/mandos/trunk : revision 24.1.113

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

16

#

16

17

# This program is free software: you can redistribute it and/or modify

17

18

# it under the terms of the GNU General Public License as published by

24

25

# GNU General Public License for more details.

25

26

#

26

27

# You should have received a copy of the GNU General Public License

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

28

30

#

29

31

# Contact the authors at <mandos@fukt.bsnet.se>.

30

32

#

31

33

32

from __future__ import division

34

from __future__ import division, with_statement, absolute_import

33

35

34

36

import SocketServer

35

37

import socket

36

import select

37

38

from optparse import OptionParser

38

39

import datetime

39

40

import errno

54

55

import stat

55

56

import logging

56

57

import logging.handlers

58

import pwd

59

from contextlib import closing

57

60

58

61

import dbus

62

import dbus.service

59

63

import gobject

60

64

import avahi

61

65

from dbus.mainloop.glib import DBusGMainLoop

62

66

import ctypes

67

import ctypes.util

63

68

64

version = "1.0"

69

version = "1.0.2"

65

70

66

71

logger = logging.Logger('mandos')

67

syslogger = logging.handlers.SysLogHandler\

68

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

69

address = "/dev/log")

70

syslogger.setFormatter(logging.Formatter\

71

('Mandos: %(levelname)s: %(message)s'))

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos: %(levelname)s: %(message)s'))

72

77

logger.addHandler(syslogger)

73

78

74

79

console = logging.StreamHandler()

79

84

class AvahiError(Exception):

80

85

def __init__(self, value):

81

86

self.value = value

87

super(AvahiError, self).__init__()

82

88

def __str__(self):

83

89

return repr(self.value)

84

90

106

112

a sensible number of times

107

113

"""

108

114

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

109

type = None, port = None, TXT = None, domain = "",

110

host = "", max_renames = 32768):

115

servicetype = None, port = None, TXT = None,

116

domain = "", host = "", max_renames = 32768):

111

117

self.interface = interface

112

118

self.name = name

113

self.type = type

119

self.type = servicetype

114

120

self.port = port

115

if TXT is None:

116

self.TXT = []

117

else:

118

self.TXT = TXT

121

self.TXT = TXT if TXT is not None else []

119

122

self.domain = domain

120

123

self.host = host

121

124

self.rename_count = 0

125

self.max_renames = max_renames

122

126

def rename(self):

123

127

"""Derived from the Avahi example code"""

124

128

if self.rename_count >= self.max_renames:

125

logger.critical(u"No suitable service name found after %i"

126

u" retries, exiting.", rename_count)

129

logger.critical(u"No suitable Zeroconf service name found"

130

u" after %i retries, exiting.",

131

self.rename_count)

127

132

raise AvahiServiceError("Too many renames")

128

name = server.GetAlternativeServiceName(name)

129

logger.error(u"Changing name to %r ...", name)

130

syslogger.setFormatter(logging.Formatter\

133

self.name = server.GetAlternativeServiceName(self.name)

134

logger.info(u"Changing Zeroconf service name to %r ...",

135

str(self.name))

136

syslogger.setFormatter(logging.Formatter

131

137

('Mandos (%s): %%(levelname)s:'

132

' %%(message)s' % name))

138

' %%(message)s' % self.name))

133

139

self.remove()

134

140

self.add()

135

141

self.rename_count += 1

141

147

"""Derived from the Avahi example code"""

142

148

global group

143

149

if group is None:

144

group = dbus.Interface\

145

(bus.get_object(avahi.DBUS_NAME,

150

group = dbus.Interface(bus.get_object

151

(avahi.DBUS_NAME,

146

152

server.EntryGroupNew()),

147

avahi.DBUS_INTERFACE_ENTRY_GROUP)

153

avahi.DBUS_INTERFACE_ENTRY_GROUP)

148

154

group.connect_to_signal('StateChanged',

149

155

entry_group_state_changed)

150

logger.debug(u"Adding service '%s' of type '%s' ...",

156

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

151

157

service.name, service.type)

152

158

group.AddService(

153

159

self.interface, # interface

164

170

# End of Avahi example code

165

171

166

172

167

class Client(object):

173

class Client(dbus.service.Object):

168

174

"""A representation of a client host served by this server.

169

175

Attributes:

170

176

name: string; from the config file, used in log messages

172

178

uniquely identify the client

173

179

secret: bytestring; sent verbatim (over TLS) to client

174

180

host: string; available for use by the checker command

175

created: datetime.datetime(); object creation, not client host

176

last_checked_ok: datetime.datetime() or None if not yet checked OK

181

created: datetime.datetime(); (UTC) object creation

182

started: datetime.datetime(); (UTC) last started

183

last_checked_ok: datetime.datetime(); (UTC) or None

177

184

timeout: datetime.timedelta(); How long from last_checked_ok

178

185

until this client is invalid

179

186

interval: datetime.timedelta(); How often to start a new checker

195

202

_interval_milliseconds: - '' -

196

203

"""

197

204

def _set_timeout(self, timeout):

198

"Setter function for 'timeout' attribute"

205

"Setter function for the 'timeout' attribute"

199

206

self._timeout = timeout

200

207

self._timeout_milliseconds = ((self.timeout.days

201

208

* 24 * 60 * 60 * 1000)

202

209

+ (self.timeout.seconds * 1000)

203

210

+ (self.timeout.microseconds

204

211

// 1000))

205

timeout = property(lambda self: self._timeout,

206

_set_timeout)

212

# Emit D-Bus signal

213

self.TimeoutChanged(self._timeout_milliseconds)

214

timeout = property(lambda self: self._timeout, _set_timeout)

207

215

del _set_timeout

216

208

217

def _set_interval(self, interval):

209

"Setter function for 'interval' attribute"

218

"Setter function for the 'interval' attribute"

210

219

self._interval = interval

211

220

self._interval_milliseconds = ((self.interval.days

212

221

* 24 * 60 * 60 * 1000)

214

223

* 1000)

215

224

+ (self.interval.microseconds

216

225

// 1000))

217

interval = property(lambda self: self._interval,

218

_set_interval)

226

# Emit D-Bus signal

227

self.IntervalChanged(self._interval_milliseconds)

228

interval = property(lambda self: self._interval, _set_interval)

219

229

del _set_interval

220

def __init__(self, name = None, stop_hook=None, config={}):

230

231

def __init__(self, name = None, stop_hook=None, config=None):

221

232

"""Note: the 'checker' key in 'config' sets the

222

233

'checker_command' attribute and *not* the 'checker'

223

234

attribute."""

235

dbus.service.Object.__init__(self, bus,

236

"/Mandos/clients/%s"

237

% name.replace(".", "_"))

238

if config is None:

239

config = {}

224

240

self.name = name

225

241

logger.debug(u"Creating client %r", self.name)

226

242

# Uppercase and remove spaces from fingerprint for later

227

243

# comparison purposes with return value from the fingerprint()

228

244

# function

229

self.fingerprint = config["fingerprint"].upper()\

230

.replace(u" ", u"")

245

self.fingerprint = (config["fingerprint"].upper()

246

.replace(u" ", u""))

231

247

logger.debug(u" Fingerprint: %s", self.fingerprint)

232

248

if "secret" in config:

233

249

self.secret = config["secret"].decode(u"base64")

234

250

elif "secfile" in config:

235

sf = open(config["secfile"])

236

self.secret = sf.read()

237

sf.close()

251

with closing(open(os.path.expanduser

252

(os.path.expandvars

253

(config["secfile"])))) as secfile:

254

self.secret = secfile.read()

238

255

else:

239

256

raise TypeError(u"No secret or secfile for client %s"

240

257

% self.name)

241

258

self.host = config.get("host", "")

242

self.created = datetime.datetime.now()

259

self.created = datetime.datetime.utcnow()

260

self.started = None

243

261

self.last_checked_ok = None

244

262

self.timeout = string_to_delta(config["timeout"])

245

263

self.interval = string_to_delta(config["interval"])

249

267

self.stop_initiator_tag = None

250

268

self.checker_callback_tag = None

251

269

self.check_command = config["checker"]

270

252

271

def start(self):

253

272

"""Start this client's checker and timeout hooks"""

273

self.started = datetime.datetime.utcnow()

254

274

# Schedule a new checker to be started an 'interval' from now,

255

275

# and every interval from then on.

256

self.checker_initiator_tag = gobject.timeout_add\

257

(self._interval_milliseconds,

258

self.start_checker)

276

self.checker_initiator_tag = (gobject.timeout_add

277

(self._interval_milliseconds,

278

self.start_checker))

259

279

# Also start a new checker *right now*.

260

280

self.start_checker()

261

281

# Schedule a stop() when 'timeout' has passed

262

self.stop_initiator_tag = gobject.timeout_add\

263

(self._timeout_milliseconds,

264

self.stop)

282

self.stop_initiator_tag = (gobject.timeout_add

283

(self._timeout_milliseconds,

284

self.stop))

285

# Emit D-Bus signal

286

self.StateChanged(True)

287

265

288

def stop(self):

266

"""Stop this client.

