/mandos/trunk : revision 240

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

35

36

import SocketServer

37

import socket

38

import optparse

38

from optparse import OptionParser

39

import datetime

40

import errno

41

import gnutls.crypto

66

import ctypes

67

import ctypes.util

68

69

version = "1.0.9"

69

version = "1.0.2"

70

71

logger = logging.Logger('mandos')

72

syslogger = (logging.handlers.SysLogHandler

73

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

74

address = "/dev/log"))

75

syslogger.setFormatter(logging.Formatter

76

('Mandos [%(process)d]: %(levelname)s:'

77

' %(message)s'))

76

('Mandos: %(levelname)s: %(message)s'))

78

77

logger.addHandler(syslogger)

79

78

80

79

console = logging.StreamHandler()

81

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

82

' %(levelname)s: %(message)s'))

80

console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'

81

' %(message)s'))

83

82

logger.addHandler(console)

84

83

85

84

class AvahiError(Exception):

86

def __init__(self, value, *args, **kwargs):

85

def __init__(self, value):

87

86

self.value = value

88

super(AvahiError, self).__init__(value, *args, **kwargs)

89

def __unicode__(self):

90

return unicode(repr(self.value))

87

super(AvahiError, self).__init__()

88

def __str__(self):

89

return repr(self.value)

91

90

92

91

class AvahiServiceError(AvahiError):

93

92

pass

114

113

"""

115

114

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

116

115

servicetype = None, port = None, TXT = None,

117

domain = "", host = "", max_renames = 32768,

118

protocol = avahi.PROTO_UNSPEC):

116

domain = "", host = "", max_renames = 32768):

119

117

self.interface = interface

120

118

self.name = name

121

119

self.type = servicetype

125

123

self.host = host

126

124

self.rename_count = 0

127

125

self.max_renames = max_renames

128

self.protocol = protocol

129

126

def rename(self):

130

127

"""Derived from the Avahi example code"""

131

128

if self.rename_count >= self.max_renames:

132

129

logger.critical(u"No suitable Zeroconf service name found"

133

130

u" after %i retries, exiting.",

134

131

self.rename_count)

135

raise AvahiServiceError(u"Too many renames")

132

raise AvahiServiceError("Too many renames")

136

133

self.name = server.GetAlternativeServiceName(self.name)

137

134

logger.info(u"Changing Zeroconf service name to %r ...",

138

135

str(self.name))

160

157

service.name, service.type)

161

158

group.AddService(

162

159

self.interface, # interface

163

self.protocol, # protocol

160

avahi.PROTO_INET6, # protocol

164

161

dbus.UInt32(0), # flags

165

162

self.name, self.type,

166

163

self.domain, self.host,

181

178

class Client(dbus.service.Object):

182

179

"""A representation of a client host served by this server.

183

180

Attributes:

184

name: string; from the config file, used in log messages and

185

D-Bus identifiers

181

name: string; from the config file, used in log messages

186

182

fingerprint: string (40 or 32 hexadecimal digits); used to

187

183

uniquely identify the client

188

184

secret: bytestring; sent verbatim (over TLS) to client

205

201

client lives. %() expansions are done at

206

202

runtime with vars(self) as dict, so that for

207

203

instance %(name)s can be used in the command.

208

current_checker_command: string; current running checker_command

209

use_dbus: bool(); Whether to provide D-Bus interface and signals

210

dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus

204

dbus_object_path: dbus.ObjectPath

205

Private attibutes:

206

_timeout: Real variable for 'timeout'

207

_interval: Real variable for 'interval'

208

_timeout_milliseconds: Used when calling gobject.timeout_add()

209

_interval_milliseconds: - '' -

211

210

"""

212

def timeout_milliseconds(self):

213

"Return the 'timeout' attribute in milliseconds"

214

return ((self.timeout.days * 24 * 60 * 60 * 1000)

215

+ (self.timeout.seconds * 1000)

216

+ (self.timeout.microseconds // 1000))

217

218

def interval_milliseconds(self):

219

"Return the 'interval' attribute in milliseconds"

220

return ((self.interval.days * 24 * 60 * 60 * 1000)

221

+ (self.interval.seconds * 1000)

222

+ (self.interval.microseconds // 1000))

223

224

def __init__(self, name = None, disable_hook=None, config=None,

225

use_dbus=True):

211

def _set_timeout(self, timeout):

212

"Setter function for the 'timeout' attribute"

213

self._timeout = timeout

214

self._timeout_milliseconds = ((self.timeout.days

215

* 24 * 60 * 60 * 1000)

216

+ (self.timeout.seconds * 1000)

217

+ (self.timeout.microseconds

218

// 1000))

219

# Emit D-Bus signal

220

self.PropertyChanged(dbus.String(u"timeout"),

221

(dbus.UInt64(self._timeout_milliseconds,

222

variant_level=1)))

223

timeout = property(lambda self: self._timeout, _set_timeout)

224

del _set_timeout

225

226

def _set_interval(self, interval):

227

"Setter function for the 'interval' attribute"

228

self._interval = interval

229

self._interval_milliseconds = ((self.interval.days

230

* 24 * 60 * 60 * 1000)

231

+ (self.interval.seconds

232

* 1000)

233

+ (self.interval.microseconds

234

// 1000))

235

# Emit D-Bus signal

236

self.PropertyChanged(dbus.String(u"interval"),

237

(dbus.UInt64(self._interval_milliseconds,

238

variant_level=1)))

239

interval = property(lambda self: self._interval, _set_interval)

240

del _set_interval

241

242

def __init__(self, name = None, disable_hook=None, config=None):

226

243

"""Note: the 'checker' key in 'config' sets the

227

244

'checker_command' attribute and *not* the 'checker'

228

245

attribute."""

229

self.name = name

246

self.dbus_object_path = (dbus.ObjectPath

247

("/Mandos/clients/"

248

+ name.replace(".", "_")))

249

dbus.service.Object.__init__(self, bus,

250

self.dbus_object_path)

230

251

if config is None:

231

252

config = {}

253

self.name = name

232

254

logger.debug(u"Creating client %r", self.name)

233

self.use_dbus = False # During __init__

234

255

# Uppercase and remove spaces from fingerprint for later

235

256

# comparison purposes with return value from the fingerprint()

236

257

# function

260

281

self.disable_initiator_tag = None

261

282

self.checker_callback_tag = None

262

283

self.checker_command = config["checker"]

263

self.current_checker_command = None

264

self.last_connect = None

265

# Only now, when this client is initialized, can it show up on

266

# the D-Bus

267

self.use_dbus = use_dbus

268

if self.use_dbus:

269

self.dbus_object_path = (dbus.ObjectPath

270

("/clients/"

271

+ self.name.replace(".", "_")))

272

dbus.service.Object.__init__(self, bus,

273

self.dbus_object_path)

274

284

275

285

def enable(self):

276

286

"""Start this client's checker and timeout hooks"""

278

288

# Schedule a new checker to be started an 'interval' from now,

279

289

# and every interval from then on.

280

290

self.checker_initiator_tag = (gobject.timeout_add

281

(self.interval_milliseconds(),

291

(self._interval_milliseconds,

282

292

self.start_checker))

283

293

# Also start a new checker *right now*.

284

294

self.start_checker()

285

295

# Schedule a disable() when 'timeout' has passed

286

296

self.disable_initiator_tag = (gobject.timeout_add

287

(self.timeout_milliseconds(),

297

(self._timeout_milliseconds,

288

298

self.disable))

289

299

self.enabled = True

290

if self.use_dbus:

291

# Emit D-Bus signals

292

self.PropertyChanged(dbus.String(u"enabled"),

293

dbus.Boolean(True, variant_level=1))

294

self.PropertyChanged(dbus.String(u"last_enabled"),

295

(_datetime_to_dbus(self.last_enabled,

296

variant_level=1)))

300

# Emit D-Bus signal

301

self.PropertyChanged(dbus.String(u"enabled"),

302

dbus.Boolean(True, variant_level=1))

303

self.PropertyChanged(dbus.String(u"last_enabled"),

304

(_datetime_to_dbus(self.last_enabled,

305

variant_level=1)))

297

306

298

307

def disable(self):

299

308

"""Disable this client."""

