/mandos/trunk : revision 24.1.113

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

16

#

16

17

# This program is free software: you can redistribute it and/or modify

17

18

# it under the terms of the GNU General Public License as published by

24

25

# GNU General Public License for more details.

25

26

#

26

27

# You should have received a copy of the GNU General Public License

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

28

30

#

29

31

# Contact the authors at <mandos@fukt.bsnet.se>.

30

32

#

31

33

32

from __future__ import division

34

from __future__ import division, with_statement, absolute_import

33

35

34

36

import SocketServer

35

37

import socket

36

import select

37

38

from optparse import OptionParser

38

39

import datetime

39

40

import errno

54

55

import stat

55

56

import logging

56

57

import logging.handlers

58

import pwd

59

from contextlib import closing

57

60

58

61

import dbus

62

import dbus.service

59

63

import gobject

60

64

import avahi

61

65

from dbus.mainloop.glib import DBusGMainLoop

62

66

import ctypes

67

import ctypes.util

63

68

64

version = "1.0"

69

version = "1.0.2"

65

70

66

71

logger = logging.Logger('mandos')

67

syslogger = logging.handlers.SysLogHandler\

68

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

69

address = "/dev/log")

70

syslogger.setFormatter(logging.Formatter\

71

('Mandos: %(levelname)s: %(message)s'))

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos: %(levelname)s: %(message)s'))

72

77

logger.addHandler(syslogger)

73

78

74

79

console = logging.StreamHandler()

79

84

class AvahiError(Exception):

80

85

def __init__(self, value):

81

86

self.value = value

87

super(AvahiError, self).__init__()

82

88

def __str__(self):

83

89

return repr(self.value)

84

90

106

112

a sensible number of times

107

113

"""

108

114

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

109

type = None, port = None, TXT = None, domain = "",

110

host = "", max_renames = 32768):

115

servicetype = None, port = None, TXT = None,

116

domain = "", host = "", max_renames = 32768):

111

117

self.interface = interface

112

118

self.name = name

113

self.type = type

119

self.type = servicetype

114

120

self.port = port

115

if TXT is None:

116

self.TXT = []

117

else:

118

self.TXT = TXT

121

self.TXT = TXT if TXT is not None else []

119

122

self.domain = domain

120

123

self.host = host

121

124

self.rename_count = 0

123

126

def rename(self):

124

127

"""Derived from the Avahi example code"""

125

128

if self.rename_count >= self.max_renames:

126

logger.critical(u"No suitable service name found after %i"

127

u" retries, exiting.", rename_count)

129

logger.critical(u"No suitable Zeroconf service name found"

130

u" after %i retries, exiting.",

131

self.rename_count)

128

132

raise AvahiServiceError("Too many renames")

129

133

self.name = server.GetAlternativeServiceName(self.name)

130

logger.info(u"Changing name to %r ...", str(self.name))

131

syslogger.setFormatter(logging.Formatter\

134

logger.info(u"Changing Zeroconf service name to %r ...",

135

str(self.name))

136

syslogger.setFormatter(logging.Formatter

132

137

('Mandos (%s): %%(levelname)s:'

133

' %%(message)s' % self.name))

138

' %%(message)s' % self.name))

134

139

self.remove()

135

140

self.add()

136

141

self.rename_count += 1

142

147

"""Derived from the Avahi example code"""

143

148

global group

144

149

if group is None:

145

group = dbus.Interface\

146

(bus.get_object(avahi.DBUS_NAME,

150

group = dbus.Interface(bus.get_object

151

(avahi.DBUS_NAME,

147

152

server.EntryGroupNew()),

148

avahi.DBUS_INTERFACE_ENTRY_GROUP)

153

avahi.DBUS_INTERFACE_ENTRY_GROUP)

149

154

group.connect_to_signal('StateChanged',

150

155

entry_group_state_changed)

151

logger.debug(u"Adding service '%s' of type '%s' ...",

156

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

152

157

service.name, service.type)

153

158

group.AddService(

154

159

self.interface, # interface

165

170

# End of Avahi example code

166

171

167

172

168

class Client(object):

173

class Client(dbus.service.Object):

169

174

"""A representation of a client host served by this server.