267

The possibility that a client might be restarted is left open,

268

but not currently used."""

269

# If this client doesn't have a secret, it is already stopped.

270

if hasattr(self, "secret") and self.secret:

289

"""Stop this client."""

290

if getattr(self, "started", None) is not None:

271

291

logger.info(u"Stopping client %s", self.name)

272

self.secret = None

273

292

else:

274

293

return False

275

294

if getattr(self, "stop_initiator_tag", False):

281

300

self.stop_checker()

282

301

if self.stop_hook:

283

302

self.stop_hook(self)

303

self.started = None

304

# Emit D-Bus signal

305

self.StateChanged(False)

284

306

# Do not run this again if called by a gobject.timeout_add

285

307

return False

308

286

309

def __del__(self):

287

310

self.stop_hook = None

288

311

self.stop()

312

289

313

def checker_callback(self, pid, condition):

290

314

"""The checker has completed, so take appropriate actions."""

291

now = datetime.datetime.now()

292

315

self.checker_callback_tag = None

293

316

self.checker = None

294

if os.WIFEXITED(condition) \

295

and (os.WEXITSTATUS(condition) == 0):

317

if (os.WIFEXITED(condition)

318

and (os.WEXITSTATUS(condition) == 0)):

296

319

logger.info(u"Checker for %(name)s succeeded",

297

320

vars(self))

298

self.last_checked_ok = now

299

gobject.source_remove(self.stop_initiator_tag)

300

self.stop_initiator_tag = gobject.timeout_add\

301

(self._timeout_milliseconds,

302

self.stop)

321

# Emit D-Bus signal

322

self.CheckerCompleted(True)

323

self.bump_timeout()

303

324

elif not os.WIFEXITED(condition):

304

325

logger.warning(u"Checker for %(name)s crashed?",

305

326

vars(self))

327

# Emit D-Bus signal

328

self.CheckerCompleted(False)

306

329

else:

307

330

logger.info(u"Checker for %(name)s failed",

308

331

vars(self))

332

# Emit D-Bus signal

333

self.CheckerCompleted(False)

334

335

def bump_timeout(self):

336

"""Bump up the timeout for this client.

337

This should only be called when the client has been seen,

338

alive and well.

339

"""

340

self.last_checked_ok = datetime.datetime.utcnow()

341

gobject.source_remove(self.stop_initiator_tag)

342

self.stop_initiator_tag = (gobject.timeout_add

343

(self._timeout_milliseconds,

344

self.stop))

345

309

346

def start_checker(self):

310

347

"""Start a new checker subprocess if one is not running.

311

348

If a checker already exists, leave it running and do

336

373

try:

337

374

logger.info(u"Starting checker %r for %s",

338

375

command, self.name)

376

# We don't need to redirect stdout and stderr, since

377

# in normal mode, that is already done by daemon(),

378

# and in debug mode we don't want to. (Stdin is

379

# always replaced by /dev/null.)

339

380

self.checker = subprocess.Popen(command,

340

381

close_fds=True,

341

382

shell=True, cwd="/")

342

self.checker_callback_tag = gobject.child_watch_add\

343

(self.checker.pid,

344

self.checker_callback)

345

except subprocess.OSError, error:

383

self.checker_callback_tag = (gobject.child_watch_add

384

(self.checker.pid,

385

self.checker_callback))

386

# Emit D-Bus signal

387

self.CheckerStarted(command)

388

except OSError, error:

346

389

logger.error(u"Failed to start subprocess: %s",

347

390

error)

348

391

# Re-run this periodically if run by gobject.timeout_add

349

392

return True

393

350

394

def stop_checker(self):

351

395

"""Force the checker process, if any, to stop."""

352

396

if self.checker_callback_tag:

364

408

if error.errno != errno.ESRCH: # No such process

365

409

raise

366

410

self.checker = None

411

367

412

def still_valid(self):

368

413

"""Has the timeout not yet passed for this client?"""