310

319

if self.disable_hook:

311

320

self.disable_hook(self)

312

321

self.enabled = False

313

if self.use_dbus:

314

# Emit D-Bus signal

315

self.PropertyChanged(dbus.String(u"enabled"),

316

dbus.Boolean(False, variant_level=1))

322

# Emit D-Bus signal

323

self.PropertyChanged(dbus.String(u"enabled"),

324

dbus.Boolean(False, variant_level=1))

317

325

# Do not run this again if called by a gobject.timeout_add

318

326

return False

319

327

325

333

"""The checker has completed, so take appropriate actions."""

326

334

self.checker_callback_tag = None

327

335

self.checker = None

328

if self.use_dbus:

336

# Emit D-Bus signal

337

self.PropertyChanged(dbus.String(u"checker_running"),

338

dbus.Boolean(False, variant_level=1))

339

if (os.WIFEXITED(condition)

340

and (os.WEXITSTATUS(condition) == 0)):

341

logger.info(u"Checker for %(name)s succeeded",

342

vars(self))

329

343

# Emit D-Bus signal

330

self.PropertyChanged(dbus.String(u"checker_running"),

331

dbus.Boolean(False, variant_level=1))

332

if os.WIFEXITED(condition):

333

exitstatus = os.WEXITSTATUS(condition)

334

if exitstatus == 0:

335

logger.info(u"Checker for %(name)s succeeded",

336

vars(self))

337

self.checked_ok()

338

else:

339

logger.info(u"Checker for %(name)s failed",

340

vars(self))

341

if self.use_dbus:

342

# Emit D-Bus signal

343

self.CheckerCompleted(dbus.Int16(exitstatus),

344

dbus.Int64(condition),

345

dbus.String(command))

346

else:

344

self.CheckerCompleted(dbus.Boolean(True),

345

dbus.UInt16(condition),

346

dbus.String(command))

347

self.bump_timeout()

348

elif not os.WIFEXITED(condition):

347

349

logger.warning(u"Checker for %(name)s crashed?",

348

350

vars(self))

349

if self.use_dbus:

350

# Emit D-Bus signal

351

self.CheckerCompleted(dbus.Int16(-1),

352

dbus.Int64(condition),

353

dbus.String(command))

351

# Emit D-Bus signal

352

self.CheckerCompleted(dbus.Boolean(False),

353

dbus.UInt16(condition),

354

dbus.String(command))

355

else:

356

logger.info(u"Checker for %(name)s failed",

357

vars(self))

358

# Emit D-Bus signal

359

self.CheckerCompleted(dbus.Boolean(False),

360

dbus.UInt16(condition),

361

dbus.String(command))

354

362

355

def checked_ok(self):

363

def bump_timeout(self):

356

364

"""Bump up the timeout for this client.

357

365

This should only be called when the client has been seen,

358

366

alive and well.

360

368

self.last_checked_ok = datetime.datetime.utcnow()

361

369

gobject.source_remove(self.disable_initiator_tag)

362

370

self.disable_initiator_tag = (gobject.timeout_add

363

(self.timeout_milliseconds(),

371

(self._timeout_milliseconds,

364

372

self.disable))

365

if self.use_dbus:

366

# Emit D-Bus signal

367

self.PropertyChanged(

368

dbus.String(u"last_checked_ok"),

369

(_datetime_to_dbus(self.last_checked_ok,

370

variant_level=1)))

373

self.PropertyChanged(dbus.String(u"last_checked_ok"),

374

(_datetime_to_dbus(self.last_checked_ok,

375

variant_level=1)))

371

376

372

377

def start_checker(self):

373

378

"""Start a new checker subprocess if one is not running.

381

386

# checkers alone, the checker would have to take more time

382

387

# than 'timeout' for the client to be declared invalid, which

383

388

# is as it should be.

384

385

# If a checker exists, make sure it is not a zombie

386

if self.checker is not None:

387

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

388

if pid:

389

logger.warning("Checker was a zombie")

390

gobject.source_remove(self.checker_callback_tag)

391

self.checker_callback(pid, status,

392

self.current_checker_command)

393

# Start a new checker if needed

394

389

if self.checker is None:

395

390

try:

396

391

# In case checker_command has exactly one % operator

406

401

logger.error(u'Could not format string "%s":'

407

402

u' %s', self.checker_command, error)

408

403

return True # Try again later

409

self.current_checker_command = command

410

404

try:

411

405

logger.info(u"Starting checker %r for %s",

412

406

command, self.name)

417

411

self.checker = subprocess.Popen(command,

418

412

close_fds=True,

419

413

shell=True, cwd="/")

420

if self.use_dbus:

421

# Emit D-Bus signal

422

self.CheckerStarted(command)

423

self.PropertyChanged(

424

dbus.String("checker_running"),

425

dbus.Boolean(True, variant_level=1))

414

# Emit D-Bus signal

415

self.CheckerStarted(command)

416

self.PropertyChanged(dbus.String("checker_running"),

417

dbus.Boolean(True, variant_level=1))

426

418

self.checker_callback_tag = (gobject.child_watch_add

427

419

(self.checker.pid,

428

420

self.checker_callback,

429

421

data=command))

430

# The checker may have completed before the gobject

431

# watch was added. Check for this.

432

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

433

if pid:

434

gobject.source_remove(self.checker_callback_tag)

435

self.checker_callback(pid, status, command)

436

422

except OSError, error:

437

423

logger.error(u"Failed to start subprocess: %s",

438

424

error)

456

442

if error.errno != errno.ESRCH: # No such process

457

443

raise

458

444

self.checker = None

459

if self.use_dbus:

460

self.PropertyChanged(dbus.String(u"checker_running"),

461

dbus.Boolean(False, variant_level=1))

445

self.PropertyChanged(dbus.String(u"checker_running"),

446

dbus.Boolean(False, variant_level=1))

462

447

463

448

def still_valid(self):

464

449

"""Has the timeout not yet passed for this client?"""

471

456

return now < (self.last_checked_ok + self.timeout)

472

457

473

458

## D-Bus methods & signals

474

_interface = u"se.bsnet.fukt.Mandos.Client"

459

_interface = u"org.mandos_system.Mandos.Client"

475

460

476

# CheckedOK - method

477

CheckedOK = dbus.service.method(_interface)(checked_ok)

478

CheckedOK.__name__ = "CheckedOK"

461

# BumpTimeout - method

462

BumpTimeout = dbus.service.method(_interface)(bump_timeout)

463

BumpTimeout.__name__ = "BumpTimeout"

479

464

480

465

# CheckerCompleted - signal

481

@dbus.service.signal(_interface, signature="nxs")

482

def CheckerCompleted(self, exitcode, waitstatus, command):

466

@dbus.service.signal(_interface, signature="bqs")

467

def CheckerCompleted(self, success, condition, command):

483

468

"D-Bus signal"

484

469

pass

485

470

515

500

if self.last_checked_ok is not None

516

501

else dbus.Boolean (False, variant_level=1)),

517

502

dbus.String("timeout"):

518

dbus.UInt64(self.timeout_milliseconds(),

503

dbus.UInt64(self._timeout_milliseconds,

519

504

variant_level=1),

520

505

dbus.String("interval"):

521

dbus.UInt64(self.interval_milliseconds(),

506

dbus.UInt64(self._interval_milliseconds,

522

507

variant_level=1),

523

508

dbus.String("checker"):

524

509

dbus.String(self.checker_command,

526

511

dbus.String("checker_running"):

527

512

dbus.Boolean(self.checker is not None,

528

513

variant_level=1),

529

dbus.String("object_path"):

530

dbus.ObjectPath(self.dbus_object_path,

531

variant_level=1)

532

514

}, signature="sv")

533

515

534

516

# IsStillValid - method

547

529

def SetChecker(self, checker):

548

530

"D-Bus setter method"

549

531

self.checker_command = checker

550

# Emit D-Bus signal

551

self.PropertyChanged(dbus.String(u"checker"),

552

dbus.String(self.checker_command,

553

variant_level=1))

554

532

555

533

# SetHost - method

556

534

@dbus.service.method(_interface, in_signature="s")

557

535

def SetHost(self, host):

558

536

"D-Bus setter method"

559

537

self.host = host

560

# Emit D-Bus signal

561

self.PropertyChanged(dbus.String(u"host"),

562

dbus.String(self.host, variant_level=1))

563

538

564

539

# SetInterval - method

565

540

@dbus.service.method(_interface, in_signature="t")

566

541

def SetInterval(self, milliseconds):

567

self.interval = datetime.timedelta(0, 0, 0, milliseconds)

568

# Emit D-Bus signal

569

self.PropertyChanged(dbus.String(u"interval"),

570

(dbus.UInt64(self.interval_milliseconds(),

571

variant_level=1)))

542

self.interval = datetime.timdeelta(0, 0, 0, milliseconds)

572

543

573

544

# SetSecret - method

574

545

@dbus.service.method(_interface, in_signature="ay",

581

552

@dbus.service.method(_interface, in_signature="t")

582

553

def SetTimeout(self, milliseconds):

583

554

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

584

# Emit D-Bus signal

585

self.PropertyChanged(dbus.String(u"timeout"),

586

(dbus.UInt64(self.timeout_milliseconds(),

587

variant_level=1)))

588

555

589

556

# Enable - method

590

557

Enable = dbus.service.method(_interface)(enable)

617

584

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

618

585

# ...do the normal thing

619

586

return session.peer_certificate

620

list_size = ctypes.c_uint(1)

587

list_size = ctypes.c_uint()

621

588

cert_list = (gnutls.library.functions

622

589

.gnutls_certificate_get_peers

623

590

(session._c_object, ctypes.byref(list_size)))

624

if not bool(cert_list) and list_size.value != 0:

625

raise gnutls.errors.GNUTLSError("error getting peer"

626

" certificate")

627

591

if list_size.value == 0:

628

592

return None

629

593

cert = cert_list[0]

698

662

# using OpenPGP certificates.

699

663

700

664

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

701

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

702

# "+DHE-DSS"))

665

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

666

# "+DHE-DSS"))

703

667

# Use a fallback default, since this MUST be set.

704

668

priority = self.server.settings.get("priority", "NORMAL")

705

669

(gnutls.library.functions

713

677

# Do not run session.bye() here: the session is not

714

678

# established. Just abandon the request.

715

679

return

716

logger.debug(u"Handshake succeeded")

717

680

try:

718

681

fpr = fingerprint(peer_certificate(session))

719

682

except (TypeError, gnutls.errors.GNUTLSError), error:

721

684

session.bye()

722

685

return

723

686

logger.debug(u"Fingerprint: %s", fpr)

724

725

687

for c in self.server.clients:

726

688

if c.fingerprint == fpr:

727

689

client = c

740

702

session.bye()

741

703

return

742

704

## This won't work here, since we're in a fork.

743

# client.checked_ok()

705

# client.bump_timeout()

744

706

sent_size = 0

745

707

while sent_size < len(client.secret):

746

708

sent = session.send(client.secret[sent_size:])

753

715

754

716

class IPv6_TCPServer(SocketServer.ForkingMixIn,

755

717

SocketServer.TCPServer, object):

756

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

718

"""IPv6 TCP server. Accepts 'None' as address and/or port.

757

719

Attributes:

758

720

settings: Server settings

759

721

clients: Set() of Client objects

767

729

if "clients" in kwargs:

768

730

self.clients = kwargs["clients"]

769

731

del kwargs["clients"]

770

if "use_ipv6" in kwargs:

771

if not kwargs["use_ipv6"]:

772

self.address_family = socket.AF_INET

773

del kwargs["use_ipv6"]

774

732

self.enabled = False

775

733

super(IPv6_TCPServer, self).__init__(*args, **kwargs)

776

734

def server_bind(self):

790

748

u" bind to interface %s",

791

749

self.settings["interface"])

792

750

else:

793

raise

751

raise error

794

752

# Only bind(2) the socket if we really need to.

795

753

if self.server_address[0] or self.server_address[1]:

796

754

if not self.server_address[0]:

797

if self.address_family == socket.AF_INET6:

798

any_address = "::" # in6addr_any

799

else:

800

any_address = socket.INADDR_ANY

801

self.server_address = (any_address,

755

in6addr_any = "::"

756

self.server_address = (in6addr_any,

802

757

self.server_address[1])

803

758

elif not self.server_address[1]:

804

759

self.server_address = (self.server_address[0],

820

775

821

776

def string_to_delta(interval):

822

777

"""Parse a string and return a datetime.timedelta

823

778

824

779

>>> string_to_delta('7d')

825

780

datetime.timedelta(7)

826

781

>>> string_to_delta('60s')

878

833

elif state == avahi.ENTRY_GROUP_FAILURE:

879

834

logger.critical(u"Avahi: Error in group state changed %s",

880

835

unicode(error))

881

raise AvahiGroupError(u"State changed: %s" % unicode(error))

836

raise AvahiGroupError("State changed: %s", str(error))

882

837

883

838

def if_nametoindex(interface):

884

839

"""Call the C function if_nametoindex(), or equivalent"""

927

882

928

883

929

884

def main():

930

parser = optparse.OptionParser(version = "%%prog %s" % version)

885

parser = OptionParser(version = "%%prog %s" % version)

931

886

parser.add_option("-i", "--interface", type="string",

932

887

metavar="IF", help="Bind to interface IF")

933

888

parser.add_option("-a", "--address", type="string",

934

889

help="Address to listen for requests on")

935

890

parser.add_option("-p", "--port", type="int",

936

891

help="Port number to receive requests on")

937

parser.add_option("--check", action="store_true",

892

parser.add_option("--check", action="store_true", default=False,

938

893

help="Run self-test")

939

894

parser.add_option("--debug", action="store_true",

940

895

help="Debug mode; run in foreground and log to"

947

902

default="/etc/mandos", metavar="DIR",

948

903

help="Directory to search for configuration"

949

904

" files")

950

parser.add_option("--no-dbus", action="store_false",

951

dest="use_dbus",

952

help=optparse.SUPPRESS_HELP) # XXX: Not done yet

953

parser.add_option("--no-ipv6", action="store_false",

954

dest="use_ipv6", help="Do not use IPv6")

955

905

options = parser.parse_args()[0]

956

906

957

907

if options.check:

967

917

"priority":

968

918

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

969

919

"servicename": "Mandos",

970

"use_dbus": "True",

971

"use_ipv6": "True",

972

920

}

973

921

974

922

# Parse config file for server-global settings

977

925

server_config.read(os.path.join(options.configdir, "mandos.conf"))

978

926

# Convert the SafeConfigParser object to a dict

979

927

server_settings = server_config.defaults()

980

# Use the appropriate methods on the non-string config options

981

server_settings["debug"] = server_config.getboolean("DEFAULT",

982

"debug")

983

server_settings["use_dbus"] = server_config.getboolean("DEFAULT",

984

"use_dbus")

985

server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",

986

"use_ipv6")

987

if server_settings["port"]:

988

server_settings["port"] = server_config.getint("DEFAULT",

989

"port")

928

# Use getboolean on the boolean config option

929

server_settings["debug"] = (server_config.getboolean

930

("DEFAULT", "debug"))

990

931

del server_config

991

932

992

933

# Override the settings from the config file with command line

993

934

# options, if set.

994

935

for option in ("interface", "address", "port", "debug",

995

"priority", "servicename", "configdir",

996

"use_dbus", "use_ipv6"):

936

"priority", "servicename", "configdir"):

997

937

value = getattr(options, option)

998

938

if value is not None:

999

939

server_settings[option] = value

1000

940

del options

1001

941

# Now we have our good server settings in "server_settings"

1002

942

1003

# For convenience

1004

943

debug = server_settings["debug"]

1005

use_dbus = server_settings["use_dbus"]

1006

use_dbus = False # XXX: Not done yet

1007

use_ipv6 = server_settings["use_ipv6"]

1008

944

1009

945

if not debug:

1010

946

syslogger.setLevel(logging.WARNING)

1019

955

# Parse config file with clients

1020

956

client_defaults = { "timeout": "1h",

1021

957

"interval": "5m",

1022

"checker": "fping -q -- %%(host)s",

958

"checker": "fping -q -- %(host)s",

1023

959

"host": "",

1024

960

}

1025

961

client_config = ConfigParser.SafeConfigParser(client_defaults)

1031

967

server_settings["port"]),

1032

968

TCP_handler,

1033

969

settings=server_settings,

1034

clients=clients, use_ipv6=use_ipv6)

970

clients=clients)

1035

971

pidfilename = "/var/run/mandos.pid"

1036

972

try:

1037

973

pidfile = open(pidfilename, "w")

1038

except IOError:

974

except IOError, error:

1039

975

logger.error("Could not open file %r", pidfilename)

1040

976

1041

977

try:

1042

978

uid = pwd.getpwnam("_mandos").pw_uid

979

except KeyError:

980

try:

981

uid = pwd.getpwnam("mandos").pw_uid

982

except KeyError:

983

try:

984

uid = pwd.getpwnam("nobody").pw_uid

985

except KeyError:

986

uid = 65534

987

try:

1043

988

gid = pwd.getpwnam("_mandos").pw_gid

1044

989

except KeyError:

1045

990

try:

1046

uid = pwd.getpwnam("mandos").pw_uid

1047

991

gid = pwd.getpwnam("mandos").pw_gid

1048

992

except KeyError:

1049

993

try:

1050

uid = pwd.getpwnam("nobody").pw_uid

1051

994

gid = pwd.getpwnam("nogroup").pw_gid

1052

995

except KeyError:

1053

uid = 65534

1054

996

gid = 65534

1055

997

try:

998

os.setuid(uid)

1056

999

os.setgid(gid)

1057

os.setuid(uid)

1058

1000

except OSError, error:

1059

1001

if error[0] != errno.EPERM:

1060

1002

raise error

1061

1003

1062

# Enable all possible GnuTLS debugging

1063

if debug:

1064

# "Use a log level over 10 to enable all debugging options."

1065

# - GnuTLS manual

1066

gnutls.library.functions.gnutls_global_set_log_level(11)

1067

1068

@gnutls.library.types.gnutls_log_func

1069

def debug_gnutls(level, string):

1070

logger.debug("GnuTLS: %s", string[:-1])

1071

1072

(gnutls.library.functions

1073

.gnutls_global_set_log_function(debug_gnutls))

1074

1075

1004

global service

1076

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1077

1005

service = AvahiService(name = server_settings["servicename"],

1078

servicetype = "_mandos._tcp",

1079

protocol = protocol)

1006

servicetype = "_mandos._tcp", )

1080

1007

if server_settings["interface"]:

1081

1008

service.interface = (if_nametoindex

1082

1009

(server_settings["interface"]))

1092

1019

avahi.DBUS_PATH_SERVER),

1093

1020

avahi.DBUS_INTERFACE_SERVER)

1094

1021

# End of Avahi example code

1095

if use_dbus:

1096

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1022

bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)

1097

1023

1098

1024

clients.update(Set(Client(name = section,

1099

1025

config

1100

= dict(client_config.items(section)),

1101

use_dbus = use_dbus)

1026

= dict(client_config.items(section)))

1102

1027

for section in client_config.sections()))

1103

1028

if not clients:

1104

logger.warning(u"No clients defined")

1029

logger.critical(u"No clients defined")

1030

sys.exit(1)

1105

1031

1106

1032

if debug:

1107

1033

# Redirect stdin so all checkers get /dev/null

1149

1075

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1150

1076

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1151

1077

1152

if use_dbus:

1153

class MandosServer(dbus.service.Object):

1154

"""A D-Bus proxy object"""

1155

def __init__(self):

1156

dbus.service.Object.__init__(self, bus, "/")

1157

_interface = u"se.bsnet.fukt.Mandos"

1158

1159

@dbus.service.signal(_interface, signature="oa{sv}")

1160

def ClientAdded(self, objpath, properties):

1161

"D-Bus signal"

1162

pass

1163

1164

@dbus.service.signal(_interface, signature="os")

1165

def ClientRemoved(self, objpath, name):

1166

"D-Bus signal"

1167

pass

1168

1169

@dbus.service.method(_interface, out_signature="ao")

1170

def GetAllClients(self):

1171

"D-Bus method"

1172

return dbus.Array(c.dbus_object_path for c in clients)

1173

1174

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1175

def GetAllClientsWithProperties(self):

1176

"D-Bus method"

1177

return dbus.Dictionary(

1178

((c.dbus_object_path, c.GetAllProperties())

1179

for c in clients),

1180

signature="oa{sv}")

1181

1182

@dbus.service.method(_interface, in_signature="o")

1183

def RemoveClient(self, object_path):

1184

"D-Bus method"

1185

for c in clients:

1186

if c.dbus_object_path == object_path:

1187

clients.remove(c)

1188

# Don't signal anything except ClientRemoved

1189

c.use_dbus = False

1190

c.disable()

1191

# Emit D-Bus signal

1192

self.ClientRemoved(object_path, c.name)

1193

return

1194

raise KeyError

1195

1196

del _interface

1197

1198

mandos_server = MandosServer()

1078

class MandosServer(dbus.service.Object):

1079

"""A D-Bus proxy object"""

1080

def __init__(self):

1081

dbus.service.Object.__init__(self, bus,

1082

"/Mandos")

1083

_interface = u"org.mandos_system.Mandos"

1084

1085

@dbus.service.signal(_interface, signature="oa{sv}")

1086

def ClientAdded(self, objpath, properties):

1087

"D-Bus signal"

1088

pass

1089

1090

@dbus.service.signal(_interface, signature="o")

1091

def ClientRemoved(self, objpath):

1092

"D-Bus signal"

1093

pass

1094

1095

@dbus.service.method(_interface, out_signature="ao")

1096

def GetAllClients(self):

1097

return dbus.Array(c.dbus_object_path for c in clients)

1098

1099

@dbus.service.method(_interface, out_signature="a{oa{sv}}")

1100

def GetAllClientsWithProperties(self):

1101

return dbus.Dictionary(

1102

((c.dbus_object_path, c.GetAllProperties())

1103

for c in clients),

1104

signature="oa{sv}")

1105

1106

@dbus.service.method(_interface, in_signature="o")

1107

def RemoveClient(self, object_path):

1108

for c in clients:

1109

if c.dbus_object_path == object_path:

1110

c.disable()

1111

clients.remove(c)

1112

return

1113

raise KeyError

1114

1115

del _interface

1116

1117

mandos_server = MandosServer()

1199

1118

1200

1119

for client in clients:

1201

if use_dbus:

1202

# Emit D-Bus signal

1203

mandos_server.ClientAdded(client.dbus_object_path,

1204

client.GetAllProperties())

1120

# Emit D-Bus signal

1121

mandos_server.ClientAdded(client.dbus_object_path,

1122

client.GetAllProperties())

1205

1123

client.enable()

1206

1124

1207

1125

tcp_server.enable()

1209

1127

1210

1128

# Find out what port we got

1211

1129

service.port = tcp_server.socket.getsockname()[1]

1212

if use_ipv6:

1213

logger.info(u"Now listening on address %r, port %d,"

1214

" flowinfo %d, scope_id %d"

1215

% tcp_server.socket.getsockname())

1216

else: # IPv4

1217

logger.info(u"Now listening on address %r, port %d"

1218

% tcp_server.socket.getsockname())

1130

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

1131

u" scope_id %d" % tcp_server.socket.getsockname())

1219

1132

1220

1133

#service.interface = tcp_server.socket.getsockname()[3]

1221

1134

1237

1150

logger.debug(u"Starting main loop")

1238

1151

main_loop.run()

1239

1152

except AvahiError, error:

1240

logger.critical(u"AvahiError: %s", error)

1153

logger.critical(u"AvahiError: %s" + unicode(error))

1241

1154

sys.exit(1)

1242

1155

except KeyboardInterrupt:

1243

1156

if debug:

1244

print >> sys.stderr

1245

logger.debug("Server received KeyboardInterrupt")

1246

logger.debug("Server exiting")

1157

print

1247

1158

1248

1159

if __name__ == '__main__':

1249

1160

main()