To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 269.2.1
- compare with another revision
- download diff
- download tarball
- view history from revision 269.2.1
- Committer: teddy at bsnet
- Date: 2010-08-16 19:00:59 UTC
- mto: (237.2.183 mandos-local)
- mto: This revision was merged to the branch mainline in revision 270.
- Revision ID: teddy@fukt.bsnet.se-20100816190059-69vvi27up95cgbbl
* Makefile (run-server, run-client): Add notices about harmless error
messages.
messages.
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- plugins.d/usplash
- files renamed:
- plugins.d/password-request.c => plugins.d/mandos-client.c
- plugins.d/password-request.xml => plugins.d/mandos-client.xml
- files modified:
- .bzrignore
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
15
16
#
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
30
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
32
#
32
33
33
from __future__ import division
34
from __future__ import division, with_statement, absolute_import
34
35
35
import SocketServer
36
import SocketServer as socketserver
36
37
import socket
37
import select
38
from optparse import OptionParser
38
import optparse
39
39
import datetime
40
40
import errno
41
41
import gnutls.crypto
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
import ConfigParser
47
import ConfigParser as configparser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
from sets import Set
53
52
import subprocess
54
53
import atexit
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
57
import pwd
58
from contextlib import closing
59
import struct
60
import fcntl
61
import functools
59
62
60
63
import dbus
64
import dbus.service
61
65
import gobject
62
66
import avahi
63
67
from dbus.mainloop.glib import DBusGMainLoop
64
68
import ctypes
65
66
version = "1.0"
67
68
logger = logging.Logger('mandos')
69
syslogger = logging.handlers.SysLogHandler\
70
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
address = "/dev/log")
72
syslogger.setFormatter(logging.Formatter\
73
('Mandos: %(levelname)s: %(message)s'))
69
import ctypes.util
70
71
try:
72
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
73
except AttributeError:
74
try:
75
from IN import SO_BINDTODEVICE
76
except ImportError:
77
SO_BINDTODEVICE = None
78
79
80
version = "1.0.14"
81
82
logger = logging.Logger(u'mandos')
83
syslogger = (logging.handlers.SysLogHandler
84
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
85
address = "/dev/log"))
86
syslogger.setFormatter(logging.Formatter
87
(u'Mandos [%(process)d]: %(levelname)s:'
88
u' %(message)s'))
74
89
logger.addHandler(syslogger)
75
90
76
91
console = logging.StreamHandler()
77
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
' %(message)s'))
92
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
93
u' %(levelname)s:'
94
u' %(message)s'))
79
95
logger.addHandler(console)
80
96
81
97
class AvahiError(Exception):
82
def __init__(self, value):
98
def __init__(self, value, *args, **kwargs):
83
99
self.value = value
84
def __str__(self):
85
return repr(self.value)
100
super(AvahiError, self).__init__(value, *args, **kwargs)
101
def __unicode__(self):
102
return unicode(repr(self.value))
86
103
87
104
class AvahiServiceError(AvahiError):
88
105
pass
93
110
94
111
class AvahiService(object):
95
112
"""An Avahi (Zeroconf) service.
113
96
114
Attributes:
97
115
interface: integer; avahi.IF_UNSPEC or an interface index.
98
116
Used to optionally bind to the specified interface.
99
name: string; Example: 'Mandos'
100
type: string; Example: '_mandos._tcp'.
117
name: string; Example: u'Mandos'
118
type: string; Example: u'_mandos._tcp'.
101
119
See <http://www.dns-sd.org/ServiceTypes.html>
102
120
port: integer; what port to announce
103
121
TXT: list of strings; TXT record for the service
106
124
max_renames: integer; maximum number of renames
107
125
rename_count: integer; counter so we only rename after collisions
108
126
a sensible number of times
127
group: D-Bus Entry Group
128
server: D-Bus Server
129
bus: dbus.SystemBus()
109
130
"""
110
131
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
111
type = None, port = None, TXT = None, domain = "",
112
host = "", max_renames = 32768):
132
servicetype = None, port = None, TXT = None,
133
domain = u"", host = u"", max_renames = 32768,
134
protocol = avahi.PROTO_UNSPEC, bus = None):
113
135
self.interface = interface
114
136
self.name = name
115
self.type = type
137
self.type = servicetype
116
138
self.port = port
117
if TXT is None:
118
self.TXT = []
119
else:
120
self.TXT = TXT
139
self.TXT = TXT if TXT is not None else []
121
140
self.domain = domain
122
141
self.host = host
123
142
self.rename_count = 0
124
143
self.max_renames = max_renames
144
self.protocol = protocol
145
self.group = None # our entry group
146
self.server = None
147
self.bus = bus
125
148
def rename(self):
126
149
"""Derived from the Avahi example code"""
127
150
if self.rename_count >= self.max_renames:
128
151
logger.critical(u"No suitable Zeroconf service name found"
129
152
u" after %i retries, exiting.",
130
rename_count)
131
raise AvahiServiceError("Too many renames")
132
self.name = server.GetAlternativeServiceName(self.name)
153
self.rename_count)
154
raise AvahiServiceError(u"Too many renames")
155
self.name = self.server.GetAlternativeServiceName(self.name)
133
156
logger.info(u"Changing Zeroconf service name to %r ...",
134
str(self.name))
135
syslogger.setFormatter(logging.Formatter\
136
('Mandos (%s): %%(levelname)s:'
137
' %%(message)s' % self.name))
157
unicode(self.name))
158
syslogger.setFormatter(logging.Formatter
159
(u'Mandos (%s) [%%(process)d]:'
160
u' %%(levelname)s: %%(message)s'
161
% self.name))
138
162
self.remove()
139
163
self.add()
140
164
self.rename_count += 1
141
165
def remove(self):
142
166
"""Derived from the Avahi example code"""
143
if group is not None:
144
group.Reset()
167
if self.group is not None:
168
self.group.Reset()
145
169
def add(self):
146
170
"""Derived from the Avahi example code"""
147
global group
148
if group is None:
149
group = dbus.Interface\
150
(bus.get_object(avahi.DBUS_NAME,
151
server.EntryGroupNew()),
152
avahi.DBUS_INTERFACE_ENTRY_GROUP)
153
group.connect_to_signal('StateChanged',
154
entry_group_state_changed)
171
if self.group is None:
172
self.group = dbus.Interface(
173
self.bus.get_object(avahi.DBUS_NAME,
174
self.server.EntryGroupNew()),
175
avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
self.group.connect_to_signal('StateChanged',
177
self.entry_group_state_changed)
155
178
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
156
service.name, service.type)
157
group.AddService(
158
self.interface, # interface
159
avahi.PROTO_INET6, # protocol
160
dbus.UInt32(0), # flags
161
self.name, self.type,
162
self.domain, self.host,
163
dbus.UInt16(self.port),
164
avahi.string_array_to_txt_array(self.TXT))
165
group.Commit()
166
167
# From the Avahi example code:
168
group = None # our entry group
169
# End of Avahi example code
179
self.name, self.type)
180
self.group.AddService(
181
self.interface,
182
self.protocol,
183
dbus.UInt32(0), # flags
184
self.name, self.type,
185
self.domain, self.host,
186
dbus.UInt16(self.port),
187
avahi.string_array_to_txt_array(self.TXT))
188
self.group.Commit()
189
def entry_group_state_changed(self, state, error):
190
"""Derived from the Avahi example code"""
191
logger.debug(u"Avahi state change: %i", state)
192
193
if state == avahi.ENTRY_GROUP_ESTABLISHED:
194
logger.debug(u"Zeroconf service established.")
195
elif state == avahi.ENTRY_GROUP_COLLISION:
196
logger.warning(u"Zeroconf service name collision.")
197
self.rename()
198
elif state == avahi.ENTRY_GROUP_FAILURE:
199
logger.critical(u"Avahi: Error in group state changed %s",
200
unicode(error))
201
raise AvahiGroupError(u"State changed: %s"
202
% unicode(error))
203
def cleanup(self):
204
"""Derived from the Avahi example code"""
205
if self.group is not None:
206
self.group.Free()
207
self.group = None
208
def server_state_changed(self, state):
209
"""Derived from the Avahi example code"""
210
if state == avahi.SERVER_COLLISION:
211
logger.error(u"Zeroconf server name collision")
212
self.remove()
213
elif state == avahi.SERVER_RUNNING:
214
self.add()
215
def activate(self):
216
"""Derived from the Avahi example code"""
217
if self.server is None:
218
self.server = dbus.Interface(
219
self.bus.get_object(avahi.DBUS_NAME,
220
avahi.DBUS_PATH_SERVER),
221
avahi.DBUS_INTERFACE_SERVER)
222
self.server.connect_to_signal(u"StateChanged",
223
self.server_state_changed)
224
self.server_state_changed(self.server.GetState())
170
225
171
226
172
227
class Client(object):
173
228
"""A representation of a client host served by this server.
229
174
230
Attributes:
175
name: string; from the config file, used in log messages
231
name: string; from the config file, used in log messages and
232
D-Bus identifiers
176
233
fingerprint: string (40 or 32 hexadecimal digits); used to
177
234
uniquely identify the client
178
secret: bytestring; sent verbatim (over TLS) to client
179
host: string; available for use by the checker command
180
created: datetime.datetime(); object creation, not client host
181
last_checked_ok: datetime.datetime() or None if not yet checked OK
182
timeout: datetime.timedelta(); How long from last_checked_ok
183
until this client is invalid
184
interval: datetime.timedelta(); How often to start a new checker
185
stop_hook: If set, called by stop() as stop_hook(self)
186
checker: subprocess.Popen(); a running checker process used
187
to see if the client lives.
188
'None' if no process is running.
235
secret: bytestring; sent verbatim (over TLS) to client
236
host: string; available for use by the checker command
237
created: datetime.datetime(); (UTC) object creation
238
last_enabled: datetime.datetime(); (UTC)
239
enabled: bool()
240
last_checked_ok: datetime.datetime(); (UTC) or None
241
timeout: datetime.timedelta(); How long from last_checked_ok
242
until this client is invalid
243
interval: datetime.timedelta(); How often to start a new checker
244
disable_hook: If set, called by disable() as disable_hook(self)
245
checker: subprocess.Popen(); a running checker process used
246
to see if the client lives.
247
'None' if no process is running.
189
248
checker_initiator_tag: a gobject event source tag, or None
190
stop_initiator_tag: - '' -
249
disable_initiator_tag: - '' -
191
250
checker_callback_tag: - '' -
192
251
checker_command: string; External command which is run to check if
193
252
client lives. %() expansions are done at
194
253
runtime with vars(self) as dict, so that for
195
254
instance %(name)s can be used in the command.
196
Private attibutes:
197
_timeout: Real variable for 'timeout'
198
_interval: Real variable for 'interval'
199
_timeout_milliseconds: Used when calling gobject.timeout_add()
200
_interval_milliseconds: - '' -
255
current_checker_command: string; current running checker_command
201
256
"""
202
def _set_timeout(self, timeout):
203
"Setter function for 'timeout' attribute"
204
self._timeout = timeout
205
self._timeout_milliseconds = ((self.timeout.days
206
* 24 * 60 * 60 * 1000)
207
+ (self.timeout.seconds * 1000)
208
+ (self.timeout.microseconds
209
// 1000))
210
timeout = property(lambda self: self._timeout,
211
_set_timeout)
212
del _set_timeout
213
def _set_interval(self, interval):
214
"Setter function for 'interval' attribute"
215
self._interval = interval
216
self._interval_milliseconds = ((self.interval.days
217
* 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds
219
* 1000)
220
+ (self.interval.microseconds
221
// 1000))
222
interval = property(lambda self: self._interval,
223
_set_interval)
224
del _set_interval
225
def __init__(self, name = None, stop_hook=None, config={}):
257
258
@staticmethod
259
def _datetime_to_milliseconds(dt):
260
"Convert a datetime.datetime() to milliseconds"
261
return ((dt.days * 24 * 60 * 60 * 1000)
262
+ (dt.seconds * 1000)
263
+ (dt.microseconds // 1000))
264
265
def timeout_milliseconds(self):
266
"Return the 'timeout' attribute in milliseconds"
267
return self._datetime_to_milliseconds(self.timeout)
268
269
def interval_milliseconds(self):
270
"Return the 'interval' attribute in milliseconds"
271
return self._datetime_to_milliseconds(self.interval)
272
273
def __init__(self, name = None, disable_hook=None, config=None):
226
274
"""Note: the 'checker' key in 'config' sets the
227
275
'checker_command' attribute and *not* the 'checker'
228
276
attribute."""
229
277
self.name = name
278
if config is None:
279
config = {}
230
280
logger.debug(u"Creating client %r", self.name)
231
281
# Uppercase and remove spaces from fingerprint for later
232
282
# comparison purposes with return value from the fingerprint()
233
283
# function
234
self.fingerprint = config["fingerprint"].upper()\
235
.replace(u" ", u"")
284
self.fingerprint = (config[u"fingerprint"].upper()
285
.replace(u" ", u""))
236
286
logger.debug(u" Fingerprint: %s", self.fingerprint)
237
if "secret" in config:
238
self.secret = config["secret"].decode(u"base64")
239
elif "secfile" in config:
240
sf = open(config["secfile"])
241
self.secret = sf.read()
242
sf.close()
287
if u"secret" in config:
288
self.secret = config[u"secret"].decode(u"base64")
289
elif u"secfile" in config:
290
with closing(open(os.path.expanduser
291
(os.path.expandvars
292
(config[u"secfile"])))) as secfile:
293
self.secret = secfile.read()
243
294
else:
244
295
raise TypeError(u"No secret or secfile for client %s"
245
296
% self.name)
246
self.host = config.get("host", "")
247
self.created = datetime.datetime.now()
297
self.host = config.get(u"host", u"")
298
self.created = datetime.datetime.utcnow()
299
self.enabled = False
300
self.last_enabled = None
248
301
self.last_checked_ok = None
249
self.timeout = string_to_delta(config["timeout"])
250
self.interval = string_to_delta(config["interval"])
251
self.stop_hook = stop_hook
302
self.timeout = string_to_delta(config[u"timeout"])
303
self.interval = string_to_delta(config[u"interval"])
304
self.disable_hook = disable_hook
252
305
self.checker = None
253
306
self.checker_initiator_tag = None
254
self.stop_initiator_tag = None
307
self.disable_initiator_tag = None
255
308
self.checker_callback_tag = None
256
self.check_command = config["checker"]
257
def start(self):
309
self.checker_command = config[u"checker"]
310
self.current_checker_command = None
311
self.last_connect = None
312
313
def enable(self):
258
314
"""Start this client's checker and timeout hooks"""
315
if getattr(self, u"enabled", False):
316
# Already enabled
317
return
318
self.last_enabled = datetime.datetime.utcnow()
259
319
# Schedule a new checker to be started an 'interval' from now,
260
320
# and every interval from then on.
261
self.checker_initiator_tag = gobject.timeout_add\
262
(self._interval_milliseconds,
263
self.start_checker)
321
self.checker_initiator_tag = (gobject.timeout_add
322
(self.interval_milliseconds(),
323
self.start_checker))
264
324
# Also start a new checker *right now*.
265
325
self.start_checker()
266
# Schedule a stop() when 'timeout' has passed
267
self.stop_initiator_tag = gobject.timeout_add\
268
(self._timeout_milliseconds,
269
self.stop)
270
def stop(self):
271
"""Stop this client.
272
The possibility that a client might be restarted is left open,
273
but not currently used."""
274
# If this client doesn't have a secret, it is already stopped.
275
if hasattr(self, "secret") and self.secret:
276
logger.info(u"Stopping client %s", self.name)
277
self.secret = None
278
else:
326
# Schedule a disable() when 'timeout' has passed
327
self.disable_initiator_tag = (gobject.timeout_add
328
(self.timeout_milliseconds(),
329
self.disable))
330
self.enabled = True
331
332
def disable(self):
333
"""Disable this client."""
334
if not getattr(self, "enabled", False):
279
335
return False
280
if getattr(self, "stop_initiator_tag", False):
281
gobject.source_remove(self.stop_initiator_tag)
282
self.stop_initiator_tag = None
283
if getattr(self, "checker_initiator_tag", False):
336
logger.info(u"Disabling client %s", self.name)
337
if getattr(self, u"disable_initiator_tag", False):
338
gobject.source_remove(self.disable_initiator_tag)
339
self.disable_initiator_tag = None
340
if getattr(self, u"checker_initiator_tag", False):
284
341
gobject.source_remove(self.checker_initiator_tag)
285
342
self.checker_initiator_tag = None
286
343
self.stop_checker()
287
if self.stop_hook:
288
self.stop_hook(self)
344
if self.disable_hook:
345
self.disable_hook(self)
346
self.enabled = False
289
347
# Do not run this again if called by a gobject.timeout_add
290
348
return False
349
291
350
def __del__(self):
292
self.stop_hook = None
293
self.stop()
294
def checker_callback(self, pid, condition):
351
self.disable_hook = None
352
self.disable()
353
354
def checker_callback(self, pid, condition, command):
295
355
"""The checker has completed, so take appropriate actions."""
