To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 24.1.113
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.113
- Committer: Björn Påhlsson
- Date: 2008-11-12 05:46:49 UTC
- mfrom: (237.1.2 mandos)
- mto: (24.1.154 mandos) (237.4.3 mandos-release)
- mto: This revision was merged to the branch mainline in revision 240.
- Revision ID: belorn@braxen-20081112054649-g3m4i22ncnaf5hbi
merge
- files added:
- debian/mandos-client.config
- files removed:
- debian/watch
- files modified:
- INSTALL
added
removed
mandos
11
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008 Teddy Hogeborn
15
# Copyright © 2008 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
35
35
36
36
import SocketServer
37
37
import socket
38
import optparse
38
from optparse import OptionParser
39
39
import datetime
40
40
import errno
41
41
import gnutls.crypto
66
66
import ctypes
67
67
import ctypes.util
68
68
69
version = "1.0.6"
69
version = "1.0.2"
70
70
71
71
logger = logging.Logger('mandos')
72
72
syslogger = (logging.handlers.SysLogHandler
73
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
74
address = "/dev/log"))
75
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
76
('Mandos: %(levelname)s: %(message)s'))
78
77
logger.addHandler(syslogger)
79
78
80
79
console = logging.StreamHandler()
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
83
82
logger.addHandler(console)
84
83
85
84
class AvahiError(Exception):
86
def __init__(self, value, *args, **kwargs):
85
def __init__(self, value):
87
86
self.value = value
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
87
super(AvahiError, self).__init__()
88
def __str__(self):
89
return repr(self.value)
91
90
92
91
class AvahiServiceError(AvahiError):
93
92
pass
114
113
"""
115
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
115
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768,
118
protocol = avahi.PROTO_UNSPEC):
116
domain = "", host = "", max_renames = 32768):
119
117
self.interface = interface
120
118
self.name = name
121
119
self.type = servicetype
125
123
self.host = host
126
124
self.rename_count = 0
127
125
self.max_renames = max_renames
128
self.protocol = protocol
129
126
def rename(self):
130
127
"""Derived from the Avahi example code"""
131
128
if self.rename_count >= self.max_renames:
132
129
logger.critical(u"No suitable Zeroconf service name found"
133
130
u" after %i retries, exiting.",
134
131
self.rename_count)
135
raise AvahiServiceError(u"Too many renames")
132
raise AvahiServiceError("Too many renames")
136
133
self.name = server.GetAlternativeServiceName(self.name)
137
134
logger.info(u"Changing Zeroconf service name to %r ...",
138
135
str(self.name))
160
157
service.name, service.type)
161
158
group.AddService(
162
159
self.interface, # interface
163
self.protocol, # protocol
160
avahi.PROTO_INET6, # protocol
164
161
dbus.UInt32(0), # flags
165
162
self.name, self.type,
166
163
self.domain, self.host,
173
170
# End of Avahi example code
174
171
175
172
176
def _datetime_to_dbus(dt, variant_level=0):
177
"""Convert a UTC datetime.datetime() to a D-Bus type."""
178
return dbus.String(dt.isoformat(), variant_level=variant_level)
179
180
181
173
class Client(dbus.service.Object):
182
174
"""A representation of a client host served by this server.
183
175
Attributes:
184
name: string; from the config file, used in log messages and
185
D-Bus identifiers
176
name: string; from the config file, used in log messages
186
177
fingerprint: string (40 or 32 hexadecimal digits); used to
187
178
uniquely identify the client
188
secret: bytestring; sent verbatim (over TLS) to client
189
host: string; available for use by the checker command
190
created: datetime.datetime(); (UTC) object creation
191
last_enabled: datetime.datetime(); (UTC)
192
enabled: bool()
179
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); (UTC) object creation
182
started: datetime.datetime(); (UTC) last started
193
183
last_checked_ok: datetime.datetime(); (UTC) or None
194
timeout: datetime.timedelta(); How long from last_checked_ok
195
until this client is invalid
196
interval: datetime.timedelta(); How often to start a new checker
197
disable_hook: If set, called by disable() as disable_hook(self)
198
checker: subprocess.Popen(); a running checker process used
199
to see if the client lives.
200
'None' if no process is running.
184
timeout: datetime.timedelta(); How long from last_checked_ok
185
until this client is invalid
186
interval: datetime.timedelta(); How often to start a new checker
187
stop_hook: If set, called by stop() as stop_hook(self)
188
checker: subprocess.Popen(); a running checker process used
189
to see if the client lives.
190
'None' if no process is running.
201
191
checker_initiator_tag: a gobject event source tag, or None
202
disable_initiator_tag: - '' -
192
stop_initiator_tag: - '' -
203
193
checker_callback_tag: - '' -
204
194
checker_command: string; External command which is run to check if
205
195
client lives. %() expansions are done at
206
196
runtime with vars(self) as dict, so that for
207
197
instance %(name)s can be used in the command.
208
current_checker_command: string; current running checker_command
209
use_dbus: bool(); Whether to provide D-Bus interface and signals
210
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
198
Private attibutes:
199
_timeout: Real variable for 'timeout'
200
_interval: Real variable for 'interval'
201
_timeout_milliseconds: Used when calling gobject.timeout_add()
202
_interval_milliseconds: - '' -
211
203
"""
212
def timeout_milliseconds(self):
213
"Return the 'timeout' attribute in milliseconds"
214
return ((self.timeout.days * 24 * 60 * 60 * 1000)
215
+ (self.timeout.seconds * 1000)
216
+ (self.timeout.microseconds // 1000))
217
218
def interval_milliseconds(self):
219
"Return the 'interval' attribute in milliseconds"
220
return ((self.interval.days * 24 * 60 * 60 * 1000)
221
+ (self.interval.seconds * 1000)
222
+ (self.interval.microseconds // 1000))
223
224
def __init__(self, name = None, disable_hook=None, config=None,
225
use_dbus=True):
204
def _set_timeout(self, timeout):
205
"Setter function for the 'timeout' attribute"
206
self._timeout = timeout
207
self._timeout_milliseconds = ((self.timeout.days
208
* 24 * 60 * 60 * 1000)
209
+ (self.timeout.seconds * 1000)
210
+ (self.timeout.microseconds
211
// 1000))
212
# Emit D-Bus signal
213
self.TimeoutChanged(self._timeout_milliseconds)
214
timeout = property(lambda self: self._timeout, _set_timeout)
215
del _set_timeout
216
217
def _set_interval(self, interval):
218
"Setter function for the 'interval' attribute"
219
self._interval = interval
220
self._interval_milliseconds = ((self.interval.days
221
* 24 * 60 * 60 * 1000)
222
+ (self.interval.seconds
223
* 1000)
224
+ (self.interval.microseconds
225
// 1000))
226
# Emit D-Bus signal
227
self.IntervalChanged(self._interval_milliseconds)
228
interval = property(lambda self: self._interval, _set_interval)
229
del _set_interval
230
231
def __init__(self, name = None, stop_hook=None, config=None):
226
232
"""Note: the 'checker' key in 'config' sets the
227
233
'checker_command' attribute and *not* the 'checker'
228
234
attribute."""
229
self.name = name
235
dbus.service.Object.__init__(self, bus,
236
"/Mandos/clients/%s"
237
% name.replace(".", "_"))
230
238
if config is None:
231
239
config = {}
240
self.name = name
232
241
logger.debug(u"Creating client %r", self.name)
233
self.use_dbus = False # During __init__
234
242
# Uppercase and remove spaces from fingerprint for later
235
243
# comparison purposes with return value from the fingerprint()
236
244
# function
249
257
% self.name)
250
258
self.host = config.get("host", "")
251
259
self.created = datetime.datetime.utcnow()
252
self.enabled = False
253
self.last_enabled = None
260
self.started = None
254
261
self.last_checked_ok = None
255
262
self.timeout = string_to_delta(config["timeout"])
256
263
self.interval = string_to_delta(config["interval"])
257
self.disable_hook = disable_hook
264
self.stop_hook = stop_hook
258
265
self.checker = None
259
266
self.checker_initiator_tag = None
260
self.disable_initiator_tag = None
267
self.stop_initiator_tag = None
261
268
self.checker_callback_tag = None
262
self.checker_command = config["checker"]
263
self.current_checker_command = None
264
self.last_connect = None
265
# Only now, when this client is initialized, can it show up on
266
# the D-Bus
267
self.use_dbus = use_dbus
268
if self.use_dbus:
269
self.dbus_object_path = (dbus.ObjectPath
270
("/clients/"
271
+ self.name.replace(".", "_")))
272
dbus.service.Object.__init__(self, bus,
273
self.dbus_object_path)
269
self.check_command = config["checker"]
274
270
275
def enable(self):
271
def start(self):
276
272
"""Start this client's checker and timeout hooks"""
277
self.last_enabled = datetime.datetime.utcnow()
273
self.started = datetime.datetime.utcnow()
278
274
# Schedule a new checker to be started an 'interval' from now,
279
275
# and every interval from then on.
280
276
self.checker_initiator_tag = (gobject.timeout_add
281
(self.interval_milliseconds(),
277
(self._interval_milliseconds,
282
278
self.start_checker))
283
279
# Also start a new checker *right now*.
284
280
self.start_checker()
285
# Schedule a disable() when 'timeout' has passed
286
self.disable_initiator_tag = (gobject.timeout_add
287
(self.timeout_milliseconds(),
288
self.disable))
289
self.enabled = True
290
if self.use_dbus:
291
# Emit D-Bus signals
292
self.PropertyChanged(dbus.String(u"enabled"),
293
dbus.Boolean(True, variant_level=1))
294
self.PropertyChanged(dbus.String(u"last_enabled"),
295
(_datetime_to_dbus(self.last_enabled,
296
variant_level=1)))
281
# Schedule a stop() when 'timeout' has passed
282
self.stop_initiator_tag = (gobject.timeout_add
283
(self._timeout_milliseconds,
284
self.stop))
285
# Emit D-Bus signal
286
self.StateChanged(True)
297
287
298
def disable(self):
299
"""Disable this client."""
300
if not getattr(self, "enabled", False):
288
def stop(self):
289
"""Stop this client."""
290
if getattr(self, "started", None) is not None:
291
logger.info(u"Stopping client %s", self.name)
292
else:
301
293
return False
302
logger.info(u"Disabling client %s", self.name)
303
if getattr(self, "disable_initiator_tag", False):
304
gobject.source_remove(self.disable_initiator_tag)
305
self.disable_initiator_tag = None
294
if getattr(self, "stop_initiator_tag", False):
295
gobject.source_remove(self.stop_initiator_tag)
296
self.stop_initiator_tag = None
306
297
if getattr(self, "checker_initiator_tag", False):
307
298
gobject.source_remove(self.checker_initiator_tag)
308
299
self.checker_initiator_tag = None
309
300
self.stop_checker()
310
if self.disable_hook:
311
self.disable_hook(self)
312
self.enabled = False
313
if self.use_dbus:
314
# Emit D-Bus signal
315
self.PropertyChanged(dbus.String(u"enabled"),
316
dbus.Boolean(False, variant_level=1))
301
if self.stop_hook:
302
self.stop_hook(self)
303
self.started = None
304
# Emit D-Bus signal
305
self.StateChanged(False)
317
306
# Do not run this again if called by a gobject.timeout_add
318
307
return False
319
308
320
309
def __del__(self):
321
self.disable_hook = None
322
self.disable()
310
self.stop_hook = None
311
self.stop()
323
312
324
def checker_callback(self, pid, condition, command):
313
def checker_callback(self, pid, condition):
325
314
"""The checker has completed, so take appropriate actions."""
326
315
self.checker_callback_tag = None
327
316
self.checker = None
328
if self.use_dbus:
317
if (os.WIFEXITED(condition)
318
and (os.WEXITSTATUS(condition) == 0)):
319
logger.info(u"Checker for %(name)s succeeded",
320
vars(self))
329
321
# Emit D-Bus signal
330
self.PropertyChanged(dbus.String(u"checker_running"),
331
dbus.Boolean(False, variant_level=1))
332
if os.WIFEXITED(condition):
333
exitstatus = os.WEXITSTATUS(condition)
334
if exitstatus == 0:
335
logger.info(u"Checker for %(name)s succeeded",
336
vars(self))
337
self.checked_ok()
338
else:
339
logger.info(u"Checker for %(name)s failed",
340
vars(self))
341
if self.use_dbus:
342
# Emit D-Bus signal
343
self.CheckerCompleted(dbus.Int16(exitstatus),
344
dbus.Int64(condition),
345
dbus.String(command))
346
else:
322
self.CheckerCompleted(True)
323
self.bump_timeout()
324
elif not os.WIFEXITED(condition):
347
325
logger.warning(u"Checker for %(name)s crashed?",
348
326
vars(self))
349
if self.use_dbus:
350
# Emit D-Bus signal
351
self.CheckerCompleted(dbus.Int16(-1),
352
dbus.Int64(condition),
353
dbus.String(command))
327
# Emit D-Bus signal
328
self.CheckerCompleted(False)
329
else:
330
logger.info(u"Checker for %(name)s failed",
331
vars(self))
332
# Emit D-Bus signal
333
self.CheckerCompleted(False)
354
334
355
def checked_ok(self):
335
def bump_timeout(self):
356
336
"""Bump up the timeout for this client.
357
337
This should only be called when the client has been seen,
358
338
alive and well.
359
339
"""
360
340
self.last_checked_ok = datetime.datetime.utcnow()
361
gobject.source_remove(self.disable_initiator_tag)
362
self.disable_initiator_tag = (gobject.timeout_add
363
(self.timeout_milliseconds(),
364
self.disable))
365
if self.use_dbus:
366
# Emit D-Bus signal
367
self.PropertyChanged(
368
dbus.String(u"last_checked_ok"),
369
(_datetime_to_dbus(self.last_checked_ok,
370
variant_level=1)))
341
gobject.source_remove(self.stop_initiator_tag)
342
self.stop_initiator_tag = (gobject.timeout_add
343
(self._timeout_milliseconds,
344
self.stop))
371
345
372
346
def start_checker(self):
373
347
"""Start a new checker subprocess if one is not running.
381
355
# checkers alone, the checker would have to take more time
382
356
# than 'timeout' for the client to be declared invalid, which
383
357
# is as it should be.
384
385
# If a checker exists, make sure it is not a zombie
386
if self.checker is not None:
387
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
388
if pid:
389
logger.warning("Checker was a zombie")
390
gobject.source_remove(self.checker_callback_tag)
391
self.checker_callback(pid, status,
392
self.current_checker_command)
393
# Start a new checker if needed
394
358
if self.checker is None:
395
359
try:
396
# In case checker_command has exactly one % operator
397
command = self.checker_command % self.host
360
# In case check_command has exactly one % operator
361
command = self.check_command % self.host
398
362
except TypeError:
399
363
# Escape attributes for the shell
400
364
escaped_attrs = dict((key, re.escape(str(val)))
401
365
for key, val in
402
366
vars(self).iteritems())
403
367
try:
404
command = self.checker_command % escaped_attrs
368
command = self.check_command % escaped_attrs
405
369
except TypeError, error:
406
370
logger.error(u'Could not format string "%s":'
407
u' %s', self.checker_command, error)
371
u' %s', self.check_command, error)
408
372
return True # Try again later
409
self.current_checker_command = command
410
373
try:
411
374
logger.info(u"Starting checker %r for %s",
412
375
command, self.name)
417
380
self.checker = subprocess.Popen(command,
418
381
close_fds=True,
419
382
shell=True, cwd="/")
420
if self.use_dbus:
421
# Emit D-Bus signal
422
self.CheckerStarted(command)
423
self.PropertyChanged(
424
dbus.String("checker_running"),
425
dbus.Boolean(True, variant_level=1))
426
383
self.checker_callback_tag = (gobject.child_watch_add
427
384
(self.checker.pid,
428
self.checker_callback,
429
data=command))
430
# The checker may have completed before the gobject
431
# watch was added. Check for this.
432
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
433
if pid:
434
gobject.source_remove(self.checker_callback_tag)
435
self.checker_callback(pid, status, command)
385
self.checker_callback))
386
# Emit D-Bus signal
387
self.CheckerStarted(command)
436
388
except OSError, error:
437
389
logger.error(u"Failed to start subprocess: %s",
438
390
error)
456
408
if error.errno != errno.ESRCH: # No such process
457
409
raise
458
410
self.checker = None
459
if self.use_dbus:
460
self.PropertyChanged(dbus.String(u"checker_running"),
461
dbus.Boolean(False, variant_level=1))
462
411
463
412
def still_valid(self):
464
413
"""Has the timeout not yet passed for this client?"""
465
if not getattr(self, "enabled", False):
414
if not self.started:
466
415
return False
467
416
now = datetime.datetime.utcnow()
468
417
if self.last_checked_ok is None:
471
420
return now < (self.last_checked_ok + self.timeout)
472
421
473
422
## D-Bus methods & signals
474
_interface = u"se.bsnet.fukt.Mandos.Client"
475
476
# CheckedOK - method
477
CheckedOK = dbus.service.method(_interface)(checked_ok)
478
CheckedOK.__name__ = "CheckedOK"
423
_interface = u"org.mandos_system.Mandos.Client"
424
425
def _datetime_to_dbus_struct(dt):
426
return dbus.Struct(dt.year, dt.month, dt.day, dt.hour,
427
dt.minute, dt.second, dt.microsecond,
428
signature="nyyyyyu")
429
430
# BumpTimeout - method
431
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
432
BumpTimeout.__name__ = "BumpTimeout"
433
434
# IntervalChanged - signal
435
@dbus.service.signal(_interface, signature="t")
436
def IntervalChanged(self, t):
437
"D-Bus signal"
438
pass
479
439
480
440
# CheckerCompleted - signal
481
@dbus.service.signal(_interface, signature="nxs")
482
def CheckerCompleted(self, exitcode, waitstatus, command):
441
@dbus.service.signal(_interface, signature="b")
442
def CheckerCompleted(self, success):
483
443
"D-Bus signal"
484
444
pass
485
445
446
# CheckerIsRunning - method
447
@dbus.service.method(_interface, out_signature="b")
448
def CheckerIsRunning(self):
449
"D-Bus getter method"
450
return self.checker is not None
451
486
452
# CheckerStarted - signal
487
453
@dbus.service.signal(_interface, signature="s")
488
454
def CheckerStarted(self, command):
489
455
"D-Bus signal"
490
456
pass
491
457
492
# GetAllProperties - method
493
@dbus.service.method(_interface, out_signature="a{sv}")
494
def GetAllProperties(self):
495
"D-Bus method"
496
return dbus.Dictionary({
497
dbus.String("name"):
498
dbus.String(self.name, variant_level=1),
499
dbus.String("fingerprint"):
500
dbus.String(self.fingerprint, variant_level=1),
501
dbus.String("host"):
502
dbus.String(self.host, variant_level=1),
503
dbus.String("created"):
504
