To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 13
- compare with another revision
- download diff
- download tarball
- view history from revision 13
- Committer: Björn Påhlsson
- Date: 2008-07-20 02:52:20 UTC
- Revision ID: belorn@braxen-20080720025220-r5u0388uy9iu23h6
Added following support:
Pluginbased client handler
rewritten Mandos client
Avahi instead of udp server discovery
openpgp encrypted key support
Passprompt stand alone application for direct console input
Added logging for Mandos server
Pluginbased client handler
rewritten Mandos client
Avahi instead of udp server discovery
openpgp encrypted key support
Passprompt stand alone application for direct console input
Added logging for Mandos server
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- clients.conf => mandos-clients.conf
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos => server.py
- files modified:
- Makefile
added
removed
server.py
1
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
# Mandos server - give out binary blobs to connecting clients.
5
#
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
#
13
# Everything else is
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
15
#
16
# This program is free software: you can redistribute it and/or modify
17
# it under the terms of the GNU General Public License as published by
18
# the Free Software Foundation, either version 3 of the License, or
19
# (at your option) any later version.
20
#
21
# This program is distributed in the hope that it will be useful,
22
# but WITHOUT ANY WARRANTY; without even the implied warranty of
23
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24
# GNU General Public License for more details.
25
#
26
# You should have received a copy of the GNU General Public License
27
# along with this program. If not, see
28
# <http://www.gnu.org/licenses/>.
29
#
30
# Contact the authors at <mandos@fukt.bsnet.se>.
31
#
32
2
33
from __future__ import division, with_statement, absolute_import
3
from __future__ import division
34
4
35
5
import SocketServer
36
6
import socket
7
import select
37
8
from optparse import OptionParser
38
9
import datetime
39
10
import errno
50
21
import signal
51
22
from sets import Set
52
23
import subprocess
53
import atexit
54
import stat
55
import logging
56
import logging.handlers
57
import pwd
58
from contextlib import closing
59
24
60
25
import dbus
61
import dbus.service
62
26
import gobject
63
27
import avahi
64
28
from dbus.mainloop.glib import DBusGMainLoop
65
29
import ctypes
66
import ctypes.util
67
68
version = "1.0.2"
30
31
import logging
32
import logging.handlers
33
34
# logghandler.setFormatter(logging.Formatter('%(levelname)s %(message)s')
69
35
70
36
logger = logging.Logger('mandos')
71
syslogger = logging.handlers.SysLogHandler\
72
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
73
address = "/dev/log")
74
syslogger.setFormatter(logging.Formatter\
75
('Mandos: %(levelname)s: %(message)s'))
76
logger.addHandler(syslogger)
77
78
console = logging.StreamHandler()
79
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
80
' %(message)s'))
81
logger.addHandler(console)
82
83
class AvahiError(Exception):
84
def __init__(self, value):
85
self.value = value
86
super(AvahiError, self).__init__()
87
def __str__(self):
88
return repr(self.value)
89
90
class AvahiServiceError(AvahiError):
91
pass
92
93
class AvahiGroupError(AvahiError):
94
pass
95
96
97
class AvahiService(object):
98
"""An Avahi (Zeroconf) service.
99
Attributes:
100
interface: integer; avahi.IF_UNSPEC or an interface index.
101
Used to optionally bind to the specified interface.
102
name: string; Example: 'Mandos'
103
type: string; Example: '_mandos._tcp'.
104
See <http://www.dns-sd.org/ServiceTypes.html>
105
port: integer; what port to announce
106
TXT: list of strings; TXT record for the service
107
domain: string; Domain to publish on, default to .local if empty.
108
host: string; Host to publish records for, default is localhost
109
max_renames: integer; maximum number of renames
110
rename_count: integer; counter so we only rename after collisions
111
a sensible number of times
112
"""
113
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
114
servicetype = None, port = None, TXT = None, domain = "",
115
host = "", max_renames = 32768):
116
self.interface = interface
117
self.name = name
118
self.type = servicetype
119
self.port = port
120
if TXT is None:
121
self.TXT = []
122
else:
123
self.TXT = TXT
124
self.domain = domain
125
self.host = host
126
self.rename_count = 0
127
self.max_renames = max_renames
128
def rename(self):
129
"""Derived from the Avahi example code"""
130
if self.rename_count >= self.max_renames:
131
logger.critical(u"No suitable Zeroconf service name found"
132
u" after %i retries, exiting.",
133
self.rename_count)
134
raise AvahiServiceError("Too many renames")
135
self.name = server.GetAlternativeServiceName(self.name)
136
logger.info(u"Changing Zeroconf service name to %r ...",
137
str(self.name))
138
syslogger.setFormatter(logging.Formatter\
139
('Mandos (%s): %%(levelname)s:'
140
' %%(message)s' % self.name))
141
self.remove()
142
self.add()
143
self.rename_count += 1
144
def remove(self):
145
"""Derived from the Avahi example code"""
146
if group is not None:
147
group.Reset()
148
def add(self):
149
"""Derived from the Avahi example code"""
150
global group
151
if group is None:
152
group = dbus.Interface\
153
(bus.get_object(avahi.DBUS_NAME,
154
server.EntryGroupNew()),
155
avahi.DBUS_INTERFACE_ENTRY_GROUP)
156
group.connect_to_signal('StateChanged',
157
entry_group_state_changed)
158
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
159
service.name, service.type)
160
group.AddService(
161
self.interface, # interface
162
avahi.PROTO_INET6, # protocol
163
dbus.UInt32(0), # flags
164
self.name, self.type,
165
self.domain, self.host,
166
dbus.UInt16(self.port),
167
avahi.string_array_to_txt_array(self.TXT))
168
group.Commit()
169
170
# From the Avahi example code:
171
group = None # our entry group
37
logger.addHandler(logging.handlers.SysLogHandler(facility = logging.handlers.SysLogHandler.LOG_DAEMON))
38
39
# This variable is used to optionally bind to a specified interface.
40
# It is a global variable to fit in with the other variables from the
41
# Avahi server example code.
42
serviceInterface = avahi.IF_UNSPEC
43
# From the Avahi server example code:
44
serviceName = "Mandos"
45
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
46
servicePort = None # Not known at startup
47
serviceTXT = [] # TXT record for the service
48
domain = "" # Domain to publish on, default to .local
49
host = "" # Host to publish records for, default to localhost
50
group = None #our entry group
51
rename_count = 12 # Counter so we only rename after collisions a
52
# sensible number of times
172
53
# End of Avahi example code
173
54
174
55
175
class Client(dbus.service.Object):
56
class Client(object):
176
57
"""A representation of a client host served by this server.
177
58
Attributes:
178
59
name: string; from the config file, used in log messages
179
60
fingerprint: string (40 or 32 hexadecimal digits); used to
180
61
uniquely identify the client
181
62
secret: bytestring; sent verbatim (over TLS) to client
182
host: string; available for use by the checker command
183
created: datetime.datetime(); object creation, not client host
184
started: bool()
185
last_checked_ok: datetime.datetime() or None if not yet checked OK
186
timeout: datetime.timedelta(); How long from last_checked_ok
187
until this client is invalid
63
fqdn: string (FQDN); available for use by the checker command
64
created: datetime.datetime()
65
last_seen: datetime.datetime() or None if not yet seen
66
timeout: datetime.timedelta(); How long from last_seen until
67
this client is invalid
188
68
interval: datetime.timedelta(); How often to start a new checker
189
69
stop_hook: If set, called by stop() as stop_hook(self)
190
70
checker: subprocess.Popen(); a running checker process used
191
71
to see if the client lives.
192
'None' if no process is running.
72
Is None if no process is running.
193
73
checker_initiator_tag: a gobject event source tag, or None
194
74
stop_initiator_tag: - '' -
195
75
checker_callback_tag: - '' -
196
76
checker_command: string; External command which is run to check if
197
client lives. %() expansions are done at
77
client lives. %()s expansions are done at
198
78
runtime with vars(self) as dict, so that for
199
79
instance %(name)s can be used in the command.
200
80
Private attibutes:
201
81
_timeout: Real variable for 'timeout'
202
82
_interval: Real variable for 'interval'
203
_timeout_milliseconds: Used when calling gobject.timeout_add()
83
_timeout_milliseconds: Used by gobject.timeout_add()
204
84
_interval_milliseconds: - '' -
205
85
"""
206
interface = u"org.mandos_system.Mandos.Clients"
207
208
@dbus.service.method(interface, out_signature="s")
209
def getName(self):
210
"D-Bus getter method"
211
return self.name
212
213
@dbus.service.method(interface, out_signature="s")
214
def getFingerprint(self):
215
"D-Bus getter method"
216
return self.fingerprint
217
218
@dbus.service.method(interface, in_signature="ay",
219
byte_arrays=True)
220
def setSecret(self, secret):
221
"D-Bus setter method"
222
self.secret = secret
223
224
86
def _set_timeout(self, timeout):
225
"Setter function for the 'timeout' attribute"
87
"Setter function for 'timeout' attribute"
226
88
self._timeout = timeout
227
89
self._timeout_milliseconds = ((self.timeout.days
228
90
* 24 * 60 * 60 * 1000)
229
91
+ (self.timeout.seconds * 1000)
230
92
+ (self.timeout.microseconds
231
93
// 1000))
232
# Emit D-Bus signal
233
self.TimeoutChanged(self._timeout_milliseconds)
234
timeout = property(lambda self: self._timeout, _set_timeout)
94
timeout = property(lambda self: self._timeout,
95
_set_timeout)
235
96
del _set_timeout
236
237
@dbus.service.method(interface, out_signature="t")
238
def getTimeout(self):
239
"D-Bus getter method"
240
return self._timeout_milliseconds
241
242
@dbus.service.signal(interface, signature="t")
243
def TimeoutChanged(self, t):
244
"D-Bus signal"
245
pass
246
247
97
def _set_interval(self, interval):
248
"Setter function for the 'interval' attribute"
98
"Setter function for 'interval' attribute"
249
99
self._interval = interval
250
100
self._interval_milliseconds = ((self.interval.days
251
101
* 24 * 60 * 60 * 1000)
253
103
* 1000)
254
104
+ (self.interval.microseconds
255
105
// 1000))
256
# Emit D-Bus signal
257
self.IntervalChanged(self._interval_milliseconds)
258
interval = property(lambda self: self._interval, _set_interval)
106
interval = property(lambda self: self._interval,
107
_set_interval)
259
108
del _set_interval
260
261
@dbus.service.method(interface, out_signature="t")
262
def getInterval(self):
263
"D-Bus getter method"
264
return self._interval_milliseconds
265
266
@dbus.service.signal(interface, signature="t")
267
def IntervalChanged(self, t):
268
"D-Bus signal"
269
pass
270
271
def __init__(self, name = None, stop_hook=None, config=None):
272
"""Note: the 'checker' key in 'config' sets the
273
'checker_command' attribute and *not* the 'checker'
274
attribute."""
275
dbus.service.Object.__init__(self, bus,
276
"/Mandos/Clients/%s"
277
% name.replace(".", "_"))
278
if config is None:
279
config = {}
109
def __init__(self, name=None, options=None, stop_hook=None,
110
fingerprint=None, secret=None, secfile=None, fqdn=None,
111
timeout=None, interval=-1, checker=None):
280
112
self.name = name
281
logger.debug(u"Creating client %r", self.name)
282
# Uppercase and remove spaces from fingerprint for later
283
# comparison purposes with return value from the fingerprint()
284
# function
285
self.fingerprint = config["fingerprint"].upper()\
286
.replace(u" ", u"")
287
logger.debug(u" Fingerprint: %s", self.fingerprint)
288
if "secret" in config:
289
self.secret = config["secret"].decode(u"base64")
290
elif "secfile" in config:
291
with closing(open(os.path.expanduser
292
(os.path.expandvars
293
(config["secfile"])))) \
294
as secfile:
295
self.secret = secfile.read()
113
# Uppercase and remove spaces from fingerprint
114
# for later comparison purposes with return value of
115
# the fingerprint() function
116
self.fingerprint = fingerprint.upper().replace(u" ", u"")
117
if secret:
118
self.secret = secret.decode(u"base64")
119
elif secfile:
120
sf = open(secfile)
121
self.secret = sf.read()
122
sf.close()
296
123
else:
297
raise TypeError(u"No secret or secfile for client %s"
298
% self.name)
299
self.host = config.get("host", "")
124
raise RuntimeError(u"No secret or secfile for client %s"
125
% self.name)
126
self.fqdn = fqdn # string
300
127
self.created = datetime.datetime.now()
301
self.started = False
302
self.last_checked_ok = None
303
self.timeout = string_to_delta(config["timeout"])
304
self.interval = string_to_delta(config["interval"])
128
self.last_seen = None
129
if timeout is None:
130
timeout = options.timeout
131
self.timeout = timeout
132
if interval == -1:
133
interval = options.interval
134
else:
135
interval = string_to_delta(interval)
136
self.interval = interval
305
137
self.stop_hook = stop_hook
306
138
self.checker = None
307
139
self.checker_initiator_tag = None
308
140
self.stop_initiator_tag = None
309
141
self.checker_callback_tag = None
310
self.check_command = config["checker"]
311
142
self.check_command = checker
312
143
def start(self):
313
"""Start this client's checker and timeout hooks"""
314
self.started = True
144
"""Start this clients checker and timeout hooks"""
315
145
# Schedule a new checker to be started an 'interval' from now,
316
146
# and every interval from then on.
317
147
self.checker_initiator_tag = gobject.timeout_add\
323
153
self.stop_initiator_tag = gobject.timeout_add\
324
154
(self._timeout_milliseconds,
325
155
self.stop)
326
# Emit D-Bus signal
327
self.StateChanged(True)
328
329
@dbus.service.signal(interface, signature="b")
330
def StateChanged(self, started):
331
"D-Bus signal"
332
pass
333
334
156
def stop(self):
335
"""Stop this client."""
336
if getattr(self, "started", False):
337
logger.info(u"Stopping client %s", self.name)
338
else:
339
return False
340
if getattr(self, "stop_initiator_tag", False):
157
"""Stop this client.
158
The possibility that this client might be restarted is left
159
open, but not currently used."""
160
logger.debug(u"Stopping client %s", self.name)
161
self.secret = None
162
if self.stop_initiator_tag:
341
163
gobject.source_remove(self.stop_initiator_tag)
342
164
self.stop_initiator_tag = None
343
if getattr(self, "checker_initiator_tag", False):
165
if self.checker_initiator_tag:
344
166
gobject.source_remove(self.checker_initiator_tag)
345
167
self.checker_initiator_tag = None
346
168
self.stop_checker()
347
169
if self.stop_hook:
348
170
self.stop_hook(self)
349
# Emit D-Bus signal
350
self.StateChanged(False)
351
171
# Do not run this again if called by a gobject.timeout_add
352
172
return False
353
# D-Bus variant
354
Stop = dbus.service.method(interface)(stop)
355
356
173
def __del__(self):
357
self.stop_hook = None
358
self.stop()
359
174
# Some code duplication here and in stop()
175
if hasattr(self, "stop_initiator_tag") \
176
and self.stop_initiator_tag:
177
gobject.source_remove(self.stop_initiator_tag)
178
self.stop_initiator_tag = None
179
if hasattr(self, "checker_initiator_tag") \
180
and self.checker_initiator_tag:
181
gobject.source_remove(self.checker_initiator_tag)
182
self.checker_initiator_tag = None
183
self.stop_checker()
360
184
def checker_callback(self, pid, condition):
361
185
"""The checker has completed, so take appropriate actions."""
362
self.checker_callback_tag = None
363
self.checker = None
186
now = datetime.datetime.now()
364
187
if os.WIFEXITED(condition) \
365
188
and (os.WEXITSTATUS(condition) == 0):
366
logger.info(u"Checker for %(name)s succeeded",
367
vars(self))
368
# Emit D-Bus signal
369
self.CheckerCompleted(True)
370
self.bump_timeout()
371
elif not os.WIFEXITED(condition):
189
logger.debug(u"Checker for %(name)s succeeded",
190
vars(self))
191
self.last_seen = now
192
gobject.source_remove(self.stop_initiator_tag)
193
self.stop_initiator_tag = gobject.timeout_add\
194
(self._timeout_milliseconds,
195
self.stop)
196
if not os.WIFEXITED(condition):
372
197
logger.warning(u"Checker for %(name)s crashed?",
373
198
vars(self))
374
# Emit D-Bus signal
375
self.CheckerCompleted(False)
376
199
else:
377
logger.info(u"Checker for %(name)s failed",
378
vars(self))
379
# Emit D-Bus signal
380
self.CheckerCompleted(False)
381
382
@dbus.service.signal(interface, signature="b")
383
def CheckerCompleted(self, success):
384
"D-Bus signal"
385
pass
386
387
def bump_timeout(self):
388
"""Bump up the timeout for this client.
389
This should only be called when the client has been seen,
390
alive and well.
391
"""
392
self.last_checked_ok = datetime.datetime.now()
393
gobject.source_remove(self.stop_initiator_tag)
394
self.stop_initiator_tag = gobject.timeout_add\
395
(self._timeout_milliseconds, self.stop)
396
# D-Bus variant
397
bumpTimeout = dbus.service.method(interface)(bump_timeout)
398
200
logger.debug(u"Checker for %(name)s failed",
201
vars(self))
202
self.checker = None
203
self.checker_callback_tag = None
399
204
def start_checker(self):
400
205
"""Start a new checker subprocess if one is not running.
401
206
If a checker already exists, leave it running and do
402
207
nothing."""
403
# The reason for not killing a running checker is that if we
404
# did that, then if a checker (for some reason) started
405
# running slowly and taking more than 'interval' time, the
406
# client would inevitably timeout, since no checker would get
407
# a chance to run to completion. If we instead leave running
408
# checkers alone, the checker would have to take more time
409
# than 'timeout' for the client to be declared invalid, which
410
# is as it should be.
411
208
if self.checker is None:
209
logger.debug(u"Starting checker for %s",
210
self.name)
412
211
try:
413
# In case check_command has exactly one % operator
414
command = self.check_command % self.host
212
command = self.check_command % self.fqdn
415
213
except TypeError:
416
# Escape attributes for the shell
417
214
escaped_attrs = dict((key, re.escape(str(val)))
418
215
for key, val in
419
216
vars(self).iteritems())
420
217
try:
421
218
command = self.check_command % escaped_attrs
422
219
except TypeError, error:
423
logger.error(u'Could not format string "%s":'
424
u' %s', self.check_command, error)
220
logger.critical(u'Could not format string "%s": %s',
221
self.check_command, error)
425
222
return True # Try again later
426
223
try:
427
logger.info(u"Starting checker %r for %s",
428
command, self.name)
429
# We don't need to redirect stdout and stderr, since
430
# in normal mode, that is already done by daemon(),
431
# and in debug mode we don't want to. (Stdin is
432
# always replaced by /dev/null.)
433
self.checker = subprocess.Popen(command,
434
close_fds=True,
435
shell=True, cwd="/")
436
self.checker_callback_tag = gobject.child_watch_add\
437
(self.checker.pid,
438
self.checker_callback)
439
# Emit D-Bus signal
440
self.CheckerStarted(command)
441
except OSError, error:
224
self.checker = subprocess.\
225
Popen(command,
226
stdout=subprocess.PIPE,
227
close_fds=True, shell=True,
228
cwd="/")
229
self.checker_callback_tag = gobject.\
230
child_watch_add(self.checker.pid,
231
self.\
232
checker_callback)
233
except subprocess.OSError, error:
442
234
logger.error(u"Failed to start subprocess: %s",
443
235
error)
444
236
# Re-run this periodically if run by gobject.timeout_add
445
237
return True
446
447
@dbus.service.signal(interface, signature="s")
448
def CheckerStarted(self, command):
449
pass
450
451
@dbus.service.method(interface, out_signature="b")
452
def checkerIsRunning(self):
453
"D-Bus getter method"
454
return self.checker is not None
455
456
238
def stop_checker(self):
457
239
"""Force the checker process, if any, to stop."""
458
if self.checker_callback_tag:
459
gobject.source_remove(self.checker_callback_tag)
460
self.checker_callback_tag = None
461
if getattr(self, "checker", None) is None:
240
if not hasattr(self, "checker") or self.checker is None:
462
241
return
463
logger.debug(u"Stopping checker for %(name)s", vars(self))
464
try:
465
os.kill(self.checker.pid, signal.SIGTERM)
466
#os.sleep(0.5)
467
#if self.checker.poll() is None:
468
# os.kill(self.checker.pid, signal.SIGKILL)
469
except OSError, error:
470
if error.errno != errno.ESRCH: # No such process
471
raise
242
gobject.source_remove(self.checker_callback_tag)
243
self.checker_callback_tag = None
244
os.kill(self.checker.pid, signal.SIGTERM)
245
if self.checker.poll() is None:
246
os.kill(self.checker.pid, signal.SIGKILL)
472
247
self.checker = None
473
# D-Bus variant
474
StopChecker = dbus.service.method(interface)(stop_checker)
475
476
def still_valid(self):
248
def still_valid(self, now=None):
477
249
"""Has the timeout not yet passed for this client?"""
478
if not self.started:
479
return False
480
now = datetime.datetime.now()
481
if self.last_checked_ok is None:
250
if now is None:
251
now = datetime.datetime.now()
252
if self.last_seen is None:
482
253
return now < (self.created + self.timeout)
483
254
else:
484
return now < (self.last_checked_ok + self.timeout)
485
# D-Bus variant
486
stillValid = dbus.service.method(interface, out_signature="b")\
487
(still_valid)
488
489
del interface
255
return now < (self.last_seen + self.timeout)
490
256
491
257
492
258
def peer_certificate(session):
493
"Return the peer's OpenPGP certificate as a bytestring"
494
259
# If not an OpenPGP certificate...
495
260
if gnutls.library.functions.gnutls_certificate_type_get\
496
261
(session._c_object) \
507
272
508
273
509
274
def fingerprint(openpgp):
510
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
275
# New empty GnuTLS certificate
276
crt = gnutls.library.types.gnutls_openpgp_crt_t()
277
gnutls.library.functions.gnutls_openpgp_crt_init\
278
(ctypes.byref(crt))
511
279
# New GnuTLS "datum" with the OpenPGP public key
512
280
datum = gnutls.library.types.gnutls_datum_t\
513
281
(ctypes.cast(ctypes.c_char_p(openpgp),
514
282
ctypes.POINTER(ctypes.c_ubyte)),
515
283
ctypes.c_uint(len(openpgp)))
516
# New empty GnuTLS certificate
517
crt = gnutls.library.types.gnutls_openpgp_crt_t()
518
gnutls.library.functions.gnutls_openpgp_crt_init\
519
(ctypes.byref(crt))
520
284
# Import the OpenPGP public key into the certificate
521
gnutls.library.functions.gnutls_openpgp_crt_import\
522
(crt, ctypes.byref(datum),
523
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
524
# Verify the self signature in the key
525
crtverify = ctypes.c_uint()
526
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
527
(crt, 0, ctypes.byref(crtverify))
528
if crtverify.value != 0:
529
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
530
raise gnutls.errors.CertificateSecurityError("Verify failed")
285
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
286
(crt,
287
ctypes.byref(datum),
288
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
531
289
# New buffer for the fingerprint
532
buf = ctypes.create_string_buffer(20)
533
buf_len = ctypes.c_size_t()
290
buffer = ctypes.create_string_buffer(20)
291
buffer_length = ctypes.c_size_t()
534
292
# Get the fingerprint from the certificate into the buffer
535
293
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
536
(crt, ctypes.byref(buf), ctypes.byref(buf_len))
294
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
537
295
# Deinit the certificate
538
296
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
539
297
# Convert the buffer to a Python bytestring
540
fpr = ctypes.string_at(buf, buf_len.value)
298
fpr = ctypes.string_at(buffer, buffer_length.value)
541
299
# Convert the bytestring to hexadecimal notation
542
300
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
543
301
return hex_fpr
544
302
545
303
546
class TCP_handler(SocketServer.BaseRequestHandler, object):
304
class tcp_handler(SocketServer.BaseRequestHandler, object):
547
305
"""A TCP request handler class.
548
306
Instantiated by IPv6_TCPServer for each request to handle it.
549
307
Note: This will run in its own forked process."""
550
308
551
309
def handle(self):
552
logger.info(u"TCP connection from: %s",
553
unicode(self.client_address))
554
session = gnutls.connection.ClientSession\
555
(self.request, gnutls.connection.X509Credentials())
556
557
line = self.request.makefile().readline()
558
logger.debug(u"Protocol version: %r", line)
559
try:
560
if int(line.strip().split()[0]) > 1:
561
raise RuntimeError
562
except (ValueError, IndexError, RuntimeError), error:
563
logger.error(u"Unknown protocol version: %s", error)
564
return
565
566
# Note: gnutls.connection.X509Credentials is really a generic
567
# GnuTLS certificate credentials object so long as no X.509
568
# keys are added to it. Therefore, we can use it here despite
569
# using OpenPGP certificates.
310
logger.debug(u"TCP connection from: %s",
311
unicode(self.client_address))
312
session = gnutls.connection.ClientSession(self.request,
313
gnutls.connection.\
314
X509Credentials())
570
315
571
316
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
572
317
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
573
318
# "+DHE-DSS"))
574
# Use a fallback default, since this MUST be set.
575
priority = self.server.settings.get("priority", "NORMAL")
319
priority = "SECURE256"
320
576
321
gnutls.library.functions.gnutls_priority_set_direct\
577
(session._c_object, priority, None)
322
(session._c_object, priority, None);
578
323
579
324
try:
580
325
session.handshake()
581
326
except gnutls.errors.GNUTLSError, error:
582
logger.warning(u"Handshake failed: %s", error)
327
logger.debug(u"Handshake failed: %s", error)
583
328
# Do not run session.bye() here: the session is not
584
329
# established. Just abandon the request.
585
330
return
586
331
try:
587
332
fpr = fingerprint(peer_certificate(session))
588
333
except (TypeError, gnutls.errors.GNUTLSError), error:
589
logger.warning(u"Bad certificate: %s", error)
334
logger.debug(u"Bad certificate: %s", error)
590
335
session.bye()
591
336
return
592
337
logger.debug(u"Fingerprint: %s", fpr)
593
338
client = None
594
for c in self.server.clients:
339
for c in clients:
595
340
if c.fingerprint == fpr:
596
341
client = c
597
342
break
598
if not client:
599
logger.warning(u"Client not found for fingerprint: %s",
600
fpr)
601
session.bye()
602
return
603
343
# Have to check if client.still_valid(), since it is possible
604
344
# that the client timed out while establishing the GnuTLS
605
345
# session.
606
if not client.still_valid():
607
logger.warning(u"Client %(name)s is invalid",
608
vars(client))
346
if (not client) or (not client.still_valid()):
347
if client:
348
logger.debug(u"Client %(name)s is invalid",
349
vars(client))
350
else:
351
logger.debug(u"Client not found for fingerprint: %s",
352
fpr)
609
353
session.bye()
610
354
return
611
## This won't work here, since we're in a fork.
612
# client.bump_timeout()
613
355
sent_size = 0
614
356
while sent_size < len(client.secret):
615
357
sent = session.send(client.secret[sent_size:])
620
362
session.bye()
621
363
622
364
623
class IPv6_TCPServer(SocketServer.ForkingMixIn,
624
SocketServer.TCPServer, object):
365
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
625
366
"""IPv6 TCP server. Accepts 'None' as address and/or port.
626
367
Attributes:
627
settings: Server settings
368
options: Command line options
628
369
clients: Set() of Client objects
629
enabled: Boolean; whether this server is activated yet
630
370
"""
631
371
address_family = socket.AF_INET6
632
372
def __init__(self, *args, **kwargs):
633
if "settings" in kwargs:
634
self.settings = kwargs["settings"]
635
del kwargs["settings"]
373
if "options" in kwargs:
374
self.options = kwargs["options"]
375
del kwargs["options"]
636
376
if "clients" in kwargs:
637
377
self.clients = kwargs["clients"]
638
378
del kwargs["clients"]
639
self.enabled = False
640
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
379
return super(type(self), self).__init__(*args, **kwargs)
641
380
def server_bind(self):
642
381
"""This overrides the normal server_bind() function
643
382
to bind to an interface if one was specified, and also NOT to
644
383
bind to an address or port if they were not specified."""
645
if self.settings["interface"]:
646
# 25 is from /usr/include/asm-i486/socket.h
647
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
384
if self.options.interface:
385
if not hasattr(socket, "SO_BINDTODEVICE"):
386
# From /usr/include/asm-i486/socket.h
387
socket.SO_BINDTODEVICE = 25
648
388
try:
649
389
self.socket.setsockopt(socket.SOL_SOCKET,
650
SO_BINDTODEVICE,
651
self.settings["interface"])
390
socket.SO_BINDTODEVICE,
391
self.options.interface)
652
392
except socket.error, error:
653
393
if error[0] == errno.EPERM:
654
logger.error(u"No permission to"
655
u" bind to interface %s",
656
self.settings["interface"])
394
logger.warning(u"No permission to"
395
u" bind to interface %s",
396
self.options.interface)
657
397
else:
658
398
raise error
659
399
# Only bind(2) the socket if we really need to.
662
402
in6addr_any = "::"
663
403
self.server_address = (in6addr_any,
664
404
self.server_address[1])
665
elif not self.server_address[1]:
405
elif self.server_address[1] is None:
666
406
self.server_address = (self.server_address[0],
667
407
0)
668
# if self.settings["interface"]:
669
# self.server_address = (self.server_address[0],
670
# 0, # port
671
# 0, # flowinfo
672
# if_nametoindex
673
# (self.settings
674
# ["interface"]))
675
return super(IPv6_TCPServer, self).server_bind()
676
def server_activate(self):
677
if self.enabled:
678
return super(IPv6_TCPServer, self).server_activate()
679
def enable(self):
680
self.enabled = True
408
return super(type(self), self).server_bind()
681
409
682
410
683
411
def string_to_delta(interval):
693
421
datetime.timedelta(1)
694
422
>>> string_to_delta(u'1w')
695
423
datetime.timedelta(7)
696
>>> string_to_delta('5m 30s')
697
datetime.timedelta(0, 330)
698
424
"""
699
timevalue = datetime.timedelta(0)
700
for s in interval.split():
701
try:
702
suffix = unicode(s[-1])
703
value = int(s[:-1])
704
if suffix == u"d":
705
delta = datetime.timedelta(value)
706
elif suffix == u"s":
707
delta = datetime.timedelta(0, value)
708
elif suffix == u"m":
709
delta = datetime.timedelta(0, 0, 0, 0, value)
710
elif suffix == u"h":
711
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
712
elif suffix == u"w":
713
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
714
else:
715
raise ValueError
716
except (ValueError, IndexError):
425
try:
426
suffix=unicode(interval[-1])
427
value=int(interval[:-1])
428
if suffix == u"d":
429
delta = datetime.timedelta(value)
430
elif suffix == u"s":
431
delta = datetime.timedelta(0, value)
432
elif suffix == u"m":
433
delta = datetime.timedelta(0, 0, 0, 0, value)
434
elif suffix == u"h":
435
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
436
elif suffix == u"w":
437
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
438
else:
717
439
raise ValueError
718
timevalue += delta
719
return timevalue
440
except (ValueError, IndexError):
441
raise ValueError
442
return delta
443
444
445
def add_service():
446
"""From the Avahi server example code"""
447
global group, serviceName, serviceType, servicePort, serviceTXT, \
448
domain, host
449
if group is None:
450
group = dbus.Interface(
451
bus.get_object( avahi.DBUS_NAME,
452
server.EntryGroupNew()),
453
avahi.DBUS_INTERFACE_ENTRY_GROUP)
454
group.connect_to_signal('StateChanged',
455
entry_group_state_changed)
456
logger.debug(u"Adding service '%s' of type '%s' ...",
457
serviceName, serviceType)
458
459
group.AddService(
460
serviceInterface, # interface
461
avahi.PROTO_INET6, # protocol
462
dbus.UInt32(0), # flags
463
serviceName, serviceType,
464
domain, host,
465
dbus.UInt16(servicePort),
466
avahi.string_array_to_txt_array(serviceTXT))
467
group.Commit()
468
469
470
def remove_service():
471
"""From the Avahi server example code"""
472
global group
473
474
if not group is None:
475
group.Reset()
720
476
721
477
722
478
def server_state_changed(state):
723
"""Derived from the Avahi example code"""
479
"""From the Avahi server example code"""
724
480
if state == avahi.SERVER_COLLISION:
725
logger.error(u"Zeroconf server name collision")
726
service.remove()
481
logger.warning(u"Server name collision")
482
remove_service()
727
483
elif state == avahi.SERVER_RUNNING:
728
service.add()
484
add_service()
729
485
730
486
731
487
def entry_group_state_changed(state, error):
732
"""Derived from the Avahi example code"""
733
logger.debug(u"Avahi state change: %i", state)
488
"""From the Avahi server example code"""
489
global serviceName, server, rename_count
490
491
logger.debug(u"state change: %i", state)
734
492
735
493
if state == avahi.ENTRY_GROUP_ESTABLISHED:
736
logger.debug(u"Zeroconf service established.")
494
logger.debug(u"Service established.")
737
495
elif state == avahi.ENTRY_GROUP_COLLISION:
738
logger.warning(u"Zeroconf service name collision.")
739
service.rename()
496
497
rename_count = rename_count - 1
498
if rename_count > 0:
499
name = server.GetAlternativeServiceName(name)
500
logger.warning(u"Service name collision, "
501
u"changing name to '%s' ...", name)
502
remove_service()
503
add_service()
504
505
else:
506
logger.error(u"No suitable service name found "
507
u"after %i retries, exiting.",
508
n_rename)
509
main_loop.quit()
740
510
elif state == avahi.ENTRY_GROUP_FAILURE:
741
logger.critical(u"Avahi: Error in group state changed %s",
742
unicode(error))
743
raise AvahiGroupError("State changed: %s", str(error))
511
logger.error(u"Error in group state changed %s",
512
unicode(error))
513
main_loop.quit()
514
return
515
744
516
745
517
def if_nametoindex(interface):
746
"""Call the C function if_nametoindex(), or equivalent"""
747
global if_nametoindex
518
"""Call the C function if_nametoindex()"""
748
519
try:
749
if_nametoindex = ctypes.cdll.LoadLibrary\
750
(ctypes.util.find_library("c")).if_nametoindex
520
libc = ctypes.cdll.LoadLibrary("libc.so.6")
521
return libc.if_nametoindex(interface)
751
522
except (OSError, AttributeError):
752
523
if "struct" not in sys.modules:
753
524
import struct
754
525
if "fcntl" not in sys.modules:
755
526
import fcntl
756
def if_nametoindex(interface):
757
"Get an interface index the hard way, i.e. using fcntl()"
758
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
759
with closing(socket.socket()) as s:
760
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
761
struct.pack("16s16x", interface))
762
interface_index = struct.unpack("I", ifreq[16:20])[0]
763
return interface_index
764
return if_nametoindex(interface)
765
766
767
def daemon(nochdir = False, noclose = False):
768
"""See daemon(3). Standard BSD Unix function.
769
This should really exist as os.daemon, but it doesn't (yet)."""
770
if os.fork():
771
sys.exit()
772
os.setsid()
773
if not nochdir:
774
os.chdir("/")
775
if os.fork():
776
sys.exit()
777
if not noclose:
778
# Close all standard open file descriptors
779
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
780
if not stat.S_ISCHR(os.fstat(null).st_mode):
781
raise OSError(errno.ENODEV,
782
"/dev/null not a character device")
783
os.dup2(null, sys.stdin.fileno())
784
os.dup2(null, sys.stdout.fileno())
785
os.dup2(null, sys.stderr.fileno())
786
if null > 2:
787
os.close(null)
788
789
790
def main():
791
parser = OptionParser(version = "%%prog %s" % version)
527
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
528
s = socket.socket()
529
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
530
struct.pack("16s16x", interface))
531
s.close()
532
interface_index = struct.unpack("I", ifreq[16:20])[0]
533
return interface_index
534
535
536
if __name__ == '__main__':
537
parser = OptionParser()
792
538
parser.add_option("-i", "--interface", type="string",
793
metavar="IF", help="Bind to interface IF")
794
parser.add_option("-a", "--address", type="string",
795
help="Address to listen for requests on")
796
parser.add_option("-p", "--port", type="int",
539
default=None, metavar="IF",
540
help="Bind to interface IF")
541
parser.add_option("--cert", type="string", default="cert.pem",
542
metavar="FILE",
543
help="Public key certificate PEM file to use")
544
parser.add_option("--key", type="string", default="key.pem",
545
metavar="FILE",
546
help="Private key PEM file to use")
547
parser.add_option("--ca", type="string", default="ca.pem",
548
metavar="FILE",
549
help="Certificate Authority certificate PEM file to use")
550
parser.add_option("--crl", type="string", default="crl.pem",
551
metavar="FILE",
552
help="Certificate Revokation List PEM file to use")
553
parser.add_option("-p", "--port", type="int", default=None,
797
554
help="Port number to receive requests on")
555
parser.add_option("--timeout", type="string", # Parsed later
556
default="1h",
557
help="Amount of downtime allowed for clients")
558
parser.add_option("--interval", type="string", # Parsed later
559
default="5m",
560
help="How often to check that a client is up")
798
561
parser.add_option("--check", action="store_true", default=False,
799
562
help="Run self-test")
800
parser.add_option("--debug", action="store_true",
801
help="Debug mode; run in foreground and log to"
802
" terminal")
803
parser.add_option("--priority", type="string", help="GnuTLS"
804
" priority string (see GnuTLS documentation)")
805
parser.add_option("--servicename", type="string", metavar="NAME",
806
help="Zeroconf service name")
807
parser.add_option("--configdir", type="string",
808
default="/etc/mandos", metavar="DIR",
809
help="Directory to search for configuration"
810
" files")
811
options = parser.parse_args()[0]
563
parser.add_option("--debug", action="store_true", default=False,
564
help="Debug mode")
565
(options, args) = parser.parse_args()
812
566
813
567
if options.check:
814
568
import doctest
815
569
doctest.testmod()
816
570
sys.exit()
817
571
818
# Default values for config file for server-global settings
819
server_defaults = { "interface": "",
820
"address": "",
821
"port": "",
822
"debug": "False",
823
"priority":
824
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
825
"servicename": "Mandos",
826
}
827
828
# Parse config file for server-global settings
829
server_config = ConfigParser.SafeConfigParser(server_defaults)
830
del server_defaults
831
server_config.read(os.path.join(options.configdir, "mandos.conf"))
832
# Convert the SafeConfigParser object to a dict
833
server_settings = server_config.defaults()
834
# Use getboolean on the boolean config option
835
server_settings["debug"] = server_config.getboolean\
836
("DEFAULT", "debug")
837
del server_config
838
839
# Override the settings from the config file with command line
840
# options, if set.
841
for option in ("interface", "address", "port", "debug",
842
"priority", "servicename", "configdir"):
843
value = getattr(options, option)
844
if value is not None:
845
server_settings[option] = value
846
del options
847
# Now we have our good server settings in "server_settings"
848
849
debug = server_settings["debug"]
850
851
if not debug:
852
syslogger.setLevel(logging.WARNING)
853
console.setLevel(logging.WARNING)
854
855
if server_settings["servicename"] != "Mandos":
856
syslogger.setFormatter(logging.Formatter\
857
('Mandos (%s): %%(levelname)s:'
858
' %%(message)s'
859
% server_settings["servicename"]))
860
861
# Parse config file with clients
862
client_defaults = { "timeout": "1h",
863
"interval": "5m",
864
"checker": "fping -q -- %(host)s",
865
"host": "",
866
}
867
client_config = ConfigParser.SafeConfigParser(client_defaults)
868
client_config.read(os.path.join(server_settings["configdir"],
869
"clients.conf"))
870
871
clients = Set()
872
tcp_server = IPv6_TCPServer((server_settings["address"],
873
server_settings["port"]),
874
TCP_handler,
875
settings=server_settings,
876
clients=clients)
877
pidfilename = "/var/run/mandos.pid"
878
try:
879
pidfile = open(pidfilename, "w")
880
except IOError, error:
881
logger.error("Could not open file %r", pidfilename)
882
883
uid = 65534
884
gid = 65534
885
try:
886
uid = pwd.getpwnam("mandos").pw_uid
887
except KeyError:
888
try:
889
uid = pwd.getpwnam("nobody").pw_uid
890
except KeyError:
891
pass
892
try:
893
gid = pwd.getpwnam("mandos").pw_gid
894
except KeyError:
895
try:
896
gid = pwd.getpwnam("nogroup").pw_gid
897
except KeyError:
898
pass
899
try:
900
os.setuid(uid)
901
os.setgid(gid)
902
except OSError, error:
903
if error[0] != errno.EPERM:
904
raise error
905
906
global service
907
service = AvahiService(name = server_settings["servicename"],
908
servicetype = "_mandos._tcp", )
909
if server_settings["interface"]:
910
service.interface = if_nametoindex\
911
(server_settings["interface"])
912
913
global main_loop
914
global bus
915
global server
916
# From the Avahi example code
572
# Parse the time arguments
573
try:
574
options.timeout = string_to_delta(options.timeout)
575
except ValueError:
576
parser.error("option --timeout: Unparseable time")
577
try:
578
options.interval = string_to_delta(options.interval)
579
except ValueError:
580
parser.error("option --interval: Unparseable time")
581
582
# Parse config file
583
defaults = { "checker": "sleep 1; fping -q -- %%(fqdn)s" }
584
client_config = ConfigParser.SafeConfigParser(defaults)
585
#client_config.readfp(open("secrets.conf"), "secrets.conf")
586
client_config.read("mandos-clients.conf")
587
588
# From the Avahi server example code
917
589
DBusGMainLoop(set_as_default=True )
918
590
main_loop = gobject.MainLoop()
919
591
bus = dbus.SystemBus()
920
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
921
avahi.DBUS_PATH_SERVER),
922
avahi.DBUS_INTERFACE_SERVER)
592
server = dbus.Interface(
593
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
594
avahi.DBUS_INTERFACE_SERVER )
923
595
# End of Avahi example code
924
596
597
debug = options.debug
598
599
clients = Set()
925
600
def remove_from_clients(client):
926
601
clients.remove(client)
927
602
if not clients:
928
logger.critical(u"No clients left, exiting")
929
sys.exit()
603
logger.debug(u"No clients left, exiting")
604
main_loop.quit()
930
605
931
clients.update(Set(Client(name = section,
606
clients.update(Set(Client(name=section, options=options,
932
607
stop_hook = remove_from_clients,
933
config
934
= dict(client_config.items(section)))
608
**(dict(client_config\
609
.items(section))))
935
610
for section in client_config.sections()))
936
if not clients:
937
logger.critical(u"No clients defined")
938
sys.exit(1)
939
940
if debug:
941
# Redirect stdin so all checkers get /dev/null
942
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
943
os.dup2(null, sys.stdin.fileno())
944
if null > 2:
945
os.close(null)
946
else:
947
# No console logging
948
logger.removeHandler(console)
949
# Close all input and output, do double fork, etc.
950
daemon()
951
952
try:
953
pid = os.getpid()
954
pidfile.write(str(pid) + "\n")
955
pidfile.close()
956
del pidfile
957
except IOError:
958
logger.error(u"Could not write to file %r with PID %d",
959
pidfilename, pid)
960
except NameError:
961
# "pidfile" was never created
962
pass
963
del pidfilename
964
965
def cleanup():
966
"Cleanup function; run on exit"
967
global group
968
# From the Avahi example code
969
if not group is None:
970
group.Free()
971
group = None
972
# End of Avahi example code
973
974
while clients:
975
client = clients.pop()
976
client.stop_hook = None
977
client.stop()
978
979
atexit.register(cleanup)
980
981
if not debug:
982
signal.signal(signal.SIGINT, signal.SIG_IGN)
983
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
984
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
985
986
611
for client in clients:
987
612
client.start()
988
613
989
tcp_server.enable()
990
tcp_server.server_activate()
991
992
# Find out what port we got
993
service.port = tcp_server.socket.getsockname()[1]
994
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
995
u" scope_id %d" % tcp_server.socket.getsockname())
996
997
#service.interface = tcp_server.socket.getsockname()[3]
998
614
tcp_server = IPv6_TCPServer((None, options.port),
615
tcp_handler,
616
options=options,
617
clients=clients)
618
# Find out what random port we got
619
servicePort = tcp_server.socket.getsockname()[1]
620
logger.debug(u"Now listening on port %d", servicePort)
621
622
if options.interface is not None:
623
serviceInterface = if_nametoindex(options.interface)
624
625
# From the Avahi server example code
626
server.connect_to_signal("StateChanged", server_state_changed)
627
server_state_changed(server.GetState())
628
# End of Avahi example code
629
630
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
631
lambda *args, **kwargs:
632
tcp_server.handle_request(*args[2:],
633
**kwargs) or True)
999
634
try:
1000
# From the Avahi example code
1001
server.connect_to_signal("StateChanged", server_state_changed)
1002
try:
1003
server_state_changed(server.GetState())
1004
except dbus.exceptions.DBusException, error:
1005
logger.critical(u"DBusException: %s", error)
1006
sys.exit(1)
1007
# End of Avahi example code
1008
1009
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1010
lambda *args, **kwargs:
1011
tcp_server.handle_request\
1012
(*args[2:], **kwargs) or True)
1013
1014
logger.debug(u"Starting main loop")
1015
635
main_loop.run()
1016
except AvahiError, error:
1017
logger.critical(u"AvahiError: %s" + unicode(error))
1018
sys.exit(1)
1019
636
except KeyboardInterrupt:
1020
if debug:
1021
print
637
print
638
639
# Cleanup here
1022
640
1023
if __name__ == '__main__':
1024
main()
641
# From the Avahi server example code
642
if not group is None:
643
group.Free()
644
# End of Avahi example code
645
646
for client in clients:
647
client.stop_hook = None
648
client.stop()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0