/mandos/trunk : revision 109

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# following functions: "AvahiService.add", "AvahiService.remove",

10

# "server_state_changed", "entry_group_state_changed", and some lines

11

# in "main".

9

# methods "add" and "remove" in the "AvahiService" class, the

10

# "server_state_changed" and "entry_group_state_changed" functions,

11

# and some lines in "main".

12

#

13

# Everything else is

14

24

# GNU General Public License for more details.

25

#

26

# You should have received a copy of the GNU General Public License

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

27

# along with this program. If not, see

28

# <http://www.gnu.org/licenses/>.

28

29

#

29

30

# Contact the authors at <mandos@fukt.bsnet.se>.

30

31

#

61

62

from dbus.mainloop.glib import DBusGMainLoop

62

63

import ctypes

63

64

# Brief description of the operation of this program:

65

#

66

# This server announces itself as a Zeroconf service. Connecting

67

# clients use the TLS protocol, with the unusual quirk that this

68

# server program acts as a TLS "client" while a connecting client acts

69

# as a TLS "server". The client (acting as a TLS "server") must

70

# supply an OpenPGP certificate, and the fingerprint of this

71

# certificate is used by this server to look up (in a list read from a

72

# file at start time) which binary blob to give the client. No other

73

# authentication or authorization is done by this server.

74

65

version = "1.0"

75

66

76

67

logger = logging.Logger('mandos')

77

68

syslogger = logging.handlers.SysLogHandler\

78

(facility = logging.handlers.SysLogHandler.LOG_DAEMON)

69

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

70

address = "/dev/log")

79

71

syslogger.setFormatter(logging.Formatter\

80

('%(levelname)s: %(message)s'))

72

('Mandos: %(levelname)s: %(message)s'))

81

73

logger.addHandler(syslogger)

82

del syslogger

83

74

75

console = logging.StreamHandler()

76

console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'

77

' %(message)s'))

78

logger.addHandler(console)

84

79

85

80

class AvahiError(Exception):

86

81

def __init__(self, value):

96

91

97

92

98

93

class AvahiService(object):

99

"""

94

"""An Avahi (Zeroconf) service.

95

Attributes:

100

96

interface: integer; avahi.IF_UNSPEC or an interface index.

101

97

Used to optionally bind to the specified interface.

102

name = string; Example: "Mandos"

103

type = string; Example: "_mandos._tcp".

104

See <http://www.dns-sd.org/ServiceTypes.html>

105

port = integer; what port to announce

106

TXT = list of strings; TXT record for the service

107

domain = string; Domain to publish on, default to .local if empty.

108

host = string; Host to publish records for, default to localhost

109

if empty.

110

max_renames = integer; maximum number of renames

111

rename_count = integer; counter so we only rename after collisions

112

a sensible number of times

98

name: string; Example: 'Mandos'

99

type: string; Example: '_mandos._tcp'.

100

See <http://www.dns-sd.org/ServiceTypes.html>

101

port: integer; what port to announce

102

TXT: list of strings; TXT record for the service

103

domain: string; Domain to publish on, default to .local if empty.

104

host: string; Host to publish records for, default is localhost

105

max_renames: integer; maximum number of renames

106

rename_count: integer; counter so we only rename after collisions

107

a sensible number of times

113

108

"""

114

109

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

115

110

type = None, port = None, TXT = None, domain = "",

116

host = "", max_renames = 12):

117

"""An Avahi (Zeroconf) service. """

111

host = "", max_renames = 32768):

118

112

self.interface = interface

119

113

self.name = name

120

114

self.type = type

126

120

self.domain = domain

127

121

self.host = host

128

122

self.rename_count = 0

123

self.max_renames = max_renames

129

124

def rename(self):

130

125

"""Derived from the Avahi example code"""

131

126

if self.rename_count >= self.max_renames:

132

logger.critical(u"No suitable service name found after %i"

133

u" retries, exiting.", rename_count)

127

logger.critical(u"No suitable Zeroconf service name found"

128

u" after %i retries, exiting.",

129

rename_count)

134

130

raise AvahiServiceError("Too many renames")

135

name = server.GetAlternativeServiceName(name)

136

logger.notice(u"Changing name to %r ...", name)

131

self.name = server.GetAlternativeServiceName(self.name)

132

logger.info(u"Changing Zeroconf service name to %r ...",

133

str(self.name))