_datetime_to_dbus(self.created, variant_level=1),
505
dbus.String("last_enabled"):
506
(_datetime_to_dbus(self.last_enabled,
507
variant_level=1)
508
if self.last_enabled is not None
509
else dbus.Boolean(False, variant_level=1)),
510
dbus.String("enabled"):
511
dbus.Boolean(self.enabled, variant_level=1),
512
dbus.String("last_checked_ok"):
513
(_datetime_to_dbus(self.last_checked_ok,
514
variant_level=1)
515
if self.last_checked_ok is not None
516
else dbus.Boolean (False, variant_level=1)),
517
dbus.String("timeout"):
518
dbus.UInt64(self.timeout_milliseconds(),
519
variant_level=1),
520
dbus.String("interval"):
521
dbus.UInt64(self.interval_milliseconds(),
522
variant_level=1),
523
dbus.String("checker"):
524
dbus.String(self.checker_command,
525
variant_level=1),
526
dbus.String("checker_running"):
527
dbus.Boolean(self.checker is not None,
528
variant_level=1),
529
dbus.String("object_path"):
530
dbus.ObjectPath(self.dbus_object_path,
531
variant_level=1)
532
}, signature="sv")
533
534
# IsStillValid - method
535
IsStillValid = (dbus.service.method(_interface, out_signature="b")
536
(still_valid))
537
IsStillValid.__name__ = "IsStillValid"
538
539
# PropertyChanged - signal
540
@dbus.service.signal(_interface, signature="sv")
541
def PropertyChanged(self, property, value):
542
"D-Bus signal"
543
pass
458
# GetChecker - method
459
@dbus.service.method(_interface, out_signature="s")
460
def GetChecker(self):
461
"D-Bus getter method"
462
return self.checker_command
463
464
# GetCreated - method
465
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
466
def GetCreated(self):
467
"D-Bus getter method"
468
return datetime_to_dbus_struct(self.created)
469
470
# GetFingerprint - method
471
@dbus.service.method(_interface, out_signature="s")
472
def GetFingerprint(self):
473
"D-Bus getter method"
474
return self.fingerprint
475
476
# GetHost - method
477
@dbus.service.method(_interface, out_signature="s")
478
def GetHost(self):
479
"D-Bus getter method"
480
return self.host
481
482
# GetInterval - method
483
@dbus.service.method(_interface, out_signature="t")
484
def GetInterval(self):
485
"D-Bus getter method"
486
return self._interval_milliseconds
487
488
# GetName - method
489
@dbus.service.method(_interface, out_signature="s")
490
def GetName(self):
491
"D-Bus getter method"
492
return self.name
493
494
# GetStarted - method
495
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
496
def GetStarted(self):
497
"D-Bus getter method"
498
if self.started is not None:
499
return datetime_to_dbus_struct(self.started)
500
else:
501
return dbus.Struct(0, 0, 0, 0, 0, 0, 0,
502
signature="nyyyyyu")
503
504
# GetTimeout - method
505
@dbus.service.method(_interface, out_signature="t")
506
def GetTimeout(self):
507
"D-Bus getter method"
508
return self._timeout_milliseconds
544
509
545
510
# SetChecker - method
546
511
@dbus.service.method(_interface, in_signature="s")
547
512
def SetChecker(self, checker):
548
513
"D-Bus setter method"
549
514
self.checker_command = checker
550
# Emit D-Bus signal
551
self.PropertyChanged(dbus.String(u"checker"),
552
dbus.String(self.checker_command,
553
variant_level=1))
554
515
555
516
# SetHost - method
556
517
@dbus.service.method(_interface, in_signature="s")
557
518
def SetHost(self, host):
558
519
"D-Bus setter method"
559
520
self.host = host
560
# Emit D-Bus signal
561
self.PropertyChanged(dbus.String(u"host"),
562
dbus.String(self.host, variant_level=1))
563
521
564
522
# SetInterval - method
565
523
@dbus.service.method(_interface, in_signature="t")
566
524
def SetInterval(self, milliseconds):
567
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
568
# Emit D-Bus signal
569
self.PropertyChanged(dbus.String(u"interval"),
570
(dbus.UInt64(self.interval_milliseconds(),
571
variant_level=1)))
525
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
526
527
# SetTimeout - method
528
@dbus.service.method(_interface, in_signature="t")
529
def SetTimeout(self, milliseconds):
530
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
572
531
573
532
# SetSecret - method
574
533
@dbus.service.method(_interface, in_signature="ay",
577
536
"D-Bus setter method"
578
537
self.secret = str(secret)
579
538
580
# SetTimeout - method
581
@dbus.service.method(_interface, in_signature="t")
582
def SetTimeout(self, milliseconds):
583
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
584
# Emit D-Bus signal
585
self.PropertyChanged(dbus.String(u"timeout"),
586
(dbus.UInt64(self.timeout_milliseconds(),
587
variant_level=1)))
588
589
# Enable - method
590
Enable = dbus.service.method(_interface)(enable)
591
Enable.__name__ = "Enable"
539
# Start - method
540
Start = dbus.service.method(_interface)(start)
541
Start.__name__ = "Start"
592
542
593
543
# StartChecker - method
594
@dbus.service.method(_interface)
595
def StartChecker(self):
596
"D-Bus method"
597
self.start_checker()
598
599
# Disable - method
600
@dbus.service.method(_interface)
601
def Disable(self):
602
"D-Bus method"
603
self.disable()
544
StartChecker = dbus.service.method(_interface)(start_checker)
545
StartChecker.__name__ = "StartChecker"
546
547
# StateChanged - signal
548
@dbus.service.signal(_interface, signature="b")
549
def StateChanged(self, started):
550
"D-Bus signal"
551
pass
552
553
# StillValid - method
554
StillValid = (dbus.service.method(_interface, out_signature="b")
555
(still_valid))
556
StillValid.__name__ = "StillValid"
557
558
# Stop - method
559
Stop = dbus.service.method(_interface)(stop)
560
Stop.__name__ = "Stop"
604
561
605
562
# StopChecker - method
606
563
StopChecker = dbus.service.method(_interface)(stop_checker)
607
564
StopChecker.__name__ = "StopChecker"
608
565
566
# TimeoutChanged - signal
567
@dbus.service.signal(_interface, signature="t")
568
def TimeoutChanged(self, t):
569
"D-Bus signal"
570
pass
571
572
del _datetime_to_dbus_struct
609
573
del _interface
610
574
611
575
617
581
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
618
582
# ...do the normal thing
619
583
return session.peer_certificate
620
list_size = ctypes.c_uint(1)
584
list_size = ctypes.c_uint()
621
585
cert_list = (gnutls.library.functions
622
586
.gnutls_certificate_get_peers
623
587
(session._c_object, ctypes.byref(list_size)))
624
if not bool(cert_list) and list_size.value != 0:
625
raise gnutls.errors.GNUTLSError("error getting peer"
626
" certificate")
627
588
if list_size.value == 0:
628
589
return None
629
590
cert = cert_list[0]
698
659
# using OpenPGP certificates.
699
660
700
661
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
701
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
702
# "+DHE-DSS"))
662
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
663
# "+DHE-DSS"))
703
664
# Use a fallback default, since this MUST be set.
704
665
priority = self.server.settings.get("priority", "NORMAL")
705
666
(gnutls.library.functions
713
674
# Do not run session.bye() here: the session is not
714
675
# established. Just abandon the request.
715
676
return
716
logger.debug(u"Handshake succeeded")
717
677
try:
718
678
fpr = fingerprint(peer_certificate(session))
719
679
except (TypeError, gnutls.errors.GNUTLSError), error:
721
681
session.bye()
722
682
return
723
683
logger.debug(u"Fingerprint: %s", fpr)
724
725
684
for c in self.server.clients:
726
685
if c.fingerprint == fpr:
727
686
client = c
740
699
session.bye()
741
700
return
742
701
## This won't work here, since we're in a fork.
743
# client.checked_ok()
702
# client.bump_timeout()
744
703
sent_size = 0
745
704
while sent_size < len(client.secret):
746
705
sent = session.send(client.secret[sent_size:])
753
712
754
713
class IPv6_TCPServer(SocketServer.ForkingMixIn,
755
714
SocketServer.TCPServer, object):
756
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
715
"""IPv6 TCP server. Accepts 'None' as address and/or port.
757
716
Attributes:
758
717
settings: Server settings
759
718
clients: Set() of Client objects
767
726
if "clients" in kwargs:
768
727
self.clients = kwargs["clients"]
769
728
del kwargs["clients"]
770
if "use_ipv6" in kwargs:
771
if not kwargs["use_ipv6"]:
772
self.address_family = socket.AF_INET
773
del kwargs["use_ipv6"]
774
729
self.enabled = False
775
730
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
776
731
def server_bind(self):
790
745
u" bind to interface %s",
791
746
self.settings["interface"])
792
747
else:
793
raise
748
raise error
794
749
# Only bind(2) the socket if we really need to.
795
750
if self.server_address[0] or self.server_address[1]:
796
751
if not self.server_address[0]:
797
if self.address_family == socket.AF_INET6:
798
any_address = "::" # in6addr_any
799
else:
800
any_address = socket.INADDR_ANY
801
self.server_address = (any_address,
752
in6addr_any = "::"
753
self.server_address = (in6addr_any,
802
754
self.server_address[1])
803
755
elif not self.server_address[1]:
804
756
self.server_address = (self.server_address[0],
820
772
821
773
def string_to_delta(interval):
822
774
"""Parse a string and return a datetime.timedelta
823
775
824
776
>>> string_to_delta('7d')
825
777
datetime.timedelta(7)
826
778
>>> string_to_delta('60s')
878
830
elif state == avahi.ENTRY_GROUP_FAILURE:
879
831
logger.critical(u"Avahi: Error in group state changed %s",
880
832
unicode(error))
881
raise AvahiGroupError(u"State changed: %s" % unicode(error))
833
raise AvahiGroupError("State changed: %s", str(error))
882
834
883
835
def if_nametoindex(interface):
884
836
"""Call the C function if_nametoindex(), or equivalent"""
927
879
928
880
929
881
def main():
930
parser = optparse.OptionParser(version = "%%prog %s" % version)
882
parser = OptionParser(version = "%%prog %s" % version)
931
883
parser.add_option("-i", "--interface", type="string",
932
884
metavar="IF", help="Bind to interface IF")
933
885
parser.add_option("-a", "--address", type="string",
934
886
help="Address to listen for requests on")
935
887
parser.add_option("-p", "--port", type="int",
936
888
help="Port number to receive requests on")
937
parser.add_option("--check", action="store_true",
889
parser.add_option("--check", action="store_true", default=False,
938
890
help="Run self-test")
939
891
parser.add_option("--debug", action="store_true",
940
892
help="Debug mode; run in foreground and log to"
947
899
default="/etc/mandos", metavar="DIR",
948
900
help="Directory to search for configuration"
949
901
" files")
950
parser.add_option("--no-dbus", action="store_false",
951
dest="use_dbus",
952
help="Do not provide D-Bus system bus"
953
" interface")
954
parser.add_option("--no-ipv6", action="store_false",
955
dest="use_ipv6", help="Do not use IPv6")
956
902
options = parser.parse_args()[0]
957
903
958
904
if options.check:
968
914
"priority":
969
915
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
970
916
"servicename": "Mandos",
971
"use_dbus": "True",
972
"use_ipv6": "True",
973
917
}
974
918
975
919
# Parse config file for server-global settings
978
922
server_config.read(os.path.join(options.configdir, "mandos.conf"))
979
923
# Convert the SafeConfigParser object to a dict
980
924
server_settings = server_config.defaults()
981
# Use the appropriate methods on the non-string config options
982
server_settings["debug"] = server_config.getboolean("DEFAULT",
983
"debug")
984
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
985
"use_dbus")
986
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
987
"use_ipv6")
988
if server_settings["port"]:
989
server_settings["port"] = server_config.getint("DEFAULT",
990
"port")
925
# Use getboolean on the boolean config option
926
server_settings["debug"] = (server_config.getboolean
927
("DEFAULT", "debug"))
991
928
del server_config
992
929
993
930
# Override the settings from the config file with command line
994
931
# options, if set.
995
932
for option in ("interface", "address", "port", "debug",
996
"priority", "servicename", "configdir",
997
"use_dbus", "use_ipv6"):
933
"priority", "servicename", "configdir"):
998
934
value = getattr(options, option)
999
935
if value is not None:
1000
936
server_settings[option] = value
1001
937
del options
1002
938
# Now we have our good server settings in "server_settings"
1003
939
1004
# For convenience
1005
940
debug = server_settings["debug"]
1006
use_dbus = server_settings["use_dbus"]
1007
use_ipv6 = server_settings["use_ipv6"]
1008
941
1009
942
if not debug:
1010
943
syslogger.setLevel(logging.WARNING)
1019
952
# Parse config file with clients
1020
953
client_defaults = { "timeout": "1h",
1021
954
"interval": "5m",
1022
"checker": "fping -q -- %%(host)s",
955
"checker": "fping -q -- %(host)s",
1023
956
"host": "",
1024
957
}
1025
958
client_config = ConfigParser.SafeConfigParser(client_defaults)
1031
964
server_settings["port"]),
1032
965
TCP_handler,
1033
966
settings=server_settings,
1034
clients=clients, use_ipv6=use_ipv6)
967
clients=clients)
1035
968
pidfilename = "/var/run/mandos.pid"
1036
969
try:
1037
970
pidfile = open(pidfilename, "w")
1038
except IOError:
971
except IOError, error:
1039
972
logger.error("Could not open file %r", pidfilename)
1040
973
1041
try:
1042
uid = pwd.getpwnam("_mandos").pw_uid
1043
gid = pwd.getpwnam("_mandos").pw_gid
1044
except KeyError:
1045
try:
1046
uid = pwd.getpwnam("mandos").pw_uid
1047
gid = pwd.getpwnam("mandos").pw_gid
1048
except KeyError:
1049
try:
1050
uid = pwd.getpwnam("nobody").pw_uid
1051
gid = pwd.getpwnam("nogroup").pw_gid
1052
except KeyError:
1053
uid = 65534
1054
gid = 65534
1055
try:
974
uid = 65534
975
gid = 65534
976
try:
977
uid = pwd.getpwnam("mandos").pw_uid
978
except KeyError:
979
try:
980
uid = pwd.getpwnam("nobody").pw_uid
981
except KeyError:
982
pass
983
try:
984
gid = pwd.getpwnam("mandos").pw_gid
985
except KeyError:
986
try:
987
gid = pwd.getpwnam("nogroup").pw_gid
988
except KeyError:
989
pass
990
try:
991
os.setuid(uid)
1056
992
os.setgid(gid)
1057
os.setuid(uid)
1058
993
except OSError, error:
1059
994
if error[0] != errno.EPERM:
1060
995
raise error
1061
996
1062
# Enable all possible GnuTLS debugging
1063
if debug:
1064
# "Use a log level over 10 to enable all debugging options."
1065
# - GnuTLS manual
1066
gnutls.library.functions.gnutls_global_set_log_level(11)
1067
1068
@gnutls.library.types.gnutls_log_func
1069
def debug_gnutls(level, string):
1070
logger.debug("GnuTLS: %s", string[:-1])
1071
1072
(gnutls.library.functions
1073
.gnutls_global_set_log_function(debug_gnutls))
1074
1075
997
global service
1076
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1077
998
service = AvahiService(name = server_settings["servicename"],
1078
servicetype = "_mandos._tcp",
1079
protocol = protocol)
999
servicetype = "_mandos._tcp", )
1080
1000
if server_settings["interface"]:
1081
1001
service.interface = (if_nametoindex
1082
1002
(server_settings["interface"]))
1092
1012
avahi.DBUS_PATH_SERVER),
1093
1013
avahi.DBUS_INTERFACE_SERVER)
1094
1014
# End of Avahi example code
1095
if use_dbus:
1096
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1015
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
1016
1017
def remove_from_clients(client):
1018
clients.remove(client)
1019
if not clients:
1020
logger.critical(u"No clients left, exiting")
1021
sys.exit()
1097
1022
1098
1023
clients.update(Set(Client(name = section,
1024
stop_hook = remove_from_clients,
1099
1025
config
1100
= dict(client_config.items(section)),
1101
use_dbus = use_dbus)
1026
= dict(client_config.items(section)))
1102
1027
for section in client_config.sections()))
1103
1028
if not clients:
1104
logger.warning(u"No clients defined")
1029
logger.critical(u"No clients defined")
1030
sys.exit(1)
1105
1031
1106
1032
if debug:
1107
1033
# Redirect stdin so all checkers get /dev/null
1139
1065
1140
1066
while clients:
1141
1067
client = clients.pop()
1142
client.disable_hook = None
1143
client.disable()
1068
client.stop_hook = None
1069
client.stop()
1144
1070
1145
1071
atexit.register(cleanup)
1146
1072
1149
1075
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1150
1076
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1151
1077
1152
if use_dbus:
1153
class MandosServer(dbus.service.Object):
1154
"""A D-Bus proxy object"""
1155
def __init__(self):
1156
dbus.service.Object.__init__(self, bus, "/")
1157
_interface = u"se.bsnet.fukt.Mandos"
1158
1159
@dbus.service.signal(_interface, signature="oa{sv}")
1160
def ClientAdded(self, objpath, properties):
1161
"D-Bus signal"
1162
pass
1163
1164
@dbus.service.signal(_interface, signature="os")
1165
def ClientRemoved(self, objpath, name):
1166
"D-Bus signal"
1167
pass
1168
1169
@dbus.service.method(_interface, out_signature="ao")
1170
def GetAllClients(self):
1171
"D-Bus method"
1172
return dbus.Array(c.dbus_object_path for c in clients)
1173
1174
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1175
def GetAllClientsWithProperties(self):
1176
"D-Bus method"
1177
return dbus.Dictionary(
1178
((c.dbus_object_path, c.GetAllProperties())
1179
for c in clients),
1180
signature="oa{sv}")
1181
1182
@dbus.service.method(_interface, in_signature="o")
1183
def RemoveClient(self, object_path):
1184
"D-Bus method"
1185
for c in clients:
1186
if c.dbus_object_path == object_path:
1187
clients.remove(c)
1188
# Don't signal anything except ClientRemoved
1189
c.use_dbus = False
1190
c.disable()
1191
# Emit D-Bus signal
1192
self.ClientRemoved(object_path, c.name)
1193
return
1194
raise KeyError
1195
1196
del _interface
1197
1198
mandos_server = MandosServer()
1199
1200
1078
for client in clients:
1201
if use_dbus:
1202
# Emit D-Bus signal
1203
mandos_server.ClientAdded(client.dbus_object_path,
1204
client.GetAllProperties())
1205
client.enable()
1079
client.start()
1206
1080
1207
1081
tcp_server.enable()
1208
1082
tcp_server.server_activate()
1209
1083
1210
1084
# Find out what port we got
1211
1085
service.port = tcp_server.socket.getsockname()[1]
1212
if use_ipv6:
1213
logger.info(u"Now listening on address %r, port %d,"
1214
" flowinfo %d, scope_id %d"
1215
% tcp_server.socket.getsockname())
1216
else: # IPv4
1217
logger.info(u"Now listening on address %r, port %d"
1218
% tcp_server.socket.getsockname())
1086
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1087
u" scope_id %d" % tcp_server.socket.getsockname())
1219
1088
1220
1089
#service.interface = tcp_server.socket.getsockname()[3]
1221
1090
1237
1106
logger.debug(u"Starting main loop")
1238
1107
main_loop.run()
1239
1108
except AvahiError, error:
1240
logger.critical(u"AvahiError: %s", error)
1109
logger.critical(u"AvahiError: %s" + unicode(error))
1241
1110
sys.exit(1)
1242
1111
except KeyboardInterrupt:
1243
1112
if debug:
1244
print >> sys.stderr
1245
logger.debug("Server received KeyboardInterrupt")
1246
logger.debug("Server exiting")
1113
print
1247
1114
1248
1115
if __name__ == '__main__':
1249
1116
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0