To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 13
- compare with another revision
- download diff
- download tarball
- view history from revision 13
- Committer: Björn Påhlsson
- Date: 2008-07-20 02:52:20 UTC
- Revision ID: belorn@braxen-20080720025220-r5u0388uy9iu23h6
Added following support:
Pluginbased client handler
rewritten Mandos client
Avahi instead of udp server discovery
openpgp encrypted key support
Passprompt stand alone application for direct console input
Added logging for Mandos server
Pluginbased client handler
rewritten Mandos client
Avahi instead of udp server discovery
openpgp encrypted key support
Passprompt stand alone application for direct console input
Added logging for Mandos server
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- clients.conf => mandos-clients.conf
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos => server.py
- files modified:
- Makefile
added
removed
server.py
1
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
# Mandos server - give out binary blobs to connecting clients.
5
#
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
#
13
# Everything else is
14
# Copyright © 2008 Teddy Hogeborn
15
# Copyright © 2008 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
19
# the Free Software Foundation, either version 3 of the License, or
20
# (at your option) any later version.
21
#
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
# GNU General Public License for more details.
26
#
27
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
#
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
#
33
2
34
from __future__ import division, with_statement, absolute_import
3
from __future__ import division
35
4
36
5
import SocketServer
37
6
import socket
7
import select
38
8
from optparse import OptionParser
39
9
import datetime
40
10
import errno
51
21
import signal
52
22
from sets import Set
53
23
import subprocess
54
import atexit
55
import stat
56
import logging
57
import logging.handlers
58
import pwd
59
from contextlib import closing
60
24
61
25
import dbus
62
import dbus.service
63
26
import gobject
64
27
import avahi
65
28
from dbus.mainloop.glib import DBusGMainLoop
66
29
import ctypes
67
import ctypes.util
68
69
version = "1.0.2"
30
31
import logging
32
import logging.handlers
33
34
# logghandler.setFormatter(logging.Formatter('%(levelname)s %(message)s')
70
35
71
36
logger = logging.Logger('mandos')
72
syslogger = (logging.handlers.SysLogHandler
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos: %(levelname)s: %(message)s'))
77
logger.addHandler(syslogger)
78
79
console = logging.StreamHandler()
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
82
logger.addHandler(console)
83
84
class AvahiError(Exception):
85
def __init__(self, value):
86
self.value = value
87
super(AvahiError, self).__init__()
88
def __str__(self):
89
return repr(self.value)
90
91
class AvahiServiceError(AvahiError):
92
pass
93
94
class AvahiGroupError(AvahiError):
95
pass
96
97
98
class AvahiService(object):
99
"""An Avahi (Zeroconf) service.
100
Attributes:
101
interface: integer; avahi.IF_UNSPEC or an interface index.
102
Used to optionally bind to the specified interface.
103
name: string; Example: 'Mandos'
104
type: string; Example: '_mandos._tcp'.
105
See <http://www.dns-sd.org/ServiceTypes.html>
106
port: integer; what port to announce
107
TXT: list of strings; TXT record for the service
108
domain: string; Domain to publish on, default to .local if empty.
109
host: string; Host to publish records for, default is localhost
110
max_renames: integer; maximum number of renames
111
rename_count: integer; counter so we only rename after collisions
112
a sensible number of times
113
"""
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
115
servicetype = None, port = None, TXT = None,
116
domain = "", host = "", max_renames = 32768):
117
self.interface = interface
118
self.name = name
119
self.type = servicetype
120
self.port = port
121
self.TXT = TXT if TXT is not None else []
122
self.domain = domain
123
self.host = host
124
self.rename_count = 0
125
self.max_renames = max_renames
126
def rename(self):
127
"""Derived from the Avahi example code"""
128
if self.rename_count >= self.max_renames:
129
logger.critical(u"No suitable Zeroconf service name found"
130
u" after %i retries, exiting.",
131
self.rename_count)
132
raise AvahiServiceError("Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
134
logger.info(u"Changing Zeroconf service name to %r ...",
135
str(self.name))
136
syslogger.setFormatter(logging.Formatter
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
139
self.remove()
140
self.add()
141
self.rename_count += 1
142
def remove(self):
143
"""Derived from the Avahi example code"""
144
if group is not None:
145
group.Reset()
146
def add(self):
147
"""Derived from the Avahi example code"""
148
global group
149
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
group.connect_to_signal('StateChanged',
155
entry_group_state_changed)
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
157
service.name, service.type)
158
group.AddService(
159
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
161
dbus.UInt32(0), # flags
162
self.name, self.type,
163
self.domain, self.host,
164
dbus.UInt16(self.port),
165
avahi.string_array_to_txt_array(self.TXT))
166
group.Commit()
167
168
# From the Avahi example code:
169
group = None # our entry group
37
logger.addHandler(logging.handlers.SysLogHandler(facility = logging.handlers.SysLogHandler.LOG_DAEMON))
38
39
# This variable is used to optionally bind to a specified interface.
40
# It is a global variable to fit in with the other variables from the
41
# Avahi server example code.
42
serviceInterface = avahi.IF_UNSPEC
43
# From the Avahi server example code:
44
serviceName = "Mandos"
45
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
46
servicePort = None # Not known at startup
47
serviceTXT = [] # TXT record for the service
48
domain = "" # Domain to publish on, default to .local
49
host = "" # Host to publish records for, default to localhost
50
group = None #our entry group
51
rename_count = 12 # Counter so we only rename after collisions a
52
# sensible number of times
170
53
# End of Avahi example code
171
54
172
55
173
class Client(dbus.service.Object):
56
class Client(object):
174
57
"""A representation of a client host served by this server.
175
58
Attributes:
176
59
name: string; from the config file, used in log messages
177
60
fingerprint: string (40 or 32 hexadecimal digits); used to
178
61
uniquely identify the client
179
62
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); (UTC) object creation
182
started: datetime.datetime(); (UTC) last started
183
last_checked_ok: datetime.datetime(); (UTC) or None
184
timeout: datetime.timedelta(); How long from last_checked_ok
185
until this client is invalid
63
fqdn: string (FQDN); available for use by the checker command
64
created: datetime.datetime()
65
last_seen: datetime.datetime() or None if not yet seen
66
timeout: datetime.timedelta(); How long from last_seen until
67
this client is invalid
186
68
interval: datetime.timedelta(); How often to start a new checker
187
69
stop_hook: If set, called by stop() as stop_hook(self)
188
70
checker: subprocess.Popen(); a running checker process used
189
71
to see if the client lives.
190
'None' if no process is running.
72
Is None if no process is running.
191
73
checker_initiator_tag: a gobject event source tag, or None
192
74
stop_initiator_tag: - '' -
193
75
checker_callback_tag: - '' -
194
76
checker_command: string; External command which is run to check if
195
client lives. %() expansions are done at
77
client lives. %()s expansions are done at
196
78
runtime with vars(self) as dict, so that for
197
79
instance %(name)s can be used in the command.
198
80
Private attibutes:
199
81
_timeout: Real variable for 'timeout'
200
82
_interval: Real variable for 'interval'
201
_timeout_milliseconds: Used when calling gobject.timeout_add()
83
_timeout_milliseconds: Used by gobject.timeout_add()
202
84
_interval_milliseconds: - '' -
203
85
"""
204
86
def _set_timeout(self, timeout):
205
"Setter function for the 'timeout' attribute"
87
"Setter function for 'timeout' attribute"
206
88
self._timeout = timeout
207
89
self._timeout_milliseconds = ((self.timeout.days
208
90
* 24 * 60 * 60 * 1000)
209
91
+ (self.timeout.seconds * 1000)
210
92
+ (self.timeout.microseconds
211
93
// 1000))
212
# Emit D-Bus signal
213
self.TimeoutChanged(self._timeout_milliseconds)
214
timeout = property(lambda self: self._timeout, _set_timeout)
94
timeout = property(lambda self: self._timeout,
95
_set_timeout)
215
96
del _set_timeout
216
217
97
def _set_interval(self, interval):
218
"Setter function for the 'interval' attribute"
98
"Setter function for 'interval' attribute"
219
99
self._interval = interval
220
100
self._interval_milliseconds = ((self.interval.days
221
101
* 24 * 60 * 60 * 1000)
223
103
* 1000)
224
104
+ (self.interval.microseconds
225
105
// 1000))
226
# Emit D-Bus signal
227
self.IntervalChanged(self._interval_milliseconds)
228
interval = property(lambda self: self._interval, _set_interval)
106
interval = property(lambda self: self._interval,
107
_set_interval)
229
108
del _set_interval
230
231
def __init__(self, name = None, stop_hook=None, config=None):
232
"""Note: the 'checker' key in 'config' sets the
233
'checker_command' attribute and *not* the 'checker'
234
attribute."""
235
dbus.service.Object.__init__(self, bus,
236
"/Mandos/clients/%s"
237
% name.replace(".", "_"))
238
if config is None:
239
config = {}
109
def __init__(self, name=None, options=None, stop_hook=None,
110
fingerprint=None, secret=None, secfile=None, fqdn=None,
111
timeout=None, interval=-1, checker=None):
240
112
self.name = name
241
logger.debug(u"Creating client %r", self.name)
242
# Uppercase and remove spaces from fingerprint for later
243
# comparison purposes with return value from the fingerprint()
244
# function
245
self.fingerprint = (config["fingerprint"].upper()
246
.replace(u" ", u""))
247
logger.debug(u" Fingerprint: %s", self.fingerprint)
248
if "secret" in config:
249
self.secret = config["secret"].decode(u"base64")
250
elif "secfile" in config:
251
with closing(open(os.path.expanduser
252
(os.path.expandvars
253
(config["secfile"])))) as secfile:
254
self.secret = secfile.read()
255
else:
256
raise TypeError(u"No secret or secfile for client %s"
257
% self.name)
258
self.host = config.get("host", "")
259
self.created = datetime.datetime.utcnow()
260
self.started = None
261
self.last_checked_ok = None
262
self.timeout = string_to_delta(config["timeout"])
263
self.interval = string_to_delta(config["interval"])
113
# Uppercase and remove spaces from fingerprint
114
# for later comparison purposes with return value of
115
# the fingerprint() function
116
self.fingerprint = fingerprint.upper().replace(u" ", u"")
117
if secret:
118
self.secret = secret.decode(u"base64")
119
elif secfile:
120
sf = open(secfile)
121
self.secret = sf.read()
122
sf.close()
123
else:
124
raise RuntimeError(u"No secret or secfile for client %s"
125
% self.name)
126
self.fqdn = fqdn # string
127
self.created = datetime.datetime.now()
128
self.last_seen = None
129
if timeout is None:
130
timeout = options.timeout
131
self.timeout = timeout
132
if interval == -1:
133
interval = options.interval
134
else:
135
interval = string_to_delta(interval)
136
self.interval = interval
264
137
self.stop_hook = stop_hook
265
138
self.checker = None
266
139
self.checker_initiator_tag = None
267
140
self.stop_initiator_tag = None
268
141
self.checker_callback_tag = None
269
self.check_command = config["checker"]
270
142
self.check_command = checker
271
143
def start(self):
272
"""Start this client's checker and timeout hooks"""
273
self.started = datetime.datetime.utcnow()
144
"""Start this clients checker and timeout hooks"""
274
145
# Schedule a new checker to be started an 'interval' from now,
275
146
# and every interval from then on.
276
self.checker_initiator_tag = (gobject.timeout_add
277
(self._interval_milliseconds,
278
self.start_checker))
147
self.checker_initiator_tag = gobject.timeout_add\
148
(self._interval_milliseconds,
149
self.start_checker)
279
150
# Also start a new checker *right now*.
280
151
self.start_checker()
281
152
# Schedule a stop() when 'timeout' has passed
282
self.stop_initiator_tag = (gobject.timeout_add
283
(self._timeout_milliseconds,
284
self.stop))
285
# Emit D-Bus signal
286
self.StateChanged(True)
287
153
self.stop_initiator_tag = gobject.timeout_add\
154
(self._timeout_milliseconds,
155
self.stop)
288
156
def stop(self):
289
"""Stop this client."""
290
if getattr(self, "started", None) is not None:
291
logger.info(u"Stopping client %s", self.name)
292
else:
293
return False
294
if getattr(self, "stop_initiator_tag", False):
157
"""Stop this client.
158
The possibility that this client might be restarted is left
159
open, but not currently used."""
160
logger.debug(u"Stopping client %s", self.name)
161
self.secret = None
162
if self.stop_initiator_tag:
295
163
gobject.source_remove(self.stop_initiator_tag)
296
164
self.stop_initiator_tag = None
297
if getattr(self, "checker_initiator_tag", False):
165
if self.checker_initiator_tag:
298
166
gobject.source_remove(self.checker_initiator_tag)
299
167
self.checker_initiator_tag = None
300
168
self.stop_checker()
301
169
if self.stop_hook:
302
170
self.stop_hook(self)
303
self.started = None
304
# Emit D-Bus signal
305
self.StateChanged(False)
306
171
# Do not run this again if called by a gobject.timeout_add
307
172
return False
308
309
173
def __del__(self):
310
self.stop_hook = None
311
self.stop()
312
174
# Some code duplication here and in stop()
175
if hasattr(self, "stop_initiator_tag") \
176
and self.stop_initiator_tag:
177
gobject.source_remove(self.stop_initiator_tag)
178
self.stop_initiator_tag = None
179
if hasattr(self, "checker_initiator_tag") \
180
and self.checker_initiator_tag:
181
gobject.source_remove(self.checker_initiator_tag)
182
self.checker_initiator_tag = None
183
self.stop_checker()
313
184
def checker_callback(self, pid, condition):
314
185
"""The checker has completed, so take appropriate actions."""
315
self.checker_callback_tag = None
316
self.checker = None
317
if (os.WIFEXITED(condition)
318
and (os.WEXITSTATUS(condition) == 0)):
319
logger.info(u"Checker for %(name)s succeeded",
320
vars(self))
321
# Emit D-Bus signal
322
self.CheckerCompleted(True)
323
self.bump_timeout()
324
elif not os.WIFEXITED(condition):
186
now = datetime.datetime.now()
187
if os.WIFEXITED(condition) \
188
and (os.WEXITSTATUS(condition) == 0):
189
logger.debug(u"Checker for %(name)s succeeded",
190
vars(self))
191
self.last_seen = now
192
gobject.source_remove(self.stop_initiator_tag)
193
self.stop_initiator_tag = gobject.timeout_add\
194
(self._timeout_milliseconds,
195
self.stop)
196
if not os.WIFEXITED(condition):
325
197
logger.warning(u"Checker for %(name)s crashed?",
326
198
vars(self))
327
# Emit D-Bus signal
328
self.CheckerCompleted(False)
329
199
else:
330
logger.info(u"Checker for %(name)s failed",
331
vars(self))
332
# Emit D-Bus signal
333
self.CheckerCompleted(False)
334
335
def bump_timeout(self):
336
"""Bump up the timeout for this client.
337
This should only be called when the client has been seen,
338
alive and well.
339
"""
340
self.last_checked_ok = datetime.datetime.utcnow()
341
gobject.source_remove(self.stop_initiator_tag)
342
self.stop_initiator_tag = (gobject.timeout_add
343
(self._timeout_milliseconds,
344
self.stop))
345
200
logger.debug(u"Checker for %(name)s failed",
201
vars(self))
202
self.checker = None
203
self.checker_callback_tag = None
346
204
def start_checker(self):
347
205
"""Start a new checker subprocess if one is not running.
348
206
If a checker already exists, leave it running and do
349
207
nothing."""
350
# The reason for not killing a running checker is that if we
351
# did that, then if a checker (for some reason) started
352
# running slowly and taking more than 'interval' time, the
353
# client would inevitably timeout, since no checker would get
354
# a chance to run to completion. If we instead leave running
355
# checkers alone, the checker would have to take more time
356
# than 'timeout' for the client to be declared invalid, which
357
# is as it should be.
358
208
if self.checker is None:
209
logger.debug(u"Starting checker for %s",
210
self.name)
359
211
try:
360
# In case check_command has exactly one % operator
361
command = self.check_command % self.host
212
command = self.check_command % self.fqdn
362
213
except TypeError:
363
# Escape attributes for the shell
364
214
escaped_attrs = dict((key, re.escape(str(val)))
365
215
for key, val in
366
216
vars(self).iteritems())
367
217
try:
368
218
command = self.check_command % escaped_attrs
369
219
except TypeError, error:
370
logger.error(u'Could not format string "%s":'
371
u' %s', self.check_command, error)
220
logger.critical(u'Could not format string "%s": %s',
221
self.check_command, error)
372
222
return True # Try again later
373
223
try:
374
logger.info(u"Starting checker %r for %s",
375
command, self.name)
376
# We don't need to redirect stdout and stderr, since
377
# in normal mode, that is already done by daemon(),
378
# and in debug mode we don't want to. (Stdin is
379
# always replaced by /dev/null.)
380
self.checker = subprocess.Popen(command,
381
close_fds=True,
382
shell=True, cwd="/")
383
self.checker_callback_tag = (gobject.child_watch_add
384
(self.checker.pid,
385
self.checker_callback))
386
# Emit D-Bus signal
387
self.CheckerStarted(command)
388
except OSError, error:
224
self.checker = subprocess.\
225
Popen(command,
226
stdout=subprocess.PIPE,
227
close_fds=True, shell=True,
228
cwd="/")
229
self.checker_callback_tag = gobject.\
230
child_watch_add(self.checker.pid,
231
self.\
232
checker_callback)
233
except subprocess.OSError, error:
389
234
logger.error(u"Failed to start subprocess: %s",
390
235
error)
391
236
# Re-run this periodically if run by gobject.timeout_add
392
237
return True
393
394
238
def stop_checker(self):
395
239
"""Force the checker process, if any, to stop."""
396
if self.checker_callback_tag:
397
gobject.source_remove(self.checker_callback_tag)
398
self.checker_callback_tag = None
399
if getattr(self, "checker", None) is None:
240
if not hasattr(self, "checker") or self.checker is None:
400
241
return
401
logger.debug(u"Stopping checker for %(name)s", vars(self))
402
try:
403
os.kill(self.checker.pid, signal.SIGTERM)
404
#os.sleep(0.5)
405
#if self.checker.poll() is None:
406
# os.kill(self.checker.pid, signal.SIGKILL)
407
except OSError, error:
408
if error.errno != errno.ESRCH: # No such process
409
raise
242
gobject.source_remove(self.checker_callback_tag)
243
self.checker_callback_tag = None
244
os.kill(self.checker.pid, signal.SIGTERM)
245
if self.checker.poll() is None:
246
os.kill(self.checker.pid, signal.SIGKILL)
410
247
self.checker = None
411
412
def still_valid(self):
248
def still_valid(self, now=None):
413
249
"""Has the timeout not yet passed for this client?"""
414
if not self.started:
415
return False
416
now = datetime.datetime.utcnow()
417
if self.last_checked_ok is None:
250
if now is None:
251
now = datetime.datetime.now()
252
if self.last_seen is None:
418
253
return now < (self.created + self.timeout)
419
254
else:
420
return now < (self.last_checked_ok + self.timeout)
421
422
## D-Bus methods & signals
423
_interface = u"org.mandos_system.Mandos.Client"
424
425
def _datetime_to_dbus_struct(dt):
426
return dbus.Struct(dt.year, dt.month, dt.day, dt.hour,
427
dt.minute, dt.second, dt.microsecond,
428
signature="nyyyyyu")
429
430
# BumpTimeout - method
431
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
432
BumpTimeout.__name__ = "BumpTimeout"
433
434
# IntervalChanged - signal
435
@dbus.service.signal(_interface, signature="t")
436
def IntervalChanged(self, t):
437
"D-Bus signal"
438
pass
439
440
# CheckerCompleted - signal
441
@dbus.service.signal(_interface, signature="b")
442
def CheckerCompleted(self, success):
443
"D-Bus signal"
444
pass
445
446
# CheckerIsRunning - method
447
@dbus.service.method(_interface, out_signature="b")
448
def CheckerIsRunning(self):
449
"D-Bus getter method"
450
return self.checker is not None
451
452
# CheckerStarted - signal
453
@dbus.service.signal(_interface, signature="s")
454
def CheckerStarted(self, command):
455
"D-Bus signal"
456
pass
457
458
# GetChecker - method
459
@dbus.service.method(_interface, out_signature="s")
460
def GetChecker(self):
461
"D-Bus getter method"
462
return self.checker_command
463
464
# GetCreated - method
465
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
466
def GetCreated(self):
467
"D-Bus getter method"
468
return datetime_to_dbus_struct(self.created)
469
470
# GetFingerprint - method
471
@dbus.service.method(_interface, out_signature="s")
472
def GetFingerprint(self):
473
"D-Bus getter method"
474
return self.fingerprint
475
476
# GetHost - method
477
@dbus.service.method(_interface, out_signature="s")
478
def GetHost(self):
479
"D-Bus getter method"
480
return self.host
481
482
# GetInterval - method
483
@dbus.service.method(_interface, out_signature="t")
484
def GetInterval(self):
485
"D-Bus getter method"
486
return self._interval_milliseconds
487
488
# GetName - method
489
@dbus.service.method(_interface, out_signature="s")
490
def GetName(self):
491
"D-Bus getter method"
492
return self.name
493
494
# GetStarted - method
495
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
496
def GetStarted(self):
497
"D-Bus getter method"
498
if self.started is not None:
499
return datetime_to_dbus_struct(self.started)
500
else:
501
return dbus.Struct(0, 0, 0, 0, 0, 0, 0,
502
signature="nyyyyyu")
503
504
# GetTimeout - method
505
@dbus.service.method(_interface, out_signature="t")
506
def GetTimeout(self):
507
"D-Bus getter method"
508
return self._timeout_milliseconds
509
510
# SetChecker - method
511
@dbus.service.method(_interface, in_signature="s")
512
def SetChecker(self, checker):
513
"D-Bus setter method"
514
self.checker_command = checker
515
516
# SetHost - method
517
@dbus.service.method(_interface, in_signature="s")
518
def SetHost(self, host):
519
"D-Bus setter method"
520
self.host = host
521
522
# SetInterval - method
523
@dbus.service.method(_interface, in_signature="t")
524
def SetInterval(self, milliseconds):
525
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
526
527
# SetTimeout - method
528
@dbus.service.method(_interface, in_signature="t")
529
def SetTimeout(self, milliseconds):
530
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
531
532
# SetSecret - method
533
@dbus.service.method(_interface, in_signature="ay",
534
byte_arrays=True)
535
def SetSecret(self, secret):
536
"D-Bus setter method"
537
self.secret = str(secret)
538
539
# Start - method
540
Start = dbus.service.method(_interface)(start)
541
Start.__name__ = "Start"
542
543
# StartChecker - method
544
StartChecker = dbus.service.method(_interface)(start_checker)
545
StartChecker.__name__ = "StartChecker"
546
547
# StateChanged - signal
548
@dbus.service.signal(_interface, signature="b")
549
def StateChanged(self, started):
550
"D-Bus signal"
551
pass
552
553
# StillValid - method
554
StillValid = (dbus.service.method(_interface, out_signature="b")
555
(still_valid))
556
StillValid.__name__ = "StillValid"
557
558
# Stop - method
559
Stop = dbus.service.method(_interface)(stop)
560
Stop.__name__ = "Stop"
561
562
# StopChecker - method
563
StopChecker = dbus.service.method(_interface)(stop_checker)
564
StopChecker.__name__ = "StopChecker"
565
566
# TimeoutChanged - signal
567
@dbus.service.signal(_interface, signature="t")
568
def TimeoutChanged(self, t):
569
"D-Bus signal"
570
pass
571
572
del _datetime_to_dbus_struct
573
del _interface
255
return now < (self.last_seen + self.timeout)
574
256
575
257
576
258
def peer_certificate(session):
577
"Return the peer's OpenPGP certificate as a bytestring"
578
259
# If not an OpenPGP certificate...
579
if (gnutls.library.functions
580
.gnutls_certificate_type_get(session._c_object)
581
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
260
if gnutls.library.functions.gnutls_certificate_type_get\
261
(session._c_object) \
262
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
582
263
# ...do the normal thing
583
264
return session.peer_certificate
584
265
list_size = ctypes.c_uint()
585
cert_list = (gnutls.library.functions
586
.gnutls_certificate_get_peers
587
(session._c_object, ctypes.byref(list_size)))
266
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
267
(session._c_object, ctypes.byref(list_size))
588
268
if list_size.value == 0:
589
269
return None
590
270
cert = cert_list[0]
592
272
593
273
594
274
def fingerprint(openpgp):
595
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
596
# New GnuTLS "datum" with the OpenPGP public key
597
datum = (gnutls.library.types
598
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
599
ctypes.POINTER
600
(ctypes.c_ubyte)),
601
ctypes.c_uint(len(openpgp))))
602
275
# New empty GnuTLS certificate
603
276
crt = gnutls.library.types.gnutls_openpgp_crt_t()
604
(gnutls.library.functions
605
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
277
gnutls.library.functions.gnutls_openpgp_crt_init\
278
(ctypes.byref(crt))
279
# New GnuTLS "datum" with the OpenPGP public key
280
datum = gnutls.library.types.gnutls_datum_t\
281
(ctypes.cast(ctypes.c_char_p(openpgp),
282
ctypes.POINTER(ctypes.c_ubyte)),
283
ctypes.c_uint(len(openpgp)))
606
284
# Import the OpenPGP public key into the certificate
607
(gnutls.library.functions
608
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
609
gnutls.library.constants
610
.GNUTLS_OPENPGP_FMT_RAW))
611
# Verify the self signature in the key
612
crtverify = ctypes.c_uint()
613
(gnutls.library.functions
614
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
615
if crtverify.value != 0:
616
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
617
raise gnutls.errors.CertificateSecurityError("Verify failed")
285
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
286
(crt,
287
ctypes.byref(datum),
288
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
618
289
# New buffer for the fingerprint
619
buf = ctypes.create_string_buffer(20)
620
buf_len = ctypes.c_size_t()
290
buffer = ctypes.create_string_buffer(20)
291
buffer_length = ctypes.c_size_t()
621
292
# Get the fingerprint from the certificate into the buffer
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
624
ctypes.byref(buf_len)))
293
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
294
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
625
295
# Deinit the certificate
626
296
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
297
# Convert the buffer to a Python bytestring
628
fpr = ctypes.string_at(buf, buf_len.value)
298
fpr = ctypes.string_at(buffer, buffer_length.value)
629
299
# Convert the bytestring to hexadecimal notation
630
300
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
631
301
return hex_fpr
632
302
633
303
634
class TCP_handler(SocketServer.BaseRequestHandler, object):
304
class tcp_handler(SocketServer.BaseRequestHandler, object):
635
305
"""A TCP request handler class.
636
306
Instantiated by IPv6_TCPServer for each request to handle it.
637
307
Note: This will run in its own forked process."""
638
308
639
309
def handle(self):
640
logger.info(u"TCP connection from: %s",
641
unicode(self.client_address))
642
session = (gnutls.connection
643
.ClientSession(self.request,
644
gnutls.connection
645
.X509Credentials()))
646
647
line = self.request.makefile().readline()
648
logger.debug(u"Protocol version: %r", line)
649
try:
650
if int(line.strip().split()[0]) > 1:
651
raise RuntimeError
652
except (ValueError, IndexError, RuntimeError), error:
653
logger.error(u"Unknown protocol version: %s", error)
654
return
655
656
# Note: gnutls.connection.X509Credentials is really a generic
657
# GnuTLS certificate credentials object so long as no X.509
658
# keys are added to it. Therefore, we can use it here despite
659
# using OpenPGP certificates.
310
logger.debug(u"TCP connection from: %s",
311
unicode(self.client_address))
312
session = gnutls.connection.ClientSession(self.request,
313
gnutls.connection.\
314
X509Credentials())
660
315
661
316
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
662
317
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
663
318
# "+DHE-DSS"))
664
# Use a fallback default, since this MUST be set.
665
priority = self.server.settings.get("priority", "NORMAL")
666
(gnutls.library.functions
667
.gnutls_priority_set_direct(session._c_object,
668
priority, None))
319
priority = "SECURE256"
320
321
gnutls.library.functions.gnutls_priority_set_direct\
322
(session._c_object, priority, None);
669
323
670
324
try:
671
325
session.handshake()
672
326
except gnutls.errors.GNUTLSError, error:
673
logger.warning(u"Handshake failed: %s", error)
327
logger.debug(u"Handshake failed: %s", error)
674
328
# Do not run session.bye() here: the session is not
675
329
# established. Just abandon the request.
676
330
return
677
331
try:
678
332
fpr = fingerprint(peer_certificate(session))
679
333
except (TypeError, gnutls.errors.GNUTLSError), error:
680
logger.warning(u"Bad certificate: %s", error)
334
logger.debug(u"Bad certificate: %s", error)
681
335
session.bye()
682
336
return
683
337
logger.debug(u"Fingerprint: %s", fpr)
684
for c in self.server.clients:
338
client = None
339
for c in clients:
685
340
if c.fingerprint == fpr:
686
341
client = c
687
342
break
688
else:
689
logger.warning(u"Client not found for fingerprint: %s",
690
fpr)
691
session.bye()
692
return
693
343
# Have to check if client.still_valid(), since it is possible
694
344
# that the client timed out while establishing the GnuTLS
695
345
# session.
696
if not client.still_valid():
697
logger.warning(u"Client %(name)s is invalid",
698
vars(client))
346
if (not client) or (not client.still_valid()):
347
if client:
348
logger.debug(u"Client %(name)s is invalid",
349
vars(client))
350
else:
351
logger.debug(u"Client not found for fingerprint: %s",
352
fpr)
699
353
session.bye()
700
354
return
701
## This won't work here, since we're in a fork.
702
# client.bump_timeout()
703
355
sent_size = 0
704
356
while sent_size < len(client.secret):
705
357
sent = session.send(client.secret[sent_size:])
710
362
session.bye()
711
363
712
364
713
class IPv6_TCPServer(SocketServer.ForkingMixIn,
714
SocketServer.TCPServer, object):
365
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
715
366
"""IPv6 TCP server. Accepts 'None' as address and/or port.
716
367
Attributes:
717
settings: Server settings
368
options: Command line options
718
369
clients: Set() of Client objects
719
enabled: Boolean; whether this server is activated yet
720
370
"""
721
371
address_family = socket.AF_INET6
722
372
def __init__(self, *args, **kwargs):
723
if "settings" in kwargs:
724
self.settings = kwargs["settings"]
725
del kwargs["settings"]
373
if "options" in kwargs:
374
self.options = kwargs["options"]
375
del kwargs["options"]
726
376
if "clients" in kwargs:
727
377
self.clients = kwargs["clients"]
728
378
del kwargs["clients"]
729
self.enabled = False
730
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
379
return super(type(self), self).__init__(*args, **kwargs)
731
380
def server_bind(self):
732
381
"""This overrides the normal server_bind() function
733
382
to bind to an interface if one was specified, and also NOT to
734
383
bind to an address or port if they were not specified."""
735
if self.settings["interface"]:
736
# 25 is from /usr/include/asm-i486/socket.h
737
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
384
if self.options.interface:
385
if not hasattr(socket, "SO_BINDTODEVICE"):
386
# From /usr/include/asm-i486/socket.h
387
socket.SO_BINDTODEVICE = 25
738
388
try:
739
389
self.socket.setsockopt(socket.SOL_SOCKET,
740
SO_BINDTODEVICE,
741
self.settings["interface"])
390
socket.SO_BINDTODEVICE,
391
self.options.interface)
742
392
except socket.error, error:
743
393
if error[0] == errno.EPERM:
744
logger.error(u"No permission to"
745
u" bind to interface %s",
746
self.settings["interface"])
394
logger.warning(u"No permission to"
395
u" bind to interface %s",
396
self.options.interface)
747
397
else:
748
398
raise error
749
399
# Only bind(2) the socket if we really need to.
752
402
in6addr_any = "::"
753
403
self.server_address = (in6addr_any,
754
404
self.server_address[1])
755
elif not self.server_address[1]:
405
elif self.server_address[1] is None:
756
406
self.server_address = (self.server_address[0],
757
407
0)
758
# if self.settings["interface"]:
759
# self.server_address = (self.server_address[0],
760
# 0, # port
761
# 0, # flowinfo
762
# if_nametoindex
763
# (self.settings
764
# ["interface"]))
765
return super(IPv6_TCPServer, self).server_bind()
766
def server_activate(self):
767
if self.enabled:
768
return super(IPv6_TCPServer, self).server_activate()
769
def enable(self):
770
self.enabled = True
408
return super(type(self), self).server_bind()
771
409
772
410
773
411
def string_to_delta(interval):
783
421
datetime.timedelta(1)
784
422
>>> string_to_delta(u'1w')
785
423
datetime.timedelta(7)
786
>>> string_to_delta('5m 30s')
787
datetime.timedelta(0, 330)
788
424
"""
789
timevalue = datetime.timedelta(0)
790
for s in interval.split():
791
try:
792
suffix = unicode(s[-1])
793
value = int(s[:-1])
794
if suffix == u"d":
795
delta = datetime.timedelta(value)
796
elif suffix == u"s":
797
delta = datetime.timedelta(0, value)
798
elif suffix == u"m":
799
delta = datetime.timedelta(0, 0, 0, 0, value)
800
elif suffix == u"h":
801
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
802
elif suffix == u"w":
803
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
804
else:
805
raise ValueError
806
except (ValueError, IndexError):
425
try:
426
suffix=unicode(interval[-1])
427
value=int(interval[:-1])
428
if suffix == u"d":
429
delta = datetime.timedelta(value)
430
elif suffix == u"s":
431
delta = datetime.timedelta(0, value)
432
elif suffix == u"m":
433
delta = datetime.timedelta(0, 0, 0, 0, value)
434
elif suffix == u"h":
435
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
436
elif suffix == u"w":
437
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
438
else:
807
439
raise ValueError
808
timevalue += delta
809
return timevalue
440
except (ValueError, IndexError):
441
raise ValueError
442
return delta
443
444
445
def add_service():
446
"""From the Avahi server example code"""
447
global group, serviceName, serviceType, servicePort, serviceTXT, \
448
domain, host
449
if group is None:
450
group = dbus.Interface(
451
bus.get_object( avahi.DBUS_NAME,
452
server.EntryGroupNew()),
453
avahi.DBUS_INTERFACE_ENTRY_GROUP)
454
group.connect_to_signal('StateChanged',
455
entry_group_state_changed)
456
logger.debug(u"Adding service '%s' of type '%s' ...",
457
serviceName, serviceType)
458
459
group.AddService(
460
serviceInterface, # interface
461
avahi.PROTO_INET6, # protocol
462
dbus.UInt32(0), # flags
463
serviceName, serviceType,
464
domain, host,
465
dbus.UInt16(servicePort),
466
avahi.string_array_to_txt_array(serviceTXT))
467
group.Commit()
468
469
470
def remove_service():
471
"""From the Avahi server example code"""
472
global group
473
474
if not group is None:
475
group.Reset()
810
476
811
477
812
478
def server_state_changed(state):
813
"""Derived from the Avahi example code"""
479
"""From the Avahi server example code"""
814
480
if state == avahi.SERVER_COLLISION:
815
logger.error(u"Zeroconf server name collision")
816
service.remove()
481
logger.warning(u"Server name collision")
482
remove_service()
817
483
elif state == avahi.SERVER_RUNNING:
818
service.add()
484
add_service()
819
485
820
486
821
487
def entry_group_state_changed(state, error):
822
"""Derived from the Avahi example code"""
823
logger.debug(u"Avahi state change: %i", state)
488
"""From the Avahi server example code"""
489
global serviceName, server, rename_count
490
491
logger.debug(u"state change: %i", state)
824
492
825
493
if state == avahi.ENTRY_GROUP_ESTABLISHED:
826
logger.debug(u"Zeroconf service established.")
494
logger.debug(u"Service established.")
827
495
elif state == avahi.ENTRY_GROUP_COLLISION:
828
logger.warning(u"Zeroconf service name collision.")
829
service.rename()
496
497
rename_count = rename_count - 1
498
if rename_count > 0:
499
name = server.GetAlternativeServiceName(name)
500
logger.warning(u"Service name collision, "
501
u"changing name to '%s' ...", name)
502
remove_service()
503
add_service()
504
505
else:
506
logger.error(u"No suitable service name found "
507
u"after %i retries, exiting.",
508
n_rename)
509
main_loop.quit()
830
510
elif state == avahi.ENTRY_GROUP_FAILURE:
831
logger.critical(u"Avahi: Error in group state changed %s",
832
unicode(error))
833
raise AvahiGroupError("State changed: %s", str(error))
511
logger.error(u"Error in group state changed %s",
512
unicode(error))
513
main_loop.quit()
514
return
515
834
516
835
517
def if_nametoindex(interface):
836
"""Call the C function if_nametoindex(), or equivalent"""
837
global if_nametoindex
518
"""Call the C function if_nametoindex()"""
838
519
try:
839
if_nametoindex = (ctypes.cdll.LoadLibrary
840
(ctypes.util.find_library("c"))
841
.if_nametoindex)
520
libc = ctypes.cdll.LoadLibrary("libc.so.6")
521
return libc.if_nametoindex(interface)
842
522
except (OSError, AttributeError):
843
523
if "struct" not in sys.modules:
844
524
import struct
845
525
if "fcntl" not in sys.modules:
846
526
import fcntl
847
def if_nametoindex(interface):
848
"Get an interface index the hard way, i.e. using fcntl()"
849
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
850
with closing(socket.socket()) as s:
851
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
852
struct.pack("16s16x", interface))
853
interface_index = struct.unpack("I", ifreq[16:20])[0]
854
return interface_index
855
return if_nametoindex(interface)
856
857
858
def daemon(nochdir = False, noclose = False):
859
"""See daemon(3). Standard BSD Unix function.
860
This should really exist as os.daemon, but it doesn't (yet)."""
861
if os.fork():
862
sys.exit()
863
os.setsid()
864
if not nochdir:
865
os.chdir("/")
866
if os.fork():
867
sys.exit()
868
if not noclose:
869
# Close all standard open file descriptors
870
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
871
if not stat.S_ISCHR(os.fstat(null).st_mode):
872
raise OSError(errno.ENODEV,
873
"/dev/null not a character device")
874
os.dup2(null, sys.stdin.fileno())
875
os.dup2(null, sys.stdout.fileno())
876
os.dup2(null, sys.stderr.fileno())
877
if null > 2:
878
os.close(null)
879
880
881
def main():
882
parser = OptionParser(version = "%%prog %s" % version)
527
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
528
s = socket.socket()
529
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
530
struct.pack("16s16x", interface))
531
s.close()
532
interface_index = struct.unpack("I", ifreq[16:20])[0]
533
return interface_index
534
535
536
if __name__ == '__main__':
537
parser = OptionParser()
883
538
parser.add_option("-i", "--interface", type="string",
884
metavar="IF", help="Bind to interface IF")
885
parser.add_option("-a", "--address", type="string",
886
help="Address to listen for requests on")
887
parser.add_option("-p", "--port", type="int",
539
default=None, metavar="IF",
540
help="Bind to interface IF")
541
parser.add_option("--cert", type="string", default="cert.pem",
542
metavar="FILE",
543
help="Public key certificate PEM file to use")
544
parser.add_option("--key", type="string", default="key.pem",
545
metavar="FILE",
546
help="Private key PEM file to use")
547
parser.add_option("--ca", type="string", default="ca.pem",
548
metavar="FILE",
549
help="Certificate Authority certificate PEM file to use")
550
parser.add_option("--crl", type="string", default="crl.pem",
551
metavar="FILE",
552
help="Certificate Revokation List PEM file to use")
553
parser.add_option("-p", "--port", type="int", default=None,
888
554
help="Port number to receive requests on")
555
parser.add_option("--timeout", type="string", # Parsed later
556
default="1h",
557
help="Amount of downtime allowed for clients")
558
parser.add_option("--interval", type="string", # Parsed later
559
default="5m",
560
help="How often to check that a client is up")
889
561
parser.add_option("--check", action="store_true", default=False,
890
562
help="Run self-test")
891
parser.add_option("--debug", action="store_true",
892
help="Debug mode; run in foreground and log to"
893
" terminal")
894
parser.add_option("--priority", type="string", help="GnuTLS"
895
" priority string (see GnuTLS documentation)")
896
parser.add_option("--servicename", type="string", metavar="NAME",
897
help="Zeroconf service name")
898
parser.add_option("--configdir", type="string",
899
default="/etc/mandos", metavar="DIR",
900
help="Directory to search for configuration"
901
" files")
902
options = parser.parse_args()[0]
563
parser.add_option("--debug", action="store_true", default=False,
564
help="Debug mode")
565
(options, args) = parser.parse_args()
903
566
904
567
if options.check:
905
568
import doctest
906
569
doctest.testmod()
907
570
sys.exit()
908
571
909
# Default values for config file for server-global settings
910
server_defaults = { "interface": "",
911
"address": "",
912
"port": "",
913
"debug": "False",
914
"priority":
915
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
916
"servicename": "Mandos",
917
}
918
919
# Parse config file for server-global settings
920
server_config = ConfigParser.SafeConfigParser(server_defaults)
921
del server_defaults
922
server_config.read(os.path.join(options.configdir, "mandos.conf"))
923
# Convert the SafeConfigParser object to a dict
924
server_settings = server_config.defaults()
925
# Use getboolean on the boolean config option
926
server_settings["debug"] = (server_config.getboolean
927
("DEFAULT", "debug"))
928
del server_config
929
930
# Override the settings from the config file with command line
931
# options, if set.
932
for option in ("interface", "address", "port", "debug",
933
"priority", "servicename", "configdir"):
934
value = getattr(options, option)
935
if value is not None:
936
server_settings[option] = value
937
del options
938
# Now we have our good server settings in "server_settings"
939
940
debug = server_settings["debug"]
941
942
if not debug:
943
syslogger.setLevel(logging.WARNING)
944
console.setLevel(logging.WARNING)
945
946
if server_settings["servicename"] != "Mandos":
947
syslogger.setFormatter(logging.Formatter
948
('Mandos (%s): %%(levelname)s:'
949
' %%(message)s'
950
% server_settings["servicename"]))
951
952
# Parse config file with clients
953
client_defaults = { "timeout": "1h",
954
"interval": "5m",
955
"checker": "fping -q -- %(host)s",
956
"host": "",
957
}
958
client_config = ConfigParser.SafeConfigParser(client_defaults)
959
client_config.read(os.path.join(server_settings["configdir"],
960
"clients.conf"))
961
962
clients = Set()
963
tcp_server = IPv6_TCPServer((server_settings["address"],
964
server_settings["port"]),
965
TCP_handler,
966
settings=server_settings,
967
clients=clients)
968
pidfilename = "/var/run/mandos.pid"
969
try:
970
pidfile = open(pidfilename, "w")
971
except IOError, error:
972
logger.error("Could not open file %r", pidfilename)
973
974
uid = 65534
975
gid = 65534
976
try:
977
uid = pwd.getpwnam("mandos").pw_uid
978
except KeyError:
979
try:
980
uid = pwd.getpwnam("nobody").pw_uid
981
except KeyError:
982
pass
983
try:
984
gid = pwd.getpwnam("mandos").pw_gid
985
except KeyError:
986
try:
987
gid = pwd.getpwnam("nogroup").pw_gid
988
except KeyError:
989
pass
990
try:
991
os.setuid(uid)
992
os.setgid(gid)
993
except OSError, error:
994
if error[0] != errno.EPERM:
995
raise error
996
997
global service
998
service = AvahiService(name = server_settings["servicename"],
999
servicetype = "_mandos._tcp", )
1000
if server_settings["interface"]:
1001
service.interface = (if_nametoindex
1002
(server_settings["interface"]))
1003
1004
global main_loop
1005
global bus
1006
global server
1007
# From the Avahi example code
572
# Parse the time arguments
573
try:
574
options.timeout = string_to_delta(options.timeout)
575
except ValueError:
576
parser.error("option --timeout: Unparseable time")
577
try:
578
options.interval = string_to_delta(options.interval)
579
except ValueError:
580
parser.error("option --interval: Unparseable time")
581
582
# Parse config file
583
defaults = { "checker": "sleep 1; fping -q -- %%(fqdn)s" }
584
client_config = ConfigParser.SafeConfigParser(defaults)
585
#client_config.readfp(open("secrets.conf"), "secrets.conf")
586
client_config.read("mandos-clients.conf")
587
588
# From the Avahi server example code
1008
589
DBusGMainLoop(set_as_default=True )
1009
590
main_loop = gobject.MainLoop()
1010
591
bus = dbus.SystemBus()
1011
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1012
avahi.DBUS_PATH_SERVER),
1013
avahi.DBUS_INTERFACE_SERVER)
592
server = dbus.Interface(
593
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
594
avahi.DBUS_INTERFACE_SERVER )
1014
595
# End of Avahi example code
1015
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
1016
596
597
debug = options.debug
598
599
clients = Set()
1017
600
def remove_from_clients(client):
1018
601
clients.remove(client)
1019
602
if not clients:
1020
logger.critical(u"No clients left, exiting")
1021
sys.exit()
603
logger.debug(u"No clients left, exiting")
604
main_loop.quit()
1022
605
1023
clients.update(Set(Client(name = section,
606
clients.update(Set(Client(name=section, options=options,
1024
607
stop_hook = remove_from_clients,
1025
config
1026
= dict(client_config.items(section)))
608
**(dict(client_config\
609
.items(section))))
1027
610
for section in client_config.sections()))
1028
if not clients:
1029
logger.critical(u"No clients defined")
1030
sys.exit(1)
1031
1032
if debug:
1033
# Redirect stdin so all checkers get /dev/null
1034
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1035
os.dup2(null, sys.stdin.fileno())
1036
if null > 2:
1037
os.close(null)
1038
else:
1039
# No console logging
1040
logger.removeHandler(console)
1041
# Close all input and output, do double fork, etc.
1042
daemon()
1043
1044
try:
1045
pid = os.getpid()
1046
pidfile.write(str(pid) + "\n")
1047
pidfile.close()
1048
del pidfile
1049
except IOError:
1050
logger.error(u"Could not write to file %r with PID %d",
1051
pidfilename, pid)
1052
except NameError:
1053
# "pidfile" was never created
1054
pass
1055
del pidfilename
1056
1057
def cleanup():
1058
"Cleanup function; run on exit"
1059
global group
1060
# From the Avahi example code
1061
if not group is None:
1062
group.Free()
1063
group = None
1064
# End of Avahi example code
1065
1066
while clients:
1067
client = clients.pop()
1068
client.stop_hook = None
1069
client.stop()
1070
1071
atexit.register(cleanup)
1072
1073
if not debug:
1074
signal.signal(signal.SIGINT, signal.SIG_IGN)
1075
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1076
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1077
1078
611
for client in clients:
1079
612
client.start()
1080
613
1081
tcp_server.enable()
1082
tcp_server.server_activate()
1083
1084
# Find out what port we got
1085
service.port = tcp_server.socket.getsockname()[1]
1086
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1087
u" scope_id %d" % tcp_server.socket.getsockname())
1088
1089
#service.interface = tcp_server.socket.getsockname()[3]
1090
614
tcp_server = IPv6_TCPServer((None, options.port),
615
tcp_handler,
616
options=options,
617
clients=clients)
618
# Find out what random port we got
619
servicePort = tcp_server.socket.getsockname()[1]
620
logger.debug(u"Now listening on port %d", servicePort)
621
622
if options.interface is not None:
623
serviceInterface = if_nametoindex(options.interface)
624
625
# From the Avahi server example code
626
server.connect_to_signal("StateChanged", server_state_changed)
627
server_state_changed(server.GetState())
628
# End of Avahi example code
629
630
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
631
lambda *args, **kwargs:
632
tcp_server.handle_request(*args[2:],
633
**kwargs) or True)
1091
634
try:
1092
# From the Avahi example code
1093
server.connect_to_signal("StateChanged", server_state_changed)
1094
try:
1095
server_state_changed(server.GetState())
1096
except dbus.exceptions.DBusException, error:
1097
logger.critical(u"DBusException: %s", error)
1098
sys.exit(1)
1099
# End of Avahi example code
1100
1101
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1102
lambda *args, **kwargs:
1103
(tcp_server.handle_request
1104
(*args[2:], **kwargs) or True))
1105
1106
logger.debug(u"Starting main loop")
1107
635
main_loop.run()
1108
except AvahiError, error:
1109
logger.critical(u"AvahiError: %s" + unicode(error))
1110
sys.exit(1)
1111
636
except KeyboardInterrupt:
1112
if debug:
1113
print
637
print
638
639
# Cleanup here
1114
640
1115
if __name__ == '__main__':
1116
main()
641
# From the Avahi server example code
642
if not group is None:
643
group.Free()
644
# End of Avahi example code
645
646
for client in clients:
647
client.stop_hook = None
648
client.stop()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0