134

syslogger.setFormatter(logging.Formatter\

135

('Mandos (%s): %%(levelname)s:'

136

' %%(message)s' % self.name))

137

self.remove()

138

self.add()

139

self.rename_count += 1

151

avahi.DBUS_INTERFACE_ENTRY_GROUP)

152

group.connect_to_signal('StateChanged',

153

entry_group_state_changed)

154

logger.debug(u"Adding service '%s' of type '%s' ...",

154

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

155

service.name, service.type)

156

group.AddService(

157

self.interface, # interface

175

fingerprint: string (40 or 32 hexadecimal digits); used to

176

uniquely identify the client

177

secret: bytestring; sent verbatim (over TLS) to client

178

fqdn: string (FQDN); available for use by the checker command

178

host: string; available for use by the checker command

179

created: datetime.datetime(); object creation, not client host

180

last_checked_ok: datetime.datetime() or None if not yet checked OK

181

timeout: datetime.timedelta(); How long from last_checked_ok

221

interval = property(lambda self: self._interval,

222

_set_interval)

223

del _set_interval

224

def __init__(self, name=None, stop_hook=None, fingerprint=None,

225

secret=None, secfile=None, fqdn=None, timeout=None,

226

interval=-1, checker=None):

227

"""Note: the 'checker' argument sets the 'checker_command'

228

attribute and not the 'checker' attribute.."""

224

def __init__(self, name = None, stop_hook=None, config={}):

225

"""Note: the 'checker' key in 'config' sets the

226

'checker_command' attribute and *not* the 'checker'

227

attribute."""

229

228

self.name = name

230

229

logger.debug(u"Creating client %r", self.name)

231

# Uppercase and remove spaces from fingerprint

232

# for later comparison purposes with return value of

233

# the fingerprint() function

234

self.fingerprint = fingerprint.upper().replace(u" ", u"")

230

# Uppercase and remove spaces from fingerprint for later

231

# comparison purposes with return value from the fingerprint()

232

# function

233

self.fingerprint = config["fingerprint"].upper()\

234

.replace(u" ", u"")

235

logger.debug(u" Fingerprint: %s", self.fingerprint)

236

if secret:

237

self.secret = secret.decode(u"base64")

238

elif secfile:

239

sf = open(secfile)

236

if "secret" in config:

237

self.secret = config["secret"].decode(u"base64")

238

elif "secfile" in config:

239

sf = open(config["secfile"])

240

self.secret = sf.read()

241

sf.close()

242

else:

243

raise TypeError(u"No secret or secfile for client %s"

244

% self.name)

245

self.fqdn = fqdn

245

self.host = config.get("host", "")

246

self.created = datetime.datetime.now()

247

self.last_checked_ok = None

248

self.timeout = string_to_delta(timeout)

249

self.interval = string_to_delta(interval)

248

self.timeout = string_to_delta(config["timeout"])

249

self.interval = string_to_delta(config["interval"])

250

self.stop_hook = stop_hook

251

self.checker = None

252

self.checker_initiator_tag = None

253

self.stop_initiator_tag = None

254

self.checker_callback_tag = None

255

self.check_command = checker

255

self.check_command = config["checker"]

256

def start(self):

257

"""Start this client's checker and timeout hooks"""

258

# Schedule a new checker to be started an 'interval' from now,

271

The possibility that a client might be restarted is left open,

272

but not currently used."""

273

# If this client doesn't have a secret, it is already stopped.

274

if self.secret:

275

logger.debug(u"Stopping client %s", self.name)

274

if hasattr(self, "secret") and self.secret:

275

logger.info(u"Stopping client %s", self.name)

276

self.secret = None

277

else:

278

return False

297

self.checker = None

298

if os.WIFEXITED(condition) \

299

and (os.WEXITSTATUS(condition) == 0):

300

logger.debug(u"Checker for %(name)s succeeded",

301

vars(self))

300

logger.info(u"Checker for %(name)s succeeded",

301

vars(self))

302

self.last_checked_ok = now

303

gobject.source_remove(self.stop_initiator_tag)

304

self.stop_initiator_tag = gobject.timeout_add\

308

logger.warning(u"Checker for %(name)s crashed?",

309

vars(self))

310

else:

311

logger.debug(u"Checker for %(name)s failed",

312

vars(self))

311

logger.info(u"Checker for %(name)s failed",

312

vars(self))

313

def start_checker(self):

314

"""Start a new checker subprocess if one is not running.

315

If a checker already exists, leave it running and do

325

if self.checker is None:

326

try:

327

# In case check_command has exactly one % operator

328

command = self.check_command % self.fqdn

328

command = self.check_command % self.host

329

except TypeError:

330

# Escape attributes for the shell

331

escaped_attrs = dict((key, re.escape(str(val)))

338

u' %s', self.check_command, error)

339

return True # Try again later

340

try:

341

logger.debug(u"Starting checker %r for %s",

342

command, self.name)

341

logger.info(u"Starting checker %r for %s",

342

command, self.name)

343

# We don't need to redirect stdout and stderr, since

344

# in normal mode, that is already done by daemon(),

345

# and in debug mode we don't want to. (Stdin is

346

# always replaced by /dev/null.)

343

347

self.checker = subprocess.Popen(command,

344

348

close_fds=True,

345

349

shell=True, cwd="/")

346

350

self.checker_callback_tag = gobject.child_watch_add\

347

351

(self.checker.pid,

348

352

self.checker_callback)

349

except subprocess.OSError, error:

353

except OSError, error:

350

354

logger.error(u"Failed to start subprocess: %s",

351

355

error)

352

356

# Re-run this periodically if run by gobject.timeout_add

358

362

self.checker_callback_tag = None

359

363

if getattr(self, "checker", None) is None:

360

364

return

361

logger.debug("Stopping checker for %(name)s", vars(self))

365

logger.debug(u"Stopping checker for %(name)s", vars(self))

362

366

try:

363

367

os.kill(self.checker.pid, signal.SIGTERM)

364

368

#os.sleep(0.5)

396

400

397

401

def fingerprint(openpgp):

398

402

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

399

# New empty GnuTLS certificate

400

crt = gnutls.library.types.gnutls_openpgp_crt_t()

401

gnutls.library.functions.gnutls_openpgp_crt_init\

402

(ctypes.byref(crt))

403

# New GnuTLS "datum" with the OpenPGP public key

404

datum = gnutls.library.types.gnutls_datum_t\

405

(ctypes.cast(ctypes.c_char_p(openpgp),

406

ctypes.POINTER(ctypes.c_ubyte)),

407

ctypes.c_uint(len(openpgp)))

408

# New empty GnuTLS certificate

409

crt = gnutls.library.types.gnutls_openpgp_crt_t()

410

gnutls.library.functions.gnutls_openpgp_crt_init\

411

(ctypes.byref(crt))

408

412

# Import the OpenPGP public key into the certificate

409

ret = gnutls.library.functions.gnutls_openpgp_crt_import\

410

(crt,

411

ctypes.byref(datum),

412

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

413

gnutls.library.functions.gnutls_openpgp_crt_import\

414

(crt, ctypes.byref(datum),

415

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

416

# Verify the self signature in the key

417

crtverify = ctypes.c_uint();

418

gnutls.library.functions.gnutls_openpgp_crt_verify_self\

419

(crt, 0, ctypes.byref(crtverify))

420

if crtverify.value != 0:

421

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

422

raise gnutls.errors.CertificateSecurityError("Verify failed")

413

423

# New buffer for the fingerprint

414

424

buffer = ctypes.create_string_buffer(20)

415

425

buffer_length = ctypes.c_size_t()

431

441

Note: This will run in its own forked process."""

432

442

433

443

def handle(self):

434

logger.debug(u"TCP connection from: %s",

444

logger.info(u"TCP connection from: %s",

435

445

unicode(self.client_address))

436

446

session = gnutls.connection.ClientSession\

437

447

(self.request, gnutls.connection.X509Credentials())

448

449

line = self.request.makefile().readline()

450

logger.debug(u"Protocol version: %r", line)

451

try:

452

if int(line.strip().split()[0]) > 1:

453

raise RuntimeError

454

except (ValueError, IndexError, RuntimeError), error:

455

logger.error(u"Unknown protocol version: %s", error)

456

return

457

438

458

# Note: gnutls.connection.X509Credentials is really a generic

439

459

# GnuTLS certificate credentials object so long as no X.509

440

460

# keys are added to it. Therefore, we can use it here despite

453

473

try:

454

474

session.handshake()

455

475

except gnutls.errors.GNUTLSError, error:

456

logger.debug(u"Handshake failed: %s", error)

476

logger.warning(u"Handshake failed: %s", error)

457

477

# Do not run session.bye() here: the session is not

458

478

# established. Just abandon the request.

459

479

return

460

480

try:

461

481

fpr = fingerprint(peer_certificate(session))

462

482

except (TypeError, gnutls.errors.GNUTLSError), error:

463

logger.debug(u"Bad certificate: %s", error)

483

logger.warning(u"Bad certificate: %s", error)

464

484

session.bye()

465

485

return

466

486

logger.debug(u"Fingerprint: %s", fpr)

470

490

client = c

471

491

break

472

492

if not client:

473

logger.debug(u"Client not found for fingerprint: %s", fpr)

493

logger.warning(u"Client not found for fingerprint: %s",

494

fpr)

474

495

session.bye()

475

496

return

476

497

# Have to check if client.still_valid(), since it is possible

477

498

# that the client timed out while establishing the GnuTLS

478

499

# session.

479

500

if not client.still_valid():

480

logger.debug(u"Client %(name)s is invalid", vars(client))

501

logger.warning(u"Client %(name)s is invalid",

502

vars(client))

481

503

session.bye()

482

504

return

483

505

sent_size = 0

509

531

"""This overrides the normal server_bind() function

510

532

to bind to an interface if one was specified, and also NOT to

511

533

bind to an address or port if they were not specified."""

512

if self.settings["interface"] != avahi.IF_UNSPEC:

534

if self.settings["interface"]:

513

535

# 25 is from /usr/include/asm-i486/socket.h

514

536

SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)

515

537

try:

518

540

self.settings["interface"])

519

541

except socket.error, error:

520

542

if error[0] == errno.EPERM:

521

logger.warning(u"No permission to"

522

u" bind to interface %s",

523

self.settings["interface"])

543

logger.error(u"No permission to"

544

u" bind to interface %s",

545

self.settings["interface"])

524

546

else:

525

547

raise error

526

548

# Only bind(2) the socket if we really need to.

529

551

in6addr_any = "::"

530

552

self.server_address = (in6addr_any,

531

553

self.server_address[1])

532

elif self.server_address[1] is None:

554

elif not self.server_address[1]:

533

555

self.server_address = (self.server_address[0],

534

556

0)

557

# if self.settings["interface"]:

558

# self.server_address = (self.server_address[0],

559

# 0, # port

560

# 0, # flowinfo

561

# if_nametoindex

562

# (self.settings

563

# ["interface"]))

535

564

return super(type(self), self).server_bind()

536

565

537

566

548

577

datetime.timedelta(1)

549

578

>>> string_to_delta(u'1w')

550

579

datetime.timedelta(7)

580

>>> string_to_delta('5m 30s')

581

datetime.timedelta(0, 330)

551

582

"""

552

try:

553

suffix=unicode(interval[-1])

554

value=int(interval[:-1])

555

if suffix == u"d":

556

delta = datetime.timedelta(value)

557

elif suffix == u"s":

558

delta = datetime.timedelta(0, value)

559

elif suffix == u"m":

560

delta = datetime.timedelta(0, 0, 0, 0, value)

561

elif suffix == u"h":

562

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

563

elif suffix == u"w":

564

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

565

else:

583

timevalue = datetime.timedelta(0)

584

for s in interval.split():

585

try:

586

suffix=unicode(s[-1])

587

value=int(s[:-1])

588

if suffix == u"d":

589

delta = datetime.timedelta(value)

590

elif suffix == u"s":

591

delta = datetime.timedelta(0, value)

592

elif suffix == u"m":

593

delta = datetime.timedelta(0, 0, 0, 0, value)

594

elif suffix == u"h":

595

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

596

elif suffix == u"w":

597

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

598

else:

599

raise ValueError

600

except (ValueError, IndexError):

566

601

raise ValueError

567

except (ValueError, IndexError):

568

raise ValueError

569

return delta

602

timevalue += delta

603

return timevalue

570

604

571

605

572

606

def server_state_changed(state):

573

607

"""Derived from the Avahi example code"""

574

608

if state == avahi.SERVER_COLLISION:

575

logger.warning(u"Server name collision")

609

logger.error(u"Zeroconf server name collision")

576

610

service.remove()

577

611

elif state == avahi.SERVER_RUNNING:

578

612

service.add()

580

614

581

615

def entry_group_state_changed(state, error):

582

616

"""Derived from the Avahi example code"""

583

logger.debug(u"state change: %i", state)

617

logger.debug(u"Avahi state change: %i", state)

584

618

585

619

if state == avahi.ENTRY_GROUP_ESTABLISHED:

586

logger.debug(u"Service established.")

620

logger.debug(u"Zeroconf service established.")

587

621

elif state == avahi.ENTRY_GROUP_COLLISION:

588

logger.warning(u"Service name collision.")

622

logger.warning(u"Zeroconf service name collision.")

589

623

service.rename()

590

624

elif state == avahi.ENTRY_GROUP_FAILURE:

591

logger.critical(u"Error in group state changed %s",

625

logger.critical(u"Avahi: Error in group state changed %s",

592

626

unicode(error))

593

627

raise AvahiGroupError("State changed: %s", str(error))

594

628

595

def if_nametoindex(interface, _func=[None]):

629

def if_nametoindex(interface):

596

630

"""Call the C function if_nametoindex(), or equivalent"""

597

if _func[0] is not None:

598

return _func[0](interface)

631

global if_nametoindex

599

632

try:

600

633

if "ctypes.util" not in sys.modules:

601

634

import ctypes.util

602

while True:

603

try:

604

libc = ctypes.cdll.LoadLibrary\

605

(ctypes.util.find_library("c"))

606

func[0] = libc.if_nametoindex

607

return _func[0](interface)

608

except IOError, e:

609

if e != errno.EINTR:

610

raise

635

if_nametoindex = ctypes.cdll.LoadLibrary\

636

(ctypes.util.find_library("c")).if_nametoindex

611

637

except (OSError, AttributeError):

612

638

if "struct" not in sys.modules:

613

639

import struct

614

640

if "fcntl" not in sys.modules:

615

641

import fcntl

616

def the_hard_way(interface):

642

def if_nametoindex(interface):

617

643

"Get an interface index the hard way, i.e. using fcntl()"

618

644

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

619

645

s = socket.socket()

622

648

s.close()

623

649

interface_index = struct.unpack("I", ifreq[16:20])[0]

624

650

return interface_index

625

_func[0] = the_hard_way

626

return _func[0](interface)

627

628

629

def daemon(nochdir, noclose):

651

return if_nametoindex(interface)

652

653

654

def daemon(nochdir = False, noclose = False):

630

655

"""See daemon(3). Standard BSD Unix function.

631

656

This should really exist as os.daemon, but it doesn't (yet)."""

632

657

if os.fork():

634

659

os.setsid()

635

660

if not nochdir:

636

661

os.chdir("/")

662

if os.fork():

663

sys.exit()

637

664

if not noclose:

638

665

# Close all standard open file descriptors

639

666

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

651

678

global main_loop_started

652

679

main_loop_started = False

653

680

654

parser = OptionParser()

681

parser = OptionParser(version = "%%prog %s" % version)

655

682

parser.add_option("-i", "--interface", type="string",

656

683

metavar="IF", help="Bind to interface IF")

657

684

parser.add_option("-a", "--address", type="string",

660

687

help="Port number to receive requests on")

661

688

parser.add_option("--check", action="store_true", default=False,

662

689

help="Run self-test")

663

parser.add_option("--debug", action="store_true", default=False,

690

parser.add_option("--debug", action="store_true",

664

691

help="Debug mode; run in foreground and log to"

665

692

" terminal")

666

693

parser.add_option("--priority", type="string", help="GnuTLS"

691

718

# Parse config file for server-global settings

692

719

server_config = ConfigParser.SafeConfigParser(server_defaults)

693

720

del server_defaults

694

server_config.read(os.path.join(options.configdir, "server.conf"))

695

server_section = "server"

721

server_config.read(os.path.join(options.configdir, "mandos.conf"))

696

722

# Convert the SafeConfigParser object to a dict

697

server_settings = dict(server_config.items(server_section))

723

server_settings = server_config.defaults()

698

724

# Use getboolean on the boolean config option

699

725

server_settings["debug"] = server_config.getboolean\

700

(server_section, "debug")

726

("DEFAULT", "debug")

701

727

del server_config

702

if not server_settings["interface"]:

703

server_settings["interface"] = avahi.IF_UNSPEC

704

728

705

729

# Override the settings from the config file with command line

706

730

# options, if set.

712

736

del options

713

737

# Now we have our good server settings in "server_settings"

714

738

739

debug = server_settings["debug"]

740

741

if not debug:

742

syslogger.setLevel(logging.WARNING)

743

console.setLevel(logging.WARNING)

744

745

if server_settings["servicename"] != "Mandos":

746

syslogger.setFormatter(logging.Formatter\

747

('Mandos (%s): %%(levelname)s:'

748

' %%(message)s'

749

% server_settings["servicename"]))

750

715

751

# Parse config file with clients

716

752

client_defaults = { "timeout": "1h",

717

753

"interval": "5m",

718

"checker": "fping -q -- %%(fqdn)s",

754

"checker": "fping -q -- %(host)s",

755

"host": "",

719

756

}

720

757

client_config = ConfigParser.SafeConfigParser(client_defaults)

721

758

client_config.read(os.path.join(server_settings["configdir"],

724

761

global service

725

762

service = AvahiService(name = server_settings["servicename"],

726

763

type = "_mandos._tcp", );

764

if server_settings["interface"]:

765

service.interface = if_nametoindex\

766

(server_settings["interface"])

727

767

728

768

global main_loop

729

769

global bus

732

772

DBusGMainLoop(set_as_default=True )

733

773

main_loop = gobject.MainLoop()

734

774

bus = dbus.SystemBus()

735

server = dbus.Interface(

736

bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),

737

avahi.DBUS_INTERFACE_SERVER )

775

server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,

776

avahi.DBUS_PATH_SERVER),

777

avahi.DBUS_INTERFACE_SERVER)

738

778

# End of Avahi example code

739

779

740

debug = server_settings["debug"]

741

742

if debug:

743

console = logging.StreamHandler()

744

# console.setLevel(logging.DEBUG)

745

console.setFormatter(logging.Formatter\

746

('%(levelname)s: %(message)s'))

747

logger.addHandler(console)

748

del console

749

750

780

clients = Set()

751

781

def remove_from_clients(client):

752

782

clients.remove(client)

753

783

if not clients:

754

logger.debug(u"No clients left, exiting")

784

logger.critical(u"No clients left, exiting")

755

785

sys.exit()

756

786

757

clients.update(Set(Client(name=section,

787

clients.update(Set(Client(name = section,

758

788

stop_hook = remove_from_clients,

759

**(dict(client_config\

760

.items(section))))

789

config

790

= dict(client_config.items(section)))

761

791

for section in client_config.sections()))

762

763

if not debug:

764

daemon(False, False)

792

if not clients:

793

logger.critical(u"No clients defined")

794

sys.exit(1)

795

796

if debug:

797

# Redirect stdin so all checkers get /dev/null

798

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

799

os.dup2(null, sys.stdin.fileno())

800

if null > 2:

801

os.close(null)

802

else:

803

# No console logging

804

logger.removeHandler(console)

805

# Close all input and output, do double fork, etc.

806

daemon()

807

808

pidfilename = "/var/run/mandos/mandos.pid"

809

pid = os.getpid()

810

try:

811

pidfile = open(pidfilename, "w")

812

pidfile.write(str(pid) + "\n")

813

pidfile.close()

814

del pidfile

815

except IOError, err:

816

logger.error(u"Could not write %s file with PID %d",

817

pidfilename, os.getpid())

765

818

766

819

def cleanup():

767

820

"Cleanup function; run on exit"

794

847

clients=clients)

795

848

# Find out what port we got

796

849

service.port = tcp_server.socket.getsockname()[1]

797

logger.debug(u"Now listening on port %d", service.port)

850

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

851

u" scope_id %d" % tcp_server.socket.getsockname())

798

852

799

if not server_settings["interface"]:

800

service.interface = if_nametoindex\

801

(server_settings["interface"])

853

#service.interface = tcp_server.socket.getsockname()[3]

802

854

803

855

try:

804

856

# From the Avahi example code

815

867

tcp_server.handle_request\

816

868

(*args[2:], **kwargs) or True)

817

869

818

logger.debug("Starting main loop")

870

logger.debug(u"Starting main loop")

819

871

main_loop_started = True

820

872

main_loop.run()

821

873

except AvahiError, error: