To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 24.1.51
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.51
- Committer: Björn Påhlsson
- Date: 2008-08-15 20:17:32 UTC
- mto: (24.1.154 mandos) (237.4.3 mandos-release)
- mto: This revision was merged to the branch mainline in revision 77.
- Revision ID: belorn@braxen-20080815201732-b7uux3yqs05b3fy9
Added configuration files support for mandos-client
Removed plus argument support for mandos-client
Removed plus argument support for mandos-client
- files added:
- COPYING
- files removed:
- ca.pem
- files renamed:
- mandos-clients.conf => clients.conf
- server.py => mandos
- plugbasedclient.c => mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- plugins.d/mandosclient.c => plugins.d/password-request.c
- files modified:
- Makefile
added
removed
mandos
1
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
# Mandos server - give out binary blobs to connecting clients.
5
#
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
#
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
15
#
16
# This program is free software: you can redistribute it and/or modify
17
# it under the terms of the GNU General Public License as published by
18
# the Free Software Foundation, either version 3 of the License, or
19
# (at your option) any later version.
20
#
21
# This program is distributed in the hope that it will be useful,
22
# but WITHOUT ANY WARRANTY; without even the implied warranty of
23
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24
# GNU General Public License for more details.
25
#
26
# You should have received a copy of the GNU General Public License
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
28
#
29
# Contact the authors at <mandos@fukt.bsnet.se>.
30
#
2
31
3
32
from __future__ import division
4
33
21
50
import signal
22
51
from sets import Set
23
52
import subprocess
53
import atexit
54
import stat
55
import logging
56
import logging.handlers
24
57
25
58
import dbus
26
59
import gobject
28
61
from dbus.mainloop.glib import DBusGMainLoop
29
62
import ctypes
30
63
31
import logging
32
import logging.handlers
33
34
# logghandler.setFormatter(logging.Formatter('%(levelname)s %(message)s')
64
version = "1.0"
35
65
36
66
logger = logging.Logger('mandos')
37
logger.addHandler(logging.handlers.SysLogHandler(facility = logging.handlers.SysLogHandler.LOG_DAEMON))
38
39
# This variable is used to optionally bind to a specified interface.
40
# It is a global variable to fit in with the other variables from the
41
# Avahi server example code.
42
serviceInterface = avahi.IF_UNSPEC
43
# From the Avahi server example code:
44
serviceName = "Mandos"
45
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
46
servicePort = None # Not known at startup
47
serviceTXT = [] # TXT record for the service
48
domain = "" # Domain to publish on, default to .local
49
host = "" # Host to publish records for, default to localhost
50
group = None #our entry group
51
rename_count = 12 # Counter so we only rename after collisions a
52
# sensible number of times
67
syslogger = logging.handlers.SysLogHandler\
68
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
69
address = "/dev/log")
70
syslogger.setFormatter(logging.Formatter\
71
('Mandos: %(levelname)s: %(message)s'))
72
logger.addHandler(syslogger)
73
74
console = logging.StreamHandler()
75
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
76
' %(message)s'))
77
logger.addHandler(console)
78
79
class AvahiError(Exception):
80
def __init__(self, value):
81
self.value = value
82
def __str__(self):
83
return repr(self.value)
84
85
class AvahiServiceError(AvahiError):
86
pass
87
88
class AvahiGroupError(AvahiError):
89
pass
90
91
92
class AvahiService(object):
93
"""An Avahi (Zeroconf) service.
94
Attributes:
95
interface: integer; avahi.IF_UNSPEC or an interface index.
96
Used to optionally bind to the specified interface.
97
name: string; Example: 'Mandos'
98
type: string; Example: '_mandos._tcp'.
99
See <http://www.dns-sd.org/ServiceTypes.html>
100
port: integer; what port to announce
101
TXT: list of strings; TXT record for the service
102
domain: string; Domain to publish on, default to .local if empty.
103
host: string; Host to publish records for, default is localhost
104
max_renames: integer; maximum number of renames
105
rename_count: integer; counter so we only rename after collisions
106
a sensible number of times
107
"""
108
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
109
type = None, port = None, TXT = None, domain = "",
110
host = "", max_renames = 32768):
111
self.interface = interface
112
self.name = name
113
self.type = type
114
self.port = port
115
if TXT is None:
116
self.TXT = []
117
else:
118
self.TXT = TXT
119
self.domain = domain
120
self.host = host
121
self.rename_count = 0
122
def rename(self):
123
"""Derived from the Avahi example code"""
124
if self.rename_count >= self.max_renames:
125
logger.critical(u"No suitable service name found after %i"
126
u" retries, exiting.", rename_count)
127
raise AvahiServiceError("Too many renames")
128
name = server.GetAlternativeServiceName(name)
129
logger.error(u"Changing name to %r ...", name)
130
syslogger.setFormatter(logging.Formatter\
131
('Mandos (%s): %%(levelname)s:'
132
' %%(message)s' % name))
133
self.remove()
134
self.add()
135
self.rename_count += 1
136
def remove(self):
137
"""Derived from the Avahi example code"""
138
if group is not None:
139
group.Reset()
140
def add(self):
141
"""Derived from the Avahi example code"""
142
global group
143
if group is None:
144
group = dbus.Interface\
145
(bus.get_object(avahi.DBUS_NAME,
146
server.EntryGroupNew()),
147
avahi.DBUS_INTERFACE_ENTRY_GROUP)
148
group.connect_to_signal('StateChanged',
149
entry_group_state_changed)
150
logger.debug(u"Adding service '%s' of type '%s' ...",
151
service.name, service.type)
152
group.AddService(
153
self.interface, # interface
154
avahi.PROTO_INET6, # protocol
155
dbus.UInt32(0), # flags
156
self.name, self.type,
157
self.domain, self.host,
158
dbus.UInt16(self.port),
159
avahi.string_array_to_txt_array(self.TXT))
160
group.Commit()
161
162
# From the Avahi example code:
163
group = None # our entry group
53
164
# End of Avahi example code
54
165
55
166
60
171
fingerprint: string (40 or 32 hexadecimal digits); used to
61
172
uniquely identify the client
62
173
secret: bytestring; sent verbatim (over TLS) to client
63
fqdn: string (FQDN); available for use by the checker command
64
created: datetime.datetime()
65
last_seen: datetime.datetime() or None if not yet seen
66
timeout: datetime.timedelta(); How long from last_seen until
67
this client is invalid
174
host: string; available for use by the checker command
175
created: datetime.datetime(); object creation, not client host
176
last_checked_ok: datetime.datetime() or None if not yet checked OK
177
timeout: datetime.timedelta(); How long from last_checked_ok
178
until this client is invalid
68
179
interval: datetime.timedelta(); How often to start a new checker
69
180
stop_hook: If set, called by stop() as stop_hook(self)
70
181
checker: subprocess.Popen(); a running checker process used
71
182
to see if the client lives.
72
Is None if no process is running.
183
'None' if no process is running.
73
184
checker_initiator_tag: a gobject event source tag, or None
74
185
stop_initiator_tag: - '' -
75
186
checker_callback_tag: - '' -
76
187
checker_command: string; External command which is run to check if
77
client lives. %()s expansions are done at
188
client lives. %() expansions are done at
78
189
runtime with vars(self) as dict, so that for
79
190
instance %(name)s can be used in the command.
80
191
Private attibutes:
81
192
_timeout: Real variable for 'timeout'
82
193
_interval: Real variable for 'interval'
83
_timeout_milliseconds: Used by gobject.timeout_add()
194
_timeout_milliseconds: Used when calling gobject.timeout_add()
84
195
_interval_milliseconds: - '' -
85
196
"""
86
197
def _set_timeout(self, timeout):
106
217
interval = property(lambda self: self._interval,
107
218
_set_interval)
108
219
del _set_interval
109
def __init__(self, name=None, options=None, stop_hook=None,
110
fingerprint=None, secret=None, secfile=None, fqdn=None,
111
timeout=None, interval=-1, checker=None):
220
def __init__(self, name = None, stop_hook=None, config={}):
221
"""Note: the 'checker' key in 'config' sets the
222
'checker_command' attribute and *not* the 'checker'
223
attribute."""
112
224
self.name = name
113
# Uppercase and remove spaces from fingerprint
114
# for later comparison purposes with return value of
115
# the fingerprint() function
116
self.fingerprint = fingerprint.upper().replace(u" ", u"")
117
if secret:
118
self.secret = secret.decode(u"base64")
119
elif secfile:
120
sf = open(secfile)
225
logger.debug(u"Creating client %r", self.name)
226
# Uppercase and remove spaces from fingerprint for later
227
# comparison purposes with return value from the fingerprint()
228
# function
229
self.fingerprint = config["fingerprint"].upper()\
230
.replace(u" ", u"")
231
logger.debug(u" Fingerprint: %s", self.fingerprint)
232
if "secret" in config:
233
self.secret = config["secret"].decode(u"base64")
234
elif "secfile" in config:
235
sf = open(config["secfile"])
121
236
self.secret = sf.read()
122
237
sf.close()
123
238
else:
124
raise RuntimeError(u"No secret or secfile for client %s"
125
% self.name)
126
self.fqdn = fqdn # string
239
raise TypeError(u"No secret or secfile for client %s"
240
% self.name)
241
self.host = config.get("host", "")
127
242
self.created = datetime.datetime.now()
128
self.last_seen = None
129
if timeout is None:
130
timeout = options.timeout
131
self.timeout = timeout
132
if interval == -1:
133
interval = options.interval
134
else:
135
interval = string_to_delta(interval)
136
self.interval = interval
243
self.last_checked_ok = None
244
self.timeout = string_to_delta(config["timeout"])
245
self.interval = string_to_delta(config["interval"])
137
246
self.stop_hook = stop_hook
138
247
self.checker = None
139
248
self.checker_initiator_tag = None
140
249
self.stop_initiator_tag = None
141
250
self.checker_callback_tag = None
142
self.check_command = checker
251
self.check_command = config["checker"]
143
252
def start(self):
144
"""Start this clients checker and timeout hooks"""
253
"""Start this client's checker and timeout hooks"""
145
254
# Schedule a new checker to be started an 'interval' from now,
146
255
# and every interval from then on.
147
256
self.checker_initiator_tag = gobject.timeout_add\
155
264
self.stop)
156
265
def stop(self):
157
266
"""Stop this client.
158
The possibility that this client might be restarted is left
159
open, but not currently used."""
160
logger.debug(u"Stopping client %s", self.name)
161
self.secret = None
162
if self.stop_initiator_tag:
267
The possibility that a client might be restarted is left open,
268
but not currently used."""
269
# If this client doesn't have a secret, it is already stopped.
270
if hasattr(self, "secret") and self.secret:
271
logger.info(u"Stopping client %s", self.name)
272
self.secret = None
273
else:
274
return False
275
if getattr(self, "stop_initiator_tag", False):
163
276
gobject.source_remove(self.stop_initiator_tag)
164
277
self.stop_initiator_tag = None
165
if self.checker_initiator_tag:
278
if getattr(self, "checker_initiator_tag", False):
166
279
gobject.source_remove(self.checker_initiator_tag)
167
280
self.checker_initiator_tag = None
168
281
self.stop_checker()
171
284
# Do not run this again if called by a gobject.timeout_add
172
285
return False
173
286
def __del__(self):
174
# Some code duplication here and in stop()
175
if hasattr(self, "stop_initiator_tag") \
176
and self.stop_initiator_tag:
177
gobject.source_remove(self.stop_initiator_tag)
178
self.stop_initiator_tag = None
179
if hasattr(self, "checker_initiator_tag") \
180
and self.checker_initiator_tag:
181
gobject.source_remove(self.checker_initiator_tag)
182
self.checker_initiator_tag = None
183
self.stop_checker()
287
self.stop_hook = None
288
self.stop()
184
289
def checker_callback(self, pid, condition):
185
290
"""The checker has completed, so take appropriate actions."""
186
291
now = datetime.datetime.now()
292
self.checker_callback_tag = None
293
self.checker = None
187
294
if os.WIFEXITED(condition) \
188
295
and (os.WEXITSTATUS(condition) == 0):
189
logger.debug(u"Checker for %(name)s succeeded",
190
vars(self))
191
self.last_seen = now
296
logger.info(u"Checker for %(name)s succeeded",
297
vars(self))
298
self.last_checked_ok = now
192
299
gobject.source_remove(self.stop_initiator_tag)
193
300
self.stop_initiator_tag = gobject.timeout_add\
194
301
(self._timeout_milliseconds,
195
302
self.stop)
196
if not os.WIFEXITED(condition):
303
elif not os.WIFEXITED(condition):
197
304
logger.warning(u"Checker for %(name)s crashed?",
198
305
vars(self))
199
306
else:
200
logger.debug(u"Checker for %(name)s failed",
201
vars(self))
202
self.checker = None
203
self.checker_callback_tag = None
307
logger.info(u"Checker for %(name)s failed",
308
vars(self))
204
309
def start_checker(self):
205
310
"""Start a new checker subprocess if one is not running.
206
311
If a checker already exists, leave it running and do
207
312
nothing."""
313
# The reason for not killing a running checker is that if we
314
# did that, then if a checker (for some reason) started
315
# running slowly and taking more than 'interval' time, the
316
# client would inevitably timeout, since no checker would get
317
# a chance to run to completion. If we instead leave running
318
# checkers alone, the checker would have to take more time
319
# than 'timeout' for the client to be declared invalid, which
320
# is as it should be.
208
321
if self.checker is None:
209
logger.debug(u"Starting checker for %s",
210
self.name)
211
322
try:
212
command = self.check_command % self.fqdn
323
# In case check_command has exactly one % operator
324
command = self.check_command % self.host
213
325
except TypeError:
326
# Escape attributes for the shell
214
327
escaped_attrs = dict((key, re.escape(str(val)))
215
328
for key, val in
216
329
vars(self).iteritems())
217
330
try:
218
331
command = self.check_command % escaped_attrs
219
332
except TypeError, error:
220
logger.critical(u'Could not format string "%s": %s',
221
self.check_command, error)
333
logger.error(u'Could not format string "%s":'
334
u' %s', self.check_command, error)
222
335
return True # Try again later
223
336
try:
224
self.checker = subprocess.\
225
Popen(command,
226
stdout=subprocess.PIPE,
227
close_fds=True, shell=True,
228
cwd="/")
229
self.checker_callback_tag = gobject.\
230
child_watch_add(self.checker.pid,
231
self.\
232
checker_callback)
337
logger.info(u"Starting checker %r for %s",
338
command, self.name)
339
self.checker = subprocess.Popen(command,
340
close_fds=True,
341
shell=True, cwd="/")
342
self.checker_callback_tag = gobject.child_watch_add\
343
(self.checker.pid,
344
self.checker_callback)
233
345
except subprocess.OSError, error:
234
346
logger.error(u"Failed to start subprocess: %s",
235
347
error)
237
349
return True
238
350
def stop_checker(self):
239
351
"""Force the checker process, if any, to stop."""
240
if not hasattr(self, "checker") or self.checker is None:
352
if self.checker_callback_tag:
353
gobject.source_remove(self.checker_callback_tag)
354
self.checker_callback_tag = None
355
if getattr(self, "checker", None) is None:
241
356
return
242
gobject.source_remove(self.checker_callback_tag)
243
self.checker_callback_tag = None
244
os.kill(self.checker.pid, signal.SIGTERM)
245
if self.checker.poll() is None:
246
os.kill(self.checker.pid, signal.SIGKILL)
357
logger.debug(u"Stopping checker for %(name)s", vars(self))
358
try:
359
os.kill(self.checker.pid, signal.SIGTERM)
360
#os.sleep(0.5)
361
#if self.checker.poll() is None:
362
# os.kill(self.checker.pid, signal.SIGKILL)
363
except OSError, error:
364
if error.errno != errno.ESRCH: # No such process
365
raise
247
366
self.checker = None
248
def still_valid(self, now=None):
367
def still_valid(self):
249
368
"""Has the timeout not yet passed for this client?"""
250
if now is None:
251
now = datetime.datetime.now()
252
if self.last_seen is None:
369
now = datetime.datetime.now()
370
if self.last_checked_ok is None:
253
371
return now < (self.created + self.timeout)
254
372
else:
255
return now < (self.last_seen + self.timeout)
373
return now < (self.last_checked_ok + self.timeout)
256
374
257
375
258
376
def peer_certificate(session):
377
"Return the peer's OpenPGP certificate as a bytestring"
259
378
# If not an OpenPGP certificate...
260
379
if gnutls.library.functions.gnutls_certificate_type_get\
261
380
(session._c_object) \
272
391
273
392
274
393
def fingerprint(openpgp):
275
# New empty GnuTLS certificate
276
crt = gnutls.library.types.gnutls_openpgp_crt_t()
277
gnutls.library.functions.gnutls_openpgp_crt_init\
278
(ctypes.byref(crt))
394
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
279
395
# New GnuTLS "datum" with the OpenPGP public key
280
396
datum = gnutls.library.types.gnutls_datum_t\
281
397
(ctypes.cast(ctypes.c_char_p(openpgp),
282
398
ctypes.POINTER(ctypes.c_ubyte)),
283
399
ctypes.c_uint(len(openpgp)))
400
# New empty GnuTLS certificate
401
crt = gnutls.library.types.gnutls_openpgp_crt_t()
402
gnutls.library.functions.gnutls_openpgp_crt_init\
403
(ctypes.byref(crt))
284
404
# Import the OpenPGP public key into the certificate
285
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
286
(crt,
287
ctypes.byref(datum),
288
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
405
gnutls.library.functions.gnutls_openpgp_crt_import\
406
(crt, ctypes.byref(datum),
407
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
289
408
# New buffer for the fingerprint
290
409
buffer = ctypes.create_string_buffer(20)
291
410
buffer_length = ctypes.c_size_t()
307
426
Note: This will run in its own forked process."""
308
427
309
428
def handle(self):
310
logger.debug(u"TCP connection from: %s",
429
logger.info(u"TCP connection from: %s",
311
430
unicode(self.client_address))
312
session = gnutls.connection.ClientSession(self.request,
313
gnutls.connection.\
314
X509Credentials())
431
session = gnutls.connection.ClientSession\
432
(self.request, gnutls.connection.X509Credentials())
433
434
line = self.request.makefile().readline()
435
logger.debug(u"Protocol version: %r", line)
436
try:
437
if int(line.strip().split()[0]) > 1:
438
raise RuntimeError
439
except (ValueError, IndexError, RuntimeError), error:
440
logger.error(u"Unknown protocol version: %s", error)
441
return
442
443
# Note: gnutls.connection.X509Credentials is really a generic
444
# GnuTLS certificate credentials object so long as no X.509
445
# keys are added to it. Therefore, we can use it here despite
446
# using OpenPGP certificates.
315
447
316
448
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
317
449
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
318
450
# "+DHE-DSS"))
319
priority = "SECURE256"
320
451
priority = "NORMAL" # Fallback default, since this
452
# MUST be set.
453
if self.server.settings["priority"]:
454
priority = self.server.settings["priority"]
321
455
gnutls.library.functions.gnutls_priority_set_direct\
322
456
(session._c_object, priority, None);
323
457
324
458
try:
325
459
session.handshake()
326
460
except gnutls.errors.GNUTLSError, error:
327
logger.debug(u"Handshake failed: %s", error)
461
logger.warning(u"Handshake failed: %s", error)
328
462
# Do not run session.bye() here: the session is not
329
463
# established. Just abandon the request.
330
464
return
331
465
try:
332
466
fpr = fingerprint(peer_certificate(session))
333
467
except (TypeError, gnutls.errors.GNUTLSError), error:
334
logger.debug(u"Bad certificate: %s", error)
468
logger.warning(u"Bad certificate: %s", error)
335
469
session.bye()
336
470
return
337
471
logger.debug(u"Fingerprint: %s", fpr)
338
472
client = None
339
for c in clients:
473
for c in self.server.clients:
340
474
if c.fingerprint == fpr:
341
475
client = c
342
476
break
477
if not client:
478
logger.warning(u"Client not found for fingerprint: %s",
479
fpr)
480
session.bye()
481
return
343
482
# Have to check if client.still_valid(), since it is possible
344
483
# that the client timed out while establishing the GnuTLS
345
484
# session.
346
if (not client) or (not client.still_valid()):
347
if client:
348
logger.debug(u"Client %(name)s is invalid",
349
vars(client))
350
else:
351
logger.debug(u"Client not found for fingerprint: %s",
352
fpr)
485
if not client.still_valid():
486
logger.warning(u"Client %(name)s is invalid",
487
vars(client))
353
488
session.bye()
354
489
return
355
490
sent_size = 0
365
500
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
366
501
"""IPv6 TCP server. Accepts 'None' as address and/or port.
367
502
Attributes:
368
options: Command line options
503
settings: Server settings
369
504
clients: Set() of Client objects
370
505
"""
371
506
address_family = socket.AF_INET6
372
507
def __init__(self, *args, **kwargs):
373
if "options" in kwargs:
374
self.options = kwargs["options"]
375
del kwargs["options"]
508
if "settings" in kwargs:
509
self.settings = kwargs["settings"]
510
del kwargs["settings"]
376
511
if "clients" in kwargs:
377
512
self.clients = kwargs["clients"]
378
513
del kwargs["clients"]
381
516
"""This overrides the normal server_bind() function
382
517
to bind to an interface if one was specified, and also NOT to
383
518
bind to an address or port if they were not specified."""
384
if self.options.interface:
385
if not hasattr(socket, "SO_BINDTODEVICE"):
386
# From /usr/include/asm-i486/socket.h
387
socket.SO_BINDTODEVICE = 25
519
if self.settings["interface"]:
520
# 25 is from /usr/include/asm-i486/socket.h
521
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
388
522
try:
389
523
self.socket.setsockopt(socket.SOL_SOCKET,
390
socket.SO_BINDTODEVICE,
391
self.options.interface)
524
SO_BINDTODEVICE,
525
self.settings["interface"])
392
526
except socket.error, error:
393
527
if error[0] == errno.EPERM:
394
logger.warning(u"No permission to"
395
u" bind to interface %s",
396
self.options.interface)
528
logger.error(u"No permission to"
529
u" bind to interface %s",
530
self.settings["interface"])
397
531
else:
398
532
raise error
399
533
# Only bind(2) the socket if we really need to.
402
536
in6addr_any = "::"
403
537
self.server_address = (in6addr_any,
404
538
self.server_address[1])
405
elif self.server_address[1] is None:
539
elif not self.server_address[1]:
406
540
self.server_address = (self.server_address[0],
407
541
0)
542
# if self.settings["interface"]:
543
# self.server_address = (self.server_address[0],
544
# 0, # port
545
# 0, # flowinfo
546
# if_nametoindex
547
# (self.settings
548
# ["interface"]))
408
549
return super(type(self), self).server_bind()
409
550
410
551
442
583
return delta
443
584
444
585
445
def add_service():
446
"""From the Avahi server example code"""
447
global group, serviceName, serviceType, servicePort, serviceTXT, \
448
domain, host
449
if group is None:
450
group = dbus.Interface(
451
bus.get_object( avahi.DBUS_NAME,
452
server.EntryGroupNew()),
453
avahi.DBUS_INTERFACE_ENTRY_GROUP)
454
group.connect_to_signal('StateChanged',
455
entry_group_state_changed)
456
logger.debug(u"Adding service '%s' of type '%s' ...",
457
serviceName, serviceType)
458
459
group.AddService(
460
serviceInterface, # interface
461
avahi.PROTO_INET6, # protocol
462
dbus.UInt32(0), # flags
463
serviceName, serviceType,
464
domain, host,
465
dbus.UInt16(servicePort),
466
avahi.string_array_to_txt_array(serviceTXT))
467
group.Commit()
468
469
470
def remove_service():
471
"""From the Avahi server example code"""
472
global group
473
474
if not group is None:
475
group.Reset()
476
477
478
586
def server_state_changed(state):
479
"""From the Avahi server example code"""
587
"""Derived from the Avahi example code"""
480
588
if state == avahi.SERVER_COLLISION:
481
logger.warning(u"Server name collision")
482
remove_service()
589
logger.error(u"Server name collision")
590
service.remove()
483
591
elif state == avahi.SERVER_RUNNING:
484
add_service()
592
service.add()
485
593
486
594
487
595
def entry_group_state_changed(state, error):
488
"""From the Avahi server example code"""
489
global serviceName, server, rename_count
490
596
"""Derived from the Avahi example code"""
491
597
logger.debug(u"state change: %i", state)
492
598
493
599
if state == avahi.ENTRY_GROUP_ESTABLISHED:
494
600
logger.debug(u"Service established.")
495
601
elif state == avahi.ENTRY_GROUP_COLLISION:
496
497
rename_count = rename_count - 1
498
if rename_count > 0:
499
name = server.GetAlternativeServiceName(name)
500
logger.warning(u"Service name collision, "
501
u"changing name to '%s' ...", name)
502
remove_service()
503
add_service()
504
505
else:
506
logger.error(u"No suitable service name found "
507
u"after %i retries, exiting.",
508
n_rename)
509
main_loop.quit()
602
logger.warning(u"Service name collision.")
603
service.rename()
510
604
elif state == avahi.ENTRY_GROUP_FAILURE:
511
logger.error(u"Error in group state changed %s",
512
unicode(error))
513
main_loop.quit()
514
return
515
605
logger.critical(u"Error in group state changed %s",
606
unicode(error))
607
raise AvahiGroupError("State changed: %s", str(error))
516
608
517
609
def if_nametoindex(interface):
518
"""Call the C function if_nametoindex()"""
610
"""Call the C function if_nametoindex(), or equivalent"""
611
global if_nametoindex
519
612
try:
520
libc = ctypes.cdll.LoadLibrary("libc.so.6")
521
return libc.if_nametoindex(interface)
613
if "ctypes.util" not in sys.modules:
614
import ctypes.util
615
if_nametoindex = ctypes.cdll.LoadLibrary\
616
(ctypes.util.find_library("c")).if_nametoindex
522
617
except (OSError, AttributeError):
523
618
if "struct" not in sys.modules:
524
619
import struct
525
620
if "fcntl" not in sys.modules:
526
621
import fcntl
527
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
528
s = socket.socket()
529
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
530
struct.pack("16s16x", interface))
531
s.close()
532
interface_index = struct.unpack("I", ifreq[16:20])[0]
533
return interface_index
534
535
536
if __name__ == '__main__':
537
parser = OptionParser()
622
def if_nametoindex(interface):
623
"Get an interface index the hard way, i.e. using fcntl()"
624
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
625
s = socket.socket()
626
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
627
struct.pack("16s16x", interface))
628
s.close()
629
interface_index = struct.unpack("I", ifreq[16:20])[0]
630
return interface_index
631
return if_nametoindex(interface)
632
633
634
def daemon(nochdir = False, noclose = False):
635
"""See daemon(3). Standard BSD Unix function.
636
This should really exist as os.daemon, but it doesn't (yet)."""
637
if os.fork():
638
sys.exit()
639
os.setsid()
640
if not nochdir:
641
os.chdir("/")
642
if os.fork():
643
sys.exit()
644
if not noclose:
645
# Close all standard open file descriptors
646
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
647
if not stat.S_ISCHR(os.fstat(null).st_mode):
648
raise OSError(errno.ENODEV,
649
"/dev/null not a character device")
650
os.dup2(null, sys.stdin.fileno())
651
os.dup2(null, sys.stdout.fileno())
652
os.dup2(null, sys.stderr.fileno())
653
if null > 2:
654
os.close(null)
655
656
657
def main():
658
global main_loop_started
659
main_loop_started = False
660
661
parser = OptionParser(version = "%%prog %s" % version)
538
662
parser.add_option("-i", "--interface", type="string",
539
default=None, metavar="IF",
540
help="Bind to interface IF")
541
parser.add_option("--cert", type="string", default="cert.pem",
542
metavar="FILE",
543
help="Public key certificate PEM file to use")
544
parser.add_option("--key", type="string", default="key.pem",
545
metavar="FILE",
546
help="Private key PEM file to use")
547
parser.add_option("--ca", type="string", default="ca.pem",
548
metavar="FILE",
549
help="Certificate Authority certificate PEM file to use")
550
parser.add_option("--crl", type="string", default="crl.pem",
551
metavar="FILE",
552
help="Certificate Revokation List PEM file to use")
553
parser.add_option("-p", "--port", type="int", default=None,
663
metavar="IF", help="Bind to interface IF")
664
parser.add_option("-a", "--address", type="string",
665
help="Address to listen for requests on")
666
parser.add_option("-p", "--port", type="int",
554
667
help="Port number to receive requests on")
555
parser.add_option("--timeout", type="string", # Parsed later
556
default="1h",
557
help="Amount of downtime allowed for clients")
558
parser.add_option("--interval", type="string", # Parsed later
559
default="5m",
560
help="How often to check that a client is up")
561
668
parser.add_option("--check", action="store_true", default=False,
562
669
help="Run self-test")
563
parser.add_option("--debug", action="store_true", default=False,
564
help="Debug mode")
670
parser.add_option("--debug", action="store_true",
671
help="Debug mode; run in foreground and log to"
672
" terminal")
673
parser.add_option("--priority", type="string", help="GnuTLS"
674
" priority string (see GnuTLS documentation)")
675
parser.add_option("--servicename", type="string", metavar="NAME",
676
help="Zeroconf service name")
677
parser.add_option("--configdir", type="string",
678
default="/etc/mandos", metavar="DIR",
679
help="Directory to search for configuration"
680
" files")
565
681
(options, args) = parser.parse_args()
566
682
567
683
if options.check:
569
685
doctest.testmod()
570
686
sys.exit()
571
687
572
# Parse the time arguments
573
try:
574
options.timeout = string_to_delta(options.timeout)
575
except ValueError:
576
parser.error("option --timeout: Unparseable time")
577
try:
578
options.interval = string_to_delta(options.interval)
579
except ValueError:
580
parser.error("option --interval: Unparseable time")
581
582
# Parse config file
583
defaults = { "checker": "sleep 1; fping -q -- %%(fqdn)s" }
584
client_config = ConfigParser.SafeConfigParser(defaults)
585
#client_config.readfp(open("secrets.conf"), "secrets.conf")
586
client_config.read("mandos-clients.conf")
587
588
# From the Avahi server example code
688
# Default values for config file for server-global settings
689
server_defaults = { "interface": "",
690
"address": "",
691
"port": "",
692
"debug": "False",
693
"priority":
694
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
695
"servicename": "Mandos",
696
}
697
698
# Parse config file for server-global settings
699
server_config = ConfigParser.SafeConfigParser(server_defaults)
700
del server_defaults
701
server_config.read(os.path.join(options.configdir, "mandos.conf"))
702
server_section = "server"
703
# Convert the SafeConfigParser object to a dict
704
server_settings = dict(server_config.items(server_section))
705
# Use getboolean on the boolean config option
706
server_settings["debug"] = server_config.getboolean\
707
(server_section, "debug")
708
del server_config
709
710
# Override the settings from the config file with command line
711
# options, if set.
712
for option in ("interface", "address", "port", "debug",
713
"priority", "servicename", "configdir"):
714
value = getattr(options, option)
715
if value is not None:
716
server_settings[option] = value
717
del options
718
# Now we have our good server settings in "server_settings"
719
720
debug = server_settings["debug"]
721
722
if not debug:
723
syslogger.setLevel(logging.WARNING)
724
console.setLevel(logging.WARNING)
725
726
if server_settings["servicename"] != "Mandos":
727
syslogger.setFormatter(logging.Formatter\
728
('Mandos (%s): %%(levelname)s:'
729
' %%(message)s'
730
% server_settings["servicename"]))
731
732
# Parse config file with clients
733
client_defaults = { "timeout": "1h",
734
"interval": "5m",
735
"checker": "fping -q -- %%(host)s",
736
}
737
client_config = ConfigParser.SafeConfigParser(client_defaults)
738
client_config.read(os.path.join(server_settings["configdir"],
739
"clients.conf"))
740
741
global service
742
service = AvahiService(name = server_settings["servicename"],
743
type = "_mandos._tcp", );
744
if server_settings["interface"]:
745
service.interface = if_nametoindex(server_settings["interface"])
746
747
global main_loop
748
global bus
749
global server
750
# From the Avahi example code
589
751
DBusGMainLoop(set_as_default=True )
590
752
main_loop = gobject.MainLoop()
591
753
bus = dbus.SystemBus()
594
756
avahi.DBUS_INTERFACE_SERVER )
595
757
# End of Avahi example code
596
758
597
debug = options.debug
598
599
759
clients = Set()
600
760
def remove_from_clients(client):
601
761
clients.remove(client)
602
762
if not clients:
603
logger.debug(u"No clients left, exiting")
604
main_loop.quit()
763
logger.critical(u"No clients left, exiting")
764
sys.exit()
605
765
606
clients.update(Set(Client(name=section, options=options,
766
clients.update(Set(Client(name = section,
607
767
stop_hook = remove_from_clients,
608
**(dict(client_config\
609
.items(section))))
768
config
769
= dict(client_config.items(section)))
610
770
for section in client_config.sections()))
771
if not clients:
772
logger.critical(u"No clients defined")
773
sys.exit(1)
774
775
if not debug:
776
logger.removeHandler(console)
777
daemon()
778
779
pidfilename = "/var/run/mandos/mandos.pid"
780
pid = os.getpid()
781
try:
782
pidfile = open(pidfilename, "w")
783
pidfile.write(str(pid) + "\n")
784
pidfile.close()
785
del pidfile
786
except IOError, err:
787
logger.error(u"Could not write %s file with PID %d",
788
pidfilename, os.getpid())
789
790
def cleanup():
791
"Cleanup function; run on exit"
792
global group
793
# From the Avahi example code
794
if not group is None:
795
group.Free()
796
group = None
797
# End of Avahi example code
798
799
while clients:
800
client = clients.pop()
801
client.stop_hook = None
802
client.stop()
803
804
atexit.register(cleanup)
805
806
if not debug:
807
signal.signal(signal.SIGINT, signal.SIG_IGN)
808
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
809
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
810
611
811
for client in clients:
612
812
client.start()
613
813
614
tcp_server = IPv6_TCPServer((None, options.port),
814
tcp_server = IPv6_TCPServer((server_settings["address"],
815
server_settings["port"]),
615
816
tcp_handler,
616
options=options,
817
settings=server_settings,
617
818
clients=clients)
618
# Find out what random port we got
619
servicePort = tcp_server.socket.getsockname()[1]
620
logger.debug(u"Now listening on port %d", servicePort)
621
622
if options.interface is not None:
623
serviceInterface = if_nametoindex(options.interface)
624
625
# From the Avahi server example code
626
server.connect_to_signal("StateChanged", server_state_changed)
627
server_state_changed(server.GetState())
628
# End of Avahi example code
629
630
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
631
lambda *args, **kwargs:
632
tcp_server.handle_request(*args[2:],
633
**kwargs) or True)
819
# Find out what port we got
820
service.port = tcp_server.socket.getsockname()[1]
821
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
822
u" scope_id %d" % tcp_server.socket.getsockname())
823
824
#service.interface = tcp_server.socket.getsockname()[3]
825
634
826
try:
827
# From the Avahi example code
828
server.connect_to_signal("StateChanged", server_state_changed)
829
try:
830
server_state_changed(server.GetState())
831
except dbus.exceptions.DBusException, error:
832
logger.critical(u"DBusException: %s", error)
833
sys.exit(1)
834
# End of Avahi example code
835
836
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
837
lambda *args, **kwargs:
838
tcp_server.handle_request\
839
(*args[2:], **kwargs) or True)
840
841
logger.debug(u"Starting main loop")
842
main_loop_started = True
635
843
main_loop.run()
844
except AvahiError, error:
845
logger.critical(u"AvahiError: %s" + unicode(error))
846
sys.exit(1)
636
847
except KeyboardInterrupt:
637
print
638
639
# Cleanup here
848
if debug:
849
print
640
850
641
# From the Avahi server example code
642
if not group is None:
643
group.Free()
644
# End of Avahi example code
645
646
for client in clients:
647
client.stop_hook = None
648
client.stop()
851
if __name__ == '__main__':
852
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0