/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to server.py

  • Committer: Teddy Hogeborn
  • Date: 2008-07-21 22:51:46 UTC
  • mfrom: (15.1.4 mandos)
  • Revision ID: teddy@fukt.bsnet.se-20080721225146-55gbo7fqocy4m930
* plugins.d/mandosclient.c (pgp_packet_decrypt): Cast "0" argument to
                                                 gpgme_data_seek.
 (start_mandos_communication): Change "ip" arg to "const char *".  New
                               variable "written".  Remove setsockopt.
                               Bug fix: Do not change decrypted_buffer.
 (resolve_callback): Removed AVAHI_GCC_UNUSED from "interface".

Show diffs side-by-side

added added

removed removed

Lines of Context:
server.py
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
 
# methods "add" and "remove" in the "AvahiService" class, the
10
 
# "server_state_changed" and "entry_group_state_changed" functions,
11
 
# and some lines in "main".
 
9
# following functions: "add_service", "remove_service",
 
10
# "server_state_changed", "entry_group_state_changed", and some lines
 
11
# in "main".
12
12
# 
13
 
# Everything else is
14
 
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
 
13
# Everything else is Copyright © 2007-2008 Teddy Hogeborn and Björn
 
14
# Påhlsson.
15
15
# 
16
16
# This program is free software: you can redistribute it and/or modify
17
17
# it under the terms of the GNU General Public License as published by
24
24
#     GNU General Public License for more details.
25
25
# 
26
26
# You should have received a copy of the GNU General Public License
27
 
# along with this program.  If not, see
28
 
# <http://www.gnu.org/licenses/>.
 
27
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
29
28
# 
30
 
# Contact the authors at <mandos@fukt.bsnet.se>.
 
29
# Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
 
30
# <https://www.fukt.bsnet.se/~teddy/>.
31
31
# 
32
32
 
33
 
from __future__ import division, with_statement, absolute_import
 
33
from __future__ import division
34
34
 
35
35
import SocketServer
36
36
import socket
 
37
import select
37
38
from optparse import OptionParser
38
39
import datetime
39
40
import errno
54
55
import stat
55
56
import logging
56
57
import logging.handlers
57
 
import pwd
58
 
from contextlib import closing
59
58
 
60
59
import dbus
61
 
import dbus.service
62
60
import gobject
63
61
import avahi
64
62
from dbus.mainloop.glib import DBusGMainLoop
65
63
import ctypes
66
 
import ctypes.util
67
 
 
68
 
version = "1.0.2"
 
64
 
 
65
# Brief description of the operation of this program:
 
66
# 
 
67
# This server announces itself as a Zeroconf service.  Connecting
 
68
# clients use the TLS protocol, with the unusual quirk that this
 
69
# server program acts as a TLS "client" while the connecting clients
 
70
# acts as a TLS "server".  The clients (acting as a TLS "server") must
 
71
# supply an OpenPGP certificate, and the fingerprint of this
 
72
# certificate is used by this server to look up (in a list read from a
 
73
# file at start time) which binary blob to give the client.  No other
 
74
# authentication or authorization is done by this server.
 
75
 
69
76
 
70
77
logger = logging.Logger('mandos')
71
78
syslogger = logging.handlers.SysLogHandler\
72
 
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
73
 
             address = "/dev/log")
 
79
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON)
74
80
syslogger.setFormatter(logging.Formatter\
75
 
                        ('Mandos: %(levelname)s: %(message)s'))
 
81
                        ('%(levelname)s: %(message)s'))
76
82
logger.addHandler(syslogger)
77
 
 
78
 
console = logging.StreamHandler()
79
 
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
80
 
                                       ' %(message)s'))
81
 
logger.addHandler(console)
82
 
 
83
 
class AvahiError(Exception):
84
 
    def __init__(self, value):
85
 
        self.value = value
86
 
        super(AvahiError, self).__init__()
87
 
    def __str__(self):
88
 
        return repr(self.value)
89
 
 
90
 
class AvahiServiceError(AvahiError):
91
 
    pass
92
 
 
93
 
class AvahiGroupError(AvahiError):
94
 
    pass
95
 
 
96
 
 
97
 
class AvahiService(object):
98
 
    """An Avahi (Zeroconf) service.
99
 
    Attributes:
100
 
    interface: integer; avahi.IF_UNSPEC or an interface index.
101
 
               Used to optionally bind to the specified interface.
102
 
    name: string; Example: 'Mandos'
103
 
    type: string; Example: '_mandos._tcp'.
104
 
                  See <http://www.dns-sd.org/ServiceTypes.html>
105
 
    port: integer; what port to announce
106
 
    TXT: list of strings; TXT record for the service
107
 
    domain: string; Domain to publish on, default to .local if empty.
108
 
    host: string; Host to publish records for, default is localhost
109
 
    max_renames: integer; maximum number of renames
110
 
    rename_count: integer; counter so we only rename after collisions
111
 
                  a sensible number of times
112
 
    """
113
 
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
114
 
                 servicetype = None, port = None, TXT = None, domain = "",
115
 
                 host = "", max_renames = 32768):
116
 
        self.interface = interface
117
 
        self.name = name
118
 
        self.type = servicetype
119
 
        self.port = port
120
 
        if TXT is None:
121
 
            self.TXT = []
122
 
        else:
123
 
            self.TXT = TXT
124
 
        self.domain = domain
125
 
        self.host = host
126
 
        self.rename_count = 0
127
 
        self.max_renames = max_renames
128
 
    def rename(self):
129
 
        """Derived from the Avahi example code"""
130
 
        if self.rename_count >= self.max_renames:
131
 
            logger.critical(u"No suitable Zeroconf service name found"
132
 
                            u" after %i retries, exiting.",
133
 
                            self.rename_count)
134
 
            raise AvahiServiceError("Too many renames")
135
 
        self.name = server.GetAlternativeServiceName(self.name)
136
 
        logger.info(u"Changing Zeroconf service name to %r ...",
137
 
                    str(self.name))
138
 
        syslogger.setFormatter(logging.Formatter\
139
 
                               ('Mandos (%s): %%(levelname)s:'
140
 
                               ' %%(message)s' % self.name))
141
 
        self.remove()
142
 
        self.add()
143
 
        self.rename_count += 1
144
 
    def remove(self):
145
 
        """Derived from the Avahi example code"""
146
 
        if group is not None:
147
 
            group.Reset()
148
 
    def add(self):
149
 
        """Derived from the Avahi example code"""
150
 
        global group
151
 
        if group is None:
152
 
            group = dbus.Interface\
153
 
                    (bus.get_object(avahi.DBUS_NAME,
154
 
                                    server.EntryGroupNew()),
155
 
                     avahi.DBUS_INTERFACE_ENTRY_GROUP)
156
 
            group.connect_to_signal('StateChanged',
157
 
                                    entry_group_state_changed)
158
 
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
159
 
                     service.name, service.type)
160
 
        group.AddService(
161
 
                self.interface,         # interface
162
 
                avahi.PROTO_INET6,      # protocol
163
 
                dbus.UInt32(0),         # flags
164
 
                self.name, self.type,
165
 
                self.domain, self.host,
166
 
                dbus.UInt16(self.port),
167
 
                avahi.string_array_to_txt_array(self.TXT))
168
 
        group.Commit()
169
 
 
 
83
del syslogger
 
84
 
 
85
# This variable is used to optionally bind to a specified interface.
 
86
# It is a global variable to fit in with the other variables from the
 
87
# Avahi example code.
 
88
serviceInterface = avahi.IF_UNSPEC
170
89
# From the Avahi example code:
171
 
group = None                            # our entry group
 
90
serviceName = "Mandos"
 
91
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
 
92
servicePort = None                      # Not known at startup
 
93
serviceTXT = []                         # TXT record for the service
 
94
domain = ""                  # Domain to publish on, default to .local
 
95
host = ""          # Host to publish records for, default to localhost
 
96
group = None #our entry group
 
97
rename_count = 12       # Counter so we only rename after collisions a
 
98
                        # sensible number of times
172
99
# End of Avahi example code
173
100
 
174
101
 
175
 
class Client(dbus.service.Object):
 
102
class Client(object):
176
103
    """A representation of a client host served by this server.
177
104
    Attributes:
178
105
    name:      string; from the config file, used in log messages
179
106
    fingerprint: string (40 or 32 hexadecimal digits); used to
180
107
                 uniquely identify the client
181
108
    secret:    bytestring; sent verbatim (over TLS) to client
182
 
    host:      string; available for use by the checker command
183
 
    created:   datetime.datetime(); object creation, not client host
184
 
    started:   bool()
185
 
    last_checked_ok: datetime.datetime() or None if not yet checked OK
186
 
    timeout:   datetime.timedelta(); How long from last_checked_ok
187
 
                                     until this client is invalid
 
109
    fqdn:      string (FQDN); available for use by the checker command
 
110
    created:   datetime.datetime()
 
111
    last_seen: datetime.datetime() or None if not yet seen
 
112
    timeout:   datetime.timedelta(); How long from last_seen until
 
113
                                     this client is invalid
188
114
    interval:  datetime.timedelta(); How often to start a new checker
189
115
    stop_hook: If set, called by stop() as stop_hook(self)
190
116
    checker:   subprocess.Popen(); a running checker process used
191
117
                                   to see if the client lives.
192
 
                                   'None' if no process is running.
 
118
                                   Is None if no process is running.
193
119
    checker_initiator_tag: a gobject event source tag, or None
194
120
    stop_initiator_tag:    - '' -
195
121
    checker_callback_tag:  - '' -
196
122
    checker_command: string; External command which is run to check if
197
 
                     client lives.  %() expansions are done at
 
123
                     client lives.  %()s expansions are done at
198
124
                     runtime with vars(self) as dict, so that for
199
125
                     instance %(name)s can be used in the command.
200
126
    Private attibutes:
201
127
    _timeout: Real variable for 'timeout'
202
128
    _interval: Real variable for 'interval'
203
 
    _timeout_milliseconds: Used when calling gobject.timeout_add()
 
129
    _timeout_milliseconds: Used by gobject.timeout_add()
204
130
    _interval_milliseconds: - '' -
205
131
    """
206
 
    interface = u"org.mandos_system.Mandos.Clients"
207
 
    
208
 
    @dbus.service.method(interface, out_signature="s")
209
 
    def getName(self):
210
 
        "D-Bus getter method"
211
 
        return self.name
212
 
    
213
 
    @dbus.service.method(interface, out_signature="s")
214
 
    def getFingerprint(self):
215
 
        "D-Bus getter method"
216
 
        return self.fingerprint
217
 
    
218
 
    @dbus.service.method(interface, in_signature="ay",
219
 
                         byte_arrays=True)
220
 
    def setSecret(self, secret):
221
 
        "D-Bus setter method"
222
 
        self.secret = secret
223
 
    
224
132
    def _set_timeout(self, timeout):
225
 
        "Setter function for the 'timeout' attribute"
 
133
        "Setter function for 'timeout' attribute"
226
134
        self._timeout = timeout
227
135
        self._timeout_milliseconds = ((self.timeout.days
228
136
                                       * 24 * 60 * 60 * 1000)
229
137
                                      + (self.timeout.seconds * 1000)
230
138
                                      + (self.timeout.microseconds
231
139
                                         // 1000))
232
 
        # Emit D-Bus signal
233
 
        self.TimeoutChanged(self._timeout_milliseconds)
234
 
    timeout = property(lambda self: self._timeout, _set_timeout)
 
140
    timeout = property(lambda self: self._timeout,
 
141
                       _set_timeout)
235
142
    del _set_timeout
236
 
    
237
 
    @dbus.service.method(interface, out_signature="t")
238
 
    def getTimeout(self):
239
 
        "D-Bus getter method"
240
 
        return self._timeout_milliseconds
241
 
    
242
 
    @dbus.service.signal(interface, signature="t")
243
 
    def TimeoutChanged(self, t):
244
 
        "D-Bus signal"
245
 
        pass
246
 
    
247
143
    def _set_interval(self, interval):
248
 
        "Setter function for the 'interval' attribute"
 
144
        "Setter function for 'interval' attribute"
249
145
        self._interval = interval
250
146
        self._interval_milliseconds = ((self.interval.days
251
147
                                        * 24 * 60 * 60 * 1000)
253
149
                                          * 1000)
254
150
                                       + (self.interval.microseconds
255
151
                                          // 1000))
256
 
        # Emit D-Bus signal
257
 
        self.IntervalChanged(self._interval_milliseconds)
258
 
    interval = property(lambda self: self._interval, _set_interval)
 
152
    interval = property(lambda self: self._interval,
 
153
                        _set_interval)
259
154
    del _set_interval
260
 
    
261
 
    @dbus.service.method(interface, out_signature="t")
262
 
    def getInterval(self):
263
 
        "D-Bus getter method"
264
 
        return self._interval_milliseconds
265
 
    
266
 
    @dbus.service.signal(interface, signature="t")
267
 
    def IntervalChanged(self, t):
268
 
        "D-Bus signal"
269
 
        pass
270
 
    
271
 
    def __init__(self, name = None, stop_hook=None, config=None):
272
 
        """Note: the 'checker' key in 'config' sets the
273
 
        'checker_command' attribute and *not* the 'checker'
274
 
        attribute."""
275
 
        dbus.service.Object.__init__(self, bus,
276
 
                                     "/Mandos/Clients/%s"
277
 
                                     % name.replace(".", "_"))
278
 
        if config is None:
279
 
            config = {}
 
155
    def __init__(self, name=None, options=None, stop_hook=None,
 
156
                 fingerprint=None, secret=None, secfile=None,
 
157
                 fqdn=None, timeout=None, interval=-1, checker=None):
 
158
        """Note: the 'checker' argument sets the 'checker_command'
 
159
        attribute and not the 'checker' attribute.."""
280
160
        self.name = name
281
 
        logger.debug(u"Creating client %r", self.name)
282
 
        # Uppercase and remove spaces from fingerprint for later
283
 
        # comparison purposes with return value from the fingerprint()
284
 
        # function
285
 
        self.fingerprint = config["fingerprint"].upper()\
286
 
                           .replace(u" ", u"")
287
 
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
288
 
        if "secret" in config:
289
 
            self.secret = config["secret"].decode(u"base64")
290
 
        elif "secfile" in config:
291
 
            with closing(open(os.path.expanduser
292
 
                              (os.path.expandvars
293
 
                               (config["secfile"])))) \
294
 
                               as secfile:
295
 
                self.secret = secfile.read()
 
161
        # Uppercase and remove spaces from fingerprint
 
162
        # for later comparison purposes with return value of
 
163
        # the fingerprint() function
 
164
        self.fingerprint = fingerprint.upper().replace(u" ", u"")
 
165
        if secret:
 
166
            self.secret = secret.decode(u"base64")
 
167
        elif secfile:
 
168
            sf = open(secfile)
 
169
            self.secret = sf.read()
 
170
            sf.close()
296
171
        else:
297
 
            raise TypeError(u"No secret or secfile for client %s"
298
 
                            % self.name)
299
 
        self.host = config.get("host", "")
 
172
            raise RuntimeError(u"No secret or secfile for client %s"
 
173
                               % self.name)
 
174
        self.fqdn = fqdn                # string
300
175
        self.created = datetime.datetime.now()
301
 
        self.started = False
302
 
        self.last_checked_ok = None
303
 
        self.timeout = string_to_delta(config["timeout"])
304
 
        self.interval = string_to_delta(config["interval"])
 
176
        self.last_seen = None
 
177
        if timeout is None:
 
178
            self.timeout = options.timeout
 
179
        else:
 
180
            self.timeout = string_to_delta(timeout)
 
181
        if interval == -1:
 
182
            self.interval = options.interval
 
183
        else:
 
184
            self.interval = string_to_delta(interval)
305
185
        self.stop_hook = stop_hook
306
186
        self.checker = None
307
187
        self.checker_initiator_tag = None
308
188
        self.stop_initiator_tag = None
309
189
        self.checker_callback_tag = None
310
 
        self.check_command = config["checker"]
311
 
    
 
190
        self.check_command = checker
312
191
    def start(self):
313
192
        """Start this client's checker and timeout hooks"""
314
 
        self.started = True
315
193
        # Schedule a new checker to be started an 'interval' from now,
316
194
        # and every interval from then on.
317
195
        self.checker_initiator_tag = gobject.timeout_add\
323
201
        self.stop_initiator_tag = gobject.timeout_add\
324
202
                                  (self._timeout_milliseconds,
325
203
                                   self.stop)
326
 
        # Emit D-Bus signal
327
 
        self.StateChanged(True)
328
 
    
329
 
    @dbus.service.signal(interface, signature="b")
330
 
    def StateChanged(self, started):
331
 
        "D-Bus signal"
332
 
        pass
333
 
    
334
204
    def stop(self):
335
 
        """Stop this client."""
336
 
        if getattr(self, "started", False):
337
 
            logger.info(u"Stopping client %s", self.name)
 
205
        """Stop this client.
 
206
        The possibility that this client might be restarted is left
 
207
        open, but not currently used."""
 
208
        # If this client doesn't have a secret, it is already stopped.
 
209
        if self.secret:
 
210
            logger.debug(u"Stopping client %s", self.name)
 
211
            self.secret = None
338
212
        else:
339
213
            return False
340
 
        if getattr(self, "stop_initiator_tag", False):
 
214
        if hasattr(self, "stop_initiator_tag") \
 
215
               and self.stop_initiator_tag:
341
216
            gobject.source_remove(self.stop_initiator_tag)
342
217
            self.stop_initiator_tag = None
343
 
        if getattr(self, "checker_initiator_tag", False):
 
218
        if hasattr(self, "checker_initiator_tag") \
 
219
               and self.checker_initiator_tag:
344
220
            gobject.source_remove(self.checker_initiator_tag)
345
221
            self.checker_initiator_tag = None
346
222
        self.stop_checker()
347
223
        if self.stop_hook:
348
224
            self.stop_hook(self)
349
 
        # Emit D-Bus signal
350
 
        self.StateChanged(False)
351
225
        # Do not run this again if called by a gobject.timeout_add
352
226
        return False
353
 
    # D-Bus variant
354
 
    Stop = dbus.service.method(interface)(stop)
355
 
    
356
227
    def __del__(self):
357
228
        self.stop_hook = None
358
229
        self.stop()
359
 
    
360
230
    def checker_callback(self, pid, condition):
361
231
        """The checker has completed, so take appropriate actions."""
 
232
        now = datetime.datetime.now()
362
233
        self.checker_callback_tag = None
363
234
        self.checker = None
364
235
        if os.WIFEXITED(condition) \
365
236
               and (os.WEXITSTATUS(condition) == 0):
366
 
            logger.info(u"Checker for %(name)s succeeded",
367
 
                        vars(self))
368
 
            # Emit D-Bus signal
369
 
            self.CheckerCompleted(True)
370
 
            self.bump_timeout()
 
237
            logger.debug(u"Checker for %(name)s succeeded",
 
238
                         vars(self))
 
239
            self.last_seen = now
 
240
            gobject.source_remove(self.stop_initiator_tag)
 
241
            self.stop_initiator_tag = gobject.timeout_add\
 
242
                                      (self._timeout_milliseconds,
 
243
                                       self.stop)
371
244
        elif not os.WIFEXITED(condition):
372
245
            logger.warning(u"Checker for %(name)s crashed?",
373
246
                           vars(self))
374
 
            # Emit D-Bus signal
375
 
            self.CheckerCompleted(False)
376
247
        else:
377
 
            logger.info(u"Checker for %(name)s failed",
378
 
                        vars(self))
379
 
            # Emit D-Bus signal
380
 
            self.CheckerCompleted(False)
381
 
    
382
 
    @dbus.service.signal(interface, signature="b")
383
 
    def CheckerCompleted(self, success):
384
 
        "D-Bus signal"
385
 
        pass
386
 
    
387
 
    def bump_timeout(self):
388
 
        """Bump up the timeout for this client.
389
 
        This should only be called when the client has been seen,
390
 
        alive and well.
391
 
        """
392
 
        self.last_checked_ok = datetime.datetime.now()
393
 
        gobject.source_remove(self.stop_initiator_tag)
394
 
        self.stop_initiator_tag = gobject.timeout_add\
395
 
            (self._timeout_milliseconds, self.stop)
396
 
    # D-Bus variant
397
 
    bumpTimeout = dbus.service.method(interface)(bump_timeout)
398
 
    
 
248
            logger.debug(u"Checker for %(name)s failed",
 
249
                         vars(self))
399
250
    def start_checker(self):
400
251
        """Start a new checker subprocess if one is not running.
401
252
        If a checker already exists, leave it running and do
410
261
        # is as it should be.
411
262
        if self.checker is None:
412
263
            try:
413
 
                # In case check_command has exactly one % operator
414
 
                command = self.check_command % self.host
 
264
                command = self.check_command % self.fqdn
415
265
            except TypeError:
416
 
                # Escape attributes for the shell
417
266
                escaped_attrs = dict((key, re.escape(str(val)))
418
267
                                     for key, val in
419
268
                                     vars(self).iteritems())
420
269
                try:
421
270
                    command = self.check_command % escaped_attrs
422
271
                except TypeError, error:
423
 
                    logger.error(u'Could not format string "%s":'
424
 
                                 u' %s', self.check_command, error)
 
272
                    logger.critical(u'Could not format string "%s":'
 
273
                                    u' %s', self.check_command, error)
425
274
                    return True # Try again later
426
275
            try:
427
 
                logger.info(u"Starting checker %r for %s",
428
 
                            command, self.name)
429
 
                # We don't need to redirect stdout and stderr, since
430
 
                # in normal mode, that is already done by daemon(),
431
 
                # and in debug mode we don't want to.  (Stdin is
432
 
                # always replaced by /dev/null.)
433
 
                self.checker = subprocess.Popen(command,
434
 
                                                close_fds=True,
435
 
                                                shell=True, cwd="/")
 
276
                logger.debug(u"Starting checker %r for %s",
 
277
                             command, self.name)
 
278
                self.checker = subprocess.\
 
279
                               Popen(command,
 
280
                                     close_fds=True, shell=True,
 
281
                                     cwd="/")
436
282
                self.checker_callback_tag = gobject.child_watch_add\
437
283
                                            (self.checker.pid,
438
284
                                             self.checker_callback)
439
 
                # Emit D-Bus signal
440
 
                self.CheckerStarted(command)
441
 
            except OSError, error:
 
285
            except subprocess.OSError, error:
442
286
                logger.error(u"Failed to start subprocess: %s",
443
287
                             error)
444
288
        # Re-run this periodically if run by gobject.timeout_add
445
289
        return True
446
 
    
447
 
    @dbus.service.signal(interface, signature="s")
448
 
    def CheckerStarted(self, command):
449
 
        pass
450
 
    
451
 
    @dbus.service.method(interface, out_signature="b")
452
 
    def checkerIsRunning(self):
453
 
        "D-Bus getter method"
454
 
        return self.checker is not None
455
 
    
456
290
    def stop_checker(self):
457
291
        """Force the checker process, if any, to stop."""
458
292
        if self.checker_callback_tag:
459
293
            gobject.source_remove(self.checker_callback_tag)
460
294
            self.checker_callback_tag = None
461
 
        if getattr(self, "checker", None) is None:
 
295
        if not hasattr(self, "checker") or self.checker is None:
462
296
            return
463
 
        logger.debug(u"Stopping checker for %(name)s", vars(self))
 
297
        logger.debug("Stopping checker for %(name)s", vars(self))
464
298
        try:
465
299
            os.kill(self.checker.pid, signal.SIGTERM)
466
300
            #os.sleep(0.5)
467
301
            #if self.checker.poll() is None:
468
302
            #    os.kill(self.checker.pid, signal.SIGKILL)
469
303
        except OSError, error:
470
 
            if error.errno != errno.ESRCH: # No such process
 
304
            if error.errno != errno.ESRCH:
471
305
                raise
472
306
        self.checker = None
473
 
    # D-Bus variant
474
 
    StopChecker = dbus.service.method(interface)(stop_checker)
475
 
    
476
 
    def still_valid(self):
 
307
    def still_valid(self, now=None):
477
308
        """Has the timeout not yet passed for this client?"""
478
 
        if not self.started:
479
 
            return False
480
 
        now = datetime.datetime.now()
481
 
        if self.last_checked_ok is None:
 
309
        if now is None:
 
310
            now = datetime.datetime.now()
 
311
        if self.last_seen is None:
482
312
            return now < (self.created + self.timeout)
483
313
        else:
484
 
            return now < (self.last_checked_ok + self.timeout)
485
 
    # D-Bus variant
486
 
    stillValid = dbus.service.method(interface, out_signature="b")\
487
 
        (still_valid)
488
 
    
489
 
    del interface
 
314
            return now < (self.last_seen + self.timeout)
490
315
 
491
316
 
492
317
def peer_certificate(session):
508
333
 
509
334
def fingerprint(openpgp):
510
335
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
 
336
    # New empty GnuTLS certificate
 
337
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
338
    gnutls.library.functions.gnutls_openpgp_crt_init\
 
339
        (ctypes.byref(crt))
511
340
    # New GnuTLS "datum" with the OpenPGP public key
512
341
    datum = gnutls.library.types.gnutls_datum_t\
513
342
        (ctypes.cast(ctypes.c_char_p(openpgp),
514
343
                     ctypes.POINTER(ctypes.c_ubyte)),
515
344
         ctypes.c_uint(len(openpgp)))
516
 
    # New empty GnuTLS certificate
517
 
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
518
 
    gnutls.library.functions.gnutls_openpgp_crt_init\
519
 
        (ctypes.byref(crt))
520
345
    # Import the OpenPGP public key into the certificate
521
 
    gnutls.library.functions.gnutls_openpgp_crt_import\
522
 
                    (crt, ctypes.byref(datum),
523
 
                     gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
524
 
    # Verify the self signature in the key
525
 
    crtverify = ctypes.c_uint()
526
 
    gnutls.library.functions.gnutls_openpgp_crt_verify_self\
527
 
        (crt, 0, ctypes.byref(crtverify))
528
 
    if crtverify.value != 0:
529
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
530
 
        raise gnutls.errors.CertificateSecurityError("Verify failed")
 
346
    ret = gnutls.library.functions.gnutls_openpgp_crt_import\
 
347
        (crt,
 
348
         ctypes.byref(datum),
 
349
         gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
531
350
    # New buffer for the fingerprint
532
 
    buf = ctypes.create_string_buffer(20)
533
 
    buf_len = ctypes.c_size_t()
 
351
    buffer = ctypes.create_string_buffer(20)
 
352
    buffer_length = ctypes.c_size_t()
534
353
    # Get the fingerprint from the certificate into the buffer
535
354
    gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
536
 
        (crt, ctypes.byref(buf), ctypes.byref(buf_len))
 
355
        (crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
537
356
    # Deinit the certificate
538
357
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
539
358
    # Convert the buffer to a Python bytestring
540
 
    fpr = ctypes.string_at(buf, buf_len.value)
 
359
    fpr = ctypes.string_at(buffer, buffer_length.value)
541
360
    # Convert the bytestring to hexadecimal notation
542
361
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
543
362
    return hex_fpr
544
363
 
545
364
 
546
 
class TCP_handler(SocketServer.BaseRequestHandler, object):
 
365
class tcp_handler(SocketServer.BaseRequestHandler, object):
547
366
    """A TCP request handler class.
548
367
    Instantiated by IPv6_TCPServer for each request to handle it.
549
368
    Note: This will run in its own forked process."""
550
369
    
551
370
    def handle(self):
552
 
        logger.info(u"TCP connection from: %s",
553
 
                    unicode(self.client_address))
554
 
        session = gnutls.connection.ClientSession\
555
 
                  (self.request, gnutls.connection.X509Credentials())
556
 
        
557
 
        line = self.request.makefile().readline()
558
 
        logger.debug(u"Protocol version: %r", line)
559
 
        try:
560
 
            if int(line.strip().split()[0]) > 1:
561
 
                raise RuntimeError
562
 
        except (ValueError, IndexError, RuntimeError), error:
563
 
            logger.error(u"Unknown protocol version: %s", error)
564
 
            return
565
 
        
566
 
        # Note: gnutls.connection.X509Credentials is really a generic
567
 
        # GnuTLS certificate credentials object so long as no X.509
568
 
        # keys are added to it.  Therefore, we can use it here despite
569
 
        # using OpenPGP certificates.
 
371
        logger.debug(u"TCP connection from: %s",
 
372
                     unicode(self.client_address))
 
373
        session = gnutls.connection.ClientSession(self.request,
 
374
                                                  gnutls.connection.\
 
375
                                                  X509Credentials())
570
376
        
571
377
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
572
378
        #                "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
573
379
        #                "+DHE-DSS"))
574
 
        # Use a fallback default, since this MUST be set.
575
 
        priority = self.server.settings.get("priority", "NORMAL")
 
380
        priority = "SECURE256"
 
381
        
576
382
        gnutls.library.functions.gnutls_priority_set_direct\
577
 
            (session._c_object, priority, None)
 
383
            (session._c_object, priority, None);
578
384
        
579
385
        try:
580
386
            session.handshake()
581
387
        except gnutls.errors.GNUTLSError, error:
582
 
            logger.warning(u"Handshake failed: %s", error)
 
388
            logger.debug(u"Handshake failed: %s", error)
583
389
            # Do not run session.bye() here: the session is not
584
390
            # established.  Just abandon the request.
585
391
            return
586
392
        try:
587
393
            fpr = fingerprint(peer_certificate(session))
588
394
        except (TypeError, gnutls.errors.GNUTLSError), error:
589
 
            logger.warning(u"Bad certificate: %s", error)
 
395
            logger.debug(u"Bad certificate: %s", error)
590
396
            session.bye()
591
397
            return
592
398
        logger.debug(u"Fingerprint: %s", fpr)
595
401
            if c.fingerprint == fpr:
596
402
                client = c
597
403
                break
598
 
        if not client:
599
 
            logger.warning(u"Client not found for fingerprint: %s",
600
 
                           fpr)
601
 
            session.bye()
602
 
            return
603
404
        # Have to check if client.still_valid(), since it is possible
604
405
        # that the client timed out while establishing the GnuTLS
605
406
        # session.
606
 
        if not client.still_valid():
607
 
            logger.warning(u"Client %(name)s is invalid",
608
 
                           vars(client))
 
407
        if (not client) or (not client.still_valid()):
 
408
            if client:
 
409
                logger.debug(u"Client %(name)s is invalid",
 
410
                             vars(client))
 
411
            else:
 
412
                logger.debug(u"Client not found for fingerprint: %s",
 
413
                             fpr)
609
414
            session.bye()
610
415
            return
611
 
        ## This won't work here, since we're in a fork.
612
 
        # client.bump_timeout()
613
416
        sent_size = 0
614
417
        while sent_size < len(client.secret):
615
418
            sent = session.send(client.secret[sent_size:])
620
423
        session.bye()
621
424
 
622
425
 
623
 
class IPv6_TCPServer(SocketServer.ForkingMixIn,
624
 
                     SocketServer.TCPServer, object):
 
426
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
625
427
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
626
428
    Attributes:
627
 
        settings:       Server settings
 
429
        options:        Command line options
628
430
        clients:        Set() of Client objects
629
 
        enabled:        Boolean; whether this server is activated yet
630
431
    """
631
432
    address_family = socket.AF_INET6
632
433
    def __init__(self, *args, **kwargs):
633
 
        if "settings" in kwargs:
634
 
            self.settings = kwargs["settings"]
635
 
            del kwargs["settings"]
 
434
        if "options" in kwargs:
 
435
            self.options = kwargs["options"]
 
436
            del kwargs["options"]
636
437
        if "clients" in kwargs:
637
438
            self.clients = kwargs["clients"]
638
439
            del kwargs["clients"]
639
 
        self.enabled = False
640
 
        super(IPv6_TCPServer, self).__init__(*args, **kwargs)
 
440
        return super(type(self), self).__init__(*args, **kwargs)
641
441
    def server_bind(self):
642
442
        """This overrides the normal server_bind() function
643
443
        to bind to an interface if one was specified, and also NOT to
644
444
        bind to an address or port if they were not specified."""
645
 
        if self.settings["interface"]:
646
 
            # 25 is from /usr/include/asm-i486/socket.h
647
 
            SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
 
445
        if self.options.interface:
 
446
            if not hasattr(socket, "SO_BINDTODEVICE"):
 
447
                # From /usr/include/asm-i486/socket.h
 
448
                socket.SO_BINDTODEVICE = 25
648
449
            try:
649
450
                self.socket.setsockopt(socket.SOL_SOCKET,
650
 
                                       SO_BINDTODEVICE,
651
 
                                       self.settings["interface"])
 
451
                                       socket.SO_BINDTODEVICE,
 
452
                                       self.options.interface)
652
453
            except socket.error, error:
653
454
                if error[0] == errno.EPERM:
654
 
                    logger.error(u"No permission to"
655
 
                                 u" bind to interface %s",
656
 
                                 self.settings["interface"])
 
455
                    logger.warning(u"No permission to"
 
456
                                   u" bind to interface %s",
 
457
                                   self.options.interface)
657
458
                else:
658
459
                    raise error
659
460
        # Only bind(2) the socket if we really need to.
662
463
                in6addr_any = "::"
663
464
                self.server_address = (in6addr_any,
664
465
                                       self.server_address[1])
665
 
            elif not self.server_address[1]:
 
466
            elif self.server_address[1] is None:
666
467
                self.server_address = (self.server_address[0],
667
468
                                       0)
668
 
#                 if self.settings["interface"]:
669
 
#                     self.server_address = (self.server_address[0],
670
 
#                                            0, # port
671
 
#                                            0, # flowinfo
672
 
#                                            if_nametoindex
673
 
#                                            (self.settings
674
 
#                                             ["interface"]))
675
 
            return super(IPv6_TCPServer, self).server_bind()
676
 
    def server_activate(self):
677
 
        if self.enabled:
678
 
            return super(IPv6_TCPServer, self).server_activate()
679
 
    def enable(self):
680
 
        self.enabled = True
 
469
            return super(type(self), self).server_bind()
681
470
 
682
471
 
683
472
def string_to_delta(interval):
693
482
    datetime.timedelta(1)
694
483
    >>> string_to_delta(u'1w')
695
484
    datetime.timedelta(7)
696
 
    >>> string_to_delta('5m 30s')
697
 
    datetime.timedelta(0, 330)
698
485
    """
699
 
    timevalue = datetime.timedelta(0)
700
 
    for s in interval.split():
701
 
        try:
702
 
            suffix = unicode(s[-1])
703
 
            value = int(s[:-1])
704
 
            if suffix == u"d":
705
 
                delta = datetime.timedelta(value)
706
 
            elif suffix == u"s":
707
 
                delta = datetime.timedelta(0, value)
708
 
            elif suffix == u"m":
709
 
                delta = datetime.timedelta(0, 0, 0, 0, value)
710
 
            elif suffix == u"h":
711
 
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
712
 
            elif suffix == u"w":
713
 
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
714
 
            else:
715
 
                raise ValueError
716
 
        except (ValueError, IndexError):
 
486
    try:
 
487
        suffix=unicode(interval[-1])
 
488
        value=int(interval[:-1])
 
489
        if suffix == u"d":
 
490
            delta = datetime.timedelta(value)
 
491
        elif suffix == u"s":
 
492
            delta = datetime.timedelta(0, value)
 
493
        elif suffix == u"m":
 
494
            delta = datetime.timedelta(0, 0, 0, 0, value)
 
495
        elif suffix == u"h":
 
496
            delta = datetime.timedelta(0, 0, 0, 0, 0, value)
 
497
        elif suffix == u"w":
 
498
            delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
 
499
        else:
717
500
            raise ValueError
718
 
        timevalue += delta
719
 
    return timevalue
 
501
    except (ValueError, IndexError):
 
502
        raise ValueError
 
503
    return delta
 
504
 
 
505
 
 
506
def add_service():
 
507
    """Derived from the Avahi example code"""
 
508
    global group, serviceName, serviceType, servicePort, serviceTXT, \
 
509
           domain, host
 
510
    if group is None:
 
511
        group = dbus.Interface(
 
512
                bus.get_object( avahi.DBUS_NAME,
 
513
                                server.EntryGroupNew()),
 
514
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
515
        group.connect_to_signal('StateChanged',
 
516
                                entry_group_state_changed)
 
517
    logger.debug(u"Adding service '%s' of type '%s' ...",
 
518
                 serviceName, serviceType)
 
519
    
 
520
    group.AddService(
 
521
            serviceInterface,           # interface
 
522
            avahi.PROTO_INET6,          # protocol
 
523
            dbus.UInt32(0),             # flags
 
524
            serviceName, serviceType,
 
525
            domain, host,
 
526
            dbus.UInt16(servicePort),
 
527
            avahi.string_array_to_txt_array(serviceTXT))
 
528
    group.Commit()
 
529
 
 
530
 
 
531
def remove_service():
 
532
    """From the Avahi example code"""
 
533
    global group
 
534
    
 
535
    if not group is None:
 
536
        group.Reset()
720
537
 
721
538
 
722
539
def server_state_changed(state):
723
540
    """Derived from the Avahi example code"""
724
541
    if state == avahi.SERVER_COLLISION:
725
 
        logger.error(u"Zeroconf server name collision")
726
 
        service.remove()
 
542
        logger.warning(u"Server name collision")
 
543
        remove_service()
727
544
    elif state == avahi.SERVER_RUNNING:
728
 
        service.add()
 
545
        add_service()
729
546
 
730
547
 
731
548
def entry_group_state_changed(state, error):
732
549
    """Derived from the Avahi example code"""
733
 
    logger.debug(u"Avahi state change: %i", state)
 
550
    global serviceName, server, rename_count
 
551
    
 
552
    logger.debug(u"state change: %i", state)
734
553
    
735
554
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
736
 
        logger.debug(u"Zeroconf service established.")
 
555
        logger.debug(u"Service established.")
737
556
    elif state == avahi.ENTRY_GROUP_COLLISION:
738
 
        logger.warning(u"Zeroconf service name collision.")
739
 
        service.rename()
 
557
        
 
558
        rename_count = rename_count - 1
 
559
        if rename_count > 0:
 
560
            name = server.GetAlternativeServiceName(name)
 
561
            logger.warning(u"Service name collision, "
 
562
                           u"changing name to '%s' ...", name)
 
563
            remove_service()
 
564
            add_service()
 
565
            
 
566
        else:
 
567
            logger.error(u"No suitable service name found after %i"
 
568
                         u" retries, exiting.", n_rename)
 
569
            killme(1)
740
570
    elif state == avahi.ENTRY_GROUP_FAILURE:
741
 
        logger.critical(u"Avahi: Error in group state changed %s",
742
 
                        unicode(error))
743
 
        raise AvahiGroupError("State changed: %s", str(error))
 
571
        logger.error(u"Error in group state changed %s",
 
572
                     unicode(error))
 
573
        killme(1)
 
574
 
744
575
 
745
576
def if_nametoindex(interface):
746
 
    """Call the C function if_nametoindex(), or equivalent"""
747
 
    global if_nametoindex
 
577
    """Call the C function if_nametoindex()"""
748
578
    try:
749
 
        if_nametoindex = ctypes.cdll.LoadLibrary\
750
 
            (ctypes.util.find_library("c")).if_nametoindex
 
579
        libc = ctypes.cdll.LoadLibrary("libc.so.6")
 
580
        return libc.if_nametoindex(interface)
751
581
    except (OSError, AttributeError):
752
582
        if "struct" not in sys.modules:
753
583
            import struct
754
584
        if "fcntl" not in sys.modules:
755
585
            import fcntl
756
 
        def if_nametoindex(interface):
757
 
            "Get an interface index the hard way, i.e. using fcntl()"
758
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
759
 
            with closing(socket.socket()) as s:
760
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
761
 
                                    struct.pack("16s16x", interface))
762
 
            interface_index = struct.unpack("I", ifreq[16:20])[0]
763
 
            return interface_index
764
 
    return if_nametoindex(interface)
765
 
 
766
 
 
767
 
def daemon(nochdir = False, noclose = False):
 
586
        SIOCGIFINDEX = 0x8933      # From /usr/include/linux/sockios.h
 
587
        s = socket.socket()
 
588
        ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
589
                            struct.pack("16s16x", interface))
 
590
        s.close()
 
591
        interface_index = struct.unpack("I", ifreq[16:20])[0]
 
592
        return interface_index
 
593
 
 
594
 
 
595
def daemon(nochdir, noclose):
768
596
    """See daemon(3).  Standard BSD Unix function.
769
597
    This should really exist as os.daemon, but it doesn't (yet)."""
770
598
    if os.fork():
772
600
    os.setsid()
773
601
    if not nochdir:
774
602
        os.chdir("/")
775
 
    if os.fork():
776
 
        sys.exit()
777
603
    if not noclose:
778
604
        # Close all standard open file descriptors
779
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
605
        null = os.open("/dev/null", os.O_NOCTTY | os.O_RDWR)
780
606
        if not stat.S_ISCHR(os.fstat(null).st_mode):
781
607
            raise OSError(errno.ENODEV,
782
608
                          "/dev/null not a character device")
787
613
            os.close(null)
788
614
 
789
615
 
 
616
def killme(status = 0):
 
617
    logger.debug("Stopping server with exit status %d", status)
 
618
    exitstatus = status
 
619
    if main_loop_started:
 
620
        main_loop.quit()
 
621
    else:
 
622
        sys.exit(status)
 
623
 
 
624
 
790
625
def main():
791
 
    parser = OptionParser(version = "%%prog %s" % version)
 
626
    global exitstatus
 
627
    exitstatus = 0
 
628
    global main_loop_started
 
629
    main_loop_started = False
 
630
    
 
631
    parser = OptionParser()
792
632
    parser.add_option("-i", "--interface", type="string",
793
 
                      metavar="IF", help="Bind to interface IF")
794
 
    parser.add_option("-a", "--address", type="string",
 
633
                      default=None, metavar="IF",
 
634
                      help="Bind to interface IF")
 
635
    parser.add_option("-a", "--address", type="string", default=None,
795
636
                      help="Address to listen for requests on")
796
 
    parser.add_option("-p", "--port", type="int",
 
637
    parser.add_option("-p", "--port", type="int", default=None,
797
638
                      help="Port number to receive requests on")
 
639
    parser.add_option("--timeout", type="string", # Parsed later
 
640
                      default="1h",
 
641
                      help="Amount of downtime allowed for clients")
 
642
    parser.add_option("--interval", type="string", # Parsed later
 
643
                      default="5m",
 
644
                      help="How often to check that a client is up")
798
645
    parser.add_option("--check", action="store_true", default=False,
799
646
                      help="Run self-test")
800
 
    parser.add_option("--debug", action="store_true",
801
 
                      help="Debug mode; run in foreground and log to"
802
 
                      " terminal")
803
 
    parser.add_option("--priority", type="string", help="GnuTLS"
804
 
                      " priority string (see GnuTLS documentation)")
805
 
    parser.add_option("--servicename", type="string", metavar="NAME",
806
 
                      help="Zeroconf service name")
807
 
    parser.add_option("--configdir", type="string",
808
 
                      default="/etc/mandos", metavar="DIR",
809
 
                      help="Directory to search for configuration"
810
 
                      " files")
811
 
    options = parser.parse_args()[0]
 
647
    parser.add_option("--debug", action="store_true", default=False,
 
648
                      help="Debug mode")
 
649
    (options, args) = parser.parse_args()
812
650
    
813
651
    if options.check:
814
652
        import doctest
815
653
        doctest.testmod()
816
654
        sys.exit()
817
655
    
818
 
    # Default values for config file for server-global settings
819
 
    server_defaults = { "interface": "",
820
 
                        "address": "",
821
 
                        "port": "",
822
 
                        "debug": "False",
823
 
                        "priority":
824
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
825
 
                        "servicename": "Mandos",
826
 
                        }
827
 
    
828
 
    # Parse config file for server-global settings
829
 
    server_config = ConfigParser.SafeConfigParser(server_defaults)
830
 
    del server_defaults
831
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
832
 
    # Convert the SafeConfigParser object to a dict
833
 
    server_settings = server_config.defaults()
834
 
    # Use getboolean on the boolean config option
835
 
    server_settings["debug"] = server_config.getboolean\
836
 
                               ("DEFAULT", "debug")
837
 
    del server_config
838
 
    
839
 
    # Override the settings from the config file with command line
840
 
    # options, if set.
841
 
    for option in ("interface", "address", "port", "debug",
842
 
                   "priority", "servicename", "configdir"):
843
 
        value = getattr(options, option)
844
 
        if value is not None:
845
 
            server_settings[option] = value
846
 
    del options
847
 
    # Now we have our good server settings in "server_settings"
848
 
    
849
 
    debug = server_settings["debug"]
850
 
    
851
 
    if not debug:
852
 
        syslogger.setLevel(logging.WARNING)
853
 
        console.setLevel(logging.WARNING)
854
 
    
855
 
    if server_settings["servicename"] != "Mandos":
856
 
        syslogger.setFormatter(logging.Formatter\
857
 
                               ('Mandos (%s): %%(levelname)s:'
858
 
                                ' %%(message)s'
859
 
                                % server_settings["servicename"]))
860
 
    
861
 
    # Parse config file with clients
862
 
    client_defaults = { "timeout": "1h",
863
 
                        "interval": "5m",
864
 
                        "checker": "fping -q -- %(host)s",
865
 
                        "host": "",
866
 
                        }
867
 
    client_config = ConfigParser.SafeConfigParser(client_defaults)
868
 
    client_config.read(os.path.join(server_settings["configdir"],
869
 
                                    "clients.conf"))
870
 
    
871
 
    clients = Set()
872
 
    tcp_server = IPv6_TCPServer((server_settings["address"],
873
 
                                 server_settings["port"]),
874
 
                                TCP_handler,
875
 
                                settings=server_settings,
876
 
                                clients=clients)
877
 
    pidfilename = "/var/run/mandos.pid"
878
 
    try:
879
 
        pidfile = open(pidfilename, "w")
880
 
    except IOError, error:
881
 
        logger.error("Could not open file %r", pidfilename)
882
 
    
883
 
    uid = 65534
884
 
    gid = 65534
885
 
    try:
886
 
        uid = pwd.getpwnam("mandos").pw_uid
887
 
    except KeyError:
888
 
        try:
889
 
            uid = pwd.getpwnam("nobody").pw_uid
890
 
        except KeyError:
891
 
            pass
892
 
    try:
893
 
        gid = pwd.getpwnam("mandos").pw_gid
894
 
    except KeyError:
895
 
        try:
896
 
            gid = pwd.getpwnam("nogroup").pw_gid
897
 
        except KeyError:
898
 
            pass
899
 
    try:
900
 
        os.setuid(uid)
901
 
        os.setgid(gid)
902
 
    except OSError, error:
903
 
        if error[0] != errno.EPERM:
904
 
            raise error
905
 
    
906
 
    global service
907
 
    service = AvahiService(name = server_settings["servicename"],
908
 
                           servicetype = "_mandos._tcp", )
909
 
    if server_settings["interface"]:
910
 
        service.interface = if_nametoindex\
911
 
                            (server_settings["interface"])
 
656
    # Parse the time arguments
 
657
    try:
 
658
        options.timeout = string_to_delta(options.timeout)
 
659
    except ValueError:
 
660
        parser.error("option --timeout: Unparseable time")
 
661
    try:
 
662
        options.interval = string_to_delta(options.interval)
 
663
    except ValueError:
 
664
        parser.error("option --interval: Unparseable time")
 
665
    
 
666
    # Parse config file
 
667
    defaults = { "checker": "fping -q -- %%(fqdn)s" }
 
668
    client_config = ConfigParser.SafeConfigParser(defaults)
 
669
    #client_config.readfp(open("global.conf"), "global.conf")
 
670
    client_config.read("mandos-clients.conf")
912
671
    
913
672
    global main_loop
914
673
    global bus
917
676
    DBusGMainLoop(set_as_default=True )
918
677
    main_loop = gobject.MainLoop()
919
678
    bus = dbus.SystemBus()
920
 
    server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
921
 
                                           avahi.DBUS_PATH_SERVER),
922
 
                            avahi.DBUS_INTERFACE_SERVER)
 
679
    server = dbus.Interface(
 
680
            bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
 
681
            avahi.DBUS_INTERFACE_SERVER )
923
682
    # End of Avahi example code
924
683
    
 
684
    debug = options.debug
 
685
    
 
686
    if debug:
 
687
        console = logging.StreamHandler()
 
688
        # console.setLevel(logging.DEBUG)
 
689
        console.setFormatter(logging.Formatter\
 
690
                             ('%(levelname)s: %(message)s'))
 
691
        logger.addHandler(console)
 
692
        del console
 
693
    
 
694
    clients = Set()
925
695
    def remove_from_clients(client):
926
696
        clients.remove(client)
927
697
        if not clients:
928
 
            logger.critical(u"No clients left, exiting")
929
 
            sys.exit()
 
698
            logger.debug(u"No clients left, exiting")
 
699
            killme()
930
700
    
931
 
    clients.update(Set(Client(name = section,
 
701
    clients.update(Set(Client(name=section, options=options,
932
702
                              stop_hook = remove_from_clients,
933
 
                              config
934
 
                              = dict(client_config.items(section)))
 
703
                              **(dict(client_config\
 
704
                                      .items(section))))
935
705
                       for section in client_config.sections()))
936
 
    if not clients:
937
 
        logger.critical(u"No clients defined")
938
 
        sys.exit(1)
939
 
    
940
 
    if debug:
941
 
        # Redirect stdin so all checkers get /dev/null
942
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
943
 
        os.dup2(null, sys.stdin.fileno())
944
 
        if null > 2:
945
 
            os.close(null)
946
 
    else:
947
 
        # No console logging
948
 
        logger.removeHandler(console)
949
 
        # Close all input and output, do double fork, etc.
950
 
        daemon()
951
 
    
952
 
    try:
953
 
        pid = os.getpid()
954
 
        pidfile.write(str(pid) + "\n")
955
 
        pidfile.close()
956
 
        del pidfile
957
 
    except IOError:
958
 
        logger.error(u"Could not write to file %r with PID %d",
959
 
                     pidfilename, pid)
960
 
    except NameError:
961
 
        # "pidfile" was never created
962
 
        pass
963
 
    del pidfilename
 
706
    
 
707
    if not debug:
 
708
        daemon(False, False)
964
709
    
965
710
    def cleanup():
966
711
        "Cleanup function; run on exit"
980
725
    
981
726
    if not debug:
982
727
        signal.signal(signal.SIGINT, signal.SIG_IGN)
983
 
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
984
 
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
 
728
    signal.signal(signal.SIGHUP, lambda signum, frame: killme())
 
729
    signal.signal(signal.SIGTERM, lambda signum, frame: killme())
985
730
    
986
731
    for client in clients:
987
732
        client.start()
988
733
    
989
 
    tcp_server.enable()
990
 
    tcp_server.server_activate()
991
 
    
992
 
    # Find out what port we got
993
 
    service.port = tcp_server.socket.getsockname()[1]
994
 
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
995
 
                u" scope_id %d" % tcp_server.socket.getsockname())
996
 
    
997
 
    #service.interface = tcp_server.socket.getsockname()[3]
998
 
    
999
 
    try:
1000
 
        # From the Avahi example code
1001
 
        server.connect_to_signal("StateChanged", server_state_changed)
1002
 
        try:
1003
 
            server_state_changed(server.GetState())
1004
 
        except dbus.exceptions.DBusException, error:
1005
 
            logger.critical(u"DBusException: %s", error)
1006
 
            sys.exit(1)
1007
 
        # End of Avahi example code
1008
 
        
1009
 
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1010
 
                             lambda *args, **kwargs:
1011
 
                             tcp_server.handle_request\
1012
 
                             (*args[2:], **kwargs) or True)
1013
 
        
1014
 
        logger.debug(u"Starting main loop")
 
734
    tcp_server = IPv6_TCPServer((options.address, options.port),
 
735
                                tcp_handler,
 
736
                                options=options,
 
737
                                clients=clients)
 
738
    # Find out what random port we got
 
739
    global servicePort
 
740
    servicePort = tcp_server.socket.getsockname()[1]
 
741
    logger.debug(u"Now listening on port %d", servicePort)
 
742
    
 
743
    if options.interface is not None:
 
744
        global serviceInterface
 
745
        serviceInterface = if_nametoindex(options.interface)
 
746
    
 
747
    # From the Avahi example code
 
748
    server.connect_to_signal("StateChanged", server_state_changed)
 
749
    try:
 
750
        server_state_changed(server.GetState())
 
751
    except dbus.exceptions.DBusException, error:
 
752
        logger.critical(u"DBusException: %s", error)
 
753
        killme(1)
 
754
    # End of Avahi example code
 
755
    
 
756
    gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
 
757
                         lambda *args, **kwargs:
 
758
                         tcp_server.handle_request(*args[2:],
 
759
                                                   **kwargs) or True)
 
760
    try:
 
761
        logger.debug("Starting main loop")
 
762
        main_loop_started = True
1015
763
        main_loop.run()
1016
 
    except AvahiError, error:
1017
 
        logger.critical(u"AvahiError: %s" + unicode(error))
1018
 
        sys.exit(1)
1019
764
    except KeyboardInterrupt:
1020
765
        if debug:
1021
766
            print
 
767
    
 
768
    sys.exit(exitstatus)
1022
769
 
1023
770
if __name__ == '__main__':
1024
771
    main()