2
2
# -*- mode: python; coding: utf-8 -*-
4
# Mandos server - give out binary blobs to connecting clients.
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
# This program is free software: you can redistribute it and/or modify
17
# it under the terms of the GNU General Public License as published by
18
# the Free Software Foundation, either version 3 of the License, or
19
# (at your option) any later version.
21
# This program is distributed in the hope that it will be useful,
22
# but WITHOUT ANY WARRANTY; without even the implied warranty of
23
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24
# GNU General Public License for more details.
26
# You should have received a copy of the GNU General Public License
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
29
# Contact the authors at <mandos@fukt.bsnet.se>.
32
4
from __future__ import division
70
42
logger.addHandler(syslogger)
74
class AvahiError(Exception):
75
def __init__(self, value):
78
return repr(self.value)
80
class AvahiServiceError(AvahiError):
83
class AvahiGroupError(AvahiError):
87
class AvahiService(object):
88
"""An Avahi (Zeroconf) service.
90
interface: integer; avahi.IF_UNSPEC or an interface index.
91
Used to optionally bind to the specified interface.
92
name: string; Example: 'Mandos'
93
type: string; Example: '_mandos._tcp'.
94
See <http://www.dns-sd.org/ServiceTypes.html>
95
port: integer; what port to announce
96
TXT: list of strings; TXT record for the service
97
domain: string; Domain to publish on, default to .local if empty.
98
host: string; Host to publish records for, default is localhost
99
max_renames: integer; maximum number of renames
100
rename_count: integer; counter so we only rename after collisions
101
a sensible number of times
103
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
104
type = None, port = None, TXT = None, domain = "",
105
host = "", max_renames = 12):
106
self.interface = interface
116
self.rename_count = 0
118
"""Derived from the Avahi example code"""
119
if self.rename_count >= self.max_renames:
120
logger.critical(u"No suitable service name found after %i"
121
u" retries, exiting.", rename_count)
122
raise AvahiServiceError("Too many renames")
123
name = server.GetAlternativeServiceName(name)
124
logger.error(u"Changing name to %r ...", name)
127
self.rename_count += 1
129
"""Derived from the Avahi example code"""
130
if group is not None:
133
"""Derived from the Avahi example code"""
136
group = dbus.Interface\
137
(bus.get_object(avahi.DBUS_NAME,
138
server.EntryGroupNew()),
139
avahi.DBUS_INTERFACE_ENTRY_GROUP)
140
group.connect_to_signal('StateChanged',
141
entry_group_state_changed)
142
logger.debug(u"Adding service '%s' of type '%s' ...",
143
service.name, service.type)
145
self.interface, # interface
146
avahi.PROTO_INET6, # protocol
147
dbus.UInt32(0), # flags
148
self.name, self.type,
149
self.domain, self.host,
150
dbus.UInt16(self.port),
151
avahi.string_array_to_txt_array(self.TXT))
154
# From the Avahi example code:
155
group = None # our entry group
45
# This variable is used to optionally bind to a specified interface.
46
# It is a global variable to fit in with the other variables from the
47
# Avahi server example code.
48
serviceInterface = avahi.IF_UNSPEC
49
# From the Avahi server example code:
50
serviceName = "Mandos"
51
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
52
servicePort = None # Not known at startup
53
serviceTXT = [] # TXT record for the service
54
domain = "" # Domain to publish on, default to .local
55
host = "" # Host to publish records for, default to localhost
56
group = None #our entry group
57
rename_count = 12 # Counter so we only rename after collisions a
58
# sensible number of times
156
59
# End of Avahi example code
164
67
uniquely identify the client
165
68
secret: bytestring; sent verbatim (over TLS) to client
166
69
fqdn: string (FQDN); available for use by the checker command
167
created: datetime.datetime(); object creation, not client host
168
last_checked_ok: datetime.datetime() or None if not yet checked OK
169
timeout: datetime.timedelta(); How long from last_checked_ok
170
until this client is invalid
70
created: datetime.datetime()
71
last_seen: datetime.datetime() or None if not yet seen
72
timeout: datetime.timedelta(); How long from last_seen until
73
this client is invalid
171
74
interval: datetime.timedelta(); How often to start a new checker
172
75
stop_hook: If set, called by stop() as stop_hook(self)
173
76
checker: subprocess.Popen(); a running checker process used
174
77
to see if the client lives.
175
'None' if no process is running.
78
Is None if no process is running.
176
79
checker_initiator_tag: a gobject event source tag, or None
177
80
stop_initiator_tag: - '' -
178
81
checker_callback_tag: - '' -
179
82
checker_command: string; External command which is run to check if
180
client lives. %() expansions are done at
83
client lives. %()s expansions are done at
181
84
runtime with vars(self) as dict, so that for
182
85
instance %(name)s can be used in the command.
183
86
Private attibutes:
184
87
_timeout: Real variable for 'timeout'
185
88
_interval: Real variable for 'interval'
186
_timeout_milliseconds: Used when calling gobject.timeout_add()
89
_timeout_milliseconds: Used by gobject.timeout_add()
187
90
_interval_milliseconds: - '' -
189
92
def _set_timeout(self, timeout):
209
112
interval = property(lambda self: self._interval,
211
114
del _set_interval
212
def __init__(self, name = None, stop_hook=None, config={}):
213
"""Note: the 'checker' key in 'config' sets the
214
'checker_command' attribute and *not* the 'checker'
115
def __init__(self, name=None, options=None, stop_hook=None,
116
fingerprint=None, secret=None, secfile=None,
117
fqdn=None, timeout=None, interval=-1, checker=None):
217
logger.debug(u"Creating client %r", self.name)
218
# Uppercase and remove spaces from fingerprint for later
219
# comparison purposes with return value from the fingerprint()
221
self.fingerprint = config["fingerprint"].upper()\
223
logger.debug(u" Fingerprint: %s", self.fingerprint)
224
if "secret" in config:
225
self.secret = config["secret"].decode(u"base64")
226
elif "secfile" in config:
227
sf = open(config["secfile"])
119
# Uppercase and remove spaces from fingerprint
120
# for later comparison purposes with return value of
121
# the fingerprint() function
122
self.fingerprint = fingerprint.upper().replace(u" ", u"")
124
self.secret = secret.decode(u"base64")
228
127
self.secret = sf.read()
231
raise TypeError(u"No secret or secfile for client %s"
233
self.fqdn = config.get("fqdn", "")
130
raise RuntimeError(u"No secret or secfile for client %s"
132
self.fqdn = fqdn # string
234
133
self.created = datetime.datetime.now()
235
self.last_checked_ok = None
236
self.timeout = string_to_delta(config["timeout"])
237
self.interval = string_to_delta(config["interval"])
134
self.last_seen = None
136
self.timeout = options.timeout
138
self.timeout = string_to_delta(timeout)
140
self.interval = options.interval
142
self.interval = string_to_delta(interval)
238
143
self.stop_hook = stop_hook
239
144
self.checker = None
240
145
self.checker_initiator_tag = None
241
146
self.stop_initiator_tag = None
242
147
self.checker_callback_tag = None
243
self.check_command = config["checker"]
148
self.check_command = checker
245
"""Start this client's checker and timeout hooks"""
150
"""Start this clients checker and timeout hooks"""
246
151
# Schedule a new checker to be started an 'interval' from now,
247
152
# and every interval from then on.
248
153
self.checker_initiator_tag = gobject.timeout_add\
258
163
"""Stop this client.
259
The possibility that a client might be restarted is left open,
260
but not currently used."""
261
# If this client doesn't have a secret, it is already stopped.
263
logger.info(u"Stopping client %s", self.name)
267
if getattr(self, "stop_initiator_tag", False):
164
The possibility that this client might be restarted is left
165
open, but not currently used."""