369

now = datetime.datetime.now()

414

if not self.started:

415

return False

416

now = datetime.datetime.utcnow()

370

417

if self.last_checked_ok is None:

371

418

return now < (self.created + self.timeout)

372

419

else:

373

420

return now < (self.last_checked_ok + self.timeout)

421

422

## D-Bus methods & signals

423

_interface = u"org.mandos_system.Mandos.Client"

424

425

def _datetime_to_dbus_struct(dt):

426

return dbus.Struct(dt.year, dt.month, dt.day, dt.hour,

427

dt.minute, dt.second, dt.microsecond,

428

signature="nyyyyyu")

429

430

# BumpTimeout - method

431

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

432

BumpTimeout.__name__ = "BumpTimeout"

433

434

# IntervalChanged - signal

435

@dbus.service.signal(_interface, signature="t")

436

def IntervalChanged(self, t):

437

"D-Bus signal"

438

pass

439

440

# CheckerCompleted - signal

441

@dbus.service.signal(_interface, signature="b")

442

def CheckerCompleted(self, success):

443

"D-Bus signal"

444

pass

445

446

# CheckerIsRunning - method

447

@dbus.service.method(_interface, out_signature="b")

448

def CheckerIsRunning(self):

449

"D-Bus getter method"

450

return self.checker is not None

451

452

# CheckerStarted - signal

453

@dbus.service.signal(_interface, signature="s")

454

def CheckerStarted(self, command):

455

"D-Bus signal"

456

pass

457

458

# GetChecker - method

459

@dbus.service.method(_interface, out_signature="s")

460

def GetChecker(self):

461

"D-Bus getter method"

462

return self.checker_command

463

464

# GetCreated - method

465

@dbus.service.method(_interface, out_signature="(nyyyyyu)")

466

def GetCreated(self):

467

"D-Bus getter method"

468

return datetime_to_dbus_struct(self.created)

469

470

# GetFingerprint - method

471

@dbus.service.method(_interface, out_signature="s")

472

def GetFingerprint(self):

473

"D-Bus getter method"

474

return self.fingerprint

475

476

# GetHost - method

477

@dbus.service.method(_interface, out_signature="s")

478

def GetHost(self):

479

"D-Bus getter method"

480

return self.host

481

482

# GetInterval - method

483

@dbus.service.method(_interface, out_signature="t")

484

def GetInterval(self):

485

"D-Bus getter method"

486

return self._interval_milliseconds

487

488

# GetName - method

489

@dbus.service.method(_interface, out_signature="s")

490

def GetName(self):

491

"D-Bus getter method"

492

return self.name

493

494

# GetStarted - method

495

@dbus.service.method(_interface, out_signature="(nyyyyyu)")

496

def GetStarted(self):

497

"D-Bus getter method"

498

if self.started is not None:

499

return datetime_to_dbus_struct(self.started)

500

else:

501

return dbus.Struct(0, 0, 0, 0, 0, 0, 0,

502

signature="nyyyyyu")

503

504

# GetTimeout - method

505

@dbus.service.method(_interface, out_signature="t")

506

def GetTimeout(self):

507

"D-Bus getter method"

508

return self._timeout_milliseconds

509

510

# SetChecker - method

511

@dbus.service.method(_interface, in_signature="s")

512

def SetChecker(self, checker):

513

"D-Bus setter method"

514

self.checker_command = checker

515

516

# SetHost - method

517

@dbus.service.method(_interface, in_signature="s")

518

def SetHost(self, host):

519

"D-Bus setter method"

520

self.host = host

521

522

# SetInterval - method

523

@dbus.service.method(_interface, in_signature="t")

524

def SetInterval(self, milliseconds):

525

self.interval = datetime.timdeelta(0, 0, 0, milliseconds)

526

527

# SetTimeout - method

528

@dbus.service.method(_interface, in_signature="t")

529

def SetTimeout(self, milliseconds):

530

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

531

532

# SetSecret - method

533

@dbus.service.method(_interface, in_signature="ay",

534

byte_arrays=True)

535

def SetSecret(self, secret):

536

"D-Bus setter method"

537

self.secret = str(secret)

538

539

# Start - method

540

Start = dbus.service.method(_interface)(start)

541

Start.__name__ = "Start"

