove(c)
1354
c.remove_from_connection()
1355
# Don't signal anything except ClientRemoved
1356
c.disable(signal=False)
1357
# Emit D-Bus signal
1358
self.ClientRemoved(object_path, c.name)
1359
return
1360
raise KeyError
1361
1362
del _interface
1363
1364
mandos_dbus_service = MandosDBusService()
1365
1366
883
for client in clients:
1367
if use_dbus:
1368
# Emit D-Bus signal
1369
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1370
client.GetAllProperties())
1371
client.enable()
884
client.start()
1372
885
1373
886
tcp_server.enable()
1374
887
tcp_server.server_activate()
1375
888
1376
889
# Find out what port we got
1377
890
service.port = tcp_server.socket.getsockname()[1]
1378
if use_ipv6:
1379
logger.info(u"Now listening on address %r, port %d,"
1380
" flowinfo %d, scope_id %d"
1381
% tcp_server.socket.getsockname())
1382
else: # IPv4
1383
logger.info(u"Now listening on address %r, port %d"
1384
% tcp_server.socket.getsockname())
891
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
892
u" scope_id %d" % tcp_server.socket.getsockname())
1385
893
1386
894
#service.interface = tcp_server.socket.getsockname()[3]
1387
895
1397
905
1398
906
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1399
907
lambda *args, **kwargs:
1400
(tcp_server.handle_request
1401
(*args[2:], **kwargs) or True))
908
tcp_server.handle_request\
909
(*args[2:], **kwargs) or True)
1402
910
1403
911
logger.debug(u"Starting main loop")
1404
912
main_loop.run()
1405
913
except AvahiError, error:
1406
logger.critical(u"AvahiError: %s", error)
914
logger.critical(u"AvahiError: %s" + unicode(error))
1407
915
sys.exit(1)
1408
916
except KeyboardInterrupt:
1409
917
if debug:
1410
print >> sys.stderr
1411
logger.debug("Server received KeyboardInterrupt")
1412
logger.debug("Server exiting")
918
print
1413
919
1414
920
if __name__ == '__main__':
1415
921
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0