296
now = datetime.datetime.now()
297
356
self.checker_callback_tag = None
298
357
self.checker = None
299
if os.WIFEXITED(condition) \
300
and (os.WEXITSTATUS(condition) == 0):
301
logger.info(u"Checker for %(name)s succeeded",
302
vars(self))
303
self.last_checked_ok = now
304
gobject.source_remove(self.stop_initiator_tag)
305
self.stop_initiator_tag = gobject.timeout_add\
306
(self._timeout_milliseconds,
307
self.stop)
308
elif not os.WIFEXITED(condition):
358
if os.WIFEXITED(condition):
359
exitstatus = os.WEXITSTATUS(condition)
360
if exitstatus == 0:
361
logger.info(u"Checker for %(name)s succeeded",
362
vars(self))
363
self.checked_ok()
364
else:
365
logger.info(u"Checker for %(name)s failed",
366
vars(self))
367
else:
309
368
logger.warning(u"Checker for %(name)s crashed?",
310
369
vars(self))
311
else:
312
logger.info(u"Checker for %(name)s failed",
313
vars(self))
370
371
def checked_ok(self):
372
"""Bump up the timeout for this client.
373
374
This should only be called when the client has been seen,
375
alive and well.
376
"""
377
self.last_checked_ok = datetime.datetime.utcnow()
378
gobject.source_remove(self.disable_initiator_tag)
379
self.disable_initiator_tag = (gobject.timeout_add
380
(self.timeout_milliseconds(),
381
self.disable))
382
314
383
def start_checker(self):
315
384
"""Start a new checker subprocess if one is not running.
385
316
386
If a checker already exists, leave it running and do
317
387
nothing."""
318
388
# The reason for not killing a running checker is that if we
323
393
# checkers alone, the checker would have to take more time
324
394
# than 'timeout' for the client to be declared invalid, which
325
395
# is as it should be.
396
397
# If a checker exists, make sure it is not a zombie
398
if self.checker is not None:
399
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
400
if pid:
401
logger.warning(u"Checker was a zombie")
402
gobject.source_remove(self.checker_callback_tag)
403
self.checker_callback(pid, status,
404
self.current_checker_command)
405
# Start a new checker if needed
326
406
if self.checker is None:
327
407
try:
328
# In case check_command has exactly one % operator
329
command = self.check_command % self.host
408
# In case checker_command has exactly one % operator
409
command = self.checker_command % self.host
330
410
except TypeError:
331
411
# Escape attributes for the shell
332
escaped_attrs = dict((key, re.escape(str(val)))
412
escaped_attrs = dict((key,
413
re.escape(unicode(str(val),
414
errors=
415
u'replace')))
333
416
for key, val in
334
417
vars(self).iteritems())
335
418
try:
336
command = self.check_command % escaped_attrs
419
command = self.checker_command % escaped_attrs
337
420
except TypeError, error:
338
421
logger.error(u'Could not format string "%s":'
339
u' %s', self.check_command, error)
422
u' %s', self.checker_command, error)
340
423
return True # Try again later
424
self.current_checker_command = command
341
425
try:
342
426
logger.info(u"Starting checker %r for %s",
343
427
command, self.name)
347
431
# always replaced by /dev/null.)
348
432
self.checker = subprocess.Popen(command,
349
433
close_fds=True,
350
shell=True, cwd="/")
351
self.checker_callback_tag = gobject.child_watch_add\
352
(self.checker.pid,
353
self.checker_callback)
434
shell=True, cwd=u"/")
435
self.checker_callback_tag = (gobject.child_watch_add
436
(self.checker.pid,
437
self.checker_callback,
438
data=command))
439
# The checker may have completed before the gobject
440
# watch was added. Check for this.
441
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
442
if pid:
443
gobject.source_remove(self.checker_callback_tag)
444
self.checker_callback(pid, status, command)
354
445
except OSError, error:
355
446
logger.error(u"Failed to start subprocess: %s",
356
447
error)
357
448
# Re-run this periodically if run by gobject.timeout_add
358
449
return True
450
359
451
def stop_checker(self):
360
452
"""Force the checker process, if any, to stop."""
361
453
if self.checker_callback_tag:
362
454
gobject.source_remove(self.checker_callback_tag)
363
455
self.checker_callback_tag = None
364
if getattr(self, "checker", None) is None:
456
if getattr(self, u"checker", None) is None:
365
457
return
366
458
logger.debug(u"Stopping checker for %(name)s", vars(self))
367
459
try:
373
465
if error.errno != errno.ESRCH: # No such process
374
466
raise
375
467
self.checker = None
468
376
469
def still_valid(self):
377
470
"""Has the timeout not yet passed for this client?"""
378
now = datetime.datetime.now()
471
if not getattr(self, u"enabled", False):
472
return False
473
now = datetime.datetime.utcnow()
379
474
if self.last_checked_ok is None:
380
475
return now < (self.created + self.timeout)
381
476
else:
382
477
return now < (self.last_checked_ok + self.timeout)
383
478
384
479
385
def peer_certificate(session):
386
"Return the peer's OpenPGP certificate as a bytestring"
387
# If not an OpenPGP certificate...
388
if gnutls.library.functions.gnutls_certificate_type_get\
389
(session._c_object) \
390
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
391
# ...do the normal thing
392
return session.peer_certificate
393
list_size = ctypes.c_uint()
394
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
395
(session._c_object, ctypes.byref(list_size))
396
if list_size.value == 0:
397
return None
398
cert = cert_list[0]
399
return ctypes.string_at(cert.data, cert.size)
400
401
402
def fingerprint(openpgp):
403
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
404
# New GnuTLS "datum" with the OpenPGP public key
405
datum = gnutls.library.types.gnutls_datum_t\
406
(ctypes.cast(ctypes.c_char_p(openpgp),
407
ctypes.POINTER(ctypes.c_ubyte)),
408
ctypes.c_uint(len(openpgp)))
409
# New empty GnuTLS certificate
410
crt = gnutls.library.types.gnutls_openpgp_crt_t()
411
gnutls.library.functions.gnutls_openpgp_crt_init\
412
(ctypes.byref(crt))
413
# Import the OpenPGP public key into the certificate
414
gnutls.library.functions.gnutls_openpgp_crt_import\
415
(crt, ctypes.byref(datum),
416
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
417
# Verify the self signature in the key
418
crtverify = ctypes.c_uint();
419
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
420
(crt, 0, ctypes.byref(crtverify))
421
if crtverify.value != 0:
422
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
423
raise gnutls.errors.CertificateSecurityError("Verify failed")
424
# New buffer for the fingerprint
425
buffer = ctypes.create_string_buffer(20)
426
buffer_length = ctypes.c_size_t()
427
# Get the fingerprint from the certificate into the buffer
428
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
429
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
430
# Deinit the certificate
431
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
432
# Convert the buffer to a Python bytestring
433
fpr = ctypes.string_at(buffer, buffer_length.value)
434
# Convert the bytestring to hexadecimal notation
435
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
436
return hex_fpr
437
438
439
class tcp_handler(SocketServer.BaseRequestHandler, object):
440
"""A TCP request handler class.
441
Instantiated by IPv6_TCPServer for each request to handle it.
480
class ClientDBus(Client, dbus.service.Object):
481
"""A Client class using D-Bus
482
483
Attributes:
484
dbus_object_path: dbus.ObjectPath
485
bus: dbus.SystemBus()
486
"""
487
# dbus.service.Object doesn't use super(), so we can't either.
488
489
def __init__(self, bus = None, *args, **kwargs):
490
self.bus = bus
491
Client.__init__(self, *args, **kwargs)
492
# Only now, when this client is initialized, can it show up on
493
# the D-Bus
494
self.dbus_object_path = (dbus.ObjectPath
495
(u"/clients/"
496
+ self.name.replace(u".", u"_")))
497
dbus.service.Object.__init__(self, self.bus,
498
self.dbus_object_path)
499
500
@staticmethod
501
def _datetime_to_dbus(dt, variant_level=0):
502
"""Convert a UTC datetime.datetime() to a D-Bus type."""
503
return dbus.String(dt.isoformat(),
504
variant_level=variant_level)
505
506
def enable(self):
507
oldstate = getattr(self, u"enabled", False)
508
r = Client.enable(self)
509
if oldstate != self.enabled:
510
# Emit D-Bus signals
511
self.PropertyChanged(dbus.String(u"enabled"),
512
dbus.Boolean(True, variant_level=1))
513
self.PropertyChanged(
514
dbus.String(u"last_enabled"),
515
self._datetime_to_dbus(self.last_enabled,
516
variant_level=1))
517
return r
518
519
def disable(self, signal = True):
520
oldstate = getattr(self, u"enabled", False)
521
r = Client.disable(self)
522
if signal and oldstate != self.enabled:
523
# Emit D-Bus signal
524
self.PropertyChanged(dbus.String(u"enabled"),
525
dbus.Boolean(False, variant_level=1))
526
return r
527
528
def __del__(self, *args, **kwargs):
529
try:
530
self.remove_from_connection()
531
except LookupError:
532
pass
533
if hasattr(dbus.service.Object, u"__del__"):
534
dbus.service.Object.__del__(self, *args, **kwargs)
535
Client.__del__(self, *args, **kwargs)
536
537
def checker_callback(self, pid, condition, command,
538
*args, **kwargs):
539
self.checker_callback_tag = None
540
self.checker = None
541
# Emit D-Bus signal
542
self.PropertyChanged(dbus.String(u"checker_running"),
543
dbus.Boolean(False, variant_level=1))
544
if os.WIFEXITED(condition):
545
exitstatus = os.WEXITSTATUS(condition)
546
# Emit D-Bus signal
547
self.CheckerCompleted(dbus.Int16(exitstatus),
548
dbus.Int64(condition),
549
dbus.String(command))
550
else:
551
# Emit D-Bus signal
552
self.CheckerCompleted(dbus.Int16(-1),
553
dbus.Int64(condition),
554
dbus.String(command))
555
556
return Client.checker_callback(self, pid, condition, command,
557
*args, **kwargs)
558
559
def checked_ok(self, *args, **kwargs):
560
r = Client.checked_ok(self, *args, **kwargs)
561
# Emit D-Bus signal
562
self.PropertyChanged(
563
dbus.String(u"last_checked_ok"),
564
(self._datetime_to_dbus(self.last_checked_ok,
565
variant_level=1)))
566
return r
567
568
def start_checker(self, *args, **kwargs):
569
old_checker = self.checker
570
if self.checker is not None:
571
old_checker_pid = self.checker.pid
572
else:
573
old_checker_pid = None
574
r = Client.start_checker(self, *args, **kwargs)
575
# Only if new checker process was started
576
if (self.checker is not None
577
and old_checker_pid != self.checker.pid):
578
# Emit D-Bus signal
579
self.CheckerStarted(self.current_checker_command)
580
self.PropertyChanged(
581
dbus.String(u"checker_running"),
582
dbus.Boolean(True, variant_level=1))
583
return r
584
585
def stop_checker(self, *args, **kwargs):
586
old_checker = getattr(self, u"checker", None)
587
r = Client.stop_checker(self, *args, **kwargs)
588
if (old_checker is not None
589
and getattr(self, u"checker", None) is None):
590
self.PropertyChanged(dbus.String(u"checker_running"),
591
dbus.Boolean(False, variant_level=1))
592
return r
593
594
## D-Bus methods & signals
595
_interface = u"se.bsnet.fukt.Mandos.Client"
596
597
# CheckedOK - method
598
@dbus.service.method(_interface)
599
def CheckedOK(self):
600
return self.checked_ok()
601
602
# CheckerCompleted - signal
603
@dbus.service.signal(_interface, signature=u"nxs")
604
def CheckerCompleted(self, exitcode, waitstatus, command):
605
"D-Bus signal"
606
pass
607
608
# CheckerStarted - signal
609
@dbus.service.signal(_interface, signature=u"s")
610
def CheckerStarted(self, command):
611
"D-Bus signal"
612
pass
613
614
# GetAllProperties - method
615
@dbus.service.method(_interface, out_signature=u"a{sv}")
616
def GetAllProperties(self):
617
"D-Bus method"
618
return dbus.Dictionary({
619
dbus.String(u"name"):
620
dbus.String(self.name, variant_level=1),
621
dbus.String(u"fingerprint"):
622
dbus.String(self.fingerprint, variant_level=1),
623
dbus.String(u"host"):
624
dbus.String(self.host, variant_level=1),
625
dbus.String(u"created"):
626
self._datetime_to_dbus(self.created,
627
variant_level=1),
628
dbus.String(u"last_enabled"):
629
(self._datetime_to_dbus(self.last_enabled,
630
variant_level=1)
631
if self.last_enabled is not None
632
else dbus.Boolean(False, variant_level=1)),
633
dbus.String(u"enabled"):
634
dbus.Boolean(self.enabled, variant_level=1),
635
dbus.String(u"last_checked_ok"):
636
(self._datetime_to_dbus(self.last_checked_ok,
637
variant_level=1)
638
if self.last_checked_ok is not None
639
else dbus.Boolean (False, variant_level=1)),
640
dbus.String(u"timeout"):
641
dbus.UInt64(self.timeout_milliseconds(),
642
variant_level=1),
643
dbus.String(u"interval"):
644
dbus.UInt64(self.interval_milliseconds(),
645
variant_level=1),
646
dbus.String(u"checker"):
647
dbus.String(self.checker_command,
648
variant_level=1),
649
dbus.String(u"checker_running"):
650
dbus.Boolean(self.checker is not None,
651
variant_level=1),
652
dbus.String(u"object_path"):
653
dbus.ObjectPath(self.dbus_object_path,
654
variant_level=1)
655
}, signature=u"sv")
656
657
# IsStillValid - method
658
@dbus.service.method(_interface, out_signature=u"b")
659
def IsStillValid(self):
660
return self.still_valid()
661
662
# PropertyChanged - signal
663
@dbus.service.signal(_interface, signature=u"sv")
664
def PropertyChanged(self, property, value):
665
"D-Bus signal"
666
pass
667
668
# ReceivedSecret - signal
669
@dbus.service.signal(_interface)
670
def ReceivedSecret(self):
671
"D-Bus signal"
672
pass
673
674
# Rejected - signal
675
@dbus.service.signal(_interface)
676
def Rejected(self):
677
"D-Bus signal"
678
pass
679
680
# SetChecker - method
681
@dbus.service.method(_interface, in_signature=u"s")
682
def SetChecker(self, checker):
683
"D-Bus setter method"
684
self.checker_command = checker
685
# Emit D-Bus signal
686
self.PropertyChanged(dbus.String(u"checker"),
687
dbus.String(self.checker_command,
688
variant_level=1))
689
690
# SetHost - method
691
@dbus.service.method(_interface, in_signature=u"s")
692
def SetHost(self, host):
693
"D-Bus setter method"
694
self.host = host
695
# Emit D-Bus signal
696
self.PropertyChanged(dbus.String(u"host"),
697
dbus.String(self.host, variant_level=1))
698
699
# SetInterval - method
700
@dbus.service.method(_interface, in_signature=u"t")
701
def SetInterval(self, milliseconds):
702
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
703
# Emit D-Bus signal
704
self.PropertyChanged(dbus.String(u"interval"),
705
(dbus.UInt64(self.interval_milliseconds(),
706
variant_level=1)))
707
708
# SetSecret - method
709
@dbus.service.method(_interface, in_signature=u"ay",
710
byte_arrays=True)
711
def SetSecret(self, secret):
712
"D-Bus setter method"
713
self.secret = str(secret)
714
715
# SetTimeout - method
716
@dbus.service.method(_interface, in_signature=u"t")
717
def SetTimeout(self, milliseconds):
718
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
719
# Emit D-Bus signal
720
self.PropertyChanged(dbus.String(u"timeout"),
721
(dbus.UInt64(self.timeout_milliseconds(),
722
variant_level=1)))
723
724
# Enable - method
725
@dbus.service.method(_interface)
726
def Enable(self):
727
"D-Bus method"
728
self.enable()
729
730
# StartChecker - method
731
@dbus.service.method(_interface)
732
def StartChecker(self):
733
"D-Bus method"
734
self.start_checker()
735
736
# Disable - method
737
@dbus.service.method(_interface)
738
def Disable(self):
739
"D-Bus method"
740
self.disable()
741
742
# StopChecker - method
743
@dbus.service.method(_interface)
744
def StopChecker(self):
745
self.stop_checker()
746
747
del _interface
748
749
750
class ClientHandler(socketserver.BaseRequestHandler, object):
751
"""A class to handle client connections.
752
753
Instantiated once for each connection to handle it.
442
754
Note: This will run in its own forked process."""
443
755
444
756
def handle(self):
445
757
logger.info(u"TCP connection from: %s",
446
unicode(self.client_address))
447
session = gnutls.connection.ClientSession\
448
(self.request, gnutls.connection.X509Credentials())
449
450
line = self.request.makefile().readline()
451
logger.debug(u"Protocol version: %r", line)
452
try:
453
if int(line.strip().split()[0]) > 1:
454
raise RuntimeError
455
except (ValueError, IndexError, RuntimeError), error:
456
logger.error(u"Unknown protocol version: %s", error)
457
return
458
459
# Note: gnutls.connection.X509Credentials is really a generic
460
# GnuTLS certificate credentials object so long as no X.509
461
# keys are added to it. Therefore, we can use it here despite
462
# using OpenPGP certificates.
463
464
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
465
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
466
# "+DHE-DSS"))
467
priority = "NORMAL" # Fallback default, since this
468
# MUST be set.
469
if self.server.settings["priority"]:
470
priority = self.server.settings["priority"]
471
gnutls.library.functions.gnutls_priority_set_direct\
472
(session._c_object, priority, None);
473
474
try:
475
session.handshake()
476
except gnutls.errors.GNUTLSError, error:
477
logger.warning(u"Handshake failed: %s", error)
478
# Do not run session.bye() here: the session is not
479
# established. Just abandon the request.
480
return
481
try:
482
fpr = fingerprint(peer_certificate(session))
483
except (TypeError, gnutls.errors.GNUTLSError), error:
484
logger.warning(u"Bad certificate: %s", error)
485
session.bye()
486
return
487
logger.debug(u"Fingerprint: %s", fpr)
488
client = None
489
for c in self.server.clients:
490
if c.fingerprint == fpr:
491
client = c
492
break
493
if not client:
494
logger.warning(u"Client not found for fingerprint: %s",
495
fpr)
496
session.bye()
497
return
498
# Have to check if client.still_valid(), since it is possible
499
# that the client timed out while establishing the GnuTLS
500
# session.
501
if not client.still_valid():
502
logger.warning(u"Client %(name)s is invalid",
503
vars(client))
504
session.bye()
505
return
506
sent_size = 0
507
while sent_size < len(client.secret):
508
sent = session.send(client.secret[sent_size:])
509
logger.debug(u"Sent: %d, remaining: %d",
510
sent, len(client.secret)
511
- (sent_size + sent))
512
sent_size += sent
513
session.bye()
514
515
516
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
517
"""IPv6 TCP server. Accepts 'None' as address and/or port.
758
unicode(self.client_address))
759
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
760
# Open IPC pipe to parent process
761
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
762
session = (gnutls.connection
763
.ClientSession(self.request,
764
gnutls.connection
765
.X509Credentials()))
766
767
line = self.request.makefile().readline()
768
logger.debug(u"Protocol version: %r", line)
769
try:
770
if int(line.strip().split()[0]) > 1:
771
raise RuntimeError
772
except (ValueError, IndexError, RuntimeError), error:
773
logger.error(u"Unknown protocol version: %s", error)
774
return
775
776
# Note: gnutls.connection.X509Credentials is really a
777
# generic GnuTLS certificate credentials object so long as
778
# no X.509 keys are added to it. Therefore, we can use it
779
# here despite using OpenPGP certificates.
780
781
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
782
# u"+AES-256-CBC", u"+SHA1",
783
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
784
# u"+DHE-DSS"))
785
# Use a fallback default, since this MUST be set.
786
priority = self.server.gnutls_priority
787
if priority is None:
788
priority = u"NORMAL"
789
(gnutls.library.functions
790
.gnutls_priority_set_direct(session._c_object,
791
priority, None))
792
793
try:
794
session.handshake()
795
except gnutls.errors.GNUTLSError, error:
796
logger.warning(u"Handshake failed: %s", error)
797
# Do not run session.bye() here: the session is not
798
# established. Just abandon the request.
799
return
800
logger.debug(u"Handshake succeeded")
801
try:
802
fpr = self.fingerprint(self.peer_certificate(session))
803
except (TypeError, gnutls.errors.GNUTLSError), error:
804
logger.warning(u"Bad certificate: %s", error)
805
session.bye()
806
return
807
logger.debug(u"Fingerprint: %s", fpr)
808
809
for c in self.server.clients:
810
if c.fingerprint == fpr:
811
client = c
812
break
813
else:
814
ipc.write(u"NOTFOUND %s %s\n"
815
% (fpr, unicode(self.client_address)))
816
session.bye()
817
return
818
# Have to check if client.still_valid(), since it is
819
# possible that the client timed out while establishing
820
# the GnuTLS session.
821
if not client.still_valid():
822
ipc.write(u"INVALID %s\n" % client.name)
823
session.bye()
824
return
825
ipc.write(u"SENDING %s\n" % client.name)
826
sent_size = 0
827
while sent_size < len(client.secret):
828
sent = session.send(client.secret[sent_size:])
829
logger.debug(u"Sent: %d, remaining: %d",
830
sent, len(client.secret)
831
- (sent_size + sent))
832
sent_size += sent
833
session.bye()
834
835
@staticmethod
836
def peer_certificate(session):
837
"Return the peer's OpenPGP certificate as a bytestring"
838
# If not an OpenPGP certificate...
839
if (gnutls.library.functions
840
.gnutls_certificate_type_get(session._c_object)
841
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
842
# ...do the normal thing
843
return session.peer_certificate
844
list_size = ctypes.c_uint(1)
845
cert_list = (gnutls.library.functions
846
.gnutls_certificate_get_peers
847
(session._c_object, ctypes.byref(list_size)))
848
if not bool(cert_list) and list_size.value != 0:
849
raise gnutls.errors.GNUTLSError(u"error getting peer"
850
u" certificate")
851
if list_size.value == 0:
852
return None
853
cert = cert_list[0]
854
return ctypes.string_at(cert.data, cert.size)
855
856
@staticmethod
857
def fingerprint(openpgp):
858
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
859
# New GnuTLS "datum" with the OpenPGP public key
860
datum = (gnutls.library.types
861
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
862
ctypes.POINTER
863
(ctypes.c_ubyte)),
864
ctypes.c_uint(len(openpgp))))
865
# New empty GnuTLS certificate
866
crt = gnutls.library.types.gnutls_openpgp_crt_t()
867
(gnutls.library.functions
868
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
869
# Import the OpenPGP public key into the certificate
870
(gnutls.library.functions
871
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
872
gnutls.library.constants
873
.GNUTLS_OPENPGP_FMT_RAW))
874
# Verify the self signature in the key
875
crtverify = ctypes.c_uint()
876
(gnutls.library.functions
877
.gnutls_openpgp_crt_verify_self(crt, 0,
878
ctypes.byref(crtverify)))
879
if crtverify.value != 0:
880
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
881
raise (gnutls.errors.CertificateSecurityError
882
(u"Verify failed"))
883
# New buffer for the fingerprint
884
buf = ctypes.create_string_buffer(20)
885
buf_len = ctypes.c_size_t()
886
# Get the fingerprint from the certificate into the buffer
887
(gnutls.library.functions
888
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
889
ctypes.byref(buf_len)))
890
# Deinit the certificate
891
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
892
# Convert the buffer to a Python bytestring
893
fpr = ctypes.string_at(buf, buf_len.value)
894
# Convert the bytestring to hexadecimal notation
895
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
896
return hex_fpr
897
898
899
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
900
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
901
def process_request(self, request, client_address):
902
"""Overrides and wraps the original process_request().
903
904
This function creates a new pipe in self.pipe
905
"""
906
self.pipe = os.pipe()
907
super(ForkingMixInWithPipe,
908
self).process_request(request, client_address)
909
os.close(self.pipe[1]) # close write end
910
self.add_pipe(self.pipe[0])
911
def add_pipe(self, pipe):
912
"""Dummy function; override as necessary"""
913
os.close(pipe)
914
915
916
class IPv6_TCPServer(ForkingMixInWithPipe,
917
socketserver.TCPServer, object):
918
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
919
518
920
Attributes:
519
settings: Server settings
520
clients: Set() of Client objects
521
921
enabled: Boolean; whether this server is activated yet
922
interface: None or a network interface name (string)
923
use_ipv6: Boolean; to use IPv6 or not
522
924
"""
523
address_family = socket.AF_INET6
524
def __init__(self, *args, **kwargs):
525
if "settings" in kwargs:
526
self.settings = kwargs["settings"]
527
del kwargs["settings"]
528
if "clients" in kwargs:
529
self.clients = kwargs["clients"]
530
del kwargs["clients"]
531
self.enabled = False
532
return super(type(self), self).__init__(*args, **kwargs)
925
def __init__(self, server_address, RequestHandlerClass,
926
interface=None, use_ipv6=True):
927
self.interface = interface
928
if use_ipv6:
929
self.address_family = socket.AF_INET6
930
socketserver.TCPServer.__init__(self, server_address,
931
RequestHandlerClass)
533
932
def server_bind(self):
534
933
"""This overrides the normal server_bind() function
535
934
to bind to an interface if one was specified, and also NOT to
536
935
bind to an address or port if they were not specified."""
537
if self.settings["interface"]:
538
# 25 is from /usr/include/asm-i486/socket.h
539
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
540
try:
541
self.socket.setsockopt(socket.SOL_SOCKET,
542
SO_BINDTODEVICE,
543
self.settings["interface"])
544
except socket.error, error:
545
if error[0] == errno.EPERM:
546
logger.error(u"No permission to"
547
u" bind to interface %s",
548
self.settings["interface"])
549
else:
550
raise error
936
if self.interface is not None:
937
if SO_BINDTODEVICE is None:
938
logger.error(u"SO_BINDTODEVICE does not exist;"
939
u" cannot bind to interface %s",
940
self.interface)
941
else:
942
try:
943
self.socket.setsockopt(socket.SOL_SOCKET,
944
SO_BINDTODEVICE,
945
str(self.interface
946
+ u'\0'))
947
except socket.error, error:
948
if error[0] == errno.EPERM:
949
logger.error(u"No permission to"
950
u" bind to interface %s",
951
self.interface)
952
elif error[0] == errno.ENOPROTOOPT:
953
logger.error(u"SO_BINDTODEVICE not available;"
954
u" cannot bind to interface %s",
955
self.interface)
956
else:
957
raise
551
958
# Only bind(2) the socket if we really need to.
552
959
if self.server_address[0] or self.server_address[1]:
553
960
if not self.server_address[0]:
554
in6addr_any = "::"
555
self.server_address = (in6addr_any,
961
if self.address_family == socket.AF_INET6:
962
any_address = u"::" # in6addr_any
963
else:
964
any_address = socket.INADDR_ANY
965
self.server_address = (any_address,
556
966
self.server_address[1])
557
967
elif not self.server_address[1]:
558
968
self.server_address = (self.server_address[0],
559
969
0)
560
# if self.settings["interface"]:
970
# if self.interface:
561
971
# self.server_address = (self.server_address[0],
562
972
# 0, # port
563
973
# 0, # flowinfo
564
974
# if_nametoindex
565
# (self.settings
566
# ["interface"]))
567
return super(type(self), self).server_bind()
975
# (self.interface))
976
return socketserver.TCPServer.server_bind(self)
977
978
979
class MandosServer(IPv6_TCPServer):
980
"""Mandos server.
981
982
Attributes:
983
clients: set of Client objects
984
gnutls_priority GnuTLS priority string
985
use_dbus: Boolean; to emit D-Bus signals or not
986
clients: set of Client objects
987
gnutls_priority GnuTLS priority string
988
use_dbus: Boolean; to emit D-Bus signals or not
989
990
Assumes a gobject.MainLoop event loop.
991
"""
992
def __init__(self, server_address, RequestHandlerClass,
993
interface=None, use_ipv6=True, clients=None,
994
gnutls_priority=None, use_dbus=True):
995
self.enabled = False
996
self.clients = clients
997
if self.clients is None:
998
self.clients = set()
999
self.use_dbus = use_dbus
1000
self.gnutls_priority = gnutls_priority
1001
IPv6_TCPServer.__init__(self, server_address,
1002
RequestHandlerClass,
1003
interface = interface,
1004
use_ipv6 = use_ipv6)
568
1005
def server_activate(self):
569
1006
if self.enabled:
570
return super(type(self), self).server_activate()
1007
return socketserver.TCPServer.server_activate(self)
571
1008
def enable(self):
572
1009
self.enabled = True
1010
def add_pipe(self, pipe):
1011
# Call "handle_ipc" for both data and EOF events
1012
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1013
self.handle_ipc)
1014
def handle_ipc(self, source, condition, file_objects={}):
1015
condition_names = {
1016
gobject.IO_IN: u"IN", # There is data to read.
1017
gobject.IO_OUT: u"OUT", # Data can be written (without
1018
# blocking).
1019
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1020
gobject.IO_ERR: u"ERR", # Error condition.
1021
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1022
# broken, usually for pipes and
1023
# sockets).
1024
}
1025
conditions_string = ' | '.join(name
1026
for cond, name in
1027
condition_names.iteritems()
1028
if cond & condition)
1029
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1030
conditions_string)
1031
1032
# Turn the pipe file descriptor into a Python file object
1033
if source not in file_objects:
1034
file_objects[source] = os.fdopen(source, u"r", 1)
1035
1036
# Read a line from the file object
1037
cmdline = file_objects[source].readline()
1038
if not cmdline: # Empty line means end of file
1039
# close the IPC pipe
1040
file_objects[source].close()
1041
del file_objects[source]
1042
1043
# Stop calling this function
1044
return False
1045
1046
logger.debug(u"IPC command: %r", cmdline)
1047
1048
# Parse and act on command
1049
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1050
1051
if cmd == u"NOTFOUND":
1052
logger.warning(u"Client not found for fingerprint: %s",
1053
args)
1054
if self.use_dbus:
1055
# Emit D-Bus signal
1056
mandos_dbus_service.ClientNotFound(args)
1057
elif cmd == u"INVALID":
1058
for client in self.clients:
1059
if client.name == args:
1060
logger.warning(u"Client %s is invalid", args)
1061
if self.use_dbus:
1062
# Emit D-Bus signal
1063
client.Rejected()
1064
break
1065
else:
1066
logger.error(u"Unknown client %s is invalid", args)
1067
elif cmd == u"SENDING":
1068
for client in self.clients:
1069
if client.name == args:
1070
logger.info(u"Sending secret to %s", client.name)
1071
client.checked_ok()
1072
if self.use_dbus:
1073
# Emit D-Bus signal
1074
client.ReceivedSecret()
1075
break
1076
else:
1077
logger.error(u"Sending secret to unknown client %s",
1078
args)
1079
else:
1080
logger.error(u"Unknown IPC command: %r", cmdline)
1081
1082
# Keep calling this function
1083
return True
573
1084
574
1085
575
1086
def string_to_delta(interval):
576
1087
"""Parse a string and return a datetime.timedelta
577
578
>>> string_to_delta('7d')
1088
1089
>>> string_to_delta(u'7d')
579
1090
datetime.timedelta(7)
580
>>> string_to_delta('60s')
1091
>>> string_to_delta(u'60s')
581
1092
datetime.timedelta(0, 60)
582
>>> string_to_delta('60m')
1093
>>> string_to_delta(u'60m')
583
1094
datetime.timedelta(0, 3600)
584
>>> string_to_delta('24h')
1095
>>> string_to_delta(u'24h')
585
1096
datetime.timedelta(1)
586
1097
>>> string_to_delta(u'1w')
587
1098
datetime.timedelta(7)
588
>>> string_to_delta('5m 30s')
1099
>>> string_to_delta(u'5m 30s')
589
1100
datetime.timedelta(0, 330)
590
1101
"""
591
1102
timevalue = datetime.timedelta(0)
592
1103
for s in interval.split():
593
1104
try:
594
suffix=unicode(s[-1])
595
value=int(s[:-1])
1105
suffix = unicode(s[-1])
1106
value = int(s[:-1])
596
1107
if suffix == u"d":
597
1108
delta = datetime.timedelta(value)
598
1109
elif suffix == u"s":
611
1122
return timevalue
612
1123
613
1124
614
def server_state_changed(state):
615
"""Derived from the Avahi example code"""
616
if state == avahi.SERVER_COLLISION:
617
logger.error(u"Zeroconf server name collision")
618
service.remove()
619
elif state == avahi.SERVER_RUNNING:
620
service.add()
621
622
623
def entry_group_state_changed(state, error):
624
"""Derived from the Avahi example code"""
625
logger.debug(u"Avahi state change: %i", state)
626
627
if state == avahi.ENTRY_GROUP_ESTABLISHED:
628
logger.debug(u"Zeroconf service established.")
629
elif state == avahi.ENTRY_GROUP_COLLISION:
630
logger.warning(u"Zeroconf service name collision.")
631
service.rename()
632
elif state == avahi.ENTRY_GROUP_FAILURE:
633
logger.critical(u"Avahi: Error in group state changed %s",
634
unicode(error))
635
raise AvahiGroupError("State changed: %s", str(error))
636
637
1125
def if_nametoindex(interface):
638
"""Call the C function if_nametoindex(), or equivalent"""
1126
"""Call the C function if_nametoindex(), or equivalent
1127
1128
Note: This function cannot accept a unicode string."""
639
1129
global if_nametoindex
640
1130
try:
641
if "ctypes.util" not in sys.modules:
642
import ctypes.util
643
if_nametoindex = ctypes.cdll.LoadLibrary\
644
(ctypes.util.find_library("c")).if_nametoindex
1131
if_nametoindex = (ctypes.cdll.LoadLibrary
1132
(ctypes.util.find_library(u"c"))
1133
.if_nametoindex)
645
1134
except (OSError, AttributeError):
646
if "struct" not in sys.modules:
647
import struct
648
if "fcntl" not in sys.modules:
649
import fcntl
1135
logger.warning(u"Doing if_nametoindex the hard way")
650
1136
def if_nametoindex(interface):
651
1137
"Get an interface index the hard way, i.e. using fcntl()"
652
1138
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
653
s = socket.socket()
654
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
655
struct.pack("16s16x", interface))
656
s.close()
657
interface_index = struct.unpack("I", ifreq[16:20])[0]
1139
with closing(socket.socket()) as s:
1140
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1141
struct.pack(str(u"16s16x"),
1142
interface))
1143
interface_index = struct.unpack(str(u"I"),
1144
ifreq[16:20])[0]
658
1145
return interface_index
659
1146
return if_nametoindex(interface)
660
1147
661
1148
662
1149
def daemon(nochdir = False, noclose = False):
663
1150
"""See daemon(3). Standard BSD Unix function.
