/mandos/trunk : revision 183

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# following functions: "AvahiService.add", "AvahiService.remove",

10

# "server_state_changed", "entry_group_state_changed", and some lines

11

# in "main".

9

# methods "add" and "remove" in the "AvahiService" class, the

10

# "server_state_changed" and "entry_group_state_changed" functions,

11

# and some lines in "main".

12

#

13

# Everything else is

14

24

# GNU General Public License for more details.

25

#

26

# You should have received a copy of the GNU General Public License

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

27

# along with this program. If not, see

28

# <http://www.gnu.org/licenses/>.

28

29

#

29

30

# Contact the authors at <mandos@fukt.bsnet.se>.

30

31

#

54

55

import stat

55

56

import logging

56

57

import logging.handlers

58

import pwd

57

59

58

60

import dbus

59

61

import gobject

61

63

from dbus.mainloop.glib import DBusGMainLoop

62

64

import ctypes

63

65

64

# Brief description of the operation of this program:

65

#

66

# This server announces itself as a Zeroconf service. Connecting

67

# clients use the TLS protocol, with the unusual quirk that this

68

# server program acts as a TLS "client" while a connecting client acts

69

# as a TLS "server". The client (acting as a TLS "server") must

70

# supply an OpenPGP certificate, and the fingerprint of this

71

# certificate is used by this server to look up (in a list read from a

72

# file at start time) which binary blob to give the client. No other

73

# authentication or authorization is done by this server.

74

66

version = "1.0"

75

67

76

68

logger = logging.Logger('mandos')

77

69

syslogger = logging.handlers.SysLogHandler\

78

(facility = logging.handlers.SysLogHandler.LOG_DAEMON)

70

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

71

address = "/dev/log")

79

72

syslogger.setFormatter(logging.Formatter\

80

('%(levelname)s: %(message)s'))

73

('Mandos: %(levelname)s: %(message)s'))

81

74

logger.addHandler(syslogger)

82

del syslogger

83

75

76

console = logging.StreamHandler()

77

console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'

78

' %(message)s'))

79

logger.addHandler(console)

84

80

85

81

class AvahiError(Exception):

86

82

def __init__(self, value):

96

92

97

93

98

94

class AvahiService(object):

99

"""

95

"""An Avahi (Zeroconf) service.

96

Attributes:

100

97

interface: integer; avahi.IF_UNSPEC or an interface index.

101

98

Used to optionally bind to the specified interface.

102

name = string; Example: "Mandos"

103

type = string; Example: "_mandos._tcp".

104

See <http://www.dns-sd.org/ServiceTypes.html>

105

port = integer; what port to announce

106

TXT = list of strings; TXT record for the service

107

domain = string; Domain to publish on, default to .local if empty.

108

host = string; Host to publish records for, default to localhost

109

if empty.

110

max_renames = integer; maximum number of renames

111

rename_count = integer; counter so we only rename after collisions

112

a sensible number of times

99

name: string; Example: 'Mandos'

100

type: string; Example: '_mandos._tcp'.

101

See <http://www.dns-sd.org/ServiceTypes.html>

102

port: integer; what port to announce

103

TXT: list of strings; TXT record for the service

104

domain: string; Domain to publish on, default to .local if empty.

105

host: string; Host to publish records for, default is localhost

106

max_renames: integer; maximum number of renames

107

rename_count: integer; counter so we only rename after collisions

108

a sensible number of times

113

109

"""

114

110

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

115

111

type = None, port = None, TXT = None, domain = "",

116

host = "", max_renames = 12):

117

"""An Avahi (Zeroconf) service. """

112

host = "", max_renames = 32768):

118

113

self.interface = interface

119

114

self.name = name

120

115

self.type = type

126

121

self.domain = domain

127

122

self.host = host

128

123

self.rename_count = 0

124

self.max_renames = max_renames

129

125

def rename(self):

130

126

"""Derived from the Avahi example code"""

131

127

if self.rename_count >= self.max_renames:

132

logger.critical(u"No suitable service name found after %i"

133

u" retries, exiting.", rename_count)

128

logger.critical(u"No suitable Zeroconf service name found"

129

u" after %i retries, exiting.",

130

rename_count)

134

131

raise AvahiServiceError("Too many renames")

135

name = server.GetAlternativeServiceName(name)

136

logger.notice(u"Changing name to %r ...", name)

132

self.name = server.GetAlternativeServiceName(self.name)

133

logger.info(u"Changing Zeroconf service name to %r ...",

134

str(self.name))

135

syslogger.setFormatter(logging.Formatter\

136

('Mandos (%s): %%(levelname)s:'

137

' %%(message)s' % self.name))

137

138

self.remove()

138

139

self.add()

139

140

self.rename_count += 1

151

152

avahi.DBUS_INTERFACE_ENTRY_GROUP)

152

153

group.connect_to_signal('StateChanged',

153

154

entry_group_state_changed)

154

logger.debug(u"Adding service '%s' of type '%s' ...",

155

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

155

156

service.name, service.type)

156

157

group.AddService(

157

158

self.interface, # interface

175

176

fingerprint: string (40 or 32 hexadecimal digits); used to

176

177

uniquely identify the client

177

178

secret: bytestring; sent verbatim (over TLS) to client

178

fqdn: string (FQDN); available for use by the checker command

179

host: string; available for use by the checker command

179

180

created: datetime.datetime(); object creation, not client host

180

181

last_checked_ok: datetime.datetime() or None if not yet checked OK

181

182

timeout: datetime.timedelta(); How long from last_checked_ok

221

222

interval = property(lambda self: self._interval,

222

223

_set_interval)

223

224

del _set_interval

224

def __init__(self, name=None, stop_hook=None, fingerprint=None,

225

secret=None, secfile=None, fqdn=None, timeout=None,

226

interval=-1, checker=None):

227

"""Note: the 'checker' argument sets the 'checker_command'

228

attribute and not the 'checker' attribute.."""

225

def __init__(self, name = None, stop_hook=None, config={}):

226

"""Note: the 'checker' key in 'config' sets the

227

'checker_command' attribute and *not* the 'checker'

228

attribute."""

229

self.name = name

230

logger.debug(u"Creating client %r", self.name)

231

# Uppercase and remove spaces from fingerprint

232

# for later comparison purposes with return value of

233

# the fingerprint() function

234

self.fingerprint = fingerprint.upper().replace(u" ", u"")

231

# Uppercase and remove spaces from fingerprint for later

232

# comparison purposes with return value from the fingerprint()

233

# function

234

self.fingerprint = config["fingerprint"].upper()\

235

.replace(u" ", u"")

235

236

logger.debug(u" Fingerprint: %s", self.fingerprint)

236

if secret:

237

self.secret = secret.decode(u"base64")

238

elif secfile:

239

sf = open(secfile)

237

if "secret" in config:

238

self.secret = config["secret"].decode(u"base64")

239

elif "secfile" in config:

240

sf = open(config["secfile"])

240

241

self.secret = sf.read()

241

242

sf.close()

242

243

else:

243

244

raise TypeError(u"No secret or secfile for client %s"

244

245

% self.name)

245

self.fqdn = fqdn

246

self.host = config.get("host", "")

246

247

self.created = datetime.datetime.now()

247

248

self.last_checked_ok = None

248

self.timeout = string_to_delta(timeout)

249

self.interval = string_to_delta(interval)

249

self.timeout = string_to_delta(config["timeout"])

250

self.interval = string_to_delta(config["interval"])

250

251

self.stop_hook = stop_hook

251

252

self.checker = None

252

253

self.checker_initiator_tag = None

253

254

self.stop_initiator_tag = None

254

255

self.checker_callback_tag = None

255

self.check_command = checker

256

self.check_command = config["checker"]

256

257

def start(self):

257

258

"""Start this client's checker and timeout hooks"""

258

259

# Schedule a new checker to be started an 'interval' from now,

271

272

The possibility that a client might be restarted is left open,

272

273

but not currently used."""

273

274

# If this client doesn't have a secret, it is already stopped.

274

if self.secret:

275

logger.debug(u"Stopping client %s", self.name)

275

if hasattr(self, "secret") and self.secret:

276

logger.info(u"Stopping client %s", self.name)

276

277

self.secret = None

277

278

else:

278

279

return False

297

298

self.checker = None

298

299

if os.WIFEXITED(condition) \

299

300

and (os.WEXITSTATUS(condition) == 0):

300

logger.debug(u"Checker for %(name)s succeeded",

301

vars(self))

301

logger.info(u"Checker for %(name)s succeeded",

302

vars(self))

302

303

self.last_checked_ok = now

303

304

gobject.source_remove(self.stop_initiator_tag)

304

305

self.stop_initiator_tag = gobject.timeout_add\

308

309

logger.warning(u"Checker for %(name)s crashed?",

309

310

vars(self))

310

311

else:

311

logger.debug(u"Checker for %(name)s failed",

312

vars(self))

312

logger.info(u"Checker for %(name)s failed",

313

vars(self))

313

314

def start_checker(self):

314

315

"""Start a new checker subprocess if one is not running.

315

316

If a checker already exists, leave it running and do

325

326

if self.checker is None:

326

327

try:

327

328

# In case check_command has exactly one % operator

328

command = self.check_command % self.fqdn

329

command = self.check_command % self.host

329

330

except TypeError:

330

331

# Escape attributes for the shell

331

332

escaped_attrs = dict((key, re.escape(str(val)))

338

339

u' %s', self.check_command, error)

339

340

return True # Try again later

340

341

try:

341

logger.debug(u"Starting checker %r for %s",

342

command, self.name)

342

logger.info(u"Starting checker %r for %s",

343

command, self.name)

344

# We don't need to redirect stdout and stderr, since

345

# in normal mode, that is already done by daemon(),

346

# and in debug mode we don't want to. (Stdin is

347

# always replaced by /dev/null.)

343

348

self.checker = subprocess.Popen(command,

344

349

close_fds=True,

345

350

shell=True, cwd="/")

346

351

self.checker_callback_tag = gobject.child_watch_add\

347

352

(self.checker.pid,

348

353

self.checker_callback)

349

except subprocess.OSError, error:

354

except OSError, error:

350

355

logger.error(u"Failed to start subprocess: %s",

351

356

error)

352

357

# Re-run this periodically if run by gobject.timeout_add

358

363

self.checker_callback_tag = None

359

364

if getattr(self, "checker", None) is None:

360

365

return

361

logger.debug("Stopping checker for %(name)s", vars(self))

366

logger.debug(u"Stopping checker for %(name)s", vars(self))

362

367

try:

363

368

os.kill(self.checker.pid, signal.SIGTERM)

364

369

#os.sleep(0.5)

396

401

397

402

def fingerprint(openpgp):

398

403

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

399

# New empty GnuTLS certificate

400

crt = gnutls.library.types.gnutls_openpgp_crt_t()

401

gnutls.library.functions.gnutls_openpgp_crt_init\

402

(ctypes.byref(crt))

403

404

# New GnuTLS "datum" with the OpenPGP public key

404

405

datum = gnutls.library.types.gnutls_datum_t\

405

406

(ctypes.cast(ctypes.c_char_p(openpgp),

406

407

ctypes.POINTER(ctypes.c_ubyte)),

407

408

ctypes.c_uint(len(openpgp)))

409

# New empty GnuTLS certificate

410

crt = gnutls.library.types.gnutls_openpgp_crt_t()

411

gnutls.library.functions.gnutls_openpgp_crt_init\

412

(ctypes.byref(crt))

408

413

# Import the OpenPGP public key into the certificate

409

ret = gnutls.library.functions.gnutls_openpgp_crt_import\

410

(crt,

411

ctypes.byref(datum),

412

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

414

gnutls.library.functions.gnutls_openpgp_crt_import\

415

(crt, ctypes.byref(datum),

416

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

417

# Verify the self signature in the key

418

crtverify = ctypes.c_uint();

419

gnutls.library.functions.gnutls_openpgp_crt_verify_self\

420

(crt, 0, ctypes.byref(crtverify))

421

if crtverify.value != 0:

422

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

423

raise gnutls.errors.CertificateSecurityError("Verify failed")

413

424

# New buffer for the fingerprint

414

425

buffer = ctypes.create_string_buffer(20)

415

426

buffer_length = ctypes.c_size_t()

431

442

Note: This will run in its own forked process."""

432

443

433

444

def handle(self):

434

logger.debug(u"TCP connection from: %s",

445

logger.info(u"TCP connection from: %s",

435

446

unicode(self.client_address))

436

437

line = self.socket.makefile().readline()

447

session = gnutls.connection.ClientSession\

448

(self.request, gnutls.connection.X509Credentials())

449

450

line = self.request.makefile().readline()

451

logger.debug(u"Protocol version: %r", line)

438

452

try:

439

453

if int(line.strip().split()[0]) > 1:

440

454

raise RuntimeError

442

456

logger.error(u"Unknown protocol version: %s", error)

443

457

return

444

458

445

session = gnutls.connection.ClientSession\

446

(self.request, gnutls.connection.X509Credentials())

447

459

# Note: gnutls.connection.X509Credentials is really a generic

448

460

# GnuTLS certificate credentials object so long as no X.509

449

461

# keys are added to it. Therefore, we can use it here despite

462

474

try:

463

475

session.handshake()

464

476

except gnutls.errors.GNUTLSError, error:

465

logger.debug(u"Handshake failed: %s", error)

477

logger.warning(u"Handshake failed: %s", error)

466

478

# Do not run session.bye() here: the session is not

467

479

# established. Just abandon the request.

468

480

return

469

481

try:

470

482

fpr = fingerprint(peer_certificate(session))

471

483

except (TypeError, gnutls.errors.GNUTLSError), error:

472

logger.debug(u"Bad certificate: %s", error)

484

logger.warning(u"Bad certificate: %s", error)

473

485

session.bye()

474

486

return

475

487

logger.debug(u"Fingerprint: %s", fpr)

479

491

client = c

480

492

break

481

493

if not client:

482

logger.debug(u"Client not found for fingerprint: %s", fpr)

494

logger.warning(u"Client not found for fingerprint: %s",

495

fpr)

483

496

session.bye()

484

497

return

485

498

# Have to check if client.still_valid(), since it is possible

486

499

# that the client timed out while establishing the GnuTLS

487

500

# session.

488

501

if not client.still_valid():

489

logger.debug(u"Client %(name)s is invalid", vars(client))

502

logger.warning(u"Client %(name)s is invalid",

503

vars(client))

490

504

session.bye()

491

505

return

492

506

sent_size = 0

504

518

Attributes:

505

519

settings: Server settings

506

520

clients: Set() of Client objects

521

enabled: Boolean; whether this server is activated yet

507

522

"""

508

523

address_family = socket.AF_INET6

509

524

def __init__(self, *args, **kwargs):

513

528

if "clients" in kwargs:

514

529

self.clients = kwargs["clients"]

515

530

del kwargs["clients"]

531

self.enabled = False

516

532

return super(type(self), self).__init__(*args, **kwargs)

517

533

def server_bind(self):

518

534

"""This overrides the normal server_bind() function

527

543

self.settings["interface"])

528

544

except socket.error, error:

529

545

if error[0] == errno.EPERM:

530

logger.warning(u"No permission to"

531

u" bind to interface %s",

532

self.settings["interface"])

546

logger.error(u"No permission to"

547

u" bind to interface %s",

548

self.settings["interface"])

533

549

else:

534

550

raise error

535

551

# Only bind(2) the socket if we really need to.

538

554

in6addr_any = "::"

539

555

self.server_address = (in6addr_any,

540

556

self.server_address[1])

541

elif self.server_address[1] is None:

557

elif not self.server_address[1]:

542

558

self.server_address = (self.server_address[0],

543

559

0)

560

# if self.settings["interface"]:

561

# self.server_address = (self.server_address[0],

562

# 0, # port

563

# 0, # flowinfo

564

# if_nametoindex

565

# (self.settings

566

# ["interface"]))

544

567

return super(type(self), self).server_bind()

568

def server_activate(self):

569

if self.enabled:

570

return super(type(self), self).server_activate()

571

def enable(self):

572

self.enabled = True

545

573

546

574

547

575

def string_to_delta(interval):

557

585

datetime.timedelta(1)

558

586

>>> string_to_delta(u'1w')

559

587

datetime.timedelta(7)

588

>>> string_to_delta('5m 30s')

589

datetime.timedelta(0, 330)

560

590

"""

561

try:

562

suffix=unicode(interval[-1])

563

value=int(interval[:-1])

564

if suffix == u"d":

565

delta = datetime.timedelta(value)

566

elif suffix == u"s":

567

delta = datetime.timedelta(0, value)

568

elif suffix == u"m":

569

delta = datetime.timedelta(0, 0, 0, 0, value)

570

elif suffix == u"h":

571

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

572

elif suffix == u"w":

573

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

574

else:

591

timevalue = datetime.timedelta(0)

592

for s in interval.split():

593

try:

594

suffix=unicode(s[-1])

595

value=int(s[:-1])

596

if suffix == u"d":

597

delta = datetime.timedelta(value)

598

elif suffix == u"s":

599

delta = datetime.timedelta(0, value)

600

elif suffix == u"m":

601

delta = datetime.timedelta(0, 0, 0, 0, value)

602

elif suffix == u"h":

603

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

604

elif suffix == u"w":

605

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

606

else:

607

raise ValueError

608

except (ValueError, IndexError):

575

609

raise ValueError

576

except (ValueError, IndexError):

577

raise ValueError

578

return delta

610

timevalue += delta

611

return timevalue

579

612

580

613

581

614

def server_state_changed(state):

582

615

"""Derived from the Avahi example code"""

583

616

if state == avahi.SERVER_COLLISION:

584

logger.warning(u"Server name collision")

617

logger.error(u"Zeroconf server name collision")

585

618

service.remove()

586

619

elif state == avahi.SERVER_RUNNING:

587

620

service.add()

589

622

590

623

def entry_group_state_changed(state, error):

591

624

"""Derived from the Avahi example code"""

592

logger.debug(u"state change: %i", state)

625

logger.debug(u"Avahi state change: %i", state)

593

626

594

627

if state == avahi.ENTRY_GROUP_ESTABLISHED:

595

logger.debug(u"Service established.")

628

logger.debug(u"Zeroconf service established.")

596

629

elif state == avahi.ENTRY_GROUP_COLLISION:

597

logger.warning(u"Service name collision.")

630

logger.warning(u"Zeroconf service name collision.")

598

631

service.rename()

599

632

elif state == avahi.ENTRY_GROUP_FAILURE:

600

logger.critical(u"Error in group state changed %s",

633

logger.critical(u"Avahi: Error in group state changed %s",

601

634

unicode(error))

602

635

raise AvahiGroupError("State changed: %s", str(error))

603

636

604

def if_nametoindex(interface, _func=[None]):

637

def if_nametoindex(interface):

605

638

"""Call the C function if_nametoindex(), or equivalent"""

606

if _func[0] is not None:

607

return _func[0](interface)

639

global if_nametoindex

608

640

try:

609

641

if "ctypes.util" not in sys.modules:

610

642

import ctypes.util

611

while True:

612

try:

613

libc = ctypes.cdll.LoadLibrary\

614

(ctypes.util.find_library("c"))

615

_func[0] = libc.if_nametoindex

616

return _func[0](interface)

617

except IOError, e:

618

if e != errno.EINTR:

619

raise

643

if_nametoindex = ctypes.cdll.LoadLibrary\

644

(ctypes.util.find_library("c")).if_nametoindex

620

645

except (OSError, AttributeError):

621

646

if "struct" not in sys.modules:

622

647

import struct

623

648

if "fcntl" not in sys.modules:

624

649

import fcntl

625

def the_hard_way(interface):

650

def if_nametoindex(interface):

626

651

"Get an interface index the hard way, i.e. using fcntl()"

627

652

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

628

653

s = socket.socket()

631

656

s.close()

632

657

interface_index = struct.unpack("I", ifreq[16:20])[0]

633

658

return interface_index

634

_func[0] = the_hard_way

635

return _func[0](interface)

636

637

638

def daemon(nochdir, noclose):

659

return if_nametoindex(interface)

660

661

662

def daemon(nochdir = False, noclose = False):

639

663

"""See daemon(3). Standard BSD Unix function.

640

664

This should really exist as os.daemon, but it doesn't (yet)."""

641

665

if os.fork():

643

667

os.setsid()

644

668

if not nochdir:

645

669

os.chdir("/")

670

if os.fork():

671

sys.exit()

646

672

if not noclose:

647

673

# Close all standard open file descriptors

648

674

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

660

686

global main_loop_started

661

687

main_loop_started = False

662

688

663

parser = OptionParser()

689

parser = OptionParser(version = "%%prog %s" % version)

664

690

parser.add_option("-i", "--interface", type="string",

665

691

metavar="IF", help="Bind to interface IF")

666

692

parser.add_option("-a", "--address", type="string",

669

695

help="Port number to receive requests on")

670

696

parser.add_option("--check", action="store_true", default=False,

671

697

help="Run self-test")

672

parser.add_option("--debug", action="store_true", default=False,

698

parser.add_option("--debug", action="store_true",

673

699

help="Debug mode; run in foreground and log to"

674

700

" terminal")

675

701

parser.add_option("--priority", type="string", help="GnuTLS"

700

726

# Parse config file for server-global settings

701

727

server_config = ConfigParser.SafeConfigParser(server_defaults)

702

728

del server_defaults

703

server_config.read(os.path.join(options.configdir, "server.conf"))

704

server_section = "server"

729

server_config.read(os.path.join(options.configdir, "mandos.conf"))

705

730

# Convert the SafeConfigParser object to a dict

706

server_settings = dict(server_config.items(server_section))

731

server_settings = server_config.defaults()

707

732

# Use getboolean on the boolean config option

708

733

server_settings["debug"] = server_config.getboolean\

709

(server_section, "debug")

734

("DEFAULT", "debug")

710

735

del server_config

711

736

712

737

# Override the settings from the config file with command line

719

744

del options

720

745

# Now we have our good server settings in "server_settings"

721

746

747

debug = server_settings["debug"]

748

749

if not debug:

750

syslogger.setLevel(logging.WARNING)

751

console.setLevel(logging.WARNING)

752

753

if server_settings["servicename"] != "Mandos":

754

syslogger.setFormatter(logging.Formatter\

755

('Mandos (%s): %%(levelname)s:'

756

' %%(message)s'

757

% server_settings["servicename"]))

758

722

759

# Parse config file with clients

723

760

client_defaults = { "timeout": "1h",

724

761

"interval": "5m",

725

"checker": "fping -q -- %%(fqdn)s",

762

"checker": "fping -q -- %(host)s",

763

"host": "",

726

764

}

727

765

client_config = ConfigParser.SafeConfigParser(client_defaults)

728

766

client_config.read(os.path.join(server_settings["configdir"],

729

767

"clients.conf"))

730

768

769

clients = Set()

770

tcp_server = IPv6_TCPServer((server_settings["address"],

771

server_settings["port"]),

772

tcp_handler,

773

settings=server_settings,

774

clients=clients)

775

pidfilename = "/var/run/mandos.pid"

776

try:

777

pidfile = open(pidfilename, "w")

778

except IOError, error:

779

logger.error("Could not open file %r", pidfilename)

780

781

uid = 65534

782

gid = 65534

783

try:

784

uid = pwd.getpwnam("mandos").pw_uid

785

except KeyError:

786

try:

787

uid = pwd.getpwnam("nobody").pw_uid

788

except KeyError:

789

pass

790

try:

791

gid = pwd.getpwnam("mandos").pw_gid

792

except KeyError:

793

try:

794

gid = pwd.getpwnam("nogroup").pw_gid

795

except KeyError:

796

pass

797

try:

798

os.setuid(uid)

799

os.setgid(gid)

800

except OSError, error:

801

if error[0] != errno.EPERM:

802

raise error

803

731

804

global service

732

805

service = AvahiService(name = server_settings["servicename"],

733

806

type = "_mandos._tcp", );

734

807

if server_settings["interface"]:

735

service.interface = if_nametoindex(server_settings["interface"])

808

service.interface = if_nametoindex\

809

(server_settings["interface"])

736

810

737

811

global main_loop

738

812

global bus

741

815

DBusGMainLoop(set_as_default=True )

742

816

main_loop = gobject.MainLoop()

743

817

bus = dbus.SystemBus()

744

server = dbus.Interface(

745

bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),

746

avahi.DBUS_INTERFACE_SERVER )

818

server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,

819

avahi.DBUS_PATH_SERVER),

820

avahi.DBUS_INTERFACE_SERVER)

747

821

# End of Avahi example code

748

822

749

debug = server_settings["debug"]

750

751

if debug:

752

console = logging.StreamHandler()

753

# console.setLevel(logging.DEBUG)

754

console.setFormatter(logging.Formatter\

755

('%(levelname)s: %(message)s'))

756

logger.addHandler(console)

757

del console

758

759

clients = Set()

760

823

def remove_from_clients(client):

761

824

clients.remove(client)

762

825

if not clients:

763

logger.debug(u"No clients left, exiting")

826

logger.critical(u"No clients left, exiting")

764

827

sys.exit()

765

828

766

clients.update(Set(Client(name=section,

829

clients.update(Set(Client(name = section,

767

830

stop_hook = remove_from_clients,

768

**(dict(client_config\

769

.items(section))))

831

config

832

= dict(client_config.items(section)))

770

833

for section in client_config.sections()))

771

772

if not debug:

773

daemon(False, False)

834

if not clients:

835

logger.critical(u"No clients defined")

836

sys.exit(1)

837

838

if debug:

839

# Redirect stdin so all checkers get /dev/null

840

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

841

os.dup2(null, sys.stdin.fileno())

842

if null > 2:

843

os.close(null)

844

else:

845

# No console logging

846

logger.removeHandler(console)

847

# Close all input and output, do double fork, etc.

848

daemon()

849

850

try:

851

pid = os.getpid()

852

pidfile.write(str(pid) + "\n")

853

pidfile.close()

854

del pidfile

855

except IOError, err:

856

logger.error(u"Could not write to file %r with PID %d",

857

pidfilename, pid)

858

except NameError:

859

# "pidfile" was never created

860

pass

861

del pidfilename

774

862

775

863

def cleanup():

776

864

"Cleanup function; run on exit"

796

884

for client in clients:

797

885

client.start()

798

886

799

tcp_server = IPv6_TCPServer((server_settings["address"],

800

server_settings["port"]),

801

tcp_handler,

802

settings=server_settings,

803

clients=clients)

887

tcp_server.enable()

888

tcp_server.server_activate()

889

804

890

# Find out what port we got

805

891

service.port = tcp_server.socket.getsockname()[1]

806

logger.debug(u"Now listening on address %r, port %d, flowinfo %d,"

807

u" scope_id %d" % tcp_server.socket.getsockname())

892

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

893

u" scope_id %d" % tcp_server.socket.getsockname())

808

894

809

895

#service.interface = tcp_server.socket.getsockname()[3]

810

896

823

909

tcp_server.handle_request\

824

910

(*args[2:], **kwargs) or True)

825

911

826

logger.debug("Starting main loop")

912

logger.debug(u"Starting main loop")

827

913

main_loop_started = True

828

914

main_loop.run()

829

915

except AvahiError, error: