To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 24.1.25
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.25
- Committer: Björn Påhlsson
- Date: 2008-08-08 02:33:41 UTC
- mto: (24.1.154 mandos) (237.4.3 mandos-release)
- mto: This revision was merged to the branch mainline in revision 50.
- Revision ID: belorn@braxen-20080808023341-34aft2vw4f35nzam
* clients.conf.xml: Renamed to "mandos-clients.conf.xml".
* Makefile (DOCBOOKTOMAN, DOCS): New
(all): Include $(DOCS)
(%.5: %.xml, %.8: %.xml, %.8mandos: %.xml): New.
(clean): Also remove $(DOCS)
* Makefile (DOCBOOKTOMAN, DOCS): New
(all): Include $(DOCS)
(%.5: %.xml, %.8: %.xml, %.8mandos: %.xml): New.
(clean): Also remove $(DOCS)
- files added:
- mandos-client.c
- plugins.d
- files removed:
- bad-ca.pem
- files renamed:
- mandos-clients.conf => clients.conf
- server.py => mandos
- files modified:
- Makefile
added
removed
mandos
1
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
# Mandos server - give out binary blobs to connecting clients.
5
#
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
#
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
15
#
16
# This program is free software: you can redistribute it and/or modify
17
# it under the terms of the GNU General Public License as published by
18
# the Free Software Foundation, either version 3 of the License, or
19
# (at your option) any later version.
20
#
21
# This program is distributed in the hope that it will be useful,
22
# but WITHOUT ANY WARRANTY; without even the implied warranty of
23
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24
# GNU General Public License for more details.
25
#
26
# You should have received a copy of the GNU General Public License
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
28
#
29
# Contact the authors at <mandos@fukt.bsnet.se>.
30
#
31
32
from __future__ import division
2
33
3
34
import SocketServer
4
35
import socket
9
40
import gnutls.crypto
10
41
import gnutls.connection
11
42
import gnutls.errors
43
import gnutls.library.functions
44
import gnutls.library.constants
45
import gnutls.library.types
12
46
import ConfigParser
13
47
import sys
48
import re
49
import os
50
import signal
51
from sets import Set
52
import subprocess
53
import atexit
54
import stat
55
import logging
56
import logging.handlers
57
58
import dbus
59
import gobject
60
import avahi
61
from dbus.mainloop.glib import DBusGMainLoop
62
import ctypes
63
64
65
logger = logging.Logger('mandos')
66
syslogger = logging.handlers.SysLogHandler\
67
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
68
syslogger.setFormatter(logging.Formatter\
69
('%(levelname)s: %(message)s'))
70
logger.addHandler(syslogger)
71
del syslogger
72
73
74
class AvahiError(Exception):
75
def __init__(self, value):
76
self.value = value
77
def __str__(self):
78
return repr(self.value)
79
80
class AvahiServiceError(AvahiError):
81
pass
82
83
class AvahiGroupError(AvahiError):
84
pass
85
86
87
class AvahiService(object):
88
"""An Avahi (Zeroconf) service.
89
Attributes:
90
interface: integer; avahi.IF_UNSPEC or an interface index.
91
Used to optionally bind to the specified interface.
92
name: string; Example: 'Mandos'
93
type: string; Example: '_mandos._tcp'.
94
See <http://www.dns-sd.org/ServiceTypes.html>
95
port: integer; what port to announce
96
TXT: list of strings; TXT record for the service
97
domain: string; Domain to publish on, default to .local if empty.
98
host: string; Host to publish records for, default is localhost
99
max_renames: integer; maximum number of renames
100
rename_count: integer; counter so we only rename after collisions
101
a sensible number of times
102
"""
103
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
104
type = None, port = None, TXT = None, domain = "",
105
host = "", max_renames = 12):
106
self.interface = interface
107
self.name = name
108
self.type = type
109
self.port = port
110
if TXT is None:
111
self.TXT = []
112
else:
113
self.TXT = TXT
114
self.domain = domain
115
self.host = host
116
self.rename_count = 0
117
def rename(self):
118
"""Derived from the Avahi example code"""
119
if self.rename_count >= self.max_renames:
120
logger.critical(u"No suitable service name found after %i"
121
u" retries, exiting.", rename_count)
122
raise AvahiServiceError("Too many renames")
123
name = server.GetAlternativeServiceName(name)
124
logger.error(u"Changing name to %r ...", name)
125
self.remove()
126
self.add()
127
self.rename_count += 1
128
def remove(self):
129
"""Derived from the Avahi example code"""
130
if group is not None:
131
group.Reset()
132
def add(self):
133
"""Derived from the Avahi example code"""
134
global group
135
if group is None:
136
group = dbus.Interface\
137
(bus.get_object(avahi.DBUS_NAME,
138
server.EntryGroupNew()),
139
avahi.DBUS_INTERFACE_ENTRY_GROUP)
140
group.connect_to_signal('StateChanged',
141
entry_group_state_changed)
142
logger.debug(u"Adding service '%s' of type '%s' ...",
143
service.name, service.type)
144
group.AddService(
145
self.interface, # interface
146
avahi.PROTO_INET6, # protocol
147
dbus.UInt32(0), # flags
148
self.name, self.type,
149
self.domain, self.host,
150
dbus.UInt16(self.port),
151
avahi.string_array_to_txt_array(self.TXT))
152
group.Commit()
153
154
# From the Avahi example code:
155
group = None # our entry group
156
# End of Avahi example code
14
157
15
158
16
159
class Client(object):
17
def __init__(self, name=None, options=None, dn=None,
18
password=None, passfile=None, fqdn=None,
19
timeout=None, interval=-1):
160
"""A representation of a client host served by this server.
161
Attributes:
162
name: string; from the config file, used in log messages
163
fingerprint: string (40 or 32 hexadecimal digits); used to
164
uniquely identify the client
165
secret: bytestring; sent verbatim (over TLS) to client
166
fqdn: string (FQDN); available for use by the checker command
167
created: datetime.datetime(); object creation, not client host
168
last_checked_ok: datetime.datetime() or None if not yet checked OK
169
timeout: datetime.timedelta(); How long from last_checked_ok
170
until this client is invalid
171
interval: datetime.timedelta(); How often to start a new checker
172
stop_hook: If set, called by stop() as stop_hook(self)
173
checker: subprocess.Popen(); a running checker process used
174
to see if the client lives.
175
'None' if no process is running.
176
checker_initiator_tag: a gobject event source tag, or None
177
stop_initiator_tag: - '' -
178
checker_callback_tag: - '' -
179
checker_command: string; External command which is run to check if
180
client lives. %() expansions are done at
181
runtime with vars(self) as dict, so that for
182
instance %(name)s can be used in the command.
183
Private attibutes:
184
_timeout: Real variable for 'timeout'
185
_interval: Real variable for 'interval'
186
_timeout_milliseconds: Used when calling gobject.timeout_add()
187
_interval_milliseconds: - '' -
188
"""
189
def _set_timeout(self, timeout):
190
"Setter function for 'timeout' attribute"
191
self._timeout = timeout
192
self._timeout_milliseconds = ((self.timeout.days
193
* 24 * 60 * 60 * 1000)
194
+ (self.timeout.seconds * 1000)
195
+ (self.timeout.microseconds
196
// 1000))
197
timeout = property(lambda self: self._timeout,
198
_set_timeout)
199
del _set_timeout
200
def _set_interval(self, interval):
201
"Setter function for 'interval' attribute"
202
self._interval = interval
203
self._interval_milliseconds = ((self.interval.days
204
* 24 * 60 * 60 * 1000)
205
+ (self.interval.seconds
206
* 1000)
207
+ (self.interval.microseconds
208
// 1000))
209
interval = property(lambda self: self._interval,
210
_set_interval)
211
del _set_interval
212
def __init__(self, name = None, stop_hook=None, config={}):
213
"""Note: the 'checker' key in 'config' sets the
214
'checker_command' attribute and *not* the 'checker'
215
attribute."""
20
216
self.name = name
21
self.dn = dn
22
if password:
23
self.password = password
24
elif passfile:
25
self.password = open(passfile).readall()
217
logger.debug(u"Creating client %r", self.name)
218
# Uppercase and remove spaces from fingerprint for later
219
# comparison purposes with return value from the fingerprint()
220
# function
221
self.fingerprint = config["fingerprint"].upper()\
222
.replace(u" ", u"")
223
logger.debug(u" Fingerprint: %s", self.fingerprint)
224
if "secret" in config:
225
self.secret = config["secret"].decode(u"base64")
226
elif "secfile" in config:
227
sf = open(config["secfile"])
228
self.secret = sf.read()
229
sf.close()
26
230
else:
27
print "No Password or Passfile in client config file"
28
# raise RuntimeError XXX
29
self.password = "gazonk"
30
self.fqdn = fqdn
231
raise TypeError(u"No secret or secfile for client %s"
232
% self.name)
233
self.fqdn = config.get("fqdn", "")
31
234
self.created = datetime.datetime.now()
32
self.last_seen = None
33
if timeout is None:
34
timeout = options.timeout
35
self.timeout = timeout
36
if interval == -1:
37
interval = options.interval
38
self.interval = interval
39
self.next_check = datetime.datetime.now()
40
41
42
class server_metaclass(type):
43
"Common behavior for the UDP and TCP server classes"
44
def __new__(cls, name, bases, attrs):
45
attrs["address_family"] = socket.AF_INET6
46
attrs["allow_reuse_address"] = True
47
def server_bind(self):
48
if self.options.interface:
49
if not hasattr(socket, "SO_BINDTODEVICE"):
50
# From /usr/include/asm-i486/socket.h
51
socket.SO_BINDTODEVICE = 25
235
self.last_checked_ok = None
236
self.timeout = string_to_delta(config["timeout"])
237
self.interval = string_to_delta(config["interval"])
238
self.stop_hook = stop_hook
239
self.checker = None
240
self.checker_initiator_tag = None
241
self.stop_initiator_tag = None
242
self.checker_callback_tag = None
243
self.check_command = config["checker"]
244
def start(self):
245
"""Start this client's checker and timeout hooks"""
246
# Schedule a new checker to be started an 'interval' from now,
247
# and every interval from then on.
248
self.checker_initiator_tag = gobject.timeout_add\
249
(self._interval_milliseconds,
250
self.start_checker)
251
# Also start a new checker *right now*.
252
self.start_checker()
253
# Schedule a stop() when 'timeout' has passed
254
self.stop_initiator_tag = gobject.timeout_add\
255
(self._timeout_milliseconds,
256
self.stop)
257
def stop(self):
258
"""Stop this client.
259
The possibility that a client might be restarted is left open,
260
but not currently used."""
261
# If this client doesn't have a secret, it is already stopped.
262
if self.secret:
263
logger.info(u"Stopping client %s", self.name)
264
self.secret = None
265
else:
266
return False
267
if getattr(self, "stop_initiator_tag", False):
268
gobject.source_remove(self.stop_initiator_tag)
269
self.stop_initiator_tag = None
270
if getattr(self, "checker_initiator_tag", False):
271
gobject.source_remove(self.checker_initiator_tag)
272
self.checker_initiator_tag = None
273
self.stop_checker()
274
if self.stop_hook:
275
self.stop_hook(self)
276
# Do not run this again if called by a gobject.timeout_add
277
return False
278
def __del__(self):
279
self.stop_hook = None
280
self.stop()
281
def checker_callback(self, pid, condition):
282
"""The checker has completed, so take appropriate actions."""
283
now = datetime.datetime.now()
284
self.checker_callback_tag = None
285
self.checker = None
286
if os.WIFEXITED(condition) \
287
and (os.WEXITSTATUS(condition) == 0):
288
logger.info(u"Checker for %(name)s succeeded",
289
vars(self))
290
self.last_checked_ok = now
291
gobject.source_remove(self.stop_initiator_tag)
292
self.stop_initiator_tag = gobject.timeout_add\
293
(self._timeout_milliseconds,
294
self.stop)
295
elif not os.WIFEXITED(condition):
296
logger.warning(u"Checker for %(name)s crashed?",
297
vars(self))
298
else:
299
logger.info(u"Checker for %(name)s failed",
300
vars(self))
301
def start_checker(self):
302
"""Start a new checker subprocess if one is not running.
303
If a checker already exists, leave it running and do
304
nothing."""
305
# The reason for not killing a running checker is that if we
306
# did that, then if a checker (for some reason) started
307
# running slowly and taking more than 'interval' time, the
308
# client would inevitably timeout, since no checker would get
309
# a chance to run to completion. If we instead leave running
310
# checkers alone, the checker would have to take more time
311
# than 'timeout' for the client to be declared invalid, which
312
# is as it should be.
313
if self.checker is None:
314
try:
315
# In case check_command has exactly one % operator
316
command = self.check_command % self.fqdn
317
except TypeError:
318
# Escape attributes for the shell
319
escaped_attrs = dict((key, re.escape(str(val)))
320
for key, val in
321
vars(self).iteritems())
52
322
try:
53
self.socket.setsockopt(socket.SOL_SOCKET,
54
socket.SO_BINDTODEVICE,
55
self.options.interface)
56
except socket.error, error:
57
if error[0] == errno.EPERM:
58
print "Warning: No permission to bind to interface", \
59
self.options.interface
60
else:
61
raise error
62
return super(type(self), self).server_bind()
63
attrs["server_bind"] = server_bind
64
def init(self, *args, **kwargs):
65
if "options" in kwargs:
66
self.options = kwargs["options"]
67
del kwargs["options"]
68
if "clients" in kwargs:
69
self.clients = kwargs["clients"]
70
del kwargs["clients"]
71
if "credentials" in kwargs:
72
self.credentials = kwargs["credentials"]
73
del kwargs["credentials"]
74
return super(type(self), self).__init__(*args, **kwargs)
75
attrs["__init__"] = init
76
return type.__new__(cls, name, bases, attrs)
77
78
79
class udp_handler(SocketServer.DatagramRequestHandler, object):
80
def handle(self):
81
self.wfile.write("Polo")
82
print "UDP request answered"
83
84
85
class IPv6_UDPServer(SocketServer.UDPServer, object):
86
__metaclass__ = server_metaclass
87
def verify_request(self, request, client_address):
88
print "UDP request came"
89
return request[0] == "Marco"
323
command = self.check_command % escaped_attrs
324
except TypeError, error:
325
logger.error(u'Could not format string "%s":'
326
u' %s', self.check_command, error)
327
return True # Try again later
328
try:
329
logger.info(u"Starting checker %r for %s",
330
command, self.name)
331
self.checker = subprocess.Popen(command,
332
close_fds=True,
333
shell=True, cwd="/")
334
self.checker_callback_tag = gobject.child_watch_add\
335
(self.checker.pid,
336
self.checker_callback)
337
except subprocess.OSError, error:
338
logger.error(u"Failed to start subprocess: %s",
339
error)
340
# Re-run this periodically if run by gobject.timeout_add
341
return True
342
def stop_checker(self):
343
"""Force the checker process, if any, to stop."""
344
if self.checker_callback_tag:
345
gobject.source_remove(self.checker_callback_tag)
346
self.checker_callback_tag = None
347
if getattr(self, "checker", None) is None:
348
return
349
logger.debug("Stopping checker for %(name)s", vars(self))
350
try:
351
os.kill(self.checker.pid, signal.SIGTERM)
352
#os.sleep(0.5)
353
#if self.checker.poll() is None:
354
# os.kill(self.checker.pid, signal.SIGKILL)
355
except OSError, error:
356
if error.errno != errno.ESRCH: # No such process
357
raise
358
self.checker = None
359
def still_valid(self):
360
"""Has the timeout not yet passed for this client?"""
361
now = datetime.datetime.now()
362
if self.last_checked_ok is None:
363
return now < (self.created + self.timeout)
364
else:
365
return now < (self.last_checked_ok + self.timeout)
366
367
368
def peer_certificate(session):
369
"Return the peer's OpenPGP certificate as a bytestring"
370
# If not an OpenPGP certificate...
371
if gnutls.library.functions.gnutls_certificate_type_get\
372
(session._c_object) \
373
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
374
# ...do the normal thing
375
return session.peer_certificate
376
list_size = ctypes.c_uint()
377
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
378
(session._c_object, ctypes.byref(list_size))
379
if list_size.value == 0:
380
return None
381
cert = cert_list[0]
382
return ctypes.string_at(cert.data, cert.size)
383
384
385
def fingerprint(openpgp):
386
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
387
# New GnuTLS "datum" with the OpenPGP public key
388
datum = gnutls.library.types.gnutls_datum_t\
389
(ctypes.cast(ctypes.c_char_p(openpgp),
390
ctypes.POINTER(ctypes.c_ubyte)),
391
ctypes.c_uint(len(openpgp)))
392
# New empty GnuTLS certificate
393
crt = gnutls.library.types.gnutls_openpgp_crt_t()
394
gnutls.library.functions.gnutls_openpgp_crt_init\
395
(ctypes.byref(crt))
396
# Import the OpenPGP public key into the certificate
397
gnutls.library.functions.gnutls_openpgp_crt_import\
398
(crt, ctypes.byref(datum),
399
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
400
# New buffer for the fingerprint
401
buffer = ctypes.create_string_buffer(20)
402
buffer_length = ctypes.c_size_t()
403
# Get the fingerprint from the certificate into the buffer
404
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
405
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
406
# Deinit the certificate
407
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
408
# Convert the buffer to a Python bytestring
409
fpr = ctypes.string_at(buffer, buffer_length.value)
410
# Convert the bytestring to hexadecimal notation
411
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
412
return hex_fpr
90
413
91
414
92
415
class tcp_handler(SocketServer.BaseRequestHandler, object):
416
"""A TCP request handler class.
417
Instantiated by IPv6_TCPServer for each request to handle it.
418
Note: This will run in its own forked process."""
419
93
420
def handle(self):
94
print "TCP request came"
95
print "Request:", self.request
96
print "Client Address:", self.client_address
97
print "Server:", self.server
98
session = gnutls.connection.ServerSession(self.request,
99
self.server.credentials)
100
session.handshake()
101
if session.peer_certificate:
102
print "DN:", session.peer_certificate.subject
103
try:
104
session.verify_peer()
105
except gnutls.errors.CertificateError, error:
106
print "Verify failed", error
107
session.bye()
108
return
109
try:
110
session.send(dict((client.dn, client.password)
111
for client in self.server.clients)
112
[session.peer_certificate.subject])
113
except KeyError:
114
session.send("gazonk")
115
# Log maybe? XXX
421
logger.info(u"TCP connection from: %s",
422
unicode(self.client_address))
423
session = gnutls.connection.ClientSession\
424
(self.request, gnutls.connection.X509Credentials())
425
426
line = self.request.makefile().readline()
427
logger.debug(u"Protocol version: %r", line)
428
try:
429
if int(line.strip().split()[0]) > 1:
430
raise RuntimeError
431
except (ValueError, IndexError, RuntimeError), error:
432
logger.error(u"Unknown protocol version: %s", error)
433
return
434
435
# Note: gnutls.connection.X509Credentials is really a generic
436
# GnuTLS certificate credentials object so long as no X.509
437
# keys are added to it. Therefore, we can use it here despite
438
# using OpenPGP certificates.
439
440
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
441
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
442
# "+DHE-DSS"))
443
priority = "NORMAL" # Fallback default, since this
444
# MUST be set.
445
if self.server.settings["priority"]:
446
priority = self.server.settings["priority"]
447
gnutls.library.functions.gnutls_priority_set_direct\
448
(session._c_object, priority, None);
449
450
try:
451
session.handshake()
452
except gnutls.errors.GNUTLSError, error:
453
logger.warning(u"Handshake failed: %s", error)
454
# Do not run session.bye() here: the session is not
455
# established. Just abandon the request.
456
return
457
try:
458
fpr = fingerprint(peer_certificate(session))
459
except (TypeError, gnutls.errors.GNUTLSError), error:
460
logger.warning(u"Bad certificate: %s", error)
461
session.bye()
462
return
463
logger.debug(u"Fingerprint: %s", fpr)
464
client = None
465
for c in self.server.clients:
466
if c.fingerprint == fpr:
467
client = c
468
break
469
if not client:
470
logger.warning(u"Client not found for fingerprint: %s",
471
fpr)
472
session.bye()
473
return
474
# Have to check if client.still_valid(), since it is possible
475
# that the client timed out while establishing the GnuTLS
476
# session.
477
if not client.still_valid():
478
logger.warning(u"Client %(name)s is invalid",
479
vars(client))
480
session.bye()
481
return
482
sent_size = 0
483
while sent_size < len(client.secret):
484
sent = session.send(client.secret[sent_size:])
485
logger.debug(u"Sent: %d, remaining: %d",
486
sent, len(client.secret)
487
- (sent_size + sent))
488
sent_size += sent
116
489
session.bye()
117
490
118
491
119
492
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
120
__metaclass__ = server_metaclass
121
request_queue_size = 1024
122
123
124
in6addr_any = "::"
125
126
cred = None
493
"""IPv6 TCP server. Accepts 'None' as address and/or port.
494
Attributes:
495
settings: Server settings
496
clients: Set() of Client objects
497
"""
498
address_family = socket.AF_INET6
499
def __init__(self, *args, **kwargs):
500
if "settings" in kwargs:
501
self.settings = kwargs["settings"]
502
del kwargs["settings"]
503
if "clients" in kwargs:
504
self.clients = kwargs["clients"]
505
del kwargs["clients"]
506
return super(type(self), self).__init__(*args, **kwargs)
507
def server_bind(self):
508
"""This overrides the normal server_bind() function
509
to bind to an interface if one was specified, and also NOT to
510
bind to an address or port if they were not specified."""
511
if self.settings["interface"]:
512
# 25 is from /usr/include/asm-i486/socket.h
513
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
514
try:
515
self.socket.setsockopt(socket.SOL_SOCKET,
516
SO_BINDTODEVICE,
517
self.settings["interface"])
518
except socket.error, error:
519
if error[0] == errno.EPERM:
520
logger.error(u"No permission to"
521
u" bind to interface %s",
522
self.settings["interface"])
523
else:
524
raise error
525
# Only bind(2) the socket if we really need to.
526
if self.server_address[0] or self.server_address[1]:
527
if not self.server_address[0]:
528
in6addr_any = "::"
529
self.server_address = (in6addr_any,
530
self.server_address[1])
531
elif not self.server_address[1]:
532
self.server_address = (self.server_address[0],
533
0)
534
# if self.settings["interface"]:
535
# self.server_address = (self.server_address[0],
536
# 0, # port
537
# 0, # flowinfo
538
# if_nametoindex
539
# (self.settings
540
# ["interface"]))
541
return super(type(self), self).server_bind()
542
127
543
128
544
def string_to_delta(interval):
129
545
"""Parse a string and return a datetime.timedelta
158
574
raise ValueError
159
575
return delta
160
576
577
578
def server_state_changed(state):
579
"""Derived from the Avahi example code"""
580
if state == avahi.SERVER_COLLISION:
581
logger.error(u"Server name collision")
582
service.remove()
583
elif state == avahi.SERVER_RUNNING:
584
service.add()
585
586
587
def entry_group_state_changed(state, error):
588
"""Derived from the Avahi example code"""
589
logger.debug(u"state change: %i", state)
590
591
if state == avahi.ENTRY_GROUP_ESTABLISHED:
592
logger.debug(u"Service established.")
593
elif state == avahi.ENTRY_GROUP_COLLISION:
594
logger.warning(u"Service name collision.")
595
service.rename()
596
elif state == avahi.ENTRY_GROUP_FAILURE:
597
logger.critical(u"Error in group state changed %s",
598
unicode(error))
599
raise AvahiGroupError("State changed: %s", str(error))
600
601
def if_nametoindex(interface):
602
"""Call the C function if_nametoindex(), or equivalent"""
603
global if_nametoindex
604
try:
605
if "ctypes.util" not in sys.modules:
606
import ctypes.util
607
if_nametoindex = ctypes.cdll.LoadLibrary\
608
(ctypes.util.find_library("c")).if_nametoindex
609
except (OSError, AttributeError):
610
if "struct" not in sys.modules:
611
import struct
612
if "fcntl" not in sys.modules:
613
import fcntl
614
def if_nametoindex(interface):
615
"Get an interface index the hard way, i.e. using fcntl()"
616
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
617
s = socket.socket()
618
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
619
struct.pack("16s16x", interface))
620
s.close()
621
interface_index = struct.unpack("I", ifreq[16:20])[0]
622
return interface_index
623
return if_nametoindex(interface)
624
625
626
def daemon(nochdir = False, noclose = False):
627
"""See daemon(3). Standard BSD Unix function.
628
This should really exist as os.daemon, but it doesn't (yet)."""
629
if os.fork():
630
sys.exit()
631
os.setsid()
632
if not nochdir:
633
os.chdir("/")
634
if os.fork():
635
sys.exit()
636
if not noclose:
637
# Close all standard open file descriptors
638
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
639
if not stat.S_ISCHR(os.fstat(null).st_mode):
640
raise OSError(errno.ENODEV,
641
"/dev/null not a character device")
642
os.dup2(null, sys.stdin.fileno())
643
os.dup2(null, sys.stdout.fileno())
644
os.dup2(null, sys.stderr.fileno())
645
if null > 2:
646
os.close(null)
647
648
161
649
def main():
650
global main_loop_started
651
main_loop_started = False
652
162
653
parser = OptionParser()
163
654
parser.add_option("-i", "--interface", type="string",
164
default="eth0", metavar="IF",
165
help="Interface to bind to")
166
parser.add_option("--cert", type="string", default="cert.pem",
167
metavar="FILE",
168
help="Public key certificate to use")
169
parser.add_option("--key", type="string", default="key.pem",
170
metavar="FILE",
171
help="Private key to use")
172
parser.add_option("--ca", type="string", default="ca.pem",
173
metavar="FILE",
174
help="Certificate Authority certificate to use")
175
parser.add_option("--crl", type="string", default="crl.pem",
176
metavar="FILE",
177
help="Certificate Revokation List to use")
178
parser.add_option("-p", "--port", type="int", default=49001,
655
metavar="IF", help="Bind to interface IF")
656
parser.add_option("-a", "--address", type="string",
657
help="Address to listen for requests on")
658
parser.add_option("-p", "--port", type="int",
179
659
help="Port number to receive requests on")
180
parser.add_option("--dh", type="int", metavar="BITS",
181
help="DH group to use")
182
parser.add_option("-t", "--timeout", type="string", # Parsed later
183
default="15m",
184
help="Amount of downtime allowed for clients")
185
parser.add_option("--interval", type="string", # Parsed later
186
default="5m",
187
help="How often to check that a client is up")
188
660
parser.add_option("--check", action="store_true", default=False,
189
661
help="Run self-test")
662
parser.add_option("--debug", action="store_true",
663
help="Debug mode; run in foreground and log to"
664
" terminal")
665
parser.add_option("--priority", type="string", help="GnuTLS"
666
" priority string (see GnuTLS documentation)")
667
parser.add_option("--servicename", type="string", metavar="NAME",
668
help="Zeroconf service name")
669
parser.add_option("--configdir", type="string",
670
default="/etc/mandos", metavar="DIR",
671
help="Directory to search for configuration"
672
" files")
190
673
(options, args) = parser.parse_args()
191
674
192
675
if options.check:
193
676
import doctest
194
677
doctest.testmod()
195
678
sys.exit()
196
679
197
# Parse the time arguments
198
try:
199
options.timeout = string_to_delta(options.timeout)
200
except ValueError:
201
parser.error("option --timeout: Unparseable time")
202
203
try:
204
options.interval = string_to_delta(options.interval)
205
except ValueError:
206
parser.error("option --interval: Unparseable time")
207
208
cert = gnutls.crypto.X509Certificate(open(options.cert).read())
209
key = gnutls.crypto.X509PrivateKey(open(options.key).read())
210
ca = gnutls.crypto.X509Certificate(open(options.ca).read())
211
crl = gnutls.crypto.X509CRL(open(options.crl).read())
212
cred = gnutls.connection.X509Credentials(cert, key, [ca], [crl])
213
214
# Parse config file
215
defaults = {}
216
client_config_object = ConfigParser.SafeConfigParser(defaults)
217
client_config_object.read("mandos-clients.conf")
218
clients = [Client(name=section, options=options,
219
**(dict(client_config_object.items(section))))
220
for section in client_config_object.sections()]
221
222
udp_server = IPv6_UDPServer((in6addr_any, options.port),
223
udp_handler,
224
options=options)
225
226
tcp_server = IPv6_TCPServer((in6addr_any, options.port),
680
# Default values for config file for server-global settings
681
server_defaults = { "interface": "",
682
"address": "",
683
"port": "",
684
"debug": "False",
685
"priority":
686
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
687
"servicename": "Mandos",
688
}
689
690
# Parse config file for server-global settings
691
server_config = ConfigParser.SafeConfigParser(server_defaults)
692
del server_defaults
693
server_config.read(os.path.join(options.configdir, "mandos.conf"))
694
server_section = "server"
695
# Convert the SafeConfigParser object to a dict
696
server_settings = dict(server_config.items(server_section))
697
# Use getboolean on the boolean config option
698
server_settings["debug"] = server_config.getboolean\
699
(server_section, "debug")
700
del server_config
701
702
# Override the settings from the config file with command line
703
# options, if set.
704
for option in ("interface", "address", "port", "debug",
705
"priority", "servicename", "configdir"):
706
value = getattr(options, option)
707
if value is not None:
708
server_settings[option] = value
709
del options
710
# Now we have our good server settings in "server_settings"
711
712
# Parse config file with clients
713
client_defaults = { "timeout": "1h",
714
"interval": "5m",
715
"checker": "fping -q -- %%(fqdn)s",
716
}
717
client_config = ConfigParser.SafeConfigParser(client_defaults)
718
client_config.read(os.path.join(server_settings["configdir"],
719
"clients.conf"))
720
721
global service
722
service = AvahiService(name = server_settings["servicename"],
723
type = "_mandos._tcp", );
724
if server_settings["interface"]:
725
service.interface = if_nametoindex(server_settings["interface"])
726
727
global main_loop
728
global bus
729
global server
730
# From the Avahi example code
731
DBusGMainLoop(set_as_default=True )
732
main_loop = gobject.MainLoop()
733
bus = dbus.SystemBus()
734
server = dbus.Interface(
735
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
736
avahi.DBUS_INTERFACE_SERVER )
737
# End of Avahi example code
738
739
debug = server_settings["debug"]
740
741
if debug:
742
console = logging.StreamHandler()
743
# console.setLevel(logging.DEBUG)
744
console.setFormatter(logging.Formatter\
745
('%(levelname)s: %(message)s'))
746
logger.addHandler(console)
747
del console
748
749
clients = Set()
750
def remove_from_clients(client):
751
clients.remove(client)
752
if not clients:
753
logger.critical(u"No clients left, exiting")
754
sys.exit()
755
756
clients.update(Set(Client(name = section,
757
stop_hook = remove_from_clients,
758
config
759
= dict(client_config.items(section)))
760
for section in client_config.sections()))
761
762
if not debug:
763
daemon()
764
765
def cleanup():
766
"Cleanup function; run on exit"
767
global group
768
# From the Avahi example code
769
if not group is None:
770
group.Free()
771
group = None
772
# End of Avahi example code
773
774
while clients:
775
client = clients.pop()
776
client.stop_hook = None
777
client.stop()
778
779
atexit.register(cleanup)
780
781
if not debug:
782
signal.signal(signal.SIGINT, signal.SIG_IGN)
783
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
784
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
785
786
for client in clients:
787
client.start()
788
789
tcp_server = IPv6_TCPServer((server_settings["address"],
790
server_settings["port"]),
227
791
tcp_handler,
228
options=options,
229
clients=clients,
230
credentials=cred)
231
232
while True:
233
in_, out, err = select.select((udp_server,
234
tcp_server), (), ())
235
for server in in_:
236
server.handle_request()
237
238
239
if __name__ == "__main__":
792
settings=server_settings,
793
clients=clients)
794
# Find out what port we got
795
service.port = tcp_server.socket.getsockname()[1]
796
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
797
u" scope_id %d" % tcp_server.socket.getsockname())
798
799
#service.interface = tcp_server.socket.getsockname()[3]
800
801
try:
802
# From the Avahi example code
803
server.connect_to_signal("StateChanged", server_state_changed)
804
try:
805
server_state_changed(server.GetState())
806
except dbus.exceptions.DBusException, error:
807
logger.critical(u"DBusException: %s", error)
808
sys.exit(1)
809
# End of Avahi example code
810
811
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
812
lambda *args, **kwargs:
813
tcp_server.handle_request\
814
(*args[2:], **kwargs) or True)
815
816
logger.debug("Starting main loop")
817
main_loop_started = True
818
main_loop.run()
819
except AvahiError, error:
820
logger.critical(u"AvahiError: %s" + unicode(error))
821
sys.exit(1)
822
except KeyboardInterrupt:
823
if debug:
824
print
825
826
if __name__ == '__main__':
240
827
main()
241
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0