98
98
class AvahiService(object):
99
"""An Avahi (Zeroconf) service.
101
100
interface: integer; avahi.IF_UNSPEC or an interface index.
102
101
Used to optionally bind to the specified interface.
103
name: string; Example: 'Mandos'
104
type: string; Example: '_mandos._tcp'.
105
See <http://www.dns-sd.org/ServiceTypes.html>
106
port: integer; what port to announce
107
TXT: list of strings; TXT record for the service
108
domain: string; Domain to publish on, default to .local if empty.
109
host: string; Host to publish records for, default is localhost
110
max_renames: integer; maximum number of renames
111
rename_count: integer; counter so we only rename after collisions
112
a sensible number of times
102
name = string; Example: "Mandos"
103
type = string; Example: "_mandos._tcp".
104
See <http://www.dns-sd.org/ServiceTypes.html>
105
port = integer; what port to announce
106
TXT = list of strings; TXT record for the service
107
domain = string; Domain to publish on, default to .local if empty.
108
host = string; Host to publish records for, default to localhost
110
max_renames = integer; maximum number of renames
111
rename_count = integer; counter so we only rename after collisions
112
a sensible number of times
114
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
115
type = None, port = None, TXT = None, domain = "",
116
host = "", max_renames = 12):
117
"""An Avahi (Zeroconf) service. """
117
118
self.interface = interface
119
self.type = servicetype
121
self.TXT = TXT if TXT is not None else []
122
126
self.domain = domain
124
128
self.rename_count = 0
125
self.max_renames = max_renames
126
129
def rename(self):
127
130
"""Derived from the Avahi example code"""
128
131
if self.rename_count >= self.max_renames:
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
132
raise AvahiServiceError(u"Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
136
syslogger.setFormatter(logging.Formatter
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
132
logger.critical(u"No suitable service name found after %i"
133
u" retries, exiting.", rename_count)
134
raise AvahiServiceError("Too many renames")
135
name = server.GetAlternativeServiceName(name)
136
logger.notice(u"Changing name to %r ...", name)
141
139
self.rename_count += 1
170
168
# End of Avahi example code
173
def _datetime_to_dbus(dt, variant_level=0):
174
"""Convert a UTC datetime.datetime() to a D-Bus type."""
175
return dbus.String(dt.isoformat(), variant_level=variant_level)
178
class Client(dbus.service.Object):
171
class Client(object):
179
172
"""A representation of a client host served by this server.
181
name: string; from the config file, used in log messages and
174
name: string; from the config file, used in log messages
183
175
fingerprint: string (40 or 32 hexadecimal digits); used to
184
176
uniquely identify the client
185
secret: bytestring; sent verbatim (over TLS) to client
186
host: string; available for use by the checker command
187
created: datetime.datetime(); (UTC) object creation
188
last_enabled: datetime.datetime(); (UTC)
190
last_checked_ok: datetime.datetime(); (UTC) or None
191
timeout: datetime.timedelta(); How long from last_checked_ok
192
until this client is invalid
193
interval: datetime.timedelta(); How often to start a new checker
194
disable_hook: If set, called by disable() as disable_hook(self)
195
checker: subprocess.Popen(); a running checker process used
196
to see if the client lives.
197
'None' if no process is running.
177
secret: bytestring; sent verbatim (over TLS) to client
178
fqdn: string (FQDN); available for use by the checker command
179
created: datetime.datetime(); object creation, not client host
180
last_checked_ok: datetime.datetime() or None if not yet checked OK
181
timeout: datetime.timedelta(); How long from last_checked_ok
182
until this client is invalid
183
interval: datetime.timedelta(); How often to start a new checker
184
stop_hook: If set, called by stop() as stop_hook(self)
185
checker: subprocess.Popen(); a running checker process used
186
to see if the client lives.
187
'None' if no process is running.
198
188
checker_initiator_tag: a gobject event source tag, or None
199
disable_initiator_tag: - '' -
189
stop_initiator_tag: - '' -
200
190
checker_callback_tag: - '' -
201
191
checker_command: string; External command which is run to check if
202
192
client lives. %() expansions are done at
203
193
runtime with vars(self) as dict, so that for
204
194
instance %(name)s can be used in the command.
205
use_dbus: bool(); Whether to provide D-Bus interface and signals
206
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
196
_timeout: Real variable for 'timeout'
197
_interval: Real variable for 'interval'
198
_timeout_milliseconds: Used when calling gobject.timeout_add()
199
_interval_milliseconds: - '' -
208
def timeout_milliseconds(self):
209
"Return the 'timeout' attribute in milliseconds"
210
return ((self.timeout.days * 24 * 60 * 60 * 1000)
211
+ (self.timeout.seconds * 1000)
212
+ (self.timeout.microseconds // 1000))
214
def interval_milliseconds(self):
215
"Return the 'interval' attribute in milliseconds"
216
return ((self.interval.days * 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds * 1000)
218
+ (self.interval.microseconds // 1000))
220
def __init__(self, name = None, disable_hook=None, config=None,
222
"""Note: the 'checker' key in 'config' sets the
223
'checker_command' attribute and *not* the 'checker'
201
def _set_timeout(self, timeout):
202
"Setter function for 'timeout' attribute"
203
self._timeout = timeout
204
self._timeout_milliseconds = ((self.timeout.days
205
* 24 * 60 * 60 * 1000)
206
+ (self.timeout.seconds * 1000)
207
+ (self.timeout.microseconds
209
timeout = property(lambda self: self._timeout,
212
def _set_interval(self, interval):
213
"Setter function for 'interval' attribute"
214
self._interval = interval
215
self._interval_milliseconds = ((self.interval.days
216
* 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds
219
+ (self.interval.microseconds
221
interval = property(lambda self: self._interval,
224
def __init__(self, name=None, stop_hook=None, fingerprint=None,
225
secret=None, secfile=None, fqdn=None, timeout=None,
226
interval=-1, checker=None):
227
"""Note: the 'checker' argument sets the 'checker_command'
228
attribute and not the 'checker' attribute.."""
228
230
logger.debug(u"Creating client %r", self.name)
229
self.use_dbus = False # During __init__
230
# Uppercase and remove spaces from fingerprint for later
231
# comparison purposes with return value from the fingerprint()
233
self.fingerprint = (config["fingerprint"].upper()
231
# Uppercase and remove spaces from fingerprint
232
# for later comparison purposes with return value of
233
# the fingerprint() function
234
self.fingerprint = fingerprint.upper().replace(u" ", u"")
235
235
logger.debug(u" Fingerprint: %s", self.fingerprint)
236
if "secret" in config:
237
self.secret = config["secret"].decode(u"base64")
238
elif "secfile" in config:
239
with closing(open(os.path.expanduser
241
(config["secfile"])))) as secfile:
242
self.secret = secfile.read()
237
self.secret = secret.decode(u"base64")
240
self.secret = sf.read()
244
243
raise TypeError(u"No secret or secfile for client %s"
246
self.host = config.get("host", "")
247
self.created = datetime.datetime.utcnow()
249
self.last_enabled = None
246
self.created = datetime.datetime.now()
250
247
self.last_checked_ok = None
251
self.timeout = string_to_delta(config["timeout"])
252
self.interval = string_to_delta(config["interval"])
253
self.disable_hook = disable_hook
248
self.timeout = string_to_delta(timeout)
249
self.interval = string_to_delta(interval)
250
self.stop_hook = stop_hook
254
251
self.checker = None
255
252
self.checker_initiator_tag = None
256
self.disable_initiator_tag = None
253
self.stop_initiator_tag = None
257
254
self.checker_callback_tag = None
258
self.checker_command = config["checker"]
259
self.last_connect = None
260
# Only now, when this client is initialized, can it show up on
262
self.use_dbus = use_dbus
264
self.dbus_object_path = (dbus.ObjectPath
266
+ self.name.replace(".", "_")))
267
dbus.service.Object.__init__(self, bus,
268
self.dbus_object_path)
255
self.check_command = checker
271
257
"""Start this client's checker and timeout hooks"""
272
self.last_enabled = datetime.datetime.utcnow()
273
258
# Schedule a new checker to be started an 'interval' from now,
274
259
# and every interval from then on.
275
self.checker_initiator_tag = (gobject.timeout_add
276
(self.interval_milliseconds(),
260
self.checker_initiator_tag = gobject.timeout_add\
261
(self._interval_milliseconds,
278
263
# Also start a new checker *right now*.
279
264
self.start_checker()
280
# Schedule a disable() when 'timeout' has passed
281
self.disable_initiator_tag = (gobject.timeout_add
282
(self.timeout_milliseconds(),
287
self.PropertyChanged(dbus.String(u"enabled"),
288
dbus.Boolean(True, variant_level=1))
289
self.PropertyChanged(dbus.String(u"last_enabled"),
290
(_datetime_to_dbus(self.last_enabled,
294
"""Disable this client."""
295
if not getattr(self, "enabled", False):
265
# Schedule a stop() when 'timeout' has passed
266
self.stop_initiator_tag = gobject.timeout_add\
267
(self._timeout_milliseconds,
271
The possibility that a client might be restarted is left open,
272
but not currently used."""
273
# If this client doesn't have a secret, it is already stopped.
275
logger.debug(u"Stopping client %s", self.name)
297
logger.info(u"Disabling client %s", self.name)
298
if getattr(self, "disable_initiator_tag", False):
299
gobject.source_remove(self.disable_initiator_tag)
300
self.disable_initiator_tag = None
279
if getattr(self, "stop_initiator_tag", False):
280
gobject.source_remove(self.stop_initiator_tag)
281
self.stop_initiator_tag = None
301
282
if getattr(self, "checker_initiator_tag", False):
302
283
gobject.source_remove(self.checker_initiator_tag)
303
284
self.checker_initiator_tag = None
304
285
self.stop_checker()
305
if self.disable_hook:
306
self.disable_hook(self)
310
self.PropertyChanged(dbus.String(u"enabled"),
311
dbus.Boolean(False, variant_level=1))
312
288
# Do not run this again if called by a gobject.timeout_add
315
290
def __del__(self):
316
self.disable_hook = None
319
def checker_callback(self, pid, condition, command):
291
self.stop_hook = None
293
def checker_callback(self, pid, condition):
320
294
"""The checker has completed, so take appropriate actions."""
295
now = datetime.datetime.now()
321
296
self.checker_callback_tag = None
322
297
self.checker = None
325
self.PropertyChanged(dbus.String(u"checker_running"),
326
dbus.Boolean(False, variant_level=1))
327
if os.WIFEXITED(condition):
328
exitstatus = os.WEXITSTATUS(condition)
330
logger.info(u"Checker for %(name)s succeeded",
334
logger.info(u"Checker for %(name)s failed",
338
self.CheckerCompleted(dbus.Int16(exitstatus),
339
dbus.Int64(condition),
340
dbus.String(command))
298
if os.WIFEXITED(condition) \
299
and (os.WEXITSTATUS(condition) == 0):
300
logger.debug(u"Checker for %(name)s succeeded",
302
self.last_checked_ok = now
303
gobject.source_remove(self.stop_initiator_tag)
304
self.stop_initiator_tag = gobject.timeout_add\
305
(self._timeout_milliseconds,
307
elif not os.WIFEXITED(condition):
342
308
logger.warning(u"Checker for %(name)s crashed?",
346
self.CheckerCompleted(dbus.Int16(-1),
347
dbus.Int64(condition),
348
dbus.String(command))
350
def checked_ok(self):
351
"""Bump up the timeout for this client.
352
This should only be called when the client has been seen,
355
self.last_checked_ok = datetime.datetime.utcnow()
356
gobject.source_remove(self.disable_initiator_tag)
357
self.disable_initiator_tag = (gobject.timeout_add
358
(self.timeout_milliseconds(),
362
self.PropertyChanged(
363
dbus.String(u"last_checked_ok"),
364
(_datetime_to_dbus(self.last_checked_ok,
311
logger.debug(u"Checker for %(name)s failed",
367
313
def start_checker(self):
368
314
"""Start a new checker subprocess if one is not running.
369
315
If a checker already exists, leave it running and do
434
368
if error.errno != errno.ESRCH: # No such process
436
370
self.checker = None
438
self.PropertyChanged(dbus.String(u"checker_running"),
439
dbus.Boolean(False, variant_level=1))
441
371
def still_valid(self):
442
372
"""Has the timeout not yet passed for this client?"""
443
if not getattr(self, "enabled", False):
445
now = datetime.datetime.utcnow()
373
now = datetime.datetime.now()
446
374
if self.last_checked_ok is None:
447
375
return now < (self.created + self.timeout)
449
377
return now < (self.last_checked_ok + self.timeout)
451
## D-Bus methods & signals
452
_interface = u"se.bsnet.fukt.Mandos.Client"
455
CheckedOK = dbus.service.method(_interface)(checked_ok)
456
CheckedOK.__name__ = "CheckedOK"
458
# CheckerCompleted - signal
459
@dbus.service.signal(_interface, signature="nxs")
460
def CheckerCompleted(self, exitcode, waitstatus, command):
464
# CheckerStarted - signal
465
@dbus.service.signal(_interface, signature="s")
466
def CheckerStarted(self, command):
470
# GetAllProperties - method
471
@dbus.service.method(_interface, out_signature="a{sv}")
472
def GetAllProperties(self):
474
return dbus.Dictionary({
476
dbus.String(self.name, variant_level=1),
477
dbus.String("fingerprint"):
478
dbus.String(self.fingerprint, variant_level=1),
480
dbus.String(self.host, variant_level=1),
481
dbus.String("created"):
482
_datetime_to_dbus(self.created, variant_level=1),
483
dbus.String("last_enabled"):
484
(_datetime_to_dbus(self.last_enabled,
486
if self.last_enabled is not None
487
else dbus.Boolean(False, variant_level=1)),
488
dbus.String("enabled"):
489
dbus.Boolean(self.enabled, variant_level=1),
490
dbus.String("last_checked_ok"):
491
(_datetime_to_dbus(self.last_checked_ok,
493
if self.last_checked_ok is not None
494
else dbus.Boolean (False, variant_level=1)),
495
dbus.String("timeout"):
496
dbus.UInt64(self.timeout_milliseconds(),
498
dbus.String("interval"):
499
dbus.UInt64(self.interval_milliseconds(),
501
dbus.String("checker"):
502
dbus.String(self.checker_command,
504
dbus.String("checker_running"):
505
dbus.Boolean(self.checker is not None,
507
dbus.String("object_path"):
508
dbus.ObjectPath(self.dbus_object_path,
512
# IsStillValid - method
513
IsStillValid = (dbus.service.method(_interface, out_signature="b")
515
IsStillValid.__name__ = "IsStillValid"
517
# PropertyChanged - signal
518
@dbus.service.signal(_interface, signature="sv")
519
def PropertyChanged(self, property, value):
523
# SetChecker - method
524
@dbus.service.method(_interface, in_signature="s")
525
def SetChecker(self, checker):
526
"D-Bus setter method"
527
self.checker_command = checker
529
self.PropertyChanged(dbus.String(u"checker"),
530
dbus.String(self.checker_command,
534
@dbus.service.method(_interface, in_signature="s")
535
def SetHost(self, host):
536
"D-Bus setter method"
539
self.PropertyChanged(dbus.String(u"host"),
540
dbus.String(self.host, variant_level=1))
542
# SetInterval - method
543
@dbus.service.method(_interface, in_signature="t")
544
def SetInterval(self, milliseconds):
545
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
547
self.PropertyChanged(dbus.String(u"interval"),
548
(dbus.UInt64(self.interval_milliseconds(),
552
@dbus.service.method(_interface, in_signature="ay",
554
def SetSecret(self, secret):
555
"D-Bus setter method"
556
self.secret = str(secret)
558
# SetTimeout - method
559
@dbus.service.method(_interface, in_signature="t")
560
def SetTimeout(self, milliseconds):
561
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
563
self.PropertyChanged(dbus.String(u"timeout"),
564
(dbus.UInt64(self.timeout_milliseconds(),
568
Enable = dbus.service.method(_interface)(enable)
569
Enable.__name__ = "Enable"
571
# StartChecker - method
572
@dbus.service.method(_interface)
573
def StartChecker(self):
578
@dbus.service.method(_interface)
583
# StopChecker - method
584
StopChecker = dbus.service.method(_interface)(stop_checker)
585
StopChecker.__name__ = "StopChecker"
590
380
def peer_certificate(session):
591
381
"Return the peer's OpenPGP certificate as a bytestring"
592
382
# If not an OpenPGP certificate...
593
if (gnutls.library.functions
594
.gnutls_certificate_type_get(session._c_object)
595
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
383
if gnutls.library.functions.gnutls_certificate_type_get\
384
(session._c_object) \
385
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
596
386
# ...do the normal thing
597
387
return session.peer_certificate
598
list_size = ctypes.c_uint(1)
599
cert_list = (gnutls.library.functions
600
.gnutls_certificate_get_peers
601
(session._c_object, ctypes.byref(list_size)))
602
if not bool(cert_list) and list_size.value != 0:
603
raise gnutls.errors.GNUTLSError("error getting peer"
388
list_size = ctypes.c_uint()
389
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
390
(session._c_object, ctypes.byref(list_size))
605
391
if list_size.value == 0:
607
393
cert = cert_list[0]
611
397
def fingerprint(openpgp):
612
398
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
613
# New GnuTLS "datum" with the OpenPGP public key
614
datum = (gnutls.library.types
615
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
618
ctypes.c_uint(len(openpgp))))
619
399
# New empty GnuTLS certificate
620
400
crt = gnutls.library.types.gnutls_openpgp_crt_t()
621
(gnutls.library.functions
622
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
401
gnutls.library.functions.gnutls_openpgp_crt_init\
403
# New GnuTLS "datum" with the OpenPGP public key
404
datum = gnutls.library.types.gnutls_datum_t\
405
(ctypes.cast(ctypes.c_char_p(openpgp),
406
ctypes.POINTER(ctypes.c_ubyte)),
407
ctypes.c_uint(len(openpgp)))
623
408
# Import the OpenPGP public key into the certificate
624
(gnutls.library.functions
625
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
626
gnutls.library.constants
627
.GNUTLS_OPENPGP_FMT_RAW))
628
# Verify the self signature in the key
629
crtverify = ctypes.c_uint()
630
(gnutls.library.functions
631
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
632
if crtverify.value != 0:
633
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
634
raise gnutls.errors.CertificateSecurityError("Verify failed")
409
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
412
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
635
413
# New buffer for the fingerprint
636
buf = ctypes.create_string_buffer(20)
637
buf_len = ctypes.c_size_t()
414
buffer = ctypes.create_string_buffer(20)
415
buffer_length = ctypes.c_size_t()
638
416
# Get the fingerprint from the certificate into the buffer
639
(gnutls.library.functions
640
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
641
ctypes.byref(buf_len)))
417
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
418
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
642
419
# Deinit the certificate
643
420
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
644
421
# Convert the buffer to a Python bytestring
645
fpr = ctypes.string_at(buf, buf_len.value)
422
fpr = ctypes.string_at(buffer, buffer_length.value)
646
423
# Convert the bytestring to hexadecimal notation
647
424
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
651
class TCP_handler(SocketServer.BaseRequestHandler, object):
428
class tcp_handler(SocketServer.BaseRequestHandler, object):
652
429
"""A TCP request handler class.
653
430
Instantiated by IPv6_TCPServer for each request to handle it.
654
431
Note: This will run in its own forked process."""
656
433
def handle(self):
657
logger.info(u"TCP connection from: %s",
658
unicode(self.client_address))
659
session = (gnutls.connection
660
.ClientSession(self.request,
664
line = self.request.makefile().readline()
665
logger.debug(u"Protocol version: %r", line)
667
if int(line.strip().split()[0]) > 1:
669
except (ValueError, IndexError, RuntimeError), error:
670
logger.error(u"Unknown protocol version: %s", error)
434
logger.debug(u"TCP connection from: %s",
435
unicode(self.client_address))
436
session = gnutls.connection.ClientSession\
437
(self.request, gnutls.connection.X509Credentials())
673
438
# Note: gnutls.connection.X509Credentials is really a generic
674
439
# GnuTLS certificate credentials object so long as no X.509
675
440
# keys are added to it. Therefore, we can use it here despite
678
443
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
679
444
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
681
# Use a fallback default, since this MUST be set.
682
priority = self.server.settings.get("priority", "NORMAL")
683
(gnutls.library.functions
684
.gnutls_priority_set_direct(session._c_object,
446
priority = "NORMAL" # Fallback default, since this
448
if self.server.settings["priority"]:
449
priority = self.server.settings["priority"]
450
gnutls.library.functions.gnutls_priority_set_direct\
451
(session._c_object, priority, None);
688
454
session.handshake()
689
455
except gnutls.errors.GNUTLSError, error:
690
logger.warning(u"Handshake failed: %s", error)
456
logger.debug(u"Handshake failed: %s", error)
691
457
# Do not run session.bye() here: the session is not
692
458
# established. Just abandon the request.
694
logger.debug(u"Handshake succeeded")
696
461
fpr = fingerprint(peer_certificate(session))
697
462
except (TypeError, gnutls.errors.GNUTLSError), error:
698
logger.warning(u"Bad certificate: %s", error)
463
logger.debug(u"Bad certificate: %s", error)
701
466
logger.debug(u"Fingerprint: %s", fpr)
702
468
for c in self.server.clients:
703
469
if c.fingerprint == fpr:
707
logger.warning(u"Client not found for fingerprint: %s",
473
logger.debug(u"Client not found for fingerprint: %s", fpr)
711
476
# Have to check if client.still_valid(), since it is possible
712
477
# that the client timed out while establishing the GnuTLS
714
479
if not client.still_valid():
715
logger.warning(u"Client %(name)s is invalid",
480
logger.debug(u"Client %(name)s is invalid", vars(client))
719
## This won't work here, since we're in a fork.
720
# client.checked_ok()
722
484
while sent_size < len(client.secret):
723
485
sent = session.send(client.secret[sent_size:])
839
581
def entry_group_state_changed(state, error):
840
582
"""Derived from the Avahi example code"""
841
logger.debug(u"Avahi state change: %i", state)
583
logger.debug(u"state change: %i", state)
843
585
if state == avahi.ENTRY_GROUP_ESTABLISHED:
844
logger.debug(u"Zeroconf service established.")
586
logger.debug(u"Service established.")
845
587
elif state == avahi.ENTRY_GROUP_COLLISION:
846
logger.warning(u"Zeroconf service name collision.")
588
logger.warning(u"Service name collision.")
848
590
elif state == avahi.ENTRY_GROUP_FAILURE:
849
logger.critical(u"Avahi: Error in group state changed %s",
591
logger.critical(u"Error in group state changed %s",
851
raise AvahiGroupError(u"State changed: %s" % unicode(error))
593
raise AvahiGroupError("State changed: %s", str(error))
853
def if_nametoindex(interface):
595
def if_nametoindex(interface, _func=[None]):
854
596
"""Call the C function if_nametoindex(), or equivalent"""
855
global if_nametoindex
597
if _func[0] is not None:
598
return _func[0](interface)
857
if_nametoindex = (ctypes.cdll.LoadLibrary
858
(ctypes.util.find_library("c"))
600
if "ctypes.util" not in sys.modules:
604
libc = ctypes.cdll.LoadLibrary\
605
(ctypes.util.find_library("c"))
606
func[0] = libc.if_nametoindex
607
return _func[0](interface)
860
611
except (OSError, AttributeError):
861
612
if "struct" not in sys.modules:
863
614
if "fcntl" not in sys.modules:
865
def if_nametoindex(interface):
616
def the_hard_way(interface):
866
617
"Get an interface index the hard way, i.e. using fcntl()"
867
618
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
868
with closing(socket.socket()) as s:
869
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
870
struct.pack("16s16x", interface))
620
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
621
struct.pack("16s16x", interface))
871
623
interface_index = struct.unpack("I", ifreq[16:20])[0]
872
624
return interface_index
873
return if_nametoindex(interface)
876
def daemon(nochdir = False, noclose = False):
625
_func[0] = the_hard_way
626
return _func[0](interface)
629
def daemon(nochdir, noclose):
877
630
"""See daemon(3). Standard BSD Unix function.
878
631
This should really exist as os.daemon, but it doesn't (yet)."""
937
687
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
938
688
"servicename": "Mandos",
942
691
# Parse config file for server-global settings
943
692
server_config = ConfigParser.SafeConfigParser(server_defaults)
944
693
del server_defaults
945
server_config.read(os.path.join(options.configdir, "mandos.conf"))
694
server_config.read(os.path.join(options.configdir, "server.conf"))
695
server_section = "server"
946
696
# Convert the SafeConfigParser object to a dict
947
server_settings = server_config.defaults()
948
# Use the appropriate methods on the non-string config options
949
server_settings["debug"] = server_config.getboolean("DEFAULT",
951
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
953
if server_settings["port"]:
954
server_settings["port"] = server_config.getint("DEFAULT",
697
server_settings = dict(server_config.items(server_section))
698
# Use getboolean on the boolean config option
699
server_settings["debug"] = server_config.getboolean\
700
(server_section, "debug")
956
701
del server_config
702
if not server_settings["interface"]:
703
server_settings["interface"] = avahi.IF_UNSPEC
958
705
# Override the settings from the config file with command line
959
706
# options, if set.
960
707
for option in ("interface", "address", "port", "debug",
961
"priority", "servicename", "configdir",
708
"priority", "servicename", "configdir"):
963
709
value = getattr(options, option)
964
710
if value is not None:
965
711
server_settings[option] = value
967
713
# Now we have our good server settings in "server_settings"
970
debug = server_settings["debug"]
971
use_dbus = server_settings["use_dbus"]
974
syslogger.setLevel(logging.WARNING)
975
console.setLevel(logging.WARNING)
977
if server_settings["servicename"] != "Mandos":
978
syslogger.setFormatter(logging.Formatter
979
('Mandos (%s): %%(levelname)s:'
981
% server_settings["servicename"]))
983
715
# Parse config file with clients
984
716
client_defaults = { "timeout": "1h",
985
717
"interval": "5m",
986
"checker": "fping -q -- %%(host)s",
718
"checker": "fping -q -- %%(fqdn)s",
989
720
client_config = ConfigParser.SafeConfigParser(client_defaults)
990
721
client_config.read(os.path.join(server_settings["configdir"],
994
tcp_server = IPv6_TCPServer((server_settings["address"],
995
server_settings["port"]),
997
settings=server_settings,
999
pidfilename = "/var/run/mandos.pid"
1001
pidfile = open(pidfilename, "w")
1002
except IOError, error:
1003
logger.error("Could not open file %r", pidfilename)
1006
uid = pwd.getpwnam("_mandos").pw_uid
1007
gid = pwd.getpwnam("_mandos").pw_gid
1010
uid = pwd.getpwnam("mandos").pw_uid
1011
gid = pwd.getpwnam("mandos").pw_gid
1014
uid = pwd.getpwnam("nobody").pw_uid
1015
gid = pwd.getpwnam("nogroup").pw_gid
1022
except OSError, error:
1023
if error[0] != errno.EPERM:
1027
725
service = AvahiService(name = server_settings["servicename"],
1028
servicetype = "_mandos._tcp", )
1029
if server_settings["interface"]:
1030
service.interface = (if_nametoindex
1031
(server_settings["interface"]))
726
type = "_mandos._tcp", );
1033
728
global main_loop
1098
784
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1099
785
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1102
class MandosServer(dbus.service.Object):
1103
"""A D-Bus proxy object"""
1105
dbus.service.Object.__init__(self, bus, "/")
1106
_interface = u"se.bsnet.fukt.Mandos"
1108
@dbus.service.signal(_interface, signature="oa{sv}")
1109
def ClientAdded(self, objpath, properties):
1113
@dbus.service.signal(_interface, signature="os")
1114
def ClientRemoved(self, objpath, name):
1118
@dbus.service.method(_interface, out_signature="ao")
1119
def GetAllClients(self):
1121
return dbus.Array(c.dbus_object_path for c in clients)
1123
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1124
def GetAllClientsWithProperties(self):
1126
return dbus.Dictionary(
1127
((c.dbus_object_path, c.GetAllProperties())
1131
@dbus.service.method(_interface, in_signature="o")
1132
def RemoveClient(self, object_path):
1135
if c.dbus_object_path == object_path:
1137
# Don't signal anything except ClientRemoved
1141
self.ClientRemoved(object_path, c.name)
1147
mandos_server = MandosServer()
1149
787
for client in clients:
1152
mandos_server.ClientAdded(client.dbus_object_path,
1153
client.GetAllProperties())
1157
tcp_server.server_activate()
790
tcp_server = IPv6_TCPServer((server_settings["address"],
791
server_settings["port"]),
793
settings=server_settings,
1159
795
# Find out what port we got
1160
796
service.port = tcp_server.socket.getsockname()[1]
1161
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1162
u" scope_id %d" % tcp_server.socket.getsockname())
797
logger.debug(u"Now listening on port %d", service.port)
1164
#service.interface = tcp_server.socket.getsockname()[3]
799
if not server_settings["interface"]:
800
service.interface = if_nametoindex\
801
(server_settings["interface"])
1167
804
# From the Avahi example code