To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 54
- compare with another revision
- download diff
- download tarball
- view history from revision 54
- Committer: Teddy Hogeborn
- Date: 2008-08-09 15:56:13 UTC
- mfrom: (24.1.29 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080809155613-pm1o10yh44nafc0g
Merge.
- files added:
- mandos-client.xml
- files removed:
- ca.pem
- files renamed:
- mandos-clients.conf => clients.conf
- server.py => mandos
- plugbasedclient.c => mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- plugins.d/mandosclient.c => plugins.d/password-request.c
- files modified:
- Makefile
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# following functions: "add_service", "remove_service",
10
# "server_state_changed", "entry_group_state_changed", and some lines
11
# in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
# Everything else is Copyright © 2007-2008 Teddy Hogeborn and Björn
14
# Påhlsson.
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
15
15
#
16
16
# This program is free software: you can redistribute it and/or modify
17
17
# it under the terms of the GNU General Public License as published by
26
26
# You should have received a copy of the GNU General Public License
27
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
28
28
#
29
# Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
30
# <https://www.fukt.bsnet.se/~teddy/>.
29
# Contact the authors at <mandos@fukt.bsnet.se>.
31
30
#
32
31
33
32
from __future__ import division
62
61
from dbus.mainloop.glib import DBusGMainLoop
63
62
import ctypes
64
63
65
# Brief description of the operation of this program:
66
#
67
# This server announces itself as a Zeroconf service. Connecting
68
# clients use the TLS protocol, with the unusual quirk that this
69
# server program acts as a TLS "client" while the connecting clients
70
# acts as a TLS "server". The clients (acting as a TLS "server") must
71
# supply an OpenPGP certificate, and the fingerprint of this
72
# certificate is used by this server to look up (in a list read from a
73
# file at start time) which binary blob to give the client. No other
74
# authentication or authorization is done by this server.
75
76
64
77
65
logger = logging.Logger('mandos')
78
66
syslogger = logging.handlers.SysLogHandler\
79
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
67
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
68
address = "/dev/log")
80
69
syslogger.setFormatter(logging.Formatter\
81
('%(levelname)s: %(message)s'))
70
('Mandos: %(levelname)s: %(message)s'))
82
71
logger.addHandler(syslogger)
83
del syslogger
84
85
# This variable is used to optionally bind to a specified interface.
86
# It is a global variable to fit in with the other variables from the
87
# Avahi example code.
88
serviceInterface = avahi.IF_UNSPEC
72
73
74
class AvahiError(Exception):
75
def __init__(self, value):
76
self.value = value
77
def __str__(self):
78
return repr(self.value)
79
80
class AvahiServiceError(AvahiError):
81
pass
82
83
class AvahiGroupError(AvahiError):
84
pass
85
86
87
class AvahiService(object):
88
"""An Avahi (Zeroconf) service.
89
Attributes:
90
interface: integer; avahi.IF_UNSPEC or an interface index.
91
Used to optionally bind to the specified interface.
92
name: string; Example: 'Mandos'
93
type: string; Example: '_mandos._tcp'.
94
See <http://www.dns-sd.org/ServiceTypes.html>
95
port: integer; what port to announce
96
TXT: list of strings; TXT record for the service
97
domain: string; Domain to publish on, default to .local if empty.