170

175

Attributes:

171

176

name: string; from the config file, used in log messages

173

178

uniquely identify the client

174

179

secret: bytestring; sent verbatim (over TLS) to client

175

180

host: string; available for use by the checker command

176

created: datetime.datetime(); object creation, not client host

177

last_checked_ok: datetime.datetime() or None if not yet checked OK

181

created: datetime.datetime(); (UTC) object creation

182

started: datetime.datetime(); (UTC) last started

183

last_checked_ok: datetime.datetime(); (UTC) or None

178

184

timeout: datetime.timedelta(); How long from last_checked_ok

179

185

until this client is invalid

180

186

interval: datetime.timedelta(); How often to start a new checker

196

202

_interval_milliseconds: - '' -

197

203

"""

198

204

def _set_timeout(self, timeout):

199

"Setter function for 'timeout' attribute"

205

"Setter function for the 'timeout' attribute"

200

206

self._timeout = timeout

201

207

self._timeout_milliseconds = ((self.timeout.days

202

208

* 24 * 60 * 60 * 1000)

203

209

+ (self.timeout.seconds * 1000)

204

210

+ (self.timeout.microseconds

205

211

// 1000))

206

timeout = property(lambda self: self._timeout,

207

_set_timeout)

212

# Emit D-Bus signal

213

self.TimeoutChanged(self._timeout_milliseconds)

214

timeout = property(lambda self: self._timeout, _set_timeout)

208

215

del _set_timeout

216

209

217

def _set_interval(self, interval):

210

"Setter function for 'interval' attribute"

218

"Setter function for the 'interval' attribute"

211

219

self._interval = interval

212

220

self._interval_milliseconds = ((self.interval.days

213

221

* 24 * 60 * 60 * 1000)

215

223

* 1000)

216

224

+ (self.interval.microseconds

217

225

// 1000))

218

interval = property(lambda self: self._interval,

219

_set_interval)

226

# Emit D-Bus signal

227

self.IntervalChanged(self._interval_milliseconds)

228

interval = property(lambda self: self._interval, _set_interval)

220

229

del _set_interval

221

def __init__(self, name = None, stop_hook=None, config={}):

230

231

def __init__(self, name = None, stop_hook=None, config=None):

222

232

"""Note: the 'checker' key in 'config' sets the

223

233

'checker_command' attribute and *not* the 'checker'

224

234

attribute."""

235

dbus.service.Object.__init__(self, bus,

236

"/Mandos/clients/%s"

237

% name.replace(".", "_"))

238

if config is None:

239

config = {}

225

240

self.name = name

226

241

logger.debug(u"Creating client %r", self.name)

227

242

# Uppercase and remove spaces from fingerprint for later

228

243

# comparison purposes with return value from the fingerprint()

229

244

# function

230

self.fingerprint = config["fingerprint"].upper()\

231

.replace(u" ", u"")

245

self.fingerprint = (config["fingerprint"].upper()

246

.replace(u" ", u""))

232

247

logger.debug(u" Fingerprint: %s", self.fingerprint)

233

248

if "secret" in config:

234

249

self.secret = config["secret"].decode(u"base64")

235

250

elif "secfile" in config:

236

sf = open(config["secfile"])

237

self.secret = sf.read()

238

sf.close()

251

with closing(open(os.path.expanduser

252

(os.path.expandvars

253

(config["secfile"])))) as secfile:

254

self.secret = secfile.read()

239

255

else:

240

256

raise TypeError(u"No secret or secfile for client %s"

241

257

% self.name)

242

258

self.host = config.get("host", "")

243

self.created = datetime.datetime.now()

259

self.created = datetime.datetime.utcnow()

260

self.started = None

244

261

self.last_checked_ok = None

245

262

self.timeout = string_to_delta(config["timeout"])

246

263

self.interval = string_to_delta(config["interval"])

250

267

self.stop_initiator_tag = None

251

268

self.checker_callback_tag = None

252

269

self.check_command = config["checker"]

270

253

271

def start(self):

254

272

"""Start this client's checker and timeout hooks"""

273

self.started = datetime.datetime.utcnow()

255

274

# Schedule a new checker to be started an 'interval' from now,

256

275

# and every interval from then on.

257

self.checker_initiator_tag = gobject.timeout_add\

258

(self._interval_milliseconds,

259

self.start_checker)

276

self.checker_initiator_tag = (gobject.timeout_add

277

(self._interval_milliseconds,

278

self.start_checker))

260

279

# Also start a new checker *right now*.

261

280

self.start_checker()

262

281

# Schedule a stop() when 'timeout' has passed

263

self.stop_initiator_tag = gobject.timeout_add\

264

(self._timeout_milliseconds,

265

self.stop)

282

self.stop_initiator_tag = (gobject.timeout_add

283

(self._timeout_milliseconds,

284

self.stop))

285

# Emit D-Bus signal

286

self.StateChanged(True)

287

266

288

def stop(self):

267

"""Stop this client.

268

The possibility that a client might be restarted is left open,

269

but not currently used."""

270

# If this client doesn't have a secret, it is already stopped.

271

if hasattr(self, "secret") and self.secret:

289

"""Stop this client."""

290

if getattr(self, "started", None) is not None:

272

291

logger.info(u"Stopping client %s", self.name)

273

self.secret = None

274

292

else:

275

293

return False

276

294

if getattr(self, "stop_initiator_tag", False):

282

300

self.stop_checker()

283

301

if self.stop_hook:

284

302

self.stop_hook(self)

303

self.started = None

304

# Emit D-Bus signal

305

self.StateChanged(False)

285

306

# Do not run this again if called by a gobject.timeout_add

286

307

return False

308

287

309

def __del__(self):

288

310

self.stop_hook = None

289

311

self.stop()

312

290

313

def checker_callback(self, pid, condition):

291

314

"""The checker has completed, so take appropriate actions."""

292

now = datetime.datetime.now()

293

315

self.checker_callback_tag = None

294

316

self.checker = None

295

if os.WIFEXITED(condition) \

296

and (os.WEXITSTATUS(condition) == 0):

317

if (os.WIFEXITED(condition)

318

and (os.WEXITSTATUS(condition) == 0)):

297

319

logger.info(u"Checker for %(name)s succeeded",

298

320

vars(self))

299

self.last_checked_ok = now

300

gobject.source_remove(self.stop_initiator_tag)

301

self.stop_initiator_tag = gobject.timeout_add\

302

(self._timeout_milliseconds,

303

self.stop)

321

# Emit D-Bus signal

322

self.CheckerCompleted(True)

323

self.bump_timeout()

304

324

elif not os.WIFEXITED(condition):

305

325

logger.warning(u"Checker for %(name)s crashed?",

306

326

vars(self))

327

# Emit D-Bus signal

328

self.CheckerCompleted(False)

307

329

else:

308

330

logger.info(u"Checker for %(name)s failed",

309

331

vars(self))

332

# Emit D-Bus signal

333

self.CheckerCompleted(False)

334

335

def bump_timeout(self):

336

"""Bump up the timeout for this client.

337

This should only be called when the client has been seen,

338

alive and well.

339

"""

340

self.last_checked_ok = datetime.datetime.utcnow()

341

gobject.source_remove(self.stop_initiator_tag)

342

self.stop_initiator_tag = (gobject.timeout_add

343

(self._timeout_milliseconds,

344

self.stop))

345

310

346

def start_checker(self):

311

347

"""Start a new checker subprocess if one is not running.

312

348

If a checker already exists, leave it running and do

337

373

try:

338

374

logger.info(u"Starting checker %r for %s",

339

375

command, self.name)

376

# We don't need to redirect stdout and stderr, since

377

# in normal mode, that is already done by daemon(),

378

# and in debug mode we don't want to. (Stdin is

379

# always replaced by /dev/null.)

340

380

self.checker = subprocess.Popen(command,

341

381

close_fds=True,

342

382

shell=True, cwd="/")

343

self.checker_callback_tag = gobject.child_watch_add\

344

(self.checker.pid,

345

self.checker_callback)

346

except subprocess.OSError, error:

383

self.checker_callback_tag = (gobject.child_watch_add

384

(self.checker.pid,

385

self.checker_callback))

386

# Emit D-Bus signal

387

self.CheckerStarted(command)

388

except OSError, error:

347

389

logger.error(u"Failed to start subprocess: %s",

348

390

error)

349

391

# Re-run this periodically if run by gobject.timeout_add

350

392

return True

393

351

394

def stop_checker(self):

352

395

"""Force the checker process, if any, to stop."""

353

396

if self.checker_callback_tag:

365

408

if error.errno != errno.ESRCH: # No such process

366

409

raise

367

410

self.checker = None

411

368

412

def still_valid(self):

369

413

"""Has the timeout not yet passed for this client?"""

