To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237
- compare with another revision
- download diff
- download tarball
- view history from revision 237
- Committer: Teddy Hogeborn
- Date: 2008-11-08 17:26:35 UTC
- Revision ID: teddy@fukt.bsnet.se-20081108172635-6eexzbysvsk4bu1z
* mandos: Also import "with_statement" and "absolute_import" from
"__future__. Import "closing" from "contextlib".
(Client.__init__): Use "with closing" on "secfile".
(Client.checker_callback): Call "self.bump_timeout()" instead of
doing it directly.
(Client.bump_timeout): New method to bump up the timeout.
(TCP_handler.handle): Simplify code to provide fallback default for
GnuTLS priority string.
(IPv6_TCPServer): Do not inherit from
"SocketServer.ForkingTCPServer", since that is
undocumented - instead, follow the example code
from the documentation.
(if_nametoindex): Use "with closing" on the socket.
"__future__. Import "closing" from "contextlib".
(Client.__init__): Use "with closing" on "secfile".
(Client.checker_callback): Call "self.bump_timeout()" instead of
doing it directly.
(Client.bump_timeout): New method to bump up the timeout.
(TCP_handler.handle): Simplify code to provide fallback default for
GnuTLS priority string.
(IPv6_TCPServer): Do not inherit from
"SocketServer.ForkingTCPServer", since that is
undocumented - instead, follow the example code
from the documentation.
(if_nametoindex): Use "with closing" on the socket.
- files added:
- debian/mandos-client.config
- files removed:
- debian/watch
- files modified:
- INSTALL
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008 Teddy Hogeborn & Björn Påhlsson
16
15
#
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
33
32
34
33
from __future__ import division, with_statement, absolute_import
35
34
36
import SocketServer as socketserver
35
import SocketServer
37
36
import socket
38
import optparse
37
from optparse import OptionParser
39
38
import datetime
40
39
import errno
41
40
import gnutls.crypto
44
43
import gnutls.library.functions
45
44
import gnutls.library.constants
46
45
import gnutls.library.types
47
import ConfigParser as configparser
46
import ConfigParser
48
47
import sys
49
48
import re
50
49
import os
51
50
import signal
51
from sets import Set
52
52
import subprocess
53
53
import atexit
54
54
import stat
56
56
import logging.handlers
57
57
import pwd
58
58
from contextlib import closing
59
import struct
60
import fcntl
61
import functools
62
59
63
60
import dbus
64
import dbus.service
65
61
import gobject
66
62
import avahi
67
63
from dbus.mainloop.glib import DBusGMainLoop
68
64
import ctypes
69
65
import ctypes.util
70
66
71
try:
72
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
73
except AttributeError:
74
try:
75
from IN import SO_BINDTODEVICE
76
except ImportError:
77
SO_BINDTODEVICE = None
78
79
80
version = "1.0.11"
81
82
logger = logging.Logger(u'mandos')
83
syslogger = (logging.handlers.SysLogHandler
84
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
85
address = "/dev/log"))
86
syslogger.setFormatter(logging.Formatter
87
(u'Mandos [%(process)d]: %(levelname)s:'
88
u' %(message)s'))
67
version = "1.0.2"
68
69
logger = logging.Logger('mandos')
70
syslogger = logging.handlers.SysLogHandler\
71
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
72
address = "/dev/log")
73
syslogger.setFormatter(logging.Formatter\
74
('Mandos: %(levelname)s: %(message)s'))
89
75
logger.addHandler(syslogger)
90
76
91
77
console = logging.StreamHandler()
92
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
93
u' %(levelname)s:'
94
u' %(message)s'))
78
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
79
' %(message)s'))
95
80
logger.addHandler(console)
96
81
97
82
class AvahiError(Exception):
98
def __init__(self, value, *args, **kwargs):
83
def __init__(self, value):
99
84
self.value = value
100
super(AvahiError, self).__init__(value, *args, **kwargs)
101
def __unicode__(self):
102
return unicode(repr(self.value))
85
super(AvahiError, self).__init__()
86
def __str__(self):
87
return repr(self.value)
103
88
104
89
class AvahiServiceError(AvahiError):
105
90
pass
110
95
111
96
class AvahiService(object):
112
97
"""An Avahi (Zeroconf) service.
113
114
98
Attributes:
115
99
interface: integer; avahi.IF_UNSPEC or an interface index.
116
100
Used to optionally bind to the specified interface.
117
name: string; Example: u'Mandos'
118
type: string; Example: u'_mandos._tcp'.
101
name: string; Example: 'Mandos'
102
type: string; Example: '_mandos._tcp'.
119
103
See <http://www.dns-sd.org/ServiceTypes.html>
120
104
port: integer; what port to announce
121
105
TXT: list of strings; TXT record for the service
124
108
max_renames: integer; maximum number of renames
125
109
rename_count: integer; counter so we only rename after collisions
126
110
a sensible number of times
127
group: D-Bus Entry Group
128
server: D-Bus Server
129
bus: dbus.SystemBus()
130
111
"""
131
112
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
132
servicetype = None, port = None, TXT = None,
133
domain = u"", host = u"", max_renames = 32768,
134
protocol = avahi.PROTO_UNSPEC, bus = None):
113
servicetype = None, port = None, TXT = None, domain = "",
114
host = "", max_renames = 32768):
135
115
self.interface = interface
136
116
self.name = name
137
117
self.type = servicetype
138
118
self.port = port
139
self.TXT = TXT if TXT is not None else []
119
if TXT is None:
120
self.TXT = []
121
else:
122
self.TXT = TXT
140
123
self.domain = domain
141
124
self.host = host
142
125
self.rename_count = 0
143
126
self.max_renames = max_renames
144
self.protocol = protocol
145
self.group = None # our entry group
146
self.server = None
147
self.bus = bus
148
127
def rename(self):
149
128
"""Derived from the Avahi example code"""
150
129
if self.rename_count >= self.max_renames:
151
130
logger.critical(u"No suitable Zeroconf service name found"
152
131
u" after %i retries, exiting.",
153
132
self.rename_count)
154
raise AvahiServiceError(u"Too many renames")
155
self.name = self.server.GetAlternativeServiceName(self.name)
133
raise AvahiServiceError("Too many renames")
134
self.name = server.GetAlternativeServiceName(self.name)
156
135
logger.info(u"Changing Zeroconf service name to %r ...",
157
unicode(self.name))
158
syslogger.setFormatter(logging.Formatter
159
(u'Mandos (%s) [%%(process)d]:'
160
u' %%(levelname)s: %%(message)s'
161
% self.name))
136
str(self.name))
137
syslogger.setFormatter(logging.Formatter\
138
('Mandos (%s): %%(levelname)s:'
139
' %%(message)s' % self.name))
162
140
self.remove()
163
141
self.add()
164
142
self.rename_count += 1
165
143
def remove(self):
166
144
"""Derived from the Avahi example code"""
167
if self.group is not None:
168
self.group.Reset()
145
if group is not None:
146
group.Reset()
169
147
def add(self):
170
148
"""Derived from the Avahi example code"""
171
if self.group is None:
172
self.group = dbus.Interface(
173
self.bus.get_object(avahi.DBUS_NAME,
174
self.server.EntryGroupNew()),
175
avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
self.group.connect_to_signal('StateChanged',
177
self.entry_group_state_changed)
149
global group
150
if group is None:
151
group = dbus.Interface\
152
(bus.get_object(avahi.DBUS_NAME,
153
server.EntryGroupNew()),
154
avahi.DBUS_INTERFACE_ENTRY_GROUP)
155
group.connect_to_signal('StateChanged',
156
entry_group_state_changed)
178
157
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
179
self.name, self.type)
180
self.group.AddService(
181
self.interface,
182
self.protocol,
183
dbus.UInt32(0), # flags
184
self.name, self.type,
185
self.domain, self.host,
186
dbus.UInt16(self.port),
187
avahi.string_array_to_txt_array(self.TXT))
188
self.group.Commit()
189
def entry_group_state_changed(self, state, error):
190
"""Derived from the Avahi example code"""
191
logger.debug(u"Avahi state change: %i", state)
192
193
if state == avahi.ENTRY_GROUP_ESTABLISHED:
194
logger.debug(u"Zeroconf service established.")
195
elif state == avahi.ENTRY_GROUP_COLLISION:
196
logger.warning(u"Zeroconf service name collision.")
