62
28
from dbus.mainloop.glib import DBusGMainLoop
67
logger = logging.Logger('mandos')
68
syslogger = logging.handlers.SysLogHandler\
69
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
71
syslogger.setFormatter(logging.Formatter\
72
('Mandos: %(levelname)s: %(message)s'))
73
logger.addHandler(syslogger)
75
console = logging.StreamHandler()
76
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
78
logger.addHandler(console)
80
class AvahiError(Exception):
81
def __init__(self, value):
84
return repr(self.value)
86
class AvahiServiceError(AvahiError):
89
class AvahiGroupError(AvahiError):
93
class AvahiService(object):
94
"""An Avahi (Zeroconf) service.
96
interface: integer; avahi.IF_UNSPEC or an interface index.
97
Used to optionally bind to the specified interface.
98
name: string; Example: 'Mandos'
99
type: string; Example: '_mandos._tcp'.
100
See <http://www.dns-sd.org/ServiceTypes.html>
101
port: integer; what port to announce
102
TXT: list of strings; TXT record for the service
103
domain: string; Domain to publish on, default to .local if empty.
104
host: string; Host to publish records for, default is localhost
105
max_renames: integer; maximum number of renames
106
rename_count: integer; counter so we only rename after collisions
107
a sensible number of times
109
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
110
type = None, port = None, TXT = None, domain = "",
111
host = "", max_renames = 32768):
112
self.interface = interface
122
self.rename_count = 0
123
self.max_renames = max_renames
125
"""Derived from the Avahi example code"""
126
if self.rename_count >= self.max_renames:
127
logger.critical(u"No suitable Zeroconf service name found"
128
u" after %i retries, exiting.",
130
raise AvahiServiceError("Too many renames")
131
self.name = server.GetAlternativeServiceName(self.name)
132
logger.info(u"Changing Zeroconf service name to %r ...",
134
syslogger.setFormatter(logging.Formatter\
135
('Mandos (%s): %%(levelname)s:'
136
' %%(message)s' % self.name))
139
self.rename_count += 1
141
"""Derived from the Avahi example code"""
142
if group is not None:
145
"""Derived from the Avahi example code"""
148
group = dbus.Interface\
149
(bus.get_object(avahi.DBUS_NAME,
150
server.EntryGroupNew()),
151
avahi.DBUS_INTERFACE_ENTRY_GROUP)
152
group.connect_to_signal('StateChanged',
153
entry_group_state_changed)
154
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
155
service.name, service.type)
157
self.interface, # interface
158
avahi.PROTO_INET6, # protocol
159
dbus.UInt32(0), # flags
160
self.name, self.type,
161
self.domain, self.host,
162
dbus.UInt16(self.port),
163
avahi.string_array_to_txt_array(self.TXT))
166
# From the Avahi example code:
167
group = None # our entry group
31
# This variable is used to optionally bind to a specified interface.
32
# It is a global variable to fit in with the other variables from the
33
# Avahi server example code.
34
serviceInterface = avahi.IF_UNSPEC
35
# From the Avahi server example code:
36
serviceName = "Mandos"
37
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
38
servicePort = None # Not known at startup
39
serviceTXT = [] # TXT record for the service
40
domain = "" # Domain to publish on, default to .local
41
host = "" # Host to publish records for, default to localhost
42
group = None #our entry group
43
rename_count = 12 # Counter so we only rename after collisions a
44
# sensible number of times
168
45
# End of Avahi example code
175
52
fingerprint: string (40 or 32 hexadecimal digits); used to
176
53
uniquely identify the client
177
54
secret: bytestring; sent verbatim (over TLS) to client
178
host: string; available for use by the checker command
179
created: datetime.datetime(); object creation, not client host
180
last_checked_ok: datetime.datetime() or None if not yet checked OK
181
timeout: datetime.timedelta(); How long from last_checked_ok
182
until this client is invalid
55
fqdn: string (FQDN); available for use by the checker command
56
created: datetime.datetime()
57
last_seen: datetime.datetime() or None if not yet seen
58
timeout: datetime.timedelta(); How long from last_seen until
59
this client is invalid
183
60
interval: datetime.timedelta(); How often to start a new checker
184
61
stop_hook: If set, called by stop() as stop_hook(self)
185
62
checker: subprocess.Popen(); a running checker process used
186
63
to see if the client lives.
187
'None' if no process is running.
64
Is None if no process is running.
188
65
checker_initiator_tag: a gobject event source tag, or None
189
66
stop_initiator_tag: - '' -
190
67
checker_callback_tag: - '' -
191
68
checker_command: string; External command which is run to check if
192
client lives. %() expansions are done at
69
client lives. %()s expansions are done at
193
70
runtime with vars(self) as dict, so that for
194
71
instance %(name)s can be used in the command.
195
72
Private attibutes:
196
73
_timeout: Real variable for 'timeout'
197
74
_interval: Real variable for 'interval'
198
_timeout_milliseconds: Used when calling gobject.timeout_add()
75
_timeout_milliseconds: Used by gobject.timeout_add()
199
76
_interval_milliseconds: - '' -
201
78
def _set_timeout(self, timeout):
221
98
interval = property(lambda self: self._interval,
223
100
del _set_interval
224
def __init__(self, name = None, stop_hook=None, config={}):
225
"""Note: the 'checker' key in 'config' sets the
226
'checker_command' attribute and *not* the 'checker'
101
def __init__(self, name=None, options=None, stop_hook=None,
102
fingerprint=None, secret=None, secfile=None, fqdn=None,
103
timeout=None, interval=-1, checker=None):
229
logger.debug(u"Creating client %r", self.name)
230
# Uppercase and remove spaces from fingerprint for later
231
# comparison purposes with return value from the fingerprint()
233
self.fingerprint = config["fingerprint"].upper()\
235
logger.debug(u" Fingerprint: %s", self.fingerprint)
236
if "secret" in config:
237
self.secret = config["secret"].decode(u"base64")
238
elif "secfile" in config:
239
sf = open(config["secfile"])
105
# Uppercase and remove spaces from fingerprint
106
# for later comparison purposes with return value of
107
# the fingerprint() function
108
self.fingerprint = fingerprint.upper().replace(u" ", u"")
110
self.secret = secret.decode(u"base64")
240
113
self.secret = sf.read()
243
raise TypeError(u"No secret or secfile for client %s"
245
self.host = config.get("host", "")
116
raise RuntimeError(u"No secret or secfile for client %s"
118
self.fqdn = fqdn # string
246
119
self.created = datetime.datetime.now()
247
self.last_checked_ok = None
248
self.timeout = string_to_delta(config["timeout"])
249
self.interval = string_to_delta(config["interval"])
120
self.last_seen = None
122
timeout = options.timeout
123
self.timeout = timeout
125
interval = options.interval
127
interval = string_to_delta(interval)
128
self.interval = interval
250
129
self.stop_hook = stop_hook
251
130
self.checker = None
252
131
self.checker_initiator_tag = None
253
132
self.stop_initiator_tag = None
254
133
self.checker_callback_tag = None
255
self.check_command = config["checker"]
134
self.check_command = checker
257
"""Start this client's checker and timeout hooks"""
136
"""Start this clients checker and timeout hooks"""
258
137
# Schedule a new checker to be started an 'interval' from now,
259
138
# and every interval from then on.
260
139
self.checker_initiator_tag = gobject.timeout_add\
288
164
# Do not run this again if called by a gobject.timeout_add
290
166
def __del__(self):
291
self.stop_hook = None
167
# Some code duplication here and in stop()
168
if hasattr(self, "stop_initiator_tag") \
169
and self.stop_initiator_tag:
170
gobject.source_remove(self.stop_initiator_tag)
171
self.stop_initiator_tag = None
172
if hasattr(self, "checker_initiator_tag") \
173
and self.checker_initiator_tag:
174
gobject.source_remove(self.checker_initiator_tag)
175
self.checker_initiator_tag = None
293
177
def checker_callback(self, pid, condition):
294
178
"""The checker has completed, so take appropriate actions."""
295
179
now = datetime.datetime.now()
296
self.checker_callback_tag = None
298
180
if os.WIFEXITED(condition) \
299
181
and (os.WEXITSTATUS(condition) == 0):
300
logger.info(u"Checker for %(name)s succeeded",
302
self.last_checked_ok = now
183
sys.stderr.write(u"Checker for %(name)s succeeded\n"
303
186
gobject.source_remove(self.stop_initiator_tag)
304
187
self.stop_initiator_tag = gobject.timeout_add\
305
188
(self._timeout_milliseconds,
307
elif not os.WIFEXITED(condition):
308
logger.warning(u"Checker for %(name)s crashed?",
311
logger.info(u"Checker for %(name)s failed",
191
if not os.WIFEXITED(condition):
192
sys.stderr.write(u"Checker for %(name)s crashed?\n"
195
sys.stderr.write(u"Checker for %(name)s failed\n"
198
self.checker_callback_tag = None
313
199
def start_checker(self):
314
200
"""Start a new checker subprocess if one is not running.
315
201
If a checker already exists, leave it running and do
317
# The reason for not killing a running checker is that if we
318
# did that, then if a checker (for some reason) started
319
# running slowly and taking more than 'interval' time, the
320
# client would inevitably timeout, since no checker would get
321
# a chance to run to completion. If we instead leave running
322
# checkers alone, the checker would have to take more time
323
# than 'timeout' for the client to be declared invalid, which
324
# is as it should be.
325
203
if self.checker is None:
205
sys.stderr.write(u"Starting checker for %s\n"
327
# In case check_command has exactly one % operator
328
command = self.check_command % self.host
208
command = self.check_command % self.fqdn
329
209
except TypeError:
330
# Escape attributes for the shell
331
210
escaped_attrs = dict((key, re.escape(str(val)))
333
212
vars(self).iteritems())
335
command = self.check_command % escaped_attrs
336
except TypeError, error:
337
logger.error(u'Could not format string "%s":'
338
u' %s', self.check_command, error)
339
return True # Try again later
213
command = self.check_command % escaped_attrs
341
logger.info(u"Starting checker %r for %s",
343
# We don't need to redirect stdout and stderr, since
344
# in normal mode, that is already done by daemon(),
345
# and in debug mode we don't want to. (Stdin is
346
# always replaced by /dev/null.)
347
self.checker = subprocess.Popen(command,
350
self.checker_callback_tag = gobject.child_watch_add\
352
self.checker_callback)
353
except OSError, error:
354
logger.error(u"Failed to start subprocess: %s",
215
self.checker = subprocess.\
217
stdout=subprocess.PIPE,
218
close_fds=True, shell=True,
220
self.checker_callback_tag = gobject.\
221
child_watch_add(self.checker.pid,
224
except subprocess.OSError, error:
225
sys.stderr.write(u"Failed to start subprocess: %s\n"
356
227
# Re-run this periodically if run by gobject.timeout_add
358
229
def stop_checker(self):
359
230
"""Force the checker process, if any, to stop."""
360
if self.checker_callback_tag:
361
gobject.source_remove(self.checker_callback_tag)
362
self.checker_callback_tag = None
363
if getattr(self, "checker", None) is None:
231
if not hasattr(self, "checker") or self.checker is None:
365
logger.debug(u"Stopping checker for %(name)s", vars(self))
367
os.kill(self.checker.pid, signal.SIGTERM)
369
#if self.checker.poll() is None:
370
# os.kill(self.checker.pid, signal.SIGKILL)
371
except OSError, error:
372
if error.errno != errno.ESRCH: # No such process
233
gobject.source_remove(self.checker_callback_tag)
234
self.checker_callback_tag = None
235
os.kill(self.checker.pid, signal.SIGTERM)
236
if self.checker.poll() is None:
237
os.kill(self.checker.pid, signal.SIGKILL)
374
238
self.checker = None
375
def still_valid(self):
239
def still_valid(self, now=None):
376
240
"""Has the timeout not yet passed for this client?"""
377
now = datetime.datetime.now()
378
if self.last_checked_ok is None:
242
now = datetime.datetime.now()
243
if self.last_seen is None:
379
244
return now < (self.created + self.timeout)
381
return now < (self.last_checked_ok + self.timeout)
246
return now < (self.last_seen + self.timeout)
384
249
def peer_certificate(session):
385
"Return the peer's OpenPGP certificate as a bytestring"
386
250
# If not an OpenPGP certificate...
387
251
if gnutls.library.functions.gnutls_certificate_type_get\
388
252
(session._c_object) \
441
298
Note: This will run in its own forked process."""
443
300
def handle(self):
444
logger.info(u"TCP connection from: %s",
445
unicode(self.client_address))
446
session = gnutls.connection.ClientSession\
447
(self.request, gnutls.connection.X509Credentials())
449
line = self.request.makefile().readline()
450
logger.debug(u"Protocol version: %r", line)
452
if int(line.strip().split()[0]) > 1:
454
except (ValueError, IndexError, RuntimeError), error:
455
logger.error(u"Unknown protocol version: %s", error)
458
# Note: gnutls.connection.X509Credentials is really a generic
459
# GnuTLS certificate credentials object so long as no X.509
460
# keys are added to it. Therefore, we can use it here despite
461
# using OpenPGP certificates.
302
sys.stderr.write(u"TCP request came\n")
303
sys.stderr.write(u"Request: %s\n" % self.request)
304
sys.stderr.write(u"Client Address: %s\n"
305
% unicode(self.client_address))
306
sys.stderr.write(u"Server: %s\n" % self.server)
307
session = gnutls.connection.ClientSession(self.request,
463
311
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
464
312
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
466
priority = "NORMAL" # Fallback default, since this
468
if self.server.settings["priority"]:
469
priority = self.server.settings["priority"]
314
priority = "SECURE256"
470
316
gnutls.library.functions.gnutls_priority_set_direct\
471
317
(session._c_object, priority, None);
474
320
session.handshake()
475
321
except gnutls.errors.GNUTLSError, error:
476
logger.warning(u"Handshake failed: %s", error)
323
sys.stderr.write(u"Handshake failed: %s\n" % error)
477
324
# Do not run session.bye() here: the session is not
478
325
# established. Just abandon the request.
481
328
fpr = fingerprint(peer_certificate(session))
482
329
except (TypeError, gnutls.errors.GNUTLSError), error:
483
logger.warning(u"Bad certificate: %s", error)
331
sys.stderr.write(u"Bad certificate: %s\n" % error)
486
logger.debug(u"Fingerprint: %s", fpr)
335
sys.stderr.write(u"Fingerprint: %s\n" % fpr)
488
for c in self.server.clients:
489
338
if c.fingerprint == fpr:
493
logger.warning(u"Client not found for fingerprint: %s",
497
341
# Have to check if client.still_valid(), since it is possible
498
342
# that the client timed out while establishing the GnuTLS
500
if not client.still_valid():
501
logger.warning(u"Client %(name)s is invalid",
344
if (not client) or (not client.still_valid()):
347
sys.stderr.write(u"Client %(name)s is invalid\n"
350
sys.stderr.write(u"Client not found for "
351
u"fingerprint: %s\n" % fpr)
506
355
while sent_size < len(client.secret):
507
356
sent = session.send(client.secret[sent_size:])
508
logger.debug(u"Sent: %d, remaining: %d",
509
sent, len(client.secret)
510
- (sent_size + sent))
358
sys.stderr.write(u"Sent: %d, remaining: %d\n"
359
% (sent, len(client.secret)
360
- (sent_size + sent)))
511
361
sent_size += sent
577
421
datetime.timedelta(1)
578
422
>>> string_to_delta(u'1w')
579
423
datetime.timedelta(7)
580
>>> string_to_delta('5m 30s')
581
datetime.timedelta(0, 330)
583
timevalue = datetime.timedelta(0)
584
for s in interval.split():
586
suffix=unicode(s[-1])
589
delta = datetime.timedelta(value)
591
delta = datetime.timedelta(0, value)
593
delta = datetime.timedelta(0, 0, 0, 0, value)
595
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
597
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
600
except (ValueError, IndexError):
426
suffix=unicode(interval[-1])
427
value=int(interval[:-1])
429
delta = datetime.timedelta(value)
431
delta = datetime.timedelta(0, value)
433
delta = datetime.timedelta(0, 0, 0, 0, value)
435
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
437
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
440
except (ValueError, IndexError):
446
"""From the Avahi server example code"""
447
global group, serviceName, serviceType, servicePort, serviceTXT, \
450
group = dbus.Interface(
451
bus.get_object( avahi.DBUS_NAME,
452
server.EntryGroupNew()),
453
avahi.DBUS_INTERFACE_ENTRY_GROUP)
454
group.connect_to_signal('StateChanged',
455
entry_group_state_changed)
457
sys.stderr.write(u"Adding service '%s' of type '%s' ...\n"
458
% (serviceName, serviceType))
461
serviceInterface, # interface
462
avahi.PROTO_INET6, # protocol
463
dbus.UInt32(0), # flags
464
serviceName, serviceType,
466
dbus.UInt16(servicePort),
467
avahi.string_array_to_txt_array(serviceTXT))
471
def remove_service():
472
"""From the Avahi server example code"""
475
if not group is None:
606
479
def server_state_changed(state):
607
"""Derived from the Avahi example code"""
480
"""From the Avahi server example code"""
608
481
if state == avahi.SERVER_COLLISION:
609
logger.error(u"Zeroconf server name collision")
482
sys.stderr.write(u"WARNING: Server name collision\n")
611
484
elif state == avahi.SERVER_RUNNING:
615
488
def entry_group_state_changed(state, error):
616
"""Derived from the Avahi example code"""
617
logger.debug(u"Avahi state change: %i", state)
489
"""From the Avahi server example code"""
490
global serviceName, server, rename_count
493
sys.stderr.write(u"state change: %i\n" % state)
619
495
if state == avahi.ENTRY_GROUP_ESTABLISHED:
620
logger.debug(u"Zeroconf service established.")
497
sys.stderr.write(u"Service established.\n")
621
498
elif state == avahi.ENTRY_GROUP_COLLISION:
622
logger.warning(u"Zeroconf service name collision.")
500
rename_count = rename_count - 1
502
name = server.GetAlternativeServiceName(name)
503
sys.stderr.write(u"WARNING: Service name collision, "
504
u"changing name to '%s' ...\n" % name)
509
sys.stderr.write(u"ERROR: No suitable service name found "
510
u"after %i retries, exiting.\n"
624
513
elif state == avahi.ENTRY_GROUP_FAILURE:
625
logger.critical(u"Avahi: Error in group state changed %s",
627
raise AvahiGroupError("State changed: %s", str(error))
514
sys.stderr.write(u"Error in group state changed %s\n"
629
520
def if_nametoindex(interface):
630
"""Call the C function if_nametoindex(), or equivalent"""
631
global if_nametoindex
521
"""Call the C function if_nametoindex()"""
633
if "ctypes.util" not in sys.modules:
635
if_nametoindex = ctypes.cdll.LoadLibrary\
636
(ctypes.util.find_library("c")).if_nametoindex
523
libc = ctypes.cdll.LoadLibrary("libc.so.6")
524
return libc.if_nametoindex(interface)
637
525
except (OSError, AttributeError):
638
526
if "struct" not in sys.modules:
640
528
if "fcntl" not in sys.modules:
642
def if_nametoindex(interface):
643
"Get an interface index the hard way, i.e. using fcntl()"
644
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
646
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
647
struct.pack("16s16x", interface))
649
interface_index = struct.unpack("I", ifreq[16:20])[0]
650
return interface_index
651
return if_nametoindex(interface)
654
def daemon(nochdir = False, noclose = False):
655
"""See daemon(3). Standard BSD Unix function.
656
This should really exist as os.daemon, but it doesn't (yet)."""
665
# Close all standard open file descriptors
666
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
667
if not stat.S_ISCHR(os.fstat(null).st_mode):
668
raise OSError(errno.ENODEV,
669
"/dev/null not a character device")
670
os.dup2(null, sys.stdin.fileno())
671
os.dup2(null, sys.stdout.fileno())
672
os.dup2(null, sys.stderr.fileno())
678
global main_loop_started
679
main_loop_started = False
681
parser = OptionParser(version = "%%prog %s" % version)
530
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
532
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
533
struct.pack("16s16x", interface))
535
interface_index = struct.unpack("I", ifreq[16:20])[0]
536
return interface_index
539
if __name__ == '__main__':
540
parser = OptionParser()
682
541
parser.add_option("-i", "--interface", type="string",
683
metavar="IF", help="Bind to interface IF")
684
parser.add_option("-a", "--address", type="string",
685
help="Address to listen for requests on")
686
parser.add_option("-p", "--port", type="int",
542
default=None, metavar="IF",
543
help="Bind to interface IF")
544
parser.add_option("--cert", type="string", default="cert.pem",
546
help="Public key certificate PEM file to use")
547
parser.add_option("--key", type="string", default="key.pem",
549
help="Private key PEM file to use")
550
parser.add_option("--ca", type="string", default="ca.pem",
552
help="Certificate Authority certificate PEM file to use")
553
parser.add_option("--crl", type="string", default="crl.pem",
555
help="Certificate Revokation List PEM file to use")
556
parser.add_option("-p", "--port", type="int", default=None,
687
557
help="Port number to receive requests on")
558
parser.add_option("--timeout", type="string", # Parsed later
560
help="Amount of downtime allowed for clients")
561
parser.add_option("--interval", type="string", # Parsed later
563
help="How often to check that a client is up")
688
564
parser.add_option("--check", action="store_true", default=False,
689
565
help="Run self-test")
690
parser.add_option("--debug", action="store_true",
691
help="Debug mode; run in foreground and log to"
693
parser.add_option("--priority", type="string", help="GnuTLS"
694
" priority string (see GnuTLS documentation)")
695
parser.add_option("--servicename", type="string", metavar="NAME",
696
help="Zeroconf service name")
697
parser.add_option("--configdir", type="string",
698
default="/etc/mandos", metavar="DIR",
699
help="Directory to search for configuration"
566
parser.add_option("--debug", action="store_true", default=False,
701
568
(options, args) = parser.parse_args()
703
570
if options.check:
705
572
doctest.testmod()
708
# Default values for config file for server-global settings
709
server_defaults = { "interface": "",
714
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
715
"servicename": "Mandos",
718
# Parse config file for server-global settings
719
server_config = ConfigParser.SafeConfigParser(server_defaults)
721
server_config.read(os.path.join(options.configdir, "mandos.conf"))
722
# Convert the SafeConfigParser object to a dict
723
server_settings = server_config.defaults()
724
# Use getboolean on the boolean config option
725
server_settings["debug"] = server_config.getboolean\
729
# Override the settings from the config file with command line
731
for option in ("interface", "address", "port", "debug",
732
"priority", "servicename", "configdir"):
733
value = getattr(options, option)
734
if value is not None:
735
server_settings[option] = value
737
# Now we have our good server settings in "server_settings"
739
debug = server_settings["debug"]
742
syslogger.setLevel(logging.WARNING)
743
console.setLevel(logging.WARNING)
745
if server_settings["servicename"] != "Mandos":
746
syslogger.setFormatter(logging.Formatter\
747
('Mandos (%s): %%(levelname)s:'
749
% server_settings["servicename"]))
751
# Parse config file with clients
752
client_defaults = { "timeout": "1h",
754
"checker": "fping -q -- %(host)s",
757
client_config = ConfigParser.SafeConfigParser(client_defaults)
758
client_config.read(os.path.join(server_settings["configdir"],
762
service = AvahiService(name = server_settings["servicename"],
763
type = "_mandos._tcp", );
764
if server_settings["interface"]:
765
service.interface = if_nametoindex\
766
(server_settings["interface"])
771
# From the Avahi example code
575
# Parse the time arguments
577
options.timeout = string_to_delta(options.timeout)
579
parser.error("option --timeout: Unparseable time")
581
options.interval = string_to_delta(options.interval)
583
parser.error("option --interval: Unparseable time")
586
defaults = { "checker": "sleep 1; fping -q -- %%(fqdn)s" }
587
client_config = ConfigParser.SafeConfigParser(defaults)
588
#client_config.readfp(open("secrets.conf"), "secrets.conf")
589
client_config.read("mandos-clients.conf")
591
# From the Avahi server example code
772
592
DBusGMainLoop(set_as_default=True )
773
593
main_loop = gobject.MainLoop()
774
594
bus = dbus.SystemBus()
775
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
776
avahi.DBUS_PATH_SERVER),
777
avahi.DBUS_INTERFACE_SERVER)
595
server = dbus.Interface(
596
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
597
avahi.DBUS_INTERFACE_SERVER )
778
598
# End of Avahi example code
600
debug = options.debug
781
603
def remove_from_clients(client):
782
604
clients.remove(client)
784
logger.critical(u"No clients left, exiting")
607
sys.stderr.write(u"No clients left, exiting\n")
787
clients.update(Set(Client(name = section,
610
clients.update(Set(Client(name=section, options=options,
788
611
stop_hook = remove_from_clients,
790
= dict(client_config.items(section)))
612
**(dict(client_config\
791
614
for section in client_config.sections()))
793
logger.critical(u"No clients defined")
797
# Redirect stdin so all checkers get /dev/null
798
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
799
os.dup2(null, sys.stdin.fileno())
804
logger.removeHandler(console)
805
# Close all input and output, do double fork, etc.
808
pidfilename = "/var/run/mandos/mandos.pid"
811
pidfile = open(pidfilename, "w")
812
pidfile.write(str(pid) + "\n")
816
logger.error(u"Could not write %s file with PID %d",
817
pidfilename, os.getpid())
820
"Cleanup function; run on exit"
822
# From the Avahi example code
823
if not group is None:
826
# End of Avahi example code
829
client = clients.pop()
830
client.stop_hook = None
833
atexit.register(cleanup)
836
signal.signal(signal.SIGINT, signal.SIG_IGN)
837
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
838
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
840
615
for client in clients:
843
tcp_server = IPv6_TCPServer((server_settings["address"],
844
server_settings["port"]),
618
tcp_server = IPv6_TCPServer((None, options.port),
846
settings=server_settings,
848
# Find out what port we got
849
service.port = tcp_server.socket.getsockname()[1]
850
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
851
u" scope_id %d" % tcp_server.socket.getsockname())
853
#service.interface = tcp_server.socket.getsockname()[3]
622
# Find out what random port we got
623
servicePort = tcp_server.socket.getsockname()[1]
625
sys.stderr.write(u"Now listening on port %d\n" % servicePort)
627
if options.interface is not None:
628
serviceInterface = if_nametoindex(options.interface)
630
# From the Avahi server example code
631
server.connect_to_signal("StateChanged", server_state_changed)
632
server_state_changed(server.GetState())
633
# End of Avahi example code
635
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
636
lambda *args, **kwargs:
637
tcp_server.handle_request(*args[2:],
856
# From the Avahi example code
857
server.connect_to_signal("StateChanged", server_state_changed)
859
server_state_changed(server.GetState())
860
except dbus.exceptions.DBusException, error:
861
logger.critical(u"DBusException: %s", error)
863
# End of Avahi example code
865
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
866
lambda *args, **kwargs:
867
tcp_server.handle_request\
868
(*args[2:], **kwargs) or True)
870
logger.debug(u"Starting main loop")
871
main_loop_started = True
873
except AvahiError, error:
874
logger.critical(u"AvahiError: %s" + unicode(error))
876
641
except KeyboardInterrupt:
880
if __name__ == '__main__':
646
# From the Avahi server example code
647
if not group is None:
649
# End of Avahi example code
651
for client in clients:
652
client.stop_hook = None