/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release
3 by Björn Påhlsson
Python based server
1
#!/usr/bin/python
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2
# -*- mode: python; coding: utf-8 -*-
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3
# 
4
# Mandos server - give out binary blobs to connecting clients.
5
# 
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
46 by Teddy Hogeborn
* network-protocol.txt: New.
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
12
# 
28 by Teddy Hogeborn
* server.conf: New file.
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
15
# 
16
# This program is free software: you can redistribute it and/or modify
17
# it under the terms of the GNU General Public License as published by
18
# the Free Software Foundation, either version 3 of the License, or
19
# (at your option) any later version.
20
#
21
#     This program is distributed in the hope that it will be useful,
22
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
23
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
24
#     GNU General Public License for more details.
25
# 
26
# You should have received a copy of the GNU General Public License
27
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
28
# 
28 by Teddy Hogeborn
* server.conf: New file.
29
# Contact the authors at <mandos@fukt.bsnet.se>.
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
30
# 
3 by Björn Påhlsson
Python based server
31
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
32
from __future__ import division
33
3 by Björn Påhlsson
Python based server
34
import SocketServer
35
import socket
36
import select
37
from optparse import OptionParser
38
import datetime
39
import errno
40
import gnutls.crypto
41
import gnutls.connection
42
import gnutls.errors
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
43
import gnutls.library.functions
44
import gnutls.library.constants
45
import gnutls.library.types
3 by Björn Påhlsson
Python based server
46
import ConfigParser
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
47
import sys
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
48
import re
49
import os
50
import signal
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
51
from sets import Set
52
import subprocess
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
53
import atexit
54
import stat
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
55
import logging
56
import logging.handlers
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
57
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
58
import dbus
59
import gobject
60
import avahi
61
from dbus.mainloop.glib import DBusGMainLoop
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
62
import ctypes
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
63
57 by Teddy Hogeborn
* mandos (version): New variable.
64
version = "1.0"
13 by Björn Påhlsson
Added following support:
65
66
logger = logging.Logger('mandos')
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
67
syslogger = logging.handlers.SysLogHandler\
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
68
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
69
             address = "/dev/log")
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
70
syslogger.setFormatter(logging.Formatter\
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
71
                        ('Mandos: %(levelname)s: %(message)s'))
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
72
logger.addHandler(syslogger)
13 by Björn Påhlsson
Added following support:
73
61 by Teddy Hogeborn
* mandos (console): Define handler globally.
74
console = logging.StreamHandler()
75
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
76
                                       ' %(message)s'))
77
logger.addHandler(console)
28 by Teddy Hogeborn
* server.conf: New file.
78
79
class AvahiError(Exception):
80
    def __init__(self, value):
81
        self.value = value
82
    def __str__(self):
83
        return repr(self.value)
84
85
class AvahiServiceError(AvahiError):
86
    pass
87
88
class AvahiGroupError(AvahiError):
89
    pass
90
91
92
class AvahiService(object):
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
93
    """An Avahi (Zeroconf) service.
94
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
95
    interface: integer; avahi.IF_UNSPEC or an interface index.
96
               Used to optionally bind to the specified interface.
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
97
    name: string; Example: 'Mandos'
98
    type: string; Example: '_mandos._tcp'.
99
                  See <http://www.dns-sd.org/ServiceTypes.html>
100
    port: integer; what port to announce
101
    TXT: list of strings; TXT record for the service
102
    domain: string; Domain to publish on, default to .local if empty.
103
    host: string; Host to publish records for, default is localhost
104
    max_renames: integer; maximum number of renames
105
    rename_count: integer; counter so we only rename after collisions
106
                  a sensible number of times
28 by Teddy Hogeborn
* server.conf: New file.
107
    """
108
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
109
                 type = None, port = None, TXT = None, domain = "",
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
110
                 host = "", max_renames = 32768):
28 by Teddy Hogeborn
* server.conf: New file.
111
        self.interface = interface
112
        self.name = name
113
        self.type = type
114
        self.port = port
115
        if TXT is None:
116
            self.TXT = []
117
        else:
118
            self.TXT = TXT
119
        self.domain = domain
120
        self.host = host
121
        self.rename_count = 0
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
122
        self.max_renames = max_renames
28 by Teddy Hogeborn
* server.conf: New file.
123
    def rename(self):
124
        """Derived from the Avahi example code"""
125
        if self.rename_count >= self.max_renames:
126
            logger.critical(u"No suitable service name found after %i"
127
                            u" retries, exiting.", rename_count)
128
            raise AvahiServiceError("Too many renames")
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
129
        self.name = server.GetAlternativeServiceName(self.name)
130
        logger.info(u"Changing name to %r ...", str(self.name))
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
131
        syslogger.setFormatter(logging.Formatter\
132
                               ('Mandos (%s): %%(levelname)s:'
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
133