197
self.rename()
198
elif state == avahi.ENTRY_GROUP_FAILURE:
199
logger.critical(u"Avahi: Error in group state changed %s",
200
unicode(error))
201
raise AvahiGroupError(u"State changed: %s"
202
% unicode(error))
203
def cleanup(self):
204
"""Derived from the Avahi example code"""
205
if self.group is not None:
206
self.group.Free()
207
self.group = None
208
def server_state_changed(self, state):
209
"""Derived from the Avahi example code"""
210
if state == avahi.SERVER_COLLISION:
211
logger.error(u"Zeroconf server name collision")
212
self.remove()
213
elif state == avahi.SERVER_RUNNING:
214
self.add()
215
def activate(self):
216
"""Derived from the Avahi example code"""
217
if self.server is None:
218
self.server = dbus.Interface(
219
self.bus.get_object(avahi.DBUS_NAME,
220
avahi.DBUS_PATH_SERVER),
221
avahi.DBUS_INTERFACE_SERVER)
222
self.server.connect_to_signal(u"StateChanged",
223
self.server_state_changed)
224
self.server_state_changed(self.server.GetState())
158
service.name, service.type)
159
group.AddService(
160
self.interface, # interface
161
avahi.PROTO_INET6, # protocol
162
dbus.UInt32(0), # flags
163
self.name, self.type,
164
self.domain, self.host,
165
dbus.UInt16(self.port),
166
avahi.string_array_to_txt_array(self.TXT))
167
group.Commit()
168
169
# From the Avahi example code:
170
group = None # our entry group
171
# End of Avahi example code
225
172
226
173
227
174
class Client(object):
228
175
"""A representation of a client host served by this server.
229
230
176
Attributes:
231
name: string; from the config file, used in log messages and
232
D-Bus identifiers
177
name: string; from the config file, used in log messages
233
178
fingerprint: string (40 or 32 hexadecimal digits); used to
234
179
uniquely identify the client
235
secret: bytestring; sent verbatim (over TLS) to client
236
host: string; available for use by the checker command
237
created: datetime.datetime(); (UTC) object creation
238
last_enabled: datetime.datetime(); (UTC)
239
enabled: bool()
240
last_checked_ok: datetime.datetime(); (UTC) or None
241
timeout: datetime.timedelta(); How long from last_checked_ok
242
until this client is invalid
243
interval: datetime.timedelta(); How often to start a new checker
244
disable_hook: If set, called by disable() as disable_hook(self)
245
checker: subprocess.Popen(); a running checker process used
246
to see if the client lives.
247
'None' if no process is running.
180
secret: bytestring; sent verbatim (over TLS) to client
181
host: string; available for use by the checker command
182
created: datetime.datetime(); object creation, not client host
183
last_checked_ok: datetime.datetime() or None if not yet checked OK
184
timeout: datetime.timedelta(); How long from last_checked_ok
185
until this client is invalid
186
interval: datetime.timedelta(); How often to start a new checker
187
stop_hook: If set, called by stop() as stop_hook(self)
188
checker: subprocess.Popen(); a running checker process used
189
to see if the client lives.
190
'None' if no process is running.
248
191
checker_initiator_tag: a gobject event source tag, or None
249
disable_initiator_tag: - '' -
192
stop_initiator_tag: - '' -
250
193
checker_callback_tag: - '' -
251
194
checker_command: string; External command which is run to check if
252
195
client lives. %() expansions are done at
253
196
runtime with vars(self) as dict, so that for
254
197
instance %(name)s can be used in the command.
255
current_checker_command: string; current running checker_command
198
Private attibutes:
199
_timeout: Real variable for 'timeout'
200
_interval: Real variable for 'interval'
201
_timeout_milliseconds: Used when calling gobject.timeout_add()
202
_interval_milliseconds: - '' -
256
203
"""
257
258
@staticmethod
259
def _datetime_to_milliseconds(dt):
260
"Convert a datetime.datetime() to milliseconds"
261
return ((dt.days * 24 * 60 * 60 * 1000)
262
+ (dt.seconds * 1000)
263
+ (dt.microseconds // 1000))
264
265
def timeout_milliseconds(self):
266
"Return the 'timeout' attribute in milliseconds"
267
return self._datetime_to_milliseconds(self.timeout)
268
269
def interval_milliseconds(self):
270
"Return the 'interval' attribute in milliseconds"
271
return self._datetime_to_milliseconds(self.interval)
272
273
def __init__(self, name = None, disable_hook=None, config=None):
204
def _set_timeout(self, timeout):
205
"Setter function for 'timeout' attribute"
206
self._timeout = timeout
207
self._timeout_milliseconds = ((self.timeout.days
208
* 24 * 60 * 60 * 1000)
209
+ (self.timeout.seconds * 1000)
210
+ (self.timeout.microseconds
211
// 1000))
212
timeout = property(lambda self: self._timeout,
213
_set_timeout)
214
del _set_timeout
215
def _set_interval(self, interval):
216
"Setter function for 'interval' attribute"
217
self._interval = interval
218
self._interval_milliseconds = ((self.interval.days
219
* 24 * 60 * 60 * 1000)
220
+ (self.interval.seconds
221
* 1000)
222
+ (self.interval.microseconds
223
// 1000))
224
interval = property(lambda self: self._interval,
225
_set_interval)
226
del _set_interval
227
def __init__(self, name = None, stop_hook=None, config=None):
274
228
"""Note: the 'checker' key in 'config' sets the
275
229
'checker_command' attribute and *not* the 'checker'
276
230
attribute."""
277
self.name = name
278
231
if config is None:
279
232
config = {}
233
self.name = name
280
234
logger.debug(u"Creating client %r", self.name)
281
235
# Uppercase and remove spaces from fingerprint for later
282
236
# comparison purposes with return value from the fingerprint()
283
237
# function
284
self.fingerprint = (config[u"fingerprint"].upper()
285
.replace(u" ", u""))
238
self.fingerprint = config["fingerprint"].upper()\
239
.replace(u" ", u"")
286
240
logger.debug(u" Fingerprint: %s", self.fingerprint)
287
if u"secret" in config:
288
self.secret = config[u"secret"].decode(u"base64")
289
elif u"secfile" in config:
241
if "secret" in config:
242
self.secret = config["secret"].decode(u"base64")
243
elif "secfile" in config:
290
244
with closing(open(os.path.expanduser
291
245
(os.path.expandvars
292
(config[u"secfile"])))) as secfile:
246
(config["secfile"])))) \
247
as secfile:
293
248
self.secret = secfile.read()
294
249
else:
295
250
raise TypeError(u"No secret or secfile for client %s"
296
251
% self.name)
297
self.host = config.get(u"host", u"")
298
self.created = datetime.datetime.utcnow()
299
self.enabled = False
300
self.last_enabled = None
252
self.host = config.get("host", "")
253
self.created = datetime.datetime.now()
301
254
self.last_checked_ok = None
302
self.timeout = string_to_delta(config[u"timeout"])
303
self.interval = string_to_delta(config[u"interval"])
304
self.disable_hook = disable_hook
255
self.timeout = string_to_delta(config["timeout"])
256
self.interval = string_to_delta(config["interval"])
257
self.stop_hook = stop_hook
305
258
self.checker = None
306
259
self.checker_initiator_tag = None
307
self.disable_initiator_tag = None
260
self.stop_initiator_tag = None
308
261
self.checker_callback_tag = None
309
self.checker_command = config[u"checker"]
310
self.current_checker_command = None
311
self.last_connect = None
312
313
def enable(self):
262
self.check_command = config["checker"]
263
def start(self):
314
264
"""Start this client's checker and timeout hooks"""
315
if getattr(self, u"enabled", False):
316
# Already enabled
317
return
318
self.last_enabled = datetime.datetime.utcnow()
319
265
# Schedule a new checker to be started an 'interval' from now,
320
266
# and every interval from then on.
321
self.checker_initiator_tag = (gobject.timeout_add
322
(self.interval_milliseconds(),
323
self.start_checker))
267
self.checker_initiator_tag = gobject.timeout_add\
268
(self._interval_milliseconds,
269
self.start_checker)
324
270
# Also start a new checker *right now*.
325
271
self.start_checker()
326
# Schedule a disable() when 'timeout' has passed
327
self.disable_initiator_tag = (gobject.timeout_add
328
(self.timeout_milliseconds(),
329
self.disable))
330
self.enabled = True
331
332
def disable(self):
333
"""Disable this client."""
334
if not getattr(self, "enabled", False):
272
# Schedule a stop() when 'timeout' has passed
273
self.stop_initiator_tag = gobject.timeout_add\
274
(self._timeout_milliseconds,
275
self.stop)
276
def stop(self):
277
"""Stop this client.
278
The possibility that a client might be restarted is left open,
279
but not currently used."""
280
# If this client doesn't have a secret, it is already stopped.
281
if hasattr(self, "secret") and self.secret:
282
logger.info(u"Stopping client %s", self.name)
283
self.secret = None
284
else:
335
285
return False
336
logger.info(u"Disabling client %s", self.name)
337
if getattr(self, u"disable_initiator_tag", False):
338
gobject.source_remove(self.disable_initiator_tag)
339
self.disable_initiator_tag = None
340
if getattr(self, u"checker_initiator_tag", False):
286
if getattr(self, "stop_initiator_tag", False):
287
gobject.source_remove(self.stop_initiator_tag)
288
self.stop_initiator_tag = None
289
if getattr(self, "checker_initiator_tag", False):
341
290
gobject.source_remove(self.checker_initiator_tag)
342
291
self.checker_initiator_tag = None
343
292
self.stop_checker()
344
if self.disable_hook:
345
self.disable_hook(self)
346
self.enabled = False
293
if self.stop_hook:
294
self.stop_hook(self)
347
295
# Do not run this again if called by a gobject.timeout_add
348
296
return False
349
350
297
def __del__(self):
351
self.disable_hook = None
352
self.disable()
353
354
def checker_callback(self, pid, condition, command):
298
self.stop_hook = None
299
self.stop()
300
def checker_callback(self, pid, condition):
355
301
"""The checker has completed, so take appropriate actions."""
356
302
self.checker_callback_tag = None
357
303
self.checker = None
358
if os.WIFEXITED(condition):
359
exitstatus = os.WEXITSTATUS(condition)
360
if exitstatus == 0:
361
logger.info(u"Checker for %(name)s succeeded",
362
vars(self))
363
self.checked_ok()
364
else:
365
logger.info(u"Checker for %(name)s failed",
366
vars(self))
367
else:
304
if os.WIFEXITED(condition) \
305
and (os.WEXITSTATUS(condition) == 0):
306
logger.info(u"Checker for %(name)s succeeded",
307
vars(self))
308
self.bump_timeout()
309
elif not os.WIFEXITED(condition):
368
310
logger.warning(u"Checker for %(name)s crashed?",
369
311
vars(self))
370
371
def checked_ok(self):
312
else:
313
logger.info(u"Checker for %(name)s failed",
314
vars(self))
315
def bump_timeout(self):
372
316
"""Bump up the timeout for this client.
373
374
317
This should only be called when the client has been seen,
375
318
alive and well.
376
319
"""
377
self.last_checked_ok = datetime.datetime.utcnow()
378
gobject.source_remove(self.disable_initiator_tag)
379
self.disable_initiator_tag = (gobject.timeout_add
380
(self.timeout_milliseconds(),
381
self.disable))
382
320
self.last_checked_ok = datetime.datetime.now()
321
gobject.source_remove(self.stop_initiator_tag)
322
self.stop_initiator_tag = gobject.timeout_add\
323
(self._timeout_milliseconds, self.stop)
383
324
def start_checker(self):
384
325
"""Start a new checker subprocess if one is not running.
385
386
326
If a checker already exists, leave it running and do
387
327
nothing."""
388
328
# The reason for not killing a running checker is that if we
393
333
# checkers alone, the checker would have to take more time
394
334
# than 'timeout' for the client to be declared invalid, which
395
335
# is as it should be.
396
397
# If a checker exists, make sure it is not a zombie
398
if self.checker is not None:
399
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
400
if pid:
401
logger.warning(u"Checker was a zombie")
402
gobject.source_remove(self.checker_callback_tag)
403
self.checker_callback(pid, status,
404
self.current_checker_command)
405
# Start a new checker if needed
406
336
if self.checker is None:
407
337
try:
408
# In case checker_command has exactly one % operator
409
command = self.checker_command % self.host
338
# In case check_command has exactly one % operator
339
command = self.check_command % self.host
410
340
except TypeError:
411
341
# Escape attributes for the shell
412
escaped_attrs = dict((key,
413
re.escape(unicode(str(val),
414
errors=
415
u'replace')))
342
escaped_attrs = dict((key, re.escape(str(val)))
416
343
for key, val in
417
344
vars(self).iteritems())
418
345
try:
419
command = self.checker_command % escaped_attrs
346
command = self.check_command % escaped_attrs
420
347
except TypeError, error:
421
348
logger.error(u'Could not format string "%s":'
422
u' %s', self.checker_command, error)
349
u' %s', self.check_command, error)
423
350
return True # Try again later
424
self.current_checker_command = command
425
351
try:
426
352
logger.info(u"Starting checker %r for %s",
427
353
command, self.name)
431
357
# always replaced by /dev/null.)
432
358
self.checker = subprocess.Popen(command,
433
359
close_fds=True,
434
shell=True, cwd=u"/")
435
self.checker_callback_tag = (gobject.child_watch_add
436
(self.checker.pid,
437
self.checker_callback,
438
data=command))
439
# The checker may have completed before the gobject
440
# watch was added. Check for this.
441
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
442
if pid:
443
gobject.source_remove(self.checker_callback_tag)
444
self.checker_callback(pid, status, command)
360
shell=True, cwd="/")
361
self.checker_callback_tag = gobject.child_watch_add\
362
(self.checker.pid,
363
self.checker_callback)
445
364
except OSError, error:
446
365
logger.error(u"Failed to start subprocess: %s",
447
366
error)
448
367
# Re-run this periodically if run by gobject.timeout_add
449
368
return True
450
451
369
def stop_checker(self):
452
370
"""Force the checker process, if any, to stop."""
453
371
if self.checker_callback_tag:
454
372
gobject.source_remove(self.checker_callback_tag)
455
373
self.checker_callback_tag = None
456
if getattr(self, u"checker", None) is None:
374
if getattr(self, "checker", None) is None:
457
375
return
458
376
logger.debug(u"Stopping checker for %(name)s", vars(self))
459
377
try:
465
383
if error.errno != errno.ESRCH: # No such process
466
384
raise
467
385
self.checker = None
468
469
386
def still_valid(self):
470
387
"""Has the timeout not yet passed for this client?"""
471
if not getattr(self, u"enabled", False):
472
return False
473
now = datetime.datetime.utcnow()
388
now = datetime.datetime.now()
474
389
if self.last_checked_ok is None:
475
390
return now < (self.created + self.timeout)
476
391
else:
477
392
return now < (self.last_checked_ok + self.timeout)
478
393
479
394
480
class ClientDBus(Client, dbus.service.Object):
481
"""A Client class using D-Bus
482
483
Attributes:
484
dbus_object_path: dbus.ObjectPath
485
bus: dbus.SystemBus()
486
"""
487
# dbus.service.Object doesn't use super(), so we can't either.
488
489
def __init__(self, bus = None, *args, **kwargs):
490
self.bus = bus
491
Client.__init__(self, *args, **kwargs)
492
# Only now, when this client is initialized, can it show up on
493
# the D-Bus
494
self.dbus_object_path = (dbus.ObjectPath
495
(u"/clients/"
496
+ self.name.replace(u".", u"_")))
497
dbus.service.Object.__init__(self, self.bus,
498
self.dbus_object_path)
499
500
@staticmethod
501
def _datetime_to_dbus(dt, variant_level=0):
502
"""Convert a UTC datetime.datetime() to a D-Bus type."""
503
return dbus.String(dt.isoformat(),
504
variant_level=variant_level)
505
506
def enable(self):
507
oldstate = getattr(self, u"enabled", False)
508
r = Client.enable(self)
509
if oldstate != self.enabled:
510
# Emit D-Bus signals
511
self.PropertyChanged(dbus.String(u"enabled"),
512
dbus.Boolean(True, variant_level=1))
513
self.PropertyChanged(
514
dbus.String(u"last_enabled"),
515
self._datetime_to_dbus(self.last_enabled,
516
variant_level=1))
517
return r
518
519
def disable(self, signal = True):
520
oldstate = getattr(self, u"enabled", False)
521
r = Client.disable(self)
522
if signal and oldstate != self.enabled:
523
# Emit D-Bus signal
524
self.PropertyChanged(dbus.String(u"enabled"),
525
dbus.Boolean(False, variant_level=1))
526
return r
527
528
def __del__(self, *args, **kwargs):
529
try:
530
self.remove_from_connection()
531
except LookupError:
532
pass
533
if hasattr(dbus.service.Object, u"__del__"):
534
dbus.service.Object.__del__(self, *args, **kwargs)
535
Client.__del__(self, *args, **kwargs)
536
537
def checker_callback(self, pid, condition, command,
538
*args, **kwargs):
539
self.checker_callback_tag = None
540
self.checker = None
541
# Emit D-Bus signal
542
self.PropertyChanged(dbus.String(u"checker_running"),
543
dbus.Boolean(False, variant_level=1))
544
if os.WIFEXITED(condition):
545
exitstatus = os.WEXITSTATUS(condition)
546
# Emit D-Bus signal
547
self.CheckerCompleted(dbus.Int16(exitstatus),
548
dbus.Int64(condition),
549
dbus.String(command))
550
else:
551
# Emit D-Bus signal
552
self.CheckerCompleted(dbus.Int16(-1),
553
dbus.Int64(condition),
554
dbus.String(command))
555
556
return Client.checker_callback(self, pid, condition, command,
557
*args, **kwargs)
558
559
def checked_ok(self, *args, **kwargs):
560
r = Client.checked_ok(self, *args, **kwargs)
561
# Emit D-Bus signal
562
self.PropertyChanged(
563
dbus.String(u"last_checked_ok"),
564
(self._datetime_to_dbus(self.last_checked_ok,
565
variant_level=1)))
566
return r
567
568
def start_checker(self, *args, **kwargs):
569
old_checker = self.checker
570
if self.checker is not None:
571
old_checker_pid = self.checker.pid
572
else:
573
old_checker_pid = None
574
r = Client.start_checker(self, *args, **kwargs)
575
# Only if new checker process was started
576
if (self.checker is not None
577
and old_checker_pid != self.checker.pid):
578
# Emit D-Bus signal
579
self.CheckerStarted(self.current_checker_command)
580
self.PropertyChanged(
581
dbus.String(u"checker_running"),
582
dbus.Boolean(True, variant_level=1))
583
return r
584
585
def stop_checker(self, *args, **kwargs):
586
old_checker = getattr(self, u"checker", None)
587
r = Client.stop_checker(self, *args, **kwargs)
588
if (old_checker is not None
589
and getattr(self, u"checker", None) is None):
590
self.PropertyChanged(dbus.String(u"checker_running"),
591
dbus.Boolean(False, variant_level=1))
592
return r
593
594
## D-Bus methods & signals
595
_interface = u"se.bsnet.fukt.Mandos.Client"
596
597
# CheckedOK - method
598
@dbus.service.method(_interface)
599
def CheckedOK(self):
600
return self.checked_ok()
601
602
# CheckerCompleted - signal
603
@dbus.service.signal(_interface, signature=u"nxs")
604
def CheckerCompleted(self, exitcode, waitstatus, command):
605
"D-Bus signal"
606
pass
607
608
# CheckerStarted - signal
609
@dbus.service.signal(_interface, signature=u"s")
610
def CheckerStarted(self, command):
611
"D-Bus signal"
612
pass
613
614
# GetAllProperties - method
615
@dbus.service.method(_interface, out_signature=u"a{sv}")
616
def GetAllProperties(self):
617
"D-Bus method"
618
return dbus.Dictionary({
619
dbus.String(u"name"):
620
dbus.String(self.name, variant_level=1),
621
dbus.String(u"fingerprint"):
622
dbus.String(self.fingerprint, variant_level=1),
623
dbus.String(u"host"):
624
dbus.String(self.host, variant_level=1),
625
dbus.String(u"created"):
626
self._datetime_to_dbus(self.created,
627
variant_level=1),
628
dbus.String(u"last_enabled"):
629
(self._datetime_to_dbus(self.last_enabled,
630
variant_level=1)
631
if self.last_enabled is not None
632
else dbus.Boolean(False, variant_level=1)),
633
dbus.String(u"enabled"):
634
dbus.Boolean(self.enabled, variant_level=1),
635
dbus.String(u"last_checked_ok"):
636
(self._datetime_to_dbus(self.last_checked_ok,
637
variant_level=1)
638
if self.last_checked_ok is not None
639
else dbus.Boolean (False, variant_level=1)),
640
dbus.String(u"timeout"):
641
dbus.UInt64(self.timeout_milliseconds(),
642
variant_level=1),
643
dbus.String(u"interval"):
644
dbus.UInt64(self.interval_milliseconds(),
645
variant_level=1),
646
dbus.String(u"checker"):
647
dbus.String(self.checker_command,
648
variant_level=1),
649
dbus.String(u"checker_running"):
650
dbus.Boolean(self.checker is not None,
651
variant_level=1),
652
dbus.String(u"object_path"):
653
dbus.ObjectPath(self.dbus_object_path,
654
variant_level=1)
655
}, signature=u"sv")
656
657
# IsStillValid - method
658
@dbus.service.method(_interface, out_signature=u"b")
659
def IsStillValid(self):
660
return self.still_valid()
661
662
# PropertyChanged - signal
663
@dbus.service.signal(_interface, signature=u"sv")
664
def PropertyChanged(self, property, value):
665
"D-Bus signal"
666
pass
667
668
# ReceivedSecret - signal
669
@dbus.service.signal(_interface)
670
def ReceivedSecret(self):
671
"D-Bus signal"
672
pass
673
674
# Rejected - signal
675
@dbus.service.signal(_interface)
676
def Rejected(self):
677
"D-Bus signal"
678
pass
679
680
# SetChecker - method
681
@dbus.service.method(_interface, in_signature=u"s")
682
def SetChecker(self, checker):
683
"D-Bus setter method"
684
self.checker_command = checker
685
# Emit D-Bus signal
686
self.PropertyChanged(dbus.String(u"checker"),
687
dbus.String(self.checker_command,
688
variant_level=1))
689
690
# SetHost - method
691
@dbus.service.method(_interface, in_signature=u"s")
692
def SetHost(self, host):
693
"D-Bus setter method"
694
self.host = host
695
# Emit D-Bus signal
696
self.PropertyChanged(dbus.String(u"host"),
697
dbus.String(self.host, variant_level=1))
698
699
# SetInterval - method
700
@dbus.service.method(_interface, in_signature=u"t")
701
def SetInterval(self, milliseconds):
702
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
703
# Emit D-Bus signal
704
self.PropertyChanged(dbus.String(u"interval"),
705
(dbus.UInt64(self.interval_milliseconds(),
706
variant_level=1)))
707
708
# SetSecret - method
709
@dbus.service.method(_interface, in_signature=u"ay",
710
byte_arrays=True)
711
def SetSecret(self, secret):
712
"D-Bus setter method"
713
self.secret = str(secret)
714
715
# SetTimeout - method
716
@dbus.service.method(_interface, in_signature=u"t")
717
def SetTimeout(self, milliseconds):
718
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
719
# Emit D-Bus signal
720
self.PropertyChanged(dbus.String(u"timeout"),
721
(dbus.UInt64(self.timeout_milliseconds(),
722
variant_level=1)))
723
724
# Enable - method
725
@dbus.service.method(_interface)
726
def Enable(self):
727
"D-Bus method"
728
self.enable()
729
730
# StartChecker - method
731
@dbus.service.method(_interface)
732
def StartChecker(self):
733
"D-Bus method"
734
self.start_checker()
735
736
# Disable - method
737
@dbus.service.method(_interface)
738
def Disable(self):
739
"D-Bus method"
740
self.disable()
741
742
# StopChecker - method
743
@dbus.service.method(_interface)
744
def StopChecker(self):
745
self.stop_checker()
746
747
del _interface
748
749
750
class ClientHandler(socketserver.BaseRequestHandler, object):
751
"""A class to handle client connections.
752
753
Instantiated once for each connection to handle it.
395
def peer_certificate(session):
396
"Return the peer's OpenPGP certificate as a bytestring"
397
# If not an OpenPGP certificate...
398
if gnutls.library.functions.gnutls_certificate_type_get\
399
(session._c_object) \
400
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
401
# ...do the normal thing
402
return session.peer_certificate
403
list_size = ctypes.c_uint()
404
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
405
(session._c_object, ctypes.byref(list_size))
406
if list_size.value == 0:
407
return None
408
cert = cert_list[0]
409
return ctypes.string_at(cert.data, cert.size)
410
411
412
def fingerprint(openpgp):
413
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
414
# New GnuTLS "datum" with the OpenPGP public key
415
datum = gnutls.library.types.gnutls_datum_t\
416
(ctypes.cast(ctypes.c_char_p(openpgp),
417
ctypes.POINTER(ctypes.c_ubyte)),
418
ctypes.c_uint(len(openpgp)))
419
# New empty GnuTLS certificate
420
crt = gnutls.library.types.gnutls_openpgp_crt_t()
421
gnutls.library.functions.gnutls_openpgp_crt_init\
422
(ctypes.byref(crt))
423
# Import the OpenPGP public key into the certificate
424
gnutls.library.functions.gnutls_openpgp_crt_import\
425
(crt, ctypes.byref(datum),
426
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
427
# Verify the self signature in the key
428
crtverify = ctypes.c_uint()
429
gnutls.library.functions.gnutls_openpgp_crt_verify_self\
430
(crt, 0, ctypes.byref(crtverify))
431
if crtverify.value != 0:
432
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
433
raise gnutls.errors.CertificateSecurityError("Verify failed")
434
# New buffer for the fingerprint
435
buf = ctypes.create_string_buffer(20)
436
buf_len = ctypes.c_size_t()
437
# Get the fingerprint from the certificate into the buffer
438
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
439
(crt, ctypes.byref(buf), ctypes.byref(buf_len))
440
# Deinit the certificate
441
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
442
# Convert the buffer to a Python bytestring
443
fpr = ctypes.string_at(buf, buf_len.value)
444
# Convert the bytestring to hexadecimal notation
445
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
446
return hex_fpr
447
448
449
class TCP_handler(SocketServer.BaseRequestHandler, object):
450
"""A TCP request handler class.
451
Instantiated by IPv6_TCPServer for each request to handle it.
754
452
Note: This will run in its own forked process."""
755
453
756
454
def handle(self):
757
455
logger.info(u"TCP connection from: %s",
758
456
unicode(self.client_address))
759
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
760
# Open IPC pipe to parent process
761
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
762
session = (gnutls.connection
763
.ClientSession(self.request,
764
gnutls.connection
765
.X509Credentials()))
766
767
line = self.request.makefile().readline()
768
logger.debug(u"Protocol version: %r", line)
769
try:
770
if int(line.strip().split()[0]) > 1:
771
raise RuntimeError
772
except (ValueError, IndexError, RuntimeError), error:
773
logger.error(u"Unknown protocol version: %s", error)
774
return
775
776
# Note: gnutls.connection.X509Credentials is really a
777
# generic GnuTLS certificate credentials object so long as
778
# no X.509 keys are added to it. Therefore, we can use it
779
# here despite using OpenPGP certificates.
780
781
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
782
# u"+AES-256-CBC", u"+SHA1",
783
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
784
# u"+DHE-DSS"))
785
# Use a fallback default, since this MUST be set.
786
priority = self.server.gnutls_priority
787
if priority is None:
788
priority = u"NORMAL"
789
(gnutls.library.functions
790
.gnutls_priority_set_direct(session._c_object,
791
priority, None))
792
793
try:
794
session.handshake()
795
except gnutls.errors.GNUTLSError, error:
796
logger.warning(u"Handshake failed: %s", error)
797
# Do not run session.bye() here: the session is not
798
# established. Just abandon the request.
799
return
800
logger.debug(u"Handshake succeeded")
801
try:
802
fpr = self.fingerprint(self.peer_certificate(session))
803
except (TypeError, gnutls.errors.GNUTLSError), error:
804
logger.warning(u"Bad certificate: %s", error)
805
session.bye()
806
return
807
logger.debug(u"Fingerprint: %s", fpr)
808
809
for c in self.server.clients:
810
if c.fingerprint == fpr:
811
client = c
812
break
813
else:
814
ipc.write(u"NOTFOUND %s %s\n"
815
% (fpr, unicode(self.client_address)))
816
session.bye()
817
return
818
# Have to check if client.still_valid(), since it is
819
# possible that the client timed out while establishing
820
# the GnuTLS session.
821
if not client.still_valid():
822
ipc.write(u"INVALID %s\n" % client.name)
823
session.bye()
824
return
825
ipc.write(u"SENDING %s\n" % client.name)
826
sent_size = 0
827
while sent_size < len(client.secret):
828
sent = session.send(client.secret[sent_size:])
829
logger.debug(u"Sent: %d, remaining: %d",
830
sent, len(client.secret)
831
- (sent_size + sent))
832
sent_size += sent
833
session.bye()
834
835
@staticmethod
836
def peer_certificate(session):
837
"Return the peer's OpenPGP certificate as a bytestring"
838
# If not an OpenPGP certificate...
839
if (gnutls.library.functions
840
.gnutls_certificate_type_get(session._c_object)
841
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
842
# ...do the normal thing
843
return session.peer_certificate
844
list_size = ctypes.c_uint(1)
845
cert_list = (gnutls.library.functions
846
.gnutls_certificate_get_peers
847
(session._c_object, ctypes.byref(list_size)))
848
if not bool(cert_list) and list_size.value != 0:
849
raise gnutls.errors.GNUTLSError(u"error getting peer"
850
u" certificate")
851
if list_size.value == 0:
852
return None
853
cert = cert_list[0]
854
return ctypes.string_at(cert.data, cert.size)
855
856
@staticmethod
857
def fingerprint(openpgp):
858
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
859
# New GnuTLS "datum" with the OpenPGP public key
860
datum = (gnutls.library.types
861
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
862
ctypes.POINTER
863
(ctypes.c_ubyte)),
864
ctypes.c_uint(len(openpgp))))
865
# New empty GnuTLS certificate
866
crt = gnutls.library.types.gnutls_openpgp_crt_t()
867
(gnutls.library.functions
868
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
869
# Import the OpenPGP public key into the certificate
870
(gnutls.library.functions
871
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
872
gnutls.library.constants
873
.GNUTLS_OPENPGP_FMT_RAW))
874
# Verify the self signature in the key
875
crtverify = ctypes.c_uint()
876
(gnutls.library.functions
877
.gnutls_openpgp_crt_verify_self(crt, 0,
878
ctypes.byref(crtverify)))
879
if crtverify.value != 0:
880
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
881
raise (gnutls.errors.CertificateSecurityError
882
(u"Verify failed"))
883
# New buffer for the fingerprint
884
buf = ctypes.create_string_buffer(20)
885
buf_len = ctypes.c_size_t()
886
# Get the fingerprint from the certificate into the buffer
887
(gnutls.library.functions
888
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
889
ctypes.byref(buf_len)))
890
# Deinit the certificate
891
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
892
# Convert the buffer to a Python bytestring
893
fpr = ctypes.string_at(buf, buf_len.value)
894
# Convert the bytestring to hexadecimal notation
895
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
896
return hex_fpr
897
898
899
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
900
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
901
def process_request(self, request, client_address):
902
"""Overrides and wraps the original process_request().
903
904
This function creates a new pipe in self.pipe
905
"""
906
self.pipe = os.pipe()
907
super(ForkingMixInWithPipe,
908
self).process_request(request, client_address)
909
os.close(self.pipe[1]) # close write end
910
self.add_pipe(self.pipe[0])
911
def add_pipe(self, pipe):
912
"""Dummy function; override as necessary"""
913
os.close(pipe)
914
915
916
class IPv6_TCPServer(ForkingMixInWithPipe,
917
socketserver.TCPServer, object):
918
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
919
457
session = gnutls.connection.ClientSession\
458
(self.request, gnutls.connection.X509Credentials())
459
460
line = self.request.makefile().readline()
461
logger.debug(u"Protocol version: %r", line)
462
try:
463
if int(line.strip().split()[0]) > 1:
464
raise RuntimeError
465
except (ValueError, IndexError, RuntimeError), error:
466
logger.error(u"Unknown protocol version: %s", error)
467
return
468
469
# Note: gnutls.connection.X509Credentials is really a generic
470
# GnuTLS certificate credentials object so long as no X.509
471
# keys are added to it. Therefore, we can use it here despite
472
# using OpenPGP certificates.
473
474
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
475
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
476
# "+DHE-DSS"))
477
# Use a fallback default, since this MUST be set.
478
priority = self.server.settings.get("priority", "NORMAL")
479
gnutls.library.functions.gnutls_priority_set_direct\
480
(session._c_object, priority, None)
481
482
try:
483
session.handshake()
484
except gnutls.errors.GNUTLSError, error:
485
logger.warning(u"Handshake failed: %s", error)
486
# Do not run session.bye() here: the session is not
487
# established. Just abandon the request.
488
return
489
try:
490
fpr = fingerprint(peer_certificate(session))
491
except (TypeError, gnutls.errors.GNUTLSError), error:
492
logger.warning(u"Bad certificate: %s", error)
493
session.bye()
494
return
495
logger.debug(u"Fingerprint: %s", fpr)
496
client = None
497
for c in self.server.clients:
498
if c.fingerprint == fpr:
499
client = c
500
break
501
if not client:
502
logger.warning(u"Client not found for fingerprint: %s",
503
fpr)
504
session.bye()
505
return
506
# Have to check if client.still_valid(), since it is possible
507
# that the client timed out while establishing the GnuTLS
508
# session.
509
if not client.still_valid():
510
logger.warning(u"Client %(name)s is invalid",
511
vars(client))
512
session.bye()
513
return
514
## This won't work here, since we're in a fork.
515
# client.bump_timeout()
516
sent_size = 0
517
while sent_size < len(client.secret):
518
sent = session.send(client.secret[sent_size:])
519
logger.debug(u"Sent: %d, remaining: %d",
520
sent, len(client.secret)
521
- (sent_size + sent))
522
sent_size += sent
523
session.bye()
524
525
526
class IPv6_TCPServer(SocketServer.ForkingMixIn,
527
SocketServer.TCPServer, object):
528
"""IPv6 TCP server. Accepts 'None' as address and/or port.
920
529
Attributes:
530
settings: Server settings
531
clients: Set() of Client objects
921
532
enabled: Boolean; whether this server is activated yet
922
interface: None or a network interface name (string)
923
use_ipv6: Boolean; to use IPv6 or not
924
533
"""
925
def __init__(self, server_address, RequestHandlerClass,
926
interface=None, use_ipv6=True):
927
self.interface = interface
928
if use_ipv6:
929
self.address_family = socket.AF_INET6
930
socketserver.TCPServer.__init__(self, server_address,
931
RequestHandlerClass)
534
address_family = socket.AF_INET6
535
def __init__(self, *args, **kwargs):
536
if "settings" in kwargs:
537
self.settings = kwargs["settings"]
538
del kwargs["settings"]
539
if "clients" in kwargs:
540
self.clients = kwargs["clients"]
541
del kwargs["clients"]
542
self.enabled = False
543
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
932
544
def server_bind(self):
933
545
"""This overrides the normal server_bind() function
934
546
to bind to an interface if one was specified, and also NOT to
935
547
bind to an address or port if they were not specified."""
936
if self.interface is not None:
937
if SO_BINDTODEVICE is None:
938
logger.error(u"SO_BINDTODEVICE does not exist;"
939
u" cannot bind to interface %s",
940
self.interface)
941
else:
942
try:
943
self.socket.setsockopt(socket.SOL_SOCKET,
944
SO_BINDTODEVICE,
945
str(self.interface
946
+ u'\0'))
947
except socket.error, error:
948
if error[0] == errno.EPERM:
949
logger.error(u"No permission to"
950
u" bind to interface %s",
951
self.interface)
952
elif error[0] == errno.ENOPROTOOPT:
953
logger.error(u"SO_BINDTODEVICE not available;"
954
u" cannot bind to interface %s",
955
self.interface)
956
else:
957
raise
548
if self.settings["interface"]:
549
# 25 is from /usr/include/asm-i486/socket.h
550
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
551
try:
552
self.socket.setsockopt(socket.SOL_SOCKET,
553
SO_BINDTODEVICE,
554
self.settings["interface"])
555
except socket.error, error:
556
if error[0] == errno.EPERM:
557
logger.error(u"No permission to"
558
u" bind to interface %s",
559
self.settings["interface"])
560
else:
561
raise error
958
562
# Only bind(2) the socket if we really need to.
959
563
if self.server_address[0] or self.server_address[1]:
960
564
if not self.server_address[0]:
961
if self.address_family == socket.AF_INET6:
962
any_address = u"::" # in6addr_any
963
else:
964
any_address = socket.INADDR_ANY
965
self.server_address = (any_address,
565
in6addr_any = "::"
566
self.server_address = (in6addr_any,
966
567
self.server_address[1])
967
568
elif not self.server_address[1]:
968
569
self.server_address = (self.server_address[0],
969
570
0)
970
# if self.interface:
571
# if self.settings["interface"]:
971
572
# self.server_address = (self.server_address[0],
972
573
# 0, # port
973
574
# 0, # flowinfo
974
575
# if_nametoindex
975
# (self.interface))
976
return socketserver.TCPServer.server_bind(self)
977
978
979
class MandosServer(IPv6_TCPServer):
980
"""Mandos server.
981
982
Attributes:
983
clients: set of Client objects
984
gnutls_priority GnuTLS priority string
985
use_dbus: Boolean; to emit D-Bus signals or not
986
clients: set of Client objects
987
gnutls_priority GnuTLS priority string
988
use_dbus: Boolean; to emit D-Bus signals or not
989
990
Assumes a gobject.MainLoop event loop.
991
"""
992
def __init__(self, server_address, RequestHandlerClass,
993
interface=None, use_ipv6=True, clients=None,
994
gnutls_priority=None, use_dbus=True):
995
self.enabled = False
996
self.clients = clients
997
if self.clients is None:
998
self.clients = set()
999
self.use_dbus = use_dbus
1000
self.gnutls_priority = gnutls_priority
1001
IPv6_TCPServer.__init__(self, server_address,
1002
RequestHandlerClass,
1003
interface = interface,
1004
use_ipv6 = use_ipv6)
576
# (self.settings
577
# ["interface"]))
578
return super(IPv6_TCPServer, self).server_bind()
1005
579
def server_activate(self):
1006
580
if self.enabled:
1007
return socketserver.TCPServer.server_activate(self)
581
return super(IPv6_TCPServer, self).server_activate()
1008
582
def enable(self):
1009
583
self.enabled = True
1010
def add_pipe(self, pipe):
1011
# Call "handle_ipc" for both data and EOF events
1012
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1013
self.handle_ipc)
1014
def handle_ipc(self, source, condition, file_objects={}):
1015
condition_names = {
1016
gobject.IO_IN: u"IN", # There is data to read.
1017
gobject.IO_OUT: u"OUT", # Data can be written (without
1018
# blocking).
1019
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1020
gobject.IO_ERR: u"ERR", # Error condition.
1021
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1022
# broken, usually for pipes and
1023
# sockets).
1024
}
1025
conditions_string = ' | '.join(name
1026
for cond, name in
1027
condition_names.iteritems()
1028
if cond & condition)
1029
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1030
conditions_string)
1031
1032
# Turn the pipe file descriptor into a Python file object
1033
if source not in file_objects:
1034
file_objects[source] = os.fdopen(source, u"r", 1)
1035
1036
# Read a line from the file object
1037
cmdline = file_objects[source].readline()
1038
if not cmdline: # Empty line means end of file
1039
# close the IPC pipe
1040
file_objects[source].close()
1041
del file_objects[source]
1042
1043
# Stop calling this function
1044
return False
1045
1046
logger.debug(u"IPC command: %r", cmdline)
1047
1048
# Parse and act on command
1049
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1050
1051
if cmd == u"NOTFOUND":
1052
logger.warning(u"Client not found for fingerprint: %s",
1053
args)
1054
if self.use_dbus:
1055
# Emit D-Bus signal
1056
mandos_dbus_service.ClientNotFound(args)
1057
elif cmd == u"INVALID":
1058
for client in self.clients:
1059
if client.name == args:
1060
logger.warning(u"Client %s is invalid", args)
1061
if self.use_dbus:
1062
# Emit D-Bus signal
1063
client.Rejected()
1064
break
1065
else:
1066
logger.error(u"Unknown client %s is invalid", args)
1067
elif cmd == u"SENDING":
1068
for client in self.clients:
1069
if client.name == args:
1070
logger.info(u"Sending secret to %s", client.name)
1071
client.checked_ok()
1072
if self.use_dbus:
1073
# Emit D-Bus signal
1074
client.ReceivedSecret()
1075
break
1076
else:
1077
logger.error(u"Sending secret to unknown client %s",
1078
args)
1079
else:
1080
logger.error(u"Unknown IPC command: %r", cmdline)
1081
1082
# Keep calling this function
1083
return True
1084
584
1085
585
1086
586
def string_to_delta(interval):
1087
587
"""Parse a string and return a datetime.timedelta
1088
1089
>>> string_to_delta(u'7d')
588
589
>>> string_to_delta('7d')
1090
590
datetime.timedelta(7)
1091
>>> string_to_delta(u'60s')
591
>>> string_to_delta('60s')
1092
592
datetime.timedelta(0, 60)
1093
>>> string_to_delta(u'60m')
593
>>> string_to_delta('60m')
1094
594
datetime.timedelta(0, 3600)
1095
>>> string_to_delta(u'24h')
595
>>> string_to_delta('24h')
1096
596
datetime.timedelta(1)
1097
597
>>> string_to_delta(u'1w')
1098
598
datetime.timedelta(7)
1099
>>> string_to_delta(u'5m 30s')
599
>>> string_to_delta('5m 30s')
1100
600
datetime.timedelta(0, 330)
1101
601
"""
1102
602
timevalue = datetime.timedelta(0)
1122
622
return timevalue
1123
623
1124
624
625
def server_state_changed(state):
626
"""Derived from the Avahi example code"""
627
if state == avahi.SERVER_COLLISION:
628
logger.error(u"Zeroconf server name collision")
629
service.remove()
630
elif state == avahi.SERVER_RUNNING:
631
service.add()
632
633
634
def entry_group_state_changed(state, error):
635
"""Derived from the Avahi example code"""
636
logger.debug(u"Avahi state change: %i", state)
637
638
if state == avahi.ENTRY_GROUP_ESTABLISHED:
639
logger.debug(u"Zeroconf service established.")
640
elif state == avahi.ENTRY_GROUP_COLLISION:
641
logger.warning(u"Zeroconf service name collision.")
642
service.rename()
643
elif state == avahi.ENTRY_GROUP_FAILURE:
644
logger.critical(u"Avahi: Error in group state changed %s",
645
unicode(error))
646
raise AvahiGroupError("State changed: %s", str(error))
647
1125
648
def if_nametoindex(interface):
1126
"""Call the C function if_nametoindex(), or equivalent
1127
1128
Note: This function cannot accept a unicode string."""
649
"""Call the C function if_nametoindex(), or equivalent"""
1129
650
global if_nametoindex
1130
651
try:
1131
if_nametoindex = (ctypes.cdll.LoadLibrary
1132
(ctypes.util.find_library(u"c"))
1133
.if_nametoindex)
652
if_nametoindex = ctypes.cdll.LoadLibrary\
653
(ctypes.util.find_library("c")).if_nametoindex
1134
654
except (OSError, AttributeError):
1135
logger.warning(u"Doing if_nametoindex the hard way")
655
if "struct" not in sys.modules:
656
import struct
657
if "fcntl" not in sys.modules:
658
import fcntl
1136
659
def if_nametoindex(interface):
1137
660
"Get an interface index the hard way, i.e. using fcntl()"
1138
661
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1139
662
with closing(socket.socket()) as s:
1140
663
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1141
struct.pack(str(u"16s16x"),
1142
interface))
1143
interface_index = struct.unpack(str(u"I"),
1144
ifreq[16:20])[0]
664
struct.pack("16s16x", interface))
665
interface_index = struct.unpack("I", ifreq[16:20])[0]
1145
666
return interface_index
1146
667
return if_nametoindex(interface)
1147
668
1148
669
1149
670
def daemon(nochdir = False, noclose = False):
1150
671
"""See daemon(3). Standard BSD Unix function.
1151
1152
672
This should really exist as os.daemon, but it doesn't (yet)."""
1153
673
if os.fork():
1154
674
sys.exit()
1155
675
os.setsid()
1156
676
if not nochdir:
1157
os.chdir(u"/")
677
os.chdir("/")
1158
678
if os.fork():
1159
679
sys.exit()
1160
680
if not noclose:
1162
682
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1163
683
if not stat.S_ISCHR(os.fstat(null).st_mode):
1164
684
raise OSError(errno.ENODEV,
1165
u"/dev/null not a character device")
685
"/dev/null not a character device")
1166
686
os.dup2(null, sys.stdin.fileno())
1167
687
os.dup2(null, sys.stdout.fileno())
1168
688
os.dup2(null, sys.stderr.fileno())
1171
691
1172
692
1173
693
def main():
1174
1175
######################################################################
1176
# Parsing of options, both command line and config file
1177
1178
parser = optparse.OptionParser(version = "%%prog %s" % version)
1179
parser.add_option("-i", u"--interface", type=u"string",
1180
metavar="IF", help=u"Bind to interface IF")
1181
parser.add_option("-a", u"--address", type=u"string",
1182
help=u"Address to listen for requests on")
1183
parser.add_option("-p", u"--port", type=u"int",
1184
help=u"Port number to receive requests on")
1185
parser.add_option("--check", action=u"store_true",
1186
help=u"Run self-test")
1187
parser.add_option("--debug", action=u"store_true",
1188
help=u"Debug mode; run in foreground and log to"
1189
u" terminal")
1190
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1191
u" priority string (see GnuTLS documentation)")
1192
parser.add_option("--servicename", type=u"string",
1193
metavar=u"NAME", help=u"Zeroconf service name")
1194
parser.add_option("--configdir", type=u"string",
1195
default=u"/etc/mandos", metavar=u"DIR",
1196
help=u"Directory to search for configuration"
1197
u" files")
1198
parser.add_option("--no-dbus", action=u"store_false",
1199
dest=u"use_dbus", help=u"Do not provide D-Bus"
1200
u" system bus interface")
1201
parser.add_option("--no-ipv6", action=u"store_false",
1202
dest=u"use_ipv6", help=u"Do not use IPv6")
694
parser = OptionParser(version = "%%prog %s" % version)
695
parser.add_option("-i", "--interface", type="string",
696
metavar="IF", help="Bind to interface IF")
697
parser.add_option("-a", "--address", type="string",
698
help="Address to listen for requests on")
699
parser.add_option("-p", "--port", type="int",
700
help="Port number to receive requests on")
701
parser.add_option("--check", action="store_true", default=False,
702
help="Run self-test")
703
parser.add_option("--debug", action="store_true",
704
help="Debug mode; run in foreground and log to"
705
" terminal")
706
parser.add_option("--priority", type="string", help="GnuTLS"
707
" priority string (see GnuTLS documentation)")
708
parser.add_option("--servicename", type="string", metavar="NAME",
709
help="Zeroconf service name")
710
parser.add_option("--configdir", type="string",
711
default="/etc/mandos", metavar="DIR",
712
help="Directory to search for configuration"
713
" files")
1203
714
options = parser.parse_args()[0]
1204
715
1205
716
if options.check:
1208
719
sys.exit()
1209
720
1210
721
# Default values for config file for server-global settings
1211
server_defaults = { u"interface": u"",
1212
u"address": u"",
1213
u"port": u"",
1214
u"debug": u"False",
1215
u"priority":
1216
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1217
u"servicename": u"Mandos",
1218
u"use_dbus": u"True",
1219
u"use_ipv6": u"True",
722
server_defaults = { "interface": "",
723
"address": "",
724
"port": "",
725
"debug": "False",
726
"priority":
727
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
728
"servicename": "Mandos",
1220
729
}
1221
730
1222
731
# Parse config file for server-global settings
1223
server_config = configparser.SafeConfigParser(server_defaults)
732
server_config = ConfigParser.SafeConfigParser(server_defaults)
1224
733
del server_defaults
1225
server_config.read(os.path.join(options.configdir,
1226
u"mandos.conf"))
734
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1227
735
# Convert the SafeConfigParser object to a dict
1228
736
server_settings = server_config.defaults()
1229
# Use the appropriate methods on the non-string config options
1230
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1231
server_settings[option] = server_config.getboolean(u"DEFAULT",
1232
option)
1233
if server_settings["port"]:
1234
server_settings["port"] = server_config.getint(u"DEFAULT",
1235
u"port")
737
# Use getboolean on the boolean config option
738
server_settings["debug"] = server_config.getboolean\
739
("DEFAULT", "debug")
