To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 24.1.4
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.4
- Committer: Björn Påhlsson
- Date: 2008-07-30 02:11:33 UTC
- mto: (24.1.154 mandos) (237.4.3 mandos-release)
- mto: This revision was merged to the branch mainline in revision 30.
- Revision ID: belorn@braxen-20080730021133-q341llq93r328q5b
Added optional parameters certdir, certkey and certfile that can be iven at start in the command line.
- files added:
- ca.pem
- files removed:
- mandos-client.xml
- files renamed:
- clients.conf => mandos-clients.conf
- mandos-client.c => plugbasedclient.c
- plugins.d/password-request.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos => server.py
- files modified:
- Makefile
added
removed
server.py
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
9
# following functions: "add_service", "remove_service",
10
# "server_state_changed", "entry_group_state_changed", and some lines
11
# in "main".
12
12
#
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
13
# Everything else is Copyright © 2007-2008 Teddy Hogeborn and Björn
14
# Påhlsson.
15
15
#
16
16
# This program is free software: you can redistribute it and/or modify
17
17
# it under the terms of the GNU General Public License as published by
26
26
# You should have received a copy of the GNU General Public License
27
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
28
28
#
29
# Contact the authors at <mandos@fukt.bsnet.se>.
29
# Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
30
# <https://www.fukt.bsnet.se/~teddy/>.
30
31
#
31
32
32
33
from __future__ import division
61
62
from dbus.mainloop.glib import DBusGMainLoop
62
63
import ctypes
63
64
65
# Brief description of the operation of this program:
66
#
67
# This server announces itself as a Zeroconf service. Connecting
68
# clients use the TLS protocol, with the unusual quirk that this
69
# server program acts as a TLS "client" while the connecting clients
70
# acts as a TLS "server". The clients (acting as a TLS "server") must
71
# supply an OpenPGP certificate, and the fingerprint of this
72
# certificate is used by this server to look up (in a list read from a
73
# file at start time) which binary blob to give the client. No other
74
# authentication or authorization is done by this server.
75
64
76
65
77
logger = logging.Logger('mandos')
66
78
syslogger = logging.handlers.SysLogHandler\
67
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
68
address = "/dev/log")
79
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
69
80
syslogger.setFormatter(logging.Formatter\
70
('Mandos: %(levelname)s: %(message)s'))
81
('%(levelname)s: %(message)s'))
71
82
logger.addHandler(syslogger)
72
73
74
class AvahiError(Exception):
75
def __init__(self, value):
76
self.value = value
77
def __str__(self):
78
return repr(self.value)
79
80
class AvahiServiceError(AvahiError):
81
pass
82
83
class AvahiGroupError(AvahiError):
84
pass
85
86
87
class AvahiService(object):
88
"""An Avahi (Zeroconf) service.
89
Attributes:
90
interface: integer; avahi.IF_UNSPEC or an interface index.
91
Used to optionally bind to the specified interface.
92
name: string; Example: 'Mandos'
93
type: string; Example: '_mandos._tcp'.
94
See <http://www.dns-sd.org/ServiceTypes.html>
95
port: integer; what port to announce
96
TXT: list of strings; TXT record for the service
97
domain: string; Domain to publish on, default to .local if empty.
98
host: string; Host to publish records for, default is localhost
99
max_renames: integer; maximum number of renames
100
rename_count: integer; counter so we only rename after collisions
101
a sensible number of times
102
"""
103
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
104
type = None, port = None, TXT = None, domain = "",
105
host = "", max_renames = 32768):
106
self.interface = interface
107
self.name = name
108
self.type = type
109
self.port = port
110
if TXT is None:
111
self.TXT = []
112
else:
113
self.TXT = TXT
114
self.domain = domain
115
self.host = host
116
self.rename_count = 0
117
def rename(self):
118
"""Derived from the Avahi example code"""
119
if self.rename_count >= self.max_renames:
120
logger.critical(u"No suitable service name found after %i"
121
u" retries, exiting.", rename_count)
122
raise AvahiServiceError("Too many renames")
123
name = server.GetAlternativeServiceName(name)
124
logger.error(u"Changing name to %r ...", name)
125
syslogger.setFormatter(logging.Formatter\
126
('Mandos (%s): %%(levelname)s:'
127
' %%(message)s' % name))
128
self.remove()
129
self.add()
130
self.rename_count += 1
131
def remove(self):
132
"""Derived from the Avahi example code"""
133
if group is not None:
134
group.Reset()
135
def add(self):
136
"""Derived from the Avahi example code"""
137
global group
138
if group is None:
139
group = dbus.Interface\
140
(bus.get_object(avahi.DBUS_NAME,
141
server.EntryGroupNew()),
142
avahi.DBUS_INTERFACE_ENTRY_GROUP)
143
group.connect_to_signal('StateChanged',
144
entry_group_state_changed)
145
logger.debug(u"Adding service '%s' of type '%s' ...",
146
service.name, service.type)
147
group.AddService(
148
self.interface, # interface
149
avahi.PROTO_INET6, # protocol
150
dbus.UInt32(0), # flags
151
self.name, self.type,
152
self.domain, self.host,
153
dbus.UInt16(self.port),
154
avahi.string_array_to_txt_array(self.TXT))
155
group.Commit()
156
83
del syslogger
84
85
# This variable is used to optionally bind to a specified interface.
86
# It is a global variable to fit in with the other variables from the
87
# Avahi example code.
88
serviceInterface = avahi.IF_UNSPEC
157
89
# From the Avahi example code:
158
group = None # our entry group
90
serviceName = None
91
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
92
servicePort = None # Not known at startup
93
serviceTXT = [] # TXT record for the service
94
domain = "" # Domain to publish on, default to .local
95
host = "" # Host to publish records for, default to localhost
96
group = None #our entry group
97
rename_count = 12 # Counter so we only rename after collisions a
98
# sensible number of times
159
99
# End of Avahi example code
160
100
161
101
166
106
fingerprint: string (40 or 32 hexadecimal digits); used to
167
107
uniquely identify the client
168
108
secret: bytestring; sent verbatim (over TLS) to client
169
host: string; available for use by the checker command
170
created: datetime.datetime(); object creation, not client host
171
last_checked_ok: datetime.datetime() or None if not yet checked OK
172
timeout: datetime.timedelta(); How long from last_checked_ok
173
until this client is invalid
109
fqdn: string (FQDN); available for use by the checker command
110
created: datetime.datetime()
111
last_seen: datetime.datetime() or None if not yet seen
112
timeout: datetime.timedelta(); How long from last_seen until
113
this client is invalid
174
114
interval: datetime.timedelta(); How often to start a new checker
175
115
stop_hook: If set, called by stop() as stop_hook(self)
176
116
checker: subprocess.Popen(); a running checker process used
177
117
to see if the client lives.
178
'None' if no process is running.
118
Is None if no process is running.
179
119
checker_initiator_tag: a gobject event source tag, or None
180
120
stop_initiator_tag: - '' -
181
121
checker_callback_tag: - '' -
182
122
checker_command: string; External command which is run to check if
183
client lives. %() expansions are done at
123
client lives. %()s expansions are done at
184
124
runtime with vars(self) as dict, so that for
185
125
instance %(name)s can be used in the command.
186
126
Private attibutes:
187
127
_timeout: Real variable for 'timeout'
188
128
_interval: Real variable for 'interval'
189
_timeout_milliseconds: Used when calling gobject.timeout_add()
129
_timeout_milliseconds: Used by gobject.timeout_add()
190
130
_interval_milliseconds: - '' -
191
131
"""
192
132
def _set_timeout(self, timeout):
212
152
interval = property(lambda self: self._interval,
213
153
_set_interval)
214
154
del _set_interval
215
def __init__(self, name = None, stop_hook=None, config={}):
216
"""Note: the 'checker' key in 'config' sets the
217
'checker_command' attribute and *not* the 'checker'
218
attribute."""
155
def __init__(self, name=None, stop_hook=None, fingerprint=None,
156
secret=None, secfile=None, fqdn=None, timeout=None,
157
interval=-1, checker=None):
158
"""Note: the 'checker' argument sets the 'checker_command'
159
attribute and not the 'checker' attribute.."""
219
160
self.name = name
220
161
logger.debug(u"Creating client %r", self.name)
221
# Uppercase and remove spaces from fingerprint for later
222
# comparison purposes with return value from the fingerprint()
223
# function
224
self.fingerprint = config["fingerprint"].upper()\
225
.replace(u" ", u"")
162
# Uppercase and remove spaces from fingerprint
163
# for later comparison purposes with return value of
164
# the fingerprint() function
165
self.fingerprint = fingerprint.upper().replace(u" ", u"")
226
166
logger.debug(u" Fingerprint: %s", self.fingerprint)
227
if "secret" in config:
228
self.secret = config["secret"].decode(u"base64")
229
elif "secfile" in config:
230
sf = open(config["secfile"])
167
if secret:
168
self.secret = secret.decode(u"base64")
169
elif secfile:
170
sf = open(secfile)
231
171
self.secret = sf.read()
232
172
sf.close()
233
173
else:
234
raise TypeError(u"No secret or secfile for client %s"
235
% self.name)
236
self.host = config.get("host", "")
174
raise RuntimeError(u"No secret or secfile for client %s"
175
% self.name)
176
self.fqdn = fqdn # string
237
177
self.created = datetime.datetime.now()
238
self.last_checked_ok = None
239
self.timeout = string_to_delta(config["timeout"])
240
self.interval = string_to_delta(config["interval"])
178
self.last_seen = None
179
self.timeout = string_to_delta(timeout)
180
self.interval = string_to_delta(interval)
241
181
self.stop_hook = stop_hook
242
182
self.checker = None
243
183
self.checker_initiator_tag = None
244
184
self.stop_initiator_tag = None
245
185
self.checker_callback_tag = None
246
self.check_command = config["checker"]
186
self.check_command = checker
247
187
def start(self):
248
188
"""Start this client's checker and timeout hooks"""
249
189
# Schedule a new checker to be started an 'interval' from now,
259
199
self.stop)
260
200
def stop(self):
261
201
"""Stop this client.
262
The possibility that a client might be restarted is left open,
263
but not currently used."""
202
The possibility that this client might be restarted is left
203
open, but not currently used."""
264
204
# If this client doesn't have a secret, it is already stopped.
265
if hasattr(self, "secret") and self.secret:
266
logger.info(u"Stopping client %s", self.name)
205
if self.secret:
206
logger.debug(u"Stopping client %s", self.name)
267
207
self.secret = None
268
208
else:
269
209
return False
270
if getattr(self, "stop_initiator_tag", False):
210
if hasattr(self, "stop_initiator_tag") \
211
and self.stop_initiator_tag:
271
212
gobject.source_remove(self.stop_initiator_tag)
272
213
self.stop_initiator_tag = None
273
if getattr(self, "checker_initiator_tag", False):
214
if hasattr(self, "checker_initiator_tag") \
215
and self.checker_initiator_tag:
274
216
gobject.source_remove(self.checker_initiator_tag)
275
217
self.checker_initiator_tag = None
276
218
self.stop_checker()
288
230
self.checker = None
289
231
if os.WIFEXITED(condition) \
290
232
and (os.WEXITSTATUS(condition) == 0):
291
logger.info(u"Checker for %(name)s succeeded",
292
vars(self))
293
self.last_checked_ok = now
233
logger.debug(u"Checker for %(name)s succeeded",
234
vars(self))
235
self.last_seen = now
294
236
gobject.source_remove(self.stop_initiator_tag)
295
237
self.stop_initiator_tag = gobject.timeout_add\
296
238
(self._timeout_milliseconds,
299
241
logger.warning(u"Checker for %(name)s crashed?",
300
242
vars(self))
301
243
else:
302
logger.info(u"Checker for %(name)s failed",
303
vars(self))
244
logger.debug(u"Checker for %(name)s failed",
245
vars(self))
304
246
def start_checker(self):
305
247
"""Start a new checker subprocess if one is not running.
306
248
If a checker already exists, leave it running and do
315
257
# is as it should be.
316
258
if self.checker is None:
317
259
try:
318
# In case check_command has exactly one % operator
319
command = self.check_command % self.host
260
command = self.check_command % self.fqdn
320
261
except TypeError:
321
# Escape attributes for the shell
322
262
escaped_attrs = dict((key, re.escape(str(val)))
323
263
for key, val in
324
264
vars(self).iteritems())
325
265
try:
326
266
command = self.check_command % escaped_attrs
327
267
except TypeError, error:
328
logger.error(u'Could not format string "%s":'
329
u' %s', self.check_command, error)
268
logger.critical(u'Could not format string "%s":'
269
u' %s', self.check_command, error)
330
270
return True # Try again later
331
271
try:
332
logger.info(u"Starting checker %r for %s",
333
command, self.name)
334
self.checker = subprocess.Popen(command,
335
close_fds=True,
336
shell=True, cwd="/")
272
logger.debug(u"Starting checker %r for %s",
273
command, self.name)
274
self.checker = subprocess.\
275
Popen(command,
276
close_fds=True, shell=True,
277
cwd="/")
337
278
self.checker_callback_tag = gobject.child_watch_add\
338
279
(self.checker.pid,
339
280
self.checker_callback)
347
288
if self.checker_callback_tag:
348
289
gobject.source_remove(self.checker_callback_tag)
349
290
self.checker_callback_tag = None
350
if getattr(self, "checker", None) is None:
291
if not hasattr(self, "checker") or self.checker is None:
351
292
return
352
logger.debug(u"Stopping checker for %(name)s", vars(self))
293
logger.debug("Stopping checker for %(name)s", vars(self))
353
294
try:
354
295
os.kill(self.checker.pid, signal.SIGTERM)
355
296
#os.sleep(0.5)
356
297
#if self.checker.poll() is None:
357
298
# os.kill(self.checker.pid, signal.SIGKILL)
358
299
except OSError, error:
359
if error.errno != errno.ESRCH: # No such process
300
if error.errno != errno.ESRCH:
360
301
raise
361
302
self.checker = None
362
def still_valid(self):
303
def still_valid(self, now=None):
363
304
"""Has the timeout not yet passed for this client?"""
364
now = datetime.datetime.now()
365
if self.last_checked_ok is None:
305
if now is None:
306
now = datetime.datetime.now()
307
if self.last_seen is None:
366
308
return now < (self.created + self.timeout)
367
309
else:
368
return now < (self.last_checked_ok + self.timeout)
310
return now < (self.last_seen + self.timeout)
369
311
370
312
371
313
def peer_certificate(session):
387
329
388
330
def fingerprint(openpgp):
389
331
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
332
# New empty GnuTLS certificate
333
crt = gnutls.library.types.gnutls_openpgp_crt_t()
334
gnutls.library.functions.gnutls_openpgp_crt_init\
335
(ctypes.byref(crt))
390
336
# New GnuTLS "datum" with the OpenPGP public key
391
337
datum = gnutls.library.types.gnutls_datum_t\
392
338
(ctypes.cast(ctypes.c_char_p(openpgp),
393
339
ctypes.POINTER(ctypes.c_ubyte)),
394
340
ctypes.c_uint(len(openpgp)))
395
# New empty GnuTLS certificate
396
crt = gnutls.library.types.gnutls_openpgp_crt_t()
397
gnutls.library.functions.gnutls_openpgp_crt_init\
398
(ctypes.byref(crt))
399
341
# Import the OpenPGP public key into the certificate
400
gnutls.library.functions.gnutls_openpgp_crt_import\
401
(crt, ctypes.byref(datum),
402
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
342
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
343
(crt,
344
ctypes.byref(datum),
345
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
403
346
# New buffer for the fingerprint
404
347
buffer = ctypes.create_string_buffer(20)
405
348
buffer_length = ctypes.c_size_t()
421
364
Note: This will run in its own forked process."""
422
365
423
366
def handle(self):
424
logger.info(u"TCP connection from: %s",
367
logger.debug(u"TCP connection from: %s",
425
368
unicode(self.client_address))
426
session = gnutls.connection.ClientSession\
427
(self.request, gnutls.connection.X509Credentials())
428
429
line = self.request.makefile().readline()
430
logger.debug(u"Protocol version: %r", line)
431
try:
432
if int(line.strip().split()[0]) > 1:
433
raise RuntimeError
434
except (ValueError, IndexError, RuntimeError), error:
435
logger.error(u"Unknown protocol version: %s", error)
436
return
437
438
# Note: gnutls.connection.X509Credentials is really a generic
439
# GnuTLS certificate credentials object so long as no X.509
440
# keys are added to it. Therefore, we can use it here despite
441
# using OpenPGP certificates.
369
session = gnutls.connection.ClientSession(self.request,
370
gnutls.connection.\
371
X509Credentials())
442
372
443
373
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
444
374
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
445
375
# "+DHE-DSS"))
446
priority = "NORMAL" # Fallback default, since this
447
# MUST be set.
448
if self.server.settings["priority"]:
449
priority = self.server.settings["priority"]
376
priority = "NORMAL"
377
if self.server.options.priority:
378
priority = self.server.options.priority
450
379
gnutls.library.functions.gnutls_priority_set_direct\
451
380
(session._c_object, priority, None);
452
381
453
382
try:
454
383
session.handshake()
455
384
except gnutls.errors.GNUTLSError, error:
456
logger.warning(u"Handshake failed: %s", error)
385
logger.debug(u"Handshake failed: %s", error)
457
386
# Do not run session.bye() here: the session is not
458
387
# established. Just abandon the request.
459
388
return
460
389
try:
461
390
fpr = fingerprint(peer_certificate(session))
462
391
except (TypeError, gnutls.errors.GNUTLSError), error:
463
logger.warning(u"Bad certificate: %s", error)
392
logger.debug(u"Bad certificate: %s", error)
464
393
session.bye()
465
394
return
466
395
logger.debug(u"Fingerprint: %s", fpr)
469
398
if c.fingerprint == fpr:
470
399
client = c
471
400
break
472
if not client:
473
logger.warning(u"Client not found for fingerprint: %s",
474
fpr)
475
session.bye()
476
return
477
401
# Have to check if client.still_valid(), since it is possible
478
402
# that the client timed out while establishing the GnuTLS
479
403
# session.
480
if not client.still_valid():
481
logger.warning(u"Client %(name)s is invalid",
482
vars(client))
404
if (not client) or (not client.still_valid()):
405
if client:
406
logger.debug(u"Client %(name)s is invalid",
407
vars(client))
408
else:
409
logger.debug(u"Client not found for fingerprint: %s",
410
fpr)
483
411
session.bye()
484
412
return
485
413
sent_size = 0
495
423
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
496
424
"""IPv6 TCP server. Accepts 'None' as address and/or port.
497
425
Attributes:
498
settings: Server settings
426
options: Command line options
499
427
clients: Set() of Client objects
500
428
"""
501
429
address_family = socket.AF_INET6
502
430
def __init__(self, *args, **kwargs):
503
if "settings" in kwargs:
504
self.settings = kwargs["settings"]
505
del kwargs["settings"]
431
if "options" in kwargs:
432
self.options = kwargs["options"]
433
del kwargs["options"]
506
434
if "clients" in kwargs:
507
435
self.clients = kwargs["clients"]
508
436
del kwargs["clients"]
511
439
"""This overrides the normal server_bind() function
512
440
to bind to an interface if one was specified, and also NOT to
513
441
bind to an address or port if they were not specified."""
514
if self.settings["interface"]:
515
# 25 is from /usr/include/asm-i486/socket.h
516
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
442
if self.options.interface:
443
if not hasattr(socket, "SO_BINDTODEVICE"):
444
# From /usr/include/asm-i486/socket.h
445
socket.SO_BINDTODEVICE = 25
517
446
try:
518
447
self.socket.setsockopt(socket.SOL_SOCKET,
519
SO_BINDTODEVICE,
520
self.settings["interface"])
448
socket.SO_BINDTODEVICE,
449
self.options.interface)
521
450
except socket.error, error:
522
451
if error[0] == errno.EPERM:
523
logger.error(u"No permission to"
524
u" bind to interface %s",
525
self.settings["interface"])
452
logger.warning(u"No permission to"
453
u" bind to interface %s",
454
self.options.interface)
526
455
else:
527
456
raise error
528
457
# Only bind(2) the socket if we really need to.
531
460
in6addr_any = "::"
532
461
self.server_address = (in6addr_any,
533
462
self.server_address[1])
534
elif not self.server_address[1]:
463
elif self.server_address[1] is None:
535
464
self.server_address = (self.server_address[0],
536
465
0)
537
# if self.settings["interface"]:
538
# self.server_address = (self.server_address[0],
539
# 0, # port
540
# 0, # flowinfo
541
# if_nametoindex
542
# (self.settings
543
# ["interface"]))
544
466
return super(type(self), self).server_bind()
545
467
546
468
578
500
return delta
579
501
580
502
503
def add_service():
504
"""Derived from the Avahi example code"""
505
global group, serviceName, serviceType, servicePort, serviceTXT, \
506
domain, host
507
if group is None:
508
group = dbus.Interface(
509
bus.get_object( avahi.DBUS_NAME,
510
server.EntryGroupNew()),
511
avahi.DBUS_INTERFACE_ENTRY_GROUP)
512
group.connect_to_signal('StateChanged',
513
entry_group_state_changed)
514
logger.debug(u"Adding service '%s' of type '%s' ...",
515
serviceName, serviceType)
516
517
group.AddService(
518
serviceInterface, # interface
519
avahi.PROTO_INET6, # protocol
520
dbus.UInt32(0), # flags
521
serviceName, serviceType,
522
domain, host,
523
dbus.UInt16(servicePort),
524
avahi.string_array_to_txt_array(serviceTXT))
525
group.Commit()
526
527
528
def remove_service():
529
"""From the Avahi example code"""
530
global group
531
532
if not group is None:
533
group.Reset()
534
535
581
536
def server_state_changed(state):
582
537
"""Derived from the Avahi example code"""
583
538
if state == avahi.SERVER_COLLISION:
584
logger.error(u"Server name collision")
585
service.remove()
539
logger.warning(u"Server name collision")
540
remove_service()
586
541
elif state == avahi.SERVER_RUNNING:
587
service.add()
542
add_service()
588
543
589
544
590
545
def entry_group_state_changed(state, error):
591
546
"""Derived from the Avahi example code"""
547
global serviceName, server, rename_count
548
592
549
logger.debug(u"state change: %i", state)
593
550
594
551
if state == avahi.ENTRY_GROUP_ESTABLISHED:
595
552
logger.debug(u"Service established.")
596
553
elif state == avahi.ENTRY_GROUP_COLLISION:
597
logger.warning(u"Service name collision.")
598
service.rename()
554
555
rename_count = rename_count - 1
556
if rename_count > 0:
557
name = server.GetAlternativeServiceName(name)
558
logger.warning(u"Service name collision, "
559
u"changing name to '%s' ...", name)
560
remove_service()
561
add_service()
562
563
else:
564
logger.error(u"No suitable service name found after %i"
565
u" retries, exiting.", n_rename)
566
killme(1)
599
567
elif state == avahi.ENTRY_GROUP_FAILURE:
600
logger.critical(u"Error in group state changed %s",
601
unicode(error))
602
raise AvahiGroupError("State changed: %s", str(error))
568
logger.error(u"Error in group state changed %s",
569
unicode(error))
570
killme(1)
571
603
572
604
573
def if_nametoindex(interface):
605
"""Call the C function if_nametoindex(), or equivalent"""
606
global if_nametoindex
574
"""Call the C function if_nametoindex()"""
607
575
try:
608
if "ctypes.util" not in sys.modules:
609
import ctypes.util
610
if_nametoindex = ctypes.cdll.LoadLibrary\
611
(ctypes.util.find_library("c")).if_nametoindex
576
libc = ctypes.cdll.LoadLibrary("libc.so.6")
577
return libc.if_nametoindex(interface)
612
578
except (OSError, AttributeError):
613
579
if "struct" not in sys.modules:
614
580
import struct
615
581
if "fcntl" not in sys.modules:
616
582
import fcntl
617
def if_nametoindex(interface):
618
"Get an interface index the hard way, i.e. using fcntl()"
619
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
620
s = socket.socket()
621
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
622
struct.pack("16s16x", interface))
623
s.close()
624
interface_index = struct.unpack("I", ifreq[16:20])[0]
625
return interface_index
626
return if_nametoindex(interface)
627
628
629
def daemon(nochdir = False, noclose = False):
583
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
584
s = socket.socket()
585
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
586
struct.pack("16s16x", interface))
587
s.close()
588
interface_index = struct.unpack("I", ifreq[16:20])[0]
589
return interface_index
590
591
592
def daemon(nochdir, noclose):
630
593
"""See daemon(3). Standard BSD Unix function.
631
594
This should really exist as os.daemon, but it doesn't (yet)."""
632
595
if os.fork():
634
597
os.setsid()
635
598
if not nochdir:
636
599
os.chdir("/")
637
if os.fork():
638
sys.exit()
639
600
if not noclose:
640
601
# Close all standard open file descriptors
641
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
602
null = os.open("/dev/null", os.O_NOCTTY | os.O_RDWR)
642
603
if not stat.S_ISCHR(os.fstat(null).st_mode):
643
604
raise OSError(errno.ENODEV,
644
605
"/dev/null not a character device")
649
610
os.close(null)
650
611
651
612
613
def killme(status = 0):
614
logger.debug("Stopping server with exit status %d", status)
615
exitstatus = status
616
if main_loop_started:
617
main_loop.quit()
618
else:
619
sys.exit(status)
620
621
652
622
def main():
623
global exitstatus
624
exitstatus = 0
653
625
global main_loop_started
654
626
main_loop_started = False
655
627
656
628
parser = OptionParser()
657
629
parser.add_option("-i", "--interface", type="string",
658
metavar="IF", help="Bind to interface IF")
659
parser.add_option("-a", "--address", type="string",
630
default=None, metavar="IF",
631
help="Bind to interface IF")
632
parser.add_option("-a", "--address", type="string", default=None,
660
633
help="Address to listen for requests on")
661
parser.add_option("-p", "--port", type="int",
634
parser.add_option("-p", "--port", type="int", default=None,
662
635
help="Port number to receive requests on")
663
636
parser.add_option("--check", action="store_true", default=False,
664
637
help="Run self-test")
665
parser.add_option("--debug", action="store_true",
666
help="Debug mode; run in foreground and log to"
667
" terminal")
668
parser.add_option("--priority", type="string", help="GnuTLS"
669
" priority string (see GnuTLS documentation)")
670
parser.add_option("--servicename", type="string", metavar="NAME",
671
help="Zeroconf service name")
672
parser.add_option("--configdir", type="string",
673
default="/etc/mandos", metavar="DIR",
674
help="Directory to search for configuration"
675
" files")
638
parser.add_option("--debug", action="store_true", default=False,
639
help="Debug mode")
640
parser.add_option("--priority", type="string",
641
default="SECURE256",
642
help="GnuTLS priority string"
643
" (see GnuTLS documentation)")
644
parser.add_option("--servicename", type="string",
645
default="Mandos", help="Zeroconf service name")
676
646
(options, args) = parser.parse_args()
677
647
678
648
if options.check:
680
650
doctest.testmod()
681
651
sys.exit()
682
652
683
# Default values for config file for server-global settings
684
server_defaults = { "interface": "",
685
"address": "",
686
"port": "",
687
"debug": "False",
688
"priority":
689
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
690
"servicename": "Mandos",
691
}
692
693
# Parse config file for server-global settings
694
server_config = ConfigParser.SafeConfigParser(server_defaults)
695
del server_defaults
696
server_config.read(os.path.join(options.configdir, "mandos.conf"))
697
server_section = "server"
698
# Convert the SafeConfigParser object to a dict
699
server_settings = dict(server_config.items(server_section))
700
# Use getboolean on the boolean config option
701
server_settings["debug"] = server_config.getboolean\
702
(server_section, "debug")
703
del server_config
704
705
# Override the settings from the config file with command line
706
# options, if set.
707
for option in ("interface", "address", "port", "debug",
708
"priority", "servicename", "configdir"):
709
value = getattr(options, option)
710
if value is not None:
711
server_settings[option] = value
712
del options
713
# Now we have our good server settings in "server_settings"
714
715
debug = server_settings["debug"]
716
717
if not debug:
718
syslogger.setLevel(logging.WARNING)
719
720
if server_settings["servicename"] != "Mandos":
721
syslogger.setFormatter(logging.Formatter\
722
('Mandos (%s): %%(levelname)s:'
723
' %%(message)s'
724
% server_settings["servicename"]))
725
726
# Parse config file with clients
727
client_defaults = { "timeout": "1h",
728
"interval": "5m",
729
"checker": "fping -q -- %%(host)s",
730
}
731
client_config = ConfigParser.SafeConfigParser(client_defaults)
732
client_config.read(os.path.join(server_settings["configdir"],
733
"clients.conf"))
734
735
global service
736
service = AvahiService(name = server_settings["servicename"],
737
type = "_mandos._tcp", );
738
if server_settings["interface"]:
739
service.interface = if_nametoindex(server_settings["interface"])
653
# Parse config file
654
defaults = { "timeout": "1h",
655
"interval": "5m",
656
"checker": "fping -q -- %%(fqdn)s",
657
}
658
client_config = ConfigParser.SafeConfigParser(defaults)
659
#client_config.readfp(open("global.conf"), "global.conf")
660
client_config.read("mandos-clients.conf")
661
662
global serviceName
663
serviceName = options.servicename;
740
664
741
665
global main_loop
742
666
global bus
750
674
avahi.DBUS_INTERFACE_SERVER )
751
675
# End of Avahi example code
752
676
677
debug = options.debug
678
753
679
if debug:
754
680
console = logging.StreamHandler()
755
681
# console.setLevel(logging.DEBUG)
762
688
def remove_from_clients(client):
763
689
clients.remove(client)
764
690
if not clients:
765
logger.critical(u"No clients left, exiting")
766
sys.exit()
691
logger.debug(u"No clients left, exiting")
692
killme()
767
693
768
clients.update(Set(Client(name = section,
694
clients.update(Set(Client(name=section,
769
695
stop_hook = remove_from_clients,
770
config
771
= dict(client_config.items(section)))
696
**(dict(client_config\
697
.items(section))))
772
698
for section in client_config.sections()))
773
if not clients:
774
logger.critical(u"No clients defined")
775
sys.exit(1)
776
699
777
700
if not debug:
778
daemon()
779
780
pidfilename = "/var/run/mandos/mandos.pid"
781
pid = os.getpid()
782
try:
783
pidfile = open(pidfilename, "w")
784
pidfile.write(str(pid) + "\n")
785
pidfile.close()
786
del pidfile
787
except IOError, err:
788
logger.error(u"Could not write %s file with PID %d",
789
pidfilename, os.getpid())
701
daemon(False, False)
790
702
791
703
def cleanup():
792
704
"Cleanup function; run on exit"
806
718
807
719
if not debug:
808
720
signal.signal(signal.SIGINT, signal.SIG_IGN)
809
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
810
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
721
signal.signal(signal.SIGHUP, lambda signum, frame: killme())
722
signal.signal(signal.SIGTERM, lambda signum, frame: killme())
811
723
812
724
for client in clients:
813
725
client.start()
814
726
815
tcp_server = IPv6_TCPServer((server_settings["address"],
816
server_settings["port"]),
727
tcp_server = IPv6_TCPServer((options.address, options.port),
817
728
tcp_handler,
818
settings=server_settings,
729
options=options,
819
730
clients=clients)
820
# Find out what port we got
821
service.port = tcp_server.socket.getsockname()[1]
822
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
823
u" scope_id %d" % tcp_server.socket.getsockname())
824
825
#service.interface = tcp_server.socket.getsockname()[3]
826
827
try:
828
# From the Avahi example code
829
server.connect_to_signal("StateChanged", server_state_changed)
830
try:
831
server_state_changed(server.GetState())
832
except dbus.exceptions.DBusException, error:
833
logger.critical(u"DBusException: %s", error)
834
sys.exit(1)
835
# End of Avahi example code
836
837
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
838
lambda *args, **kwargs:
839
tcp_server.handle_request\
840
(*args[2:], **kwargs) or True)
841
842
logger.debug(u"Starting main loop")
731
# Find out what random port we got
732
global servicePort
733
servicePort = tcp_server.socket.getsockname()[1]
734
logger.debug(u"Now listening on port %d", servicePort)
735
736
if options.interface is not None:
737
global serviceInterface
738
serviceInterface = if_nametoindex(options.interface)
739
740
# From the Avahi example code
741
server.connect_to_signal("StateChanged", server_state_changed)
742
try:
743
server_state_changed(server.GetState())
744
except dbus.exceptions.DBusException, error:
745
logger.critical(u"DBusException: %s", error)
746
killme(1)
747
# End of Avahi example code
748
749
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
750
lambda *args, **kwargs:
751
tcp_server.handle_request(*args[2:],
752
**kwargs) or True)
753
try:
754
logger.debug("Starting main loop")
843
755
main_loop_started = True
844
756
main_loop.run()
845
except AvahiError, error:
846
logger.critical(u"AvahiError: %s" + unicode(error))
847
sys.exit(1)
848
757
except KeyboardInterrupt:
849
758
if debug:
850
759
print
760
761
sys.exit(exitstatus)
851
762
852
763
if __name__ == '__main__':
853
764
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0