63
62
from dbus.mainloop.glib import DBusGMainLoop
65
# Brief description of the operation of this program:
67
# This server announces itself as a Zeroconf service. Connecting
68
# clients use the TLS protocol, with the unusual quirk that this
69
# server program acts as a TLS "client" while the connecting clients
70
# acts as a TLS "server". The clients (acting as a TLS "server") must
71
# supply an OpenPGP certificate, and the fingerprint of this
72
# certificate is used by this server to look up (in a list read from a
73
# file at start time) which binary blob to give the client. No other
74
# authentication or authorization is done by this server.
68
77
logger = logging.Logger('mandos')
69
78
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
79
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
72
80
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
81
('%(levelname)s: %(message)s'))
74
82
logger.addHandler(syslogger)
76
console = logging.StreamHandler()
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
79
logger.addHandler(console)
81
class AvahiError(Exception):
82
def __init__(self, value):
85
return repr(self.value)
87
class AvahiServiceError(AvahiError):
90
class AvahiGroupError(AvahiError):
94
class AvahiService(object):
95
"""An Avahi (Zeroconf) service.
97
interface: integer; avahi.IF_UNSPEC or an interface index.
98
Used to optionally bind to the specified interface.
99
name: string; Example: 'Mandos'
100
type: string; Example: '_mandos._tcp'.
101
See <http://www.dns-sd.org/ServiceTypes.html>
102
port: integer; what port to announce
103
TXT: list of strings; TXT record for the service
104
domain: string; Domain to publish on, default to .local if empty.
105
host: string; Host to publish records for, default is localhost
106
max_renames: integer; maximum number of renames
107
rename_count: integer; counter so we only rename after collisions
108
a sensible number of times
110
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
111
type = None, port = None, TXT = None, domain = "",
112
host = "", max_renames = 32768):
113
self.interface = interface
123
self.rename_count = 0
124
self.max_renames = max_renames
126
"""Derived from the Avahi example code"""
127
if self.rename_count >= self.max_renames:
128
logger.critical(u"No suitable Zeroconf service name found"
129
u" after %i retries, exiting.",
131
raise AvahiServiceError("Too many renames")
132
self.name = server.GetAlternativeServiceName(self.name)
133
logger.info(u"Changing Zeroconf service name to %r ...",
135
syslogger.setFormatter(logging.Formatter\
136
('Mandos (%s): %%(levelname)s:'
137
' %%(message)s' % self.name))
140
self.rename_count += 1
142
"""Derived from the Avahi example code"""
143
if group is not None:
146
"""Derived from the Avahi example code"""
149
group = dbus.Interface\
150
(bus.get_object(avahi.DBUS_NAME,
151
server.EntryGroupNew()),
152
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
group.connect_to_signal('StateChanged',
154
entry_group_state_changed)
155
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
156
service.name, service.type)
158
self.interface, # interface
159
avahi.PROTO_INET6, # protocol
160
dbus.UInt32(0), # flags
161
self.name, self.type,
162
self.domain, self.host,
163
dbus.UInt16(self.port),
164
avahi.string_array_to_txt_array(self.TXT))
85
# This variable is used to optionally bind to a specified interface.
86
# It is a global variable to fit in with the other variables from the
88
serviceInterface = avahi.IF_UNSPEC
167
89
# From the Avahi example code:
168
group = None # our entry group
91
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
92
servicePort = None # Not known at startup
93
serviceTXT = [] # TXT record for the service
94
domain = "" # Domain to publish on, default to .local
95
host = "" # Host to publish records for, default to localhost
96
group = None #our entry group
97
rename_count = 12 # Counter so we only rename after collisions a
98
# sensible number of times
169
99
# End of Avahi example code
176
106
fingerprint: string (40 or 32 hexadecimal digits); used to
177
107
uniquely identify the client
178
108
secret: bytestring; sent verbatim (over TLS) to client
179
host: string; available for use by the checker command
180
created: datetime.datetime(); object creation, not client host
181
last_checked_ok: datetime.datetime() or None if not yet checked OK
182
timeout: datetime.timedelta(); How long from last_checked_ok
183
until this client is invalid
109
fqdn: string (FQDN); available for use by the checker command
110
created: datetime.datetime()
111
last_seen: datetime.datetime() or None if not yet seen
112
timeout: datetime.timedelta(); How long from last_seen until
113
this client is invalid
184
114
interval: datetime.timedelta(); How often to start a new checker
185
115
stop_hook: If set, called by stop() as stop_hook(self)
186
116
checker: subprocess.Popen(); a running checker process used
187
117
to see if the client lives.
188
'None' if no process is running.
118
Is None if no process is running.
189
119
checker_initiator_tag: a gobject event source tag, or None
190
120
stop_initiator_tag: - '' -
191
121
checker_callback_tag: - '' -
192
122
checker_command: string; External command which is run to check if
193
client lives. %() expansions are done at
123
client lives. %()s expansions are done at
194
124
runtime with vars(self) as dict, so that for
195
125
instance %(name)s can be used in the command.
196
126
Private attibutes:
197
127
_timeout: Real variable for 'timeout'
198
128
_interval: Real variable for 'interval'
199
_timeout_milliseconds: Used when calling gobject.timeout_add()
129
_timeout_milliseconds: Used by gobject.timeout_add()
200
130
_interval_milliseconds: - '' -
202
132
def _set_timeout(self, timeout):
222
152
interval = property(lambda self: self._interval,
224
154
del _set_interval
225
def __init__(self, name = None, stop_hook=None, config={}):
226
"""Note: the 'checker' key in 'config' sets the
227
'checker_command' attribute and *not* the 'checker'
155
def __init__(self, name=None, stop_hook=None, fingerprint=None,
156
secret=None, secfile=None, fqdn=None, timeout=None,
157
interval=-1, checker=None):
158
"""Note: the 'checker' argument sets the 'checker_command'
159
attribute and not the 'checker' attribute.."""
230
161
logger.debug(u"Creating client %r", self.name)
231
# Uppercase and remove spaces from fingerprint for later
232
# comparison purposes with return value from the fingerprint()
234
self.fingerprint = config["fingerprint"].upper()\
162
# Uppercase and remove spaces from fingerprint
163
# for later comparison purposes with return value of
164
# the fingerprint() function
165
self.fingerprint = fingerprint.upper().replace(u" ", u"")
236
166
logger.debug(u" Fingerprint: %s", self.fingerprint)
237
if "secret" in config:
238
self.secret = config["secret"].decode(u"base64")
239
elif "secfile" in config:
240
sf = open(config["secfile"])
168
self.secret = secret.decode(u"base64")
241
171
self.secret = sf.read()
244
raise TypeError(u"No secret or secfile for client %s"
246
self.host = config.get("host", "")
174
raise RuntimeError(u"No secret or secfile for client %s"
176
self.fqdn = fqdn # string
247
177
self.created = datetime.datetime.now()
248
self.last_checked_ok = None
249
self.timeout = string_to_delta(config["timeout"])
250
self.interval = string_to_delta(config["interval"])
178
self.last_seen = None
179
self.timeout = string_to_delta(timeout)
180
self.interval = string_to_delta(interval)
251
181
self.stop_hook = stop_hook
252
182
self.checker = None
253
183
self.checker_initiator_tag = None
254
184
self.stop_initiator_tag = None
255
185
self.checker_callback_tag = None
256
self.check_command = config["checker"]
186
self.check_command = checker
258
188
"""Start this client's checker and timeout hooks"""
259
189
# Schedule a new checker to be started an 'interval' from now,
271
201
"""Stop this client.
272
The possibility that a client might be restarted is left open,
273
but not currently used."""
202
The possibility that this client might be restarted is left
203
open, but not currently used."""
274
204
# If this client doesn't have a secret, it is already stopped.
275
if hasattr(self, "secret") and self.secret:
276
logger.info(u"Stopping client %s", self.name)
206
logger.debug(u"Stopping client %s", self.name)
277
207
self.secret = None
280
if getattr(self, "stop_initiator_tag", False):
210
if hasattr(self, "stop_initiator_tag") \
211
and self.stop_initiator_tag:
281
212
gobject.source_remove(self.stop_initiator_tag)
282
213
self.stop_initiator_tag = None
283
if getattr(self, "checker_initiator_tag", False):
214
if hasattr(self, "checker_initiator_tag") \
215
and self.checker_initiator_tag:
284
216
gobject.source_remove(self.checker_initiator_tag)
285
217
self.checker_initiator_tag = None
286
218
self.stop_checker()
325
257
# is as it should be.
326
258
if self.checker is None:
328
# In case check_command has exactly one % operator
329
command = self.check_command % self.host
260
command = self.check_command % self.fqdn
330
261
except TypeError:
331
# Escape attributes for the shell
332
262
escaped_attrs = dict((key, re.escape(str(val)))
334
264
vars(self).iteritems())
336
266
command = self.check_command % escaped_attrs
337
267
except TypeError, error:
338
logger.error(u'Could not format string "%s":'
339
u' %s', self.check_command, error)
268
logger.critical(u'Could not format string "%s":'
269
u' %s', self.check_command, error)
340
270
return True # Try again later
342
logger.info(u"Starting checker %r for %s",
344
# We don't need to redirect stdout and stderr, since
345
# in normal mode, that is already done by daemon(),
346
# and in debug mode we don't want to. (Stdin is
347
# always replaced by /dev/null.)
348
self.checker = subprocess.Popen(command,
272
logger.debug(u"Starting checker %r for %s",
274
self.checker = subprocess.\
276
close_fds=True, shell=True,
351
278
self.checker_callback_tag = gobject.child_watch_add\
352
279
(self.checker.pid,
353
280
self.checker_callback)
354
except OSError, error:
281
except subprocess.OSError, error:
355
282
logger.error(u"Failed to start subprocess: %s",
357
284
# Re-run this periodically if run by gobject.timeout_add
361
288
if self.checker_callback_tag:
362
289
gobject.source_remove(self.checker_callback_tag)
363
290
self.checker_callback_tag = None
364
if getattr(self, "checker", None) is None:
291
if not hasattr(self, "checker") or self.checker is None:
366
logger.debug(u"Stopping checker for %(name)s", vars(self))
293
logger.debug("Stopping checker for %(name)s", vars(self))
368
295
os.kill(self.checker.pid, signal.SIGTERM)
370
297
#if self.checker.poll() is None:
371
298
# os.kill(self.checker.pid, signal.SIGKILL)
372
299
except OSError, error:
373
if error.errno != errno.ESRCH: # No such process
300
if error.errno != errno.ESRCH:
375
302
self.checker = None
376
def still_valid(self):
303
def still_valid(self, now=None):
377
304
"""Has the timeout not yet passed for this client?"""
378
now = datetime.datetime.now()
379
if self.last_checked_ok is None:
306
now = datetime.datetime.now()
307
if self.last_seen is None:
380
308
return now < (self.created + self.timeout)
382
return now < (self.last_checked_ok + self.timeout)
310
return now < (self.last_seen + self.timeout)
385
313
def peer_certificate(session):
402
330
def fingerprint(openpgp):
403
331
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
332
# New empty GnuTLS certificate
333
crt = gnutls.library.types.gnutls_openpgp_crt_t()
334
gnutls.library.functions.gnutls_openpgp_crt_init\
404
336
# New GnuTLS "datum" with the OpenPGP public key
405
337
datum = gnutls.library.types.gnutls_datum_t\
406
338
(ctypes.cast(ctypes.c_char_p(openpgp),
407
339
ctypes.POINTER(ctypes.c_ubyte)),
408
340
ctypes.c_uint(len(openpgp)))
409
# New empty GnuTLS certificate
410
crt = gnutls.library.types.gnutls_openpgp_crt_t()
411
gnutls.library.functions.gnutls_openpgp_crt_init\
413
341
# Import the OpenPGP public key into the certificate
414
gnutls.library.functions.gnutls_openpgp_crt_import\
415
(crt, ctypes.byref(datum),
416
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
417
# Verify the self signature in the key
418
crtverify = ctypes.c_uint();
419
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
(crt, 0, ctypes.byref(crtverify))
421
if crtverify.value != 0:
422
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
423
raise gnutls.errors.CertificateSecurityError("Verify failed")
342
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
345
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
424
346
# New buffer for the fingerprint
425
347
buffer = ctypes.create_string_buffer(20)
426
348
buffer_length = ctypes.c_size_t()
442
364
Note: This will run in its own forked process."""
444
366
def handle(self):
445
logger.info(u"TCP connection from: %s",
367
logger.debug(u"TCP connection from: %s",
446
368
unicode(self.client_address))
447
session = gnutls.connection.ClientSession\
448
(self.request, gnutls.connection.X509Credentials())
450
line = self.request.makefile().readline()
451
logger.debug(u"Protocol version: %r", line)
453
if int(line.strip().split()[0]) > 1:
455
except (ValueError, IndexError, RuntimeError), error:
456
logger.error(u"Unknown protocol version: %s", error)
459
# Note: gnutls.connection.X509Credentials is really a generic
460
# GnuTLS certificate credentials object so long as no X.509
461
# keys are added to it. Therefore, we can use it here despite
462
# using OpenPGP certificates.
369
session = gnutls.connection.ClientSession(self.request,
464
373
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
465
374
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
467
priority = "NORMAL" # Fallback default, since this
469
if self.server.settings["priority"]:
470
priority = self.server.settings["priority"]
377
if self.server.options.priority:
378
priority = self.server.options.priority
471
379
gnutls.library.functions.gnutls_priority_set_direct\
472
380
(session._c_object, priority, None);
475
383
session.handshake()
476
384
except gnutls.errors.GNUTLSError, error:
477
logger.warning(u"Handshake failed: %s", error)
385
logger.debug(u"Handshake failed: %s", error)
478
386
# Do not run session.bye() here: the session is not
479
387
# established. Just abandon the request.
482
390
fpr = fingerprint(peer_certificate(session))
483
391
except (TypeError, gnutls.errors.GNUTLSError), error:
484
logger.warning(u"Bad certificate: %s", error)
392
logger.debug(u"Bad certificate: %s", error)
487
395
logger.debug(u"Fingerprint: %s", fpr)
516
423
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
517
424
"""IPv6 TCP server. Accepts 'None' as address and/or port.
519
settings: Server settings
426
options: Command line options
520
427
clients: Set() of Client objects
521
enabled: Boolean; whether this server is activated yet
523
429
address_family = socket.AF_INET6
524
430
def __init__(self, *args, **kwargs):
525
if "settings" in kwargs:
526
self.settings = kwargs["settings"]
527
del kwargs["settings"]
431
if "options" in kwargs:
432
self.options = kwargs["options"]
433
del kwargs["options"]
528
434
if "clients" in kwargs:
529
435
self.clients = kwargs["clients"]
530
436
del kwargs["clients"]
532
437
return super(type(self), self).__init__(*args, **kwargs)
533
438
def server_bind(self):
534
439
"""This overrides the normal server_bind() function
535
440
to bind to an interface if one was specified, and also NOT to
536
441
bind to an address or port if they were not specified."""
537
if self.settings["interface"]:
538
# 25 is from /usr/include/asm-i486/socket.h
539
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
442
if self.options.interface:
443
if not hasattr(socket, "SO_BINDTODEVICE"):
444
# From /usr/include/asm-i486/socket.h
445
socket.SO_BINDTODEVICE = 25
541
447
self.socket.setsockopt(socket.SOL_SOCKET,
543
self.settings["interface"])
448
socket.SO_BINDTODEVICE,
449
self.options.interface)
544
450
except socket.error, error:
545
451
if error[0] == errno.EPERM:
546
logger.error(u"No permission to"
547
u" bind to interface %s",
548
self.settings["interface"])
452
logger.warning(u"No permission to"
453
u" bind to interface %s",
454
self.options.interface)
551
457
# Only bind(2) the socket if we really need to.
585
479
datetime.timedelta(1)
586
480
>>> string_to_delta(u'1w')
587
481
datetime.timedelta(7)
588
>>> string_to_delta('5m 30s')
589
datetime.timedelta(0, 330)
591
timevalue = datetime.timedelta(0)
592
for s in interval.split():
594
suffix=unicode(s[-1])
597
delta = datetime.timedelta(value)
599
delta = datetime.timedelta(0, value)
601
delta = datetime.timedelta(0, 0, 0, 0, value)
603
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
605
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
608
except (ValueError, IndexError):
484
suffix=unicode(interval[-1])
485
value=int(interval[:-1])
487
delta = datetime.timedelta(value)
489
delta = datetime.timedelta(0, value)
491
delta = datetime.timedelta(0, 0, 0, 0, value)
493
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
495
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
498
except (ValueError, IndexError):
504
"""Derived from the Avahi example code"""
505
global group, serviceName, serviceType, servicePort, serviceTXT, \
508
group = dbus.Interface(
509
bus.get_object( avahi.DBUS_NAME,
510
server.EntryGroupNew()),
511
avahi.DBUS_INTERFACE_ENTRY_GROUP)
512
group.connect_to_signal('StateChanged',
513
entry_group_state_changed)
514
logger.debug(u"Adding service '%s' of type '%s' ...",
515
serviceName, serviceType)
518
serviceInterface, # interface
519
avahi.PROTO_INET6, # protocol
520
dbus.UInt32(0), # flags
521
serviceName, serviceType,
523
dbus.UInt16(servicePort),
524
avahi.string_array_to_txt_array(serviceTXT))
528
def remove_service():
529
"""From the Avahi example code"""
532
if not group is None:
614
536
def server_state_changed(state):
615
537
"""Derived from the Avahi example code"""
616
538
if state == avahi.SERVER_COLLISION:
617
logger.error(u"Zeroconf server name collision")
539
logger.warning(u"Server name collision")
619
541
elif state == avahi.SERVER_RUNNING:
623
545
def entry_group_state_changed(state, error):
624
546
"""Derived from the Avahi example code"""
625
logger.debug(u"Avahi state change: %i", state)
547
global serviceName, server, rename_count
549
logger.debug(u"state change: %i", state)
627
551
if state == avahi.ENTRY_GROUP_ESTABLISHED:
628
logger.debug(u"Zeroconf service established.")
552
logger.debug(u"Service established.")
629
553
elif state == avahi.ENTRY_GROUP_COLLISION:
630
logger.warning(u"Zeroconf service name collision.")
555
rename_count = rename_count - 1
557
name = server.GetAlternativeServiceName(name)
558
logger.warning(u"Service name collision, "
559
u"changing name to '%s' ...", name)
564
logger.error(u"No suitable service name found after %i"
565
u" retries, exiting.", n_rename)
632
567
elif state == avahi.ENTRY_GROUP_FAILURE:
633
logger.critical(u"Avahi: Error in group state changed %s",
635
raise AvahiGroupError("State changed: %s", str(error))
568
logger.error(u"Error in group state changed %s",
637
573
def if_nametoindex(interface):
638
"""Call the C function if_nametoindex(), or equivalent"""
639
global if_nametoindex
574
"""Call the C function if_nametoindex()"""
641
if "ctypes.util" not in sys.modules:
643
if_nametoindex = ctypes.cdll.LoadLibrary\
644
(ctypes.util.find_library("c")).if_nametoindex
576
libc = ctypes.cdll.LoadLibrary("libc.so.6")
577
return libc.if_nametoindex(interface)
645
578
except (OSError, AttributeError):
646
579
if "struct" not in sys.modules:
648
581
if "fcntl" not in sys.modules:
650
def if_nametoindex(interface):
651
"Get an interface index the hard way, i.e. using fcntl()"
652
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
654
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
655
struct.pack("16s16x", interface))
657
interface_index = struct.unpack("I", ifreq[16:20])[0]
658
return interface_index
659
return if_nametoindex(interface)
662
def daemon(nochdir = False, noclose = False):
583
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
585
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
586
struct.pack("16s16x", interface))
588
interface_index = struct.unpack("I", ifreq[16:20])[0]
589
return interface_index
592
def daemon(nochdir, noclose):
663
593
"""See daemon(3). Standard BSD Unix function.
664
594
This should really exist as os.daemon, but it doesn't (yet)."""
613
def killme(status = 0):
614
logger.debug("Stopping server with exit status %d", status)
616
if main_loop_started:
686
625
global main_loop_started
687
626
main_loop_started = False
689
parser = OptionParser(version = "%%prog %s" % version)
628
parser = OptionParser()
690
629
parser.add_option("-i", "--interface", type="string",
691
metavar="IF", help="Bind to interface IF")
692
parser.add_option("-a", "--address", type="string",
630
default=None, metavar="IF",
631
help="Bind to interface IF")
632
parser.add_option("-a", "--address", type="string", default=None,
693
633
help="Address to listen for requests on")
694
parser.add_option("-p", "--port", type="int",
634
parser.add_option("-p", "--port", type="int", default=None,
695
635
help="Port number to receive requests on")
696
636
parser.add_option("--check", action="store_true", default=False,
697
637
help="Run self-test")
698
parser.add_option("--debug", action="store_true",
699
help="Debug mode; run in foreground and log to"
701
parser.add_option("--priority", type="string", help="GnuTLS"
702
" priority string (see GnuTLS documentation)")
703
parser.add_option("--servicename", type="string", metavar="NAME",
704
help="Zeroconf service name")
705
parser.add_option("--configdir", type="string",
706
default="/etc/mandos", metavar="DIR",
707
help="Directory to search for configuration"
638
parser.add_option("--debug", action="store_true", default=False,
640
parser.add_option("--priority", type="string",
642
help="GnuTLS priority string"
643
" (see GnuTLS documentation)")
644
parser.add_option("--servicename", type="string",
645
default="Mandos", help="Zeroconf service name")
709
646
(options, args) = parser.parse_args()
711
648
if options.check:
713
650
doctest.testmod()
716
# Default values for config file for server-global settings
717
server_defaults = { "interface": "",
722
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
723
"servicename": "Mandos",
726
# Parse config file for server-global settings
727
server_config = ConfigParser.SafeConfigParser(server_defaults)
729
server_config.read(os.path.join(options.configdir, "mandos.conf"))
730
# Convert the SafeConfigParser object to a dict
731
server_settings = server_config.defaults()
732
# Use getboolean on the boolean config option
733
server_settings["debug"] = server_config.getboolean\
737
# Override the settings from the config file with command line
739
for option in ("interface", "address", "port", "debug",
740
"priority", "servicename", "configdir"):
741
value = getattr(options, option)
742
if value is not None:
743
server_settings[option] = value
745
# Now we have our good server settings in "server_settings"
747
debug = server_settings["debug"]
750
syslogger.setLevel(logging.WARNING)
751
console.setLevel(logging.WARNING)
753
if server_settings["servicename"] != "Mandos":
754
syslogger.setFormatter(logging.Formatter\
755
('Mandos (%s): %%(levelname)s:'
757
% server_settings["servicename"]))
759
# Parse config file with clients
760
client_defaults = { "timeout": "1h",
762
"checker": "fping -q -- %(host)s",
765
client_config = ConfigParser.SafeConfigParser(client_defaults)
766
client_config.read(os.path.join(server_settings["configdir"],
770
tcp_server = IPv6_TCPServer((server_settings["address"],
771
server_settings["port"]),
773
settings=server_settings,
778
uid = pwd.getpwnam("mandos").pw_uid
781
uid = pwd.getpwnam("nobody").pw_uid
785
gid = pwd.getpwnam("mandos").pw_gid
788
gid = pwd.getpwnam("nogroup").pw_gid
794
except OSError, error:
795
if error[0] != errno.EPERM:
799
service = AvahiService(name = server_settings["servicename"],
800
type = "_mandos._tcp", );
801
if server_settings["interface"]:
802
service.interface = if_nametoindex\
803
(server_settings["interface"])
654
defaults = { "timeout": "1h",
656
"checker": "fping -q -- %%(fqdn)s",
658
client_config = ConfigParser.SafeConfigParser(defaults)
659
#client_config.readfp(open("global.conf"), "global.conf")
660
client_config.read("mandos-clients.conf")
663
serviceName = options.servicename;
809
669
DBusGMainLoop(set_as_default=True )
810
670
main_loop = gobject.MainLoop()
811
671
bus = dbus.SystemBus()
812
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
813
avahi.DBUS_PATH_SERVER),
814
avahi.DBUS_INTERFACE_SERVER)
672
server = dbus.Interface(
673
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
674
avahi.DBUS_INTERFACE_SERVER )
815
675
# End of Avahi example code
677
debug = options.debug
680
console = logging.StreamHandler()
681
# console.setLevel(logging.DEBUG)
682
console.setFormatter(logging.Formatter\
683
('%(levelname)s: %(message)s'))
684
logger.addHandler(console)
817
688
def remove_from_clients(client):
818
689
clients.remove(client)
820
logger.critical(u"No clients left, exiting")
691
logger.debug(u"No clients left, exiting")
823
clients.update(Set(Client(name = section,
694
clients.update(Set(Client(name=section,
824
695
stop_hook = remove_from_clients,
826
= dict(client_config.items(section)))
696
**(dict(client_config\
827
698
for section in client_config.sections()))
829
logger.critical(u"No clients defined")
833
# Redirect stdin so all checkers get /dev/null
834
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
835
os.dup2(null, sys.stdin.fileno())
840
logger.removeHandler(console)
841
# Close all input and output, do double fork, etc.
844
pidfilename = "/var/run/mandos.pid"
847
pidfile = open(pidfilename, "w")
848
pidfile.write(str(pid) + "\n")
852
logger.error(u"Could not write %s file with PID %d",
853
pidfilename, os.getpid())
856
704
"Cleanup function; run on exit"
872
720
signal.signal(signal.SIGINT, signal.SIG_IGN)
873
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
874
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
721
signal.signal(signal.SIGHUP, lambda signum, frame: killme())
722
signal.signal(signal.SIGTERM, lambda signum, frame: killme())
876
724
for client in clients:
880
tcp_server.server_activate()
882
# Find out what port we got
883
service.port = tcp_server.socket.getsockname()[1]
884
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
885
u" scope_id %d" % tcp_server.socket.getsockname())
887
#service.interface = tcp_server.socket.getsockname()[3]
890
# From the Avahi example code
891
server.connect_to_signal("StateChanged", server_state_changed)
893
server_state_changed(server.GetState())
894
except dbus.exceptions.DBusException, error:
895
logger.critical(u"DBusException: %s", error)
897
# End of Avahi example code
899
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
900
lambda *args, **kwargs:
901
tcp_server.handle_request\
902
(*args[2:], **kwargs) or True)
904
logger.debug(u"Starting main loop")
727
tcp_server = IPv6_TCPServer((options.address, options.port),
731
# Find out what random port we got
733
servicePort = tcp_server.socket.getsockname()[1]
734
logger.debug(u"Now listening on port %d", servicePort)
736
if options.interface is not None:
737
global serviceInterface
738
serviceInterface = if_nametoindex(options.interface)
740
# From the Avahi example code
741
server.connect_to_signal("StateChanged", server_state_changed)
743
server_state_changed(server.GetState())
744
except dbus.exceptions.DBusException, error:
745
logger.critical(u"DBusException: %s", error)
747
# End of Avahi example code
749
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
750
lambda *args, **kwargs:
751
tcp_server.handle_request(*args[2:],
754
logger.debug("Starting main loop")
905
755
main_loop_started = True
907
except AvahiError, error:
908
logger.critical(u"AvahiError: %s" + unicode(error))
910
757
except KeyboardInterrupt:
914
763
if __name__ == '__main__':