To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 26
- compare with another revision
- download diff
- download tarball
- view history from revision 26
- Committer: Teddy Hogeborn
- Date: 2008-07-22 06:23:59 UTC
- mfrom: (24.1.1 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080722062359-qti3ecst69bq3ltk
Merge.
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- clients.conf => mandos-clients.conf
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos => server.py
- files modified:
- Makefile
added
removed
server.py
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
9
# following functions: "add_service", "remove_service",
10
# "server_state_changed", "entry_group_state_changed", and some lines
11
# in "main".
12
12
#
13
# Everything else is
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
13
# Everything else is Copyright © 2007-2008 Teddy Hogeborn and Björn
14
# Påhlsson.
15
15
#
16
16
# This program is free software: you can redistribute it and/or modify
17
17
# it under the terms of the GNU General Public License as published by
24
24
# GNU General Public License for more details.
25
25
#
26
26
# You should have received a copy of the GNU General Public License
27
# along with this program. If not, see
28
# <http://www.gnu.org/licenses/>.
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
29
28
#
30
# Contact the authors at <mandos@fukt.bsnet.se>.
29
# Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
30
# <https://www.fukt.bsnet.se/~teddy/>.
31
31
#
32
32
33
33
from __future__ import division
34
34
35
35
import SocketServer
36
36
import socket
37
import select
37
38
from optparse import OptionParser
38
39
import datetime
39
40
import errno
54
55
import stat
55
56
import logging
56
57
import logging.handlers
57
import pwd
58
58
59
59
import dbus
60
60
import gobject
61
61
import avahi
62
62
from dbus.mainloop.glib import DBusGMainLoop
63
63
import ctypes
64
import ctypes.util
65
66
version = "1.0"
64
65
# Brief description of the operation of this program:
66
#
67
# This server announces itself as a Zeroconf service. Connecting
68
# clients use the TLS protocol, with the unusual quirk that this
69
# server program acts as a TLS "client" while the connecting clients
70
# acts as a TLS "server". The clients (acting as a TLS "server") must
71
# supply an OpenPGP certificate, and the fingerprint of this
72
# certificate is used by this server to look up (in a list read from a
73
# file at start time) which binary blob to give the client. No other
74
# authentication or authorization is done by this server.
75
67
76
68
77
logger = logging.Logger('mandos')
69
78
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
79
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
72
80
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
81
('%(levelname)s: %(message)s'))
74
82
logger.addHandler(syslogger)
75
76
console = logging.StreamHandler()
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
' %(message)s'))
79
logger.addHandler(console)
80
81
class AvahiError(Exception):
82
def __init__(self, value):
83
self.value = value
84
super(AvahiError, self).__init__()
85
def __str__(self):
86
return repr(self.value)
87
88
class AvahiServiceError(AvahiError):
89
pass
90
91
class AvahiGroupError(AvahiError):
92
pass
93
94
95
class AvahiService(object):
96
"""An Avahi (Zeroconf) service.
97
Attributes:
98
interface: integer; avahi.IF_UNSPEC or an interface index.
99
Used to optionally bind to the specified interface.
100
name: string; Example: 'Mandos'
101
type: string; Example: '_mandos._tcp'.
102
See <http://www.dns-sd.org/ServiceTypes.html>
103
port: integer; what port to announce
104
TXT: list of strings; TXT record for the service
105
domain: string; Domain to publish on, default to .local if empty.
106
host: string; Host to publish records for, default is localhost
107
max_renames: integer; maximum number of renames
108
rename_count: integer; counter so we only rename after collisions
109
a sensible number of times
110
"""
111
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
112
servicetype = None, port = None, TXT = None, domain = "",
113
host = "", max_renames = 32768):
114
self.interface = interface
115
self.name = name
116
self.type = servicetype
117
self.port = port
118
if TXT is None:
119
self.TXT = []
120
else:
121
self.TXT = TXT
122
self.domain = domain
123
self.host = host
124
self.rename_count = 0
125
self.max_renames = max_renames
126
def rename(self):
127
"""Derived from the Avahi example code"""
128
if self.rename_count >= self.max_renames:
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
131
self.rename_count)
132
raise AvahiServiceError("Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter\
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
139
self.remove()
140
self.add()
141
self.rename_count += 1
142
def remove(self):
143
"""Derived from the Avahi example code"""
144
if group is not None:
145
group.Reset()
146
def add(self):
147
"""Derived from the Avahi example code"""
148
global group
149
if group is None:
150
group = dbus.Interface\
151
(bus.get_object(avahi.DBUS_NAME,
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
group.connect_to_signal('StateChanged',
155
entry_group_state_changed)
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
157
service.name, service.type)
158
group.AddService(
159
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
161
dbus.UInt32(0), # flags
162
self.name, self.type,
163
self.domain, self.host,
164
dbus.UInt16(self.port),
165
avahi.string_array_to_txt_array(self.TXT))
166
group.Commit()
167
83
del syslogger
84
85
# This variable is used to optionally bind to a specified interface.
86
# It is a global variable to fit in with the other variables from the
87
# Avahi example code.
88
serviceInterface = avahi.IF_UNSPEC
168
89
# From the Avahi example code:
169
group = None # our entry group
90
serviceName = None
91
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
92
servicePort = None # Not known at startup
93
serviceTXT = [] # TXT record for the service
94
domain = "" # Domain to publish on, default to .local
95
host = "" # Host to publish records for, default to localhost
96
group = None #our entry group
97
rename_count = 12 # Counter so we only rename after collisions a
98
# sensible number of times
170
99
# End of Avahi example code
171
100
172
101
177
106
fingerprint: string (40 or 32 hexadecimal digits); used to
178
107
uniquely identify the client
179
108
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); object creation, not client host
182
last_checked_ok: datetime.datetime() or None if not yet checked OK
183
timeout: datetime.timedelta(); How long from last_checked_ok
184
until this client is invalid
109
fqdn: string (FQDN); available for use by the checker command
110
created: datetime.datetime()
111
last_seen: datetime.datetime() or None if not yet seen
112
timeout: datetime.timedelta(); How long from last_seen until
113
this client is invalid
185
114
interval: datetime.timedelta(); How often to start a new checker
186
115
stop_hook: If set, called by stop() as stop_hook(self)
187
116
checker: subprocess.Popen(); a running checker process used
188
117
to see if the client lives.
189
'None' if no process is running.
118
Is None if no process is running.
190
119
checker_initiator_tag: a gobject event source tag, or None
191
120
stop_initiator_tag: - '' -
192
121
checker_callback_tag: - '' -
193
122
checker_command: string; External command which is run to check if
194
client lives. %() expansions are done at
123
client lives. %()s expansions are done at
195
124
runtime with vars(self) as dict, so that for
196
125
instance %(name)s can be used in the command.
197
126
Private attibutes:
198
127
_timeout: Real variable for 'timeout'
199
128
_interval: Real variable for 'interval'
200
_timeout_milliseconds: Used when calling gobject.timeout_add()
129
_timeout_milliseconds: Used by gobject.timeout_add()
201
130
_interval_milliseconds: - '' -
202
131
"""
203
132
def _set_timeout(self, timeout):
223
152
interval = property(lambda self: self._interval,
224
153
_set_interval)
225
154
del _set_interval
226
def __init__(self, name = None, stop_hook=None, config=None):
227
"""Note: the 'checker' key in 'config' sets the
228
'checker_command' attribute and *not* the 'checker'
229
attribute."""
230
if config is None:
231
config = {}
155
def __init__(self, name=None, stop_hook=None, fingerprint=None,
156
secret=None, secfile=None, fqdn=None, timeout=None,
157
interval=-1, checker=None):
158
"""Note: the 'checker' argument sets the 'checker_command'
159
attribute and not the 'checker' attribute.."""
232
160
self.name = name
233
161
logger.debug(u"Creating client %r", self.name)
234
# Uppercase and remove spaces from fingerprint for later
235
# comparison purposes with return value from the fingerprint()
236
# function
237
self.fingerprint = config["fingerprint"].upper()\
238
.replace(u" ", u"")
162
# Uppercase and remove spaces from fingerprint
163
# for later comparison purposes with return value of
164
# the fingerprint() function
165
self.fingerprint = fingerprint.upper().replace(u" ", u"")
239
166
logger.debug(u" Fingerprint: %s", self.fingerprint)
240
if "secret" in config:
241
self.secret = config["secret"].decode(u"base64")
242
elif "secfile" in config:
243
secfile = open(os.path.expanduser(os.path.expandvars
244
(config["secfile"])))
245
self.secret = secfile.read()
246
secfile.close()
167
if secret:
168
self.secret = secret.decode(u"base64")
169
elif secfile:
170
sf = open(secfile)
171
self.secret = sf.read()
172
sf.close()
247
173
else:
248
raise TypeError(u"No secret or secfile for client %s"
249
% self.name)
250
self.host = config.get("host", "")
174
raise RuntimeError(u"No secret or secfile for client %s"
175
% self.name)
176
self.fqdn = fqdn # string
251
177
self.created = datetime.datetime.now()
252
self.last_checked_ok = None
253
self.timeout = string_to_delta(config["timeout"])
254
self.interval = string_to_delta(config["interval"])
178
self.last_seen = None
179
self.timeout = string_to_delta(timeout)
180
self.interval = string_to_delta(interval)
255
181
self.stop_hook = stop_hook
256
182
self.checker = None
257
183
self.checker_initiator_tag = None
258
184
self.stop_initiator_tag = None
259
185
self.checker_callback_tag = None
260
self.check_command = config["checker"]
186
self.check_command = checker
261
187
def start(self):
262
188
"""Start this client's checker and timeout hooks"""
263
189
# Schedule a new checker to be started an 'interval' from now,
273
199
self.stop)
274
200
def stop(self):
275
201
"""Stop this client.
276
The possibility that a client might be restarted is left open,
277
but not currently used."""
202
The possibility that this client might be restarted is left
203
open, but not currently used."""
278
204
# If this client doesn't have a secret, it is already stopped.
279
if hasattr(self, "secret") and self.secret:
280
logger.info(u"Stopping client %s", self.name)
205
if self.secret:
206
logger.debug(u"Stopping client %s", self.name)
281
207
self.secret = None
282
208
else:
283
209
return False
284
if getattr(self, "stop_initiator_tag", False):
210
if hasattr(self, "stop_initiator_tag") \
211
and self.stop_initiator_tag:
285
212
gobject.source_remove(self.stop_initiator_tag)
286
213
self.stop_initiator_tag = None
287
if getattr(self, "checker_initiator_tag", False):
214
if hasattr(self, "checker_initiator_tag") \
215
and self.checker_initiator_tag:
288
216
gobject.source_remove(self.checker_initiator_tag)
289
217
self.checker_initiator_tag = None
290
218
self.stop_checker()
302
230
self.checker = None
303
231
if os.WIFEXITED(condition) \
304
232
and (os.WEXITSTATUS(condition) == 0):
305
logger.info(u"Checker for %(name)s succeeded",
306
vars(self))
307
self.last_checked_ok = now
233
logger.debug(u"Checker for %(name)s succeeded",
234
vars(self))
235
self.last_seen = now
308
236
gobject.source_remove(self.stop_initiator_tag)
309
237
self.stop_initiator_tag = gobject.timeout_add\
310
238
(self._timeout_milliseconds,
313
241
logger.warning(u"Checker for %(name)s crashed?",
314
242
vars(self))
315
243
else:
316
logger.info(u"Checker for %(name)s failed",
317
vars(self))
244
logger.debug(u"Checker for %(name)s failed",
245
vars(self))
318
246
def start_checker(self):
319
247
"""Start a new checker subprocess if one is not running.
320
248
If a checker already exists, leave it running and do
329
257
# is as it should be.
330
258
if self.checker is None:
331
259
try:
332
# In case check_command has exactly one % operator
333
command = self.check_command % self.host
260
command = self.check_command % self.fqdn
334
261
except TypeError:
335
# Escape attributes for the shell
336
262
escaped_attrs = dict((key, re.escape(str(val)))
337
263
for key, val in
338
264
vars(self).iteritems())
339
265
try:
340
266
command = self.check_command % escaped_attrs
341
267
except TypeError, error:
342
logger.error(u'Could not format string "%s":'
343
u' %s', self.check_command, error)
268
logger.critical(u'Could not format string "%s":'
269
u' %s', self.check_command, error)
344
270
return True # Try again later
345
271
try:
346
logger.info(u"Starting checker %r for %s",
347
command, self.name)
348
# We don't need to redirect stdout and stderr, since
349
# in normal mode, that is already done by daemon(),
350
# and in debug mode we don't want to. (Stdin is
351
# always replaced by /dev/null.)
352
self.checker = subprocess.Popen(command,
353
close_fds=True,
354
shell=True, cwd="/")
272
logger.debug(u"Starting checker %r for %s",
273
command, self.name)
274
self.checker = subprocess.\
275
Popen(command,
276
close_fds=True, shell=True,
277
cwd="/")
355
278
self.checker_callback_tag = gobject.child_watch_add\
356
279
(self.checker.pid,
357
280
self.checker_callback)
358
except OSError, error:
281
except subprocess.OSError, error:
359
282
logger.error(u"Failed to start subprocess: %s",
360
283
error)
361
284
# Re-run this periodically if run by gobject.timeout_add
365
288
if self.checker_callback_tag:
366
289
gobject.source_remove(self.checker_callback_tag)
367
290
self.checker_callback_tag = None
368
if getattr(self, "checker", None) is None:
291
if not hasattr(self, "checker") or self.checker is None:
369
292
return
370
logger.debug(u"Stopping checker for %(name)s", vars(self))
293
logger.debug("Stopping checker for %(name)s", vars(self))
371
294
try:
372
295
os.kill(self.checker.pid, signal.SIGTERM)
373
296
#os.sleep(0.5)
374
297
#if self.checker.poll() is None:
375
298
# os.kill(self.checker.pid, signal.SIGKILL)
376
299
except OSError, error:
377
if error.errno != errno.ESRCH: # No such process
300
if error.errno != errno.ESRCH:
378
301
raise
379
302
self.checker = None
380
def still_valid(self):
303
def still_valid(self, now=None):
381
304
"""Has the timeout not yet passed for this client?"""
