/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release
3 by Björn Påhlsson
Python based server
1
#!/usr/bin/python
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2
# -*- mode: python; coding: utf-8 -*-
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3
# 
4
# Mandos server - give out binary blobs to connecting clients.
5
# 
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
46 by Teddy Hogeborn
* network-protocol.txt: New.
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
12
# 
28 by Teddy Hogeborn
* server.conf: New file.
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
15
# 
16
# This program is free software: you can redistribute it and/or modify
17
# it under the terms of the GNU General Public License as published by
18
# the Free Software Foundation, either version 3 of the License, or
19
# (at your option) any later version.
20
#
21
#     This program is distributed in the hope that it will be useful,
22
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
23
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
24
#     GNU General Public License for more details.
25
# 
26
# You should have received a copy of the GNU General Public License
27
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
28
# 
28 by Teddy Hogeborn
* server.conf: New file.
29
# Contact the authors at <mandos@fukt.bsnet.se>.
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
30
# 
3 by Björn Påhlsson
Python based server
31
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
32
from __future__ import division
33
3 by Björn Påhlsson
Python based server
34
import SocketServer
35
import socket
36
import select
37
from optparse import OptionParser
38
import datetime
39
import errno
40
import gnutls.crypto
41
import gnutls.connection
42
import gnutls.errors
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
43
import gnutls.library.functions
44
import gnutls.library.constants
45
import gnutls.library.types
3 by Björn Påhlsson
Python based server
46
import ConfigParser
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
47
import sys
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
48
import re
49
import os
50
import signal
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
51
from sets import Set
52
import subprocess
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
53
import atexit
54
import stat
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
55
import logging
56
import logging.handlers
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
57
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
58
import dbus
59
import gobject
60
import avahi
61
from dbus.mainloop.glib import DBusGMainLoop
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
62
import ctypes
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
63
13 by Björn Påhlsson
Added following support:
64
65
logger = logging.Logger('mandos')
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
66
syslogger = logging.handlers.SysLogHandler\
67
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON)
68
syslogger.setFormatter(logging.Formatter\
69
                        ('%(levelname)s: %(message)s'))
70
logger.addHandler(syslogger)
71
del syslogger
13 by Björn Påhlsson
Added following support:
72
28 by Teddy Hogeborn
* server.conf: New file.
73
74
class AvahiError(Exception):
75
    def __init__(self, value):
76
        self.value = value
77
    def __str__(self):
78
        return repr(self.value)
79
80
class AvahiServiceError(AvahiError):
81
    pass
82
83
class AvahiGroupError(AvahiError):
84
    pass
85
86
87
class AvahiService(object):
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
88
    """An Avahi (Zeroconf) service.
89
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
90
    interface: integer; avahi.IF_UNSPEC or an interface index.
91
               Used to optionally bind to the specified interface.
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
92
    name: string; Example: 'Mandos'
93
    type: string; Example: '_mandos._tcp'.
94
                  See <http://www.dns-sd.org/ServiceTypes.html>
95
    port: integer; what port to announce
96
    TXT: list of strings; TXT record for the service
97
    domain: string; Domain to publish on, default to .local if empty.
98
    host: string; Host to publish records for, default is localhost
99
    max_renames: integer; maximum number of renames
100
    rename_count: integer; counter so we only rename after collisions
101
                  a sensible number of times
28 by Teddy Hogeborn
* server.conf: New file.
102
    """
103
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
104
                 type = None, port = None, TXT = None, domain = "",
105
                 host = "", max_renames = 12):
106
        self.interface = interface
107
        self.name = name
108
        self.type = type
109
        self.port = port
110
        if TXT is None:
111
            self.TXT = []
112
        else:
113
            self.TXT = TXT
114
        self.domain = domain
115
        self.host = host
116
        self.rename_count = 0
117
    def rename(self):
118
        """Derived from the Avahi example code"""
119
        if self.rename_count >= self.max_renames:
120
            logger.critical(u"No suitable service name found after %i"
121
                            u" retries, exiting.", rename_count)
122
            raise AvahiServiceError("Too many renames")
123
        name = server.GetAlternativeServiceName(name)
44 by Teddy Hogeborn
* ca.pem: Removed.
124
        logger.error(u"Changing name to %r ...", name)
28 by Teddy Hogeborn
* server.conf: New file.
125
        self.remove()
126
        self.add()
127
        self.rename_count += 1
128
    def remove(self):
129
        """Derived from the Avahi example code"""
130
        if group is not None:
131
            group.Reset()
132
    def add(self):
133
        """Derived from the Avahi example code"""
134
        global group
135
        if group is None:
136
            group = dbus.Interface\
137
                    (bus.get_object(avahi.DBUS_NAME,
138
                                    server.EntryGroupNew()),
139
                     avahi.DBUS_INTERFACE_ENTRY_GROUP)
140
            group.connect_to_signal('StateChanged',
141
                                    entry_group_state_changed)
142
        logger.debug(u"Adding service '%s' of type '%s' ...",
143
                     service.name, service.type)
144
        group.AddService(
145
                self.interface,         # interface
146
                avahi.PROTO_INET6,      # protocol
147
                dbus.UInt32(0),         # flags
148
                self.name, self.type,
149
                self.domain, self.host,
150
                dbus.UInt16(self.port),
151
                avahi.string_array_to_txt_array(self.TXT))
152
        group.Commit()
153
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
154
# From the Avahi example code:
28 by Teddy Hogeborn
* server.conf: New file.
155
group = None                            # our entry group
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
156
# End of Avahi example code
157
158
3 by Björn Påhlsson
Python based server
159
class Client(object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
160
    """A representation of a client host served by this server.
161
    Attributes:
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
162
    name:      string; from the config file, used in log messages
163
    fingerprint: string (40 or 32 hexadecimal digits); used to
164
                 uniquely identify the client
165
    secret:    bytestring; sent verbatim (over TLS) to client
166
    fqdn:      string (FQDN); available for use by the checker command
28 by Teddy Hogeborn
* server.conf: New file.
167
    created:   datetime.datetime(); object creation, not client host
168
    last_checked_ok: datetime.datetime() or None if not yet checked OK
169
    timeout:   datetime.timedelta(); How long from last_checked_ok
170
                                     until this client is invalid
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
171
    interval:  datetime.timedelta(); How often to start a new checker
172
    stop_hook: If set, called by stop() as stop_hook(self)
173
    checker:   subprocess.Popen(); a running checker process used
174
                                   to see if the client lives.
28 by Teddy Hogeborn
* server.conf: New file.
175
                                   'None' if no process is running.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
176
    checker_initiator_tag: a gobject event source tag, or None
177
    stop_initiator_tag:    - '' -
178
    checker_callback_tag:  - '' -
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
179
    checker_command: string; External command which is run to check if
28 by Teddy Hogeborn
* server.conf: New file.
180
                     client lives.  %() expansions are done at
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
181
                     runtime with vars(self) as dict, so that for
182
                     instance %(name)s can be used in the command.
183
    Private attibutes:
184
    _timeout: Real variable for 'timeout'
185
    _interval: Real variable for 'interval'
28 by Teddy Hogeborn
* server.conf: New file.
186
    _timeout_milliseconds: Used when calling gobject.timeout_add()
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
187
    _interval_milliseconds: - '' -
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
188
    """
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
189
    def _set_timeout(self, timeout):
190
        "Setter function for 'timeout' attribute"
191
        self._timeout = timeout
192
        self._timeout_milliseconds = ((self.timeout.days
193
                                       * 24 * 60 * 60 * 1000)
194
                                      + (self.timeout.seconds * 1000)
195
                                      + (self.timeout.microseconds
196
                                         // 1000))
197
    timeout = property(lambda self: self._timeout,
198
                       _set_timeout)
199
    del _set_timeout
200
    def _set_interval(self, interval):
201
        "Setter function for 'interval' attribute"
202
        self._interval = interval
203
        self._interval_milliseconds = ((self.interval.days
204
                                        * 24 * 60 * 60 * 1000)
205
                                       + (self.interval.seconds
206
                                          * 1000)
207
                                       + (self.interval.microseconds
208
                                          // 1000))
209
    interval = property(lambda self: self._interval,
210
                        _set_interval)
211
    del _set_interval
44 by Teddy Hogeborn
* ca.pem: Removed.
212
    def __init__(self, name = None, stop_hook=None, config={}):
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
213
        """Note: the 'checker' key in 'config' sets the
214
        'checker_command' attribute and *not* the 'checker'
215
        attribute."""
3 by Björn Påhlsson
Python based server
216
        self.name = name
25 by Teddy Hogeborn
* mandos-clients.conf ([DEFAULT]): New section.
217
        logger.debug(u"Creating client %r", self.name)
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
218
        # Uppercase and remove spaces from fingerprint for later
219
        # comparison purposes with return value from the fingerprint()
220
        # function
44 by Teddy Hogeborn
* ca.pem: Removed.
221
        self.fingerprint = config["fingerprint"].upper()\
222
                           .replace(u" ", u"")
25 by Teddy Hogeborn
* mandos-clients.conf ([DEFAULT]): New section.
223
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
44 by Teddy Hogeborn
* ca.pem: Removed.
224
        if "secret" in config:
225
            self.secret = config["secret"].decode(u"base64")
226
        elif "secfile" in config:
227
            sf = open(config["secfile"])
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
228
            self.secret = sf.read()
229
            sf.close()
3 by Björn Påhlsson
Python based server
230
        else:
28 by Teddy Hogeborn
* server.conf: New file.
231
            raise TypeError(u"No secret or secfile for client %s"
232
                            % self.name)
44 by Teddy Hogeborn
* ca.pem: Removed.
233
        self.fqdn = config.get("fqdn", "")
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
234
        self.created = datetime.datetime.now()
28 by Teddy Hogeborn
* server.conf: New file.
235
        self.last_checked_ok = None
44 by Teddy Hogeborn
* ca.pem: Removed.
236
        self.timeout = string_to_delta(config["timeout"])
237
        self.interval = string_to_delta(config["interval"])
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
238
        self.stop_hook = stop_hook
239
        self.checker = None
240
        self.checker_initiator_tag = None
241
        self.stop_initiator_tag = None
242
        self.checker_callback_tag = None
44 by Teddy Hogeborn
* ca.pem: Removed.
243
        self.check_command = config["checker"]
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
244
    def start(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
245
        """Start this client's checker and timeout hooks"""
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
246
        # Schedule a new checker to be started an 'interval' from now,
247
        # and every interval from then on.
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
248
        self.checker_initiator_tag = gobject.timeout_add\
249
                                     (self._interval_milliseconds,
250
                                      self.start_checker)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
251
        # Also start a new checker *right now*.
252
        self.start_checker()
253
        # Schedule a stop() when 'timeout' has passed
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
254
        self.stop_initiator_tag = gobject.timeout_add\
255
                                  (self._timeout_milliseconds,
256
                                   self.stop)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
257
    def stop(self):
258
        """Stop this client.
28 by Teddy Hogeborn
* server.conf: New file.
259
        The possibility that a client might be restarted is left open,
260
        but not currently used."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
261
        # If this client doesn't have a secret, it is already stopped.
262
        if self.secret:
44 by Teddy Hogeborn
* ca.pem: Removed.
263
            logger.info(u"Stopping client %s", self.name)
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
264
            self.secret = None
265
        else:
266
            return False
28 by Teddy Hogeborn
* server.conf: New file.
267
        if getattr(self, "stop_initiator_tag", False):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
268
            gobject.source_remove(self.stop_initiator_tag)
269
            self.stop_initiator_tag = None
28 by Teddy Hogeborn
* server.conf: New file.
270
        if getattr(self, "checker_initiator_tag", False):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
271
            gobject.source_remove(self.checker_initiator_tag)
272
            self.checker_initiator_tag = None
273
        self.stop_checker()
274
        if self.stop_hook:
275
            self.stop_hook(self)
276
        # Do not run this again if called by a gobject.timeout_add
277
        return False
278
    def __del__(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
279
        self.stop_hook = None
280
        self.stop()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
281
    def checker_callback(self, pid, condition):
282
        """The checker has completed, so take appropriate actions."""
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
283
        now = datetime.datetime.now()
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
284
        self.checker_callback_tag = None
285
        self.checker = None
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
286
        if os.WIFEXITED(condition) \
287
               and (os.WEXITSTATUS(condition) == 0):
44 by Teddy Hogeborn
* ca.pem: Removed.
288
            logger.info(u"Checker for %(name)s succeeded",
289
                        vars(self))
28 by Teddy Hogeborn
* server.conf: New file.
290
            self.last_checked_ok = now
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
291
            gobject.source_remove(self.stop_initiator_tag)
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
292
            self.stop_initiator_tag = gobject.timeout_add\
293
                                      (self._timeout_milliseconds,
294
                                       self.stop)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
295
        elif not os.WIFEXITED(condition):
13 by Björn Påhlsson
Added following support:
296
            logger.warning(u"Checker for %(name)s crashed?",
297
                           vars(self))
298
        else:
44 by Teddy Hogeborn
* ca.pem: Removed.
299
            logger.info(u"Checker for %(name)s failed",
300
                        vars(self))
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
301
    def start_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
302
        """Start a new checker subprocess if one is not running.
303
        If a checker already exists, leave it running and do
304
        nothing."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
305
        # The reason for not killing a running checker is that if we
306
        # did that, then if a checker (for some reason) started
307
        # running slowly and taking more than 'interval' time, the
308
        # client would inevitably timeout, since no checker would get
309
        # a chance to run to completion.  If we instead leave running
310
        # checkers alone, the checker would have to take more time
311
        # than 'timeout' for the client to be declared invalid, which
312
        # is as it should be.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
313
        if self.checker is None:
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
314
            try:
28 by Teddy Hogeborn
* server.conf: New file.
315
                # In case check_command has exactly one % operator
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
316
                command = self.check_command % self.fqdn
317
            except TypeError:
28 by Teddy Hogeborn
* server.conf: New file.
318
                # Escape attributes for the shell
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
319
                escaped_attrs = dict((key, re.escape(str(val)))
320
                                     for key, val in
321
                                     vars(self).iteritems())
13 by Björn Påhlsson
Added following support:
322
                try:
323
                    command = self.check_command % escaped_attrs
324
                except TypeError, error:
28 by Teddy Hogeborn
* server.conf: New file.
325
                    logger.error(u'Could not format string "%s":'
326
                                 u' %s', self.check_command, error)
13 by Björn Påhlsson
Added following support:
327
                    return True # Try again later
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
328
            try:
44 by Teddy Hogeborn
* ca.pem: Removed.
329
                logger.info(u"Starting checker %r for %s",
330
                            command, self.name)
28 by Teddy Hogeborn
* server.conf: New file.
331
                self.checker = subprocess.Popen(command,
332
                                                close_fds=True,
333
                                                shell=True, cwd="/")
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
334
                self.checker_callback_tag = gobject.child_watch_add\
335
                                            (self.checker.pid,
336
                                             self.checker_callback)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
337
            except subprocess.OSError, error:
13 by Björn Påhlsson
Added following support:
338
                logger.error(u"Failed to start subprocess: %s",
339
                             error)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
340
        # Re-run this periodically if run by gobject.timeout_add
341
        return True
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
342
    def stop_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
343
        """Force the checker process, if any, to stop."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
344
        if self.checker_callback_tag:
345
            gobject.source_remove(self.checker_callback_tag)
346
            self.checker_callback_tag = None
28 by Teddy Hogeborn
* server.conf: New file.
347
        if getattr(self, "checker", None) is None:
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
348
            return
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
349
        logger.debug("Stopping checker for %(name)s", vars(self))
350
        try:
351
            os.kill(self.checker.pid, signal.SIGTERM)
352
            #os.sleep(0.5)
353
            #if self.checker.poll() is None:
354
            #    os.kill(self.checker.pid, signal.SIGKILL)
355
        except OSError, error:
28 by Teddy Hogeborn
* server.conf: New file.
356
            if error.errno != errno.ESRCH: # No such process
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
357
                raise
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
358
        self.checker = None
28 by Teddy Hogeborn
* server.conf: New file.
359
    def still_valid(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
360
        """Has the timeout not yet passed for this client?"""
28 by Teddy Hogeborn
* server.conf: New file.
361
        now = datetime.datetime.now()
362
        if self.last_checked_ok is None:
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
363
            return now < (self.created + self.timeout)
364
        else:
28 by Teddy Hogeborn
* server.conf: New file.
365
            return now < (self.last_checked_ok + self.timeout)
3 by Björn Påhlsson
Python based server
366
367
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
368
def peer_certificate(session):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
369
    "Return the peer's OpenPGP certificate as a bytestring"
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
370
    # If not an OpenPGP certificate...
371
    if gnutls.library.functions.gnutls_certificate_type_get\
372
            (session._c_object) \
373
           != gnutls.library.constants.GNUTLS_CRT_OPENPGP:
374
        # ...do the normal thing
375
        return session.peer_certificate
376
    list_size = ctypes.c_uint()
377
    cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
378
        (session._c_object, ctypes.byref(list_size))
379
    if list_size.value == 0:
380
        return None
381
    cert = cert_list[0]
382
    return ctypes.string_at(cert.data, cert.size)
383
384
385
def fingerprint(openpgp):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
386
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
387
    # New GnuTLS "datum" with the OpenPGP public key
388
    datum = gnutls.library.types.gnutls_datum_t\
389
        (ctypes.cast(ctypes.c_char_p(openpgp),
390
                     ctypes.POINTER(ctypes.c_ubyte)),
391
         ctypes.c_uint(len(openpgp)))
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
392
    # New empty GnuTLS certificate
393
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
394
    gnutls.library.functions.gnutls_openpgp_crt_init\
395
        (ctypes.byref(crt))
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
396
    # Import the OpenPGP public key into the certificate
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
397
    gnutls.library.functions.gnutls_openpgp_crt_import\
398
                    (crt, ctypes.byref(datum),
399
                     gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
400
    # New buffer for the fingerprint
401
    buffer = ctypes.create_string_buffer(20)
402
    buffer_length = ctypes.c_size_t()
403
    # Get the fingerprint from the certificate into the buffer
404
    gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
405
        (crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
406
    # Deinit the certificate
407
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
408
    # Convert the buffer to a Python bytestring
409
    fpr = ctypes.string_at(buffer, buffer_length.value)
410
    # Convert the bytestring to hexadecimal notation
411
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
412
    return hex_fpr
413
414
3 by Björn Påhlsson
Python based server
415
class tcp_handler(SocketServer.BaseRequestHandler, object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
416
    """A TCP request handler class.
417
    Instantiated by IPv6_TCPServer for each request to handle it.
418
    Note: This will run in its own forked process."""
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
419
    
3 by Björn Påhlsson
Python based server
420
    def handle(self):
44 by Teddy Hogeborn
* ca.pem: Removed.
421
        logger.info(u"TCP connection from: %s",
13 by Björn Påhlsson
Added following support:
422
                     unicode(self.client_address))
41 by Teddy Hogeborn
Merge.
423
        session = gnutls.connection.ClientSession\
424
                  (self.request, gnutls.connection.X509Credentials())
425
        
24.1.12 by Björn Påhlsson
merge +
426
        line = self.request.makefile().readline()
427
        logger.debug(u"Protocol version: %r", line)
24.1.11 by Björn Påhlsson
Added support for protocol version handling
428
        try:
429
            if int(line.strip().split()[0]) > 1:
430
                raise RuntimeError
431
        except (ValueError, IndexError, RuntimeError), error:
432
            logger.error(u"Unknown protocol version: %s", error)
433
            return
434
        
28 by Teddy Hogeborn
* server.conf: New file.
435
        # Note: gnutls.connection.X509Credentials is really a generic
436
        # GnuTLS certificate credentials object so long as no X.509
437
        # keys are added to it.  Therefore, we can use it here despite
438
        # using OpenPGP certificates.
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
439
        
440
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
441
        #                "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
442
        #                "+DHE-DSS"))
28 by Teddy Hogeborn
* server.conf: New file.
443
        priority = "NORMAL"             # Fallback default, since this
444
                                        # MUST be set.
445
        if self.server.settings["priority"]:
446
            priority = self.server.settings["priority"]
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
447
        gnutls.library.functions.gnutls_priority_set_direct\
448
            (session._c_object, priority, None);
449
        
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
450
        try:
451
            session.handshake()
452
        except gnutls.errors.GNUTLSError, error:
44 by Teddy Hogeborn
* ca.pem: Removed.
453
            logger.warning(u"Handshake failed: %s", error)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
454
            # Do not run session.bye() here: the session is not
455
            # established.  Just abandon the request.
456
            return
3 by Björn Påhlsson
Python based server
457
        try:
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
458
            fpr = fingerprint(peer_certificate(session))
459
        except (TypeError, gnutls.errors.GNUTLSError), error:
44 by Teddy Hogeborn
* ca.pem: Removed.
460
            logger.warning(u"Bad certificate: %s", error)
3 by Björn Påhlsson
Python based server
461
            session.bye()
462
            return
13 by Björn Påhlsson
Added following support:
463
        logger.debug(u"Fingerprint: %s", fpr)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
464
        client = None
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
465
        for c in self.server.clients:
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
466
            if c.fingerprint == fpr:
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
467
                client = c
468
                break
28 by Teddy Hogeborn
* server.conf: New file.
469
        if not client:
44 by Teddy Hogeborn
* ca.pem: Removed.
470
            logger.warning(u"Client not found for fingerprint: %s",
471
                           fpr)
28 by Teddy Hogeborn
* server.conf: New file.
472
            session.bye()
473
            return
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
474
        # Have to check if client.still_valid(), since it is possible
475
        # that the client timed out while establishing the GnuTLS
476
        # session.
28 by Teddy Hogeborn
* server.conf: New file.
477
        if not client.still_valid():
44 by Teddy Hogeborn
* ca.pem: Removed.
478
            logger.warning(u"Client %(name)s is invalid",
479
                           vars(client))
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
480
            session.bye()
481
            return
482
        sent_size = 0
483
        while sent_size < len(client.secret):
484
            sent = session.send(client.secret[sent_size:])
13 by Björn Påhlsson
Added following support:
485
            logger.debug(u"Sent: %d, remaining: %d",
486
                         sent, len(client.secret)
487
                         - (sent_size + sent))
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
488
            sent_size += sent
3 by Björn Påhlsson
Python based server
489
        session.bye()
490
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
491
3 by Björn Påhlsson
Python based server
492
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
493
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
494
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
495
        settings:       Server settings
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
496
        clients:        Set() of Client objects
497
    """
498
    address_family = socket.AF_INET6
499
    def __init__(self, *args, **kwargs):
28 by Teddy Hogeborn
* server.conf: New file.
500
        if "settings" in kwargs:
501
            self.settings = kwargs["settings"]
502
            del kwargs["settings"]
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
503
        if "clients" in kwargs:
504
            self.clients = kwargs["clients"]
505
            del kwargs["clients"]
506
        return super(type(self), self).__init__(*args, **kwargs)
507
    def server_bind(self):
508
        """This overrides the normal server_bind() function
509
        to bind to an interface if one was specified, and also NOT to
510
        bind to an address or port if they were not specified."""
29 by Teddy Hogeborn
* plugins.d/mandosclient.c (start_mandos_communication): Changed
511
        if self.settings["interface"]:
28 by Teddy Hogeborn
* server.conf: New file.
512
            # 25 is from /usr/include/asm-i486/socket.h
513
            SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
514
            try:
515
                self.socket.setsockopt(socket.SOL_SOCKET,
28 by Teddy Hogeborn
* server.conf: New file.
516
                                       SO_BINDTODEVICE,
517
                                       self.settings["interface"])
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
518
            except socket.error, error:
519
                if error[0] == errno.EPERM:
44 by Teddy Hogeborn
* ca.pem: Removed.
520
                    logger.error(u"No permission to"
521
                                 u" bind to interface %s",
522
                                 self.settings["interface"])
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
523
                else:
524
                    raise error
525
        # Only bind(2) the socket if we really need to.
526
        if self.server_address[0] or self.server_address[1]:
527
            if not self.server_address[0]:
528
                in6addr_any = "::"
529
                self.server_address = (in6addr_any,
530
                                       self.server_address[1])
531
            elif self.server_address[1] is None:
532
                self.server_address = (self.server_address[0],
533
                                       0)
534
            return super(type(self), self).server_bind()
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
535
3 by Björn Påhlsson
Python based server
536
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
537
def string_to_delta(interval):
538
    """Parse a string and return a datetime.timedelta
539
540
    >>> string_to_delta('7d')
541
    datetime.timedelta(7)
542
    >>> string_to_delta('60s')
543
    datetime.timedelta(0, 60)
544
    >>> string_to_delta('60m')
545
    datetime.timedelta(0, 3600)
546
    >>> string_to_delta('24h')
547
    datetime.timedelta(1)
548
    >>> string_to_delta(u'1w')
549
    datetime.timedelta(7)
550
    """
551
    try:
552
        suffix=unicode(interval[-1])
553
        value=int(interval[:-1])
554
        if suffix == u"d":
555
            delta = datetime.timedelta(value)
556
        elif suffix == u"s":
557
            delta = datetime.timedelta(0, value)
558
        elif suffix == u"m":
559
            delta = datetime.timedelta(0, 0, 0, 0, value)
560
        elif suffix == u"h":
561
            delta = datetime.timedelta(0, 0, 0, 0, 0, value)
562
        elif suffix == u"w":
563
            delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
564
        else:
565
            raise ValueError
566
    except (ValueError, IndexError):
567
        raise ValueError
568
    return delta
569
8 by Teddy Hogeborn
* Makefile (client_debug): Bug fix; add quotes and / to CERT_ROOT.
570
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
571
def server_state_changed(state):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
572
    """Derived from the Avahi example code"""
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
573
    if state == avahi.SERVER_COLLISION:
44 by Teddy Hogeborn
* ca.pem: Removed.
574
        logger.error(u"Server name collision")
28 by Teddy Hogeborn
* server.conf: New file.
575
        service.remove()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
576
    elif state == avahi.SERVER_RUNNING:
28 by Teddy Hogeborn
* server.conf: New file.
577
        service.add()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
578
579
580
def entry_group_state_changed(state, error):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
581
    """Derived from the Avahi example code"""
13 by Björn Påhlsson
Added following support:
582
    logger.debug(u"state change: %i", state)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
583
    
584
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
13 by Björn Påhlsson
Added following support:
585
        logger.debug(u"Service established.")
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
586
    elif state == avahi.ENTRY_GROUP_COLLISION:
28 by Teddy Hogeborn
* server.conf: New file.
587
        logger.warning(u"Service name collision.")
588
        service.rename()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
589
    elif state == avahi.ENTRY_GROUP_FAILURE:
28 by Teddy Hogeborn
* server.conf: New file.
590
        logger.critical(u"Error in group state changed %s",
591
                        unicode(error))
592
        raise AvahiGroupError("State changed: %s", str(error))
593
24.1.13 by Björn Påhlsson
mandosclient
594
def if_nametoindex(interface):
28 by Teddy Hogeborn
* server.conf: New file.
595
    """Call the C function if_nametoindex(), or equivalent"""
24.1.13 by Björn Påhlsson
mandosclient
596
    global if_nametoindex
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
597
    try:
28 by Teddy Hogeborn
* server.conf: New file.
598
        if "ctypes.util" not in sys.modules:
599
            import ctypes.util
24.1.13 by Björn Påhlsson
mandosclient
600
        if_nametoindex = ctypes.cdll.LoadLibrary\
601
            (ctypes.util.find_library("c")).if_nametoindex
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
602
    except (OSError, AttributeError):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
603
        if "struct" not in sys.modules:
604
            import struct
605
        if "fcntl" not in sys.modules:
606
            import fcntl
24.1.13 by Björn Påhlsson
mandosclient
607
        def if_nametoindex(interface):
28 by Teddy Hogeborn
* server.conf: New file.
608
            "Get an interface index the hard way, i.e. using fcntl()"
609
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
610
            s = socket.socket()
611
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
612
                                struct.pack("16s16x", interface))
613
            s.close()
614
            interface_index = struct.unpack("I", ifreq[16:20])[0]
615
            return interface_index
24.1.13 by Björn Påhlsson
mandosclient
616
    return if_nametoindex(interface)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
617
618
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
619
def daemon(nochdir, noclose):
620
    """See daemon(3).  Standard BSD Unix function.
621
    This should really exist as os.daemon, but it doesn't (yet)."""
622
    if os.fork():
623
        sys.exit()
624
    os.setsid()
625
    if not nochdir:
626
        os.chdir("/")
46 by Teddy Hogeborn
* network-protocol.txt: New.
627
    if os.fork():
628
        sys.exit()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
629
    if not noclose:
630
        # Close all standard open file descriptors
28 by Teddy Hogeborn
* server.conf: New file.
631
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
632
        if not stat.S_ISCHR(os.fstat(null).st_mode):
633
            raise OSError(errno.ENODEV,
634
                          "/dev/null not a character device")
635
        os.dup2(null, sys.stdin.fileno())
636
        os.dup2(null, sys.stdout.fileno())
637
        os.dup2(null, sys.stderr.fileno())
638
        if null > 2:
639
            os.close(null)
640
641
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
642
def main():
643
    global main_loop_started
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
644
    main_loop_started = False
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
645
    
3 by Björn Påhlsson
Python based server
646
    parser = OptionParser()
647
    parser.add_option("-i", "--interface", type="string",
28 by Teddy Hogeborn
* server.conf: New file.
648
                      metavar="IF", help="Bind to interface IF")
649
    parser.add_option("-a", "--address", type="string",
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
650
                      help="Address to listen for requests on")
28 by Teddy Hogeborn
* server.conf: New file.
651
    parser.add_option("-p", "--port", type="int",
3 by Björn Påhlsson
Python based server
652
                      help="Port number to receive requests on")
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
653
    parser.add_option("--check", action="store_true", default=False,
654
                      help="Run self-test")
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
655
    parser.add_option("--debug", action="store_true", default=False,
28 by Teddy Hogeborn
* server.conf: New file.
656
                      help="Debug mode; run in foreground and log to"
657
                      " terminal")
658
    parser.add_option("--priority", type="string", help="GnuTLS"
659
                      " priority string (see GnuTLS documentation)")
660
    parser.add_option("--servicename", type="string", metavar="NAME",
661
                      help="Zeroconf service name")
662
    parser.add_option("--configdir", type="string",
663
                      default="/etc/mandos", metavar="DIR",
664
                      help="Directory to search for configuration"
665
                      " files")
3 by Björn Påhlsson
Python based server
666
    (options, args) = parser.parse_args()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
667
    
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
668
    if options.check:
669
        import doctest
670
        doctest.testmod()
671
        sys.exit()
3 by Björn Påhlsson
Python based server
672
    
28 by Teddy Hogeborn
* server.conf: New file.
673
    # Default values for config file for server-global settings
674
    server_defaults = { "interface": "",
675
                        "address": "",
676
                        "port": "",
677
                        "debug": "False",
678
                        "priority":
679
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
680
                        "servicename": "Mandos",
681
                        }
682
    
683
    # Parse config file for server-global settings
684
    server_config = ConfigParser.SafeConfigParser(server_defaults)
685
    del server_defaults
686
    server_config.read(os.path.join(options.configdir, "server.conf"))
687
    server_section = "server"
688
    # Convert the SafeConfigParser object to a dict
689
    server_settings = dict(server_config.items(server_section))
690
    # Use getboolean on the boolean config option
691
    server_settings["debug"] = server_config.getboolean\
692
                               (server_section, "debug")
693
    del server_config
694
    
695
    # Override the settings from the config file with command line
696
    # options, if set.
697
    for option in ("interface", "address", "port", "debug",
698
                   "priority", "servicename", "configdir"):
699
        value = getattr(options, option)
700
        if value is not None:
701
            server_settings[option] = value
702
    del options
703
    # Now we have our good server settings in "server_settings"
704
    
705
    # Parse config file with clients
706
    client_defaults = { "timeout": "1h",
707
                        "interval": "5m",
708
                        "checker": "fping -q -- %%(fqdn)s",
709
                        }
710
    client_config = ConfigParser.SafeConfigParser(client_defaults)
711
    client_config.read(os.path.join(server_settings["configdir"],
712
                                    "clients.conf"))
713
    
714
    global service
715
    service = AvahiService(name = server_settings["servicename"],
716
                           type = "_mandos._tcp", );
29 by Teddy Hogeborn
* plugins.d/mandosclient.c (start_mandos_communication): Changed
717
    if server_settings["interface"]:
718
        service.interface = if_nametoindex(server_settings["interface"])
25 by Teddy Hogeborn
* mandos-clients.conf ([DEFAULT]): New section.
719
    
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
720
    global main_loop
721
    global bus
722
    global server
723
    # From the Avahi example code
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
724
    DBusGMainLoop(set_as_default=True )
725
    main_loop = gobject.MainLoop()
726
    bus = dbus.SystemBus()
727
    server = dbus.Interface(
728
            bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
729
            avahi.DBUS_INTERFACE_SERVER )
730
    # End of Avahi example code
731
    
28 by Teddy Hogeborn
* server.conf: New file.
732
    debug = server_settings["debug"]
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
733
    
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
734
    if debug:
735
        console = logging.StreamHandler()
736
        # console.setLevel(logging.DEBUG)
737
        console.setFormatter(logging.Formatter\
738
                             ('%(levelname)s: %(message)s'))
739
        logger.addHandler(console)
740
        del console
741
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
742
    clients = Set()
743
    def remove_from_clients(client):
744
        clients.remove(client)
745
        if not clients:
44 by Teddy Hogeborn
* ca.pem: Removed.
746
            logger.critical(u"No clients left, exiting")
28 by Teddy Hogeborn
* server.conf: New file.
747
            sys.exit()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
748
    
44 by Teddy Hogeborn
* ca.pem: Removed.
749
    clients.update(Set(Client(name = section,
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
750
                              stop_hook = remove_from_clients,
44 by Teddy Hogeborn
* ca.pem: Removed.
751
                              config
752
                              = dict(client_config.items(section)))
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
753
                       for section in client_config.sections()))
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
754
    
755
    if not debug:
756
        daemon(False, False)
757
    
758
    def cleanup():
759
        "Cleanup function; run on exit"
760
        global group
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
761
        # From the Avahi example code
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
762
        if not group is None:
763
            group.Free()
764
            group = None
765
        # End of Avahi example code
766
        
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
767
        while clients:
768
            client = clients.pop()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
769
            client.stop_hook = None
770
            client.stop()
771
    
772
    atexit.register(cleanup)
773
    
774
    if not debug:
775
        signal.signal(signal.SIGINT, signal.SIG_IGN)
28 by Teddy Hogeborn
* server.conf: New file.
776
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
777
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
778
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
779
    for client in clients:
780
        client.start()
781
    
28 by Teddy Hogeborn
* server.conf: New file.
782
    tcp_server = IPv6_TCPServer((server_settings["address"],
783
                                 server_settings["port"]),
3 by Björn Påhlsson
Python based server
784
                                tcp_handler,
28 by Teddy Hogeborn
* server.conf: New file.
785
                                settings=server_settings,
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
786
                                clients=clients)
28 by Teddy Hogeborn
* server.conf: New file.
787
    # Find out what port we got
788
    service.port = tcp_server.socket.getsockname()[1]
44 by Teddy Hogeborn
* ca.pem: Removed.
789
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
790
                u" scope_id %d" % tcp_server.socket.getsockname())
28 by Teddy Hogeborn
* server.conf: New file.
791
    
29 by Teddy Hogeborn
* plugins.d/mandosclient.c (start_mandos_communication): Changed
792
    #service.interface = tcp_server.socket.getsockname()[3]
28 by Teddy Hogeborn
* server.conf: New file.
793
    
794
    try:
795
        # From the Avahi example code
796
        server.connect_to_signal("StateChanged", server_state_changed)
797
        try:
798
            server_state_changed(server.GetState())
799
        except dbus.exceptions.DBusException, error:
800
            logger.critical(u"DBusException: %s", error)
801
            sys.exit(1)
802
        # End of Avahi example code
803
        
804
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
805
                             lambda *args, **kwargs:
806
                             tcp_server.handle_request\
807
                             (*args[2:], **kwargs) or True)
808
        
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
809
        logger.debug("Starting main loop")
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
810
        main_loop_started = True
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
811
        main_loop.run()
28 by Teddy Hogeborn
* server.conf: New file.
812
    except AvahiError, error:
813
        logger.critical(u"AvahiError: %s" + unicode(error))
814
        sys.exit(1)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
815
    except KeyboardInterrupt:
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
816
        if debug:
817
            print
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
818
819
if __name__ == '__main__':
820
    main()