542

543

# StartChecker - method

544

StartChecker = dbus.service.method(_interface)(start_checker)

545

StartChecker.__name__ = "StartChecker"

546

547

# StateChanged - signal

548

@dbus.service.signal(_interface, signature="b")

549

def StateChanged(self, started):

550

"D-Bus signal"

551

pass

552

553

# StillValid - method

554

StillValid = (dbus.service.method(_interface, out_signature="b")

555

(still_valid))

556

StillValid.__name__ = "StillValid"

557

558

# Stop - method

559

Stop = dbus.service.method(_interface)(stop)

560

Stop.__name__ = "Stop"

561

562

# StopChecker - method

563

StopChecker = dbus.service.method(_interface)(stop_checker)

564

StopChecker.__name__ = "StopChecker"

565

566

# TimeoutChanged - signal

567

@dbus.service.signal(_interface, signature="t")

568

def TimeoutChanged(self, t):

569

"D-Bus signal"

570

pass

571

572

del _datetime_to_dbus_struct

573

del _interface

374

574

375

575

376

576

def peer_certificate(session):

377

577

"Return the peer's OpenPGP certificate as a bytestring"

378

578

# If not an OpenPGP certificate...

379

if gnutls.library.functions.gnutls_certificate_type_get\

380

(session._c_object) \

381

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:

579

if (gnutls.library.functions

580

.gnutls_certificate_type_get(session._c_object)

581

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

382

582

# ...do the normal thing

383

583

return session.peer_certificate

384

584

list_size = ctypes.c_uint()

385

cert_list = gnutls.library.functions.gnutls_certificate_get_peers\

386

(session._c_object, ctypes.byref(list_size))

585

cert_list = (gnutls.library.functions

586

.gnutls_certificate_get_peers

587

(session._c_object, ctypes.byref(list_size)))

387

588

if list_size.value == 0:

388

589

return None

389

590

cert = cert_list[0]

393

594

def fingerprint(openpgp):

394

595

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

395

596

# New GnuTLS "datum" with the OpenPGP public key

396

datum = gnutls.library.types.gnutls_datum_t\

397

(ctypes.cast(ctypes.c_char_p(openpgp),

398

ctypes.POINTER(ctypes.c_ubyte)),

399

ctypes.c_uint(len(openpgp)))

597

datum = (gnutls.library.types

598

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

599

ctypes.POINTER

600

(ctypes.c_ubyte)),

601

ctypes.c_uint(len(openpgp))))

400

602

# New empty GnuTLS certificate

401

603

crt = gnutls.library.types.gnutls_openpgp_crt_t()

402

gnutls.library.functions.gnutls_openpgp_crt_init\

403

(ctypes.byref(crt))

604

(gnutls.library.functions

605

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

404

606

# Import the OpenPGP public key into the certificate

405

gnutls.library.functions.gnutls_openpgp_crt_import\

406

(crt, ctypes.byref(datum),

407

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

607

(gnutls.library.functions

608

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

609

gnutls.library.constants

610

.GNUTLS_OPENPGP_FMT_RAW))

611

# Verify the self signature in the key

612

crtverify = ctypes.c_uint()

613

(gnutls.library.functions

614

.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))

615

if crtverify.value != 0:

616

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

617

raise gnutls.errors.CertificateSecurityError("Verify failed")

408

618

# New buffer for the fingerprint

409

buffer = ctypes.create_string_buffer(20)

410

buffer_length = ctypes.c_size_t()

619

buf = ctypes.create_string_buffer(20)

620

buf_len = ctypes.c_size_t()

411

621

# Get the fingerprint from the certificate into the buffer

412

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\

413

(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))

622

(gnutls.library.functions

623

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

624

ctypes.byref(buf_len)))

414

625

# Deinit the certificate

415

626

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

416

627

# Convert the buffer to a Python bytestring

417

fpr = ctypes.string_at(buffer, buffer_length.value)

628

fpr = ctypes.string_at(buf, buf_len.value)

418

629

# Convert the bytestring to hexadecimal notation

419

630

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

420

631

return hex_fpr

421

632

422

633

423

class tcp_handler(SocketServer.BaseRequestHandler, object):

634

class TCP_handler(SocketServer.BaseRequestHandler, object):

424

635

"""A TCP request handler class.

425

636

Instantiated by IPv6_TCPServer for each request to handle it.

426

637

Note: This will run in its own forked process."""

427

638

428

639

def handle(self):

429

640

logger.info(u"TCP connection from: %s",

430

unicode(self.client_address))

431

session = gnutls.connection.ClientSession\

432

(self.request, gnutls.connection.X509Credentials())

641

unicode(self.client_address))

642

session = (gnutls.connection

643

.ClientSession(self.request,

644

gnutls.connection

645

.X509Credentials()))

433

646

434

647

line = self.request.makefile().readline()

435

648

logger.debug(u"Protocol version: %r", line)

448

661

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

449

662

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

450

663

# "+DHE-DSS"))

451

priority = "NORMAL" # Fallback default, since this

452

# MUST be set.

453

if self.server.settings["priority"]:

454

priority = self.server.settings["priority"]

455

gnutls.library.functions.gnutls_priority_set_direct\

456

(session._c_object, priority, None);

664

# Use a fallback default, since this MUST be set.

665

priority = self.server.settings.get("priority", "NORMAL")

666

(gnutls.library.functions

667

.gnutls_priority_set_direct(session._c_object,

668

priority, None))

457

669

458

670

try:

459

671

session.handshake()

469

681

session.bye()

470

682

return

471

683

logger.debug(u"Fingerprint: %s", fpr)

472

client = None

473

684

for c in self.server.clients:

474

685

if c.fingerprint == fpr:

475

686

client = c

476

687

break

477

if not client:

688

else:

478

689

logger.warning(u"Client not found for fingerprint: %s",

479

690

fpr)

480

691

session.bye()

487

698

vars(client))

488

699

session.bye()

489

700

return

701

## This won't work here, since we're in a fork.

702

# client.bump_timeout()

490

703

sent_size = 0

491

704

while sent_size < len(client.secret):

492

705

sent = session.send(client.secret[sent_size:])

497

710

session.bye()

498

711

499

712

500

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

713

class IPv6_TCPServer(SocketServer.ForkingMixIn,

714

SocketServer.TCPServer, object):

501

715

"""IPv6 TCP server. Accepts 'None' as address and/or port.

502

716

Attributes:

503

717

settings: Server settings

504

718

clients: Set() of Client objects

719

enabled: Boolean; whether this server is activated yet

505

720

"""

506

721

address_family = socket.AF_INET6

507

722

def __init__(self, *args, **kwargs):

511

726

if "clients" in kwargs:

512

727

self.clients = kwargs["clients"]

513

728

del kwargs["clients"]

514

return super(type(self), self).__init__(*args, **kwargs)

729

self.enabled = False

730

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

515

731

def server_bind(self):

516

732

"""This overrides the normal server_bind() function

517

733

to bind to an interface if one was specified, and also NOT to

546

762

# if_nametoindex

547

763

# (self.settings

548

764

# ["interface"]))

549

return super(type(self), self).server_bind()

765

return super(IPv6_TCPServer, self).server_bind()

766

def server_activate(self):

767

if self.enabled:

768

return super(IPv6_TCPServer, self).server_activate()

769

def enable(self):

770

self.enabled = True

550

771

551

772

552

773

def string_to_delta(interval):

562

783

datetime.timedelta(1)

563

784

>>> string_to_delta(u'1w')

564

785

datetime.timedelta(7)

786

>>> string_to_delta('5m 30s')

787

datetime.timedelta(0, 330)

565

788

"""

566

try:

567

suffix=unicode(interval[-1])

568

value=int(interval[:-1])

569

if suffix == u"d":

570

delta = datetime.timedelta(value)

571

elif suffix == u"s":

572

delta = datetime.timedelta(0, value)

573

elif suffix == u"m":

574

delta = datetime.timedelta(0, 0, 0, 0, value)

575

elif suffix == u"h":

576

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

577

elif suffix == u"w":

578

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

579

else:

789

timevalue = datetime.timedelta(0)

790

for s in interval.split():

791

try:

792

suffix = unicode(s[-1])

793

value = int(s[:-1])

794

if suffix == u"d":

795

delta = datetime.timedelta(value)

796

elif suffix == u"s":

797

delta = datetime.timedelta(0, value)

798

elif suffix == u"m":

799

delta = datetime.timedelta(0, 0, 0, 0, value)

800

elif suffix == u"h":

801

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

802

elif suffix == u"w":

803

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

804

else:

805

raise ValueError

806

except (ValueError, IndexError):

580

807

raise ValueError

581

except (ValueError, IndexError):

582

raise ValueError

583

return delta

808

timevalue += delta

809

return timevalue

584

810

585

811

586

812

def server_state_changed(state):

587

813

"""Derived from the Avahi example code"""

588

814

if state == avahi.SERVER_COLLISION:

589

logger.error(u"Server name collision")

815

logger.error(u"Zeroconf server name collision")

590

816

service.remove()

591

817

elif state == avahi.SERVER_RUNNING:

592

818

service.add()

594

820

595

821

def entry_group_state_changed(state, error):

596

822

"""Derived from the Avahi example code"""

597

logger.debug(u"state change: %i", state)

823

logger.debug(u"Avahi state change: %i", state)

598

824

599

825

if state == avahi.ENTRY_GROUP_ESTABLISHED:

600

logger.debug(u"Service established.")

826

logger.debug(u"Zeroconf service established.")

601

827

elif state == avahi.ENTRY_GROUP_COLLISION:

602

logger.warning(u"Service name collision.")

828

logger.warning(u"Zeroconf service name collision.")

603

829

service.rename()

604

830

elif state == avahi.ENTRY_GROUP_FAILURE:

605

logger.critical(u"Error in group state changed %s",

831

logger.critical(u"Avahi: Error in group state changed %s",

606

832

unicode(error))

607

833

raise AvahiGroupError("State changed: %s", str(error))

608

834

610

836

"""Call the C function if_nametoindex(), or equivalent"""

611

837

global if_nametoindex

612

838

try:

613

if "ctypes.util" not in sys.modules:

614

import ctypes.util

615

if_nametoindex = ctypes.cdll.LoadLibrary\

616

(ctypes.util.find_library("c")).if_nametoindex

839

if_nametoindex = (ctypes.cdll.LoadLibrary

840

(ctypes.util.find_library("c"))

841

.if_nametoindex)

617

842

except (OSError, AttributeError):

618

843

if "struct" not in sys.modules:

619

844

import struct

622

847

def if_nametoindex(interface):

623

848

"Get an interface index the hard way, i.e. using fcntl()"

624

849

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

625

s = socket.socket()

626

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

627

struct.pack("16s16x", interface))

628

s.close()

850

with closing(socket.socket()) as s:

851

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

852

struct.pack("16s16x", interface))

629

853

interface_index = struct.unpack("I", ifreq[16:20])[0]

630

854

return interface_index

631

855

return if_nametoindex(interface)

655

879

656

880

657

881

def main():

658

global main_loop_started

659

main_loop_started = False

660

661

882

parser = OptionParser(version = "%%prog %s" % version)

662

883

parser.add_option("-i", "--interface", type="string",

663

884

metavar="IF", help="Bind to interface IF")

678

899

default="/etc/mandos", metavar="DIR",

679

900

help="Directory to search for configuration"

680

901

" files")

681

(options, args) = parser.parse_args()

902

options = parser.parse_args()[0]

682

903

683

904

if options.check:

684

905

import doctest

699

920

server_config = ConfigParser.SafeConfigParser(server_defaults)

700

921

del server_defaults

701

922

server_config.read(os.path.join(options.configdir, "mandos.conf"))

702

server_section = "server"

703

923

# Convert the SafeConfigParser object to a dict

704

server_settings = dict(server_config.items(server_section))

924

server_settings = server_config.defaults()

705

925

# Use getboolean on the boolean config option

706

server_settings["debug"] = server_config.getboolean\

707

(server_section, "debug")

926

server_settings["debug"] = (server_config.getboolean

927

("DEFAULT", "debug"))

708

928

del server_config

709

929

710

930

# Override the settings from the config file with command line

724

944

console.setLevel(logging.WARNING)

725

945

726

946

if server_settings["servicename"] != "Mandos":

727

syslogger.setFormatter(logging.Formatter\

947

syslogger.setFormatter(logging.Formatter

728

948

('Mandos (%s): %%(levelname)s:'

729

949

' %%(message)s'

730

950

% server_settings["servicename"]))

732

952

# Parse config file with clients

733

953

client_defaults = { "timeout": "1h",

734

954

"interval": "5m",

735

"checker": "fping -q -- %%(host)s",

955

"checker": "fping -q -- %(host)s",

956

"host": "",

736

957

}

737

958

client_config = ConfigParser.SafeConfigParser(client_defaults)

738

959

client_config.read(os.path.join(server_settings["configdir"],

739

960

"clients.conf"))

740

961

962

clients = Set()

963

tcp_server = IPv6_TCPServer((server_settings["address"],

964

server_settings["port"]),

965

TCP_handler,

966

settings=server_settings,

967

clients=clients)

968

pidfilename = "/var/run/mandos.pid"

969

try:

970

pidfile = open(pidfilename, "w")

971

except IOError, error:

972

logger.error("Could not open file %r", pidfilename)

973

974

uid = 65534

975

gid = 65534

976

try:

977

uid = pwd.getpwnam("mandos").pw_uid

978

except KeyError:

979

try:

980

uid = pwd.getpwnam("nobody").pw_uid

981

except KeyError:

982

pass

983

try:

984

gid = pwd.getpwnam("mandos").pw_gid

985

except KeyError:

986

try:

987

gid = pwd.getpwnam("nogroup").pw_gid

988

except KeyError:

989

pass

990

try:

991

os.setuid(uid)

992

os.setgid(gid)

993

except OSError, error:

994

if error[0] != errno.EPERM:

995

raise error

996

741

997

global service

742

998

service = AvahiService(name = server_settings["servicename"],

743

type = "_mandos._tcp", );

999

servicetype = "_mandos._tcp", )

744

1000

if server_settings["interface"]:

745

service.interface = if_nametoindex(server_settings["interface"])

1001

service.interface = (if_nametoindex

1002

(server_settings["interface"]))

746

1003

747

1004

global main_loop

748

1005

global bus

751

1008

DBusGMainLoop(set_as_default=True )

752

1009

main_loop = gobject.MainLoop()

753

1010

bus = dbus.SystemBus()

754

server = dbus.Interface(

755

bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),

756

avahi.DBUS_INTERFACE_SERVER )

1011

server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,

1012

avahi.DBUS_PATH_SERVER),

1013

avahi.DBUS_INTERFACE_SERVER)

757

1014

# End of Avahi example code

1015

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)

758

1016

759

clients = Set()

760

1017

def remove_from_clients(client):

761

1018

clients.remove(client)

762

1019

if not clients:

772

1029

logger.critical(u"No clients defined")

773

1030

sys.exit(1)

774

1031

775

if not debug:

1032

if debug:

1033

# Redirect stdin so all checkers get /dev/null

1034

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1035

os.dup2(null, sys.stdin.fileno())

1036

if null > 2:

1037

os.close(null)

1038

else:

1039

# No console logging

776

1040

logger.removeHandler(console)

1041

# Close all input and output, do double fork, etc.

777

1042

daemon()

778

1043

779

pidfilename = "/var/run/mandos/mandos.pid"

780

pid = os.getpid()

781

1044

try:

782

pidfile = open(pidfilename, "w")

1045

pid = os.getpid()

783

1046

pidfile.write(str(pid) + "\n")

784

1047

pidfile.close()

785

1048

del pidfile

786

except IOError, err:

787

logger.error(u"Could not write %s file with PID %d",

788

pidfilename, os.getpid())

1049

except IOError:

1050

logger.error(u"Could not write to file %r with PID %d",

1051

pidfilename, pid)

1052

except NameError:

1053

# "pidfile" was never created

1054

pass

1055

del pidfilename

789

1056

790

1057

def cleanup():

791

1058

"Cleanup function; run on exit"

811

1078

for client in clients:

812

1079

client.start()

813

1080

814

tcp_server = IPv6_TCPServer((server_settings["address"],

815

server_settings["port"]),

816

tcp_handler,

817

settings=server_settings,

818

clients=clients)

1081

tcp_server.enable()

1082

tcp_server.server_activate()

1083

819

1084

# Find out what port we got

820

1085

service.port = tcp_server.socket.getsockname()[1]

821

1086

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

835

1100

836

1101

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

837

1102

lambda *args, **kwargs:

838

tcp_server.handle_request\

839

(*args[2:], **kwargs) or True)

1103

(tcp_server.handle_request

1104

(*args[2:], **kwargs) or True))

840

1105

841

1106

logger.debug(u"Starting main loop")

842

main_loop_started = True

843

1107

main_loop.run()

844

1108

except AvahiError, error:

845

1109

logger.critical(u"AvahiError: %s" + unicode(error))