To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 3
- compare with another revision
- download diff
- download tarball
- view history from revision 3
- Committer: Björn Påhlsson
- Date: 2007-12-11 23:40:35 UTC
- Revision ID: belorn@braxen-20071211234035-m1nsu41vuzkak69h
Python based server
Added client configfile
Added client configfile
- files added:
- bad-ca.pem
- files removed:
- COPYING
- plugins.d
- files renamed:
- clients.conf => mandos-clients.conf
- mandos => server.py
- files modified:
- Makefile
added
removed
server.py
1
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
# Mandos server - give out binary blobs to connecting clients.
5
#
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
#
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
15
#
16
# This program is free software: you can redistribute it and/or modify
17
# it under the terms of the GNU General Public License as published by
18
# the Free Software Foundation, either version 3 of the License, or
19
# (at your option) any later version.
20
#
21
# This program is distributed in the hope that it will be useful,
22
# but WITHOUT ANY WARRANTY; without even the implied warranty of
23
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24
# GNU General Public License for more details.
25
#
26
# You should have received a copy of the GNU General Public License
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
28
#
29
# Contact the authors at <mandos@fukt.bsnet.se>.
30
#
31
32
from __future__ import division
33
2
34
3
import SocketServer
35
4
import socket
40
9
import gnutls.crypto
41
10
import gnutls.connection
42
11
import gnutls.errors
43
import gnutls.library.functions
44
import gnutls.library.constants
45
import gnutls.library.types
46
12
import ConfigParser
47
import sys
48
import re
49
import os
50
import signal
51
from sets import Set
52
import subprocess
53
import atexit
54
import stat
55
import logging
56
import logging.handlers
57
58
import dbus
59
import gobject
60
import avahi
61
from dbus.mainloop.glib import DBusGMainLoop
62
import ctypes
63
64
version = "1.0"
65
66
logger = logging.Logger('mandos')
67
syslogger = logging.handlers.SysLogHandler\
68
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
69
address = "/dev/log")
70
syslogger.setFormatter(logging.Formatter\
71
('Mandos: %(levelname)s: %(message)s'))
72
logger.addHandler(syslogger)
73
74
console = logging.StreamHandler()
75
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
76
' %(message)s'))
77
logger.addHandler(console)
78
79
class AvahiError(Exception):
80
def __init__(self, value):
81
self.value = value
82
def __str__(self):
83
return repr(self.value)
84
85
class AvahiServiceError(AvahiError):
86
pass
87
88
class AvahiGroupError(AvahiError):
89
pass
90
91
92
class AvahiService(object):
93
"""An Avahi (Zeroconf) service.
94
Attributes:
95
interface: integer; avahi.IF_UNSPEC or an interface index.
96
Used to optionally bind to the specified interface.
97
name: string; Example: 'Mandos'
98
type: string; Example: '_mandos._tcp'.
99
See <http://www.dns-sd.org/ServiceTypes.html>
100
port: integer; what port to announce
101
TXT: list of strings; TXT record for the service
102
domain: string; Domain to publish on, default to .local if empty.
103
host: string; Host to publish records for, default is localhost
104
max_renames: integer; maximum number of renames
105
rename_count: integer; counter so we only rename after collisions
106
a sensible number of times
107
"""
108
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
109
type = None, port = None, TXT = None, domain = "",
110
host = "", max_renames = 32768):
111
self.interface = interface
112
self.name = name
113
self.type = type
114
self.port = port
115
if TXT is None:
116
self.TXT = []
117
else:
118
self.TXT = TXT
119
self.domain = domain
120
self.host = host
121
self.rename_count = 0
122
self.max_renames = max_renames
123
def rename(self):
124
"""Derived from the Avahi example code"""
125
if self.rename_count >= self.max_renames:
126
logger.critical(u"No suitable service name found after %i"
127
u" retries, exiting.", rename_count)
128
raise AvahiServiceError("Too many renames")
129
self.name = server.GetAlternativeServiceName(self.name)
130
logger.info(u"Changing name to %r ...", str(self.name))
131
syslogger.setFormatter(logging.Formatter\
132
('Mandos (%s): %%(levelname)s:'
133
' %%(message)s' % self.name))
134
self.remove()
135
self.add()
136
self.rename_count += 1
137
def remove(self):
138
"""Derived from the Avahi example code"""
139
if group is not None:
140
group.Reset()
141
def add(self):
142
"""Derived from the Avahi example code"""
143
global group
144
if group is None:
145
group = dbus.Interface\
146
(bus.get_object(avahi.DBUS_NAME,
147
server.EntryGroupNew()),
148
avahi.DBUS_INTERFACE_ENTRY_GROUP)
149
group.connect_to_signal('StateChanged',
150
entry_group_state_changed)
151
logger.debug(u"Adding service '%s' of type '%s' ...",
152
service.name, service.type)
153
group.AddService(
154
self.interface, # interface
155
avahi.PROTO_INET6, # protocol
156
dbus.UInt32(0), # flags
157
self.name, self.type,
158
self.domain, self.host,
159
dbus.UInt16(self.port),
160
avahi.string_array_to_txt_array(self.TXT))
161
group.Commit()
162
163
# From the Avahi example code:
164
group = None # our entry group
165
# End of Avahi example code
166
167
13
168
14
class Client(object):
169
"""A representation of a client host served by this server.
170
Attributes:
171
name: string; from the config file, used in log messages
172
fingerprint: string (40 or 32 hexadecimal digits); used to
173
uniquely identify the client
174
secret: bytestring; sent verbatim (over TLS) to client
175
host: string; available for use by the checker command
176
created: datetime.datetime(); object creation, not client host
177
last_checked_ok: datetime.datetime() or None if not yet checked OK
178
timeout: datetime.timedelta(); How long from last_checked_ok
179
until this client is invalid
180
interval: datetime.timedelta(); How often to start a new checker
181
stop_hook: If set, called by stop() as stop_hook(self)
182
checker: subprocess.Popen(); a running checker process used
183
to see if the client lives.
184
'None' if no process is running.
185
checker_initiator_tag: a gobject event source tag, or None
186
stop_initiator_tag: - '' -
187
checker_callback_tag: - '' -
188
checker_command: string; External command which is run to check if
189
client lives. %() expansions are done at
190
runtime with vars(self) as dict, so that for
191
instance %(name)s can be used in the command.
192
Private attibutes:
193
_timeout: Real variable for 'timeout'
194
_interval: Real variable for 'interval'
195
_timeout_milliseconds: Used when calling gobject.timeout_add()
196
_interval_milliseconds: - '' -
197
"""
198
def _set_timeout(self, timeout):
199
"Setter function for 'timeout' attribute"
200
self._timeout = timeout
201
self._timeout_milliseconds = ((self.timeout.days
202
* 24 * 60 * 60 * 1000)
203
+ (self.timeout.seconds * 1000)
204
+ (self.timeout.microseconds
205
// 1000))
206
timeout = property(lambda self: self._timeout,
207
_set_timeout)
208
del _set_timeout
209
def _set_interval(self, interval):
210
"Setter function for 'interval' attribute"
211
self._interval = interval
212
self._interval_milliseconds = ((self.interval.days
213
* 24 * 60 * 60 * 1000)
214
+ (self.interval.seconds
215
* 1000)
216
+ (self.interval.microseconds
217
// 1000))
218
interval = property(lambda self: self._interval,
219
_set_interval)
220
del _set_interval
221
def __init__(self, name = None, stop_hook=None, config={}):
222
"""Note: the 'checker' key in 'config' sets the
223
'checker_command' attribute and *not* the 'checker'
224
attribute."""
15
def __init__(self, name=None, dn=None, password=None,
16
passfile=None, fqdn=None, timeout=None,
17
interval=-1):
225
18
self.name = name
226
logger.debug(u"Creating client %r", self.name)
227
# Uppercase and remove spaces from fingerprint for later
228
# comparison purposes with return value from the fingerprint()
229
# function
230
self.fingerprint = config["fingerprint"].upper()\
231
.replace(u" ", u"")
232
logger.debug(u" Fingerprint: %s", self.fingerprint)
233
if "secret" in config:
234
self.secret = config["secret"].decode(u"base64")
235
elif "secfile" in config:
236
sf = open(config["secfile"])
237
self.secret = sf.read()
238
sf.close()
239
else:
240
raise TypeError(u"No secret or secfile for client %s"
241
% self.name)
242
self.host = config.get("host", "")
243
self.created = datetime.datetime.now()
244
self.last_checked_ok = None
245
self.timeout = string_to_delta(config["timeout"])
246
self.interval = string_to_delta(config["interval"])
247
self.stop_hook = stop_hook
248
self.checker = None
249
self.checker_initiator_tag = None
250
self.stop_initiator_tag = None
251
self.checker_callback_tag = None
252
self.check_command = config["checker"]
253
def start(self):
254
"""Start this client's checker and timeout hooks"""
255
# Schedule a new checker to be started an 'interval' from now,
256
# and every interval from then on.
257
self.checker_initiator_tag = gobject.timeout_add\
258
(self._interval_milliseconds,
259
self.start_checker)
260
# Also start a new checker *right now*.
261
self.start_checker()
262
# Schedule a stop() when 'timeout' has passed
263
self.stop_initiator_tag = gobject.timeout_add\
264
(self._timeout_milliseconds,
265
self.stop)
266
def stop(self):
267
"""Stop this client.
268
The possibility that a client might be restarted is left open,
269
but not currently used."""
270
# If this client doesn't have a secret, it is already stopped.
271
if hasattr(self, "secret") and self.secret:
272
logger.info(u"Stopping client %s", self.name)
273
self.secret = None
274
else:
275
return False
276
if getattr(self, "stop_initiator_tag", False):
277
gobject.source_remove(self.stop_initiator_tag)
278
self.stop_initiator_tag = None
279
if getattr(self, "checker_initiator_tag", False):
280
gobject.source_remove(self.checker_initiator_tag)
281
self.checker_initiator_tag = None
282
self.stop_checker()
283
if self.stop_hook:
284
self.stop_hook(self)
285
# Do not run this again if called by a gobject.timeout_add
286
return False
287
def __del__(self):
288
self.stop_hook = None
289
self.stop()
290
def checker_callback(self, pid, condition):
291
"""The checker has completed, so take appropriate actions."""
292
now = datetime.datetime.now()
293
self.checker_callback_tag = None
294
self.checker = None
295
if os.WIFEXITED(condition) \
296
and (os.WEXITSTATUS(condition) == 0):
297
logger.info(u"Checker for %(name)s succeeded",
298
vars(self))
299
self.last_checked_ok = now
300
gobject.source_remove(self.stop_initiator_tag)
301
self.stop_initiator_tag = gobject.timeout_add\
302
(self._timeout_milliseconds,
303
self.stop)
304
elif not os.WIFEXITED(condition):
305
logger.warning(u"Checker for %(name)s crashed?",
306
vars(self))
307
else:
308
logger.info(u"Checker for %(name)s failed",
309
vars(self))
310
def start_checker(self):
311
"""Start a new checker subprocess if one is not running.
312
If a checker already exists, leave it running and do
313
nothing."""
314
# The reason for not killing a running checker is that if we
315
# did that, then if a checker (for some reason) started
316
# running slowly and taking more than 'interval' time, the
317
# client would inevitably timeout, since no checker would get
318
# a chance to run to completion. If we instead leave running
319
# checkers alone, the checker would have to take more time
320
# than 'timeout' for the client to be declared invalid, which
321
# is as it should be.
322
if self.checker is None:
323
try:
324
# In case check_command has exactly one % operator
325
command = self.check_command % self.host
326
except TypeError:
327
# Escape attributes for the shell
328
escaped_attrs = dict((key, re.escape(str(val)))
329
for key, val in
330
vars(self).iteritems())
331
try:
332
command = self.check_command % escaped_attrs
333
except TypeError, error:
334
logger.error(u'Could not format string "%s":'
335
u' %s', self.check_command, error)
336
return True # Try again later
337
try:
338
logger.info(u"Starting checker %r for %s",
339
command, self.name)
340
self.checker = subprocess.Popen(command,
341
close_fds=True,
342
shell=True, cwd="/")
343
self.checker_callback_tag = gobject.child_watch_add\
344
(self.checker.pid,
345
self.checker_callback)
346
except subprocess.OSError, error:
347
logger.error(u"Failed to start subprocess: %s",
348
error)
349
# Re-run this periodically if run by gobject.timeout_add
350
return True
351
def stop_checker(self):
352
"""Force the checker process, if any, to stop."""
353
if self.checker_callback_tag:
354
gobject.source_remove(self.checker_callback_tag)
355
self.checker_callback_tag = None
356
if getattr(self, "checker", None) is None:
357
return
358
logger.debug(u"Stopping checker for %(name)s", vars(self))
19
self.dn = dn
20
if password:
21
self.password = password
22
elif passfile:
23
self.password = open(passfile).readall()
24
else:
25
print "No Password or Passfile in client config file"
26
# raise RuntimeError XXX
27
self.password = "gazonk"
28
self.fqdn = fqdn
29
# self.created = ...
30
self.last_seen = None
31
if timeout is None:
32
timeout = self.server.options.timeout
33
self.timeout = timeout
34
if interval == -1:
35
interval = self.server.options.interval
36
self.interval = interval
37
38
def server_bind(self):
39
if self.options.interface:
40
if not hasattr(socket, "SO_BINDTODEVICE"):
41
# From /usr/include/asm-i486/socket.h
42
socket.SO_BINDTODEVICE = 25
359
43
try:
360
os.kill(self.checker.pid, signal.SIGTERM)
361
#os.sleep(0.5)
362
#if self.checker.poll() is None:
363
# os.kill(self.checker.pid, signal.SIGKILL)
364
except OSError, error:
365
if error.errno != errno.ESRCH: # No such process
366
raise
367
self.checker = None
368
def still_valid(self):
369
"""Has the timeout not yet passed for this client?"""
370
now = datetime.datetime.now()
371
if self.last_checked_ok is None:
372
return now < (self.created + self.timeout)
373
else:
374
return now < (self.last_checked_ok + self.timeout)
375
376
377
def peer_certificate(session):
378
"Return the peer's OpenPGP certificate as a bytestring"
379
# If not an OpenPGP certificate...
380
if gnutls.library.functions.gnutls_certificate_type_get\
381
(session._c_object) \
382
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
383
# ...do the normal thing
384
return session.peer_certificate
385
list_size = ctypes.c_uint()
386
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
387
(session._c_object, ctypes.byref(list_size))
388
if list_size.value == 0:
389
return None
390
cert = cert_list[0]
391
return ctypes.string_at(cert.data, cert.size)
392
393
394
def fingerprint(openpgp):
395
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
396
# New GnuTLS "datum" with the OpenPGP public key
397
datum = gnutls.library.types.gnutls_datum_t\
398
(ctypes.cast(ctypes.c_char_p(openpgp),
399
ctypes.POINTER(ctypes.c_ubyte)),
400
ctypes.c_uint(len(openpgp)))
401
# New empty GnuTLS certificate
402
crt = gnutls.library.types.gnutls_openpgp_crt_t()
403
gnutls.library.functions.gnutls_openpgp_crt_init\
404
(ctypes.byref(crt))
405
# Import the OpenPGP public key into the certificate
406
gnutls.library.functions.gnutls_openpgp_crt_import\
407
(crt, ctypes.byref(datum),
408
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
409
# New buffer for the fingerprint
410
buffer = ctypes.create_string_buffer(20)
411
buffer_length = ctypes.c_size_t()
412
# Get the fingerprint from the certificate into the buffer
413
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
414
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
415
# Deinit the certificate
416
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
417
# Convert the buffer to a Python bytestring
418
fpr = ctypes.string_at(buffer, buffer_length.value)
419
# Convert the bytestring to hexadecimal notation
420
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
421
return hex_fpr
44
self.socket.setsockopt(socket.SOL_SOCKET,
45
socket.SO_BINDTODEVICE,
46
self.options.interface)
47
except socket.error, error:
48
if error[0] == errno.EPERM:
49
print "Warning: Denied permission to bind to interface", \
50
self.options.interface
51
else:
52
raise error
53
return super(type(self), self).server_bind()
54
55
56
def init_with_options(self, *args, **kwargs):
57
if "options" in kwargs:
58
self.options = kwargs["options"]
59
del kwargs["options"]
60
if "clients" in kwargs:
61
self.clients = kwargs["clients"]
62
del kwargs["clients"]
63
if "credentials" in kwargs:
64
self.credentials = kwargs["credentials"]
65
del kwargs["credentials"]
66
return super(type(self), self).__init__(*args, **kwargs)
67
68
69
class udp_handler(SocketServer.DatagramRequestHandler, object):
70
def handle(self):
71
self.wfile.write("Polo")
72
print "UDP request answered"
73
74
75
class IPv6_UDPServer(SocketServer.UDPServer, object):
76
__init__ = init_with_options
77
address_family = socket.AF_INET6
78
allow_reuse_address = True
79
server_bind = server_bind
80
def verify_request(self, request, client_address):
81
print "UDP request came"
82
return request[0] == "Marco"
422
83
423
84
424
85
class tcp_handler(SocketServer.BaseRequestHandler, object):
425
"""A TCP request handler class.
426
Instantiated by IPv6_TCPServer for each request to handle it.
427
Note: This will run in its own forked process."""
428
429
86
def handle(self):
430
logger.info(u"TCP connection from: %s",
431
unicode(self.client_address))
432
session = gnutls.connection.ClientSession\
433
(self.request, gnutls.connection.X509Credentials())
434
435
line = self.request.makefile().readline()
436
logger.debug(u"Protocol version: %r", line)
437
try:
438
if int(line.strip().split()[0]) > 1:
439
raise RuntimeError
440
except (ValueError, IndexError, RuntimeError), error:
441
logger.error(u"Unknown protocol version: %s", error)
442
return
443
444
# Note: gnutls.connection.X509Credentials is really a generic
445
# GnuTLS certificate credentials object so long as no X.509
446
# keys are added to it. Therefore, we can use it here despite
447
# using OpenPGP certificates.
448
449
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
450
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
451
# "+DHE-DSS"))
452
priority = "NORMAL" # Fallback default, since this
453
# MUST be set.
454
if self.server.settings["priority"]:
455
priority = self.server.settings["priority"]
456
gnutls.library.functions.gnutls_priority_set_direct\
457
(session._c_object, priority, None);
458
459
try:
460
session.handshake()
461
except gnutls.errors.GNUTLSError, error:
462
logger.warning(u"Handshake failed: %s", error)
463
# Do not run session.bye() here: the session is not
464
# established. Just abandon the request.
465
return
466
try:
467
fpr = fingerprint(peer_certificate(session))
468
except (TypeError, gnutls.errors.GNUTLSError), error:
469
logger.warning(u"Bad certificate: %s", error)
470
session.bye()
471
return
472
logger.debug(u"Fingerprint: %s", fpr)
473
client = None
474
for c in self.server.clients:
475
if c.fingerprint == fpr:
476
client = c
477
break
478
if not client:
479
logger.warning(u"Client not found for fingerprint: %s",
480
fpr)
481
session.bye()
482
return
483
# Have to check if client.still_valid(), since it is possible
484
# that the client timed out while establishing the GnuTLS
485
# session.
486
if not client.still_valid():
487
logger.warning(u"Client %(name)s is invalid",
488
vars(client))
489
session.bye()
490
return
491
sent_size = 0
492
while sent_size < len(client.secret):
493
sent = session.send(client.secret[sent_size:])
494
logger.debug(u"Sent: %d, remaining: %d",
495
sent, len(client.secret)
496
- (sent_size + sent))
497
sent_size += sent
87
print "TCP request came"
88
print "Request:", self.request
89
print "Client Address:", self.client_address
90
print "Server:", self.server
91
session = gnutls.connection.ServerSession(self.request,
92
self.server.credentials)
93
session.handshake()
94
if session.peer_certificate:
95
print "DN:", session.peer_certificate.subject
96
try:
97
session.verify_peer()
98
except gnutls.errors.CertificateError, error:
99
print "Verify failed", error
100
session.bye()
101
return
102
try:
103
session.send(dict((client.dn, client.password)
104
for client in self.server.clients)
105
[session.peer_certificate.subject])
106
except KeyError:
107
session.send("gazonk")
108
# Log maybe? XXX
498
109
session.bye()
499
110
500
501
111
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
502
"""IPv6 TCP server. Accepts 'None' as address and/or port.
503
Attributes:
504
settings: Server settings
505
clients: Set() of Client objects
506
"""
112
__init__ = init_with_options
507
113
address_family = socket.AF_INET6
508
def __init__(self, *args, **kwargs):
509
if "settings" in kwargs:
510
self.settings = kwargs["settings"]
511
del kwargs["settings"]
512
if "clients" in kwargs:
513
self.clients = kwargs["clients"]
514
del kwargs["clients"]
515
return super(type(self), self).__init__(*args, **kwargs)
516
def server_bind(self):
517
"""This overrides the normal server_bind() function
518
to bind to an interface if one was specified, and also NOT to
519
bind to an address or port if they were not specified."""
520
if self.settings["interface"]:
521
# 25 is from /usr/include/asm-i486/socket.h
522
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
523
try:
524
self.socket.setsockopt(socket.SOL_SOCKET,
525
SO_BINDTODEVICE,
526
self.settings["interface"])
527
except socket.error, error:
528
if error[0] == errno.EPERM:
529
logger.error(u"No permission to"
530
u" bind to interface %s",
531
self.settings["interface"])
532
else:
533
raise error
534
# Only bind(2) the socket if we really need to.
535
if self.server_address[0] or self.server_address[1]:
536
if not self.server_address[0]:
537
in6addr_any = "::"
538
self.server_address = (in6addr_any,
539
self.server_address[1])
540
elif not self.server_address[1]:
541
self.server_address = (self.server_address[0],
542
0)
543
# if self.settings["interface"]:
544
# self.server_address = (self.server_address[0],
545
# 0, # port
546
# 0, # flowinfo
547
# if_nametoindex
548
# (self.settings
549
# ["interface"]))
550
return super(type(self), self).server_bind()
551
552
553
def string_to_delta(interval):
554
"""Parse a string and return a datetime.timedelta
555
556
>>> string_to_delta('7d')
557
datetime.timedelta(7)
558
>>> string_to_delta('60s')
559
datetime.timedelta(0, 60)
560
>>> string_to_delta('60m')
561
datetime.timedelta(0, 3600)
562
>>> string_to_delta('24h')
563
datetime.timedelta(1)
564
>>> string_to_delta(u'1w')
565
datetime.timedelta(7)
566
>>> string_to_delta('5m 30s')
567
datetime.timedelta(0, 330)
568
"""
569
timevalue = datetime.timedelta(0)
570
for s in interval.split():
571
try:
572
suffix=unicode(s[-1])
573
value=int(s[:-1])
574
if suffix == u"d":
575
delta = datetime.timedelta(value)
576
elif suffix == u"s":
577
delta = datetime.timedelta(0, value)
578
elif suffix == u"m":
579
delta = datetime.timedelta(0, 0, 0, 0, value)
580
elif suffix == u"h":
581
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
582
elif suffix == u"w":
583
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
584
else:
585
raise ValueError
586
except (ValueError, IndexError):
587
raise ValueError
588
timevalue += delta
589
return timevalue
590
591
592
def server_state_changed(state):
593
"""Derived from the Avahi example code"""
594
if state == avahi.SERVER_COLLISION:
595
logger.error(u"Server name collision")
596
service.remove()
597
elif state == avahi.SERVER_RUNNING:
598
service.add()
599
600
601
def entry_group_state_changed(state, error):
602
"""Derived from the Avahi example code"""
603
logger.debug(u"state change: %i", state)
604
605
if state == avahi.ENTRY_GROUP_ESTABLISHED:
606
logger.debug(u"Service established.")
607
elif state == avahi.ENTRY_GROUP_COLLISION:
608
logger.warning(u"Service name collision.")
609
service.rename()
610
elif state == avahi.ENTRY_GROUP_FAILURE:
611
logger.critical(u"Error in group state changed %s",
612
unicode(error))
613
raise AvahiGroupError("State changed: %s", str(error))
614
615
def if_nametoindex(interface):
616
"""Call the C function if_nametoindex(), or equivalent"""
617
global if_nametoindex
618
try:
619
if "ctypes.util" not in sys.modules:
620
import ctypes.util
621
if_nametoindex = ctypes.cdll.LoadLibrary\
622
(ctypes.util.find_library("c")).if_nametoindex
623
except (OSError, AttributeError):
624
if "struct" not in sys.modules:
625
import struct
626
if "fcntl" not in sys.modules:
627
import fcntl
628
def if_nametoindex(interface):
629
"Get an interface index the hard way, i.e. using fcntl()"
630
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
631
s = socket.socket()
632
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
633
struct.pack("16s16x", interface))
634
s.close()
635
interface_index = struct.unpack("I", ifreq[16:20])[0]
636
return interface_index
637
return if_nametoindex(interface)
638
639
640
def daemon(nochdir = False, noclose = False):
641
"""See daemon(3). Standard BSD Unix function.
642
This should really exist as os.daemon, but it doesn't (yet)."""
643
if os.fork():
644
sys.exit()
645
os.setsid()
646
if not nochdir:
647
os.chdir("/")
648
if os.fork():
649
sys.exit()
650
if not noclose:
651
# Close all standard open file descriptors
652
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
653
if not stat.S_ISCHR(os.fstat(null).st_mode):
654
raise OSError(errno.ENODEV,
655
"/dev/null not a character device")
656
os.dup2(null, sys.stdin.fileno())
657
os.dup2(null, sys.stdout.fileno())
658
os.dup2(null, sys.stderr.fileno())
659
if null > 2:
660
os.close(null)
661
114
allow_reuse_address = True
115
request_queue_size = 1024
116
server_bind = server_bind
117
118
119
in6addr_any = "::"
120
121
cred = None
662
122
663
123
def main():
664
global main_loop_started
665
main_loop_started = False
666
667
parser = OptionParser(version = "%%prog %s" % version)
124
parser = OptionParser()
668
125
parser.add_option("-i", "--interface", type="string",
669
metavar="IF", help="Bind to interface IF")
670
parser.add_option("-a", "--address", type="string",
671
help="Address to listen for requests on")
672
parser.add_option("-p", "--port", type="int",
126
default="eth0", metavar="IF",
127
help="Interface to bind to")
128
parser.add_option("--cert", type="string", default="cert.pem",
129
metavar="FILE",
130
help="Public key certificate to use")
131
parser.add_option("--key", type="string", default="key.pem",
132
metavar="FILE",
133
help="Private key to use")
134
parser.add_option("--ca", type="string", default="ca.pem",
135
metavar="FILE",
136
help="Certificate Authority certificate to use")
137
parser.add_option("--crl", type="string", default="crl.pem",
138
metavar="FILE",
139
help="Certificate Revokation List to use")
140
parser.add_option("-p", "--port", type="int", default=49001,
673
141
help="Port number to receive requests on")
674
parser.add_option("--check", action="store_true", default=False,
675
help="Run self-test")
676
parser.add_option("--debug", action="store_true",
677
help="Debug mode; run in foreground and log to"
678
" terminal")
679
parser.add_option("--priority", type="string", help="GnuTLS"
680
" priority string (see GnuTLS documentation)")
681
parser.add_option("--servicename", type="string", metavar="NAME",
682
help="Zeroconf service name")
683
parser.add_option("--configdir", type="string",
684
default="/etc/mandos", metavar="DIR",
685
help="Directory to search for configuration"
686
" files")
142
parser.add_option("--dh", type="int", metavar="BITS",
143
help="DH group to use")
144
parser.add_option("-t", "--timeout", type="string", # Parsed later
145
default="15m",
146
help="Amount of downtime allowed for clients")
687
147
(options, args) = parser.parse_args()
688
148
689
if options.check:
690
import doctest
691
doctest.testmod()
692
sys.exit()
693
694
# Default values for config file for server-global settings
695
server_defaults = { "interface": "",
696
"address": "",
697
"port": "",
698
"debug": "False",
699
"priority":
700
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
701
"servicename": "Mandos",
702
}
703
704
# Parse config file for server-global settings
705
server_config = ConfigParser.SafeConfigParser(server_defaults)
706
del server_defaults
707
server_config.read(os.path.join(options.configdir, "mandos.conf"))
708
# Convert the SafeConfigParser object to a dict
709
server_settings = server_config.defaults()
710
# Use getboolean on the boolean config option
711
server_settings["debug"] = server_config.getboolean\
712
("DEFAULT", "debug")
713
del server_config
714
715
# Override the settings from the config file with command line
716
# options, if set.
717
for option in ("interface", "address", "port", "debug",
718
"priority", "servicename", "configdir"):
719
value = getattr(options, option)
720
if value is not None:
721
server_settings[option] = value
722
del options
723
# Now we have our good server settings in "server_settings"
724
725
debug = server_settings["debug"]
726
727
if not debug:
728
syslogger.setLevel(logging.WARNING)
729
console.setLevel(logging.WARNING)
730
731
if server_settings["servicename"] != "Mandos":
732
syslogger.setFormatter(logging.Formatter\
733
('Mandos (%s): %%(levelname)s:'
734
' %%(message)s'
735
% server_settings["servicename"]))
736
737
# Parse config file with clients
738
client_defaults = { "timeout": "1h",
739
"interval": "5m",
740
"checker": "fping -q -- %%(host)s",
741
"host": "",
742
}
743
client_config = ConfigParser.SafeConfigParser(client_defaults)
744
client_config.read(os.path.join(server_settings["configdir"],
745
"clients.conf"))
746
747
global service
748
service = AvahiService(name = server_settings["servicename"],
749
type = "_mandos._tcp", );
750
if server_settings["interface"]:
751
service.interface = if_nametoindex(server_settings["interface"])
752
753
global main_loop
754
global bus
755
global server
756
# From the Avahi example code
757
DBusGMainLoop(set_as_default=True )
758
main_loop = gobject.MainLoop()
759
bus = dbus.SystemBus()
760
server = dbus.Interface(
761
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
762
avahi.DBUS_INTERFACE_SERVER )
763
# End of Avahi example code
764
765
clients = Set()
766
def remove_from_clients(client):
767
clients.remove(client)
768
if not clients:
769
logger.critical(u"No clients left, exiting")
770
sys.exit()
771
772
clients.update(Set(Client(name = section,
773
stop_hook = remove_from_clients,
774
config
775
= dict(client_config.items(section)))
776
for section in client_config.sections()))
777
if not clients:
778
logger.critical(u"No clients defined")
779
sys.exit(1)
780
781
if not debug:
782
logger.removeHandler(console)
783
daemon()
784
785
pidfilename = "/var/run/mandos/mandos.pid"
786
pid = os.getpid()
149
# Parse the time argument
787
150
try:
788
pidfile = open(pidfilename, "w")
789
pidfile.write(str(pid) + "\n")
790
pidfile.close()
791
del pidfile
792
except IOError, err:
793
logger.error(u"Could not write %s file with PID %d",
794
pidfilename, os.getpid())
795
796
def cleanup():
797
"Cleanup function; run on exit"
798
global group
799
# From the Avahi example code
800
if not group is None:
801
group.Free()
802
group = None
803
# End of Avahi example code
804
805
while clients:
806
client = clients.pop()
807
client.stop_hook = None
808
client.stop()
809
810
atexit.register(cleanup)
811
812
if not debug:
813
signal.signal(signal.SIGINT, signal.SIG_IGN)
814
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
815
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
816
817
for client in clients:
818
client.start()
819
820
tcp_server = IPv6_TCPServer((server_settings["address"],
821
server_settings["port"]),
151
suffix=options.timeout[-1]
152
value=int(options.timeout[:-1])
153
if suffix == "d":
154
options.timeout = datetime.timedelta(value)
155
elif suffix == "s":
156
options.timeout = datetime.timedelta(0, value)
157
elif suffix == "m":
158
options.timeout = datetime.timedelta(0, 0, 0, 0, value)
159
elif suffix == "h":
160
options.timeout = datetime.timedelta(0, 0, 0, 0, 0, value)
161
elif suffix == "w":
162
options.timeout = datetime.timedelta(0, 0, 0, 0, 0, 0,
163
value)
164
else:
165
raise ValueError
166
except (ValueError, IndexError):
167
parser.error("option --timeout: Unparseable time")
168
169
cert = gnutls.crypto.X509Certificate(open(options.cert).read())
170
key = gnutls.crypto.X509PrivateKey(open(options.key).read())
171
ca = gnutls.crypto.X509Certificate(open(options.ca).read())
172
crl = gnutls.crypto.X509CRL(open(options.crl).read())
173
cred = gnutls.connection.X509Credentials(cert, key, [ca], [crl])
174
175
# Parse config file
176
defaults = {}
177
client_config_object = ConfigParser.SafeConfigParser(defaults)
178
client_config_object.read("mandos-clients.conf")
179
clients = [Client(name=section,
180
**(dict(client_config_object.items(section))))
181
for section in client_config_object.sections()]
182
183
udp_server = IPv6_UDPServer((in6addr_any, options.port),
184
udp_handler,
185
options=options)
186
187
tcp_server = IPv6_TCPServer((in6addr_any, options.port),
822
188
tcp_handler,
823
settings=server_settings,
824
clients=clients)
825
# Find out what port we got
826
service.port = tcp_server.socket.getsockname()[1]
827
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
828
u" scope_id %d" % tcp_server.socket.getsockname())
829
830
#service.interface = tcp_server.socket.getsockname()[3]
831
832
try:
833
# From the Avahi example code
834
server.connect_to_signal("StateChanged", server_state_changed)
835
try:
836
server_state_changed(server.GetState())
837
except dbus.exceptions.DBusException, error:
838
logger.critical(u"DBusException: %s", error)
839
sys.exit(1)
840
# End of Avahi example code
841
842
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
843
lambda *args, **kwargs:
844
tcp_server.handle_request\
845
(*args[2:], **kwargs) or True)
846
847
logger.debug(u"Starting main loop")
848
main_loop_started = True
849
main_loop.run()
850
except AvahiError, error:
851
logger.critical(u"AvahiError: %s" + unicode(error))
852
sys.exit(1)
853
except KeyboardInterrupt:
854
if debug:
855
print
856
857
if __name__ == '__main__':
189
options=options,
190
clients=clients,
191
credentials=cred)
192
193
while True:
194
in_, out, err = select.select((udp_server,
195
tcp_server), (), ())
196
for server in in_:
197
server.handle_request()
198
199
200
if __name__ == "__main__":
858
201
main()
202
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0