382
now = datetime.datetime.now()
383
if self.last_checked_ok is None:
305
if now is None:
306
now = datetime.datetime.now()
307
if self.last_seen is None:
384
308
return now < (self.created + self.timeout)
385
309
else:
386
return now < (self.last_checked_ok + self.timeout)
310
return now < (self.last_seen + self.timeout)
387
311
388
312
389
313
def peer_certificate(session):
405
329
406
330
def fingerprint(openpgp):
407
331
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
332
# New empty GnuTLS certificate
333
crt = gnutls.library.types.gnutls_openpgp_crt_t()
334
gnutls.library.functions.gnutls_openpgp_crt_init\
335
(ctypes.byref(crt))
408
336
# New GnuTLS "datum" with the OpenPGP public key
409
337
datum = gnutls.library.types.gnutls_datum_t\
410
338
(ctypes.cast(ctypes.c_char_p(openpgp),
411
339
ctypes.POINTER(ctypes.c_ubyte)),
412
340
ctypes.c_uint(len(openpgp)))
413
# New empty GnuTLS certificate
414
crt = gnutls.library.types.gnutls_openpgp_crt_t()
415
gnutls.library.functions.gnutls_openpgp_crt_init\
416
(ctypes.byref(crt))
417
341
# Import the OpenPGP public key into the certificate
418
gnutls.library.functions.gnutls_openpgp_crt_import\
419
(crt, ctypes.byref(datum),
420
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
421
# Verify the self signature in the key
422
crtverify = ctypes.c_uint()
423
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
424
(crt, 0, ctypes.byref(crtverify))
425
if crtverify.value != 0:
426
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
427
raise gnutls.errors.CertificateSecurityError("Verify failed")
342
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
343
(crt,
344
ctypes.byref(datum),
345
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
428
346
# New buffer for the fingerprint
429
buf = ctypes.create_string_buffer(20)
430
buf_len = ctypes.c_size_t()
347
buffer = ctypes.create_string_buffer(20)
348
buffer_length = ctypes.c_size_t()
431
349
# Get the fingerprint from the certificate into the buffer
432
350
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
433
(crt, ctypes.byref(buf), ctypes.byref(buf_len))
351
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
434
352
# Deinit the certificate
435
353
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
436
354
# Convert the buffer to a Python bytestring
437
fpr = ctypes.string_at(buf, buf_len.value)
355
fpr = ctypes.string_at(buffer, buffer_length.value)
438
356
# Convert the bytestring to hexadecimal notation
439
357
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
440
358
return hex_fpr
441
359
442
360
443
class TCP_handler(SocketServer.BaseRequestHandler, object):
361
class tcp_handler(SocketServer.BaseRequestHandler, object):
444
362
"""A TCP request handler class.
445
363
Instantiated by IPv6_TCPServer for each request to handle it.
446
364
Note: This will run in its own forked process."""
447
365
448
366
def handle(self):
449
logger.info(u"TCP connection from: %s",
367
logger.debug(u"TCP connection from: %s",
450
368
unicode(self.client_address))
451
session = gnutls.connection.ClientSession\
452
(self.request, gnutls.connection.X509Credentials())
453
454
line = self.request.makefile().readline()
455
logger.debug(u"Protocol version: %r", line)
456
try:
457
if int(line.strip().split()[0]) > 1:
458
raise RuntimeError
459
except (ValueError, IndexError, RuntimeError), error:
460
logger.error(u"Unknown protocol version: %s", error)
461
return
462
463
# Note: gnutls.connection.X509Credentials is really a generic
464
# GnuTLS certificate credentials object so long as no X.509
465
# keys are added to it. Therefore, we can use it here despite
466
# using OpenPGP certificates.
369
session = gnutls.connection.ClientSession(self.request,
370
gnutls.connection.\
371
X509Credentials())
467
372
468
373
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
469
374
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
470
375
# "+DHE-DSS"))
471
priority = "NORMAL" # Fallback default, since this
472
# MUST be set.
473
if self.server.settings["priority"]:
474
priority = self.server.settings["priority"]
376
priority = "NORMAL"
377
if self.server.options.priority:
378
priority = self.server.options.priority
475
379
gnutls.library.functions.gnutls_priority_set_direct\
476
(session._c_object, priority, None)
380
(session._c_object, priority, None);
477
381
478
382
try:
479
383
session.handshake()
480
384
except gnutls.errors.GNUTLSError, error:
481
logger.warning(u"Handshake failed: %s", error)
385
logger.debug(u"Handshake failed: %s", error)
482
386
# Do not run session.bye() here: the session is not
483
387
# established. Just abandon the request.
484
388
return
485
389
try:
486
390
fpr = fingerprint(peer_certificate(session))
487
391
except (TypeError, gnutls.errors.GNUTLSError), error:
488
logger.warning(u"Bad certificate: %s", error)
392
logger.debug(u"Bad certificate: %s", error)
489
393
session.bye()
490
394
return
491
395
logger.debug(u"Fingerprint: %s", fpr)
494
398
if c.fingerprint == fpr:
495
399
client = c
496
400
break
497
if not client:
498
logger.warning(u"Client not found for fingerprint: %s",
499
fpr)
500
session.bye()
501
return
502
401
# Have to check if client.still_valid(), since it is possible
503
402
# that the client timed out while establishing the GnuTLS
504
403
# session.
505
if not client.still_valid():
506
logger.warning(u"Client %(name)s is invalid",
507
vars(client))
404
if (not client) or (not client.still_valid()):
405
if client:
406
logger.debug(u"Client %(name)s is invalid",
407
vars(client))
408
else:
409
logger.debug(u"Client not found for fingerprint: %s",
410
fpr)
508
411
session.bye()
509
412
return
510
413
sent_size = 0
520
423
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
521
424
"""IPv6 TCP server. Accepts 'None' as address and/or port.
522
425
Attributes:
523
settings: Server settings
426
options: Command line options
524
427
clients: Set() of Client objects
525
enabled: Boolean; whether this server is activated yet
526
428
"""
527
429
address_family = socket.AF_INET6
528
430
def __init__(self, *args, **kwargs):
529
if "settings" in kwargs:
530
self.settings = kwargs["settings"]
531
del kwargs["settings"]
431
if "options" in kwargs:
432
self.options = kwargs["options"]
433
del kwargs["options"]
532
434
if "clients" in kwargs:
533
435
self.clients = kwargs["clients"]
534
436
del kwargs["clients"]
535
self.enabled = False
536
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
437
return super(type(self), self).__init__(*args, **kwargs)
537
438
def server_bind(self):
538
439
"""This overrides the normal server_bind() function
539
440
to bind to an interface if one was specified, and also NOT to
540
441
bind to an address or port if they were not specified."""
541
if self.settings["interface"]:
542
# 25 is from /usr/include/asm-i486/socket.h
543
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
442
if self.options.interface:
443
if not hasattr(socket, "SO_BINDTODEVICE"):
444
# From /usr/include/asm-i486/socket.h
445
socket.SO_BINDTODEVICE = 25
544
446
try:
545
447
self.socket.setsockopt(socket.SOL_SOCKET,
546
SO_BINDTODEVICE,
547
self.settings["interface"])
448
socket.SO_BINDTODEVICE,
449
self.options.interface)
548
450
except socket.error, error:
549
451
if error[0] == errno.EPERM:
550
logger.error(u"No permission to"
551
u" bind to interface %s",
552
self.settings["interface"])
452
logger.warning(u"No permission to"
453
u" bind to interface %s",
454
self.options.interface)
553
455
else:
554
456
raise error
555
457
# Only bind(2) the socket if we really need to.
558
460
in6addr_any = "::"
559
461
self.server_address = (in6addr_any,
560
462
self.server_address[1])
561
elif not self.server_address[1]:
463
elif self.server_address[1] is None:
562
464
self.server_address = (self.server_address[0],
563
465
0)
564
# if self.settings["interface"]:
565
# self.server_address = (self.server_address[0],
566
# 0, # port
567
# 0, # flowinfo
568
# if_nametoindex
569
# (self.settings
570
# ["interface"]))
571
return super(IPv6_TCPServer, self).server_bind()
572
def server_activate(self):
573
if self.enabled:
574
return super(IPv6_TCPServer, self).server_activate()
575
def enable(self):
576
self.enabled = True
466
return super(type(self), self).server_bind()
577
467
578
468
579
469
def string_to_delta(interval):
589
479
datetime.timedelta(1)
590
480
>>> string_to_delta(u'1w')
591
481
datetime.timedelta(7)
592
>>> string_to_delta('5m 30s')
593
datetime.timedelta(0, 330)
594
482
"""
595
timevalue = datetime.timedelta(0)
596
for s in interval.split():
597
try:
598
suffix = unicode(s[-1])
599
value = int(s[:-1])
600
if suffix == u"d":
601
delta = datetime.timedelta(value)
602
elif suffix == u"s":
603
delta = datetime.timedelta(0, value)
604
elif suffix == u"m":
605
delta = datetime.timedelta(0, 0, 0, 0, value)
606
elif suffix == u"h":
607
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
608
elif suffix == u"w":
609
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
610
else:
611
raise ValueError
612
except (ValueError, IndexError):
483
try:
484
suffix=unicode(interval[-1])
485
value=int(interval[:-1])
486
if suffix == u"d":
487
delta = datetime.timedelta(value)
488
elif suffix == u"s":
489
delta = datetime.timedelta(0, value)
490
elif suffix == u"m":
491
delta = datetime.timedelta(0, 0, 0, 0, value)
492
elif suffix == u"h":
493
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
494
elif suffix == u"w":
495
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
496
else:
613
497
raise ValueError
614
timevalue += delta
615
return timevalue
498
except (ValueError, IndexError):
499
raise ValueError
500
return delta
501
502
503
def add_service():
504
"""Derived from the Avahi example code"""
505
global group, serviceName, serviceType, servicePort, serviceTXT, \
506
domain, host
507
if group is None:
508
group = dbus.Interface(
509
bus.get_object( avahi.DBUS_NAME,
510
server.EntryGroupNew()),
511
avahi.DBUS_INTERFACE_ENTRY_GROUP)
512
group.connect_to_signal('StateChanged',
513
entry_group_state_changed)
514
logger.debug(u"Adding service '%s' of type '%s' ...",
515
serviceName, serviceType)
516
517
group.AddService(
518
serviceInterface, # interface
519
avahi.PROTO_INET6, # protocol
520
dbus.UInt32(0), # flags
521
serviceName, serviceType,
522
domain, host,
523
dbus.UInt16(servicePort),
524
avahi.string_array_to_txt_array(serviceTXT))
525
group.Commit()
526
527
528
def remove_service():
529
"""From the Avahi example code"""
530
global group
531
532
if not group is None:
533
group.Reset()
616
534
617
535
618
536
def server_state_changed(state):
619
537
"""Derived from the Avahi example code"""
620
538
if state == avahi.SERVER_COLLISION:
621
logger.error(u"Zeroconf server name collision")
622
service.remove()
539
logger.warning(u"Server name collision")
540
remove_service()
623
541
elif state == avahi.SERVER_RUNNING:
624
service.add()
542
add_service()
625
543
626
544
627
545
def entry_group_state_changed(state, error):
628
546
"""Derived from the Avahi example code"""
629
logger.debug(u"Avahi state change: %i", state)
547
global serviceName, server, rename_count
548
549
logger.debug(u"state change: %i", state)
630
550
631
551
if state == avahi.ENTRY_GROUP_ESTABLISHED:
632
logger.debug(u"Zeroconf service established.")
552
logger.debug(u"Service established.")
633
553
elif state == avahi.ENTRY_GROUP_COLLISION:
634
logger.warning(u"Zeroconf service name collision.")
635
service.rename()
554
555
rename_count = rename_count - 1
556
if rename_count > 0:
557
name = server.GetAlternativeServiceName(name)
558
logger.warning(u"Service name collision, "
559
u"changing name to '%s' ...", name)
560
remove_service()
561
add_service()
562
563
else:
564
logger.error(u"No suitable service name found after %i"
565
u" retries, exiting.", n_rename)
566
killme(1)
636
567
elif state == avahi.ENTRY_GROUP_FAILURE:
637
logger.critical(u"Avahi: Error in group state changed %s",
638
unicode(error))
639
raise AvahiGroupError("State changed: %s", str(error))
568
logger.error(u"Error in group state changed %s",
569
unicode(error))
570
killme(1)
571
640
572
641
573
def if_nametoindex(interface):
642
"""Call the C function if_nametoindex(), or equivalent"""
643
global if_nametoindex
574
"""Call the C function if_nametoindex()"""
644
575
try:
645
if_nametoindex = ctypes.cdll.LoadLibrary\
646
(ctypes.util.find_library("c")).if_nametoindex
576
libc = ctypes.cdll.LoadLibrary("libc.so.6")
577
return libc.if_nametoindex(interface)
647
578
except (OSError, AttributeError):
648
579
if "struct" not in sys.modules:
649
580
import struct
650
581
if "fcntl" not in sys.modules:
651
582
import fcntl
652
def if_nametoindex(interface):
653
"Get an interface index the hard way, i.e. using fcntl()"
654
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
655
s = socket.socket()
656
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
657
struct.pack("16s16x", interface))
658
s.close()
659
interface_index = struct.unpack("I", ifreq[16:20])[0]
660
return interface_index
661
return if_nametoindex(interface)
662
663
664
def daemon(nochdir = False, noclose = False):
583
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
584
s = socket.socket()
585
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
586
struct.pack("16s16x", interface))
587
s.close()
588
interface_index = struct.unpack("I", ifreq[16:20])[0]
589
return interface_index
590
591
592
def daemon(nochdir, noclose):
665
593
"""See daemon(3). Standard BSD Unix function.
666
594
This should really exist as os.daemon, but it doesn't (yet)."""
667
595
if os.fork():
669
597
os.setsid()
670
598
if not nochdir:
671
599
os.chdir("/")
672
if os.fork():
673
sys.exit()
674
600
if not noclose:
675
601
# Close all standard open file descriptors
676
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
602
null = os.open("/dev/null", os.O_NOCTTY | os.O_RDWR)
677
603
if not stat.S_ISCHR(os.fstat(null).st_mode):
678
604
raise OSError(errno.ENODEV,
679
605
"/dev/null not a character device")
684
610
os.close(null)
685
611
686
612
613
def killme(status = 0):
614
logger.debug("Stopping server with exit status %d", status)
615
exitstatus = status
616
if main_loop_started:
617
main_loop.quit()
618
else:
619
sys.exit(status)
620
621
687
622
def main():
688
parser = OptionParser(version = "%%prog %s" % version)
623
global exitstatus
624
exitstatus = 0
625
global main_loop_started
626
main_loop_started = False
627
628
parser = OptionParser()
689
629
parser.add_option("-i", "--interface", type="string",
690
metavar="IF", help="Bind to interface IF")
691
parser.add_option("-a", "--address", type="string",
630
default=None, metavar="IF",
631
help="Bind to interface IF")
632
parser.add_option("-a", "--address", type="string", default=None,
692
633
help="Address to listen for requests on")
693
parser.add_option("-p", "--port", type="int",
634
parser.add_option("-p", "--port", type="int", default=None,
694
635
help="Port number to receive requests on")
695
636
parser.add_option("--check", action="store_true", default=False,
696
637
help="Run self-test")
697
parser.add_option("--debug", action="store_true",
698
help="Debug mode; run in foreground and log to"
699
" terminal")
700
parser.add_option("--priority", type="string", help="GnuTLS"
701
" priority string (see GnuTLS documentation)")
702
parser.add_option("--servicename", type="string", metavar="NAME",
703
help="Zeroconf service name")
704
parser.add_option("--configdir", type="string",
705
default="/etc/mandos", metavar="DIR",
706
help="Directory to search for configuration"
707
" files")
708
options = parser.parse_args()[0]
638
parser.add_option("--debug", action="store_true", default=False,
639
help="Debug mode")
640
parser.add_option("--priority", type="string",
641
default="SECURE256",
642
help="GnuTLS priority string"
643
" (see GnuTLS documentation)")
644
parser.add_option("--servicename", type="string",
645
default="Mandos", help="Zeroconf service name")
646
(options, args) = parser.parse_args()
709
647
710
648
if options.check:
711
649
import doctest
712
650
doctest.testmod()
713
651
sys.exit()
714
652
715
# Default values for config file for server-global settings
716
server_defaults = { "interface": "",
717
"address": "",
718
"port": "",
719
"debug": "False",
720
"priority":
721
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
722
"servicename": "Mandos",
723
}
724
725
# Parse config file for server-global settings
726
server_config = ConfigParser.SafeConfigParser(server_defaults)
727
del server_defaults
728
server_config.read(os.path.join(options.configdir, "mandos.conf"))
729
# Convert the SafeConfigParser object to a dict
730
server_settings = server_config.defaults()
731
# Use getboolean on the boolean config option
732
server_settings["debug"] = server_config.getboolean\
733
("DEFAULT", "debug")
734
del server_config
735
736
# Override the settings from the config file with command line
737
# options, if set.
738
for option in ("interface", "address", "port", "debug",
739
"priority", "servicename", "configdir"):
740
value = getattr(options, option)
741
if value is not None:
742
server_settings[option] = value
743
del options
744
# Now we have our good server settings in "server_settings"
745
746
debug = server_settings["debug"]
747
748
if not debug:
749
syslogger.setLevel(logging.WARNING)
750
console.setLevel(logging.WARNING)
751
752
if server_settings["servicename"] != "Mandos":
753
syslogger.setFormatter(logging.Formatter\
754
('Mandos (%s): %%(levelname)s:'
755
' %%(message)s'
756
% server_settings["servicename"]))
757
758
# Parse config file with clients
759
client_defaults = { "timeout": "1h",
760
"interval": "5m",
761
"checker": "fping -q -- %(host)s",
762
"host": "",
763
}
764
client_config = ConfigParser.SafeConfigParser(client_defaults)
765
client_config.read(os.path.join(server_settings["configdir"],
766
"clients.conf"))
767
768
clients = Set()
769
tcp_server = IPv6_TCPServer((server_settings["address"],
770
server_settings["port"]),
771
TCP_handler,
772
settings=server_settings,
773
clients=clients)
774
pidfilename = "/var/run/mandos.pid"
775
try:
776
pidfile = open(pidfilename, "w")
777
except IOError, error:
778
logger.error("Could not open file %r", pidfilename)
779
780
uid = 65534
781
gid = 65534
782
try:
783
uid = pwd.getpwnam("mandos").pw_uid
784
except KeyError:
785
try:
786
uid = pwd.getpwnam("nobody").pw_uid
787
except KeyError:
788
pass
789
try:
790
gid = pwd.getpwnam("mandos").pw_gid
791
except KeyError:
792
try:
793
gid = pwd.getpwnam("nogroup").pw_gid
794
except KeyError:
795
pass
796
try:
797
os.setuid(uid)
798
os.setgid(gid)
799
except OSError, error:
800
if error[0] != errno.EPERM:
801
raise error
802
803
global service
