To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 12
- compare with another revision
- download diff
- download tarball
- view history from revision 12
- Committer: Teddy Hogeborn
- Date: 2008-07-19 18:43:24 UTC
- Revision ID: teddy@fukt.bsnet.se-20080719184324-iwhoa5in75xa0u2u
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
[braxen_client]/password): Removed.
([foo]/fingerprint, [braxen_client]/fingerprint): New.
([foo]/checker): New.
([foo]/secfile): New.
([braxen_client]/secret): New.
* server.py: New "--debug" option to set debug flag. Removed "cert",
"key", "ca", "crl", and "cred" variables. Added default
value for "checker" config file setting. Do not pass
credentials to IPv6_TCPServer constructor.
(debug): New global debug flag. Used by most debugging output code.
(Client.__init__): Keyword argument "dn" replaced by "fingerprint",
"password" renamed to "secret", and "passfile"
renamed to "secfile". New keyword argument
"checker". All callers changed.
(Client.dn): Removed.
(Client.fingerprint): New.
(Client.password): Renamed to "secret"; all users changed.
(Client.passfile): Renamed to "secfile"; all users changed.
(Client.timeout, Client.interval): Changed to be properties; now
automatically updates the
"_timeout_milliseconds" and
"_interval_milliseconds" values.
(Client.timeout_milliseconds): Renamed to "_timeout_milliseconds".
(Client.interval_milliseconds): Renamed to "_interval_milliseconds".
(Client.check_command): New.
(Client.start_checker): Use the new "check_command" attribute.
(peer_certificate, fingerprint): New functions.
(tcp_handler.handle): Use ClientSession with empty credentials
object instead of ServerSession. Set gnutls
priority string. Do not verify peer. Use
fingerprint instead of DN when searching for
clients. Bug fix: Loop sending data so even large
secret data strings are sent.
(IPv6_TCPServer.credentials): Removed.
(if_nametoindex): Do not import ctypes since that is now imported
globally.
[braxen_client]/password): Removed.
([foo]/fingerprint, [braxen_client]/fingerprint): New.
([foo]/checker): New.
([foo]/secfile): New.
([braxen_client]/secret): New.
* server.py: New "--debug" option to set debug flag. Removed "cert",
"key", "ca", "crl", and "cred" variables. Added default
value for "checker" config file setting. Do not pass
credentials to IPv6_TCPServer constructor.
(debug): New global debug flag. Used by most debugging output code.
(Client.__init__): Keyword argument "dn" replaced by "fingerprint",
"password" renamed to "secret", and "passfile"
renamed to "secfile". New keyword argument
"checker". All callers changed.
(Client.dn): Removed.
(Client.fingerprint): New.
(Client.password): Renamed to "secret"; all users changed.
(Client.passfile): Renamed to "secfile"; all users changed.
(Client.timeout, Client.interval): Changed to be properties; now
automatically updates the
"_timeout_milliseconds" and
"_interval_milliseconds" values.
(Client.timeout_milliseconds): Renamed to "_timeout_milliseconds".
(Client.interval_milliseconds): Renamed to "_interval_milliseconds".
(Client.check_command): New.
(Client.start_checker): Use the new "check_command" attribute.
(peer_certificate, fingerprint): New functions.
(tcp_handler.handle): Use ClientSession with empty credentials
object instead of ServerSession. Set gnutls
priority string. Do not verify peer. Use
fingerprint instead of DN when searching for
clients. Bug fix: Loop sending data so even large
secret data strings are sent.
(IPv6_TCPServer.credentials): Removed.
(if_nametoindex): Do not import ctypes since that is now imported
globally.
- files modified:
- Makefile
added
removed
server.py
1
1
#!/usr/bin/python
2
2
3
from __future__ import division
4
3
5
import SocketServer
4
6
import socket
5
7
import select
9
11
import gnutls.crypto
10
12
import gnutls.connection
11
13
import gnutls.errors
14
import gnutls.library.functions
15
import gnutls.library.constants
16
import gnutls.library.types
12
17
import ConfigParser
13
18
import sys
19
import re
20
import os
21
import signal
22
from sets import Set
23
import subprocess
24
25
import dbus
26
import gobject
27
import avahi
28
from dbus.mainloop.glib import DBusGMainLoop
29
import ctypes
30
31
# This variable is used to optionally bind to a specified interface.
32
# It is a global variable to fit in with the other variables from the
33
# Avahi server example code.
34
serviceInterface = avahi.IF_UNSPEC
35
# From the Avahi server example code:
36
serviceName = "Mandos"
37
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
38
servicePort = None # Not known at startup
39
serviceTXT = [] # TXT record for the service
40
domain = "" # Domain to publish on, default to .local
41
host = "" # Host to publish records for, default to localhost
42
group = None #our entry group
43
rename_count = 12 # Counter so we only rename after collisions a
44
# sensible number of times
45
# End of Avahi example code
14
46
15
47
16
48
class Client(object):
17
def __init__(self, name=None, options=None, dn=None,
18
password=None, passfile=None, fqdn=None,
19
timeout=None, interval=-1):
49
"""A representation of a client host served by this server.
50
Attributes:
51
name: string; from the config file, used in log messages
52
fingerprint: string (40 or 32 hexadecimal digits); used to
53
uniquely identify the client
54
secret: bytestring; sent verbatim (over TLS) to client
55
fqdn: string (FQDN); available for use by the checker command
56
created: datetime.datetime()
57
last_seen: datetime.datetime() or None if not yet seen
58
timeout: datetime.timedelta(); How long from last_seen until
59
this client is invalid
60
interval: datetime.timedelta(); How often to start a new checker
61
stop_hook: If set, called by stop() as stop_hook(self)
62
checker: subprocess.Popen(); a running checker process used
63
to see if the client lives.
64
Is None if no process is running.
65
checker_initiator_tag: a gobject event source tag, or None
66
stop_initiator_tag: - '' -
67
checker_callback_tag: - '' -
68
checker_command: string; External command which is run to check if
69
client lives. %()s expansions are done at
70
runtime with vars(self) as dict, so that for
71
instance %(name)s can be used in the command.
72
Private attibutes:
73
_timeout: Real variable for 'timeout'
74
_interval: Real variable for 'interval'
75
_timeout_milliseconds: Used by gobject.timeout_add()
76
_interval_milliseconds: - '' -
77
"""
78
def _set_timeout(self, timeout):
79
"Setter function for 'timeout' attribute"
80
self._timeout = timeout
81
self._timeout_milliseconds = ((self.timeout.days
82
* 24 * 60 * 60 * 1000)
83
+ (self.timeout.seconds * 1000)
84
+ (self.timeout.microseconds
85
// 1000))
86
timeout = property(lambda self: self._timeout,
87
_set_timeout)
88
del _set_timeout
89
def _set_interval(self, interval):
90
"Setter function for 'interval' attribute"
91
self._interval = interval
92
self._interval_milliseconds = ((self.interval.days
93
* 24 * 60 * 60 * 1000)
94
+ (self.interval.seconds
95
* 1000)
96
+ (self.interval.microseconds
97
// 1000))
98
interval = property(lambda self: self._interval,
99
_set_interval)
100
del _set_interval
101
def __init__(self, name=None, options=None, stop_hook=None,
102
fingerprint=None, secret=None, secfile=None, fqdn=None,
103
timeout=None, interval=-1, checker=None):
20
104
self.name = name
21
self.dn = dn
22
if password:
23
self.password = password
24
elif passfile:
25
self.password = open(passfile).readall()
105
# Uppercase and remove spaces from fingerprint
106
# for later comparison purposes with return value of
107
# the fingerprint() function
108
self.fingerprint = fingerprint.upper().replace(u" ", u"")
109
if secret:
110
self.secret = secret.decode(u"base64")
111
elif secfile:
112
sf = open(secfile)
113
self.secret = sf.read()
114
sf.close()
26
115
else:
27
print "No Password or Passfile in client config file"
28
# raise RuntimeError XXX
29
self.password = "gazonk"
30
self.fqdn = fqdn
116
raise RuntimeError(u"No secret or secfile for client %s"
117
% self.name)
118
self.fqdn = fqdn # string
31
119
self.created = datetime.datetime.now()
32
120
self.last_seen = None
33
121
if timeout is None:
35
123
self.timeout = timeout
36
124
if interval == -1:
37
125
interval = options.interval
126
else:
127
interval = string_to_delta(interval)
38
128
self.interval = interval
39
self.next_check = datetime.datetime.now()
40
41
42
class server_metaclass(type):
43
"Common behavior for the UDP and TCP server classes"
44
def __new__(cls, name, bases, attrs):
45
attrs["address_family"] = socket.AF_INET6
46
attrs["allow_reuse_address"] = True
47
def server_bind(self):
48
if self.options.interface:
49
if not hasattr(socket, "SO_BINDTODEVICE"):
50
# From /usr/include/asm-i486/socket.h
51
socket.SO_BINDTODEVICE = 25
52
try:
53
self.socket.setsockopt(socket.SOL_SOCKET,
54
socket.SO_BINDTODEVICE,
55
self.options.interface)
56
except socket.error, error:
57
if error[0] == errno.EPERM:
58
print "Warning: No permission to bind to interface", \
59
self.options.interface
60
else:
61
raise error
62
return super(type(self), self).server_bind()
63
attrs["server_bind"] = server_bind
64
def init(self, *args, **kwargs):
65
if "options" in kwargs:
66
self.options = kwargs["options"]
67
del kwargs["options"]
68
if "clients" in kwargs:
69
self.clients = kwargs["clients"]
70
del kwargs["clients"]
71
if "credentials" in kwargs:
72
self.credentials = kwargs["credentials"]
73
del kwargs["credentials"]
74
return super(type(self), self).__init__(*args, **kwargs)
75
attrs["__init__"] = init
76
return type.__new__(cls, name, bases, attrs)
77
78
79
class udp_handler(SocketServer.DatagramRequestHandler, object):
80
def handle(self):
81
self.wfile.write("Polo")
82
print "UDP request answered"
83
84
85
class IPv6_UDPServer(SocketServer.UDPServer, object):
86
__metaclass__ = server_metaclass
87
def verify_request(self, request, client_address):
88
print "UDP request came"
89
return request[0] == "Marco"
129
self.stop_hook = stop_hook
130
self.checker = None
131
self.checker_initiator_tag = None
132
self.stop_initiator_tag = None
133
self.checker_callback_tag = None
134
self.check_command = checker
135
def start(self):
136
"""Start this clients checker and timeout hooks"""
137
# Schedule a new checker to be started an 'interval' from now,
138
# and every interval from then on.
139
self.checker_initiator_tag = gobject.timeout_add\
140
(self._interval_milliseconds,
141
self.start_checker)
142
# Also start a new checker *right now*.
143
self.start_checker()
144
# Schedule a stop() when 'timeout' has passed
145
self.stop_initiator_tag = gobject.timeout_add\
146
(self._timeout_milliseconds,
147
self.stop)
148
def stop(self):
149
"""Stop this client.
150
The possibility that this client might be restarted is left
151
open, but not currently used."""
152
if debug:
153
sys.stderr.write(u"Stopping client %s\n" % self.name)
154
self.secret = None
155
if self.stop_initiator_tag:
156
gobject.source_remove(self.stop_initiator_tag)
157
self.stop_initiator_tag = None
158
if self.checker_initiator_tag:
159
gobject.source_remove(self.checker_initiator_tag)
160
self.checker_initiator_tag = None
161
self.stop_checker()
162
if self.stop_hook:
163
self.stop_hook(self)
164
# Do not run this again if called by a gobject.timeout_add
165
return False
166
def __del__(self):
167
# Some code duplication here and in stop()
168
if hasattr(self, "stop_initiator_tag") \
169
and self.stop_initiator_tag:
170
gobject.source_remove(self.stop_initiator_tag)
171
self.stop_initiator_tag = None
172
if hasattr(self, "checker_initiator_tag") \
173
and self.checker_initiator_tag:
174
gobject.source_remove(self.checker_initiator_tag)
175
self.checker_initiator_tag = None
176
self.stop_checker()
177
def checker_callback(self, pid, condition):
178
"""The checker has completed, so take appropriate actions."""
179
now = datetime.datetime.now()
180
if os.WIFEXITED(condition) \
181
and (os.WEXITSTATUS(condition) == 0):
182
if debug:
183
sys.stderr.write(u"Checker for %(name)s succeeded\n"
184
% vars(self))
185
self.last_seen = now
186
gobject.source_remove(self.stop_initiator_tag)
187
self.stop_initiator_tag = gobject.timeout_add\
188
(self._timeout_milliseconds,
189
self.stop)
190
elif debug:
191
if not os.WIFEXITED(condition):
192
sys.stderr.write(u"Checker for %(name)s crashed?\n"
193
% vars(self))
194
else:
195
sys.stderr.write(u"Checker for %(name)s failed\n"
196
% vars(self))
197
self.checker = None
198
self.checker_callback_tag = None
199
def start_checker(self):
200
"""Start a new checker subprocess if one is not running.
201
If a checker already exists, leave it running and do
202
nothing."""
203
if self.checker is None:
204
if debug:
205
sys.stderr.write(u"Starting checker for %s\n"
206
% self.name)
207
try:
208
command = self.check_command % self.fqdn
209
except TypeError:
210
escaped_attrs = dict((key, re.escape(str(val)))
211
for key, val in
212
vars(self).iteritems())
213
command = self.check_command % escaped_attrs
214
try:
215
self.checker = subprocess.\
216
Popen(command,
217
stdout=subprocess.PIPE,
218
close_fds=True, shell=True,
219
cwd="/")
220
self.checker_callback_tag = gobject.\
221
child_watch_add(self.checker.pid,
222
self.\
223
checker_callback)
224
except subprocess.OSError, error:
225
sys.stderr.write(u"Failed to start subprocess: %s\n"
226
% error)
227
# Re-run this periodically if run by gobject.timeout_add
228
return True
229
def stop_checker(self):
230
"""Force the checker process, if any, to stop."""
231
if not hasattr(self, "checker") or self.checker is None:
232
return
233
gobject.source_remove(self.checker_callback_tag)
234
self.checker_callback_tag = None
235
os.kill(self.checker.pid, signal.SIGTERM)
236
if self.checker.poll() is None:
237
os.kill(self.checker.pid, signal.SIGKILL)
238
self.checker = None
239
def still_valid(self, now=None):
240
"""Has the timeout not yet passed for this client?"""
241
if now is None:
242
now = datetime.datetime.now()
243
if self.last_seen is None:
244
return now < (self.created + self.timeout)
245
else:
246
return now < (self.last_seen + self.timeout)
247
248
249
def peer_certificate(session):
250
# If not an OpenPGP certificate...
251
if gnutls.library.functions.gnutls_certificate_type_get\
252
(session._c_object) \
253
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
254
# ...do the normal thing
255
return session.peer_certificate
256
list_size = ctypes.c_uint()
257
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
258
(session._c_object, ctypes.byref(list_size))
259
if list_size.value == 0:
260
return None
261
cert = cert_list[0]
262
return ctypes.string_at(cert.data, cert.size)
263
264
265
def fingerprint(openpgp):
266
# New empty GnuTLS certificate
267
crt = gnutls.library.types.gnutls_openpgp_crt_t()
268
gnutls.library.functions.gnutls_openpgp_crt_init\
269
(ctypes.byref(crt))
270
# New GnuTLS "datum" with the OpenPGP public key
271
datum = gnutls.library.types.gnutls_datum_t\
272
(ctypes.cast(ctypes.c_char_p(openpgp),
273
ctypes.POINTER(ctypes.c_ubyte)),
274
ctypes.c_uint(len(openpgp)))
275
# Import the OpenPGP public key into the certificate
276
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
277
(crt,
278
ctypes.byref(datum),
279
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
280
# New buffer for the fingerprint
281
buffer = ctypes.create_string_buffer(20)
282
buffer_length = ctypes.c_size_t()
283
# Get the fingerprint from the certificate into the buffer
284
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
285
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
286
# Deinit the certificate
287
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
288
# Convert the buffer to a Python bytestring
289
fpr = ctypes.string_at(buffer, buffer_length.value)
290
# Convert the bytestring to hexadecimal notation
291
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
292
return hex_fpr
90
293
91
294
92
295
class tcp_handler(SocketServer.BaseRequestHandler, object):
296
"""A TCP request handler class.
297
Instantiated by IPv6_TCPServer for each request to handle it.
298
Note: This will run in its own forked process."""
299
93
300
def handle(self):
94
print "TCP request came"
95
print "Request:", self.request
96
print "Client Address:", self.client_address
97
print "Server:", self.server
98
session = gnutls.connection.ServerSession(self.request,
99
self.server.credentials)
100
session.handshake()
101
if session.peer_certificate:
102
print "DN:", session.peer_certificate.subject
103
try:
104
session.verify_peer()
105
except gnutls.errors.CertificateError, error:
106
print "Verify failed", error
107
session.bye()
108
return
109
try:
110
session.send(dict((client.dn, client.password)
111
for client in self.server.clients)
112
[session.peer_certificate.subject])
113
except KeyError:
114
session.send("gazonk")
115
# Log maybe? XXX
301
if debug:
302
sys.stderr.write(u"TCP request came\n")
303
sys.stderr.write(u"Request: %s\n" % self.request)
304
sys.stderr.write(u"Client Address: %s\n"
305
% unicode(self.client_address))
306
sys.stderr.write(u"Server: %s\n" % self.server)
307
session = gnutls.connection.ClientSession(self.request,
308
gnutls.connection.\
309
X509Credentials())
310
311
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
312
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
313
# "+DHE-DSS"))
314
priority = "SECURE256"
315
316
gnutls.library.functions.gnutls_priority_set_direct\
317
(session._c_object, priority, None);
318
319
try:
320
session.handshake()
321
except gnutls.errors.GNUTLSError, error:
322
if debug:
323
sys.stderr.write(u"Handshake failed: %s\n" % error)
324
# Do not run session.bye() here: the session is not
325
# established. Just abandon the request.
326
return
327
try:
328
fpr = fingerprint(peer_certificate(session))
329
except (TypeError, gnutls.errors.GNUTLSError), error:
330
if debug:
331
sys.stderr.write(u"Bad certificate: %s\n" % error)
332
session.bye()
333
return
334
if debug:
335
sys.stderr.write(u"Fingerprint: %s\n" % fpr)
336
client = None
337
for c in clients:
338
if c.fingerprint == fpr:
339
client = c
340
break
341
# Have to check if client.still_valid(), since it is possible
342
# that the client timed out while establishing the GnuTLS
343
# session.
344
if (not client) or (not client.still_valid()):
345
if debug:
346
if client:
347
sys.stderr.write(u"Client %(name)s is invalid\n"
348
% vars(client))
349
else:
350
sys.stderr.write(u"Client not found for "
351
u"fingerprint: %s\n" % fpr)
352
session.bye()
353
return
354
sent_size = 0
355
while sent_size < len(client.secret):
356
sent = session.send(client.secret[sent_size:])
357
if debug:
358
sys.stderr.write(u"Sent: %d, remaining: %d\n"
359
% (sent, len(client.secret)
360
- (sent_size + sent)))
361
sent_size += sent
116
362
session.bye()
117
363
118
364
119
365
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
120
__metaclass__ = server_metaclass
121
request_queue_size = 1024
122
123
124
in6addr_any = "::"
125
126
cred = None
366
"""IPv6 TCP server. Accepts 'None' as address and/or port.
367
Attributes:
368
options: Command line options
369
clients: Set() of Client objects
370
"""
371
address_family = socket.AF_INET6
372
def __init__(self, *args, **kwargs):
373
if "options" in kwargs:
374
self.options = kwargs["options"]
375
del kwargs["options"]
376
if "clients" in kwargs:
377
self.clients = kwargs["clients"]
378
del kwargs["clients"]
379
return super(type(self), self).__init__(*args, **kwargs)
380
def server_bind(self):
381
"""This overrides the normal server_bind() function
382
to bind to an interface if one was specified, and also NOT to
383
bind to an address or port if they were not specified."""
384
if self.options.interface:
385
if not hasattr(socket, "SO_BINDTODEVICE"):
386
# From /usr/include/asm-i486/socket.h
387
socket.SO_BINDTODEVICE = 25
388
try:
389
self.socket.setsockopt(socket.SOL_SOCKET,
390
socket.SO_BINDTODEVICE,
391
self.options.interface)
392
except socket.error, error:
393
if error[0] == errno.EPERM:
394
sys.stderr.write(u"Warning: No permission to" \
395
u" bind to interface %s\n"
396
% self.options.interface)
397
else:
398
raise error
399
# Only bind(2) the socket if we really need to.
400
if self.server_address[0] or self.server_address[1]:
401
if not self.server_address[0]:
402
in6addr_any = "::"
403
self.server_address = (in6addr_any,
404
self.server_address[1])
405
elif self.server_address[1] is None:
406
self.server_address = (self.server_address[0],
407
0)
408
return super(type(self), self).server_bind()
409
127
410
128
411
def string_to_delta(interval):
129
412
"""Parse a string and return a datetime.timedelta
158
441
raise ValueError
159
442
return delta
160
443
161
def main():
444
445
def add_service():
446
"""From the Avahi server example code"""
447
global group, serviceName, serviceType, servicePort, serviceTXT, \
448
domain, host
449
if group is None:
450
group = dbus.Interface(
451
bus.get_object( avahi.DBUS_NAME,
452
server.EntryGroupNew()),
453
avahi.DBUS_INTERFACE_ENTRY_GROUP)
454
group.connect_to_signal('StateChanged',
455
entry_group_state_changed)
456
if debug:
457
sys.stderr.write(u"Adding service '%s' of type '%s' ...\n"
458
% (serviceName, serviceType))
459
460
group.AddService(
461
serviceInterface, # interface
462
avahi.PROTO_INET6, # protocol
463
dbus.UInt32(0), # flags
464
serviceName, serviceType,
465
domain, host,
466
dbus.UInt16(servicePort),
467
avahi.string_array_to_txt_array(serviceTXT))
468
group.Commit()
469
470
471
def remove_service():
472
"""From the Avahi server example code"""
473
global group
474
475
if not group is None:
476
group.Reset()
477
478
479
def server_state_changed(state):
480
"""From the Avahi server example code"""
481
if state == avahi.SERVER_COLLISION:
482
sys.stderr.write(u"WARNING: Server name collision\n")
483
remove_service()
484
elif state == avahi.SERVER_RUNNING:
485
add_service()
486
487
488
def entry_group_state_changed(state, error):
489
"""From the Avahi server example code"""
490
global serviceName, server, rename_count
491
492
if debug:
493
sys.stderr.write(u"state change: %i\n" % state)
494
495
if state == avahi.ENTRY_GROUP_ESTABLISHED:
496
if debug:
497
sys.stderr.write(u"Service established.\n")
498
elif state == avahi.ENTRY_GROUP_COLLISION:
499
500
rename_count = rename_count - 1
501
if rename_count > 0:
502
name = server.GetAlternativeServiceName(name)
503
sys.stderr.write(u"WARNING: Service name collision, "
504
u"changing name to '%s' ...\n" % name)
505
remove_service()
506
add_service()
507
508
else:
509
sys.stderr.write(u"ERROR: No suitable service name found "
510
u"after %i retries, exiting.\n"
511
% n_rename)
512
main_loop.quit()
513
elif state == avahi.ENTRY_GROUP_FAILURE:
514
sys.stderr.write(u"Error in group state changed %s\n"
515
% unicode(error))
516
main_loop.quit()
517
return
518
519
520
def if_nametoindex(interface):
521
"""Call the C function if_nametoindex()"""
522
try:
523
libc = ctypes.cdll.LoadLibrary("libc.so.6")
524
return libc.if_nametoindex(interface)
525
except (OSError, AttributeError):
526
if "struct" not in sys.modules:
527
import struct
528
if "fcntl" not in sys.modules:
529
import fcntl
530
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
531
s = socket.socket()
532
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
533
struct.pack("16s16x", interface))
534
s.close()
535
interface_index = struct.unpack("I", ifreq[16:20])[0]
536
return interface_index
537
538
539
if __name__ == '__main__':
162
540
parser = OptionParser()
163
541
parser.add_option("-i", "--interface", type="string",
164
default="eth0", metavar="IF",
165
help="Interface to bind to")
542
default=None, metavar="IF",
543
help="Bind to interface IF")
166
544
parser.add_option("--cert", type="string", default="cert.pem",
167
545
metavar="FILE",
168
help="Public key certificate to use")
546
help="Public key certificate PEM file to use")
169
547
parser.add_option("--key", type="string", default="key.pem",
170
548
metavar="FILE",
171
help="Private key to use")
549
help="Private key PEM file to use")
172
550
parser.add_option("--ca", type="string", default="ca.pem",
173
551
metavar="FILE",
174
help="Certificate Authority certificate to use")
552
help="Certificate Authority certificate PEM file to use")
175
553
parser.add_option("--crl", type="string", default="crl.pem",
176
554
metavar="FILE",
177
help="Certificate Revokation List to use")
178
parser.add_option("-p", "--port", type="int", default=49001,
555
help="Certificate Revokation List PEM file to use")
556
parser.add_option("-p", "--port", type="int", default=None,
179
557
help="Port number to receive requests on")
180
parser.add_option("--dh", type="int", metavar="BITS",
181
help="DH group to use")
182
parser.add_option("-t", "--timeout", type="string", # Parsed later
183
default="15m",
558
parser.add_option("--timeout", type="string", # Parsed later
559
default="1h",
184
560
help="Amount of downtime allowed for clients")
185
561
parser.add_option("--interval", type="string", # Parsed later
186
562
default="5m",
187
563
help="How often to check that a client is up")
188
564
parser.add_option("--check", action="store_true", default=False,
189
565
help="Run self-test")
566
parser.add_option("--debug", action="store_true", default=False,
567
help="Debug mode")
190
568
(options, args) = parser.parse_args()
191
569
192
570
if options.check:
193
571
import doctest
194
572
doctest.testmod()
199
577
options.timeout = string_to_delta(options.timeout)
200
578
except ValueError:
201
579
parser.error("option --timeout: Unparseable time")
202
203
580
try:
204
581
options.interval = string_to_delta(options.interval)
205
582
except ValueError:
206
583
parser.error("option --interval: Unparseable time")
207
584
208
cert = gnutls.crypto.X509Certificate(open(options.cert).read())
209
key = gnutls.crypto.X509PrivateKey(open(options.key).read())
210
ca = gnutls.crypto.X509Certificate(open(options.ca).read())
211
crl = gnutls.crypto.X509CRL(open(options.crl).read())
212
cred = gnutls.connection.X509Credentials(cert, key, [ca], [crl])
213
214
585
# Parse config file
215
defaults = {}
216
client_config_object = ConfigParser.SafeConfigParser(defaults)
217
client_config_object.read("mandos-clients.conf")
218
clients = [Client(name=section, options=options,
219
**(dict(client_config_object.items(section))))
220
for section in client_config_object.sections()]
221
222
udp_server = IPv6_UDPServer((in6addr_any, options.port),
223
udp_handler,
224
options=options)
225
226
tcp_server = IPv6_TCPServer((in6addr_any, options.port),
586
defaults = { "checker": "sleep 1; fping -q -- %%(fqdn)s" }
587
client_config = ConfigParser.SafeConfigParser(defaults)
588
#client_config.readfp(open("secrets.conf"), "secrets.conf")
589
client_config.read("mandos-clients.conf")
590
591
# From the Avahi server example code
592
DBusGMainLoop(set_as_default=True )
593
main_loop = gobject.MainLoop()
594
bus = dbus.SystemBus()
595
server = dbus.Interface(
596
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
597
avahi.DBUS_INTERFACE_SERVER )
598
# End of Avahi example code
599
600
debug = options.debug
601
602
clients = Set()
603
def remove_from_clients(client):
604
clients.remove(client)
605
if not clients:
606
if debug:
607
sys.stderr.write(u"No clients left, exiting\n")
608
main_loop.quit()
609
610
clients.update(Set(Client(name=section, options=options,
611
stop_hook = remove_from_clients,
612
**(dict(client_config\
613
.items(section))))
614
for section in client_config.sections()))
615
for client in clients:
616
client.start()
617
618
tcp_server = IPv6_TCPServer((None, options.port),
227
619
tcp_handler,
228
620
options=options,
229
clients=clients,
230
credentials=cred)
231
232
while True:
233
in_, out, err = select.select((udp_server,
234
tcp_server), (), ())
235
for server in in_:
236
server.handle_request()
237
238
239
if __name__ == "__main__":
240
main()
241
621
clients=clients)
622
# Find out what random port we got
623
servicePort = tcp_server.socket.getsockname()[1]
624
if debug:
625
sys.stderr.write(u"Now listening on port %d\n" % servicePort)
626
627
if options.interface is not None:
628
serviceInterface = if_nametoindex(options.interface)
629
630
# From the Avahi server example code
631
server.connect_to_signal("StateChanged", server_state_changed)
632
server_state_changed(server.GetState())
633
# End of Avahi example code
634
635
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
636
lambda *args, **kwargs:
637
tcp_server.handle_request(*args[2:],
638
**kwargs) or True)
639
try:
640
main_loop.run()
641
except KeyboardInterrupt:
642
print
643
644
# Cleanup here
645
646
# From the Avahi server example code
647
if not group is None:
648
group.Free()
649
# End of Avahi example code
650
651
for client in clients:
652
client.stop_hook = None
653
client.stop()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0