98
host: string; Host to publish records for, default is localhost
99
max_renames: integer; maximum number of renames
100
rename_count: integer; counter so we only rename after collisions
101
a sensible number of times
102
"""
103
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
104
type = None, port = None, TXT = None, domain = "",
105
host = "", max_renames = 32768):
106
self.interface = interface
107
self.name = name
108
self.type = type
109
self.port = port
110
if TXT is None:
111
self.TXT = []
112
else:
113
self.TXT = TXT
114
self.domain = domain
115
self.host = host
116
self.rename_count = 0
117
def rename(self):
118
"""Derived from the Avahi example code"""
119
if self.rename_count >= self.max_renames:
120
logger.critical(u"No suitable service name found after %i"
121
u" retries, exiting.", rename_count)
122
raise AvahiServiceError("Too many renames")
123
name = server.GetAlternativeServiceName(name)
124
logger.error(u"Changing name to %r ...", name)
125
syslogger.setFormatter(logging.Formatter\
126
('Mandos (%s): %%(levelname)s:'
127
' %%(message)s' % name))
128
self.remove()
129
self.add()
130
self.rename_count += 1
131
def remove(self):
132
"""Derived from the Avahi example code"""
133
if group is not None:
134
group.Reset()
135
def add(self):
136
"""Derived from the Avahi example code"""
137
global group
138
if group is None:
139
group = dbus.Interface\
140
(bus.get_object(avahi.DBUS_NAME,
141
server.EntryGroupNew()),
142
avahi.DBUS_INTERFACE_ENTRY_GROUP)
143
group.connect_to_signal('StateChanged',
144
entry_group_state_changed)
145
logger.debug(u"Adding service '%s' of type '%s' ...",
146
service.name, service.type)
147
group.AddService(
148
self.interface, # interface
149
avahi.PROTO_INET6, # protocol
150
dbus.UInt32(0), # flags
151
self.name, self.type,
152
self.domain, self.host,
153
dbus.UInt16(self.port),
154
avahi.string_array_to_txt_array(self.TXT))
155
group.Commit()
156
89
157
# From the Avahi example code:
90
serviceName = None
91
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
92
servicePort = None # Not known at startup
93
serviceTXT = [] # TXT record for the service
94
domain = "" # Domain to publish on, default to .local
95
host = "" # Host to publish records for, default to localhost
96
group = None #our entry group
97
rename_count = 12 # Counter so we only rename after collisions a
98
# sensible number of times
158
group = None # our entry group
99
159
# End of Avahi example code
100
160
101
161
106
166
fingerprint: string (40 or 32 hexadecimal digits); used to
107
167
uniquely identify the client
108
168
secret: bytestring; sent verbatim (over TLS) to client
109
fqdn: string (FQDN); available for use by the checker command
110
created: datetime.datetime()
111
last_seen: datetime.datetime() or None if not yet seen
112
timeout: datetime.timedelta(); How long from last_seen until
113
this client is invalid
169
host: string; available for use by the checker command
170
created: datetime.datetime(); object creation, not client host
171
last_checked_ok: datetime.datetime() or None if not yet checked OK
172
timeout: datetime.timedelta(); How long from last_checked_ok
173
until this client is invalid
114
174
interval: datetime.timedelta(); How often to start a new checker
115
175
stop_hook: If set, called by stop() as stop_hook(self)
116
176
checker: subprocess.Popen(); a running checker process used
117
177
to see if the client lives.
118
Is None if no process is running.
178
'None' if no process is running.
119
179
checker_initiator_tag: a gobject event source tag, or None
120
180
stop_initiator_tag: - '' -
121
181
checker_callback_tag: - '' -
122
182
checker_command: string; External command which is run to check if
123
client lives. %()s expansions are done at
183
client lives. %() expansions are done at
124
184
runtime with vars(self) as dict, so that for
125
185
instance %(name)s can be used in the command.
126
186
Private attibutes:
127
187
_timeout: Real variable for 'timeout'
128
188
_interval: Real variable for 'interval'
129
_timeout_milliseconds: Used by gobject.timeout_add()
189
_timeout_milliseconds: Used when calling gobject.timeout_add()
130
190
_interval_milliseconds: - '' -
131
191
"""
132
192
def _set_timeout(self, timeout):
152
212
interval = property(lambda self: self._interval,
153
213
_set_interval)
154
214
del _set_interval
155
def __init__(self, name=None, stop_hook=None, fingerprint=None,
156
secret=None, secfile=None, fqdn=None, timeout=None,
157
interval=-1, checker=None):
158
"""Note: the 'checker' argument sets the 'checker_command'
159
attribute and not the 'checker' attribute.."""
215
def __init__(self, name = None, stop_hook=None, config={}):
216
"""Note: the 'checker' key in 'config' sets the
217
'checker_command' attribute and *not* the 'checker'
218
attribute."""