1151
664
1152
This should really exist as os.daemon, but it doesn't (yet)."""
665
1153
if os.fork():
666
1154
sys.exit()
667
1155
os.setsid()
668
1156
if not nochdir:
669
os.chdir("/")
1157
os.chdir(u"/")
670
1158
if os.fork():
671
1159
sys.exit()
672
1160
if not noclose:
674
1162
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
675
1163
if not stat.S_ISCHR(os.fstat(null).st_mode):
676
1164
raise OSError(errno.ENODEV,
677
"/dev/null not a character device")
1165
u"/dev/null not a character device")
678
1166
os.dup2(null, sys.stdin.fileno())
679
1167
os.dup2(null, sys.stdout.fileno())
680
1168
os.dup2(null, sys.stderr.fileno())
683
1171
684
1172
685
1173
def main():
686
global main_loop_started
687
main_loop_started = False
688
689
parser = OptionParser(version = "%%prog %s" % version)
690
parser.add_option("-i", "--interface", type="string",
691
metavar="IF", help="Bind to interface IF")
692
parser.add_option("-a", "--address", type="string",
693
help="Address to listen for requests on")
694
parser.add_option("-p", "--port", type="int",
695
help="Port number to receive requests on")
696
parser.add_option("--check", action="store_true", default=False,
697
help="Run self-test")
698
parser.add_option("--debug", action="store_true",
699
help="Debug mode; run in foreground and log to"
700
" terminal")
701
parser.add_option("--priority", type="string", help="GnuTLS"
702
" priority string (see GnuTLS documentation)")
703
parser.add_option("--servicename", type="string", metavar="NAME",
704
help="Zeroconf service name")
705
parser.add_option("--configdir", type="string",
706
default="/etc/mandos", metavar="DIR",
707
help="Directory to search for configuration"
708
" files")
709
(options, args) = parser.parse_args()
1174
1175
######################################################################
1176
# Parsing of options, both command line and config file
1177
1178
parser = optparse.OptionParser(version = "%%prog %s" % version)
1179
parser.add_option("-i", u"--interface", type=u"string",
1180
metavar="IF", help=u"Bind to interface IF")
1181
parser.add_option("-a", u"--address", type=u"string",
1182
help=u"Address to listen for requests on")
1183
parser.add_option("-p", u"--port", type=u"int",
1184
help=u"Port number to receive requests on")
1185
parser.add_option("--check", action=u"store_true",
1186
help=u"Run self-test")
1187
parser.add_option("--debug", action=u"store_true",
1188
help=u"Debug mode; run in foreground and log to"
1189
u" terminal")
1190
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1191
u" priority string (see GnuTLS documentation)")
1192
parser.add_option("--servicename", type=u"string",
1193
metavar=u"NAME", help=u"Zeroconf service name")
1194
parser.add_option("--configdir", type=u"string",
1195
default=u"/etc/mandos", metavar=u"DIR",
1196
help=u"Directory to search for configuration"
1197
u" files")
1198
parser.add_option("--no-dbus", action=u"store_false",
1199
dest=u"use_dbus",
1200
help=optparse.SUPPRESS_HELP) # XXX: Not done yet
1201
parser.add_option("--no-ipv6", action=u"store_false",
1202
dest=u"use_ipv6", help=u"Do not use IPv6")
1203
options = parser.parse_args()[0]
710
1204
711
1205
if options.check:
712
1206
import doctest
714
1208
sys.exit()
715
1209
716
1210
# Default values for config file for server-global settings
717
server_defaults = { "interface": "",
718
"address": "",
719
"port": "",
720
"debug": "False",
721
"priority":
722
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
723
"servicename": "Mandos",
1211
server_defaults = { u"interface": u"",
1212
u"address": u"",
1213
u"port": u"",
1214
u"debug": u"False",
1215
u"priority":
1216
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1217
u"servicename": u"Mandos",
1218
u"use_dbus": u"True",
1219
u"use_ipv6": u"True",
724
1220
}
725
1221
726
1222
# Parse config file for server-global settings
727
server_config = ConfigParser.SafeConfigParser(server_defaults)
1223
server_config = configparser.SafeConfigParser(server_defaults)
728
1224
del server_defaults
729
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1225
server_config.read(os.path.join(options.configdir,
1226
u"mandos.conf"))
730
1227
# Convert the SafeConfigParser object to a dict
731
1228
server_settings = server_config.defaults()
732
# Use getboolean on the boolean config option
733
server_settings["debug"] = server_config.getboolean\
734
("DEFAULT", "debug")
1229
# Use the appropriate methods on the non-string config options
1230
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1231
server_settings[option] = server_config.getboolean(u"DEFAULT",
1232
option)
1233
if server_settings["port"]:
1234
server_settings["port"] = server_config.getint(u"DEFAULT",
1235
u"port")
735
1236
del server_config
736
1237
737
1238
# Override the settings from the config file with command line
738
1239
# options, if set.
739
for option in ("interface", "address", "port", "debug",
740
"priority", "servicename", "configdir"):
1240
for option in (u"interface", u"address", u"port", u"debug",
1241
u"priority", u"servicename", u"configdir",
1242
u"use_dbus", u"use_ipv6"):
741
1243
value = getattr(options, option)
742
1244
if value is not None:
743
1245
server_settings[option] = value
744
1246
del options
1247
# Force all strings to be unicode
1248
for option in server_settings.keys():
1249
if type(server_settings[option]) is str:
1250
server_settings[option] = unicode(server_settings[option])
745
1251
# Now we have our good server settings in "server_settings"
746
1252
747
debug = server_settings["debug"]
1253
##################################################################
1254
1255
# For convenience
1256
debug = server_settings[u"debug"]
1257
use_dbus = server_settings[u"use_dbus"]
1258
use_dbus = False # XXX: Not done yet
1259
use_ipv6 = server_settings[u"use_ipv6"]
748
1260
749
1261
if not debug:
750
1262
syslogger.setLevel(logging.WARNING)
751
1263
console.setLevel(logging.WARNING)
752
1264
753
if server_settings["servicename"] != "Mandos":
754
syslogger.setFormatter(logging.Formatter\
755
('Mandos (%s): %%(levelname)s:'
756
' %%(message)s'
757
% server_settings["servicename"]))
1265
if server_settings[u"servicename"] != u"Mandos":
1266
syslogger.setFormatter(logging.Formatter
1267
(u'Mandos (%s) [%%(process)d]:'
1268
u' %%(levelname)s: %%(message)s'
1269
% server_settings[u"servicename"]))
758
1270
759
1271
# Parse config file with clients
760
client_defaults = { "timeout": "1h",
761
"interval": "5m",
762
"checker": "fping -q -- %(host)s",
763
"host": "",
1272
client_defaults = { u"timeout": u"1h",
1273
u"interval": u"5m",
1274
u"checker": u"fping -q -- %%(host)s",
1275
u"host": u"",
764
1276
}
765
client_config = ConfigParser.SafeConfigParser(client_defaults)
766
client_config.read(os.path.join(server_settings["configdir"],
767
"clients.conf"))
768
769
clients = Set()
770
tcp_server = IPv6_TCPServer((server_settings["address"],
771
server_settings["port"]),
772
tcp_handler,
773
settings=server_settings,
774
clients=clients)
775
pidfilename = "/var/run/mandos.pid"
776
try:
777
pidfile = open(pidfilename, "w")
778
except IOError, error:
779
logger.error("Could not open file %r", pidfilename)
780
781
uid = 65534
782
gid = 65534
783
try:
784
uid = pwd.getpwnam("mandos").pw_uid
785
except KeyError:
786
try:
787
uid = pwd.getpwnam("nobody").pw_uid
788
except KeyError:
789
pass
790
try:
791
gid = pwd.getpwnam("mandos").pw_gid
792
except KeyError:
793
try:
794
gid = pwd.getpwnam("nogroup").pw_gid
795
except KeyError:
796
pass
797
try:
1277
client_config = configparser.SafeConfigParser(client_defaults)
1278
client_config.read(os.path.join(server_settings[u"configdir"],
1279
u"clients.conf"))
1280
1281
global mandos_dbus_service
1282
mandos_dbus_service = None
1283
1284
tcp_server = MandosServer((server_settings[u"address"],
1285
server_settings[u"port"]),
1286
ClientHandler,
1287
interface=server_settings[u"interface"],
1288
use_ipv6=use_ipv6,
1289
gnutls_priority=
1290
server_settings[u"priority"],
1291
use_dbus=use_dbus)
1292
pidfilename = u"/var/run/mandos.pid"
1293
try:
1294
pidfile = open(pidfilename, u"w")
1295
except IOError:
1296
logger.error(u"Could not open file %r", pidfilename)
1297
1298
try:
1299
uid = pwd.getpwnam(u"_mandos").pw_uid
1300
gid = pwd.getpwnam(u"_mandos").pw_gid
1301
except KeyError:
1302
try:
1303
uid = pwd.getpwnam(u"mandos").pw_uid
1304
gid = pwd.getpwnam(u"mandos").pw_gid
1305
except KeyError:
1306
try:
1307
uid = pwd.getpwnam(u"nobody").pw_uid
1308
gid = pwd.getpwnam(u"nobody").pw_gid
1309
except KeyError:
1310
uid = 65534
1311
gid = 65534
1312
try:
1313
os.setgid(gid)
798
1314
os.setuid(uid)
799
os.setgid(gid)
800
1315
except OSError, error:
801
1316
if error[0] != errno.EPERM:
802
1317
raise error
803
1318
804
global service
805
service = AvahiService(name = server_settings["servicename"],
806
type = "_mandos._tcp", );
807
if server_settings["interface"]:
808
service.interface = if_nametoindex\
809
(server_settings["interface"])
1319
# Enable all possible GnuTLS debugging
1320
if debug:
1321
# "Use a log level over 10 to enable all debugging options."
1322
# - GnuTLS manual
1323
gnutls.library.functions.gnutls_global_set_log_level(11)
1324
1325
@gnutls.library.types.gnutls_log_func
1326
def debug_gnutls(level, string):
1327
logger.debug(u"GnuTLS: %s", string[:-1])
1328
1329
(gnutls.library.functions
1330
.gnutls_global_set_log_function(debug_gnutls))
810
1331
811
1332
global main_loop
812
global bus
813
global server
814
1333
# From the Avahi example code
815
1334
DBusGMainLoop(set_as_default=True )
816
1335
main_loop = gobject.MainLoop()
817
1336
bus = dbus.SystemBus()
818
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
819
avahi.DBUS_PATH_SERVER),
820
avahi.DBUS_INTERFACE_SERVER)
821
1337
# End of Avahi example code
822
823
def remove_from_clients(client):
824
clients.remove(client)
825
if not clients:
826
logger.critical(u"No clients left, exiting")
827
sys.exit()
828
829
clients.update(Set(Client(name = section,
830
stop_hook = remove_from_clients,
831
config
832
= dict(client_config.items(section)))
833
for section in client_config.sections()))
834
if not clients:
835
logger.critical(u"No clients defined")
836
sys.exit(1)
1338
if use_dbus:
1339
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1340
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1341
service = AvahiService(name = server_settings[u"servicename"],
1342
servicetype = u"_mandos._tcp",
1343
protocol = protocol, bus = bus)
1344
if server_settings["interface"]:
1345
service.interface = (if_nametoindex
1346
(str(server_settings[u"interface"])))
1347
1348
client_class = Client
1349
if use_dbus:
1350
client_class = functools.partial(ClientDBus, bus = bus)
1351
tcp_server.clients.update(set(
1352
client_class(name = section,
1353
config= dict(client_config.items(section)))
1354
for section in client_config.sections()))
1355
if not tcp_server.clients:
1356
logger.warning(u"No clients defined")
837
1357
838
1358
if debug:
839
1359
# Redirect stdin so all checkers get /dev/null
848
1368
daemon()
849
1369
850
1370
try:
851
pid = os.getpid()
852
pidfile.write(str(pid) + "\n")
853
pidfile.close()
1371
with closing(pidfile):
1372
pid = os.getpid()
1373
pidfile.write(str(pid) + "\n")
854
1374
del pidfile
855
except IOError, err:
1375
except IOError:
856
1376
logger.error(u"Could not write to file %r with PID %d",
857
1377
pidfilename, pid)
858
1378
except NameError:
862
1382
863
1383
def cleanup():
864
1384
"Cleanup function; run on exit"
865
global group
866
# From the Avahi example code
867
if not group is None:
868
group.Free()
869
group = None
870
# End of Avahi example code
1385
service.cleanup()
871
1386
872
while clients:
873
client = clients.pop()
874
client.stop_hook = None
875
client.stop()
1387
while tcp_server.clients:
1388
client = tcp_server.clients.pop()
1389
client.disable_hook = None
1390
client.disable()
876
1391
877
1392
atexit.register(cleanup)
878
1393
881
1396
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
882
1397
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
883
1398
884
for client in clients:
885
client.start()
1399
if use_dbus:
1400
class MandosDBusService(dbus.service.Object):
1401
"""A D-Bus proxy object"""
1402
def __init__(self):
1403
dbus.service.Object.__init__(self, bus, u"/")
1404
_interface = u"se.bsnet.fukt.Mandos"
1405
1406
@dbus.service.signal(_interface, signature=u"oa{sv}")
1407
def ClientAdded(self, objpath, properties):
1408
"D-Bus signal"
1409
pass
1410
1411
@dbus.service.signal(_interface, signature=u"s")
1412
def ClientNotFound(self, fingerprint):
1413
"D-Bus signal"
1414
pass
1415
1416
@dbus.service.signal(_interface, signature=u"os")
1417
def ClientRemoved(self, objpath, name):
1418
"D-Bus signal"
1419
pass
1420
1421
@dbus.service.method(_interface, out_signature=u"ao")
1422
def GetAllClients(self):
1423
"D-Bus method"
1424
return dbus.Array(c.dbus_object_path
1425
for c in tcp_server.clients)
1426
1427
@dbus.service.method(_interface,
1428
out_signature=u"a{oa{sv}}")
1429
def GetAllClientsWithProperties(self):
1430
"D-Bus method"
1431
return dbus.Dictionary(
1432
((c.dbus_object_path, c.GetAllProperties())
1433
for c in tcp_server.clients),
1434
signature=u"oa{sv}")
1435
1436
@dbus.service.method(_interface, in_signature=u"o")
1437
def RemoveClient(self, object_path):
1438
"D-Bus method"
1439
for c in tcp_server.clients:
1440
if c.dbus_object_path == object_path:
1441
tcp_server.clients.remove(c)
1442
c.remove_from_connection()
1443
# Don't signal anything except ClientRemoved
1444
c.disable(signal=False)
1445
# Emit D-Bus signal
1446
self.ClientRemoved(object_path, c.name)
1447
return
1448
raise KeyError
1449
1450
del _interface
1451
1452
mandos_dbus_service = MandosDBusService()
1453
1454
for client in tcp_server.clients:
1455
if use_dbus:
1456
# Emit D-Bus signal
1457
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1458
client.GetAllProperties())
1459
client.enable()
886
1460
887
1461
tcp_server.enable()
888
1462
tcp_server.server_activate()
889
1463
890
1464
# Find out what port we got
891
1465
service.port = tcp_server.socket.getsockname()[1]
892
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
893
u" scope_id %d" % tcp_server.socket.getsockname())
1466
if use_ipv6:
1467
logger.info(u"Now listening on address %r, port %d,"
1468
" flowinfo %d, scope_id %d"
1469
% tcp_server.socket.getsockname())
1470
else: # IPv4
1471
logger.info(u"Now listening on address %r, port %d"
1472
% tcp_server.socket.getsockname())
894
1473
895
1474
#service.interface = tcp_server.socket.getsockname()[3]
896
1475
897
1476
try:
898
1477
# From the Avahi example code
899
server.connect_to_signal("StateChanged", server_state_changed)
900
1478
try:
901
server_state_changed(server.GetState())
1479
service.activate()
902
1480
except dbus.exceptions.DBusException, error:
903
1481
logger.critical(u"DBusException: %s", error)
904
1482
sys.exit(1)
906
1484
907
1485
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
908
1486
lambda *args, **kwargs:
909
tcp_server.handle_request\
910
(*args[2:], **kwargs) or True)
1487
(tcp_server.handle_request
1488
(*args[2:], **kwargs) or True))
911
1489
912
1490
logger.debug(u"Starting main loop")
913
main_loop_started = True
914
1491
main_loop.run()
915
1492
except AvahiError, error:
916
logger.critical(u"AvahiError: %s" + unicode(error))
1493
logger.critical(u"AvahiError: %s", error)
917
1494
sys.exit(1)
918
1495
except KeyboardInterrupt:
919
1496
if debug:
920
print
1497
print >> sys.stderr
1498
logger.debug(u"Server received KeyboardInterrupt")
1499
logger.debug(u"Server exiting")
921
1500
922
1501
if __name__ == '__main__':
923
1502
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0