166
logger.debug(u"Stopping client %s", self.name)
168
if self.stop_initiator_tag:
268
169
gobject.source_remove(self.stop_initiator_tag)
269
170
self.stop_initiator_tag = None
270
if getattr(self, "checker_initiator_tag", False):
171
if self.checker_initiator_tag:
271
172
gobject.source_remove(self.checker_initiator_tag)
272
173
self.checker_initiator_tag = None
273
174
self.stop_checker()
276
177
# Do not run this again if called by a gobject.timeout_add
278
179
def __del__(self):
279
self.stop_hook = None
180
# Some code duplication here and in stop()
181
if hasattr(self, "stop_initiator_tag") \
182
and self.stop_initiator_tag:
183
gobject.source_remove(self.stop_initiator_tag)
184
self.stop_initiator_tag = None
185
if hasattr(self, "checker_initiator_tag") \
186
and self.checker_initiator_tag:
187
gobject.source_remove(self.checker_initiator_tag)
188
self.checker_initiator_tag = None
281
190
def checker_callback(self, pid, condition):
282
191
"""The checker has completed, so take appropriate actions."""
283
192
now = datetime.datetime.now()
284
self.checker_callback_tag = None
286
193
if os.WIFEXITED(condition) \
287
194
and (os.WEXITSTATUS(condition) == 0):
288
logger.info(u"Checker for %(name)s succeeded",
290
self.last_checked_ok = now
195
logger.debug(u"Checker for %(name)s succeeded",
291
198
gobject.source_remove(self.stop_initiator_tag)
292
199
self.stop_initiator_tag = gobject.timeout_add\
293
200
(self._timeout_milliseconds,
296
203
logger.warning(u"Checker for %(name)s crashed?",
299
logger.info(u"Checker for %(name)s failed",
206
logger.debug(u"Checker for %(name)s failed",
209
self.checker_callback_tag = None
301
210
def start_checker(self):
302
211
"""Start a new checker subprocess if one is not running.
303
212
If a checker already exists, leave it running and do
305
# The reason for not killing a running checker is that if we
306
# did that, then if a checker (for some reason) started
307
# running slowly and taking more than 'interval' time, the
308
# client would inevitably timeout, since no checker would get
309
# a chance to run to completion. If we instead leave running
310
# checkers alone, the checker would have to take more time
311
# than 'timeout' for the client to be declared invalid, which
312
# is as it should be.
313
214
if self.checker is None:
315
# In case check_command has exactly one % operator
316
216
command = self.check_command % self.fqdn
317
217
except TypeError:
318
# Escape attributes for the shell
319
218
escaped_attrs = dict((key, re.escape(str(val)))
321
220
vars(self).iteritems())
323
222
command = self.check_command % escaped_attrs
324
223
except TypeError, error:
325
logger.error(u'Could not format string "%s":'
326
u' %s', self.check_command, error)
224
logger.critical(u'Could not format string "%s":'
225
u' %s', self.check_command, error)
327
226
return True # Try again later
329
logger.info(u"Starting checker %r for %s",
331
self.checker = subprocess.Popen(command,
228
logger.debug(u"Starting checker %r for %s",
230
self.checker = subprocess.\
232
close_fds=True, shell=True,
334
234
self.checker_callback_tag = gobject.child_watch_add\
335
235
(self.checker.pid,
336
236
self.checker_callback)
342
242
def stop_checker(self):
343
243
"""Force the checker process, if any, to stop."""
344
if self.checker_callback_tag:
345
gobject.source_remove(self.checker_callback_tag)
346
self.checker_callback_tag = None
347
if getattr(self, "checker", None) is None:
244
if not hasattr(self, "checker") or self.checker is None:
349
logger.debug("Stopping checker for %(name)s", vars(self))
351
os.kill(self.checker.pid, signal.SIGTERM)
353
#if self.checker.poll() is None:
354
# os.kill(self.checker.pid, signal.SIGKILL)
355
except OSError, error:
356
if error.errno != errno.ESRCH: # No such process
246
gobject.source_remove(self.checker_callback_tag)
247
self.checker_callback_tag = None
248
os.kill(self.checker.pid, signal.SIGTERM)
249
if self.checker.poll() is None:
250
os.kill(self.checker.pid, signal.SIGKILL)
358
251
self.checker = None
359
def still_valid(self):
252
def still_valid(self, now=None):
360
253
"""Has the timeout not yet passed for this client?"""
361
now = datetime.datetime.now()
362
if self.last_checked_ok is None:
255
now = datetime.datetime.now()
256
if self.last_seen is None:
363
257
return now < (self.created + self.timeout)
365
return now < (self.last_checked_ok + self.timeout)
259
return now < (self.last_seen + self.timeout)
368
262
def peer_certificate(session):
369
"Return the peer's OpenPGP certificate as a bytestring"
263
"Return an OpenPGP data packet string for the peer's certificate"
370
264
# If not an OpenPGP certificate...
371
265
if gnutls.library.functions.gnutls_certificate_type_get\
372
266
(session._c_object) \
385
279
def fingerprint(openpgp):
386
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
280
"Convert an OpenPGP data string to a hexdigit fingerprint string"
281
# New empty GnuTLS certificate
282
crt = gnutls.library.types.gnutls_openpgp_crt_t()
283
gnutls.library.functions.gnutls_openpgp_crt_init\
387
285
# New GnuTLS "datum" with the OpenPGP public key
388
286
datum = gnutls.library.types.gnutls_datum_t\
389
287
(ctypes.cast(ctypes.c_char_p(openpgp),
390
288
ctypes.POINTER(ctypes.c_ubyte)),
391
289
ctypes.c_uint(len(openpgp)))
392
# New empty GnuTLS certificate
393
crt = gnutls.library.types.gnutls_openpgp_crt_t()
394
gnutls.library.functions.gnutls_openpgp_crt_init\
396
290
# Import the OpenPGP public key into the certificate
397
gnutls.library.functions.gnutls_openpgp_crt_import\
398
(crt, ctypes.byref(datum),
399
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
291
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
294
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
400
295
# New buffer for the fingerprint
401
296
buffer = ctypes.create_string_buffer(20)
402
297
buffer_length = ctypes.c_size_t()
418
313
Note: This will run in its own forked process."""
420
315
def handle(self):
421
logger.info(u"TCP connection from: %s",
316
logger.debug(u"TCP connection from: %s",
422
317
unicode(self.client_address))
423
session = gnutls.connection.ClientSession\
424
(self.request, gnutls.connection.X509Credentials())
426
line = self.request.makefile().readline()
427
logger.debug(u"Protocol version: %r", line)
429
if int(line.strip().split()[0]) > 1:
431
except (ValueError, IndexError, RuntimeError), error:
432
logger.error(u"Unknown protocol version: %s", error)
435
# Note: gnutls.connection.X509Credentials is really a generic
436
# GnuTLS certificate credentials object so long as no X.509
437
# keys are added to it. Therefore, we can use it here despite
438
# using OpenPGP certificates.
318
session = gnutls.connection.ClientSession(self.request,
440
322
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
441
323
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
443
priority = "NORMAL" # Fallback default, since this
445
if self.server.settings["priority"]:
446
priority = self.server.settings["priority"]
325
priority = "SECURE256"
447
327
gnutls.library.functions.gnutls_priority_set_direct\
448
328
(session._c_object, priority, None);
451
331
session.handshake()
452
332
except gnutls.errors.GNUTLSError, error:
453
logger.warning(u"Handshake failed: %s", error)
333
logger.debug(u"Handshake failed: %s", error)
454
334
# Do not run session.bye() here: the session is not
455
335
# established. Just abandon the request.
458
338
fpr = fingerprint(peer_certificate(session))
459
339
except (TypeError, gnutls.errors.GNUTLSError), error:
460
logger.warning(u"Bad certificate: %s", error)
340
logger.debug(u"Bad certificate: %s", error)
463
343
logger.debug(u"Fingerprint: %s", fpr)
465
for c in self.server.clients:
466
346
if c.fingerprint == fpr:
470
logger.warning(u"Client not found for fingerprint: %s",
474
349
# Have to check if client.still_valid(), since it is possible
475
350
# that the client timed out while establishing the GnuTLS
477
if not client.still_valid():
478
logger.warning(u"Client %(name)s is invalid",
352
if (not client) or (not client.still_valid()):
354
logger.debug(u"Client %(name)s is invalid",
357
logger.debug(u"Client not found for fingerprint: %s",
508
387
"""This overrides the normal server_bind() function
509
388
to bind to an interface if one was specified, and also NOT to
510
389
bind to an address or port if they were not specified."""
511
if self.settings["interface"]:
512
# 25 is from /usr/include/asm-i486/socket.h
513
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
390
if self.options.interface:
391
if not hasattr(socket, "SO_BINDTODEVICE"):
392
# From /usr/include/asm-i486/socket.h
393
socket.SO_BINDTODEVICE = 25
515
395
self.socket.setsockopt(socket.SOL_SOCKET,
517
self.settings["interface"])
396
socket.SO_BINDTODEVICE,
397
self.options.interface)
518
398
except socket.error, error:
519
399
if error[0] == errno.EPERM:
520
logger.error(u"No permission to"
521
u" bind to interface %s",
522
self.settings["interface"])
400
logger.warning(u"No permission to"
401
u" bind to interface %s",
402
self.options.interface)
525
405
# Only bind(2) the socket if we really need to.
452
"""From the Avahi server example code"""
453
global group, serviceName, serviceType, servicePort, serviceTXT, \
456
group = dbus.Interface(
457
bus.get_object( avahi.DBUS_NAME,
458
server.EntryGroupNew()),
459
avahi.DBUS_INTERFACE_ENTRY_GROUP)
460
group.connect_to_signal('StateChanged',
461
entry_group_state_changed)
462
logger.debug(u"Adding service '%s' of type '%s' ...",
463
serviceName, serviceType)
466
serviceInterface, # interface
467
avahi.PROTO_INET6, # protocol
468
dbus.UInt32(0), # flags
469
serviceName, serviceType,
471
dbus.UInt16(servicePort),
472
avahi.string_array_to_txt_array(serviceTXT))
476
def remove_service():
477
"""From the Avahi server example code"""
480
if not group is None:
571
484
def server_state_changed(state):
572
"""Derived from the Avahi example code"""
485
"""From the Avahi server example code"""
573
486
if state == avahi.SERVER_COLLISION:
574
logger.error(u"Server name collision")
487
logger.warning(u"Server name collision")
576
489
elif state == avahi.SERVER_RUNNING:
580
493
def entry_group_state_changed(state, error):
581
"""Derived from the Avahi example code"""
494
"""From the Avahi server example code"""
495
global serviceName, server, rename_count
582
497
logger.debug(u"state change: %i", state)
584
499
if state == avahi.ENTRY_GROUP_ESTABLISHED:
585
500
logger.debug(u"Service established.")
586
501
elif state == avahi.ENTRY_GROUP_COLLISION:
587
logger.warning(u"Service name collision.")
503
rename_count = rename_count - 1
505
name = server.GetAlternativeServiceName(name)
506
logger.warning(u"Service name collision, "
507
u"changing name to '%s' ...", name)
512
logger.error(u"No suitable service name found after %i"
513
u" retries, exiting.", n_rename)
589
515
elif state == avahi.ENTRY_GROUP_FAILURE:
590
logger.critical(u"Error in group state changed %s",
592
raise AvahiGroupError("State changed: %s", str(error))
516
logger.error(u"Error in group state changed %s",
594
521
def if_nametoindex(interface):
595
"""Call the C function if_nametoindex(), or equivalent"""
596
global if_nametoindex
522
"""Call the C function if_nametoindex()"""
598
if "ctypes.util" not in sys.modules:
600
if_nametoindex = ctypes.cdll.LoadLibrary\
601
(ctypes.util.find_library("c")).if_nametoindex
524
libc = ctypes.cdll.LoadLibrary("libc.so.6")
525
return libc.if_nametoindex(interface)
602
526
except (OSError, AttributeError):
603
527
if "struct" not in sys.modules:
605
529
if "fcntl" not in sys.modules:
607
def if_nametoindex(interface):
608
"Get an interface index the hard way, i.e. using fcntl()"
609
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
611
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
612
struct.pack("16s16x", interface))
614
interface_index = struct.unpack("I", ifreq[16:20])[0]
615
return interface_index
616
return if_nametoindex(interface)
619
def daemon(nochdir = False, noclose = False):
531
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
533
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
534
struct.pack("16s16x", interface))
536
interface_index = struct.unpack("I", ifreq[16:20])[0]
537
return interface_index
540
def daemon(nochdir, noclose):
620
541
"""See daemon(3). Standard BSD Unix function.
621
542
This should really exist as os.daemon, but it doesn't (yet)."""
643
global main_loop_started
561
def killme(status = 0):
562
logger.debug("Stopping server with exit status %d", status)
564
if main_loop_started:
570
if __name__ == '__main__':
644
572
main_loop_started = False
646
573
parser = OptionParser()
647
574
parser.add_option("-i", "--interface", type="string",
648
metavar="IF", help="Bind to interface IF")
649
parser.add_option("-a", "--address", type="string",
650
help="Address to listen for requests on")
651
parser.add_option("-p", "--port", type="int",
575
default=None, metavar="IF",
576
help="Bind to interface IF")
577
parser.add_option("-p", "--port", type="int", default=None,
652
578
help="Port number to receive requests on")
579
parser.add_option("--timeout", type="string", # Parsed later
581
help="Amount of downtime allowed for clients")
582
parser.add_option("--interval", type="string", # Parsed later
584
help="How often to check that a client is up")
653
585
parser.add_option("--check", action="store_true", default=False,
654
586
help="Run self-test")
655
587
parser.add_option("--debug", action="store_true", default=False,
656
help="Debug mode; run in foreground and log to"
658
parser.add_option("--priority", type="string", help="GnuTLS"
659
" priority string (see GnuTLS documentation)")
660
parser.add_option("--servicename", type="string", metavar="NAME",
661
help="Zeroconf service name")
662
parser.add_option("--configdir", type="string",
663
default="/etc/mandos", metavar="DIR",
664
help="Directory to search for configuration"
666
589
(options, args) = parser.parse_args()
668
591
if options.check:
670
593
doctest.testmod()
673
# Default values for config file for server-global settings
674
server_defaults = { "interface": "",
679
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
680
"servicename": "Mandos",
683
# Parse config file for server-global settings
684
server_config = ConfigParser.SafeConfigParser(server_defaults)
686
server_config.read(os.path.join(options.configdir, "mandos.conf"))
687
server_section = "server"
688
# Convert the SafeConfigParser object to a dict
689
server_settings = dict(server_config.items(server_section))
690
# Use getboolean on the boolean config option
691
server_settings["debug"] = server_config.getboolean\
692
(server_section, "debug")
695
# Override the settings from the config file with command line
697
for option in ("interface", "address", "port", "debug",
698
"priority", "servicename", "configdir"):
699
value = getattr(options, option)
700
if value is not None:
701
server_settings[option] = value
703
# Now we have our good server settings in "server_settings"
705
# Parse config file with clients
706
client_defaults = { "timeout": "1h",
708
"checker": "fping -q -- %%(fqdn)s",
710
client_config = ConfigParser.SafeConfigParser(client_defaults)
711
client_config.read(os.path.join(server_settings["configdir"],
715
service = AvahiService(name = server_settings["servicename"],
716
type = "_mandos._tcp", );
717
if server_settings["interface"]:
718
service.interface = if_nametoindex(server_settings["interface"])
723
# From the Avahi example code
596
# Parse the time arguments
598
options.timeout = string_to_delta(options.timeout)
600
parser.error("option --timeout: Unparseable time")
602
options.interval = string_to_delta(options.interval)
604
parser.error("option --interval: Unparseable time")
607
defaults = { "checker": "fping -q -- %%(fqdn)s" }
608
client_config = ConfigParser.SafeConfigParser(defaults)
609
#client_config.readfp(open("secrets.conf"), "secrets.conf")
610
client_config.read("mandos-clients.conf")
612
# From the Avahi server example code
724
613
DBusGMainLoop(set_as_default=True )
725
614
main_loop = gobject.MainLoop()
726
615
bus = dbus.SystemBus()
743
632
def remove_from_clients(client):
744
633
clients.remove(client)
746
logger.critical(u"No clients left, exiting")
635
logger.debug(u"No clients left, exiting")
749
clients.update(Set(Client(name = section,
638
clients.update(Set(Client(name=section, options=options,
750
639
stop_hook = remove_from_clients,
752
= dict(client_config.items(section)))
640
**(dict(client_config\
753
642
for section in client_config.sections()))
759
648
"Cleanup function; run on exit"
761
# From the Avahi example code
650
# From the Avahi server example code
762
651
if not group is None:
765
654
# End of Avahi example code
768
client = clients.pop()
656
for client in clients:
769
657
client.stop_hook = None
775
663
signal.signal(signal.SIGINT, signal.SIG_IGN)
776
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
777
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
664
signal.signal(signal.SIGHUP, lambda signum, frame: killme())
665
signal.signal(signal.SIGTERM, lambda signum, frame: killme())
779
667
for client in clients:
782
tcp_server = IPv6_TCPServer((server_settings["address"],
783
server_settings["port"]),
670
tcp_server = IPv6_TCPServer((None, options.port),
785
settings=server_settings,
787
# Find out what port we got
788
service.port = tcp_server.socket.getsockname()[1]
789
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
790
u" scope_id %d" % tcp_server.socket.getsockname())
792
#service.interface = tcp_server.socket.getsockname()[3]
795
# From the Avahi example code
796
server.connect_to_signal("StateChanged", server_state_changed)
798
server_state_changed(server.GetState())
799
except dbus.exceptions.DBusException, error:
800
logger.critical(u"DBusException: %s", error)
802
# End of Avahi example code
804
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
805
lambda *args, **kwargs:
806
tcp_server.handle_request\
807
(*args[2:], **kwargs) or True)
809
logger.debug("Starting main loop")
674
# Find out what random port we got
675
servicePort = tcp_server.socket.getsockname()[1]
676
logger.debug(u"Now listening on port %d", servicePort)
678
if options.interface is not None:
679
serviceInterface = if_nametoindex(options.interface)
681
# From the Avahi server example code
682
server.connect_to_signal("StateChanged", server_state_changed)
684
server_state_changed(server.GetState())
685
except dbus.exceptions.DBusException, error:
686
logger.critical(u"DBusException: %s", error)
688
# End of Avahi example code
690
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
691
lambda *args, **kwargs:
692
tcp_server.handle_request(*args[2:],
810
695
main_loop_started = True
812
except AvahiError, error:
813
logger.critical(u"AvahiError: %s" + unicode(error))
815
697
except KeyboardInterrupt:
819
if __name__ == '__main__':