370

now = datetime.datetime.now()

414

if not self.started:

415

return False

416

now = datetime.datetime.utcnow()

371

417

if self.last_checked_ok is None:

372

418

return now < (self.created + self.timeout)

373

419

else:

374

420

return now < (self.last_checked_ok + self.timeout)

421

422

## D-Bus methods & signals

423

_interface = u"org.mandos_system.Mandos.Client"

424

425

def _datetime_to_dbus_struct(dt):

426

return dbus.Struct(dt.year, dt.month, dt.day, dt.hour,

427

dt.minute, dt.second, dt.microsecond,

428

signature="nyyyyyu")

429

430

# BumpTimeout - method

431

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

432

BumpTimeout.__name__ = "BumpTimeout"

433

434

# IntervalChanged - signal

435

@dbus.service.signal(_interface, signature="t")

436

def IntervalChanged(self, t):

437

"D-Bus signal"

438

pass

439

440

# CheckerCompleted - signal

441

@dbus.service.signal(_interface, signature="b")

442

def CheckerCompleted(self, success):

443

"D-Bus signal"

444

pass

445

446

# CheckerIsRunning - method

447

@dbus.service.method(_interface, out_signature="b")

448

def CheckerIsRunning(self):

449

"D-Bus getter method"

450

return self.checker is not None

451

452

# CheckerStarted - signal

453

@dbus.service.signal(_interface, signature="s")

454

def CheckerStarted(self, command):

455

"D-Bus signal"

456

pass

457

458

# GetChecker - method

459

@dbus.service.method(_interface, out_signature="s")

460

def GetChecker(self):

461

"D-Bus getter method"

462

return self.checker_command

463

464

# GetCreated - method

465

@dbus.service.method(_interface, out_signature="(nyyyyyu)")

466

def GetCreated(self):

467

"D-Bus getter method"

468

return datetime_to_dbus_struct(self.created)

469

470

# GetFingerprint - method

471

@dbus.service.method(_interface, out_signature="s")

472

def GetFingerprint(self):

473

"D-Bus getter method"

474

return self.fingerprint

475

476

# GetHost - method

477

@dbus.service.method(_interface, out_signature="s")

478

def GetHost(self):

479

"D-Bus getter method"

480

return self.host

481

482

# GetInterval - method

483

@dbus.service.method(_interface, out_signature="t")

484

def GetInterval(self):

485

"D-Bus getter method"

486

return self._interval_milliseconds

487

488

# GetName - method

489

@dbus.service.method(_interface, out_signature="s")

490

def GetName(self):

491

"D-Bus getter method"

492

return self.name

493

494

# GetStarted - method

495

@dbus.service.method(_interface, out_signature="(nyyyyyu)")

496

def GetStarted(self):

497

"D-Bus getter method"

498

if self.started is not None:

499

return datetime_to_dbus_struct(self.started)

500

else:

501

return dbus.Struct(0, 0, 0, 0, 0, 0, 0,

502

signature="nyyyyyu")

503

504

# GetTimeout - method

505

@dbus.service.method(_interface, out_signature="t")

506

def GetTimeout(self):

507

"D-Bus getter method"

508

return self._timeout_milliseconds

509

510

# SetChecker - method

511

@dbus.service.method(_interface, in_signature="s")

512

def SetChecker(self, checker):

513

"D-Bus setter method"

514

self.checker_command = checker

515

516

# SetHost - method

517

@dbus.service.method(_interface, in_signature="s")

518

def SetHost(self, host):

519

"D-Bus setter method"

520

self.host = host

521

522

# SetInterval - method

523

@dbus.service.method(_interface, in_signature="t")

524

def SetInterval(self, milliseconds):

525

self.interval = datetime.timdeelta(0, 0, 0, milliseconds)

526

527

# SetTimeout - method

528

@dbus.service.method(_interface, in_signature="t")

529

def SetTimeout(self, milliseconds):

530

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

531

532

# SetSecret - method

533

@dbus.service.method(_interface, in_signature="ay",

534

byte_arrays=True)

535

def SetSecret(self, secret):

536

"D-Bus setter method"

537

self.secret = str(secret)

538

539

# Start - method

540

Start = dbus.service.method(_interface)(start)

541

Start.__name__ = "Start"

542

543

# StartChecker - method

544

StartChecker = dbus.service.method(_interface)(start_checker)

545

StartChecker.__name__ = "StartChecker"

546

547

# StateChanged - signal

548

@dbus.service.signal(_interface, signature="b")

549

def StateChanged(self, started):

550

"D-Bus signal"

551

pass

552

553

# StillValid - method

554

StillValid = (dbus.service.method(_interface, out_signature="b")

555

(still_valid))

556

StillValid.__name__ = "StillValid"

557

558

# Stop - method

559

Stop = dbus.service.method(_interface)(stop)

560

Stop.__name__ = "Stop"

561

562

# StopChecker - method

563

StopChecker = dbus.service.method(_interface)(stop_checker)

564

StopChecker.__name__ = "StopChecker"

565

566

# TimeoutChanged - signal

567

@dbus.service.signal(_interface, signature="t")

568

def TimeoutChanged(self, t):

569

"D-Bus signal"

570

pass

571

572

del _datetime_to_dbus_struct

573

del _interface

375

574

376

575

377

576

def peer_certificate(session):

378

577

"Return the peer's OpenPGP certificate as a bytestring"

379

578

# If not an OpenPGP certificate...

380

if gnutls.library.functions.gnutls_certificate_type_get\

381

(session._c_object) \

382

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:

579

if (gnutls.library.functions

580

.gnutls_certificate_type_get(session._c_object)

581

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

383

582

# ...do the normal thing

384

583

return session.peer_certificate

385

584

list_size = ctypes.c_uint()

386

cert_list = gnutls.library.functions.gnutls_certificate_get_peers\

387

(session._c_object, ctypes.byref(list_size))

585

cert_list = (gnutls.library.functions

586

.gnutls_certificate_get_peers

587

(session._c_object, ctypes.byref(list_size)))

388

588

if list_size.value == 0:

389

589

return None

390

590

cert = cert_list[0]

394

594

def fingerprint(openpgp):

395

595

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

396

596

# New GnuTLS "datum" with the OpenPGP public key

397

datum = gnutls.library.types.gnutls_datum_t\

398

(ctypes.cast(ctypes.c_char_p(openpgp),

399

ctypes.POINTER(ctypes.c_ubyte)),

400

ctypes.c_uint(len(openpgp)))

597

datum = (gnutls.library.types

598

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

599

ctypes.POINTER

600

(ctypes.c_ubyte)),

601

ctypes.c_uint(len(openpgp))))

401

602

# New empty GnuTLS certificate

402

603

crt = gnutls.library.types.gnutls_openpgp_crt_t()

403

gnutls.library.functions.gnutls_openpgp_crt_init\

404

(ctypes.byref(crt))

604

(gnutls.library.functions

605

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

405

606

# Import the OpenPGP public key into the certificate

406

gnutls.library.functions.gnutls_openpgp_crt_import\

407

(crt, ctypes.byref(datum),

408

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

607

(gnutls.library.functions

608

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

609

gnutls.library.constants

610

.GNUTLS_OPENPGP_FMT_RAW))

611

# Verify the self signature in the key

612

crtverify = ctypes.c_uint()

613

(gnutls.library.functions

614

.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))

615

if crtverify.value != 0:

616

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

617

raise gnutls.errors.CertificateSecurityError("Verify failed")

409

618

# New buffer for the fingerprint

410

buffer = ctypes.create_string_buffer(20)

411

buffer_length = ctypes.c_size_t()

619

buf = ctypes.create_string_buffer(20)

620

buf_len = ctypes.c_size_t()

412

621

# Get the fingerprint from the certificate into the buffer

413

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\

414

(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))

622

(gnutls.library.functions

623

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

624

ctypes.byref(buf_len)))

415

625

# Deinit the certificate

416

626

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

417

627

# Convert the buffer to a Python bytestring

418

fpr = ctypes.string_at(buffer, buffer_length.value)

628

fpr = ctypes.string_at(buf, buf_len.value)

419

629

# Convert the bytestring to hexadecimal notation

420

630

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

421

631

return hex_fpr

422

632

423

633

424

class tcp_handler(SocketServer.BaseRequestHandler, object):

634

class TCP_handler(SocketServer.BaseRequestHandler, object):

425

635

"""A TCP request handler class.

426

636

Instantiated by IPv6_TCPServer for each request to handle it.

427

637

Note: This will run in its own forked process."""

428

638

429

639

def handle(self):

430

640

logger.info(u"TCP connection from: %s",

431

unicode(self.client_address))

432

session = gnutls.connection.ClientSession\

433

(self.request, gnutls.connection.X509Credentials())

641

unicode(self.client_address))

642

session = (gnutls.connection

643

.ClientSession(self.request,

644

gnutls.connection

645

.X509Credentials()))

434

646

435

647

line = self.request.makefile().readline()

436

648

logger.debug(u"Protocol version: %r", line)

449

661

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

450

662

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

451

663

# "+DHE-DSS"))

452

priority = "NORMAL" # Fallback default, since this

453

# MUST be set.

454

if self.server.settings["priority"]:

455

priority = self.server.settings["priority"]

456

gnutls.library.functions.gnutls_priority_set_direct\

457

(session._c_object, priority, None);

664

# Use a fallback default, since this MUST be set.

665

priority = self.server.settings.get("priority", "NORMAL")

666

(gnutls.library.functions

667

.gnutls_priority_set_direct(session._c_object,

668

priority, None))

458

669

459

670

try:

460

671

session.handshake()

470

681

session.bye()

471

682

return

472

683

logger.debug(u"Fingerprint: %s", fpr)

473

client = None

474

684

for c in self.server.clients:

475

685

if c.fingerprint == fpr:

476

686

client = c

477

687

break

478

if not client:

688

else:

479

689

logger.warning(u"Client not found for fingerprint: %s",

480

690

fpr)

481

691

session.bye()

488

698

vars(client))

489

699

session.bye()

490

700

return

701

## This won't work here, since we're in a fork.

702

# client.bump_timeout()

491

703

sent_size = 0

492

704

while sent_size < len(client.secret):

493

705

sent = session.send(client.secret[sent_size:])

498

710

session.bye()

499

711

500

712

501

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

713

class IPv6_TCPServer(SocketServer.ForkingMixIn,

714

SocketServer.TCPServer, object):

502

715

"""IPv6 TCP server. Accepts 'None' as address and/or port.

503

716

Attributes:

504

717

settings: Server settings

505

718

clients: Set() of Client objects

719

enabled: Boolean; whether this server is activated yet

506

720

"""

507

721

address_family = socket.AF_INET6

508

722

def __init__(self, *args, **kwargs):

512

726

if "clients" in kwargs:

513

727

self.clients = kwargs["clients"]

514

728

del kwargs["clients"]

515

return super(type(self), self).__init__(*args, **kwargs)

729

self.enabled = False

730

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

516

731

def server_bind(self):

517

732

"""This overrides the normal server_bind() function

518

733

to bind to an interface if one was specified, and also NOT to

547

762

# if_nametoindex

548

763

# (self.settings

549

764

# ["interface"]))

550

return super(type(self), self).server_bind()

765

return super(IPv6_TCPServer, self).server_bind()

766

def server_activate(self):

767

if self.enabled:

768

return super(IPv6_TCPServer, self).server_activate()

769

def enable(self):

770

self.enabled = True

551

771

552

772

553

773

def string_to_delta(interval):

563

783

datetime.timedelta(1)

564

784

>>> string_to_delta(u'1w')

565

785

datetime.timedelta(7)

786

>>> string_to_delta('5m 30s')

787

datetime.timedelta(0, 330)

566

788

"""

567

try:

568

suffix=unicode(interval[-1])

569

value=int(interval[:-1])

570

if suffix == u"d":

571

delta = datetime.timedelta(value)

572

elif suffix == u"s":

573

delta = datetime.timedelta(0, value)

574

elif suffix == u"m":

575

delta = datetime.timedelta(0, 0, 0, 0, value)

576

elif suffix == u"h":

577

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

578

elif suffix == u"w":

579

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

580

else:

789

timevalue = datetime.timedelta(0)

790

for s in interval.split():

791

try:

792

suffix = unicode(s[-1])

793

value = int(s[:-1])

794

if suffix == u"d":

795

delta = datetime.timedelta(value)

796

elif suffix == u"s":

797

delta = datetime.timedelta(0, value)

798

elif suffix == u"m":

799

delta = datetime.timedelta(0, 0, 0, 0, value)

800

elif suffix == u"h":

801

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

802

elif suffix == u"w":

803

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

804

else:

805

raise ValueError

806

except (ValueError, IndexError):

581

807

raise ValueError

582

except (ValueError, IndexError):

583

raise ValueError

584

return delta

808

timevalue += delta

809

return timevalue

585

810

586

811

587

812

def server_state_changed(state):

588

813

"""Derived from the Avahi example code"""

589

814

if state == avahi.SERVER_COLLISION:

590

logger.error(u"Server name collision")

815

logger.error(u"Zeroconf server name collision")

591

816

service.remove()

592

817

elif state == avahi.SERVER_RUNNING:

593

818

service.add()

595

820

596

821

def entry_group_state_changed(state, error):

597

822

"""Derived from the Avahi example code"""

598

logger.debug(u"state change: %i", state)

823

logger.debug(u"Avahi state change: %i", state)

599

824

600

825

if state == avahi.ENTRY_GROUP_ESTABLISHED:

601

logger.debug(u"Service established.")

826

logger.debug(u"Zeroconf service established.")

602

827

elif state == avahi.ENTRY_GROUP_COLLISION:

603

logger.warning(u"Service name collision.")

828

logger.warning(u"Zeroconf service name collision.")

604

829

service.rename()

605

830

elif state == avahi.ENTRY_GROUP_FAILURE:

606

logger.critical(u"Error in group state changed %s",

831

logger.critical(u"Avahi: Error in group state changed %s",

607

832

unicode(error))

608

833

raise AvahiGroupError("State changed: %s", str(error))

609

834

611

836

"""Call the C function if_nametoindex(), or equivalent"""

612

837

global if_nametoindex

613

838

try:

614

if "ctypes.util" not in sys.modules:

615

import ctypes.util

616

if_nametoindex = ctypes.cdll.LoadLibrary\

617

(ctypes.util.find_library("c")).if_nametoindex

839

if_nametoindex = (ctypes.cdll.LoadLibrary

840

(ctypes.util.find_library("c"))

841

.if_nametoindex)

618

842

except (OSError, AttributeError):

619

843

if "struct" not in sys.modules:

620

844

import struct

623

847

def if_nametoindex(interface):

624

848

"Get an interface index the hard way, i.e. using fcntl()"

625

849

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

626

s = socket.socket()

627

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

628

struct.pack("16s16x", interface))

629

s.close()

850

with closing(socket.socket()) as s:

851

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

852

struct.pack("16s16x", interface))

630

853

interface_index = struct.unpack("I", ifreq[16:20])[0]

631

854

return interface_index

632

855

return if_nametoindex(interface)

656

879

657

880

658

881

def main():

659

global main_loop_started

660

main_loop_started = False

661

662

882

parser = OptionParser(version = "%%prog %s" % version)

663

883

parser.add_option("-i", "--interface", type="string",

664

884

metavar="IF", help="Bind to interface IF")

679

899

default="/etc/mandos", metavar="DIR",

680

900

help="Directory to search for configuration"

681

901

" files")

682

(options, args) = parser.parse_args()

902

options = parser.parse_args()[0]

683

903

684

904

if options.check:

685

905

import doctest

700

920

server_config = ConfigParser.SafeConfigParser(server_defaults)

701

921

del server_defaults

702

922

server_config.read(os.path.join(options.configdir, "mandos.conf"))

703

server_section = "server"

704

923

# Convert the SafeConfigParser object to a dict

705

server_settings = dict(server_config.items(server_section))

924

server_settings = server_config.defaults()

706

925

# Use getboolean on the boolean config option

707

server_settings["debug"] = server_config.getboolean\

708

(server_section, "debug")

926

server_settings["debug"] = (server_config.getboolean

927

("DEFAULT", "debug"))

709

928

del server_config

710

929

711

930

# Override the settings from the config file with command line

725

944

console.setLevel(logging.WARNING)

726

945

727

946

if server_settings["servicename"] != "Mandos":

728

syslogger.setFormatter(logging.Formatter\

947

syslogger.setFormatter(logging.Formatter

729

948

('Mandos (%s): %%(levelname)s:'

730

949

' %%(message)s'

731

950

% server_settings["servicename"]))

733

952

# Parse config file with clients

734

953

client_defaults = { "timeout": "1h",

735

954

"interval": "5m",

736

"checker": "fping -q -- %%(host)s",

955

"checker": "fping -q -- %(host)s",

956

"host": "",

737

957

}

738

958

client_config = ConfigParser.SafeConfigParser(client_defaults)

739

959

client_config.read(os.path.join(server_settings["configdir"],

740

960

"clients.conf"))

741

961

962

clients = Set()

963

tcp_server = IPv6_TCPServer((server_settings["address"],

964

server_settings["port"]),

965

TCP_handler,

966

settings=server_settings,

967

clients=clients)

968

pidfilename = "/var/run/mandos.pid"

969

try:

970

pidfile = open(pidfilename, "w")

971

except IOError, error:

972

logger.error("Could not open file %r", pidfilename)

973

974

uid = 65534

975

gid = 65534

976

try:

977

uid = pwd.getpwnam("mandos").pw_uid

978

except KeyError:

979

try:

980

uid = pwd.getpwnam("nobody").pw_uid

981

except KeyError:

982

pass

983

try:

984

gid = pwd.getpwnam("mandos").pw_gid

985

except KeyError:

986

try:

987

gid = pwd.getpwnam("nogroup").pw_gid

988

except KeyError:

989

pass

990

try:

991

os.setuid(uid)

992

os.setgid(gid)

993

except OSError, error:

994

if error[0] != errno.EPERM:

995

raise error

996

742

997

global service

743

998

service = AvahiService(name = server_settings["servicename"],

744

type = "_mandos._tcp", );

999

servicetype = "_mandos._tcp", )

745

1000

if server_settings["interface"]:

746

service.interface = if_nametoindex(server_settings["interface"])

1001

service.interface = (if_nametoindex

1002

(server_settings["interface"]))

747

1003

748

1004

global main_loop

749

1005

global bus

752

1008

DBusGMainLoop(set_as_default=True )

753

1009

main_loop = gobject.MainLoop()

754

1010

bus = dbus.SystemBus()

755

server = dbus.Interface(

756

bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),

757

avahi.DBUS_INTERFACE_SERVER )

1011

server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,

1012

avahi.DBUS_PATH_SERVER),

1013

avahi.DBUS_INTERFACE_SERVER)

758

1014

# End of Avahi example code

1015

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)

759

1016

760

clients = Set()

761

1017

def remove_from_clients(client):

762

1018

clients.remove(client)

763

1019

if not clients:

773

1029

logger.critical(u"No clients defined")

774

1030

sys.exit(1)

775

1031

776

if not debug:

1032

if debug:

1033

# Redirect stdin so all checkers get /dev/null

1034

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1035

os.dup2(null, sys.stdin.fileno())

1036

if null > 2:

1037

os.close(null)

1038

else:

1039

# No console logging

777

1040

logger.removeHandler(console)

1041

# Close all input and output, do double fork, etc.

778

1042

daemon()

779

1043

780

pidfilename = "/var/run/mandos/mandos.pid"

781

pid = os.getpid()

782

1044

try:

783

pidfile = open(pidfilename, "w")

1045

pid = os.getpid()

784

1046

pidfile.write(str(pid) + "\n")

785

1047

pidfile.close()

786

1048

del pidfile

787

except IOError, err:

788

logger.error(u"Could not write %s file with PID %d",

789

pidfilename, os.getpid())

1049

except IOError:

1050

logger.error(u"Could not write to file %r with PID %d",

1051

pidfilename, pid)

1052

except NameError:

1053

# "pidfile" was never created

1054

pass

1055

del pidfilename

790

1056

791

1057

def cleanup():

792

1058

"Cleanup function; run on exit"

812

1078

for client in clients:

813

1079

client.start()

814

1080

815

tcp_server = IPv6_TCPServer((server_settings["address"],

816

server_settings["port"]),

817

tcp_handler,

818

settings=server_settings,

819

clients=clients)

1081

tcp_server.enable()

1082

tcp_server.server_activate()

1083

820

1084

# Find out what port we got

821

1085

service.port = tcp_server.socket.getsockname()[1]

822

1086

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

836

1100

837

1101

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

838

1102

lambda *args, **kwargs:

839

tcp_server.handle_request\

840

(*args[2:], **kwargs) or True)

1103

(tcp_server.handle_request

1104

(*args[2:], **kwargs) or True))

841

1105

842

1106

logger.debug(u"Starting main loop")

843

main_loop_started = True

844

1107

main_loop.run()

845

1108

except AvahiError, error:

846

1109

logger.critical(u"AvahiError: %s" + unicode(error))