160
219
self.name = name
161
220
logger.debug(u"Creating client %r", self.name)
162
# Uppercase and remove spaces from fingerprint
163
# for later comparison purposes with return value of
164
# the fingerprint() function
165
self.fingerprint = fingerprint.upper().replace(u" ", u"")
221
# Uppercase and remove spaces from fingerprint for later
222
# comparison purposes with return value from the fingerprint()
223
# function
224
self.fingerprint = config["fingerprint"].upper()\
225
.replace(u" ", u"")
166
226
logger.debug(u" Fingerprint: %s", self.fingerprint)
167
if secret:
168
self.secret = secret.decode(u"base64")
169
elif secfile:
170
sf = open(secfile)
227
if "secret" in config:
228
self.secret = config["secret"].decode(u"base64")
229
elif "secfile" in config:
230
sf = open(config["secfile"])
171
231
self.secret = sf.read()
172
232
sf.close()
173
233
else:
174
raise RuntimeError(u"No secret or secfile for client %s"
175
% self.name)
176
self.fqdn = fqdn # string
234
raise TypeError(u"No secret or secfile for client %s"
235
% self.name)
236
self.host = config.get("host", "")
177
237
self.created = datetime.datetime.now()
178
self.last_seen = None
179
self.timeout = string_to_delta(timeout)
180
self.interval = string_to_delta(interval)
238
self.last_checked_ok = None
239
self.timeout = string_to_delta(config["timeout"])
240
self.interval = string_to_delta(config["interval"])
181
241
self.stop_hook = stop_hook
182
242
self.checker = None
183
243
self.checker_initiator_tag = None
184
244
self.stop_initiator_tag = None
185
245
self.checker_callback_tag = None
186
self.check_command = checker
246
self.check_command = config["checker"]
187
247
def start(self):
188
248
"""Start this client's checker and timeout hooks"""
189
249
# Schedule a new checker to be started an 'interval' from now,
199
259
self.stop)
200
260
def stop(self):
201
261
"""Stop this client.
202
The possibility that this client might be restarted is left
203
open, but not currently used."""
262
The possibility that a client might be restarted is left open,
263
but not currently used."""
204
264
# If this client doesn't have a secret, it is already stopped.
205
if self.secret:
206
logger.debug(u"Stopping client %s", self.name)
265
if hasattr(self, "secret") and self.secret:
266
logger.info(u"Stopping client %s", self.name)
207
267
self.secret = None
208
268
else:
209
269
return False
210
if hasattr(self, "stop_initiator_tag") \
211
and self.stop_initiator_tag:
270
if getattr(self, "stop_initiator_tag", False):
212
271
gobject.source_remove(self.stop_initiator_tag)
213
272
self.stop_initiator_tag = None
214
if hasattr(self, "checker_initiator_tag") \
215
and self.checker_initiator_tag:
273
if getattr(self, "checker_initiator_tag", False):
216
274
gobject.source_remove(self.checker_initiator_tag)
217
275
self.checker_initiator_tag = None
218
276
self.stop_checker()
230
288
self.checker = None
231
289
if os.WIFEXITED(condition) \
232
290
and (os.WEXITSTATUS(condition) == 0):
233
logger.debug(u"Checker for %(name)s succeeded",
234
vars(self))
235
self.last_seen = now
291
logger.info(u"Checker for %(name)s succeeded",
292
vars(self))
293
self.last_checked_ok = now
236
294
gobject.source_remove(self.stop_initiator_tag)
237
295
self.stop_initiator_tag = gobject.timeout_add\
238
296
(self._timeout_milliseconds,
241
299
logger.warning(u"Checker for %(name)s crashed?",
242
300
vars(self))
243
301
else:
244
logger.debug(u"Checker for %(name)s failed",
245
vars(self))
302
logger.info(u"Checker for %(name)s failed",
303
vars(self))
246
304
def start_checker(self):
247
305
"""Start a new checker subprocess if one is not running.
248
306
If a checker already exists, leave it running and do
257
315
# is as it should be.
258
316
if self.checker is None:
259
317
try:
260
command = self.check_command % self.fqdn
318
# In case check_command has exactly one % operator
319
command = self.check_command % self.host
261
320
except TypeError:
321
# Escape attributes for the shell
262
322
escaped_attrs = dict((key, re.escape(str(val)))
263
323
for key, val in
264
324
vars(self).iteritems())
265
325
try:
266
326
command = self.check_command % escaped_attrs
267
327
except TypeError, error:
268
logger.critical(u'Could not format string "%s":'
269
u' %s', self.check_command, error)
328
logger.error(u'Could not format string "%s":'
329
u' %s', self.check_command, error)
270
330
return True # Try again later
271
331
try:
272
logger.debug(u"Starting checker %r for %s",
273
command, self.name)
274
self.checker = subprocess.\
275
Popen(command,
276
close_fds=True, shell=True,
277
cwd="/")
332
logger.info(u"Starting checker %r for %s",
333
command, self.name)
334
self.checker = subprocess.Popen(command,
335
close_fds=True,
336
shell=True, cwd="/")
278
337
self.checker_callback_tag = gobject.child_watch_add\
279
338
(self.checker.pid,
280
339
self.checker_callback)
288
347
if self.checker_callback_tag:
289
348
gobject.source_remove(self.checker_callback_tag)
290
349
self.checker_callback_tag = None
291
if not hasattr(self, "checker") or self.checker is None:
350
if getattr(self, "checker", None) is None:
292
351
return
293
logger.debug("Stopping checker for %(name)s", vars(self))
352
logger.debug(u"Stopping checker for %(name)s", vars(self))
294
353
try:
295
354
os.kill(self.checker.pid, signal.SIGTERM)
296
355
#os.sleep(0.5)
297
356
#if self.checker.poll() is None:
298
357
# os.kill(self.checker.pid, signal.SIGKILL)
299
358
except OSError, error:
300
if error.errno != errno.ESRCH:
359
if error.errno != errno.ESRCH: # No such process
301
360
raise
302
361
self.checker = None
303
def still_valid(self, now=None):
362
def still_valid(self):
304
363
"""Has the timeout not yet passed for this client?"""
305
if now is None:
306
now = datetime.datetime.now()
307
if self.last_seen is None:
364
now = datetime.datetime.now()
365
if self.last_checked_ok is None:
308
366
return now < (self.created + self.timeout)
309
367
else:
310
return now < (self.last_seen + self.timeout)
368
return now < (self.last_checked_ok + self.timeout)
311
369
312
370
313
371
def peer_certificate(session):
329
387
330
388
def fingerprint(openpgp):
331
389
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
332
# New empty GnuTLS certificate
333
crt = gnutls.library.types.gnutls_openpgp_crt_t()
334
gnutls.library.functions.gnutls_openpgp_crt_init\
335
(ctypes.byref(crt))
336
390
# New GnuTLS "datum" with the OpenPGP public key
337
391
datum = gnutls.library.types.gnutls_datum_t\
338
392
(ctypes.cast(ctypes.c_char_p(openpgp),
339
393
ctypes.POINTER(ctypes.c_ubyte)),
340
394
ctypes.c_uint(len(openpgp)))
395
# New empty GnuTLS certificate
396
crt = gnutls.library.types.gnutls_openpgp_crt_t()
397
gnutls.library.functions.gnutls_openpgp_crt_init\
398
(ctypes.byref(crt))
341
399
# Import the OpenPGP public key into the certificate
342
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
343
(crt,
344
ctypes.byref(datum),
345
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
400
gnutls.library.functions.gnutls_openpgp_crt_import\
401
(crt, ctypes.byref(datum),
402
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
346
403
# New buffer for the fingerprint
347
404
buffer = ctypes.create_string_buffer(20)
348
405
buffer_length = ctypes.c_size_t()
364
421
Note: This will run in its own forked process."""
365
422
366
423
def handle(self):
367
logger.debug(u"TCP connection from: %s",
424
logger.info(u"TCP connection from: %s",
368
425
unicode(self.client_address))
369
session = gnutls.connection.ClientSession(self.request,
370
gnutls.connection.\
371
X509Credentials())
426
session = gnutls.connection.ClientSession\
427
(self.request, gnutls.connection.X509Credentials())
428
429
line = self.request.makefile().readline()
430
logger.debug(u"Protocol version: %r", line)
431
try:
432
if int(line.strip().split()[0]) > 1:
433
raise RuntimeError
434
except (ValueError, IndexError, RuntimeError), error:
435
logger.error(u"Unknown protocol version: %s", error)
436
return
437
438
# Note: gnutls.connection.X509Credentials is really a generic
439
# GnuTLS certificate credentials object so long as no X.509
440
# keys are added to it. Therefore, we can use it here despite
441
# using OpenPGP certificates.
372
442
373
443
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
374
444
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
375
445
# "+DHE-DSS"))
376
priority = "NORMAL"
377
if self.server.options.priority:
378
priority = self.server.options.priority
446
priority = "NORMAL" # Fallback default, since this
447
# MUST be set.
448
if self.server.settings["priority"]:
449
priority = self.server.settings["priority"]
379
450
gnutls.library.functions.gnutls_priority_set_direct\
380
451
(session._c_object, priority, None);
381
452
382
453
try:
383
454
session.handshake()
384
455
except gnutls.errors.GNUTLSError, error:
385
logger.debug(u"Handshake failed: %s", error)
456
logger.warning(u"Handshake failed: %s", error)
386
457
# Do not run session.bye() here: the session is not
387
458
# established. Just abandon the request.
388
459
return
389
460
try:
390
461
fpr = fingerprint(peer_certificate(session))
391
462
except (TypeError, gnutls.errors.GNUTLSError), error:
392
logger.debug(u"Bad certificate: %s", error)
463
logger.warning(u"Bad certificate: %s", error)
393
464
session.bye()
394
465
return
395
466
logger.debug(u"Fingerprint: %s", fpr)
398
469
if c.fingerprint == fpr:
399
470
client = c
400
471
break
472
if not client:
473
logger.warning(u"Client not found for fingerprint: %s",
474
fpr)
475
session.bye()
476
return
401
477
# Have to check if client.still_valid(), since it is possible
402
478
# that the client timed out while establishing the GnuTLS
403
479
# session.
404
if (not client) or (not client.still_valid()):
405
if client:
406
logger.debug(u"Client %(name)s is invalid",
407
vars(client))
408
else:
409
logger.debug(u"Client not found for fingerprint: %s",
410
fpr)
480
if not client.still_valid():
481
logger.warning(u"Client %(name)s is invalid",
482
vars(client))
411
483
session.bye()
412
484
return
413
485
sent_size = 0
423
495
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
424
496
"""IPv6 TCP server. Accepts 'None' as address and/or port.
425
497
Attributes:
426
options: Command line options
498
settings: Server settings
427
499
clients: Set() of Client objects
428
500
"""
429
501
address_family = socket.AF_INET6
430
502
def __init__(self, *args, **kwargs):
431
if "options" in kwargs:
432
self.options = kwargs["options"]
433
del kwargs["options"]
503
if "settings" in kwargs:
504
self.settings = kwargs["settings"]
505
del kwargs["settings"]
434
506
if "clients" in kwargs:
435
507
self.clients = kwargs["clients"]
436
508
del kwargs["clients"]
439
511
"""This overrides the normal server_bind() function
440
512
to bind to an interface if one was specified, and also NOT to
441
513
bind to an address or port if they were not specified."""
442
if self.options.interface:
443
if not hasattr(socket, "SO_BINDTODEVICE"):
444
# From /usr/include/asm-i486/socket.h
445
socket.SO_BINDTODEVICE = 25
514
if self.settings["interface"]:
515
# 25 is from /usr/include/asm-i486/socket.h
516
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
446
517
try:
447
518
self.socket.setsockopt(socket.SOL_SOCKET,
448
socket.SO_BINDTODEVICE,
449
self.options.interface)
519
SO_BINDTODEVICE,
520
self.settings["interface"])
450
521
except socket.error, error:
451
522
if error[0] == errno.EPERM:
452
logger.warning(u"No permission to"
453
u" bind to interface %s",
454
self.options.interface)
523
logger.error(u"No permission to"
524
u" bind to interface %s",
525
self.settings["interface"])
455
526
else:
456
527
raise error
457
528
# Only bind(2) the socket if we really need to.
460
531
in6addr_any = "::"
461
532
self.server_address = (in6addr_any,
462
533
self.server_address[1])
463
elif self.server_address[1] is None:
534
elif not self.server_address[1]:
464
535
self.server_address = (self.server_address[0],
465
536
0)
537
# if self.settings["interface"]:
538
# self.server_address = (self.server_address[0],
539
# 0, # port
540
# 0, # flowinfo
541
# if_nametoindex
542
# (self.settings
543
# ["interface"]))
466
544
return super(type(self), self).server_bind()
467
545
468
546
500
578
return delta
501
579
502
580
503
def add_service():
504
"""Derived from the Avahi example code"""
505
global group, serviceName, serviceType, servicePort, serviceTXT, \
506
domain, host
507
if group is None:
508
group = dbus.Interface(
509
bus.get_object( avahi.DBUS_NAME,
510
server.EntryGroupNew()),
511
avahi.DBUS_INTERFACE_ENTRY_GROUP)
512
group.connect_to_signal('StateChanged',
513
entry_group_state_changed)
514
logger.debug(u"Adding service '%s' of type '%s' ...",
515
serviceName, serviceType)
516
517
group.AddService(
518
serviceInterface, # interface
519
avahi.PROTO_INET6, # protocol
520
dbus.UInt32(0), # flags
521
serviceName, serviceType,
522
domain, host,
523
dbus.UInt16(servicePort),
524
avahi.string_array_to_txt_array(serviceTXT))
525
group.Commit()
526
527
528
def remove_service():
529
"""From the Avahi example code"""
530
global group
531
532
if not group is None:
533
group.Reset()
534
535
536
581
def server_state_changed(state):
537
582
"""Derived from the Avahi example code"""
538
583
if state == avahi.SERVER_COLLISION:
539
logger.warning(u"Server name collision")
540
remove_service()
584
logger.error(u"Server name collision")
585
service.remove()
541
586
elif state == avahi.SERVER_RUNNING:
542
add_service()
587
service.add()
543
588
544
589
545
590
def entry_group_state_changed(state, error):
546
591
"""Derived from the Avahi example code"""
547
global serviceName, server, rename_count
548
549
592
logger.debug(u"state change: %i", state)
550
593
551
594
if state == avahi.ENTRY_GROUP_ESTABLISHED:
552
595
logger.debug(u"Service established.")
553
596
elif state == avahi.ENTRY_GROUP_COLLISION:
554
555
rename_count = rename_count - 1
556
if rename_count > 0:
557
name = server.GetAlternativeServiceName(name)
558
logger.warning(u"Service name collision, "
559
u"changing name to '%s' ...", name)
560
remove_service()
561
add_service()
562
563
else:
564
logger.error(u"No suitable service name found after %i"
565
u" retries, exiting.", n_rename)
566
killme(1)
597
logger.warning(u"Service name collision.")
598
service.rename()
567
599
elif state == avahi.ENTRY_GROUP_FAILURE:
568
logger.error(u"Error in group state changed %s",
569
unicode(error))
570
killme(1)
571
600
logger.critical(u"Error in group state changed %s",
601
unicode(error))
602
raise AvahiGroupError("State changed: %s", str(error))
572
603
573
604
def if_nametoindex(interface):
574
"""Call the C function if_nametoindex()"""
605
"""Call the C function if_nametoindex(), or equivalent"""
606
global if_nametoindex
575
607
try:
576
libc = ctypes.cdll.LoadLibrary("libc.so.6")
577
return libc.if_nametoindex(interface)
608
if "ctypes.util" not in sys.modules:
609
import ctypes.util
610
if_nametoindex = ctypes.cdll.LoadLibrary\
611
(ctypes.util.find_library("c")).if_nametoindex
578
612
except (OSError, AttributeError):
579
613
if "struct" not in sys.modules:
580
614
import struct
581
615
if "fcntl" not in sys.modules:
582
616
import fcntl
583
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
584
s = socket.socket()
585
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
586
struct.pack("16s16x", interface))
587
s.close()
588
interface_index = struct.unpack("I", ifreq[16:20])[0]
589
return interface_index
590
591
592
def daemon(nochdir, noclose):
617
def if_nametoindex(interface):
618
"Get an interface index the hard way, i.e. using fcntl()"
619
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
620
s = socket.socket()
621
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
622
struct.pack("16s16x", interface))
623
s.close()
624
interface_index = struct.unpack("I", ifreq[16:20])[0]
625
return interface_index
626
return if_nametoindex(interface)
627
628
629
def daemon(nochdir = False, noclose = False):
593
630
"""See daemon(3). Standard BSD Unix function.
594
631
This should really exist as os.daemon, but it doesn't (yet)."""
595
632
if os.fork():
597
634
os.setsid()
598
635
if not nochdir:
599
636
os.chdir("/")
637
if os.fork():
638
sys.exit()
600
639
if not noclose:
601
640
# Close all standard open file descriptors
602
null = os.open("/dev/null", os.O_NOCTTY | os.O_RDWR)
641
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
603
642
if not stat.S_ISCHR(os.fstat(null).st_mode):
604
643
raise OSError(errno.ENODEV,
605
644
"/dev/null not a character device")
610
649
os.close(null)
611
650
612
651
613
def killme(status = 0):
614
logger.debug("Stopping server with exit status %d", status)
615
exitstatus = status
616
if main_loop_started:
617
main_loop.quit()
618
else:
619
sys.exit(status)
620
621
622
652
def main():
623
global exitstatus
624
exitstatus = 0
625
653
global main_loop_started
626
654
main_loop_started = False
627
655
628
656
parser = OptionParser()
629
657
parser.add_option("-i", "--interface", type="string",
630
default=None, metavar="IF",
631
help="Bind to interface IF")
632
parser.add_option("-a", "--address", type="string", default=None,
658
metavar="IF", help="Bind to interface IF")
659
parser.add_option("-a", "--address", type="string",
633
660
help="Address to listen for requests on")
634
parser.add_option("-p", "--port", type="int", default=None,
661
parser.add_option("-p", "--port", type="int",
635
662
help="Port number to receive requests on")
636
663
parser.add_option("--check", action="store_true", default=False,
637
664
help="Run self-test")
638
parser.add_option("--debug", action="store_true", default=False,
639
help="Debug mode")
640
parser.add_option("--priority", type="string",
641
default="SECURE256",
642
help="GnuTLS priority string"
643
" (see GnuTLS documentation)")
644
parser.add_option("--servicename", type="string",
645
default="Mandos", help="Zeroconf service name")
665
parser.add_option("--debug", action="store_true",
666
help="Debug mode; run in foreground and log to"
667
" terminal")
668
parser.add_option("--priority", type="string", help="GnuTLS"
669
" priority string (see GnuTLS documentation)")
670
parser.add_option("--servicename", type="string", metavar="NAME",
671
help="Zeroconf service name")
672
parser.add_option("--configdir", type="string",
673
default="/etc/mandos", metavar="DIR",
674
help="Directory to search for configuration"
675
" files")
646
676
(options, args) = parser.parse_args()
647
677
648
678
if options.check:
650
680
doctest.testmod()
651
681
sys.exit()
652
682
653
# Parse config file
654
defaults = { "timeout": "1h",
655
"interval": "5m",
656
"checker": "fping -q -- %%(fqdn)s",
657
}
658
client_config = ConfigParser.SafeConfigParser(defaults)
659
#client_config.readfp(open("global.conf"), "global.conf")
660
client_config.read("mandos-clients.conf")
661
662
global serviceName
663
serviceName = options.servicename;
683
# Default values for config file for server-global settings
684
server_defaults = { "interface": "",
685
"address": "",
686
"port": "",
687
"debug": "False",
688
"priority":
689
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
690
"servicename": "Mandos",
691
}
692
693
# Parse config file for server-global settings
694
server_config = ConfigParser.SafeConfigParser(server_defaults)
695
del server_defaults
696
server_config.read(os.path.join(options.configdir, "mandos.conf"))
697
server_section = "server"
698
# Convert the SafeConfigParser object to a dict
699
server_settings = dict(server_config.items(server_section))
700
# Use getboolean on the boolean config option
701
server_settings["debug"] = server_config.getboolean\
702
(server_section, "debug")
703
del server_config
704
705
# Override the settings from the config file with command line
706
# options, if set.
707
for option in ("interface", "address", "port", "debug",
708
"priority", "servicename", "configdir"):
709
value = getattr(options, option)
710
if value is not None:
711
server_settings[option] = value
712
del options
713
# Now we have our good server settings in "server_settings"
714
715
debug = server_settings["debug"]
716
717
if not debug:
718
syslogger.setLevel(logging.WARNING)
719
720
if server_settings["servicename"] != "Mandos":
721
syslogger.setFormatter(logging.Formatter\
722
('Mandos (%s): %%(levelname)s:'
723
' %%(message)s'
724
% server_settings["servicename"]))
725
726
# Parse config file with clients
727
client_defaults = { "timeout": "1h",
728
"interval": "5m",
729
"checker": "fping -q -- %%(host)s",
730
}
731
client_config = ConfigParser.SafeConfigParser(client_defaults)
732
client_config.read(os.path.join(server_settings["configdir"],
733
"clients.conf"))
734
735
global service
736
service = AvahiService(name = server_settings["servicename"],
737
type = "_mandos._tcp", );
738
if server_settings["interface"]:
739
service.interface = if_nametoindex(server_settings["interface"])
664
740
665
741
global main_loop
666
742
global bus
674
750
avahi.DBUS_INTERFACE_SERVER )
675
751
# End of Avahi example code
676
752
677
debug = options.debug
678
679
753
if debug:
680
754
console = logging.StreamHandler()
681
755
# console.setLevel(logging.DEBUG)
688
762
def remove_from_clients(client):
689
763
clients.remove(client)
690
764
if not clients:
691
logger.debug(u"No clients left, exiting")
692
killme()
765
logger.critical(u"No clients left, exiting")
766
sys.exit()
693
767
694
clients.update(Set(Client(name=section,
768
clients.update(Set(Client(name = section,
695
769
stop_hook = remove_from_clients,
696
**(dict(client_config\
697
.items(section))))
770
config
771
= dict(client_config.items(section)))
698
772
for section in client_config.sections()))
773
if not clients:
774
logger.critical(u"No clients defined")
775
sys.exit(1)
699
776
700
777
if not debug:
701
daemon(False, False)
778
daemon()
779
780
pidfilename = "/var/run/mandos/mandos.pid"
781
pid = os.getpid()
782
try:
783
pidfile = open(pidfilename, "w")
784
pidfile.write(str(pid) + "\n")
785
pidfile.close()
786
del pidfile
787
except IOError, err:
788
logger.error(u"Could not write %s file with PID %d",
789
pidfilename, os.getpid())
702
790
703
791
def cleanup():
704
792
"Cleanup function; run on exit"
718
806
719
807
if not debug:
720
808
signal.signal(signal.SIGINT, signal.SIG_IGN)
721
signal.signal(signal.SIGHUP, lambda signum, frame: killme())
722
signal.signal(signal.SIGTERM, lambda signum, frame: killme())
809
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
810
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
723
811
724
812
for client in clients:
725
813
client.start()
726
814
727
tcp_server = IPv6_TCPServer((options.address, options.port),
815
tcp_server = IPv6_TCPServer((server_settings["address"],
816
server_settings["port"]),
728
817
tcp_handler,
729
options=options,
818
settings=server_settings,
730
819
clients=clients)
731
# Find out what random port we got
732
global servicePort
733
servicePort = tcp_server.socket.getsockname()[1]
734
logger.debug(u"Now listening on port %d", servicePort)
735
736
if options.interface is not None:
737
global serviceInterface
738
serviceInterface = if_nametoindex(options.interface)
739
740
# From the Avahi example code
741
server.connect_to_signal("StateChanged", server_state_changed)
742
try:
743
server_state_changed(server.GetState())
744
except dbus.exceptions.DBusException, error:
745
logger.critical(u"DBusException: %s", error)
746
killme(1)
747
# End of Avahi example code
748
749
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
750
lambda *args, **kwargs:
751
tcp_server.handle_request(*args[2:],
752
**kwargs) or True)
753
try:
754
logger.debug("Starting main loop")
820
# Find out what port we got
821
service.port = tcp_server.socket.getsockname()[1]
822
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
823
u" scope_id %d" % tcp_server.socket.getsockname())
824
825
#service.interface = tcp_server.socket.getsockname()[3]
826
827
try:
828
# From the Avahi example code
829
server.connect_to_signal("StateChanged", server_state_changed)
830
try:
831
server_state_changed(server.GetState())
832
except dbus.exceptions.DBusException, error:
833
logger.critical(u"DBusException: %s", error)
834
sys.exit(1)
835
# End of Avahi example code
836
837
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
838
lambda *args, **kwargs:
839
tcp_server.handle_request\
840
(*args[2:], **kwargs) or True)
841
842
logger.debug(u"Starting main loop")
755
843
main_loop_started = True
756
844
main_loop.run()
845
except AvahiError, error:
846
logger.critical(u"AvahiError: %s" + unicode(error))
847
sys.exit(1)
757
848
except KeyboardInterrupt:
758
849
if debug:
759
850
print
760
761
sys.exit(exitstatus)
762
851
763
852
if __name__ == '__main__':
764
853
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0