/mandos/trunk : revision 183

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# following functions: "AvahiService.add", "AvahiService.remove",

10

# "server_state_changed", "entry_group_state_changed", and some lines

11

# in "main".

9

# methods "add" and "remove" in the "AvahiService" class, the

10

# "server_state_changed" and "entry_group_state_changed" functions,

11

# and some lines in "main".

12

#

13

# Everything else is

14

24

# GNU General Public License for more details.

25

#

26

# You should have received a copy of the GNU General Public License

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

27

# along with this program. If not, see

28

# <http://www.gnu.org/licenses/>.

28

29

#

29

30

# Contact the authors at <mandos@fukt.bsnet.se>.

30

31

#

54

55

import stat

55

56

import logging

56

57

import logging.handlers

58

import pwd

57

59

58

60

import dbus

59

61

import gobject

61

63

from dbus.mainloop.glib import DBusGMainLoop

62

64

import ctypes

63

65

64

# Brief description of the operation of this program:

65

#

66

# This server announces itself as a Zeroconf service. Connecting

67

# clients use the TLS protocol, with the unusual quirk that this

68

# server program acts as a TLS "client" while a connecting client acts

69

# as a TLS "server". The client (acting as a TLS "server") must

70

# supply an OpenPGP certificate, and the fingerprint of this

71

# certificate is used by this server to look up (in a list read from a

72

# file at start time) which binary blob to give the client. No other

73

# authentication or authorization is done by this server.

74

66

version = "1.0"

75

67

76

68

logger = logging.Logger('mandos')

77

69

syslogger = logging.handlers.SysLogHandler\

78

(facility = logging.handlers.SysLogHandler.LOG_DAEMON)

70

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

71

address = "/dev/log")

79

72

syslogger.setFormatter(logging.Formatter\

80

('%(levelname)s: %(message)s'))

73

('Mandos: %(levelname)s: %(message)s'))

81

74

logger.addHandler(syslogger)

82

del syslogger

83

75

76

console = logging.StreamHandler()

77

console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'

78

' %(message)s'))

79

logger.addHandler(console)

84

80

85

81

class AvahiError(Exception):

86

82

def __init__(self, value):

96

92

97

93

98

94

class AvahiService(object):

99

"""

95

"""An Avahi (Zeroconf) service.

96

Attributes:

100

97

interface: integer; avahi.IF_UNSPEC or an interface index.

101

98

Used to optionally bind to the specified interface.

102

name = string; Example: "Mandos"

103

type = string; Example: "_mandos._tcp".

104

See <http://www.dns-sd.org/ServiceTypes.html>

105

port = integer; what port to announce

106

TXT = list of strings; TXT record for the service

107

domain = string; Domain to publish on, default to .local if empty.

108

host = string; Host to publish records for, default to localhost

109

if empty.

110

max_renames = integer; maximum number of renames

111

rename_count = integer; counter so we only rename after collisions

112

a sensible number of times

99

name: string; Example: 'Mandos'

100

type: string; Example: '_mandos._tcp'.

101

See <http://www.dns-sd.org/ServiceTypes.html>

102

port: integer; what port to announce

103

TXT: list of strings; TXT record for the service

104

domain: string; Domain to publish on, default to .local if empty.

105

host: string; Host to publish records for, default is localhost

106

max_renames: integer; maximum number of renames

107

rename_count: integer; counter so we only rename after collisions

108

a sensible number of times

113

109

"""

114

110

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

115

111

type = None, port = None, TXT = None, domain = "",

116

host = "", max_renames = 12):

117

"""An Avahi (Zeroconf) service. """

112

host = "", max_renames = 32768):

118

113

self.interface = interface

119

114

self.name = name

120

115

self.type = type

126

121

self.domain = domain

127

122

self.host = host

128

123

self.rename_count = 0

124

self.max_renames = max_renames

129

125

def rename(self):

130

126

"""Derived from the Avahi example code"""

131

127

if self.rename_count >= self.max_renames:

132

logger.critical(u"No suitable service name found after %i"

133

u" retries, exiting.", rename_count)

128

logger.critical(u"No suitable Zeroconf service name found"

129

u" after %i retries, exiting.",

130

rename_count)

134

131

raise AvahiServiceError("Too many renames")

135

name = server.GetAlternativeServiceName(name)

136

logger.notice(u"Changing name to %r ...", name)

132

self.name = server.GetAlternativeServiceName(self.name)

133

logger.info(u"Changing Zeroconf service name to %r ...",

134

str(self.name))

135

syslogger.setFormatter(logging.Formatter\

136

('Mandos (%s): %%(levelname)s:'

137

' %%(message)s' % self.name))

137

138

self.remove()

138

139

self.add()

139

140

self.rename_count += 1

151

152

avahi.DBUS_INTERFACE_ENTRY_GROUP)

152

153

group.connect_to_signal('StateChanged',

153

154

entry_group_state_changed)

154

logger.debug(u"Adding service '%s' of type '%s' ...",

155

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

155

156

service.name, service.type)

156

157

group.AddService(

157

158

self.interface, # interface

175

176

fingerprint: string (40 or 32 hexadecimal digits); used to

176

177

uniquely identify the client

177

178

secret: bytestring; sent verbatim (over TLS) to client

178

fqdn: string (FQDN); available for use by the checker command

179

host: string; available for use by the checker command

179

180

created: datetime.datetime(); object creation, not client host

180

181

last_checked_ok: datetime.datetime() or None if not yet checked OK

181

182

timeout: datetime.timedelta(); How long from last_checked_ok

221

222

interval = property(lambda self: self._interval,

222

223

_set_interval)

223

224

del _set_interval

224

def __init__(self, name=None, stop_hook=None, fingerprint=None,

225

secret=None, secfile=None, fqdn=None, timeout=None,

226

interval=-1, checker=None):

227

"""Note: the 'checker' argument sets the 'checker_command'

228

attribute and not the 'checker' attribute.."""

225

def __init__(self, name = None, stop_hook=None, config={}):

226

"""Note: the 'checker' key in 'config' sets the

227

'checker_command' attribute and *not* the 'checker'

228

attribute."""

229

self.name = name

230

logger.debug(u"Creating client %r", self.name)

231

# Uppercase and remove spaces from fingerprint

232

# for later comparison purposes with return value of

233

# the fingerprint() function

234

self.fingerprint = fingerprint.upper().replace(u" ", u"")

231

# Uppercase and remove spaces from fingerprint for later

232

# comparison purposes with return value from the fingerprint()

233

# function

234

self.fingerprint = config["fingerprint"].upper()\

235

.replace(u" ", u"")

235

236

logger.debug(u" Fingerprint: %s", self.fingerprint)

236

if secret:

237

self.secret = secret.decode(u"base64")

238

elif secfile:

239

sf = open(secfile)

237

if "secret" in config:

238

self.secret = config["secret"].decode(u"base64")

239

elif "secfile" in config:

240

sf = open(config["secfile"])

240

241

self.secret = sf.read()

241

242

sf.close()

242

243

else:

243

244

raise TypeError(u"No secret or secfile for client %s"

244

245

% self.name)

245

self.fqdn = fqdn

246

self.host = config.get("host", "")

246

247

self.created = datetime.datetime.now()

247

248

self.last_checked_ok = None

248

self.timeout = string_to_delta(timeout)

249

self.interval = string_to_delta(interval)

249

self.timeout = string_to_delta(config["timeout"])

250

self.interval = string_to_delta(config["interval"])

250

251

self.stop_hook = stop_hook

251

252

self.checker = None

252

253

self.checker_initiator_tag = None

253

254

self.stop_initiator_tag = None

254

255

self.checker_callback_tag = None

255

self.check_command = checker

256

self.check_command = config["checker"]

256

257

def start(self):

257

258

"""Start this client's checker and timeout hooks"""

258

259

# Schedule a new checker to be started an 'interval' from now,

271

272

The possibility that a client might be restarted is left open,

272

273

but not currently used."""

273

274

# If this client doesn't have a secret, it is already stopped.

274

if self.secret:

275

logger.debug(u"Stopping client %s", self.name)

275

if hasattr(self, "secret") and self.secret:

276

logger.info(u"Stopping client %s", self.name)

276

277

self.secret = None

277

278

else:

278

279

return False

297

298

self.checker = None

298

299

if os.WIFEXITED(condition) \

299

300

and (os.WEXITSTATUS(condition) == 0):

300

logger.debug(u"Checker for %(name)s succeeded",

301

vars(self))

301

logger.info(u"Checker for %(name)s succeeded",

302

vars(self))

302

303

self.last_checked_ok = now

303

304

gobject.source_remove(self.stop_initiator_tag)

304

305

self.stop_initiator_tag = gobject.timeout_add\

308

309

logger.warning(u"Checker for %(name)s crashed?",

309

310

vars(self))

310

311

else:

311

logger.debug(u"Checker for %(name)s failed",

312

vars(self))

312

logger.info(u"Checker for %(name)s failed",

313

vars(self))

313

314

def start_checker(self):

314

315

"""Start a new checker subprocess if one is not running.

315

316

If a checker already exists, leave it running and do

325

326

if self.checker is None:

326

327

try:

327

328

# In case check_command has exactly one % operator

328

command = self.check_command % self.fqdn

329

command = self.check_command % self.host

329

330

except TypeError:

330

331

# Escape attributes for the shell

331

332

escaped_attrs = dict((key, re.escape(str(val)))

338

339

u' %s', self.check_command, error)

339

340

return True # Try again later

340

341

try:

341

logger.debug(u"Starting checker %r for %s",

342

command, self.name)

342

logger.info(u"Starting checker %r for %s",

343

command, self.name)

344

# We don't need to redirect stdout and stderr, since

345

# in normal mode, that is already done by daemon(),

346

# and in debug mode we don't want to. (Stdin is

347

# always replaced by /dev/null.)

343

348

self.checker = subprocess.Popen(command,

344

349

close_fds=True,

345

350

shell=True, cwd="/")

346

351

self.checker_callback_tag = gobject.child_watch_add\

347

352

(self.checker.pid,

348

353

self.checker_callback)

349

except subprocess.OSError, error:

354

except OSError, error:

350

355

logger.error(u"Failed to start subprocess: %s",

351

356

error)

352

357

# Re-run this periodically if run by gobject.timeout_add

358

363

self.checker_callback_tag = None

359

364

if getattr(self, "checker", None) is None:

360

365

return

361

logger.debug("Stopping checker for %(name)s", vars(self))

366

logger.debug(u"Stopping checker for %(name)s", vars(self))

362

367

try:

363

368

os.kill(self.checker.pid, signal.SIGTERM)

364

369

#os.sleep(0.5)

396

401

397

402

def fingerprint(openpgp):

398

403

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

399

# New empty GnuTLS certificate

400

crt = gnutls.library.types.gnutls_openpgp_crt_t()

401

gnutls.library.functions.gnutls_openpgp_crt_init\

402

(ctypes.byref(crt))

403

404

# New GnuTLS "datum" with the OpenPGP public key

404

405

datum = gnutls.library.types.gnutls_datum_t\

405

406

(ctypes.cast(ctypes.c_char_p(openpgp),

406

407

ctypes.POINTER(ctypes.c_ubyte)),

407

408

ctypes.c_uint(len(openpgp)))

409

# New empty GnuTLS certificate

410

crt = gnutls.library.types.gnutls_openpgp_crt_t()

411

gnutls.library.functions.gnutls_openpgp_crt_init\

412

(ctypes.byref(crt))

408

413

# Import the OpenPGP public key into the certificate

409

ret = gnutls.library.functions.gnutls_openpgp_crt_import\

410

(crt,

411

ctypes.byref(datum),

412

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

414

gnutls.library.functions.gnutls_openpgp_crt_import\

415

(crt, ctypes.byref(datum),

416

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

417

# Verify the self signature in the key

418

crtverify = ctypes.c_uint();

419

gnutls.library.functions.gnutls_openpgp_crt_verify_self\

420

(crt, 0, ctypes.byref(crtverify))

421

if crtverify.value != 0:

422

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

423

raise gnutls.errors.CertificateSecurityError("Verify failed")

413

424

# New buffer for the fingerprint

414

425

buffer = ctypes.create_string_buffer(20)

415

426

buffer_length = ctypes.c_size_t()

431

442

Note: This will run in its own forked process."""

432

443

433

444

def handle(self):

434

logger.debug(u"TCP connection from: %s",

445

logger.info(u"TCP connection from: %s",

435

446

unicode(self.client_address))

436

447

session = gnutls.connection.ClientSession\

437

448

(self.request, gnutls.connection.X509Credentials())

449

450

line = self.request.makefile().readline()

451

logger.debug(u"Protocol version: %r", line)

452

try:

453

if int(line.strip().split()[0]) > 1:

454

raise RuntimeError

455

except (ValueError, IndexError, RuntimeError), error:

456

logger.error(u"Unknown protocol version: %s", error)

457

return

458

438

459

# Note: gnutls.connection.X509Credentials is really a generic

439

460

# GnuTLS certificate credentials object so long as no X.509

440

461

# keys are added to it. Therefore, we can use it here despite

453

474

try:

454

475

session.handshake()

455

476

except gnutls.errors.GNUTLSError, error:

456

logger.debug(u"Handshake failed: %s", error)

477

logger.warning(u"Handshake failed: %s", error)

457

478

# Do not run session.bye() here: the session is not

458

479

# established. Just abandon the request.

459

480

return

460

481

try:

461

482

fpr = fingerprint(peer_certificate(session))

462

483

except (TypeError, gnutls.errors.GNUTLSError), error:

463

logger.debug(u"Bad certificate: %s", error)

484

logger.warning(u"Bad certificate: %s", error)

464

485

session.bye()

465

486

return

466

487

logger.debug(u"Fingerprint: %s", fpr)

470

491

client = c

471

492

break

472

493

if not client:

473

logger.debug(u"Client not found for fingerprint: %s", fpr)

494

logger.warning(u"Client not found for fingerprint: %s",

495

fpr)

474

496

session.bye()

475

497

return

476

498

# Have to check if client.still_valid(), since it is possible

477

499

# that the client timed out while establishing the GnuTLS

478

500

# session.

479

501

if not client.still_valid():

480

logger.debug(u"Client %(name)s is invalid", vars(client))

502

logger.warning(u"Client %(name)s is invalid",

503

vars(client))

481

504

session.bye()

482

505

return

483

506

sent_size = 0

495

518

Attributes:

496

519

settings: Server settings

497

520

clients: Set() of Client objects

521

enabled: Boolean; whether this server is activated yet

498

522

"""

499

523

address_family = socket.AF_INET6

500

524

def __init__(self, *args, **kwargs):

504

528

if "clients" in kwargs:

505

529

self.clients = kwargs["clients"]

506

530

del kwargs["clients"]

531

self.enabled = False

507

532

return super(type(self), self).__init__(*args, **kwargs)

508

533

def server_bind(self):

509

534

"""This overrides the normal server_bind() function

518

543

self.settings["interface"])

519

544

except socket.error, error:

520

545

if error[0] == errno.EPERM:

521

logger.warning(u"No permission to"

522

u" bind to interface %s",

523

self.settings["interface"])

546

logger.error(u"No permission to"

547

u" bind to interface %s",

548

self.settings["interface"])

524

549

else:

525

550

raise error

526

551

# Only bind(2) the socket if we really need to.

529

554

in6addr_any = "::"

530

555

self.server_address = (in6addr_any,

531

556

self.server_address[1])

532

elif self.server_address[1] is None:

557

elif not self.server_address[1]:

533

558

self.server_address = (self.server_address[0],

534

559

0)

560

# if self.settings["interface"]:

561

# self.server_address = (self.server_address[0],

562

# 0, # port

563

# 0, # flowinfo

564

# if_nametoindex

565

# (self.settings

566

# ["interface"]))

535

567

return super(type(self), self).server_bind()

568

def server_activate(self):

569

if self.enabled:

570

return super(type(self), self).server_activate()

571

def enable(self):

572

self.enabled = True

536

573

537

574

538

575

def string_to_delta(interval):

548

585

datetime.timedelta(1)

549

586

>>> string_to_delta(u'1w')

550

587

datetime.timedelta(7)

588

>>> string_to_delta('5m 30s')

589

datetime.timedelta(0, 330)

551

590

"""

552

try:

553

suffix=unicode(interval[-1])

554

value=int(interval[:-1])

555

if suffix == u"d":

556

delta = datetime.timedelta(value)

557

elif suffix == u"s":

558

delta = datetime.timedelta(0, value)

559

elif suffix == u"m":

560

delta = datetime.timedelta(0, 0, 0, 0, value)

561

elif suffix == u"h":

562

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

563

elif suffix == u"w":

564

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

565

else:

591

timevalue = datetime.timedelta(0)

592

for s in interval.split():

593

try:

594

suffix=unicode(s[-1])

595

value=int(s[:-1])

596

if suffix == u"d":

597

delta = datetime.timedelta(value)

598

elif suffix == u"s":

599

delta = datetime.timedelta(0, value)

600

elif suffix == u"m":

601

delta = datetime.timedelta(0, 0, 0, 0, value)

602

elif suffix == u"h":

603

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

604

elif suffix == u"w":

605

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

606

else:

607

raise ValueError

608

except (ValueError, IndexError):

566

609

raise ValueError

567

except (ValueError, IndexError):

568

raise ValueError

569

return delta

610

timevalue += delta

611

return timevalue

570

612

571

613

572

614

def server_state_changed(state):

573

615

"""Derived from the Avahi example code"""

574

616

if state == avahi.SERVER_COLLISION:

575

logger.warning(u"Server name collision")

617

logger.error(u"Zeroconf server name collision")

576

618

service.remove()

577

619

elif state == avahi.SERVER_RUNNING:

578

620

service.add()

580

622

581

623

def entry_group_state_changed(state, error):

582

624

"""Derived from the Avahi example code"""

583

logger.debug(u"state change: %i", state)

625

logger.debug(u"Avahi state change: %i", state)

584

626

585

627

if state == avahi.ENTRY_GROUP_ESTABLISHED:

586

logger.debug(u"Service established.")

628

logger.debug(u"Zeroconf service established.")

587

629

elif state == avahi.ENTRY_GROUP_COLLISION:

588

logger.warning(u"Service name collision.")

630

logger.warning(u"Zeroconf service name collision.")

589

631

service.rename()

590

632

elif state == avahi.ENTRY_GROUP_FAILURE:

591

logger.critical(u"Error in group state changed %s",

633

logger.critical(u"Avahi: Error in group state changed %s",

592

634

unicode(error))

593

635

raise AvahiGroupError("State changed: %s", str(error))

594

636

595

def if_nametoindex(interface, _func=[None]):

637

def if_nametoindex(interface):

596

638

"""Call the C function if_nametoindex(), or equivalent"""

597

if _func[0] is not None:

598

return _func[0](interface)

639

global if_nametoindex

599

640

try:

600

641

if "ctypes.util" not in sys.modules:

601

642

import ctypes.util

602

while True:

603

try:

604

libc = ctypes.cdll.LoadLibrary\

605

(ctypes.util.find_library("c"))

606

_func[0] = libc.if_nametoindex

607

return _func[0](interface)

608

except IOError, e:

609

if e != errno.EINTR:

610

raise

643

if_nametoindex = ctypes.cdll.LoadLibrary\

644

(ctypes.util.find_library("c")).if_nametoindex

611

645

except (OSError, AttributeError):

612

646

if "struct" not in sys.modules:

613

647

import struct

614

648

if "fcntl" not in sys.modules:

615

649

import fcntl

616

def the_hard_way(interface):

650

def if_nametoindex(interface):

617

651

"Get an interface index the hard way, i.e. using fcntl()"

618

652

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

619

653

s = socket.socket()

622

656

s.close()

623

657

interface_index = struct.unpack("I", ifreq[16:20])[0]

624

658

return interface_index

625

_func[0] = the_hard_way

626

return _func[0](interface)

627

628

629

def daemon(nochdir, noclose):

659

return if_nametoindex(interface)

660

661

662

def daemon(nochdir = False, noclose = False):

630

663

"""See daemon(3). Standard BSD Unix function.

631

664

This should really exist as os.daemon, but it doesn't (yet)."""

632

665

if os.fork():

634

667

os.setsid()

635

668

if not nochdir:

636

669

os.chdir("/")

670

if os.fork():

671

sys.exit()

637

672

if not noclose:

638

673

# Close all standard open file descriptors

639

674

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

651

686

global main_loop_started

652

687

main_loop_started = False

653

688

654

parser = OptionParser()

689

parser = OptionParser(version = "%%prog %s" % version)

655

690

parser.add_option("-i", "--interface", type="string",

656

691

metavar="IF", help="Bind to interface IF")

657

692

parser.add_option("-a", "--address", type="string",

660

695

help="Port number to receive requests on")

661

696

parser.add_option("--check", action="store_true", default=False,

662

697

help="Run self-test")

663

parser.add_option("--debug", action="store_true", default=False,

698

parser.add_option("--debug", action="store_true",

664

699

help="Debug mode; run in foreground and log to"

665

700

" terminal")

666

701

parser.add_option("--priority", type="string", help="GnuTLS"

691

726

# Parse config file for server-global settings

692

727

server_config = ConfigParser.SafeConfigParser(server_defaults)

693

728

del server_defaults

694

server_config.read(os.path.join(options.configdir, "server.conf"))

695

server_section = "server"

729

server_config.read(os.path.join(options.configdir, "mandos.conf"))

696

730

# Convert the SafeConfigParser object to a dict

697

server_settings = dict(server_config.items(server_section))

731

server_settings = server_config.defaults()

698

732

# Use getboolean on the boolean config option

699

733

server_settings["debug"] = server_config.getboolean\

700

(server_section, "debug")

734

("DEFAULT", "debug")

701

735

del server_config

702

736

703

737

# Override the settings from the config file with command line

710

744

del options

711

745

# Now we have our good server settings in "server_settings"

712

746

747

debug = server_settings["debug"]

748

749

if not debug:

750

syslogger.setLevel(logging.WARNING)

751

console.setLevel(logging.WARNING)

752

753

if server_settings["servicename"] != "Mandos":

754

syslogger.setFormatter(logging.Formatter\

755

('Mandos (%s): %%(levelname)s:'

756

' %%(message)s'

757

% server_settings["servicename"]))

758

713

759

# Parse config file with clients

714

760

client_defaults = { "timeout": "1h",

715

761

"interval": "5m",

716

"checker": "fping -q -- %%(fqdn)s",

762

"checker": "fping -q -- %(host)s",

763

"host": "",

717

764

}

718

765

client_config = ConfigParser.SafeConfigParser(client_defaults)

719

766

client_config.read(os.path.join(server_settings["configdir"],

720

767

"clients.conf"))

721

768

769

clients = Set()

770

tcp_server = IPv6_TCPServer((server_settings["address"],

771

server_settings["port"]),

772

tcp_handler,

773

settings=server_settings,

774

clients=clients)

775

pidfilename = "/var/run/mandos.pid"

776

try:

777

pidfile = open(pidfilename, "w")

778

except IOError, error:

779

logger.error("Could not open file %r", pidfilename)

780

781

uid = 65534

782

gid = 65534

783

try:

784

uid = pwd.getpwnam("mandos").pw_uid

785

except KeyError:

786

try:

787

uid = pwd.getpwnam("nobody").pw_uid

788

except KeyError:

789

pass

790

try:

791

gid = pwd.getpwnam("mandos").pw_gid

792

except KeyError:

793

try:

794

gid = pwd.getpwnam("nogroup").pw_gid

795

except KeyError:

796

pass

797

try:

798

os.setuid(uid)

799

os.setgid(gid)

800

except OSError, error:

801

if error[0] != errno.EPERM:

802

raise error

803

722

804

global service

723

805

service = AvahiService(name = server_settings["servicename"],

724

806

type = "_mandos._tcp", );

725

807

if server_settings["interface"]:

726

service.interface = if_nametoindex(server_settings["interface"])

808

service.interface = if_nametoindex\

809

(server_settings["interface"])

727

810

728

811

global main_loop

729

812

global bus

732

815

DBusGMainLoop(set_as_default=True )

733

816

main_loop = gobject.MainLoop()

734

817

bus = dbus.SystemBus()

735

server = dbus.Interface(

736

bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),

737

avahi.DBUS_INTERFACE_SERVER )

818

server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,

819

avahi.DBUS_PATH_SERVER),

820

avahi.DBUS_INTERFACE_SERVER)

738

821

# End of Avahi example code

739

822

740

debug = server_settings["debug"]

741

742

if debug:

743

console = logging.StreamHandler()

744

# console.setLevel(logging.DEBUG)

745

console.setFormatter(logging.Formatter\

746

('%(levelname)s: %(message)s'))

747

logger.addHandler(console)

748

del console

749

750

clients = Set()

751

823

def remove_from_clients(client):

752

824

clients.remove(client)

753

825

if not clients:

754

logger.debug(u"No clients left, exiting")

826

logger.critical(u"No clients left, exiting")

755

827

sys.exit()

756

828

757

clients.update(Set(Client(name=section,

829

clients.update(Set(Client(name = section,

758

830

stop_hook = remove_from_clients,

759

**(dict(client_config\

760

.items(section))))

831

config

832

= dict(client_config.items(section)))

761

833

for section in client_config.sections()))

762

763

if not debug:

764

daemon(False, False)

834

if not clients:

835

logger.critical(u"No clients defined")

836

sys.exit(1)

837

838

if debug:

839

# Redirect stdin so all checkers get /dev/null

840

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

841

os.dup2(null, sys.stdin.fileno())

842

if null > 2:

843

os.close(null)

844

else:

845

# No console logging

846

logger.removeHandler(console)

847

# Close all input and output, do double fork, etc.

848

daemon()

849

850

try:

851

pid = os.getpid()

852

pidfile.write(str(pid) + "\n")

853

pidfile.close()

854

del pidfile

855

except IOError, err:

856

logger.error(u"Could not write to file %r with PID %d",

857

pidfilename, pid)

858

except NameError:

859

# "pidfile" was never created

860

pass

861

del pidfilename

765

862

766

863

def cleanup():

767

864

"Cleanup function; run on exit"

787

884

for client in clients:

788

885

client.start()

789

886

790

tcp_server = IPv6_TCPServer((server_settings["address"],

791

server_settings["port"]),

792

tcp_handler,

793

settings=server_settings,

794

clients=clients)

887

tcp_server.enable()

888

tcp_server.server_activate()

889

795

890

# Find out what port we got

796

891

service.port = tcp_server.socket.getsockname()[1]

797

logger.debug(u"Now listening on address %r, port %d, flowinfo %d,"

798

u" scope_id %d" % tcp_server.socket.getsockname())

892

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

893

u" scope_id %d" % tcp_server.socket.getsockname())

799

894

800

895

#service.interface = tcp_server.socket.getsockname()[3]

801

896

814

909

tcp_server.handle_request\

815

910

(*args[2:], **kwargs) or True)

816

911

817

logger.debug("Starting main loop")

912

logger.debug(u"Starting main loop")

818

913

main_loop_started = True

819

914

main_loop.run()

820

915

except AvahiError, error: