To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 24
- compare with another revision
- download diff
- download tarball
- view history from revision 24
- Committer: Teddy Hogeborn
- Date: 2008-07-22 01:59:47 UTC
- Revision ID: teddy@fukt.bsnet.se-20080722015947-y7o6keji020nvrhw
* Makefile (OPTIMIZE): New; optimize for size.
(CFLAGS): Use $(OPTIMIZE).
(CFLAGS): Use $(OPTIMIZE).
- files added:
- ca.pem
- files removed:
- initramfs-tools-hook
- files renamed:
- clients.conf => mandos-clients.conf
- plugin-runner.c => plugbasedclient.c
- plugins.d/password-request.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos => server.py
- files modified:
- Makefile
added
removed
server.py
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
9
# following functions: "add_service", "remove_service",
10
# "server_state_changed", "entry_group_state_changed", and some lines
11
# in "main".
12
12
#
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
13
# Everything else is Copyright © 2007-2008 Teddy Hogeborn and Björn
14
# Påhlsson.
15
15
#
16
16
# This program is free software: you can redistribute it and/or modify
17
17
# it under the terms of the GNU General Public License as published by
26
26
# You should have received a copy of the GNU General Public License
27
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
28
28
#
29
# Contact the authors at <mandos@fukt.bsnet.se>.
29
# Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
30
# <https://www.fukt.bsnet.se/~teddy/>.
30
31
#
31
32
32
33
from __future__ import division
61
62
from dbus.mainloop.glib import DBusGMainLoop
62
63
import ctypes
63
64
64
version = "1.0"
65
# Brief description of the operation of this program:
66
#
67
# This server announces itself as a Zeroconf service. Connecting
68
# clients use the TLS protocol, with the unusual quirk that this
69
# server program acts as a TLS "client" while the connecting clients
70
# acts as a TLS "server". The clients (acting as a TLS "server") must
71
# supply an OpenPGP certificate, and the fingerprint of this
72
# certificate is used by this server to look up (in a list read from a
73
# file at start time) which binary blob to give the client. No other
74
# authentication or authorization is done by this server.
75
65
76
66
77
logger = logging.Logger('mandos')
67
78
syslogger = logging.handlers.SysLogHandler\
68
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
69
address = "/dev/log")
79
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
70
80
syslogger.setFormatter(logging.Formatter\
71
('Mandos: %(levelname)s: %(message)s'))
81
('%(levelname)s: %(message)s'))
72
82
logger.addHandler(syslogger)
73
74
console = logging.StreamHandler()
75
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
76
' %(message)s'))
77
logger.addHandler(console)
78
79
class AvahiError(Exception):
80
def __init__(self, value):
81
self.value = value
82
def __str__(self):
83
return repr(self.value)
84
85
class AvahiServiceError(AvahiError):
86
pass
87
88
class AvahiGroupError(AvahiError):
89
pass
90
91
92
class AvahiService(object):
93
"""An Avahi (Zeroconf) service.
94
Attributes:
95
interface: integer; avahi.IF_UNSPEC or an interface index.
96
Used to optionally bind to the specified interface.
97
name: string; Example: 'Mandos'
98
type: string; Example: '_mandos._tcp'.
99
See <http://www.dns-sd.org/ServiceTypes.html>
100
port: integer; what port to announce
101
TXT: list of strings; TXT record for the service
102
domain: string; Domain to publish on, default to .local if empty.
103
host: string; Host to publish records for, default is localhost
104
max_renames: integer; maximum number of renames
105
rename_count: integer; counter so we only rename after collisions
106
a sensible number of times
107
"""
108
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
109
type = None, port = None, TXT = None, domain = "",
110
host = "", max_renames = 32768):
111
self.interface = interface
112
self.name = name
113
self.type = type
114
self.port = port
115
if TXT is None:
116
self.TXT = []
117
else:
118
self.TXT = TXT
119
self.domain = domain
120
self.host = host
121
self.rename_count = 0
122
def rename(self):
123
"""Derived from the Avahi example code"""
124
if self.rename_count >= self.max_renames:
125
logger.critical(u"No suitable service name found after %i"
126
u" retries, exiting.", rename_count)
127
raise AvahiServiceError("Too many renames")
128
name = server.GetAlternativeServiceName(name)
129
logger.error(u"Changing name to %r ...", name)
130
syslogger.setFormatter(logging.Formatter\
131
('Mandos (%s): %%(levelname)s:'
132
' %%(message)s' % name))
133
self.remove()
134
self.add()
135
self.rename_count += 1
136
def remove(self):
137
"""Derived from the Avahi example code"""
138
if group is not None:
139
group.Reset()
140
def add(self):
141
"""Derived from the Avahi example code"""
142
global group
143
if group is None:
144
group = dbus.Interface\
145
(bus.get_object(avahi.DBUS_NAME,
146
server.EntryGroupNew()),
147
avahi.DBUS_INTERFACE_ENTRY_GROUP)
148
group.connect_to_signal('StateChanged',
149
entry_group_state_changed)
150
logger.debug(u"Adding service '%s' of type '%s' ...",
151
service.name, service.type)
152
group.AddService(
153
self.interface, # interface
154
avahi.PROTO_INET6, # protocol
155
dbus.UInt32(0), # flags
156
self.name, self.type,
157
self.domain, self.host,
158
dbus.UInt16(self.port),
159
avahi.string_array_to_txt_array(self.TXT))
160
group.Commit()
161
83
del syslogger
84
85
# This variable is used to optionally bind to a specified interface.
86
# It is a global variable to fit in with the other variables from the
87
# Avahi example code.
88
serviceInterface = avahi.IF_UNSPEC
162
89
# From the Avahi example code:
163
group = None # our entry group
90
serviceName = "Mandos"
91
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
92
servicePort = None # Not known at startup
93
serviceTXT = [] # TXT record for the service
94
domain = "" # Domain to publish on, default to .local
95
host = "" # Host to publish records for, default to localhost
96
group = None #our entry group
97
rename_count = 12 # Counter so we only rename after collisions a
98
# sensible number of times
164
99
# End of Avahi example code
165
100
166
101
171
106
fingerprint: string (40 or 32 hexadecimal digits); used to
172
107
uniquely identify the client
173
108
secret: bytestring; sent verbatim (over TLS) to client
174
host: string; available for use by the checker command
175
created: datetime.datetime(); object creation, not client host
176
last_checked_ok: datetime.datetime() or None if not yet checked OK
177
timeout: datetime.timedelta(); How long from last_checked_ok
178
until this client is invalid
109
fqdn: string (FQDN); available for use by the checker command
110
created: datetime.datetime()
111
last_seen: datetime.datetime() or None if not yet seen
112
timeout: datetime.timedelta(); How long from last_seen until
113
this client is invalid
179
114
interval: datetime.timedelta(); How often to start a new checker
180
115
stop_hook: If set, called by stop() as stop_hook(self)
181
116
checker: subprocess.Popen(); a running checker process used
182
117
to see if the client lives.
183
'None' if no process is running.
118
Is None if no process is running.
184
119
checker_initiator_tag: a gobject event source tag, or None
185
120
stop_initiator_tag: - '' -
186
121
checker_callback_tag: - '' -
187
122
checker_command: string; External command which is run to check if
188
client lives. %() expansions are done at
123
client lives. %()s expansions are done at
189
124
runtime with vars(self) as dict, so that for
190
125
instance %(name)s can be used in the command.
191
126
Private attibutes:
192
127
_timeout: Real variable for 'timeout'
193
128
_interval: Real variable for 'interval'
194
_timeout_milliseconds: Used when calling gobject.timeout_add()
129
_timeout_milliseconds: Used by gobject.timeout_add()
195
130
_interval_milliseconds: - '' -
196
131
"""
197
132
def _set_timeout(self, timeout):
217
152
interval = property(lambda self: self._interval,
218
153
_set_interval)
219
154
del _set_interval
220
def __init__(self, name = None, stop_hook=None, config={}):
221
"""Note: the 'checker' key in 'config' sets the
222
'checker_command' attribute and *not* the 'checker'
223
attribute."""
155
def __init__(self, name=None, options=None, stop_hook=None,
156
fingerprint=None, secret=None, secfile=None,
157
fqdn=None, timeout=None, interval=-1, checker=None):
158
"""Note: the 'checker' argument sets the 'checker_command'
159
attribute and not the 'checker' attribute.."""
224
160
self.name = name
225
logger.debug(u"Creating client %r", self.name)
226
# Uppercase and remove spaces from fingerprint for later
227
# comparison purposes with return value from the fingerprint()
228
# function
229
self.fingerprint = config["fingerprint"].upper()\
230
.replace(u" ", u"")
231
logger.debug(u" Fingerprint: %s", self.fingerprint)
232
if "secret" in config:
233
self.secret = config["secret"].decode(u"base64")
234
elif "secfile" in config:
235
sf = open(config["secfile"])
161
# Uppercase and remove spaces from fingerprint
162
# for later comparison purposes with return value of
163
# the fingerprint() function
164
self.fingerprint = fingerprint.upper().replace(u" ", u"")
165
if secret:
166
self.secret = secret.decode(u"base64")
167
elif secfile:
168
sf = open(secfile)
236
169
self.secret = sf.read()
237
170
sf.close()
238
171
else:
239
raise TypeError(u"No secret or secfile for client %s"
240
% self.name)
241
self.host = config.get("host", "")
172
raise RuntimeError(u"No secret or secfile for client %s"
173
% self.name)
174
self.fqdn = fqdn # string
242
175
self.created = datetime.datetime.now()
243
self.last_checked_ok = None
244
self.timeout = string_to_delta(config["timeout"])
245
self.interval = string_to_delta(config["interval"])
176
self.last_seen = None
177
if timeout is None:
178
self.timeout = options.timeout
179
else:
180
self.timeout = string_to_delta(timeout)
181
if interval == -1:
182
self.interval = options.interval
183
else:
184
self.interval = string_to_delta(interval)
246
185
self.stop_hook = stop_hook
247
186
self.checker = None
248
187
self.checker_initiator_tag = None
249
188
self.stop_initiator_tag = None
250
189
self.checker_callback_tag = None
251
self.check_command = config["checker"]
190
self.check_command = checker
252
191
def start(self):
253
192
"""Start this client's checker and timeout hooks"""
254
193
# Schedule a new checker to be started an 'interval' from now,
264
203
self.stop)
265
204
def stop(self):
266
205
"""Stop this client.
267
The possibility that a client might be restarted is left open,
268
but not currently used."""
206
The possibility that this client might be restarted is left
207
open, but not currently used."""
269
208
# If this client doesn't have a secret, it is already stopped.
270
if hasattr(self, "secret") and self.secret:
271
logger.info(u"Stopping client %s", self.name)
209
if self.secret:
210
logger.debug(u"Stopping client %s", self.name)
272
211
self.secret = None
273
212
else:
274
213
return False
275
if getattr(self, "stop_initiator_tag", False):
214
if hasattr(self, "stop_initiator_tag") \
215
and self.stop_initiator_tag:
276
216
gobject.source_remove(self.stop_initiator_tag)
277
217
self.stop_initiator_tag = None
278
if getattr(self, "checker_initiator_tag", False):
218
if hasattr(self, "checker_initiator_tag") \
219
and self.checker_initiator_tag:
279
220
gobject.source_remove(self.checker_initiator_tag)
280
221
self.checker_initiator_tag = None
281
222
self.stop_checker()
293
234
self.checker = None
294
235
if os.WIFEXITED(condition) \
295
236
and (os.WEXITSTATUS(condition) == 0):
296
logger.info(u"Checker for %(name)s succeeded",
297
vars(self))
298
self.last_checked_ok = now
237
logger.debug(u"Checker for %(name)s succeeded",
238
vars(self))
239
self.last_seen = now
299
240
gobject.source_remove(self.stop_initiator_tag)
300
241
self.stop_initiator_tag = gobject.timeout_add\
301
242
(self._timeout_milliseconds,
304
245
logger.warning(u"Checker for %(name)s crashed?",
305
246
vars(self))
306
247
else:
307
logger.info(u"Checker for %(name)s failed",
308
vars(self))
248
logger.debug(u"Checker for %(name)s failed",
249
vars(self))
309
250
def start_checker(self):
310
251
"""Start a new checker subprocess if one is not running.
311
252
If a checker already exists, leave it running and do
320
261
# is as it should be.
321
262
if self.checker is None:
322
263
try:
323
# In case check_command has exactly one % operator
324
command = self.check_command % self.host
264
command = self.check_command % self.fqdn
325
265
except TypeError:
326
# Escape attributes for the shell
327
266
escaped_attrs = dict((key, re.escape(str(val)))
328
267
for key, val in
329
268
vars(self).iteritems())
330
269
try:
331
270
command = self.check_command % escaped_attrs
332
271
except TypeError, error:
333
logger.error(u'Could not format string "%s":'
334
u' %s', self.check_command, error)
272
logger.critical(u'Could not format string "%s":'
273
u' %s', self.check_command, error)
335
274
return True # Try again later
336
275
try:
337
logger.info(u"Starting checker %r for %s",
338
command, self.name)
339
self.checker = subprocess.Popen(command,
340
close_fds=True,
341
shell=True, cwd="/")
276
logger.debug(u"Starting checker %r for %s",
277
command, self.name)
278
self.checker = subprocess.\
279
Popen(command,
280
close_fds=True, shell=True,
281
cwd="/")
342
282
self.checker_callback_tag = gobject.child_watch_add\
343
283
(self.checker.pid,
344
284
self.checker_callback)
352
292
if self.checker_callback_tag:
353
293
gobject.source_remove(self.checker_callback_tag)
354
294
self.checker_callback_tag = None
355
if getattr(self, "checker", None) is None:
295
if not hasattr(self, "checker") or self.checker is None:
356
296
return
357
logger.debug(u"Stopping checker for %(name)s", vars(self))
297
logger.debug("Stopping checker for %(name)s", vars(self))
358
298
try:
359
299
os.kill(self.checker.pid, signal.SIGTERM)
360
300
#os.sleep(0.5)
361
301
#if self.checker.poll() is None:
362
302
# os.kill(self.checker.pid, signal.SIGKILL)
363
303
except OSError, error:
364
if error.errno != errno.ESRCH: # No such process
304
if error.errno != errno.ESRCH:
365
305
raise
366
306
self.checker = None
367
def still_valid(self):
307
def still_valid(self, now=None):
368
308
"""Has the timeout not yet passed for this client?"""
369
now = datetime.datetime.now()
370
if self.last_checked_ok is None:
309
if now is None:
310
now = datetime.datetime.now()
311
if self.last_seen is None:
371
312
return now < (self.created + self.timeout)
372
313
else:
373
return now < (self.last_checked_ok + self.timeout)
314
return now < (self.last_seen + self.timeout)
374
315
375
316
376
317
def peer_certificate(session):
392
333
393
334
def fingerprint(openpgp):
394
335
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
336
# New empty GnuTLS certificate
337
crt = gnutls.library.types.gnutls_openpgp_crt_t()
338
gnutls.library.functions.gnutls_openpgp_crt_init\
339
(ctypes.byref(crt))
395
340
# New GnuTLS "datum" with the OpenPGP public key
396
341
datum = gnutls.library.types.gnutls_datum_t\
397
342
(ctypes.cast(ctypes.c_char_p(openpgp),
398
343
ctypes.POINTER(ctypes.c_ubyte)),
399
344
ctypes.c_uint(len(openpgp)))
400
# New empty GnuTLS certificate
401
crt = gnutls.library.types.gnutls_openpgp_crt_t()
402
gnutls.library.functions.gnutls_openpgp_crt_init\
403
(ctypes.byref(crt))
404
345
# Import the OpenPGP public key into the certificate
405
gnutls.library.functions.gnutls_openpgp_crt_import\
406
(crt, ctypes.byref(datum),
407
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
346
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
347
(crt,
348
ctypes.byref(datum),
349
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
408
350
# New buffer for the fingerprint
409
351
buffer = ctypes.create_string_buffer(20)
410
352
buffer_length = ctypes.c_size_t()
426
368
Note: This will run in its own forked process."""
427
369
428
370
def handle(self):
429
logger.info(u"TCP connection from: %s",
371
logger.debug(u"TCP connection from: %s",
430
372
unicode(self.client_address))
431
session = gnutls.connection.ClientSession\
432
(self.request, gnutls.connection.X509Credentials())
433
434
line = self.request.makefile().readline()
435
logger.debug(u"Protocol version: %r", line)
436
try:
437
if int(line.strip().split()[0]) > 1:
438
raise RuntimeError
439
except (ValueError, IndexError, RuntimeError), error:
440
logger.error(u"Unknown protocol version: %s", error)
441
return
442
443
# Note: gnutls.connection.X509Credentials is really a generic
444
# GnuTLS certificate credentials object so long as no X.509
445
# keys are added to it. Therefore, we can use it here despite
446
# using OpenPGP certificates.
373
session = gnutls.connection.ClientSession(self.request,
374
gnutls.connection.\
375
X509Credentials())
447
376
448
377
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
449
378
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
450
379
# "+DHE-DSS"))
451
priority = "NORMAL" # Fallback default, since this
452
# MUST be set.
453
if self.server.settings["priority"]:
454
priority = self.server.settings["priority"]
380
priority = "SECURE256"
381
455
382
gnutls.library.functions.gnutls_priority_set_direct\
456
383
(session._c_object, priority, None);
457
384
458
385
try:
459
386
session.handshake()
460
387
except gnutls.errors.GNUTLSError, error:
461
logger.warning(u"Handshake failed: %s", error)
388
logger.debug(u"Handshake failed: %s", error)
462
389
# Do not run session.bye() here: the session is not
463
390
# established. Just abandon the request.
464
391
return
465
392
try:
466
393
fpr = fingerprint(peer_certificate(session))
467
394
except (TypeError, gnutls.errors.GNUTLSError), error:
468
logger.warning(u"Bad certificate: %s", error)
395
logger.debug(u"Bad certificate: %s", error)
469
396
session.bye()
470
397
return
471
398
logger.debug(u"Fingerprint: %s", fpr)
474
401
if c.fingerprint == fpr:
475
402
client = c
476
403
break
477
if not client:
478
logger.warning(u"Client not found for fingerprint: %s",
479
fpr)
480
session.bye()
481
return
482
404
# Have to check if client.still_valid(), since it is possible
483
405
# that the client timed out while establishing the GnuTLS
484
406
# session.
485
if not client.still_valid():
486
logger.warning(u"Client %(name)s is invalid",
487
vars(client))
407
if (not client) or (not client.still_valid()):
408
if client:
409
logger.debug(u"Client %(name)s is invalid",
410
vars(client))
411
else:
412
logger.debug(u"Client not found for fingerprint: %s",
413
fpr)
488
414
session.bye()
489
415
return
490
416
sent_size = 0
500
426
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
501
427
"""IPv6 TCP server. Accepts 'None' as address and/or port.
502
428
Attributes:
503
settings: Server settings
429
options: Command line options
504
430
clients: Set() of Client objects
505
431
"""
506
432
address_family = socket.AF_INET6
507
433
def __init__(self, *args, **kwargs):
508
if "settings" in kwargs:
509
self.settings = kwargs["settings"]
510
del kwargs["settings"]
434
if "options" in kwargs:
435
self.options = kwargs["options"]
436
del kwargs["options"]
511
437
if "clients" in kwargs:
512
438
self.clients = kwargs["clients"]
513
439
del kwargs["clients"]
516
442
"""This overrides the normal server_bind() function
517
443
to bind to an interface if one was specified, and also NOT to
518
444
bind to an address or port if they were not specified."""
519
if self.settings["interface"]:
520
# 25 is from /usr/include/asm-i486/socket.h
521
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
445
if self.options.interface:
446
if not hasattr(socket, "SO_BINDTODEVICE"):
447
# From /usr/include/asm-i486/socket.h
448
socket.SO_BINDTODEVICE = 25
522
449
try:
523
450
self.socket.setsockopt(socket.SOL_SOCKET,
524
SO_BINDTODEVICE,
525
self.settings["interface"])
451
socket.SO_BINDTODEVICE,
452
self.options.interface)
526
453
except socket.error, error:
527
454
if error[0] == errno.EPERM:
528
logger.error(u"No permission to"
529
u" bind to interface %s",
530
self.settings["interface"])
455
logger.warning(u"No permission to"
456
u" bind to interface %s",
457
self.options.interface)
531
458
else:
532
459
raise error
533
460
# Only bind(2) the socket if we really need to.
536
463
in6addr_any = "::"
537
464
self.server_address = (in6addr_any,
538
465
self.server_address[1])
539
elif not self.server_address[1]:
466
elif self.server_address[1] is None:
540
467
self.server_address = (self.server_address[0],
541
468
0)
542
# if self.settings["interface"]:
543
# self.server_address = (self.server_address[0],
544
# 0, # port
545
# 0, # flowinfo
546
# if_nametoindex
547
# (self.settings
548
# ["interface"]))
549
469
return super(type(self), self).server_bind()
550
470
551
471
583
503
return delta
584
504
585
505
506
def add_service():
507
"""Derived from the Avahi example code"""
508
global group, serviceName, serviceType, servicePort, serviceTXT, \
509
domain, host
510
if group is None:
511
group = dbus.Interface(
512
bus.get_object( avahi.DBUS_NAME,
513
server.EntryGroupNew()),
514
avahi.DBUS_INTERFACE_ENTRY_GROUP)
515
group.connect_to_signal('StateChanged',
516
entry_group_state_changed)
517
logger.debug(u"Adding service '%s' of type '%s' ...",
518
serviceName, serviceType)
519
520
group.AddService(
521
serviceInterface, # interface
522
avahi.PROTO_INET6, # protocol
523
dbus.UInt32(0), # flags
524
serviceName, serviceType,
525
domain, host,
526
dbus.UInt16(servicePort),
527
avahi.string_array_to_txt_array(serviceTXT))
528
group.Commit()
529
530
531
def remove_service():
532
"""From the Avahi example code"""
533
global group
534
535
if not group is None:
536
group.Reset()
537
538
586
539
def server_state_changed(state):
587
540
"""Derived from the Avahi example code"""
588
541
if state == avahi.SERVER_COLLISION:
589
logger.error(u"Server name collision")
590
service.remove()
542
logger.warning(u"Server name collision")
543
remove_service()
591
544
elif state == avahi.SERVER_RUNNING:
592
service.add()
545
add_service()
593
546
594
547
595
548
def entry_group_state_changed(state, error):
596
549
"""Derived from the Avahi example code"""
550
global serviceName, server, rename_count
551
597
552
logger.debug(u"state change: %i", state)
598
553
599
554
if state == avahi.ENTRY_GROUP_ESTABLISHED:
600
555
logger.debug(u"Service established.")
601
556
elif state == avahi.ENTRY_GROUP_COLLISION:
602
logger.warning(u"Service name collision.")
603
service.rename()
557
558
rename_count = rename_count - 1
559
if rename_count > 0:
560
name = server.GetAlternativeServiceName(name)
561
logger.warning(u"Service name collision, "
562
u"changing name to '%s' ...", name)
563
remove_service()
564
add_service()
565
566
else:
567
logger.error(u"No suitable service name found after %i"
568
u" retries, exiting.", n_rename)
569
killme(1)
604
570
elif state == avahi.ENTRY_GROUP_FAILURE:
605
logger.critical(u"Error in group state changed %s",
606
unicode(error))
607
raise AvahiGroupError("State changed: %s", str(error))
571
logger.error(u"Error in group state changed %s",
572
unicode(error))
573
killme(1)
574
608
575
609
576
def if_nametoindex(interface):
610
"""Call the C function if_nametoindex(), or equivalent"""
611
global if_nametoindex
577
"""Call the C function if_nametoindex()"""
612
578
try:
613
if "ctypes.util" not in sys.modules:
614
import ctypes.util
615
if_nametoindex = ctypes.cdll.LoadLibrary\
616
(ctypes.util.find_library("c")).if_nametoindex
579
libc = ctypes.cdll.LoadLibrary("libc.so.6")
580
return libc.if_nametoindex(interface)
617
581
except (OSError, AttributeError):
618
582
if "struct" not in sys.modules:
619
583
import struct
620
584
if "fcntl" not in sys.modules:
621
585
import fcntl
622
def if_nametoindex(interface):
623
"Get an interface index the hard way, i.e. using fcntl()"
624
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
625
s = socket.socket()
626
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
627
struct.pack("16s16x", interface))
628
s.close()
629
interface_index = struct.unpack("I", ifreq[16:20])[0]
630
return interface_index
631
return if_nametoindex(interface)
632
633
634
def daemon(nochdir = False, noclose = False):
586
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
587
s = socket.socket()
588
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
589
struct.pack("16s16x", interface))
590
s.close()
591
interface_index = struct.unpack("I", ifreq[16:20])[0]
592
return interface_index
593
594
595
def daemon(nochdir, noclose):
635
596
"""See daemon(3). Standard BSD Unix function.
636
597
This should really exist as os.daemon, but it doesn't (yet)."""
637
598
if os.fork():
639
600
os.setsid()
640
601
if not nochdir:
641
602
os.chdir("/")
642
if os.fork():
643
sys.exit()
644
603
if not noclose:
645
604
# Close all standard open file descriptors
646
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
605
null = os.open("/dev/null", os.O_NOCTTY | os.O_RDWR)
647
606
if not stat.S_ISCHR(os.fstat(null).st_mode):
648
607
raise OSError(errno.ENODEV,
649
608
"/dev/null not a character device")
654
613
os.close(null)
655
614
656
615
616
def killme(status = 0):
617
logger.debug("Stopping server with exit status %d", status)
618
exitstatus = status
619
if main_loop_started:
620
main_loop.quit()
621
else:
622
sys.exit(status)
623
624
657
625
def main():
626
global exitstatus
627
exitstatus = 0
658
628
global main_loop_started
659
629
main_loop_started = False
660
630
661
parser = OptionParser(version = "%%prog %s" % version)
631
parser = OptionParser()
662
632
parser.add_option("-i", "--interface", type="string",
663
metavar="IF", help="Bind to interface IF")
664
parser.add_option("-a", "--address", type="string",
633
default=None, metavar="IF",
634
help="Bind to interface IF")
635
parser.add_option("-a", "--address", type="string", default=None,
665
636
help="Address to listen for requests on")
666
parser.add_option("-p", "--port", type="int",
637
parser.add_option("-p", "--port", type="int", default=None,
667
638
help="Port number to receive requests on")
639
parser.add_option("--timeout", type="string", # Parsed later
640
default="1h",
641
help="Amount of downtime allowed for clients")
642
parser.add_option("--interval", type="string", # Parsed later
643
default="5m",
644
help="How often to check that a client is up")
668
645
parser.add_option("--check", action="store_true", default=False,
669
646
help="Run self-test")
670
parser.add_option("--debug", action="store_true",
671
help="Debug mode; run in foreground and log to"
672
" terminal")
673
parser.add_option("--priority", type="string", help="GnuTLS"
674
" priority string (see GnuTLS documentation)")
675
parser.add_option("--servicename", type="string", metavar="NAME",
676
help="Zeroconf service name")
677
parser.add_option("--configdir", type="string",
678
default="/etc/mandos", metavar="DIR",
679
help="Directory to search for configuration"
680
" files")
647
parser.add_option("--debug", action="store_true", default=False,
648
help="Debug mode")
681
649
(options, args) = parser.parse_args()
682
650
683
651
if options.check:
685
653
doctest.testmod()
686
654
sys.exit()
687
655
688
# Default values for config file for server-global settings
689
server_defaults = { "interface": "",
690
"address": "",
691
"port": "",
692
"debug": "False",
693
"priority":
694
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
695
"servicename": "Mandos",
696
}
697
698
# Parse config file for server-global settings
699
server_config = ConfigParser.SafeConfigParser(server_defaults)
700
del server_defaults
701
server_config.read(os.path.join(options.configdir, "mandos.conf"))
702
server_section = "server"
703
# Convert the SafeConfigParser object to a dict
704
server_settings = dict(server_config.items(server_section))
705
# Use getboolean on the boolean config option
706
server_settings["debug"] = server_config.getboolean\
707
(server_section, "debug")
708
del server_config
709
710
# Override the settings from the config file with command line
711
# options, if set.
712
for option in ("interface", "address", "port", "debug",
713
"priority", "servicename", "configdir"):
714
value = getattr(options, option)
715
if value is not None:
716
server_settings[option] = value
717
del options
718
# Now we have our good server settings in "server_settings"
719
720
debug = server_settings["debug"]
721
722
if not debug:
723
syslogger.setLevel(logging.WARNING)
724
console.setLevel(logging.WARNING)
725
726
if server_settings["servicename"] != "Mandos":
727
syslogger.setFormatter(logging.Formatter\
728
('Mandos (%s): %%(levelname)s:'
729
' %%(message)s'
730
% server_settings["servicename"]))
731
732
# Parse config file with clients
733
client_defaults = { "timeout": "1h",
734
"interval": "5m",
735
"checker": "fping -q -- %%(host)s",
736
}
737
client_config = ConfigParser.SafeConfigParser(client_defaults)
738
client_config.read(os.path.join(server_settings["configdir"],
739
"clients.conf"))
740
741
global service
742
service = AvahiService(name = server_settings["servicename"],
743
type = "_mandos._tcp", );
744
if server_settings["interface"]:
745
service.interface = if_nametoindex(server_settings["interface"])
656
# Parse the time arguments
657
try:
658
options.timeout = string_to_delta(options.timeout)
659
except ValueError:
660
parser.error("option --timeout: Unparseable time")
661
try:
662
options.interval = string_to_delta(options.interval)
663
except ValueError:
664
parser.error("option --interval: Unparseable time")
665
666
# Parse config file
667
defaults = { "checker": "fping -q -- %%(fqdn)s" }
668
client_config = ConfigParser.SafeConfigParser(defaults)
669
#client_config.readfp(open("global.conf"), "global.conf")
670
client_config.read("mandos-clients.conf")
746
671
747
672
global main_loop
748
673
global bus
756
681
avahi.DBUS_INTERFACE_SERVER )
757
682
# End of Avahi example code
758
683
684
debug = options.debug
685
686
if debug:
687
console = logging.StreamHandler()
688
# console.setLevel(logging.DEBUG)
689
console.setFormatter(logging.Formatter\
690
('%(levelname)s: %(message)s'))
691
logger.addHandler(console)
692
del console
693
759
694
clients = Set()
760
695
def remove_from_clients(client):
761
696
clients.remove(client)
762
697
if not clients:
763
logger.critical(u"No clients left, exiting")
764
sys.exit()
698
logger.debug(u"No clients left, exiting")
699
killme()
765
700
766
clients.update(Set(Client(name = section,
701
clients.update(Set(Client(name=section, options=options,
767
702
stop_hook = remove_from_clients,
768
config
769
= dict(client_config.items(section)))
703
**(dict(client_config\
704
.items(section))))
770
705
for section in client_config.sections()))
771
if not clients:
772
logger.critical(u"No clients defined")
773
sys.exit(1)
774
706
775
707
if not debug:
776
logger.removeHandler(console)
777
daemon()
778
779
pidfilename = "/var/run/mandos/mandos.pid"
780
pid = os.getpid()
781
try:
782
pidfile = open(pidfilename, "w")
783
pidfile.write(str(pid) + "\n")
784
pidfile.close()
785
del pidfile
786
except IOError, err:
787
logger.error(u"Could not write %s file with PID %d",
788
pidfilename, os.getpid())
708
daemon(False, False)
789
709
790
710
def cleanup():
791
711
"Cleanup function; run on exit"
805
725
806
726
if not debug:
807
727
signal.signal(signal.SIGINT, signal.SIG_IGN)
808
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
809
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
728
signal.signal(signal.SIGHUP, lambda signum, frame: killme())
729
signal.signal(signal.SIGTERM, lambda signum, frame: killme())
810
730
811
731
for client in clients:
812
732
client.start()
813
733
814
tcp_server = IPv6_TCPServer((server_settings["address"],
815
server_settings["port"]),
734
tcp_server = IPv6_TCPServer((options.address, options.port),
816
735
tcp_handler,
817
settings=server_settings,
736
options=options,
818
737
clients=clients)
819
# Find out what port we got
820
service.port = tcp_server.socket.getsockname()[1]
821
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
822
u" scope_id %d" % tcp_server.socket.getsockname())
823
824
#service.interface = tcp_server.socket.getsockname()[3]
825
826
try:
827
# From the Avahi example code
828
server.connect_to_signal("StateChanged", server_state_changed)
829
try:
830
server_state_changed(server.GetState())
831
except dbus.exceptions.DBusException, error:
832
logger.critical(u"DBusException: %s", error)
833
sys.exit(1)
834
# End of Avahi example code
835
836
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
837
lambda *args, **kwargs:
838
tcp_server.handle_request\
839
(*args[2:], **kwargs) or True)
840
841
logger.debug(u"Starting main loop")
738
# Find out what random port we got
739
global servicePort
740
servicePort = tcp_server.socket.getsockname()[1]
741
logger.debug(u"Now listening on port %d", servicePort)
742
743
if options.interface is not None:
744
global serviceInterface
745
serviceInterface = if_nametoindex(options.interface)
746
747
# From the Avahi example code
748
server.connect_to_signal("StateChanged", server_state_changed)
749
try:
750
server_state_changed(server.GetState())
751
except dbus.exceptions.DBusException, error:
752
logger.critical(u"DBusException: %s", error)
753
killme(1)
754
# End of Avahi example code
755
756
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
757
lambda *args, **kwargs:
758
tcp_server.handle_request(*args[2:],
759
**kwargs) or True)
760
try:
761
logger.debug("Starting main loop")
842
762
main_loop_started = True
843
763
main_loop.run()
844
except AvahiError, error:
845
logger.critical(u"AvahiError: %s" + unicode(error))
846
sys.exit(1)
847
764
except KeyboardInterrupt:
848
765
if debug:
849
766
print
767
768
sys.exit(exitstatus)
850
769
851
770
if __name__ == '__main__':
852
771
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0