                               ' %%(message)s' % self.name))
28 by Teddy Hogeborn
* server.conf: New file.
134
        self.remove()
135
        self.add()
136
        self.rename_count += 1
137
    def remove(self):
138
        """Derived from the Avahi example code"""
139
        if group is not None:
140
            group.Reset()
141
    def add(self):
142
        """Derived from the Avahi example code"""
143
        global group
144
        if group is None:
145
            group = dbus.Interface\
146
                    (bus.get_object(avahi.DBUS_NAME,
147
                                    server.EntryGroupNew()),
148
                     avahi.DBUS_INTERFACE_ENTRY_GROUP)
149
            group.connect_to_signal('StateChanged',
150
                                    entry_group_state_changed)
151
        logger.debug(u"Adding service '%s' of type '%s' ...",
152
                     service.name, service.type)
153
        group.AddService(
154
                self.interface,         # interface
155
                avahi.PROTO_INET6,      # protocol
156
                dbus.UInt32(0),         # flags
157
                self.name, self.type,
158
                self.domain, self.host,
159
                dbus.UInt16(self.port),
160
                avahi.string_array_to_txt_array(self.TXT))
161
        group.Commit()
162
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
163
# From the Avahi example code:
28 by Teddy Hogeborn
* server.conf: New file.
164
group = None                            # our entry group
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
165
# End of Avahi example code
166
167
3 by Björn Påhlsson
Python based server
168
class Client(object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
169
    """A representation of a client host served by this server.
170
    Attributes:
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
171
    name:      string; from the config file, used in log messages
172
    fingerprint: string (40 or 32 hexadecimal digits); used to
173
                 uniquely identify the client
174
    secret:    bytestring; sent verbatim (over TLS) to client
51 by Teddy Hogeborn
* clients.conf: Better comments.
175
    host:      string; available for use by the checker command
28 by Teddy Hogeborn
* server.conf: New file.
176
    created:   datetime.datetime(); object creation, not client host
177
    last_checked_ok: datetime.datetime() or None if not yet checked OK
178
    timeout:   datetime.timedelta(); How long from last_checked_ok
179
                                     until this client is invalid
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
180
    interval:  datetime.timedelta(); How often to start a new checker
181
    stop_hook: If set, called by stop() as stop_hook(self)
182
    checker:   subprocess.Popen(); a running checker process used
183
                                   to see if the client lives.
28 by Teddy Hogeborn
* server.conf: New file.
184
                                   'None' if no process is running.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
185
    checker_initiator_tag: a gobject event source tag, or None
186
    stop_initiator_tag:    - '' -
187
    checker_callback_tag:  - '' -
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
188
    checker_command: string; External command which is run to check if
28 by Teddy Hogeborn
* server.conf: New file.
189
                     client lives.  %() expansions are done at
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
190
                     runtime with vars(self) as dict, so that for
191
                     instance %(name)s can be used in the command.
192
    Private attibutes:
193
    _timeout: Real variable for 'timeout'
194
    _interval: Real variable for 'interval'
28 by Teddy Hogeborn
* server.conf: New file.
195
    _timeout_milliseconds: Used when calling gobject.timeout_add()
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
196
    _interval_milliseconds: - '' -
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
197
    """
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
198
    def _set_timeout(self, timeout):
199
        "Setter function for 'timeout' attribute"
200
        self._timeout = timeout
201
        self._timeout_milliseconds = ((self.timeout.days
202
                                       * 24 * 60 * 60 * 1000)
203
                                      + (self.timeout.seconds * 1000)
204
                                      + (self.timeout.microseconds
205
                                         // 1000))
206
    timeout = property(lambda self: self._timeout,
207
                       _set_timeout)
208
    del _set_timeout
209
    def _set_interval(self, interval):
210
        "Setter function for 'interval' attribute"
211
        self._interval = interval
212
        self._interval_milliseconds = ((self.interval.days
213
                                        * 24 * 60 * 60 * 1000)
214
                                       + (self.interval.seconds
215
                                          * 1000)
216
                                       + (self.interval.microseconds
217
                                          // 1000))
218
    interval = property(lambda self: self._interval,
219
                        _set_interval)
220
    del _set_interval
44 by Teddy Hogeborn
* ca.pem: Removed.
221
    def __init__(self, name = None, stop_hook=None, config={}):
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
222
        """Note: the 'checker' key in 'config' sets the
223
        'checker_command' attribute and *not* the 'checker'
224
        attribute."""
3 by Björn Påhlsson
Python based server
225
        self.name = name
25 by Teddy Hogeborn
* mandos-clients.conf ([DEFAULT]): New section.
226
        logger.debug(u"Creating client %r", self.name)
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
227
        # Uppercase and remove spaces from fingerprint for later
228
        # comparison purposes with return value from the fingerprint()
229
        # function
44 by Teddy Hogeborn
* ca.pem: Removed.
230
        self.fingerprint = config["fingerprint"].upper()\
231
                           .replace(u" ", u"")
25 by Teddy Hogeborn
* mandos-clients.conf ([DEFAULT]): New section.
232
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
44 by Teddy Hogeborn
* ca.pem: Removed.
233
        if "secret" in config:
234
            self.secret = config["secret"].decode(u"base64")
235
        elif "secfile" in config:
236
            sf = open(config["secfile"])
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
237
            self.secret = sf.read()
238
            sf.close()
3 by Björn Påhlsson
Python based server
239
        else:
28 by Teddy Hogeborn
* server.conf: New file.
240
            raise TypeError(u"No secret or secfile for client %s"
241
                            % self.name)
51 by Teddy Hogeborn
* clients.conf: Better comments.
242
        self.host = config.get("host", "")
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
243
        self.created = datetime.datetime.now()
28 by Teddy Hogeborn
* server.conf: New file.
244
        self.last_checked_ok = None
44 by Teddy Hogeborn
* ca.pem: Removed.
245
        self.timeout = string_to_delta(config["timeout"])
246
        self.interval = string_to_delta(config["interval"])
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
247
        self.stop_hook = stop_hook
248
        self.checker = None
249
        self.checker_initiator_tag = None
250
        self.stop_initiator_tag = None
251
        self.checker_callback_tag = None
44 by Teddy Hogeborn
* ca.pem: Removed.
252
        self.check_command = config["checker"]
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
253
    def start(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
254
        """Start this client's checker and timeout hooks"""
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
255
        # Schedule a new checker to be started an 'interval' from now,
256
        # and every interval from then on.
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
257
        self.checker_initiator_tag = gobject.timeout_add\
258
                                     (self._interval_milliseconds,
259
                                      self.start_checker)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
260
        # Also start a new checker *right now*.
261
        self.start_checker()
262
        # Schedule a stop() when 'timeout' has passed
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
263
        self.stop_initiator_tag = gobject.timeout_add\
264
                                  (self._timeout_milliseconds,
265
                                   self.stop)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
266
    def stop(self):
267
        """Stop this client.
28 by Teddy Hogeborn
* server.conf: New file.
268
        The possibility that a client might be restarted is left open,
269
        but not currently used."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
270
        # If this client doesn't have a secret, it is already stopped.
51 by Teddy Hogeborn
* clients.conf: Better comments.
271
        if hasattr(self, "secret") and self.secret:
44 by Teddy Hogeborn
* ca.pem: Removed.
272
            logger.info(u"Stopping client %s", self.name)
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
273
            self.secret = None
274
        else:
275
            return False
28 by Teddy Hogeborn
* server.conf: New file.
276
        if getattr(self, "stop_initiator_tag", False):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
277
            gobject.source_remove(self.stop_initiator_tag)
278
            self.stop_initiator_tag = None
28 by Teddy Hogeborn
* server.conf: New file.
279
        if getattr(self, "checker_initiator_tag", False):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
280
            gobject.source_remove(self.checker_initiator_tag)
281
            self.checker_initiator_tag = None
282
        self.stop_checker()
283
        if self.stop_hook:
284
            self.stop_hook(self)
285
        # Do not run this again if called by a gobject.timeout_add
286
        return False
287
    def __del__(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
288
        self.stop_hook = None
289
        self.stop()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
290
    def checker_callback(self, pid, condition):
291
        """The checker has completed, so take appropriate actions."""
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
292
        now = datetime.datetime.now()
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
293
        self.checker_callback_tag = None
294
        self.checker = None
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
295
        if os.WIFEXITED(condition) \
296
               and (os.WEXITSTATUS(condition) == 0):
44 by Teddy Hogeborn
* ca.pem: Removed.
297
            logger.info(u"Checker for %(name)s succeeded",
298
                        vars(self))
28 by Teddy Hogeborn
* server.conf: New file.
299
            self.last_checked_ok = now
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
300
            gobject.source_remove(self.stop_initiator_tag)
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
301
            self.stop_initiator_tag = gobject.timeout_add\
302
                                      (self._timeout_milliseconds,
303
                                       self.stop)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
304
        elif not os.WIFEXITED(condition):
13 by Björn Påhlsson
Added following support:
305
            logger.warning(u"Checker for %(name)s crashed?",
306
                           vars(self))
307
        else:
44 by Teddy Hogeborn
* ca.pem: Removed.
308
            logger.info(u"Checker for %(name)s failed",
309
                        vars(self))
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
310
    def start_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
311
        """Start a new checker subprocess if one is not running.
312
        If a checker already exists, leave it running and do
313
        nothing."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
314
        # The reason for not killing a running checker is that if we
315
        # did that, then if a checker (for some reason) started
316
        # running slowly and taking more than 'interval' time, the
317
        # client would inevitably timeout, since no checker would get
318
        # a chance to run to completion.  If we instead leave running
319
        # checkers alone, the checker would have to take more time
320
        # than 'timeout' for the client to be declared invalid, which
321
        # is as it should be.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
322
        if self.checker is None:
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
323
            try:
28 by Teddy Hogeborn
* server.conf: New file.
324
                # In case check_command has exactly one % operator
51 by Teddy Hogeborn
* clients.conf: Better comments.
325
                command = self.check_command % self.host
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
326
            except TypeError:
28 by Teddy Hogeborn
* server.conf: New file.
327
                # Escape attributes for the shell
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
328
                escaped_attrs = dict((key, re.escape(str(val)))
329
                                     for key, val in
330
                                     vars(self).iteritems())
13 by Björn Påhlsson
Added following support:
331
                try:
332
                    command = self.check_command % escaped_attrs
333
                except TypeError, error:
28 by Teddy Hogeborn
* server.conf: New file.
334
                    logger.error(u'Could not format string "%s":'
335
                                 u' %s', self.check_command, error)
13 by Björn Påhlsson
Added following support:
336
                    return True # Try again later
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
337
            try:
44 by Teddy Hogeborn
* ca.pem: Removed.
338
                logger.info(u"Starting checker %r for %s",
339
                            command, self.name)
28 by Teddy Hogeborn
* server.conf: New file.
340
                self.checker = subprocess.Popen(command,
341
                                                close_fds=True,
342
                                                shell=True, cwd="/")
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
343
                self.checker_callback_tag = gobject.child_watch_add\
344
                                            (self.checker.pid,
345
                                             self.checker_callback)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
346
            except subprocess.OSError, error:
13 by Björn Påhlsson
Added following support:
347
                logger.error(u"Failed to start subprocess: %s",
348
                             error)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
349
        # Re-run this periodically if run by gobject.timeout_add
350
        return True
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
351
    def stop_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
352
        """Force the checker process, if any, to stop."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
353
        if self.checker_callback_tag:
354
            gobject.source_remove(self.checker_callback_tag)
355
            self.checker_callback_tag = None
28 by Teddy Hogeborn
* server.conf: New file.
356
        if getattr(self, "checker", None) is None:
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
357
            return
51 by Teddy Hogeborn
* clients.conf: Better comments.
358
        logger.debug(u"Stopping checker for %(name)s", vars(self))
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
359
        try:
360
            os.kill(self.checker.pid, signal.SIGTERM)
361
            #os.sleep(0.5)
362
            #if self.checker.poll() is None:
363
            #    os.kill(self.checker.pid, signal.SIGKILL)
364
        except OSError, error:
28 by Teddy Hogeborn
* server.conf: New file.
365
            if error.errno != errno.ESRCH: # No such process
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
366
                raise
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
367
        self.checker = None
28 by Teddy Hogeborn
* server.conf: New file.
368
    def still_valid(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
369
        """Has the timeout not yet passed for this client?"""
28 by Teddy Hogeborn
* server.conf: New file.
370
        now = datetime.datetime.now()
371
        if self.last_checked_ok is None:
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
372
            return now < (self.created + self.timeout)
373
        else:
28 by Teddy Hogeborn
* server.conf: New file.
374
            return now < (self.last_checked_ok + self.timeout)
3 by Björn Påhlsson
Python based server
375
376
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
377
def peer_certificate(session):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
378
    "Return the peer's OpenPGP certificate as a bytestring"
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
379
    # If not an OpenPGP certificate...
380
    if gnutls.library.functions.gnutls_certificate_type_get\
381
            (session._c_object) \
382
           != gnutls.library.constants.GNUTLS_CRT_OPENPGP:
383
        # ...do the normal thing
384
        return session.peer_certificate
385
    list_size = ctypes.c_uint()
386
    cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
387
        (session._c_object, ctypes.byref(list_size))
388
    if list_size.value == 0:
389
        return None
390
    cert = cert_list[0]
391
    return ctypes.string_at(cert.data, cert.size)
392
393
394
def fingerprint(openpgp):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
395
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
396
    # New GnuTLS "datum" with the OpenPGP public key
397
    datum = gnutls.library.types.gnutls_datum_t\
398
        (ctypes.cast(ctypes.c_char_p(openpgp),
399
                     ctypes.POINTER(ctypes.c_ubyte)),
400
         ctypes.c_uint(len(openpgp)))
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
401
    # New empty GnuTLS certificate
402
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
403
    gnutls.library.functions.gnutls_openpgp_crt_init\
404
        (ctypes.byref(crt))
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
405
    # Import the OpenPGP public key into the certificate
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
406
    gnutls.library.functions.gnutls_openpgp_crt_import\
407
                    (crt, ctypes.byref(datum),
408
                     gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
409
    # New buffer for the fingerprint
410
    buffer = ctypes.create_string_buffer(20)
411
    buffer_length = ctypes.c_size_t()
412
    # Get the fingerprint from the certificate into the buffer
413
    gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
414
        (crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
415
    # Deinit the certificate
416
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
417
    # Convert the buffer to a Python bytestring
418
    fpr = ctypes.string_at(buffer, buffer_length.value)
419
    # Convert the bytestring to hexadecimal notation
420
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
421
    return hex_fpr
422
423
3 by Björn Påhlsson
Python based server
424
class tcp_handler(SocketServer.BaseRequestHandler, object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
425
    """A TCP request handler class.
426
    Instantiated by IPv6_TCPServer for each request to handle it.
427
    Note: This will run in its own forked process."""
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
428
    
3 by Björn Påhlsson
Python based server
429
    def handle(self):
44 by Teddy Hogeborn
* ca.pem: Removed.
430
        logger.info(u"TCP connection from: %s",
13 by Björn Påhlsson
Added following support:
431
                     unicode(self.client_address))
41 by Teddy Hogeborn
Merge.
432
        session = gnutls.connection.ClientSession\
433
                  (self.request, gnutls.connection.X509Credentials())
434
        
24.1.12 by Björn Påhlsson
merge +
435
        line = self.request.makefile().readline()
436
        logger.debug(u"Protocol version: %r", line)
24.1.11 by Björn Påhlsson
Added support for protocol version handling
437
        try:
438
            if int(line.strip().split()[0]) > 1:
439
                raise RuntimeError
440
        except (ValueError, IndexError, RuntimeError), error:
441
            logger.error(u"Unknown protocol version: %s", error)
442
            return
443
        
28 by Teddy Hogeborn
* server.conf: New file.
444
        # Note: gnutls.connection.X509Credentials is really a generic
445
        # GnuTLS certificate credentials object so long as no X.509
446
        # keys are added to it.  Therefore, we can use it here despite
447
        # using OpenPGP certificates.
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
448
        
449
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
450
        #                "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
451
        #                "+DHE-DSS"))
28 by Teddy Hogeborn
* server.conf: New file.
452
        priority = "NORMAL"             # Fallback default, since this
453
                                        # MUST be set.
454
        if self.server.settings["priority"]:
455
            priority = self.server.settings["priority"]
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
456
        gnutls.library.functions.gnutls_priority_set_direct\
457
            (session._c_object, priority, None);
458
        
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
459
        try:
460
            session.handshake()
461
        except gnutls.errors.GNUTLSError, error:
44 by Teddy Hogeborn
* ca.pem: Removed.
462
            logger.warning(u"Handshake failed: %s", error)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
463
            # Do not run session.bye() here: the session is not
464
            # established.  Just abandon the request.
465
            return
3 by Björn Påhlsson
Python based server
466
        try:
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
467
            fpr = fingerprint(peer_certificate(session))
468
        except (TypeError, gnutls.errors.GNUTLSError), error:
44 by Teddy Hogeborn
* ca.pem: Removed.
469
            logger.warning(u"Bad certificate: %s", error)
3 by Björn Påhlsson
Python based server
470
            session.bye()
471
            return
13 by Björn Påhlsson
Added following support:
472
        logger.debug(u"Fingerprint: %s", fpr)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
473
        client = None
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
474
        for c in self.server.clients:
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
475
            if c.fingerprint == fpr:
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
476
                client = c
477
                break
28 by Teddy Hogeborn
* server.conf: New file.
478
        if not client:
44 by Teddy Hogeborn
* ca.pem: Removed.
479
            logger.warning(u"Client not found for fingerprint: %s",
480
                           fpr)
28 by Teddy Hogeborn
* server.conf: New file.
481
            session.bye()
482
            return
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
483
        # Have to check if client.still_valid(), since it is possible
484
        # that the client timed out while establishing the GnuTLS
485
        # session.
28 by Teddy Hogeborn
* server.conf: New file.
486
        if not client.still_valid():
44 by Teddy Hogeborn
* ca.pem: Removed.
487
            logger.warning(u"Client %(name)s is invalid",
488
                           vars(client))
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
489
            session.bye()
490
            return
491
        sent_size = 0
492
        while sent_size < len(client.secret):
493
            sent = session.send(client.secret[sent_size:])
13 by Björn Påhlsson
Added following support:
494
            logger.debug(u"Sent: %d, remaining: %d",
495
                         sent, len(client.secret)
496
                         - (sent_size + sent))
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
497
            sent_size += sent
3 by Björn Påhlsson
Python based server
498
        session.bye()
499
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
500
3 by Björn Påhlsson
Python based server
501
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
502
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
503
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
504
        settings:       Server settings
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
505
        clients:        Set() of Client objects
506
    """
507
    address_family = socket.AF_INET6
508
    def __init__(self, *args, **kwargs):
28 by Teddy Hogeborn
* server.conf: New file.
509
        if "settings" in kwargs:
510
            self.settings = kwargs["settings"]
511
            del kwargs["settings"]
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
512
        if "clients" in kwargs:
513
            self.clients = kwargs["clients"]
514
            del kwargs["clients"]
515
        return super(type(self), self).__init__(*args, **kwargs)
516
    def server_bind(self):
517
        """This overrides the normal server_bind() function
518
        to bind to an interface if one was specified, and also NOT to
519
        bind to an address or port if they were not specified."""
29 by Teddy Hogeborn
* plugins.d/mandosclient.c (start_mandos_communication): Changed
520
        if self.settings["interface"]:
28 by Teddy Hogeborn
* server.conf: New file.
521
            # 25 is from /usr/include/asm-i486/socket.h
522
            SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
523
            try:
524
                self.socket.setsockopt(socket.SOL_SOCKET,
28 by Teddy Hogeborn
* server.conf: New file.
525
                                       SO_BINDTODEVICE,
526
                                       self.settings["interface"])
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
527
            except socket.error, error:
528
                if error[0] == errno.EPERM:
44 by Teddy Hogeborn
* ca.pem: Removed.
529
                    logger.error(u"No permission to"
530
                                 u" bind to interface %s",
531
                                 self.settings["interface"])
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
532
                else:
533
                    raise error
534
        # Only bind(2) the socket if we really need to.
535
        if self.server_address[0] or self.server_address[1]:
536
            if not self.server_address[0]:
537
                in6addr_any = "::"
538
                self.server_address = (in6addr_any,
539
                                       self.server_address[1])
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
540
            elif not self.server_address[1]:
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
541
                self.server_address = (self.server_address[0],
542
                                       0)
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
543
#                 if self.settings["interface"]:
544
#                     self.server_address = (self.server_address[0],
545
#                                            0, # port
546
#                                            0, # flowinfo
547
#                                            if_nametoindex
548
#                                            (self.settings
549
#                                             ["interface"]))
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
550
            return super(type(self), self).server_bind()
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
551
3 by Björn Påhlsson
Python based server
552
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
553
def string_to_delta(interval):
554
    """Parse a string and return a datetime.timedelta
555
556
    >>> string_to_delta('7d')
557
    datetime.timedelta(7)
558
    >>> string_to_delta('60s')
559
    datetime.timedelta(0, 60)
560
    >>> string_to_delta('60m')
561
    datetime.timedelta(0, 3600)
562
    >>> string_to_delta('24h')
563
    datetime.timedelta(1)
564
    >>> string_to_delta(u'1w')
565
    datetime.timedelta(7)
566
    """
567
    try:
568
        suffix=unicode(interval[-1])
569
        value=int(interval[:-1])
570
        if suffix == u"d":
571
            delta = datetime.timedelta(value)
572
        elif suffix == u"s":
573
            delta = datetime.timedelta(0, value)
574
        elif suffix == u"m":
575
            delta = datetime.timedelta(0, 0, 0, 0, value)
576
        elif suffix == u"h":
577
            delta = datetime.timedelta(0, 0, 0, 0, 0, value)
578
        elif suffix == u"w":
579
            delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
580
        else:
581
            raise ValueError
582
    except (ValueError, IndexError):
583
        raise ValueError
584
    return delta
585
8 by Teddy Hogeborn
* Makefile (client_debug): Bug fix; add quotes and / to CERT_ROOT.
586
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
587
def server_state_changed(state):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
588
    """Derived from the Avahi example code"""
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
589
    if state == avahi.SERVER_COLLISION:
44 by Teddy Hogeborn
* ca.pem: Removed.
590
        logger.error(u"Server name collision")
28 by Teddy Hogeborn
* server.conf: New file.
591
        service.remove()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
592
    elif state == avahi.SERVER_RUNNING:
28 by Teddy Hogeborn
* server.conf: New file.
593
        service.add()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
594
595
596
def entry_group_state_changed(state, error):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
597
    """Derived from the Avahi example code"""
13 by Björn Påhlsson
Added following support:
598
    logger.debug(u"state change: %i", state)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
599
    
600
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
13 by Björn Påhlsson
Added following support:
601
        logger.debug(u"Service established.")
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
602
    elif state == avahi.ENTRY_GROUP_COLLISION:
28 by Teddy Hogeborn
* server.conf: New file.
603
        logger.warning(u"Service name collision.")
604
        service.rename()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
605
    elif state == avahi.ENTRY_GROUP_FAILURE:
28 by Teddy Hogeborn
* server.conf: New file.
606
        logger.critical(u"Error in group state changed %s",
607
                        unicode(error))
608
        raise AvahiGroupError("State changed: %s", str(error))
609
24.1.13 by Björn Påhlsson
mandosclient
610
def if_nametoindex(interface):
28 by Teddy Hogeborn
* server.conf: New file.
611
    """Call the C function if_nametoindex(), or equivalent"""
24.1.13 by Björn Påhlsson
mandosclient
612
    global if_nametoindex
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
613
    try:
28 by Teddy Hogeborn
* server.conf: New file.
614
        if "ctypes.util" not in sys.modules:
615
            import ctypes.util
24.1.13 by Björn Påhlsson
mandosclient
616
        if_nametoindex = ctypes.cdll.LoadLibrary\
617
            (ctypes.util.find_library("c")).if_nametoindex
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
618
    except (OSError, AttributeError):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
619
        if "struct" not in sys.modules:
620
            import struct
621
        if "fcntl" not in sys.modules:
622
            import fcntl
24.1.13 by Björn Påhlsson
mandosclient
623
        def if_nametoindex(interface):
28 by Teddy Hogeborn
* server.conf: New file.
624
            "Get an interface index the hard way, i.e. using fcntl()"
625
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
626
            s = socket.socket()
627
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
628
                                struct.pack("16s16x", interface))
629
            s.close()
630
            interface_index = struct.unpack("I", ifreq[16:20])[0]
631
            return interface_index
24.1.13 by Björn Påhlsson
mandosclient
632
    return if_nametoindex(interface)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
633
634
47 by Teddy Hogeborn
* plugbasedclient.c: Renamed to "mandos-client.c". All users changed.
635
def daemon(nochdir = False, noclose = False):
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
636
    """See daemon(3).  Standard BSD Unix function.
637
    This should really exist as os.daemon, but it doesn't (yet)."""
638
    if os.fork():
639
        sys.exit()
640
    os.setsid()
641
    if not nochdir:
642
        os.chdir("/")
46 by Teddy Hogeborn
* network-protocol.txt: New.
643
    if os.fork():
644
        sys.exit()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
645
    if not noclose:
646
        # Close all standard open file descriptors
28 by Teddy Hogeborn
* server.conf: New file.
647
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
648
        if not stat.S_ISCHR(os.fstat(null).st_mode):
649
            raise OSError(errno.ENODEV,
650
                          "/dev/null not a character device")
651
        os.dup2(null, sys.stdin.fileno())
652
        os.dup2(null, sys.stdout.fileno())
653
        os.dup2(null, sys.stderr.fileno())
654
        if null > 2:
655
            os.close(null)
656
657
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
658
def main():
659
    global main_loop_started
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
660
    main_loop_started = False
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
661
    
59 by Teddy Hogeborn
* mandos (main): Use program name in --version output.
662
    parser = OptionParser(version = "%%prog %s" % version)
3 by Björn Påhlsson
Python based server
663
    parser.add_option("-i", "--interface", type="string",
28 by Teddy Hogeborn
* server.conf: New file.
664
                      metavar="IF", help="Bind to interface IF")
665
    parser.add_option("-a", "--address", type="string",
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
666
                      help="Address to listen for requests on")
28 by Teddy Hogeborn
* server.conf: New file.
667
    parser.add_option("-p", "--port", type="int",
3 by Björn Påhlsson
Python based server
668
                      help="Port number to receive requests on")
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
669
    parser.add_option("--check", action="store_true", default=False,
670
                      help="Run self-test")
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
671
    parser.add_option("--debug", action="store_true",
28 by Teddy Hogeborn
* server.conf: New file.
672
                      help="Debug mode; run in foreground and log to"
673
                      " terminal")
674
    parser.add_option("--priority", type="string", help="GnuTLS"
675
                      " priority string (see GnuTLS documentation)")
676
    parser.add_option("--servicename", type="string", metavar="NAME",
677
                      help="Zeroconf service name")
678
    parser.add_option("--configdir", type="string",
679
                      default="/etc/mandos", metavar="DIR",
680
                      help="Directory to search for configuration"
681
                      " files")
3 by Björn Påhlsson
Python based server
682
    (options, args) = parser.parse_args()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
683
    
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
684
    if options.check:
685
        import doctest
686
        doctest.testmod()
687
        sys.exit()
3 by Björn Påhlsson
Python based server
688
    
28 by Teddy Hogeborn
* server.conf: New file.
689
    # Default values for config file for server-global settings
690
    server_defaults = { "interface": "",
691
                        "address": "",
692
                        "port": "",
693
                        "debug": "False",
694
                        "priority":
695
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
696
                        "servicename": "Mandos",
697
                        }
698
    
699
    # Parse config file for server-global settings
700
    server_config = ConfigParser.SafeConfigParser(server_defaults)
701
    del server_defaults
47 by Teddy Hogeborn
* plugbasedclient.c: Renamed to "mandos-client.c". All users changed.
702
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
28 by Teddy Hogeborn
* server.conf: New file.
703
    # Convert the SafeConfigParser object to a dict
89 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages for section 5 pages.
704
    server_settings = server_config.defaults()
28 by Teddy Hogeborn
* server.conf: New file.
705
    # Use getboolean on the boolean config option
706
    server_settings["debug"] = server_config.getboolean\
89 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages for section 5 pages.
707
                               ("DEFAULT", "debug")
28 by Teddy Hogeborn
* server.conf: New file.
708
    del server_config
709
    
710
    # Override the settings from the config file with command line
711
    # options, if set.
712
    for option in ("interface", "address", "port", "debug",
713
                   "priority", "servicename", "configdir"):
714
        value = getattr(options, option)
715
        if value is not None:
716
            server_settings[option] = value
717
    del options
718
    # Now we have our good server settings in "server_settings"
719
    
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
720
    debug = server_settings["debug"]
721
    
722
    if not debug:
723
        syslogger.setLevel(logging.WARNING)
61 by Teddy Hogeborn
* mandos (console): Define handler globally.
724
        console.setLevel(logging.WARNING)
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
725
    
726
    if server_settings["servicename"] != "Mandos":
727
        syslogger.setFormatter(logging.Formatter\
728
                               ('Mandos (%s): %%(levelname)s:'
729
                                ' %%(message)s'
730
                                % server_settings["servicename"]))
731
    
28 by Teddy Hogeborn
* server.conf: New file.
732
    # Parse config file with clients
733
    client_defaults = { "timeout": "1h",
734
                        "interval": "5m",
51 by Teddy Hogeborn
* clients.conf: Better comments.
735
                        "checker": "fping -q -- %%(host)s",
28 by Teddy Hogeborn
* server.conf: New file.
736
                        }
737
    client_config = ConfigParser.SafeConfigParser(client_defaults)
738
    client_config.read(os.path.join(server_settings["configdir"],
739
                                    "clients.conf"))
740
    
741
    global service
742
    service = AvahiService(name = server_settings["servicename"],
743
                           type = "_mandos._tcp", );
29 by Teddy Hogeborn
* plugins.d/mandosclient.c (start_mandos_communication): Changed
744
    if server_settings["interface"]:
745
        service.interface = if_nametoindex(server_settings["interface"])
25 by Teddy Hogeborn
* mandos-clients.conf ([DEFAULT]): New section.
746
    
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
747
    global main_loop
748
    global bus
749
    global server
750
    # From the Avahi example code
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
751
    DBusGMainLoop(set_as_default=True )
752
    main_loop = gobject.MainLoop()
753
    bus = dbus.SystemBus()
754
    server = dbus.Interface(
755
            bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
756
            avahi.DBUS_INTERFACE_SERVER )
757
    # End of Avahi example code
758
    
759
    clients = Set()
760
    def remove_from_clients(client):
761
        clients.remove(client)
762
        if not clients:
44 by Teddy Hogeborn
* ca.pem: Removed.
763
            logger.critical(u"No clients left, exiting")
28 by Teddy Hogeborn
* server.conf: New file.
764
            sys.exit()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
765
    
44 by Teddy Hogeborn
* ca.pem: Removed.
766
    clients.update(Set(Client(name = section,
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
767
                              stop_hook = remove_from_clients,
44 by Teddy Hogeborn
* ca.pem: Removed.
768
                              config
769
                              = dict(client_config.items(section)))
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
770
                       for section in client_config.sections()))
51 by Teddy Hogeborn
* clients.conf: Better comments.
771
    if not clients:
772
        logger.critical(u"No clients defined")
773
        sys.exit(1)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
774
    
775
    if not debug:
61 by Teddy Hogeborn
* mandos (console): Define handler globally.
776
        logger.removeHandler(console)
47 by Teddy Hogeborn
* plugbasedclient.c: Renamed to "mandos-client.c". All users changed.
777
        daemon()
51 by Teddy Hogeborn
* clients.conf: Better comments.
778
    
50 by Teddy Hogeborn
* Makefile: Do DocBook manual conversion in a better way.
779
    pidfilename = "/var/run/mandos/mandos.pid"
780
    pid = os.getpid()
781
    try:
782
        pidfile = open(pidfilename, "w")
783
        pidfile.write(str(pid) + "\n")
784
        pidfile.close()
785
        del pidfile
786
    except IOError, err:
51 by Teddy Hogeborn
* clients.conf: Better comments.
787
        logger.error(u"Could not write %s file with PID %d",
50 by Teddy Hogeborn
* Makefile: Do DocBook manual conversion in a better way.
788
                     pidfilename, os.getpid())
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
789
    
790
    def cleanup():
791
        "Cleanup function; run on exit"
792
        global group
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
793
        # From the Avahi example code
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
794
        if not group is None:
795
            group.Free()
796
            group = None
797
        # End of Avahi example code
798
        
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
799
        while clients:
800
            client = clients.pop()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
801
            client.stop_hook = None
802
            client.stop()
803
    
804
    atexit.register(cleanup)
805
    
806
    if not debug:
807
        signal.signal(signal.SIGINT, signal.SIG_IGN)
28 by Teddy Hogeborn
* server.conf: New file.
808
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
809
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
810
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
811
    for client in clients:
812
        client.start()
813
    
28 by Teddy Hogeborn
* server.conf: New file.
814
    tcp_server = IPv6_TCPServer((server_settings["address"],
815
                                 server_settings["port"]),
3 by Björn Påhlsson
Python based server
816
                                tcp_handler,
28 by Teddy Hogeborn
* server.conf: New file.
817
                                settings=server_settings,
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
818
                                clients=clients)
28 by Teddy Hogeborn
* server.conf: New file.
819
    # Find out what port we got
820
    service.port = tcp_server.socket.getsockname()[1]
44 by Teddy Hogeborn
* ca.pem: Removed.
821
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
822
                u" scope_id %d" % tcp_server.socket.getsockname())
28 by Teddy Hogeborn
* server.conf: New file.
823
    
29 by Teddy Hogeborn
* plugins.d/mandosclient.c (start_mandos_communication): Changed
824
    #service.interface = tcp_server.socket.getsockname()[3]
28 by Teddy Hogeborn
* server.conf: New file.
825
    
826
    try:
827
        # From the Avahi example code
828
        server.connect_to_signal("StateChanged", server_state_changed)
829
        try:
830
            server_state_changed(server.GetState())
831
        except dbus.exceptions.DBusException, error:
832
            logger.critical(u"DBusException: %s", error)
833
            sys.exit(1)
834
        # End of Avahi example code
835
        
836
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
837
                             lambda *args, **kwargs:
838
                             tcp_server.handle_request\
839
                             (*args[2:], **kwargs) or True)
840
        
51 by Teddy Hogeborn
* clients.conf: Better comments.
841
        logger.debug(u"Starting main loop")
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
842
        main_loop_started = True
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
843
        main_loop.run()
28 by Teddy Hogeborn
* server.conf: New file.
844
    except AvahiError, error:
845
        logger.critical(u"AvahiError: %s" + unicode(error))
846
        sys.exit(1)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
847
    except KeyboardInterrupt:
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
848
        if debug:
849
            print
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
850
851
if __name__ == '__main__':
852
    main()