/mandos/release : revision 27

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add" and "remove" in the "AvahiService" class, the

10

# "server_state_changed" and "entry_group_state_changed" functions,

11

# and some lines in "main".

9

# following functions: "add_service", "remove_service",

10

# "server_state_changed", "entry_group_state_changed", and some lines

11

# in "main".

12

#

13

# Everything else is

14

13

14

# Påhlsson.

15

#

16

# This program is free software: you can redistribute it and/or modify

17

# it under the terms of the GNU General Public License as published by

26

# You should have received a copy of the GNU General Public License

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

28

#

29

# Contact the authors at <mandos@fukt.bsnet.se>.

29

# Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and

30

# <https://www.fukt.bsnet.se/~teddy/>.

30

31

#

31

32

33

from __future__ import division

61

62

from dbus.mainloop.glib import DBusGMainLoop

62

63

import ctypes

63

64

65

# Brief description of the operation of this program:

66

#

67

# This server announces itself as a Zeroconf service. Connecting

68

# clients use the TLS protocol, with the unusual quirk that this

69

# server program acts as a TLS "client" while the connecting clients

70

# acts as a TLS "server". The clients (acting as a TLS "server") must

71

# supply an OpenPGP certificate, and the fingerprint of this

72

# certificate is used by this server to look up (in a list read from a

73

# file at start time) which binary blob to give the client. No other

74

# authentication or authorization is done by this server.

75

64

76

65

77

logger = logging.Logger('mandos')

66

78

syslogger = logging.handlers.SysLogHandler\

70

82

logger.addHandler(syslogger)

71

83

del syslogger

72

84

73

74

class AvahiError(Exception):

75

def __init__(self, value):

76

self.value = value

77

def __str__(self):

78

return repr(self.value)

79

80

class AvahiServiceError(AvahiError):

81

pass

82

83

class AvahiGroupError(AvahiError):

84

pass

85

86

87

class AvahiService(object):

88

"""An Avahi (Zeroconf) service.

89

Attributes:

90

interface: integer; avahi.IF_UNSPEC or an interface index.

91

Used to optionally bind to the specified interface.

92

name: string; Example: 'Mandos'

93

type: string; Example: '_mandos._tcp'.

94

See <http://www.dns-sd.org/ServiceTypes.html>

95

port: integer; what port to announce

96

TXT: list of strings; TXT record for the service

97

domain: string; Domain to publish on, default to .local if empty.

98

host: string; Host to publish records for, default is localhost

99

max_renames: integer; maximum number of renames

100

rename_count: integer; counter so we only rename after collisions

101

a sensible number of times

102

"""

103

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

104

type = None, port = None, TXT = None, domain = "",

105

host = "", max_renames = 12):

106

self.interface = interface

107

self.name = name

108

self.type = type

109

self.port = port

110

if TXT is None:

111

self.TXT = []

112

else:

113

self.TXT = TXT

114

self.domain = domain

115

self.host = host

116

self.rename_count = 0

117

def rename(self):

118

"""Derived from the Avahi example code"""

119

if self.rename_count >= self.max_renames:

120

logger.critical(u"No suitable service name found after %i"

121

u" retries, exiting.", rename_count)

122

raise AvahiServiceError("Too many renames")

123

name = server.GetAlternativeServiceName(name)

124

logger.error(u"Changing name to %r ...", name)

125

self.remove()

126

self.add()

127

self.rename_count += 1

128

def remove(self):

129

"""Derived from the Avahi example code"""

130

if group is not None:

131

group.Reset()

132

def add(self):

133

"""Derived from the Avahi example code"""

134

global group

135

if group is None:

136

group = dbus.Interface\

137

(bus.get_object(avahi.DBUS_NAME,

138

server.EntryGroupNew()),

139

avahi.DBUS_INTERFACE_ENTRY_GROUP)

140

group.connect_to_signal('StateChanged',

141

entry_group_state_changed)

142

logger.debug(u"Adding service '%s' of type '%s' ...",

143

service.name, service.type)

