To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 305
- compare with another revision
- download diff
- download tarball
- view history from revision 305
- Committer: Teddy Hogeborn
- Date: 2009-02-09 02:13:58 UTC
- Revision ID: teddy@fukt.bsnet.se-20090209021358-6nrlc91oi08hn5hb
* initramfs-tools-hook: Whitespace change only.
- files added:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- server.py => mandos
- server.conf => mandos.conf
- plugbasedclient.c => plugin-runner.c
- plugins.d/mandosclient.c => plugins.d/mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- files modified:
- Makefile
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# following functions: "AvahiService.add", "AvahiService.remove",
10
# "server_state_changed", "entry_group_state_changed", and some lines
11
# in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
24
25
# GNU General Public License for more details.
25
26
#
26
27
# You should have received a copy of the GNU General Public License
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
28
30
#
29
31
# Contact the authors at <mandos@fukt.bsnet.se>.
30
32
#
31
33
32
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
33
35
34
36
import SocketServer
35
37
import socket
36
import select
37
from optparse import OptionParser
38
import optparse
38
39
import datetime
39
40
import errno
40
41
import gnutls.crypto
54
55
import stat
55
56
import logging
56
57
import logging.handlers
58
import pwd
59
from contextlib import closing
57
60
58
61
import dbus
62
import dbus.service
59
63
import gobject
60
64
import avahi
61
65
from dbus.mainloop.glib import DBusGMainLoop
62
66
import ctypes
63
64
# Brief description of the operation of this program:
65
#
66
# This server announces itself as a Zeroconf service. Connecting
67
# clients use the TLS protocol, with the unusual quirk that this
68
# server program acts as a TLS "client" while a connecting client acts
69
# as a TLS "server". The client (acting as a TLS "server") must
70
# supply an OpenPGP certificate, and the fingerprint of this
71
# certificate is used by this server to look up (in a list read from a
72
# file at start time) which binary blob to give the client. No other
73
# authentication or authorization is done by this server.
74
67
import ctypes.util
68
69
version = "1.0.5"
75
70
76
71
logger = logging.Logger('mandos')
77
syslogger = logging.handlers.SysLogHandler\
78
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
79
syslogger.setFormatter(logging.Formatter\
80
('%(levelname)s: %(message)s'))
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
81
78
logger.addHandler(syslogger)
82
del syslogger
83
79
80
console = logging.StreamHandler()
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
83
logger.addHandler(console)
84
84
85
85
class AvahiError(Exception):
86
def __init__(self, value):
86
def __init__(self, value, *args, **kwargs):
87
87
self.value = value
88
def __str__(self):
89
return repr(self.value)
88
super(AvahiError, self).__init__(value, *args, **kwargs)
89
def __unicode__(self):
90
return unicode(repr(self.value))
90
91
91
92
class AvahiServiceError(AvahiError):
92
93
pass
96
97
97
98
98
99
class AvahiService(object):
99
"""
100
"""An Avahi (Zeroconf) service.
101
Attributes:
100
102
interface: integer; avahi.IF_UNSPEC or an interface index.
101
103
Used to optionally bind to the specified interface.
102
name = string; Example: "Mandos"
103
type = string; Example: "_mandos._tcp".
104
See <http://www.dns-sd.org/ServiceTypes.html>
105
port = integer; what port to announce
106
TXT = list of strings; TXT record for the service
107
domain = string; Domain to publish on, default to .local if empty.
108
host = string; Host to publish records for, default to localhost
109
if empty.
110
max_renames = integer; maximum number of renames
111
rename_count = integer; counter so we only rename after collisions
112
a sensible number of times
104
name: string; Example: 'Mandos'
105
type: string; Example: '_mandos._tcp'.
106
See <http://www.dns-sd.org/ServiceTypes.html>
107
port: integer; what port to announce
108
TXT: list of strings; TXT record for the service
109
domain: string; Domain to publish on, default to .local if empty.
110
host: string; Host to publish records for, default is localhost
111
max_renames: integer; maximum number of renames
112
rename_count: integer; counter so we only rename after collisions
113
a sensible number of times
113
114
"""
114
115
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
type = None, port = None, TXT = None, domain = "",
116
host = "", max_renames = 12):
117
"""An Avahi (Zeroconf) service. """
116
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768):
118
118
self.interface = interface
119
119
self.name = name
120
self.type = type
120
self.type = servicetype
121
121
self.port = port
122
if TXT is None:
123
self.TXT = []
124
else:
125
self.TXT = TXT
122
self.TXT = TXT if TXT is not None else []
126
123
self.domain = domain
127
124
self.host = host
128
125
self.rename_count = 0
126
self.max_renames = max_renames
129
127
def rename(self):
130
128
"""Derived from the Avahi example code"""
131
129
if self.rename_count >= self.max_renames:
132
logger.critical(u"No suitable service name found after %i"
133
u" retries, exiting.", rename_count)
134
raise AvahiServiceError("Too many renames")
135
name = server.GetAlternativeServiceName(name)
136
logger.error(u"Changing name to %r ...", name)
130
logger.critical(u"No suitable Zeroconf service name found"
131
u" after %i retries, exiting.",
132
self.rename_count)
133
raise AvahiServiceError(u"Too many renames")
134
self.name = server.GetAlternativeServiceName(self.name)
135
logger.info(u"Changing Zeroconf service name to %r ...",
136
str(self.name))
137
syslogger.setFormatter(logging.Formatter
138
('Mandos (%s): %%(levelname)s:'
139
' %%(message)s' % self.name))
137
140
self.remove()
138
141
self.add()
139
142
self.rename_count += 1
145
148
"""Derived from the Avahi example code"""
146
149
global group
147
150
if group is None:
148
group = dbus.Interface\
149
(bus.get_object(avahi.DBUS_NAME,
151
group = dbus.Interface(bus.get_object
152
(avahi.DBUS_NAME,
150
153
server.EntryGroupNew()),
151
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
avahi.DBUS_INTERFACE_ENTRY_GROUP)
152
155
group.connect_to_signal('StateChanged',
153
156
entry_group_state_changed)
154
logger.debug(u"Adding service '%s' of type '%s' ...",
157
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
155
158
service.name, service.type)
156
159
group.AddService(
157
160
self.interface, # interface
168
171
# End of Avahi example code
169
172
170
173
171
class Client(object):
174
def _datetime_to_dbus(dt, variant_level=0):
175
"""Convert a UTC datetime.datetime() to a D-Bus type."""
176
return dbus.String(dt.isoformat(), variant_level=variant_level)
177
178
179
class Client(dbus.service.Object):
172
180
"""A representation of a client host served by this server.
173
181
Attributes:
174
name: string; from the config file, used in log messages
182
name: string; from the config file, used in log messages and
183
D-Bus identifiers
175
184
fingerprint: string (40 or 32 hexadecimal digits); used to
176
185
uniquely identify the client
177
secret: bytestring; sent verbatim (over TLS) to client
178
fqdn: string (FQDN); available for use by the checker command
179
created: datetime.datetime(); object creation, not client host
180
last_checked_ok: datetime.datetime() or None if not yet checked OK
181
timeout: datetime.timedelta(); How long from last_checked_ok
182
until this client is invalid
183
interval: datetime.timedelta(); How often to start a new checker
184
stop_hook: If set, called by stop() as stop_hook(self)
185
checker: subprocess.Popen(); a running checker process used
186
to see if the client lives.
187
'None' if no process is running.
186
secret: bytestring; sent verbatim (over TLS) to client
187
host: string; available for use by the checker command
188
created: datetime.datetime(); (UTC) object creation
189
last_enabled: datetime.datetime(); (UTC)
190
enabled: bool()
191
last_checked_ok: datetime.datetime(); (UTC) or None
192
timeout: datetime.timedelta(); How long from last_checked_ok
193
until this client is invalid
194
interval: datetime.timedelta(); How often to start a new checker
195
disable_hook: If set, called by disable() as disable_hook(self)
196
checker: subprocess.Popen(); a running checker process used
197
to see if the client lives.
198
'None' if no process is running.
188
199
checker_initiator_tag: a gobject event source tag, or None
189
stop_initiator_tag: - '' -
200
disable_initiator_tag: - '' -
190
201
checker_callback_tag: - '' -
191
202
checker_command: string; External command which is run to check if
192
203
client lives. %() expansions are done at
193
204
runtime with vars(self) as dict, so that for
194
205
instance %(name)s can be used in the command.
195
Private attibutes:
196
_timeout: Real variable for 'timeout'
197
_interval: Real variable for 'interval'
198
_timeout_milliseconds: Used when calling gobject.timeout_add()
199
_interval_milliseconds: - '' -
206
use_dbus: bool(); Whether to provide D-Bus interface and signals
207
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
200
208
"""
201
def _set_timeout(self, timeout):
202
"Setter function for 'timeout' attribute"
203
self._timeout = timeout
204
self._timeout_milliseconds = ((self.timeout.days
205
* 24 * 60 * 60 * 1000)
206
+ (self.timeout.seconds * 1000)
207
+ (self.timeout.microseconds
208
// 1000))
209
timeout = property(lambda self: self._timeout,
210
_set_timeout)
211
del _set_timeout
212
def _set_interval(self, interval):
213
"Setter function for 'interval' attribute"
214
self._interval = interval
215
self._interval_milliseconds = ((self.interval.days
216
* 24 * 60 * 60 * 1000)
217
+ (self.interval.seconds
218
* 1000)
219
+ (self.interval.microseconds
220
// 1000))
221
interval = property(lambda self: self._interval,
222
_set_interval)
223
del _set_interval
224
def __init__(self, name = None, stop_hook=None, config={}):
225
"""Note: the 'checker' argument sets the 'checker_command'
226
attribute and not the 'checker' attribute.."""
209
def timeout_milliseconds(self):
210
"Return the 'timeout' attribute in milliseconds"
211
return ((self.timeout.days * 24 * 60 * 60 * 1000)
212
+ (self.timeout.seconds * 1000)
213
+ (self.timeout.microseconds // 1000))
214
215
def interval_milliseconds(self):
216
"Return the 'interval' attribute in milliseconds"
217
return ((self.interval.days * 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds * 1000)
219
+ (self.interval.microseconds // 1000))
220
221
def __init__(self, name = None, disable_hook=None, config=None,
222
use_dbus=True):
223
"""Note: the 'checker' key in 'config' sets the
224
'checker_command' attribute and *not* the 'checker'
225
attribute."""
227
226
self.name = name
227
if config is None:
228
config = {}
228
229
logger.debug(u"Creating client %r", self.name)
229
# Uppercase and remove spaces from fingerprint
230
# for later comparison purposes with return value of
231
# the fingerprint() function
232
self.fingerprint = config["fingerprint"].upper()\
233
.replace(u" ", u"")
230
self.use_dbus = False # During __init__
231
# Uppercase and remove spaces from fingerprint for later
232
# comparison purposes with return value from the fingerprint()
233
# function
234
self.fingerprint = (config["fingerprint"].upper()
235
.replace(u" ", u""))
234
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
235
237
if "secret" in config:
236
238
self.secret = config["secret"].decode(u"base64")
237
239
elif "secfile" in config:
238
sf = open(config["secfile"])
239
self.secret = sf.read()
240
sf.close()
240
with closing(open(os.path.expanduser
241
(os.path.expandvars
242
(config["secfile"])))) as secfile:
243
self.secret = secfile.read()
241
244
else:
242
245
raise TypeError(u"No secret or secfile for client %s"
243
246
% self.name)
244
self.fqdn = config.get("fqdn", "")
245
self.created = datetime.datetime.now()
247
self.host = config.get("host", "")
248
self.created = datetime.datetime.utcnow()
249
self.enabled = False
250
self.last_enabled = None
246
251
self.last_checked_ok = None
247
252
self.timeout = string_to_delta(config["timeout"])
248
253
self.interval = string_to_delta(config["interval"])
249
self.stop_hook = stop_hook
254
self.disable_hook = disable_hook
250
255
self.checker = None
251
256
self.checker_initiator_tag = None
252
self.stop_initiator_tag = None
257
self.disable_initiator_tag = None
253
258
self.checker_callback_tag = None
254
self.check_command = config["checker"]
255
def start(self):
259
self.checker_command = config["checker"]
260
self.last_connect = None
261
# Only now, when this client is initialized, can it show up on
262
# the D-Bus
263
self.use_dbus = use_dbus
264
if self.use_dbus:
265
self.dbus_object_path = (dbus.ObjectPath
266
("/clients/"
267
+ self.name.replace(".", "_")))
268
dbus.service.Object.__init__(self, bus,
269
self.dbus_object_path)
270
271
def enable(self):
256
272
"""Start this client's checker and timeout hooks"""
273
self.last_enabled = datetime.datetime.utcnow()
257
274
# Schedule a new checker to be started an 'interval' from now,
258
275
# and every interval from then on.
259
self.checker_initiator_tag = gobject.timeout_add\
260
(self._interval_milliseconds,
261
self.start_checker)
276
self.checker_initiator_tag = (gobject.timeout_add
277
(self.interval_milliseconds(),
278
self.start_checker))
262
279
# Also start a new checker *right now*.
263
280
self.start_checker()
264
# Schedule a stop() when 'timeout' has passed
265
self.stop_initiator_tag = gobject.timeout_add\
266
(self._timeout_milliseconds,
267
self.stop)
268
def stop(self):
269
"""Stop this client.
270
The possibility that a client might be restarted is left open,
271
but not currently used."""
272
# If this client doesn't have a secret, it is already stopped.
273
if self.secret:
274
logger.info(u"Stopping client %s", self.name)
275
self.secret = None
276
else:
281
# Schedule a disable() when 'timeout' has passed
282
self.disable_initiator_tag = (gobject.timeout_add
283
(self.timeout_milliseconds(),
284
self.disable))
285
self.enabled = True
286
if self.use_dbus:
287
# Emit D-Bus signals
288
self.PropertyChanged(dbus.String(u"enabled"),
289
dbus.Boolean(True, variant_level=1))
290
self.PropertyChanged(dbus.String(u"last_enabled"),
291
(_datetime_to_dbus(self.last_enabled,
292
variant_level=1)))
293
294
def disable(self):
295
"""Disable this client."""
296
if not getattr(self, "enabled", False):
277
297
return False
278
if getattr(self, "stop_initiator_tag", False):
279
gobject.source_remove(self.stop_initiator_tag)
280
self.stop_initiator_tag = None
298
logger.info(u"Disabling client %s", self.name)
299
if getattr(self, "disable_initiator_tag", False):
300
gobject.source_remove(self.disable_initiator_tag)
301
self.disable_initiator_tag = None
281
302
if getattr(self, "checker_initiator_tag", False):
282
303
gobject.source_remove(self.checker_initiator_tag)
283
304
self.checker_initiator_tag = None
284
305
self.stop_checker()
285
if self.stop_hook:
286
self.stop_hook(self)
306
if self.disable_hook:
307
self.disable_hook(self)
308
self.enabled = False
309
if self.use_dbus:
310
# Emit D-Bus signal
311
self.PropertyChanged(dbus.String(u"enabled"),
312
dbus.Boolean(False, variant_level=1))
287
313
# Do not run this again if called by a gobject.timeout_add
288
314
return False
315
289
316
def __del__(self):
290
self.stop_hook = None
291
self.stop()
292
def checker_callback(self, pid, condition):
317
self.disable_hook = None
318
self.disable()
319
320
def checker_callback(self, pid, condition, command):
293
321
"""The checker has completed, so take appropriate actions."""
294
now = datetime.datetime.now()
295
322
self.checker_callback_tag = None
296
323
self.checker = None
297
if os.WIFEXITED(condition) \
298
and (os.WEXITSTATUS(condition) == 0):
299
logger.info(u"Checker for %(name)s succeeded",
300
vars(self))
301
self.last_checked_ok = now
302
gobject.source_remove(self.stop_initiator_tag)
303
self.stop_initiator_tag = gobject.timeout_add\
304
(self._timeout_milliseconds,
305
self.stop)
306
elif not os.WIFEXITED(condition):
324
if self.use_dbus:
325
# Emit D-Bus signal
326
self.PropertyChanged(dbus.String(u"checker_running"),
327
dbus.Boolean(False, variant_level=1))
328
if os.WIFEXITED(condition):
329
exitstatus = os.WEXITSTATUS(condition)
330
if exitstatus == 0:
331
logger.info(u"Checker for %(name)s succeeded",
332
vars(self))
333
self.checked_ok()
334
else:
335
logger.info(u"Checker for %(name)s failed",
336
vars(self))
337
if self.use_dbus:
338
# Emit D-Bus signal
339
self.CheckerCompleted(dbus.Int16(exitstatus),
340
dbus.Int64(condition),
341
dbus.String(command))
342
else:
307
343
logger.warning(u"Checker for %(name)s crashed?",
308
344
vars(self))
309
else:
310
logger.info(u"Checker for %(name)s failed",
311
vars(self))
345
if self.use_dbus:
346
# Emit D-Bus signal
347
self.CheckerCompleted(dbus.Int16(-1),
348
dbus.Int64(condition),
349
dbus.String(command))
350
351
def checked_ok(self):
352
"""Bump up the timeout for this client.
353
This should only be called when the client has been seen,
354
alive and well.
355
"""
356
self.last_checked_ok = datetime.datetime.utcnow()
357
gobject.source_remove(self.disable_initiator_tag)
358
self.disable_initiator_tag = (gobject.timeout_add
359
(self.timeout_milliseconds(),
360
self.disable))
361
if self.use_dbus:
362
# Emit D-Bus signal
363
self.PropertyChanged(
364
dbus.String(u"last_checked_ok"),
365
(_datetime_to_dbus(self.last_checked_ok,
366
variant_level=1)))
367
312
368
def start_checker(self):
313
369
"""Start a new checker subprocess if one is not running.
314
370
If a checker already exists, leave it running and do
323
379
# is as it should be.
324
380
if self.checker is None:
325
381
try:
326
# In case check_command has exactly one % operator
327
command = self.check_command % self.fqdn
382
# In case checker_command has exactly one % operator
383
command = self.checker_command % self.host
328
384
except TypeError:
329
385
# Escape attributes for the shell
330
386
escaped_attrs = dict((key, re.escape(str(val)))
331
387
for key, val in
332
388
vars(self).iteritems())
333
389
try:
334
command = self.check_command % escaped_attrs
390
command = self.checker_command % escaped_attrs
335
391
except TypeError, error:
336
392
logger.error(u'Could not format string "%s":'
337
u' %s', self.check_command, error)
393
u' %s', self.checker_command, error)
338
394
return True # Try again later
339
395
try:
340
396
logger.info(u"Starting checker %r for %s",
341
397
command, self.name)
398
# We don't need to redirect stdout and stderr, since
399
# in normal mode, that is already done by daemon(),
400
# and in debug mode we don't want to. (Stdin is
401
# always replaced by /dev/null.)
342
402
self.checker = subprocess.Popen(command,
343
403
close_fds=True,
344
404
shell=True, cwd="/")
345
self.checker_callback_tag = gobject.child_watch_add\
346
(self.checker.pid,
347
self.checker_callback)
348
except subprocess.OSError, error:
405
if self.use_dbus:
406
# Emit D-Bus signal
407
self.CheckerStarted(command)
408
self.PropertyChanged(
409
dbus.String("checker_running"),
410
dbus.Boolean(True, variant_level=1))
411
self.checker_callback_tag = (gobject.child_watch_add
412
(self.checker.pid,
413
self.checker_callback,
414
data=command))
415
except OSError, error:
349
416
logger.error(u"Failed to start subprocess: %s",
350
417
error)
351
418
# Re-run this periodically if run by gobject.timeout_add
352
419
return True
420
353
421
def stop_checker(self):
354
422
"""Force the checker process, if any, to stop."""
355
423
if self.checker_callback_tag:
357
425
self.checker_callback_tag = None
358
426
if getattr(self, "checker", None) is None:
359
427
return
360
logger.debug("Stopping checker for %(name)s", vars(self))
428
logger.debug(u"Stopping checker for %(name)s", vars(self))
361
429
try:
362
430
os.kill(self.checker.pid, signal.SIGTERM)
363
431
#os.sleep(0.5)
367
435
if error.errno != errno.ESRCH: # No such process
368
436
raise
369
437
self.checker = None
438
if self.use_dbus:
439
self.PropertyChanged(dbus.String(u"checker_running"),
440
dbus.Boolean(False, variant_level=1))
441
370
442
def still_valid(self):
371
443
"""Has the timeout not yet passed for this client?"""
372
now = datetime.datetime.now()
444
if not getattr(self, "enabled", False):
445
return False
446
now = datetime.datetime.utcnow()
373
447
if self.last_checked_ok is None:
374
448
return now < (self.created + self.timeout)
375
449
else:
376
450
return now < (self.last_checked_ok + self.timeout)
451
452
## D-Bus methods & signals
453
_interface = u"se.bsnet.fukt.Mandos.Client"
454
455
# CheckedOK - method
456
CheckedOK = dbus.service.method(_interface)(checked_ok)
457
CheckedOK.__name__ = "CheckedOK"
458
459
# CheckerCompleted - signal
460
@dbus.service.signal(_interface, signature="nxs")
461
def CheckerCompleted(self, exitcode, waitstatus, command):
462
"D-Bus signal"
463
pass
464
465
# CheckerStarted - signal
466
@dbus.service.signal(_interface, signature="s")
467
def CheckerStarted(self, command):
468
"D-Bus signal"
469
pass
470
471
# GetAllProperties - method
472
@dbus.service.method(_interface, out_signature="a{sv}")
473
def GetAllProperties(self):
474
"D-Bus method"
475
return dbus.Dictionary({
476
dbus.String("name"):
477
dbus.String(self.name, variant_level=1),
478
dbus.String("fingerprint"):
479
dbus.String(self.fingerprint, variant_level=1),
480
dbus.String("host"):
481
dbus.String(self.host, variant_level=1),
482
dbus.String("created"):
483
_datetime_to_dbus(self.created, variant_level=1),
484
dbus.String("last_enabled"):
485
(_datetime_to_dbus(self.last_enabled,
486
variant_level=1)
487
if self.last_enabled is not None
488
else dbus.Boolean(False, variant_level=1)),
489
dbus.String("enabled"):
490
dbus.Boolean(self.enabled, variant_level=1),
491
dbus.String("last_checked_ok"):
492
(_datetime_to_dbus(self.last_checked_ok,
493
variant_level=1)
494
if self.last_checked_ok is not None
495
else dbus.Boolean (False, variant_level=1)),
496
dbus.String("timeout"):
497
dbus.UInt64(self.timeout_milliseconds(),
498
variant_level=1),
499
dbus.String("interval"):
500
dbus.UInt64(self.interval_milliseconds(),
501
variant_level=1),
502
dbus.String("checker"):
503
dbus.String(self.checker_command,
504
variant_level=1),
505
dbus.String("checker_running"):
506
dbus.Boolean(self.checker is not None,
507
variant_level=1),
508
dbus.String("object_path"):
509
dbus.ObjectPath(self.dbus_object_path,
510
variant_level=1)
511
}, signature="sv")
512
513
# IsStillValid - method
514
IsStillValid = (dbus.service.method(_interface, out_signature="b")
515
(still_valid))
516
IsStillValid.__name__ = "IsStillValid"
517
518
# PropertyChanged - signal
519
@dbus.service.signal(_interface, signature="sv")
520
def PropertyChanged(self, property, value):
521
"D-Bus signal"
522
pass
523
524
# SetChecker - method
525
@dbus.service.method(_interface, in_signature="s")
526
def SetChecker(self, checker):
527
"D-Bus setter method"
528
self.checker_command = checker
529
# Emit D-Bus signal
530
self.PropertyChanged(dbus.String(u"checker"),
531
dbus.String(self.checker_command,
532
variant_level=1))
533
534
# SetHost - method
535
@dbus.service.method(_interface, in_signature="s")
536
def SetHost(self, host):
537
"D-Bus setter method"
538
self.host = host
539
# Emit D-Bus signal
540
self.PropertyChanged(dbus.String(u"host"),
541
dbus.String(self.host, variant_level=1))
542
543
# SetInterval - method
544
@dbus.service.method(_interface, in_signature="t")
545
def SetInterval(self, milliseconds):
546
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
547
# Emit D-Bus signal
548
self.PropertyChanged(dbus.String(u"interval"),
549
(dbus.UInt64(self.interval_milliseconds(),
550
variant_level=1)))
551
552
# SetSecret - method
553
@dbus.service.method(_interface, in_signature="ay",
554
byte_arrays=True)
555
def SetSecret(self, secret):
556
"D-Bus setter method"
557
self.secret = str(secret)
558
559
# SetTimeout - method
560
@dbus.service.method(_interface, in_signature="t")
561
def SetTimeout(self, milliseconds):
562
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
563
# Emit D-Bus signal
564
self.PropertyChanged(dbus.String(u"timeout"),
565
(dbus.UInt64(self.timeout_milliseconds(),
566
variant_level=1)))
567
568
# Enable - method
569
Enable = dbus.service.method(_interface)(enable)
570
Enable.__name__ = "Enable"
571
572
# StartChecker - method
573
@dbus.service.method(_interface)
574
def StartChecker(self):
575
"D-Bus method"
576
self.start_checker()
577
578
# Disable - method
579
@dbus.service.method(_interface)
580
def Disable(self):
581
"D-Bus method"
582
self.disable()
583
584
# StopChecker - method
585
StopChecker = dbus.service.method(_interface)(stop_checker)
586
StopChecker.__name__ = "StopChecker"
587
588
del _interface
377
589
378
590
379
591
def peer_certificate(session):
380
592
"Return the peer's OpenPGP certificate as a bytestring"
381
593
# If not an OpenPGP certificate...
382
if gnutls.library.functions.gnutls_certificate_type_get\
383
(session._c_object) \
384
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
594
if (gnutls.library.functions
595
.gnutls_certificate_type_get(session._c_object)
596
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
385
597
# ...do the normal thing
386
598
return session.peer_certificate
387
list_size = ctypes.c_uint()
388
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
389
(session._c_object, ctypes.byref(list_size))
599
list_size = ctypes.c_uint(1)
600
cert_list = (gnutls.library.functions
601
.gnutls_certificate_get_peers
602
(session._c_object, ctypes.byref(list_size)))
603
if not bool(cert_list) and list_size.value != 0:
604
raise gnutls.errors.GNUTLSError("error getting peer"
605
" certificate")
390
606
if list_size.value == 0:
391
607
return None
392
608
cert = cert_list[0]
395
611
396
612
def fingerprint(openpgp):
397
613
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
614
# New GnuTLS "datum" with the OpenPGP public key
615
datum = (gnutls.library.types
616
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
617
ctypes.POINTER
618
(ctypes.c_ubyte)),
619
ctypes.c_uint(len(openpgp))))
398
620
# New empty GnuTLS certificate
399
621
crt = gnutls.library.types.gnutls_openpgp_crt_t()
400
gnutls.library.functions.gnutls_openpgp_crt_init\
401
(ctypes.byref(crt))
402
# New GnuTLS "datum" with the OpenPGP public key
403
datum = gnutls.library.types.gnutls_datum_t\
404
(ctypes.cast(ctypes.c_char_p(openpgp),
405
ctypes.POINTER(ctypes.c_ubyte)),
406
ctypes.c_uint(len(openpgp)))
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
407
624
# Import the OpenPGP public key into the certificate
408
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
409
(crt,
410
ctypes.byref(datum),
411
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
625
(gnutls.library.functions
626
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
627
gnutls.library.constants
628
.GNUTLS_OPENPGP_FMT_RAW))
629
# Verify the self signature in the key
630
crtverify = ctypes.c_uint()
631
(gnutls.library.functions
632
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
633
if crtverify.value != 0:
634
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
635
raise gnutls.errors.CertificateSecurityError("Verify failed")
412
636
# New buffer for the fingerprint
413
buffer = ctypes.create_string_buffer(20)
414
buffer_length = ctypes.c_size_t()
637
buf = ctypes.create_string_buffer(20)
638
buf_len = ctypes.c_size_t()
415
639
# Get the fingerprint from the certificate into the buffer
416
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
417
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
640
(gnutls.library.functions
641
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
642
ctypes.byref(buf_len)))
418
643
# Deinit the certificate
419
644
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
420
645
# Convert the buffer to a Python bytestring
421
fpr = ctypes.string_at(buffer, buffer_length.value)
646
fpr = ctypes.string_at(buf, buf_len.value)
422
647
# Convert the bytestring to hexadecimal notation
423
648
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
424
649
return hex_fpr
425
650
426
651
427
class tcp_handler(SocketServer.BaseRequestHandler, object):
652
class TCP_handler(SocketServer.BaseRequestHandler, object):
428
653
"""A TCP request handler class.
429
654
Instantiated by IPv6_TCPServer for each request to handle it.
430
655
Note: This will run in its own forked process."""
431
656
432
657
def handle(self):
433
658
logger.info(u"TCP connection from: %s",
434
unicode(self.client_address))
435
session = gnutls.connection.ClientSession\
436
(self.request, gnutls.connection.X509Credentials())
659
unicode(self.client_address))
660
session = (gnutls.connection
661
.ClientSession(self.request,
662
gnutls.connection
663
.X509Credentials()))
437
664
438
665
line = self.request.makefile().readline()
439
666
logger.debug(u"Protocol version: %r", line)
450
677
# using OpenPGP certificates.
451
678
452
679
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
453
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
454
# "+DHE-DSS"))
455
priority = "NORMAL" # Fallback default, since this
456
# MUST be set.
457
if self.server.settings["priority"]:
458
priority = self.server.settings["priority"]
459
gnutls.library.functions.gnutls_priority_set_direct\
460
(session._c_object, priority, None);
680
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
681
# "+DHE-DSS"))
682
# Use a fallback default, since this MUST be set.
683
priority = self.server.settings.get("priority", "NORMAL")
684
(gnutls.library.functions
685
.gnutls_priority_set_direct(session._c_object,
686
priority, None))
461
687
462
688
try:
463
689
session.handshake()
466
692
# Do not run session.bye() here: the session is not
467
693
# established. Just abandon the request.
468
694
return
695
logger.debug(u"Handshake succeeded")
469
696
try:
470
697
fpr = fingerprint(peer_certificate(session))
471
698
except (TypeError, gnutls.errors.GNUTLSError), error:
473
700
session.bye()
474
701
return
475
702
logger.debug(u"Fingerprint: %s", fpr)
476
client = None
703
477
704
for c in self.server.clients:
478
705
if c.fingerprint == fpr:
479
706
client = c
480
707
break
481
if not client:
708
else:
482
709
logger.warning(u"Client not found for fingerprint: %s",
483
710
fpr)
484
711
session.bye()
491
718
vars(client))
492
719
session.bye()
493
720
return
721
## This won't work here, since we're in a fork.
722
# client.checked_ok()
494
723
sent_size = 0
495
724
while sent_size < len(client.secret):
496
725
sent = session.send(client.secret[sent_size:])
501
730
session.bye()
502
731
503
732
504
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
733
class IPv6_TCPServer(SocketServer.ForkingMixIn,
734
SocketServer.TCPServer, object):
505
735
"""IPv6 TCP server. Accepts 'None' as address and/or port.
506
736
Attributes:
507
737
settings: Server settings
508
738
clients: Set() of Client objects
739
enabled: Boolean; whether this server is activated yet
509
740
"""
510
741
address_family = socket.AF_INET6
511
742
def __init__(self, *args, **kwargs):
515
746
if "clients" in kwargs:
516
747
self.clients = kwargs["clients"]
517
748
del kwargs["clients"]
518
return super(type(self), self).__init__(*args, **kwargs)
749
self.enabled = False
750
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
519
751
def server_bind(self):
520
752
"""This overrides the normal server_bind() function
521
753
to bind to an interface if one was specified, and also NOT to
533
765
u" bind to interface %s",
534
766
self.settings["interface"])
535
767
else:
536
raise error
768
raise
537
769
# Only bind(2) the socket if we really need to.
538
770
if self.server_address[0] or self.server_address[1]:
539
771
if not self.server_address[0]:
540
772
in6addr_any = "::"
541
773
self.server_address = (in6addr_any,
542
774
self.server_address[1])
543
elif self.server_address[1] is None:
775
elif not self.server_address[1]:
544
776
self.server_address = (self.server_address[0],
545
777
0)
546
return super(type(self), self).server_bind()
778
# if self.settings["interface"]:
779
# self.server_address = (self.server_address[0],
780
# 0, # port
781
# 0, # flowinfo
782
# if_nametoindex
783
# (self.settings
784
# ["interface"]))
785
return super(IPv6_TCPServer, self).server_bind()
786
def server_activate(self):
787
if self.enabled:
788
return super(IPv6_TCPServer, self).server_activate()
789
def enable(self):
790
self.enabled = True
547
791
548
792
549
793
def string_to_delta(interval):
550
794
"""Parse a string and return a datetime.timedelta
551
795
552
796
>>> string_to_delta('7d')
553
797
datetime.timedelta(7)
554
798
>>> string_to_delta('60s')
559
803
datetime.timedelta(1)
560
804
>>> string_to_delta(u'1w')
561
805
datetime.timedelta(7)
806
>>> string_to_delta('5m 30s')
807
datetime.timedelta(0, 330)
562
808
"""
563
try:
564
suffix=unicode(interval[-1])
565
value=int(interval[:-1])
566
if suffix == u"d":
567
delta = datetime.timedelta(value)
568
elif suffix == u"s":
569
delta = datetime.timedelta(0, value)
570
elif suffix == u"m":
571
delta = datetime.timedelta(0, 0, 0, 0, value)
572
elif suffix == u"h":
573
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
574
elif suffix == u"w":
575
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
576
else:
809
timevalue = datetime.timedelta(0)
810
for s in interval.split():
811
try:
812
suffix = unicode(s[-1])
813
value = int(s[:-1])
814
if suffix == u"d":
815
delta = datetime.timedelta(value)
816
elif suffix == u"s":
817
delta = datetime.timedelta(0, value)
818
elif suffix == u"m":
819
delta = datetime.timedelta(0, 0, 0, 0, value)
820
elif suffix == u"h":
821
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
822
elif suffix == u"w":
823
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
824
else:
825
raise ValueError
826
except (ValueError, IndexError):
577
827
raise ValueError
578
except (ValueError, IndexError):
579
raise ValueError
580
return delta
828
timevalue += delta
829
return timevalue
581
830
582
831
583
832
def server_state_changed(state):
584
833
"""Derived from the Avahi example code"""
585
834
if state == avahi.SERVER_COLLISION:
586
logger.error(u"Server name collision")
835
logger.error(u"Zeroconf server name collision")
587
836
service.remove()
588
837
elif state == avahi.SERVER_RUNNING:
589
838
service.add()
591
840
592
841
def entry_group_state_changed(state, error):
593
842
"""Derived from the Avahi example code"""
594
logger.debug(u"state change: %i", state)
843
logger.debug(u"Avahi state change: %i", state)
595
844
596
845
if state == avahi.ENTRY_GROUP_ESTABLISHED:
597
logger.debug(u"Service established.")
846
logger.debug(u"Zeroconf service established.")
598
847
elif state == avahi.ENTRY_GROUP_COLLISION:
599
logger.warning(u"Service name collision.")
848
logger.warning(u"Zeroconf service name collision.")
600
849
service.rename()
601
850
elif state == avahi.ENTRY_GROUP_FAILURE:
602
logger.critical(u"Error in group state changed %s",
851
logger.critical(u"Avahi: Error in group state changed %s",
603
852
unicode(error))
604
raise AvahiGroupError("State changed: %s", str(error))
853
raise AvahiGroupError(u"State changed: %s" % unicode(error))
605
854
606
855
def if_nametoindex(interface):
607
856
"""Call the C function if_nametoindex(), or equivalent"""
608
857
global if_nametoindex
609
858
try:
610
if "ctypes.util" not in sys.modules:
611
import ctypes.util
612
if_nametoindex = ctypes.cdll.LoadLibrary\
613
(ctypes.util.find_library("c")).if_nametoindex
859
if_nametoindex = (ctypes.cdll.LoadLibrary
860
(ctypes.util.find_library("c"))
861
.if_nametoindex)
614
862
except (OSError, AttributeError):
615
863
if "struct" not in sys.modules:
616
864
import struct
619
867
def if_nametoindex(interface):
620
868
"Get an interface index the hard way, i.e. using fcntl()"
621
869
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
622
s = socket.socket()
623
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
624
struct.pack("16s16x", interface))
625
s.close()
870
with closing(socket.socket()) as s:
871
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
872
struct.pack("16s16x", interface))
626
873
interface_index = struct.unpack("I", ifreq[16:20])[0]
627
874
return interface_index
628
875
return if_nametoindex(interface)
629
876
630
877
631
def daemon(nochdir, noclose):
878
def daemon(nochdir = False, noclose = False):
632
879
"""See daemon(3). Standard BSD Unix function.
633
880
This should really exist as os.daemon, but it doesn't (yet)."""
634
881
if os.fork():
636
883
os.setsid()
637
884
if not nochdir:
638
885
os.chdir("/")
886
if os.fork():
887
sys.exit()
639
888
if not noclose:
640
889
# Close all standard open file descriptors
641
890
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
650
899
651
900
652
901
def main():
653
global main_loop_started
654
main_loop_started = False
655
656
parser = OptionParser()
902
parser = optparse.OptionParser(version = "%%prog %s" % version)
657
903
parser.add_option("-i", "--interface", type="string",
658
904
metavar="IF", help="Bind to interface IF")
659
905
parser.add_option("-a", "--address", type="string",
660
906
help="Address to listen for requests on")
661
907
parser.add_option("-p", "--port", type="int",
662
908
help="Port number to receive requests on")
663
parser.add_option("--check", action="store_true", default=False,
909
parser.add_option("--check", action="store_true",
664
910
help="Run self-test")
665
parser.add_option("--debug", action="store_true", default=False,
911
parser.add_option("--debug", action="store_true",
666
912
help="Debug mode; run in foreground and log to"
667
913
" terminal")
668
914
parser.add_option("--priority", type="string", help="GnuTLS"
673
919
default="/etc/mandos", metavar="DIR",
674
920
help="Directory to search for configuration"
675
921
" files")
676
(options, args) = parser.parse_args()
922
parser.add_option("--no-dbus", action="store_false",
923
dest="use_dbus",
924
help="Do not provide D-Bus system bus"
925
" interface")
926
options = parser.parse_args()[0]
677
927
678
928
if options.check:
679
929
import doctest
688
938
"priority":
689
939
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
690
940
"servicename": "Mandos",
941
"use_dbus": "True",
691
942
}
692
943
693
944
# Parse config file for server-global settings
694
945
server_config = ConfigParser.SafeConfigParser(server_defaults)
695
946
del server_defaults
696
server_config.read(os.path.join(options.configdir, "server.conf"))
697
server_section = "server"
947
server_config.read(os.path.join(options.configdir, "mandos.conf"))
698
948
# Convert the SafeConfigParser object to a dict
699
server_settings = dict(server_config.items(server_section))
700
# Use getboolean on the boolean config option
701
server_settings["debug"] = server_config.getboolean\
702
(server_section, "debug")
949
server_settings = server_config.defaults()
950
# Use the appropriate methods on the non-string config options
951
server_settings["debug"] = server_config.getboolean("DEFAULT",
952
"debug")
953
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
954
"use_dbus")
955
if server_settings["port"]:
956
server_settings["port"] = server_config.getint("DEFAULT",
957
"port")
703
958
del server_config
704
959
705
960
# Override the settings from the config file with command line
706
961
# options, if set.
707
962
for option in ("interface", "address", "port", "debug",
708
"priority", "servicename", "configdir"):
963
"priority", "servicename", "configdir",
964
"use_dbus"):
709
965
value = getattr(options, option)
710
966
if value is not None:
711
967
server_settings[option] = value
712
968
del options
713
969
# Now we have our good server settings in "server_settings"
714
970
971
# For convenience
972
debug = server_settings["debug"]
973
use_dbus = server_settings["use_dbus"]
974
975
if not debug:
976
syslogger.setLevel(logging.WARNING)
977
console.setLevel(logging.WARNING)
978
979
if server_settings["servicename"] != "Mandos":
980
syslogger.setFormatter(logging.Formatter
981
('Mandos (%s): %%(levelname)s:'
982
' %%(message)s'
983
% server_settings["servicename"]))
984
715
985
# Parse config file with clients
716
986
client_defaults = { "timeout": "1h",
717
987
"interval": "5m",
718
"checker": "fping -q -- %%(fqdn)s",
988
"checker": "fping -q -- %%(host)s",
989
"host": "",
719
990
}
720
991
client_config = ConfigParser.SafeConfigParser(client_defaults)
721
992
client_config.read(os.path.join(server_settings["configdir"],
722
993
"clients.conf"))
723
994
995
clients = Set()
996
tcp_server = IPv6_TCPServer((server_settings["address"],
997
server_settings["port"]),
998
TCP_handler,
999
settings=server_settings,
1000
clients=clients)
1001
pidfilename = "/var/run/mandos.pid"
1002
try:
1003
pidfile = open(pidfilename, "w")
1004
except IOError:
1005
logger.error("Could not open file %r", pidfilename)
1006
1007
try:
1008
uid = pwd.getpwnam("_mandos").pw_uid
1009
gid = pwd.getpwnam("_mandos").pw_gid
1010
except KeyError:
1011
try:
1012
uid = pwd.getpwnam("mandos").pw_uid
1013
gid = pwd.getpwnam("mandos").pw_gid
1014
except KeyError:
1015
try:
1016
uid = pwd.getpwnam("nobody").pw_uid
1017
gid = pwd.getpwnam("nogroup").pw_gid
1018
except KeyError:
1019
uid = 65534
1020
gid = 65534
1021
try:
1022
os.setgid(gid)
1023
os.setuid(uid)
1024
except OSError, error:
1025
if error[0] != errno.EPERM:
1026
raise error
1027
1028
# Enable all possible GnuTLS debugging
1029
if debug:
1030
# "Use a log level over 10 to enable all debugging options."
1031
# - GnuTLS manual
1032
gnutls.library.functions.gnutls_global_set_log_level(11)
1033
1034
@gnutls.library.types.gnutls_log_func
1035
def debug_gnutls(level, string):
1036
logger.debug("GnuTLS: %s", string[:-1])
1037
1038
(gnutls.library.functions
1039
.gnutls_global_set_log_function(debug_gnutls))
1040
724
1041
global service
725
1042
service = AvahiService(name = server_settings["servicename"],
726
type = "_mandos._tcp", );
1043
servicetype = "_mandos._tcp", )
727
1044
if server_settings["interface"]:
728
service.interface = if_nametoindex(server_settings["interface"])
1045
service.interface = (if_nametoindex
1046
(server_settings["interface"]))
729
1047
730
1048
global main_loop
731
1049
global bus
734
1052
DBusGMainLoop(set_as_default=True )
735
1053
main_loop = gobject.MainLoop()
736
1054
bus = dbus.SystemBus()
737
server = dbus.Interface(
738
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
739
avahi.DBUS_INTERFACE_SERVER )
1055
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1056
avahi.DBUS_PATH_SERVER),
1057
avahi.DBUS_INTERFACE_SERVER)
740
1058
# End of Avahi example code
741
742
debug = server_settings["debug"]
743
744
if debug:
745
console = logging.StreamHandler()
746
# console.setLevel(logging.DEBUG)
747
console.setFormatter(logging.Formatter\
748
('%(levelname)s: %(message)s'))
749
logger.addHandler(console)
750
del console
751
752
clients = Set()
753
def remove_from_clients(client):
754
clients.remove(client)
755
if not clients:
756
logger.critical(u"No clients left, exiting")
757
sys.exit()
1059
if use_dbus:
1060
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
758
1061
759
1062
clients.update(Set(Client(name = section,
760
stop_hook = remove_from_clients,
761
1063
config
762
= dict(client_config.items(section)))
1064
= dict(client_config.items(section)),
1065
use_dbus = use_dbus)
763
1066
for section in client_config.sections()))
764
765
if not debug:
766
daemon(False, False)
1067
if not clients:
1068
logger.warning(u"No clients defined")
1069
1070
if debug:
1071
# Redirect stdin so all checkers get /dev/null
1072
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1073
os.dup2(null, sys.stdin.fileno())
1074
if null > 2:
1075
os.close(null)
1076
else:
1077
# No console logging
1078
logger.removeHandler(console)
1079
# Close all input and output, do double fork, etc.
1080
daemon()
1081
1082
try:
1083
pid = os.getpid()
1084
pidfile.write(str(pid) + "\n")
1085
pidfile.close()
1086
del pidfile
1087
except IOError:
1088
logger.error(u"Could not write to file %r with PID %d",
1089
pidfilename, pid)
1090
except NameError:
1091
# "pidfile" was never created
1092
pass
1093
del pidfilename
767
1094
768
1095
def cleanup():
769
1096
"Cleanup function; run on exit"
776
1103
777
1104
while clients:
778
1105
client = clients.pop()
779
client.stop_hook = None
780
client.stop()
1106
client.disable_hook = None
1107
client.disable()
781
1108
782
1109
atexit.register(cleanup)
783
1110
786
1113
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
787
1114
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
788
1115
1116
if use_dbus:
1117
class MandosServer(dbus.service.Object):
1118
"""A D-Bus proxy object"""
1119
def __init__(self):
1120
dbus.service.Object.__init__(self, bus, "/")
1121
_interface = u"se.bsnet.fukt.Mandos"
1122
1123
@dbus.service.signal(_interface, signature="oa{sv}")
1124
def ClientAdded(self, objpath, properties):
1125
"D-Bus signal"
1126
pass
1127
1128
@dbus.service.signal(_interface, signature="os")
1129
def ClientRemoved(self, objpath, name):
1130
"D-Bus signal"
1131
pass
1132
1133
@dbus.service.method(_interface, out_signature="ao")
1134
def GetAllClients(self):
1135
"D-Bus method"
1136
return dbus.Array(c.dbus_object_path for c in clients)
1137
1138
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
1139
def GetAllClientsWithProperties(self):
1140
"D-Bus method"
1141
return dbus.Dictionary(
1142
((c.dbus_object_path, c.GetAllProperties())
1143
for c in clients),
1144
signature="oa{sv}")
1145
1146
@dbus.service.method(_interface, in_signature="o")
1147
def RemoveClient(self, object_path):
1148
"D-Bus method"
1149
for c in clients:
1150
if c.dbus_object_path == object_path:
1151
clients.remove(c)
1152
# Don't signal anything except ClientRemoved
1153
c.use_dbus = False
1154
c.disable()
1155
# Emit D-Bus signal
1156
self.ClientRemoved(object_path, c.name)
1157
return
1158
raise KeyError
1159
1160
del _interface
1161
1162
mandos_server = MandosServer()
1163
789
1164
for client in clients:
790
client.start()
791
792
tcp_server = IPv6_TCPServer((server_settings["address"],
793
server_settings["port"]),
794
tcp_handler,
795
settings=server_settings,
796
clients=clients)
1165
if use_dbus:
1166
# Emit D-Bus signal
1167
mandos_server.ClientAdded(client.dbus_object_path,
1168
client.GetAllProperties())
1169
client.enable()
1170
1171
tcp_server.enable()
1172
tcp_server.server_activate()
1173
797
1174
# Find out what port we got
798
1175
service.port = tcp_server.socket.getsockname()[1]
799
1176
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
813
1190
814
1191
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
815
1192
lambda *args, **kwargs:
816
tcp_server.handle_request\
817
(*args[2:], **kwargs) or True)
1193
(tcp_server.handle_request
1194
(*args[2:], **kwargs) or True))
818
1195
819
logger.debug("Starting main loop")
820
main_loop_started = True
1196
logger.debug(u"Starting main loop")
821
1197
main_loop.run()
822
1198
except AvahiError, error:
823
logger.critical(u"AvahiError: %s" + unicode(error))
1199
logger.critical(u"AvahiError: %s", error)
824
1200
sys.exit(1)
825
1201
except KeyboardInterrupt:
826
1202
if debug:
827
print
1203
print >> sys.stderr
1204
logger.debug("Server received KeyboardInterrupt")
1205
logger.debug("Server exiting")
828
1206
829
1207
if __name__ == '__main__':
830
1208
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0