804
service = AvahiService(name = server_settings["servicename"],
805
servicetype = "_mandos._tcp", )
806
if server_settings["interface"]:
807
service.interface = if_nametoindex\
808
(server_settings["interface"])
653
# Parse config file
654
defaults = { "timeout": "1h",
655
"interval": "5m",
656
"checker": "fping -q -- %%(fqdn)s",
657
}
658
client_config = ConfigParser.SafeConfigParser(defaults)
659
#client_config.readfp(open("global.conf"), "global.conf")
660
client_config.read("mandos-clients.conf")
661
662
global serviceName
663
serviceName = options.servicename;
809
664
810
665
global main_loop
811
666
global bus
814
669
DBusGMainLoop(set_as_default=True )
815
670
main_loop = gobject.MainLoop()
816
671
bus = dbus.SystemBus()
817
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
818
avahi.DBUS_PATH_SERVER),
819
avahi.DBUS_INTERFACE_SERVER)
672
server = dbus.Interface(
673
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
674
avahi.DBUS_INTERFACE_SERVER )
820
675
# End of Avahi example code
821
676
677
debug = options.debug
678
679
if debug:
680
console = logging.StreamHandler()
681
# console.setLevel(logging.DEBUG)
682
console.setFormatter(logging.Formatter\
683
('%(levelname)s: %(message)s'))
684
logger.addHandler(console)
685
del console
686
687
clients = Set()
822
688
def remove_from_clients(client):
823
689
clients.remove(client)
824
690
if not clients:
825
logger.critical(u"No clients left, exiting")
826
sys.exit()
691
logger.debug(u"No clients left, exiting")
692
killme()
827
693
828
clients.update(Set(Client(name = section,
694
clients.update(Set(Client(name=section,
829
695
stop_hook = remove_from_clients,
830
config
831
= dict(client_config.items(section)))
696
**(dict(client_config\
697
.items(section))))
832
698
for section in client_config.sections()))
833
if not clients:
834
logger.critical(u"No clients defined")
835
sys.exit(1)
836
837
if debug:
838
# Redirect stdin so all checkers get /dev/null
839
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
840
os.dup2(null, sys.stdin.fileno())
841
if null > 2:
842
os.close(null)
843
else:
844
# No console logging
845
logger.removeHandler(console)
846
# Close all input and output, do double fork, etc.
847
daemon()
848
849
try:
850
pid = os.getpid()
851
pidfile.write(str(pid) + "\n")
852
pidfile.close()
853
del pidfile
854
except IOError:
855
logger.error(u"Could not write to file %r with PID %d",
856
pidfilename, pid)
857
except NameError:
858
# "pidfile" was never created
859
pass
860
del pidfilename
699
700
if not debug:
701
daemon(False, False)
861
702
862
703
def cleanup():
863
704
"Cleanup function; run on exit"
877
718
878
719
if not debug:
879
720
signal.signal(signal.SIGINT, signal.SIG_IGN)
880
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
881
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
721
signal.signal(signal.SIGHUP, lambda signum, frame: killme())
722
signal.signal(signal.SIGTERM, lambda signum, frame: killme())
882
723
883
724
for client in clients:
884
725
client.start()
885
726
886
tcp_server.enable()
887
tcp_server.server_activate()
888
889
# Find out what port we got
890
service.port = tcp_server.socket.getsockname()[1]
891
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
892
u" scope_id %d" % tcp_server.socket.getsockname())
893
894
#service.interface = tcp_server.socket.getsockname()[3]
895
896
try:
897
# From the Avahi example code
898
server.connect_to_signal("StateChanged", server_state_changed)
899
try:
900
server_state_changed(server.GetState())
901
except dbus.exceptions.DBusException, error:
902
logger.critical(u"DBusException: %s", error)
903
sys.exit(1)
904
# End of Avahi example code
905
906
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
907
lambda *args, **kwargs:
908
tcp_server.handle_request\
909
(*args[2:], **kwargs) or True)
910
911
logger.debug(u"Starting main loop")
727
tcp_server = IPv6_TCPServer((options.address, options.port),
728
tcp_handler,
729
options=options,
730
clients=clients)
731
# Find out what random port we got
732
global servicePort
733
servicePort = tcp_server.socket.getsockname()[1]
734
logger.debug(u"Now listening on port %d", servicePort)
735
736
if options.interface is not None:
737
global serviceInterface
738
serviceInterface = if_nametoindex(options.interface)
739
740
# From the Avahi example code
741
server.connect_to_signal("StateChanged", server_state_changed)
742
try:
743
server_state_changed(server.GetState())
744
except dbus.exceptions.DBusException, error:
745
logger.critical(u"DBusException: %s", error)
746
killme(1)
747
# End of Avahi example code
748
749
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
750
lambda *args, **kwargs:
751
tcp_server.handle_request(*args[2:],
752
**kwargs) or True)
753
try:
754
logger.debug("Starting main loop")
755
main_loop_started = True
912
756
main_loop.run()
913
except AvahiError, error:
914
logger.critical(u"AvahiError: %s" + unicode(error))
915
sys.exit(1)
916
757
except KeyboardInterrupt:
917
758
if debug:
918
759
print
760
761
sys.exit(exitstatus)
919
762
920
763
if __name__ == '__main__':
921
764
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0