144

group.AddService(

145

self.interface, # interface

146

avahi.PROTO_INET6, # protocol

147

dbus.UInt32(0), # flags

148

self.name, self.type,

149

self.domain, self.host,

150

dbus.UInt16(self.port),

151

avahi.string_array_to_txt_array(self.TXT))

152

group.Commit()

153

85

# This variable is used to optionally bind to a specified interface.

86

# It is a global variable to fit in with the other variables from the

87

# Avahi example code.

88

serviceInterface = avahi.IF_UNSPEC

154

89

# From the Avahi example code:

155

group = None # our entry group

90

serviceName = None

91

serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html

92

servicePort = None # Not known at startup

93

serviceTXT = [] # TXT record for the service

94

domain = "" # Domain to publish on, default to .local

95

host = "" # Host to publish records for, default to localhost

96

group = None #our entry group

97

rename_count = 12 # Counter so we only rename after collisions a

98

# sensible number of times

156

99

# End of Avahi example code

157

100

158

101

164

107

uniquely identify the client

165

108

secret: bytestring; sent verbatim (over TLS) to client

166

109

fqdn: string (FQDN); available for use by the checker command

167

created: datetime.datetime(); object creation, not client host

168

last_checked_ok: datetime.datetime() or None if not yet checked OK

169

timeout: datetime.timedelta(); How long from last_checked_ok

170

until this client is invalid

110

created: datetime.datetime()

111

last_seen: datetime.datetime() or None if not yet seen

112

timeout: datetime.timedelta(); How long from last_seen until

113

this client is invalid

171

114

interval: datetime.timedelta(); How often to start a new checker

172

115

stop_hook: If set, called by stop() as stop_hook(self)

173

116

checker: subprocess.Popen(); a running checker process used

174

117

to see if the client lives.

175

'None' if no process is running.

118

Is None if no process is running.

176

119

checker_initiator_tag: a gobject event source tag, or None

177

120

stop_initiator_tag: - '' -

178

121

checker_callback_tag: - '' -

179

122

checker_command: string; External command which is run to check if

180

client lives. %() expansions are done at

123

client lives. %()s expansions are done at

181

124

runtime with vars(self) as dict, so that for

182

125

instance %(name)s can be used in the command.

183

126

Private attibutes:

184

127

_timeout: Real variable for 'timeout'

185

128

_interval: Real variable for 'interval'

186

_timeout_milliseconds: Used when calling gobject.timeout_add()

129

_timeout_milliseconds: Used by gobject.timeout_add()

187

130

_interval_milliseconds: - '' -

188

131

"""

189

132

def _set_timeout(self, timeout):

209

152

interval = property(lambda self: self._interval,

210

153

_set_interval)

211

154

del _set_interval

212

def __init__(self, name = None, stop_hook=None, config={}):

213

"""Note: the 'checker' key in 'config' sets the

214

'checker_command' attribute and *not* the 'checker'

215

attribute."""

155

def __init__(self, name=None, stop_hook=None, fingerprint=None,

156

secret=None, secfile=None, fqdn=None, timeout=None,

157

interval=-1, checker=None):

158

"""Note: the 'checker' argument sets the 'checker_command'

159

attribute and not the 'checker' attribute.."""

216

160

self.name = name

217

161

logger.debug(u"Creating client %r", self.name)

218

# Uppercase and remove spaces from fingerprint for later

219

# comparison purposes with return value from the fingerprint()

220

# function

221

self.fingerprint = config["fingerprint"].upper()\

222

.replace(u" ", u"")

162

# Uppercase and remove spaces from fingerprint

163

# for later comparison purposes with return value of

164

# the fingerprint() function

165

self.fingerprint = fingerprint.upper().replace(u" ", u"")

223

166

logger.debug(u" Fingerprint: %s", self.fingerprint)

224

if "secret" in config:

225

self.secret = config["secret"].decode(u"base64")

226

elif "secfile" in config:

227

sf = open(config["secfile"])

167

if secret:

168

self.secret = secret.decode(u"base64")

169

elif secfile:

170

sf = open(secfile)

228

171

self.secret = sf.read()

229

172

sf.close()

230

173

else:

231

raise TypeError(u"No secret or secfile for client %s"

232

% self.name)

233

self.fqdn = config.get("fqdn", "")

174

raise RuntimeError(u"No secret or secfile for client %s"

175

% self.name)

176

self.fqdn = fqdn # string

234

177

self.created = datetime.datetime.now()

235

self.last_checked_ok = None

236

self.timeout = string_to_delta(config["timeout"])

237

self.interval = string_to_delta(config["interval"])

178

self.last_seen = None

179

self.timeout = string_to_delta(timeout)

180

self.interval = string_to_delta(interval)

238

181

self.stop_hook = stop_hook

239

182

self.checker = None

240

183

self.checker_initiator_tag = None

241

184

self.stop_initiator_tag = None

242

185

self.checker_callback_tag = None

243

self.check_command = config["checker"]

186

self.check_command = checker

244

187

def start(self):

245

188

"""Start this client's checker and timeout hooks"""

246

189

# Schedule a new checker to be started an 'interval' from now,

256

199

self.stop)

257

200

def stop(self):

258

201

"""Stop this client.

259

The possibility that a client might be restarted is left open,

260

but not currently used."""

202

The possibility that this client might be restarted is left

203

open, but not currently used."""

261

204

# If this client doesn't have a secret, it is already stopped.

262

205

if self.secret:

263

logger.info(u"Stopping client %s", self.name)

206

logger.debug(u"Stopping client %s", self.name)

264

207

self.secret = None

265

208

else:

266

209

return False

267

if getattr(self, "stop_initiator_tag", False):

210

if hasattr(self, "stop_initiator_tag") \

211

and self.stop_initiator_tag:

268

212

gobject.source_remove(self.stop_initiator_tag)

269

213

self.stop_initiator_tag = None

270

if getattr(self, "checker_initiator_tag", False):

214

if hasattr(self, "checker_initiator_tag") \

215

and self.checker_initiator_tag:

271

216

gobject.source_remove(self.checker_initiator_tag)

272

217

self.checker_initiator_tag = None

273

218

self.stop_checker()

285

230

self.checker = None

286

231

if os.WIFEXITED(condition) \

287

232

and (os.WEXITSTATUS(condition) == 0):

288

logger.info(u"Checker for %(name)s succeeded",

289

vars(self))

290

self.last_checked_ok = now

233

logger.debug(u"Checker for %(name)s succeeded",

234

vars(self))

235

self.last_seen = now

291

236

gobject.source_remove(self.stop_initiator_tag)

292

237

self.stop_initiator_tag = gobject.timeout_add\

293

238

(self._timeout_milliseconds,

296

241

logger.warning(u"Checker for %(name)s crashed?",

297

242

vars(self))

298

243

else:

299

logger.info(u"Checker for %(name)s failed",

300

vars(self))

244

logger.debug(u"Checker for %(name)s failed",

245

vars(self))

301

246

def start_checker(self):

302

247

"""Start a new checker subprocess if one is not running.

303

248

If a checker already exists, leave it running and do

312

257

# is as it should be.

313

258

if self.checker is None:

314

259

try:

315

# In case check_command has exactly one % operator

316

260

command = self.check_command % self.fqdn

317

261

except TypeError:

318

# Escape attributes for the shell

319

262

escaped_attrs = dict((key, re.escape(str(val)))

320

263

for key, val in

321

264

vars(self).iteritems())

322

265

try:

323

266

command = self.check_command % escaped_attrs

324

267

except TypeError, error:

325

logger.error(u'Could not format string "%s":'

326

u' %s', self.check_command, error)

268

logger.critical(u'Could not format string "%s":'

269

u' %s', self.check_command, error)

327

270

return True # Try again later

328

271

try:

329

logger.info(u"Starting checker %r for %s",

330

command, self.name)

331

self.checker = subprocess.Popen(command,

332

close_fds=True,

333

shell=True, cwd="/")

272

logger.debug(u"Starting checker %r for %s",

273

command, self.name)

274

self.checker = subprocess.\

275

Popen(command,

276

close_fds=True, shell=True,

277

cwd="/")

334

278

self.checker_callback_tag = gobject.child_watch_add\

335

279

(self.checker.pid,

336

280

self.checker_callback)

344

288

if self.checker_callback_tag:

345

289

gobject.source_remove(self.checker_callback_tag)

346

290

self.checker_callback_tag = None

347

if getattr(self, "checker", None) is None:

291

if not hasattr(self, "checker") or self.checker is None:

348

292

return

349

293

logger.debug("Stopping checker for %(name)s", vars(self))

350

294

try:

353

297

#if self.checker.poll() is None:

354

298

# os.kill(self.checker.pid, signal.SIGKILL)

355

299

except OSError, error:

356

if error.errno != errno.ESRCH: # No such process

300

if error.errno != errno.ESRCH:

357

301

raise

358

302

self.checker = None

359

def still_valid(self):

303

def still_valid(self, now=None):

360

304

"""Has the timeout not yet passed for this client?"""

361

now = datetime.datetime.now()

362

if self.last_checked_ok is None:

305

if now is None:

306

now = datetime.datetime.now()

307

if self.last_seen is None:

363

308

return now < (self.created + self.timeout)

364

309

else:

365

return now < (self.last_checked_ok + self.timeout)

310

return now < (self.last_seen + self.timeout)

366

311

367

312

368

313

def peer_certificate(session):

384

329

385

330

def fingerprint(openpgp):

386

331

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

332

# New empty GnuTLS certificate

333

crt = gnutls.library.types.gnutls_openpgp_crt_t()

334

gnutls.library.functions.gnutls_openpgp_crt_init\

335

(ctypes.byref(crt))

387

336

# New GnuTLS "datum" with the OpenPGP public key

388

337

datum = gnutls.library.types.gnutls_datum_t\

389

338

(ctypes.cast(ctypes.c_char_p(openpgp),

390

339

ctypes.POINTER(ctypes.c_ubyte)),

391

340

ctypes.c_uint(len(openpgp)))

392

# New empty GnuTLS certificate

393

crt = gnutls.library.types.gnutls_openpgp_crt_t()

394

gnutls.library.functions.gnutls_openpgp_crt_init\

395

(ctypes.byref(crt))

396

341

# Import the OpenPGP public key into the certificate

397

gnutls.library.functions.gnutls_openpgp_crt_import\

398

(crt, ctypes.byref(datum),

399

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

342

ret = gnutls.library.functions.gnutls_openpgp_crt_import\

343

(crt,

344

ctypes.byref(datum),

345

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

400

346

# New buffer for the fingerprint

401

347

buffer = ctypes.create_string_buffer(20)

402

348

buffer_length = ctypes.c_size_t()

418

364

Note: This will run in its own forked process."""

419

365

420

366

def handle(self):

421

logger.info(u"TCP connection from: %s",

367

logger.debug(u"TCP connection from: %s",

422

368

unicode(self.client_address))

423

session = gnutls.connection.ClientSession\

424

(self.request, gnutls.connection.X509Credentials())

425

426

line = self.request.makefile().readline()

427

logger.debug(u"Protocol version: %r", line)

428

try:

429

if int(line.strip().split()[0]) > 1:

430

raise RuntimeError

431

except (ValueError, IndexError, RuntimeError), error:

432

logger.error(u"Unknown protocol version: %s", error)

433

return

434

435

# Note: gnutls.connection.X509Credentials is really a generic

436

# GnuTLS certificate credentials object so long as no X.509

437

# keys are added to it. Therefore, we can use it here despite

438

# using OpenPGP certificates.

369

session = gnutls.connection.ClientSession(self.request,

370

gnutls.connection.\

371

X509Credentials())

439

372

440

373

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

441

374

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

442

375

# "+DHE-DSS"))

443

priority = "NORMAL" # Fallback default, since this

444

# MUST be set.

445

if self.server.settings["priority"]:

446

priority = self.server.settings["priority"]

376

priority = "NORMAL"

377

if self.server.options.priority:

378

priority = self.server.options.priority

447

379

gnutls.library.functions.gnutls_priority_set_direct\

448

380

(session._c_object, priority, None);

449

381

450

382

try:

451

383

session.handshake()

452

384

except gnutls.errors.GNUTLSError, error:

453

logger.warning(u"Handshake failed: %s", error)

385

logger.debug(u"Handshake failed: %s", error)

454

386

# Do not run session.bye() here: the session is not

455

387

# established. Just abandon the request.

456

388

return

457

389

try:

458

390

fpr = fingerprint(peer_certificate(session))

459

391

except (TypeError, gnutls.errors.GNUTLSError), error:

460

logger.warning(u"Bad certificate: %s", error)

392

logger.debug(u"Bad certificate: %s", error)

461

393

session.bye()

462

394

return

463

395

logger.debug(u"Fingerprint: %s", fpr)

466

398

if c.fingerprint == fpr:

467

399

client = c

468

400

break

469

if not client:

470

logger.warning(u"Client not found for fingerprint: %s",

471

fpr)

472

session.bye()

473

return

474

401

# Have to check if client.still_valid(), since it is possible

475

402

# that the client timed out while establishing the GnuTLS

476

403

# session.

477

if not client.still_valid():

478

logger.warning(u"Client %(name)s is invalid",

479

vars(client))

404

if (not client) or (not client.still_valid()):

405

if client:

406

logger.debug(u"Client %(name)s is invalid",

407

vars(client))

408

else:

409

logger.debug(u"Client not found for fingerprint: %s",

410

fpr)

480

411

session.bye()

481

412

return

482

413

sent_size = 0

492

423

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

493

424

"""IPv6 TCP server. Accepts 'None' as address and/or port.

494

425

Attributes:

495

settings: Server settings

426

options: Command line options

496

427

clients: Set() of Client objects

497

428

"""

498

429

address_family = socket.AF_INET6

499

430

def __init__(self, *args, **kwargs):

500

if "settings" in kwargs:

501

self.settings = kwargs["settings"]

502

del kwargs["settings"]

431

if "options" in kwargs:

432

self.options = kwargs["options"]

433

del kwargs["options"]

503

434

if "clients" in kwargs:

504

435

self.clients = kwargs["clients"]

505

436

del kwargs["clients"]

508

439

"""This overrides the normal server_bind() function

509

440

to bind to an interface if one was specified, and also NOT to

510

441

bind to an address or port if they were not specified."""

511

if self.settings["interface"]:

512

# 25 is from /usr/include/asm-i486/socket.h

513

SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)

442

if self.options.interface:

443

if not hasattr(socket, "SO_BINDTODEVICE"):

444

# From /usr/include/asm-i486/socket.h

445

socket.SO_BINDTODEVICE = 25

514

446

try:

515

447

self.socket.setsockopt(socket.SOL_SOCKET,

516

SO_BINDTODEVICE,

517

self.settings["interface"])

448

socket.SO_BINDTODEVICE,

449

self.options.interface)

518

450

except socket.error, error:

519

451

if error[0] == errno.EPERM:

520

logger.error(u"No permission to"

521

u" bind to interface %s",

522

self.settings["interface"])

452

logger.warning(u"No permission to"

453

u" bind to interface %s",

454

self.options.interface)

523

455

else:

524

456

raise error

525

457

# Only bind(2) the socket if we really need to.

568

500

return delta

569

501

570

502

503

def add_service():

504

"""Derived from the Avahi example code"""

505

global group, serviceName, serviceType, servicePort, serviceTXT, \

506

domain, host

507

if group is None:

508

group = dbus.Interface(

509

bus.get_object( avahi.DBUS_NAME,

510

server.EntryGroupNew()),

511

avahi.DBUS_INTERFACE_ENTRY_GROUP)

512

group.connect_to_signal('StateChanged',

513

entry_group_state_changed)

514

logger.debug(u"Adding service '%s' of type '%s' ...",

515

serviceName, serviceType)

516

517

group.AddService(

518

serviceInterface, # interface

519

avahi.PROTO_INET6, # protocol

520

dbus.UInt32(0), # flags

521

serviceName, serviceType,

522

domain, host,

523

dbus.UInt16(servicePort),

524

avahi.string_array_to_txt_array(serviceTXT))

525

group.Commit()

526

527

528

def remove_service():

529

"""From the Avahi example code"""

530

global group

531

532

if not group is None:

533

group.Reset()

534

535

571

536

def server_state_changed(state):

572

537

"""Derived from the Avahi example code"""

573

538

if state == avahi.SERVER_COLLISION:

574

logger.error(u"Server name collision")

575

service.remove()

539

logger.warning(u"Server name collision")

540

remove_service()

576

541

elif state == avahi.SERVER_RUNNING:

577

service.add()

542

add_service()

578

543

579

544

580

545

def entry_group_state_changed(state, error):

581

546

"""Derived from the Avahi example code"""

547

global serviceName, server, rename_count

548

582

549

logger.debug(u"state change: %i", state)

583

550

584

551

if state == avahi.ENTRY_GROUP_ESTABLISHED:

585

552

logger.debug(u"Service established.")

586

553

elif state == avahi.ENTRY_GROUP_COLLISION:

587

logger.warning(u"Service name collision.")

588

service.rename()

554

555

rename_count = rename_count - 1

556

if rename_count > 0:

557

name = server.GetAlternativeServiceName(name)

558

logger.warning(u"Service name collision, "

559

u"changing name to '%s' ...", name)

560

remove_service()

561

add_service()

562

563

else:

564

logger.error(u"No suitable service name found after %i"

565

u" retries, exiting.", n_rename)

566

killme(1)

589

567

elif state == avahi.ENTRY_GROUP_FAILURE:

590

logger.critical(u"Error in group state changed %s",

591

unicode(error))

592

raise AvahiGroupError("State changed: %s", str(error))

568

logger.error(u"Error in group state changed %s",

569

unicode(error))

570

killme(1)

571

593

572

594

573

def if_nametoindex(interface):

595

"""Call the C function if_nametoindex(), or equivalent"""

596

global if_nametoindex

574

"""Call the C function if_nametoindex()"""

597

575

try:

598

if "ctypes.util" not in sys.modules:

599

import ctypes.util

600

if_nametoindex = ctypes.cdll.LoadLibrary\

601

(ctypes.util.find_library("c")).if_nametoindex

576

libc = ctypes.cdll.LoadLibrary("libc.so.6")

577

return libc.if_nametoindex(interface)

602

578

except (OSError, AttributeError):

603

579

if "struct" not in sys.modules:

604

580

import struct

605

581

if "fcntl" not in sys.modules:

606

582

import fcntl

607

def if_nametoindex(interface):

608

"Get an interface index the hard way, i.e. using fcntl()"

609

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

610

s = socket.socket()

611

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

612

struct.pack("16s16x", interface))

613

s.close()

614

interface_index = struct.unpack("I", ifreq[16:20])[0]

615

return interface_index

616

return if_nametoindex(interface)

617

618

619

def daemon(nochdir = False, noclose = False):

583

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

584

s = socket.socket()

585

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

586

struct.pack("16s16x", interface))

587

s.close()

588

interface_index = struct.unpack("I", ifreq[16:20])[0]

589

return interface_index

590

591

592

def daemon(nochdir, noclose):

620

593

"""See daemon(3). Standard BSD Unix function.

621

594

This should really exist as os.daemon, but it doesn't (yet)."""

622

595

if os.fork():

624

597

os.setsid()

625

598

if not nochdir:

626

599

os.chdir("/")

627

if os.fork():

628

sys.exit()

629

600

if not noclose:

630

601

# Close all standard open file descriptors

631

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

602

null = os.open("/dev/null", os.O_NOCTTY | os.O_RDWR)

632

603

if not stat.S_ISCHR(os.fstat(null).st_mode):

633

604

raise OSError(errno.ENODEV,

634

605

"/dev/null not a character device")

639

610

os.close(null)

640

611

641

612

613

def killme(status = 0):

614

logger.debug("Stopping server with exit status %d", status)

615

exitstatus = status

616

if main_loop_started:

617

main_loop.quit()

618

else:

619

sys.exit(status)

620

621

642

622

def main():

623

global exitstatus

624

exitstatus = 0

643

625

global main_loop_started

644

626

main_loop_started = False

645

627

646

628

parser = OptionParser()

647

629

parser.add_option("-i", "--interface", type="string",

648

metavar="IF", help="Bind to interface IF")

649

parser.add_option("-a", "--address", type="string",

630

default=None, metavar="IF",

631

help="Bind to interface IF")

632

parser.add_option("-a", "--address", type="string", default=None,

650

633

help="Address to listen for requests on")

651

parser.add_option("-p", "--port", type="int",

634

parser.add_option("-p", "--port", type="int", default=None,

652

635

help="Port number to receive requests on")

653

636

parser.add_option("--check", action="store_true", default=False,

654

637

help="Run self-test")

655

638

parser.add_option("--debug", action="store_true", default=False,

656

help="Debug mode; run in foreground and log to"

657

" terminal")

658

parser.add_option("--priority", type="string", help="GnuTLS"

659

" priority string (see GnuTLS documentation)")

660

parser.add_option("--servicename", type="string", metavar="NAME",

661

help="Zeroconf service name")

662

parser.add_option("--configdir", type="string",

663

default="/etc/mandos", metavar="DIR",

664

help="Directory to search for configuration"

665

" files")

639

help="Debug mode")

640

parser.add_option("--priority", type="string",

641

default="SECURE256",

642

help="GnuTLS priority string"

643

" (see GnuTLS documentation)")

644

parser.add_option("--servicename", type="string",

645

default="Mandos", help="Zeroconf service name")

666

646

(options, args) = parser.parse_args()

667

647

668

648

if options.check:

670

650

doctest.testmod()

671

651

sys.exit()

672

652

673

# Default values for config file for server-global settings

674

server_defaults = { "interface": "",

675

"address": "",

676

"port": "",

677

"debug": "False",

678

"priority":

679

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

680

"servicename": "Mandos",

681

}

682

683

# Parse config file for server-global settings

684

server_config = ConfigParser.SafeConfigParser(server_defaults)

685

del server_defaults

686

server_config.read(os.path.join(options.configdir, "mandos.conf"))

687

server_section = "server"

688

# Convert the SafeConfigParser object to a dict

689

server_settings = dict(server_config.items(server_section))

690

# Use getboolean on the boolean config option

691

server_settings["debug"] = server_config.getboolean\

692

(server_section, "debug")

693

del server_config

694

695

# Override the settings from the config file with command line

696

# options, if set.

697

for option in ("interface", "address", "port", "debug",

698

"priority", "servicename", "configdir"):

699

value = getattr(options, option)

700

if value is not None:

701

server_settings[option] = value

702

del options

703

# Now we have our good server settings in "server_settings"

704

705

# Parse config file with clients

706

client_defaults = { "timeout": "1h",

707

"interval": "5m",

708

"checker": "fping -q -- %%(fqdn)s",

709

}

710

client_config = ConfigParser.SafeConfigParser(client_defaults)

711

client_config.read(os.path.join(server_settings["configdir"],

712

"clients.conf"))

713

714

global service

715

service = AvahiService(name = server_settings["servicename"],

716

type = "_mandos._tcp", );

717

if server_settings["interface"]:

718

service.interface = if_nametoindex(server_settings["interface"])

653

# Parse config file

654

defaults = { "timeout": "1h",

655

"interval": "5m",

656

"checker": "fping -q -- %%(fqdn)s",

657

}

658

client_config = ConfigParser.SafeConfigParser(defaults)

659

#client_config.readfp(open("global.conf"), "global.conf")

660

client_config.read("mandos-clients.conf")

661

662

global serviceName

663

serviceName = options.servicename;

719

664

720

665

global main_loop

721

666

global bus

729

674

avahi.DBUS_INTERFACE_SERVER )

730

675

# End of Avahi example code

731

676

732

debug = server_settings["debug"]

677

debug = options.debug

733

678

734

679

if debug:

735

680

console = logging.StreamHandler()

743

688

def remove_from_clients(client):

744

689

clients.remove(client)

745

690

if not clients:

746

logger.critical(u"No clients left, exiting")

747

sys.exit()

691

logger.debug(u"No clients left, exiting")

692

killme()

748

693

749

clients.update(Set(Client(name = section,

694

clients.update(Set(Client(name=section,

750

695

stop_hook = remove_from_clients,

751

config

752

= dict(client_config.items(section)))

696

**(dict(client_config\

697

.items(section))))

753

698

for section in client_config.sections()))

754

699

755

700

if not debug:

756

daemon()

701

daemon(False, False)

757

702

758

703

def cleanup():

759

704

"Cleanup function; run on exit"

773

718

774

719

if not debug:

775

720

signal.signal(signal.SIGINT, signal.SIG_IGN)

776

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

777

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

721

signal.signal(signal.SIGHUP, lambda signum, frame: killme())

722

signal.signal(signal.SIGTERM, lambda signum, frame: killme())

778

723

779

724

for client in clients:

780

725

client.start()

781

726

782

tcp_server = IPv6_TCPServer((server_settings["address"],

783

server_settings["port"]),

727

tcp_server = IPv6_TCPServer((options.address, options.port),

784

728

tcp_handler,

785

settings=server_settings,

729

options=options,

786

730

clients=clients)

787

# Find out what port we got

788

service.port = tcp_server.socket.getsockname()[1]

789

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

790

u" scope_id %d" % tcp_server.socket.getsockname())

791

792

#service.interface = tcp_server.socket.getsockname()[3]

793

794

try:

795

# From the Avahi example code

796

server.connect_to_signal("StateChanged", server_state_changed)

797

try:

798

server_state_changed(server.GetState())

799

except dbus.exceptions.DBusException, error:

800

logger.critical(u"DBusException: %s", error)

801

sys.exit(1)

802

# End of Avahi example code

803

804

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

805

lambda *args, **kwargs:

806

tcp_server.handle_request\

807

(*args[2:], **kwargs) or True)

808

731

# Find out what random port we got

732

global servicePort

733

servicePort = tcp_server.socket.getsockname()[1]

734

logger.debug(u"Now listening on port %d", servicePort)

735

736

if options.interface is not None:

737

global serviceInterface

738

serviceInterface = if_nametoindex(options.interface)

739

740

# From the Avahi example code

741

server.connect_to_signal("StateChanged", server_state_changed)

742

try:

743

server_state_changed(server.GetState())

744

except dbus.exceptions.DBusException, error:

745

logger.critical(u"DBusException: %s", error)

746

killme(1)

747

# End of Avahi example code

748

749

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

750

lambda *args, **kwargs:

751

tcp_server.handle_request(*args[2:],

752

**kwargs) or True)

753

try:

809

754

logger.debug("Starting main loop")

810

755

main_loop_started = True

811

756

main_loop.run()

812

except AvahiError, error:

813

logger.critical(u"AvahiError: %s" + unicode(error))

814

sys.exit(1)

815

757

except KeyboardInterrupt:

816

758

if debug:

817

759

print

760

761

sys.exit(exitstatus)

818

762

819

763

if __name__ == '__main__':

820

764

main()