To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 24.1.22
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.22
- Committer: Björn Påhlsson
- Date: 2008-08-08 01:25:27 UTC
- mfrom: (49 mandos)
- mto: (24.1.154 mandos) (237.4.3 mandos-release)
- mto: This revision was merged to the branch mainline in revision 50.
- Revision ID: belorn@braxen-20080808012527-s03r8xd2b20ncon0
merge
- files added:
- mandos.conf
- files removed:
- ca.pem
- files renamed:
- mandos-clients.conf => clients.conf
- server.py => mandos
- plugbasedclient.c => mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- plugins.d/mandosclient.c => plugins.d/password-request.c
- files modified:
- Makefile
added
removed
mandos
1
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
# Mandos server - give out binary blobs to connecting clients.
5
#
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
#
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
15
#
16
# This program is free software: you can redistribute it and/or modify
17
# it under the terms of the GNU General Public License as published by
18
# the Free Software Foundation, either version 3 of the License, or
19
# (at your option) any later version.
20
#
21
# This program is distributed in the hope that it will be useful,
22
# but WITHOUT ANY WARRANTY; without even the implied warranty of
23
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24
# GNU General Public License for more details.
25
#
26
# You should have received a copy of the GNU General Public License
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
28
#
29
# Contact the authors at <mandos@fukt.bsnet.se>.
30
#
2
31
3
32
from __future__ import division
4
33
21
50
import signal
22
51
from sets import Set
23
52
import subprocess
53
import atexit
54
import stat
55
import logging
56
import logging.handlers
24
57
25
58
import dbus
26
59
import gobject
28
61
from dbus.mainloop.glib import DBusGMainLoop
29
62
import ctypes
30
63
31
import logging
32
import logging.handlers
33
34
# logghandler.setFormatter(logging.Formatter('%(levelname)s %(message)s')
35
64
36
65
logger = logging.Logger('mandos')
37
logger.addHandler(logging.handlers.SysLogHandler(facility = logging.handlers.SysLogHandler.LOG_DAEMON))
38
39
# This variable is used to optionally bind to a specified interface.
40
# It is a global variable to fit in with the other variables from the
41
# Avahi server example code.
42
serviceInterface = avahi.IF_UNSPEC
43
# From the Avahi server example code:
44
serviceName = "Mandos"
45
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
46
servicePort = None # Not known at startup
47
serviceTXT = [] # TXT record for the service
48
domain = "" # Domain to publish on, default to .local
49
host = "" # Host to publish records for, default to localhost
50
group = None #our entry group
51
rename_count = 12 # Counter so we only rename after collisions a
52
# sensible number of times
66
syslogger = logging.handlers.SysLogHandler\
67
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
68
syslogger.setFormatter(logging.Formatter\
69
('%(levelname)s: %(message)s'))
70
logger.addHandler(syslogger)
71
del syslogger
72
73
74
class AvahiError(Exception):
75
def __init__(self, value):
76
self.value = value
77
def __str__(self):
78
return repr(self.value)
79
80
class AvahiServiceError(AvahiError):
81
pass
82
83
class AvahiGroupError(AvahiError):
84
pass
85
86
87
class AvahiService(object):
88
"""An Avahi (Zeroconf) service.
89
Attributes:
90
interface: integer; avahi.IF_UNSPEC or an interface index.
91
Used to optionally bind to the specified interface.
92
name: string; Example: 'Mandos'
93
type: string; Example: '_mandos._tcp'.
94
See <http://www.dns-sd.org/ServiceTypes.html>
95
port: integer; what port to announce
96
TXT: list of strings; TXT record for the service
97
domain: string; Domain to publish on, default to .local if empty.
98
host: string; Host to publish records for, default is localhost
99
max_renames: integer; maximum number of renames
100
rename_count: integer; counter so we only rename after collisions
101
a sensible number of times
102
"""
103
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
104
type = None, port = None, TXT = None, domain = "",
105
host = "", max_renames = 12):
106
self.interface = interface
107
self.name = name
108
self.type = type
109
self.port = port
110
if TXT is None:
111
self.TXT = []
112
else:
113
self.TXT = TXT
114
self.domain = domain
115
self.host = host
116
self.rename_count = 0
117
def rename(self):
118
"""Derived from the Avahi example code"""
119
if self.rename_count >= self.max_renames:
120
logger.critical(u"No suitable service name found after %i"
121
u" retries, exiting.", rename_count)
122
raise AvahiServiceError("Too many renames")
123
name = server.GetAlternativeServiceName(name)
124
logger.error(u"Changing name to %r ...", name)
125
self.remove()
126
self.add()
127
self.rename_count += 1
128
def remove(self):
129
"""Derived from the Avahi example code"""
130
if group is not None:
131
group.Reset()
132
def add(self):
133
"""Derived from the Avahi example code"""
134
global group
135
if group is None:
136
group = dbus.Interface\
137
(bus.get_object(avahi.DBUS_NAME,
138
server.EntryGroupNew()),
139
avahi.DBUS_INTERFACE_ENTRY_GROUP)
140
group.connect_to_signal('StateChanged',
141
entry_group_state_changed)
142
logger.debug(u"Adding service '%s' of type '%s' ...",
143
service.name, service.type)
144
group.AddService(
145
self.interface, # interface
146
avahi.PROTO_INET6, # protocol
147
dbus.UInt32(0), # flags
148
self.name, self.type,
149
self.domain, self.host,
150
dbus.UInt16(self.port),
151
avahi.string_array_to_txt_array(self.TXT))
152
group.Commit()
153
154
# From the Avahi example code:
155
group = None # our entry group
53
156
# End of Avahi example code
54
157
55
158
61
164
uniquely identify the client
62
165
secret: bytestring; sent verbatim (over TLS) to client
63
166
fqdn: string (FQDN); available for use by the checker command
64
created: datetime.datetime()
65
last_seen: datetime.datetime() or None if not yet seen
66
timeout: datetime.timedelta(); How long from last_seen until
67
this client is invalid
167
created: datetime.datetime(); object creation, not client host
168
last_checked_ok: datetime.datetime() or None if not yet checked OK
169
timeout: datetime.timedelta(); How long from last_checked_ok
170
until this client is invalid
68
171
interval: datetime.timedelta(); How often to start a new checker
69
172
stop_hook: If set, called by stop() as stop_hook(self)
70
173
checker: subprocess.Popen(); a running checker process used
71
174
to see if the client lives.
72
Is None if no process is running.
175
'None' if no process is running.
73
176
checker_initiator_tag: a gobject event source tag, or None
74
177
stop_initiator_tag: - '' -
75
178
checker_callback_tag: - '' -
76
179
checker_command: string; External command which is run to check if
77
client lives. %()s expansions are done at
180
client lives. %() expansions are done at
78
181
runtime with vars(self) as dict, so that for
79
182
instance %(name)s can be used in the command.
80
183
Private attibutes:
81
184
_timeout: Real variable for 'timeout'
82
185
_interval: Real variable for 'interval'
83
_timeout_milliseconds: Used by gobject.timeout_add()
186
_timeout_milliseconds: Used when calling gobject.timeout_add()
84
187
_interval_milliseconds: - '' -
85
188
"""
86
189
def _set_timeout(self, timeout):
106
209
interval = property(lambda self: self._interval,
107
210
_set_interval)
108
211
del _set_interval
109
def __init__(self, name=None, options=None, stop_hook=None,
110
fingerprint=None, secret=None, secfile=None, fqdn=None,
111
timeout=None, interval=-1, checker=None):
212
def __init__(self, name = None, stop_hook=None, config={}):
213
"""Note: the 'checker' key in 'config' sets the
214
'checker_command' attribute and *not* the 'checker'
215
attribute."""
112
216
self.name = name
113
# Uppercase and remove spaces from fingerprint
114
# for later comparison purposes with return value of
115
# the fingerprint() function
116
self.fingerprint = fingerprint.upper().replace(u" ", u"")
117
if secret:
118
self.secret = secret.decode(u"base64")
119
elif secfile:
120
sf = open(secfile)
217
logger.debug(u"Creating client %r", self.name)
218
# Uppercase and remove spaces from fingerprint for later
219
# comparison purposes with return value from the fingerprint()
220
# function
221
self.fingerprint = config["fingerprint"].upper()\
222
.replace(u" ", u"")
223
logger.debug(u" Fingerprint: %s", self.fingerprint)
224
if "secret" in config:
225
self.secret = config["secret"].decode(u"base64")
226
elif "secfile" in config:
227
sf = open(config["secfile"])
121
228
self.secret = sf.read()
122
229
sf.close()
123
230
else:
124
raise RuntimeError(u"No secret or secfile for client %s"
125
% self.name)
126
self.fqdn = fqdn # string
231
raise TypeError(u"No secret or secfile for client %s"
232
% self.name)
233
self.fqdn = config.get("fqdn", "")
127
234
self.created = datetime.datetime.now()
128
self.last_seen = None
129
if timeout is None:
130
timeout = options.timeout
131
self.timeout = timeout
132
if interval == -1:
133
interval = options.interval
134
else:
135
interval = string_to_delta(interval)
136
self.interval = interval
235
self.last_checked_ok = None
236
self.timeout = string_to_delta(config["timeout"])
237
self.interval = string_to_delta(config["interval"])
137
238
self.stop_hook = stop_hook
138
239
self.checker = None
139
240
self.checker_initiator_tag = None
140
241
self.stop_initiator_tag = None
141
242
self.checker_callback_tag = None
142
self.check_command = checker
243
self.check_command = config["checker"]
143
244
def start(self):
144
"""Start this clients checker and timeout hooks"""
245
"""Start this client's checker and timeout hooks"""
145
246
# Schedule a new checker to be started an 'interval' from now,
146
247
# and every interval from then on.
147
248
self.checker_initiator_tag = gobject.timeout_add\
155
256
self.stop)
156
257
def stop(self):
157
258
"""Stop this client.
158
The possibility that this client might be restarted is left
159
open, but not currently used."""
160
logger.debug(u"Stopping client %s", self.name)
161
self.secret = None
162
if self.stop_initiator_tag:
259
The possibility that a client might be restarted is left open,
260
but not currently used."""
261
# If this client doesn't have a secret, it is already stopped.
262
if self.secret:
263
logger.info(u"Stopping client %s", self.name)
264
self.secret = None
265
else:
266
return False
267
if getattr(self, "stop_initiator_tag", False):
163
268
gobject.source_remove(self.stop_initiator_tag)
164
269
self.stop_initiator_tag = None
165
if self.checker_initiator_tag:
270
if getattr(self, "checker_initiator_tag", False):
166
271
gobject.source_remove(self.checker_initiator_tag)
167
272
self.checker_initiator_tag = None
168
273
self.stop_checker()
171
276
# Do not run this again if called by a gobject.timeout_add
172
277
return False
173
278
def __del__(self):
174
# Some code duplication here and in stop()
175
if hasattr(self, "stop_initiator_tag") \
176
and self.stop_initiator_tag:
177
gobject.source_remove(self.stop_initiator_tag)
178
self.stop_initiator_tag = None
179
if hasattr(self, "checker_initiator_tag") \
180
and self.checker_initiator_tag:
181
gobject.source_remove(self.checker_initiator_tag)
182
self.checker_initiator_tag = None
183
self.stop_checker()
279
self.stop_hook = None
280
self.stop()
184
281
def checker_callback(self, pid, condition):
185
282
"""The checker has completed, so take appropriate actions."""
186
283
now = datetime.datetime.now()
284
self.checker_callback_tag = None
285
self.checker = None
187
286
if os.WIFEXITED(condition) \
188
287
and (os.WEXITSTATUS(condition) == 0):
189
logger.debug(u"Checker for %(name)s succeeded",
190
vars(self))
191
self.last_seen = now
288
logger.info(u"Checker for %(name)s succeeded",
289
vars(self))
290
self.last_checked_ok = now
192
291
gobject.source_remove(self.stop_initiator_tag)
193
292
self.stop_initiator_tag = gobject.timeout_add\
194
293
(self._timeout_milliseconds,
195
294
self.stop)
196
if not os.WIFEXITED(condition):
295
elif not os.WIFEXITED(condition):
197
296
logger.warning(u"Checker for %(name)s crashed?",
198
297
vars(self))
199
298
else:
200
logger.debug(u"Checker for %(name)s failed",
201
vars(self))
202
self.checker = None
203
self.checker_callback_tag = None
299
logger.info(u"Checker for %(name)s failed",
300
vars(self))
204
301
def start_checker(self):
205
302
"""Start a new checker subprocess if one is not running.
206
303
If a checker already exists, leave it running and do
207
304
nothing."""
305
# The reason for not killing a running checker is that if we
306
# did that, then if a checker (for some reason) started
307
# running slowly and taking more than 'interval' time, the
308
# client would inevitably timeout, since no checker would get
309
# a chance to run to completion. If we instead leave running
310
# checkers alone, the checker would have to take more time
311
# than 'timeout' for the client to be declared invalid, which
312
# is as it should be.
208
313
if self.checker is None:
209
logger.debug(u"Starting checker for %s",
210
self.name)
211
314
try:
315
# In case check_command has exactly one % operator
212
316
command = self.check_command % self.fqdn
213
317
except TypeError:
318
# Escape attributes for the shell
214
319
escaped_attrs = dict((key, re.escape(str(val)))
215
320
for key, val in
216
321
vars(self).iteritems())
217
322
try:
218
323
command = self.check_command % escaped_attrs
219
324
except TypeError, error:
220
logger.critical(u'Could not format string "%s": %s',
221
self.check_command, error)
325
logger.error(u'Could not format string "%s":'
326
u' %s', self.check_command, error)
222
327
return True # Try again later
223
328
try:
224
self.checker = subprocess.\
225
Popen(command,
226
stdout=subprocess.PIPE,
227
close_fds=True, shell=True,
228
cwd="/")
229
self.checker_callback_tag = gobject.\
230
child_watch_add(self.checker.pid,
231
self.\
232
checker_callback)
329
logger.info(u"Starting checker %r for %s",
330
command, self.name)
331
self.checker = subprocess.Popen(command,
332
close_fds=True,
333
shell=True, cwd="/")
334
self.checker_callback_tag = gobject.child_watch_add\
335
(self.checker.pid,
336
self.checker_callback)
233
337
except subprocess.OSError, error:
234
338
logger.error(u"Failed to start subprocess: %s",
235
339
error)
237
341
return True
238
342
def stop_checker(self):
239
343
"""Force the checker process, if any, to stop."""
240
if not hasattr(self, "checker") or self.checker is None:
344
if self.checker_callback_tag:
345
gobject.source_remove(self.checker_callback_tag)
346
self.checker_callback_tag = None
347
if getattr(self, "checker", None) is None:
241
348
return
242
gobject.source_remove(self.checker_callback_tag)
243
self.checker_callback_tag = None
244
os.kill(self.checker.pid, signal.SIGTERM)
245
if self.checker.poll() is None:
246
os.kill(self.checker.pid, signal.SIGKILL)
349
logger.debug("Stopping checker for %(name)s", vars(self))
350
try:
351
os.kill(self.checker.pid, signal.SIGTERM)
352
#os.sleep(0.5)
353
#if self.checker.poll() is None:
354
# os.kill(self.checker.pid, signal.SIGKILL)
355
except OSError, error:
356
if error.errno != errno.ESRCH: # No such process
357
raise
247
358
self.checker = None
248
def still_valid(self, now=None):
359
def still_valid(self):
249
360
"""Has the timeout not yet passed for this client?"""
250
if now is None:
251
now = datetime.datetime.now()
252
if self.last_seen is None:
361
now = datetime.datetime.now()
362
if self.last_checked_ok is None:
253
363
return now < (self.created + self.timeout)
254
364
else:
255
return now < (self.last_seen + self.timeout)
365
return now < (self.last_checked_ok + self.timeout)
256
366
257
367
258
368
def peer_certificate(session):
369
"Return the peer's OpenPGP certificate as a bytestring"
259
370
# If not an OpenPGP certificate...
260
371
if gnutls.library.functions.gnutls_certificate_type_get\
261
372
(session._c_object) \
272
383
273
384
274
385
def fingerprint(openpgp):
275
# New empty GnuTLS certificate
276
crt = gnutls.library.types.gnutls_openpgp_crt_t()
277
gnutls.library.functions.gnutls_openpgp_crt_init\
278
(ctypes.byref(crt))
386
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
279
387
# New GnuTLS "datum" with the OpenPGP public key
280
388
datum = gnutls.library.types.gnutls_datum_t\
281
389
(ctypes.cast(ctypes.c_char_p(openpgp),
282
390
ctypes.POINTER(ctypes.c_ubyte)),
283
391
ctypes.c_uint(len(openpgp)))
392
# New empty GnuTLS certificate
393
crt = gnutls.library.types.gnutls_openpgp_crt_t()
394
gnutls.library.functions.gnutls_openpgp_crt_init\
395
(ctypes.byref(crt))
284
396
# Import the OpenPGP public key into the certificate
285
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
286
(crt,
287
ctypes.byref(datum),
288
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
397
gnutls.library.functions.gnutls_openpgp_crt_import\
398
(crt, ctypes.byref(datum),
399
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
289
400
# New buffer for the fingerprint
290
401
buffer = ctypes.create_string_buffer(20)
291
402
buffer_length = ctypes.c_size_t()
307
418
Note: This will run in its own forked process."""
308
419
309
420
def handle(self):
310
logger.debug(u"TCP connection from: %s",
421
logger.info(u"TCP connection from: %s",
311
422
unicode(self.client_address))
312
session = gnutls.connection.ClientSession(self.request,
313
gnutls.connection.\
314
X509Credentials())
423
session = gnutls.connection.ClientSession\
424
(self.request, gnutls.connection.X509Credentials())
425
426
line = self.request.makefile().readline()
427
logger.debug(u"Protocol version: %r", line)
428
try:
429
if int(line.strip().split()[0]) > 1:
430
raise RuntimeError
431
except (ValueError, IndexError, RuntimeError), error:
432
logger.error(u"Unknown protocol version: %s", error)
433
return
434
435
# Note: gnutls.connection.X509Credentials is really a generic
436
# GnuTLS certificate credentials object so long as no X.509
437
# keys are added to it. Therefore, we can use it here despite
438
# using OpenPGP certificates.
315
439
316
440
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
317
441
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
318
442
# "+DHE-DSS"))
319
priority = "SECURE256"
320
443
priority = "NORMAL" # Fallback default, since this
444
# MUST be set.
445
if self.server.settings["priority"]:
446
priority = self.server.settings["priority"]
321
447
gnutls.library.functions.gnutls_priority_set_direct\
322
448
(session._c_object, priority, None);
323
449
324
450
try:
325
451
session.handshake()
326
452
except gnutls.errors.GNUTLSError, error:
327
logger.debug(u"Handshake failed: %s", error)
453
logger.warning(u"Handshake failed: %s", error)
328
454
# Do not run session.bye() here: the session is not
329
455
# established. Just abandon the request.
330
456
return
331
457
try:
332
458
fpr = fingerprint(peer_certificate(session))
333
459
except (TypeError, gnutls.errors.GNUTLSError), error:
334
logger.debug(u"Bad certificate: %s", error)
460
logger.warning(u"Bad certificate: %s", error)
335
461
session.bye()
336
462
return
337
463
logger.debug(u"Fingerprint: %s", fpr)
338
464
client = None
339
for c in clients:
465
for c in self.server.clients:
340
466
if c.fingerprint == fpr:
341
467
client = c
342
468
break
469
if not client:
470
logger.warning(u"Client not found for fingerprint: %s",
471
fpr)
472
session.bye()
473
return
343
474
# Have to check if client.still_valid(), since it is possible
344
475
# that the client timed out while establishing the GnuTLS
345
476
# session.
346
if (not client) or (not client.still_valid()):
347
if client:
348
logger.debug(u"Client %(name)s is invalid",
349
vars(client))
350
else:
351
logger.debug(u"Client not found for fingerprint: %s",
352
fpr)
477
if not client.still_valid():
478
logger.warning(u"Client %(name)s is invalid",
479
vars(client))
353
480
session.bye()
354
481
return
355
482
sent_size = 0
365
492
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
366
493
"""IPv6 TCP server. Accepts 'None' as address and/or port.
367
494
Attributes:
368
options: Command line options
495
settings: Server settings
369
496
clients: Set() of Client objects
370
497
"""
371
498
address_family = socket.AF_INET6
372
499
def __init__(self, *args, **kwargs):
373
if "options" in kwargs:
374
self.options = kwargs["options"]
375
del kwargs["options"]
500
if "settings" in kwargs:
501
self.settings = kwargs["settings"]
502
del kwargs["settings"]
376
503
if "clients" in kwargs:
377
504
self.clients = kwargs["clients"]
378
505
del kwargs["clients"]
381
508
"""This overrides the normal server_bind() function
382
509
to bind to an interface if one was specified, and also NOT to
383
510
bind to an address or port if they were not specified."""
384
if self.options.interface:
385
if not hasattr(socket, "SO_BINDTODEVICE"):
386
# From /usr/include/asm-i486/socket.h
387
socket.SO_BINDTODEVICE = 25
511
if self.settings["interface"]:
512
# 25 is from /usr/include/asm-i486/socket.h
513
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
388
514
try:
389
515
self.socket.setsockopt(socket.SOL_SOCKET,
390
socket.SO_BINDTODEVICE,
391
self.options.interface)
516
SO_BINDTODEVICE,
517
self.settings["interface"])
392
518
except socket.error, error:
393
519
if error[0] == errno.EPERM:
394
logger.warning(u"No permission to"
395
u" bind to interface %s",
396
self.options.interface)
520
logger.error(u"No permission to"
521
u" bind to interface %s",
522
self.settings["interface"])
397
523
else:
398
524
raise error
399
525
# Only bind(2) the socket if we really need to.
402
528
in6addr_any = "::"
403
529
self.server_address = (in6addr_any,
404
530
self.server_address[1])
405
elif self.server_address[1] is None:
531
elif not self.server_address[1]:
406
532
self.server_address = (self.server_address[0],
407
533
0)
534
# if self.settings["interface"]:
535
# self.server_address = (self.server_address[0],
536
# 0, # port
537
# 0, # flowinfo
538
# if_nametoindex
539
# (self.settings
540
# ["interface"]))
408
541
return super(type(self), self).server_bind()
409
542
410
543
442
575
return delta
443
576
444
577
445
def add_service():
446
"""From the Avahi server example code"""
447
global group, serviceName, serviceType, servicePort, serviceTXT, \
448
domain, host
449
if group is None:
450
group = dbus.Interface(
451
bus.get_object( avahi.DBUS_NAME,
452
server.EntryGroupNew()),
453
avahi.DBUS_INTERFACE_ENTRY_GROUP)
454
group.connect_to_signal('StateChanged',
455
entry_group_state_changed)
456
logger.debug(u"Adding service '%s' of type '%s' ...",
457
serviceName, serviceType)
458
459
group.AddService(
460
serviceInterface, # interface
461
avahi.PROTO_INET6, # protocol
462
dbus.UInt32(0), # flags
463
serviceName, serviceType,
464
domain, host,
465
dbus.UInt16(servicePort),
466
avahi.string_array_to_txt_array(serviceTXT))
467
group.Commit()
468
469
470
def remove_service():
471
"""From the Avahi server example code"""
472
global group
473
474
if not group is None:
475
group.Reset()
476
477
478
578
def server_state_changed(state):
479
"""From the Avahi server example code"""
579
"""Derived from the Avahi example code"""
480
580
if state == avahi.SERVER_COLLISION:
481
logger.warning(u"Server name collision")
482
remove_service()
581
logger.error(u"Server name collision")
582
service.remove()
483
583
elif state == avahi.SERVER_RUNNING:
484
add_service()
584
service.add()
485
585
486
586
487
587
def entry_group_state_changed(state, error):
488
"""From the Avahi server example code"""
489
global serviceName, server, rename_count
490
588
"""Derived from the Avahi example code"""
491
589
logger.debug(u"state change: %i", state)
492
590
493
591
if state == avahi.ENTRY_GROUP_ESTABLISHED:
494
592
logger.debug(u"Service established.")
495
593
elif state == avahi.ENTRY_GROUP_COLLISION:
496
497
rename_count = rename_count - 1
498
if rename_count > 0:
499
name = server.GetAlternativeServiceName(name)
500
logger.warning(u"Service name collision, "
501
u"changing name to '%s' ...", name)
502
remove_service()
503
add_service()
504
505
else:
506
logger.error(u"No suitable service name found "
507
u"after %i retries, exiting.",
508
n_rename)
509
main_loop.quit()
594
logger.warning(u"Service name collision.")
595
service.rename()
510
596
elif state == avahi.ENTRY_GROUP_FAILURE:
511
logger.error(u"Error in group state changed %s",
512
unicode(error))
513
main_loop.quit()
514
return
515
597
logger.critical(u"Error in group state changed %s",
598
unicode(error))
599
raise AvahiGroupError("State changed: %s", str(error))
516
600
517
601
def if_nametoindex(interface):
518
"""Call the C function if_nametoindex()"""
602
"""Call the C function if_nametoindex(), or equivalent"""
603
global if_nametoindex
519
604
try:
520
libc = ctypes.cdll.LoadLibrary("libc.so.6")
521
return libc.if_nametoindex(interface)
605
if "ctypes.util" not in sys.modules:
606
import ctypes.util
607
if_nametoindex = ctypes.cdll.LoadLibrary\
608
(ctypes.util.find_library("c")).if_nametoindex
522
609
except (OSError, AttributeError):
523
610
if "struct" not in sys.modules:
524
611
import struct
525
612
if "fcntl" not in sys.modules:
526
613
import fcntl
527
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
528
s = socket.socket()
529
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
530
struct.pack("16s16x", interface))
531
s.close()
532
interface_index = struct.unpack("I", ifreq[16:20])[0]
533
return interface_index
534
535
536
if __name__ == '__main__':
614
def if_nametoindex(interface):
615
"Get an interface index the hard way, i.e. using fcntl()"
616
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
617
s = socket.socket()
618
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
619
struct.pack("16s16x", interface))
620
s.close()
621
interface_index = struct.unpack("I", ifreq[16:20])[0]
622
return interface_index
623
return if_nametoindex(interface)
624
625
626
def daemon(nochdir = False, noclose = False):
627
"""See daemon(3). Standard BSD Unix function.
628
This should really exist as os.daemon, but it doesn't (yet)."""
629
if os.fork():
630
sys.exit()
631
os.setsid()
632
if not nochdir:
633
os.chdir("/")
634
if os.fork():
635
sys.exit()
636
if not noclose:
637
# Close all standard open file descriptors
638
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
639
if not stat.S_ISCHR(os.fstat(null).st_mode):
640
raise OSError(errno.ENODEV,
641
"/dev/null not a character device")
642
os.dup2(null, sys.stdin.fileno())
643
os.dup2(null, sys.stdout.fileno())
644
os.dup2(null, sys.stderr.fileno())
645
if null > 2:
646
os.close(null)
647
648
649
def main():
650
global main_loop_started
651
main_loop_started = False
652
537
653
parser = OptionParser()
538
654
parser.add_option("-i", "--interface", type="string",
539
default=None, metavar="IF",
540
help="Bind to interface IF")
541
parser.add_option("--cert", type="string", default="cert.pem",
542
metavar="FILE",
543
help="Public key certificate PEM file to use")
544
parser.add_option("--key", type="string", default="key.pem",
545
metavar="FILE",
546
help="Private key PEM file to use")
547
parser.add_option("--ca", type="string", default="ca.pem",
548
metavar="FILE",
549
help="Certificate Authority certificate PEM file to use")
550
parser.add_option("--crl", type="string", default="crl.pem",
551
metavar="FILE",
552
help="Certificate Revokation List PEM file to use")
553
parser.add_option("-p", "--port", type="int", default=None,
655
metavar="IF", help="Bind to interface IF")
656
parser.add_option("-a", "--address", type="string",
657
help="Address to listen for requests on")
658
parser.add_option("-p", "--port", type="int",
554
659
help="Port number to receive requests on")
555
parser.add_option("--timeout", type="string", # Parsed later
556
default="1h",
557
help="Amount of downtime allowed for clients")
558
parser.add_option("--interval", type="string", # Parsed later
559
default="5m",
560
help="How often to check that a client is up")
561
660
parser.add_option("--check", action="store_true", default=False,
562
661
help="Run self-test")
563
parser.add_option("--debug", action="store_true", default=False,
564
help="Debug mode")
662
parser.add_option("--debug", action="store_true",
663
help="Debug mode; run in foreground and log to"
664
" terminal")
665
parser.add_option("--priority", type="string", help="GnuTLS"
666
" priority string (see GnuTLS documentation)")
667
parser.add_option("--servicename", type="string", metavar="NAME",
668
help="Zeroconf service name")
669
parser.add_option("--configdir", type="string",
670
default="/etc/mandos", metavar="DIR",
671
help="Directory to search for configuration"
672
" files")
565
673
(options, args) = parser.parse_args()
566
674
567
675
if options.check:
569
677
doctest.testmod()
570
678
sys.exit()
571
679
572
# Parse the time arguments
573
try:
574
options.timeout = string_to_delta(options.timeout)
575
except ValueError:
576
parser.error("option --timeout: Unparseable time")
577
try:
578
options.interval = string_to_delta(options.interval)
579
except ValueError:
580
parser.error("option --interval: Unparseable time")
581
582
# Parse config file
583
defaults = { "checker": "sleep 1; fping -q -- %%(fqdn)s" }
584
client_config = ConfigParser.SafeConfigParser(defaults)
585
#client_config.readfp(open("secrets.conf"), "secrets.conf")
586
client_config.read("mandos-clients.conf")
587
588
# From the Avahi server example code
680
# Default values for config file for server-global settings
681
server_defaults = { "interface": "",
682
"address": "",
683
"port": "",
684
"debug": "False",
685
"priority":
686
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
687
"servicename": "Mandos",
688
}
689
690
# Parse config file for server-global settings
691
server_config = ConfigParser.SafeConfigParser(server_defaults)
692
del server_defaults
693
server_config.read(os.path.join(options.configdir, "mandos.conf"))
694
server_section = "server"
695
# Convert the SafeConfigParser object to a dict
696
server_settings = dict(server_config.items(server_section))
697
# Use getboolean on the boolean config option
698
server_settings["debug"] = server_config.getboolean\
699
(server_section, "debug")
700
del server_config
701
702
# Override the settings from the config file with command line
703
# options, if set.
704
for option in ("interface", "address", "port", "debug",
705
"priority", "servicename", "configdir"):
706
value = getattr(options, option)
707
if value is not None:
708
server_settings[option] = value
709
del options
710
# Now we have our good server settings in "server_settings"
711
712
# Parse config file with clients
713
client_defaults = { "timeout": "1h",
714
"interval": "5m",
715
"checker": "fping -q -- %%(fqdn)s",
716
}
717
client_config = ConfigParser.SafeConfigParser(client_defaults)
718
client_config.read(os.path.join(server_settings["configdir"],
719
"clients.conf"))
720
721
global service
722
service = AvahiService(name = server_settings["servicename"],
723
type = "_mandos._tcp", );
724
if server_settings["interface"]:
725
service.interface = if_nametoindex(server_settings["interface"])
726
727
global main_loop
728
global bus
729
global server
730
# From the Avahi example code
589
731
DBusGMainLoop(set_as_default=True )
590
732
main_loop = gobject.MainLoop()
591
733
bus = dbus.SystemBus()
594
736
avahi.DBUS_INTERFACE_SERVER )
595
737
# End of Avahi example code
596
738
597
debug = options.debug
739
debug = server_settings["debug"]
740
741
if debug:
742
console = logging.StreamHandler()
743
# console.setLevel(logging.DEBUG)
744
console.setFormatter(logging.Formatter\
745
('%(levelname)s: %(message)s'))
746
logger.addHandler(console)
747
del console
598
748
599
749
clients = Set()
600
750
def remove_from_clients(client):
601
751
clients.remove(client)
602
752
if not clients:
603
logger.debug(u"No clients left, exiting")
604
main_loop.quit()
753
logger.critical(u"No clients left, exiting")
754
sys.exit()
605
755
606
clients.update(Set(Client(name=section, options=options,
756
clients.update(Set(Client(name = section,
607
757
stop_hook = remove_from_clients,
608
**(dict(client_config\
609
.items(section))))
758
config
759
= dict(client_config.items(section)))
610
760
for section in client_config.sections()))
761
762
if not debug:
763
daemon()
764
765
def cleanup():
766
"Cleanup function; run on exit"
767
global group
768
# From the Avahi example code
769
if not group is None:
770
group.Free()
771
group = None
772
# End of Avahi example code
773
774
while clients:
775
client = clients.pop()
776
client.stop_hook = None
777
client.stop()
778
779
atexit.register(cleanup)
780
781
if not debug:
782
signal.signal(signal.SIGINT, signal.SIG_IGN)
783
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
784
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
785
611
786
for client in clients:
612
787
client.start()
613
788
614
tcp_server = IPv6_TCPServer((None, options.port),
789
tcp_server = IPv6_TCPServer((server_settings["address"],
790
server_settings["port"]),
615
791
tcp_handler,
616
options=options,
792
settings=server_settings,
617
793
clients=clients)
618
# Find out what random port we got
619
servicePort = tcp_server.socket.getsockname()[1]
620
logger.debug(u"Now listening on port %d", servicePort)
621
622
if options.interface is not None:
623
serviceInterface = if_nametoindex(options.interface)
624
625
# From the Avahi server example code
626
server.connect_to_signal("StateChanged", server_state_changed)
627
server_state_changed(server.GetState())
628
# End of Avahi example code
629
630
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
631
lambda *args, **kwargs:
632
tcp_server.handle_request(*args[2:],
633
**kwargs) or True)
794
# Find out what port we got
795
service.port = tcp_server.socket.getsockname()[1]
796
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
797
u" scope_id %d" % tcp_server.socket.getsockname())
798
799
#service.interface = tcp_server.socket.getsockname()[3]
800
634
801
try:
802
# From the Avahi example code
803
server.connect_to_signal("StateChanged", server_state_changed)
804
try:
805
server_state_changed(server.GetState())
806
except dbus.exceptions.DBusException, error:
807
logger.critical(u"DBusException: %s", error)
808
sys.exit(1)
809
# End of Avahi example code
810
811
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
812
lambda *args, **kwargs:
813
tcp_server.handle_request\
814
(*args[2:], **kwargs) or True)
815
816
logger.debug("Starting main loop")
817
main_loop_started = True
635
818
main_loop.run()
819
except AvahiError, error:
820
logger.critical(u"AvahiError: %s" + unicode(error))
821
sys.exit(1)
636
822
except KeyboardInterrupt:
637
print
638
639
# Cleanup here
823
if debug:
824
print
640
825
641
# From the Avahi server example code
642
if not group is None:
643
group.Free()
644
# End of Avahi example code
645
646
for client in clients:
647
client.stop_hook = None
648
client.stop()
826
if __name__ == '__main__':
827
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0