1236
740
del server_config
1237
741
1238
742
# Override the settings from the config file with command line
1239
743
# options, if set.
1240
for option in (u"interface", u"address", u"port", u"debug",
1241
u"priority", u"servicename", u"configdir",
1242
u"use_dbus", u"use_ipv6"):
744
for option in ("interface", "address", "port", "debug",
745
"priority", "servicename", "configdir"):
1243
746
value = getattr(options, option)
1244
747
if value is not None:
1245
748
server_settings[option] = value
1246
749
del options
1247
# Force all strings to be unicode
1248
for option in server_settings.keys():
1249
if type(server_settings[option]) is str:
1250
server_settings[option] = unicode(server_settings[option])
1251
750
# Now we have our good server settings in "server_settings"
1252
751
1253
##################################################################
1254
1255
# For convenience
1256
debug = server_settings[u"debug"]
1257
use_dbus = server_settings[u"use_dbus"]
1258
use_ipv6 = server_settings[u"use_ipv6"]
752
debug = server_settings["debug"]
1259
753
1260
754
if not debug:
1261
755
syslogger.setLevel(logging.WARNING)
1262
756
console.setLevel(logging.WARNING)
1263
757
1264
if server_settings[u"servicename"] != u"Mandos":
1265
syslogger.setFormatter(logging.Formatter
1266
(u'Mandos (%s) [%%(process)d]:'
1267
u' %%(levelname)s: %%(message)s'
1268
% server_settings[u"servicename"]))
758
if server_settings["servicename"] != "Mandos":
759
syslogger.setFormatter(logging.Formatter\
760
('Mandos (%s): %%(levelname)s:'
761
' %%(message)s'
762
% server_settings["servicename"]))
1269
763
1270
764
# Parse config file with clients
1271
client_defaults = { u"timeout": u"1h",
1272
u"interval": u"5m",
1273
u"checker": u"fping -q -- %%(host)s",
1274
u"host": u"",
765
client_defaults = { "timeout": "1h",
766
"interval": "5m",
767
"checker": "fping -q -- %(host)s",
768
"host": "",
1275
769
}
1276
client_config = configparser.SafeConfigParser(client_defaults)
1277
client_config.read(os.path.join(server_settings[u"configdir"],
1278
u"clients.conf"))
1279
1280
global mandos_dbus_service
1281
mandos_dbus_service = None
1282
1283
tcp_server = MandosServer((server_settings[u"address"],
1284
server_settings[u"port"]),
1285
ClientHandler,
1286
interface=server_settings[u"interface"],
1287
use_ipv6=use_ipv6,
1288
gnutls_priority=
1289
server_settings[u"priority"],
1290
use_dbus=use_dbus)
1291
pidfilename = u"/var/run/mandos.pid"
1292
try:
1293
pidfile = open(pidfilename, u"w")
1294
except IOError:
1295
logger.error(u"Could not open file %r", pidfilename)
1296
1297
try:
1298
uid = pwd.getpwnam(u"_mandos").pw_uid
1299
gid = pwd.getpwnam(u"_mandos").pw_gid
1300
except KeyError:
1301
try:
1302
uid = pwd.getpwnam(u"mandos").pw_uid
1303
gid = pwd.getpwnam(u"mandos").pw_gid
1304
except KeyError:
1305
try:
1306
uid = pwd.getpwnam(u"nobody").pw_uid
1307
gid = pwd.getpwnam(u"nobody").pw_gid
1308
except KeyError:
1309
uid = 65534
1310
gid = 65534
1311
try:
770
client_config = ConfigParser.SafeConfigParser(client_defaults)
771
client_config.read(os.path.join(server_settings["configdir"],
772
"clients.conf"))
773
774
clients = Set()
775
tcp_server = IPv6_TCPServer((server_settings["address"],
776
server_settings["port"]),
777
TCP_handler,
778
settings=server_settings,
779
clients=clients)
780
pidfilename = "/var/run/mandos.pid"
781
try:
782
pidfile = open(pidfilename, "w")
783
except IOError, error:
784
logger.error("Could not open file %r", pidfilename)
785
786
uid = 65534
787
gid = 65534
788
try:
789
uid = pwd.getpwnam("mandos").pw_uid
790
except KeyError:
791
try:
792
uid = pwd.getpwnam("nobody").pw_uid
793
except KeyError:
794
pass
795
try:
796
gid = pwd.getpwnam("mandos").pw_gid
797
except KeyError:
798
try:
799
gid = pwd.getpwnam("nogroup").pw_gid
800
except KeyError:
801
pass
802
try:
803
os.setuid(uid)
1312
804
os.setgid(gid)
1313
os.setuid(uid)
1314
805
except OSError, error:
1315
806
if error[0] != errno.EPERM:
1316
807
raise error
1317
808
1318
# Enable all possible GnuTLS debugging
1319
if debug:
1320
# "Use a log level over 10 to enable all debugging options."
1321
# - GnuTLS manual
1322
gnutls.library.functions.gnutls_global_set_log_level(11)
1323
1324
@gnutls.library.types.gnutls_log_func
1325
def debug_gnutls(level, string):
1326
logger.debug(u"GnuTLS: %s", string[:-1])
1327
1328
(gnutls.library.functions
1329
.gnutls_global_set_log_function(debug_gnutls))
809
global service
810
service = AvahiService(name = server_settings["servicename"],
811
servicetype = "_mandos._tcp", )
812
if server_settings["interface"]:
813
service.interface = if_nametoindex\
814
(server_settings["interface"])
1330
815
1331
816
global main_loop
817
global bus
818
global server
1332
819
# From the Avahi example code
1333
820
DBusGMainLoop(set_as_default=True )
1334
821
main_loop = gobject.MainLoop()
1335
822
bus = dbus.SystemBus()
823
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
824
avahi.DBUS_PATH_SERVER),
825
avahi.DBUS_INTERFACE_SERVER)
1336
826
# End of Avahi example code
1337
if use_dbus:
1338
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1339
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1340
service = AvahiService(name = server_settings[u"servicename"],
1341
servicetype = u"_mandos._tcp",
1342
protocol = protocol, bus = bus)
1343
if server_settings["interface"]:
1344
service.interface = (if_nametoindex
1345
(str(server_settings[u"interface"])))
1346
1347
client_class = Client
1348
if use_dbus:
1349
client_class = functools.partial(ClientDBus, bus = bus)
1350
tcp_server.clients.update(set(
1351
client_class(name = section,
1352
config= dict(client_config.items(section)))
1353
for section in client_config.sections()))
1354
if not tcp_server.clients:
1355
logger.warning(u"No clients defined")
827
828
def remove_from_clients(client):
829
clients.remove(client)
830
if not clients:
831
logger.critical(u"No clients left, exiting")
832
sys.exit()
833
834
clients.update(Set(Client(name = section,
835
stop_hook = remove_from_clients,
836
config
837
= dict(client_config.items(section)))
838
for section in client_config.sections()))
839
if not clients:
840
logger.critical(u"No clients defined")
841
sys.exit(1)
1356
842
1357
843
if debug:
1358
844
# Redirect stdin so all checkers get /dev/null
1367
853
daemon()
1368
854
1369
855
try:
1370
with closing(pidfile):
1371
pid = os.getpid()
1372
pidfile.write(str(pid) + "\n")
856
pid = os.getpid()
857
pidfile.write(str(pid) + "\n")
858
pidfile.close()
1373
859
del pidfile
1374
860
except IOError:
1375
861
logger.error(u"Could not write to file %r with PID %d",
1381
867
1382
868
def cleanup():
1383
869
"Cleanup function; run on exit"
1384
service.cleanup()
870
global group
871
# From the Avahi example code
872
if not group is None:
873
group.Free()
874
group = None
875
# End of Avahi example code
1385
876
1386
while tcp_server.clients:
1387
client = tcp_server.clients.pop()
1388
client.disable_hook = None
1389
client.disable()
877
while clients:
878
client = clients.pop()
879
client.stop_hook = None
880
client.stop()
1390
881
1391
882
atexit.register(cleanup)
1392
883
1395
886
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1396
887
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1397
888
1398
if use_dbus:
1399
class MandosDBusService(dbus.service.Object):
1400
"""A D-Bus proxy object"""
1401
def __init__(self):
1402
dbus.service.Object.__init__(self, bus, u"/")
1403
_interface = u"se.bsnet.fukt.Mandos"
1404
1405
@dbus.service.signal(_interface, signature=u"oa{sv}")
1406
def ClientAdded(self, objpath, properties):
1407
"D-Bus signal"
1408
pass
1409
1410
@dbus.service.signal(_interface, signature=u"s")
1411
def ClientNotFound(self, fingerprint):
1412
"D-Bus signal"
1413
pass
1414
1415
@dbus.service.signal(_interface, signature=u"os")
1416
def ClientRemoved(self, objpath, name):
1417
"D-Bus signal"
1418
pass
1419
1420
@dbus.service.method(_interface, out_signature=u"ao")
1421
def GetAllClients(self):
1422
"D-Bus method"
1423
return dbus.Array(c.dbus_object_path
1424
for c in tcp_server.clients)
1425
1426
@dbus.service.method(_interface,
1427
out_signature=u"a{oa{sv}}")
1428
def GetAllClientsWithProperties(self):
1429
"D-Bus method"
1430
return dbus.Dictionary(
1431
((c.dbus_object_path, c.GetAllProperties())
1432
for c in tcp_server.clients),
1433
signature=u"oa{sv}")
1434
1435
@dbus.service.method(_interface, in_signature=u"o")
1436
def RemoveClient(self, object_path):
1437
"D-Bus method"
1438
for c in tcp_server.clients:
1439
if c.dbus_object_path == object_path:
1440
tcp_server.clients.remove(c)
1441
c.remove_from_connection()
1442
# Don't signal anything except ClientRemoved
1443
c.disable(signal=False)
1444
# Emit D-Bus signal
1445
self.ClientRemoved(object_path, c.name)
1446
return
1447
raise KeyError
1448
1449
del _interface
1450
1451
mandos_dbus_service = MandosDBusService()
1452
1453
for client in tcp_server.clients:
1454
if use_dbus:
1455
# Emit D-Bus signal
1456
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1457
client.GetAllProperties())
1458
client.enable()
889
for client in clients:
890
client.start()
1459
891
1460
892
tcp_server.enable()
1461
893
tcp_server.server_activate()
1462
894
1463
895
# Find out what port we got
1464
896
service.port = tcp_server.socket.getsockname()[1]
1465
if use_ipv6:
1466
logger.info(u"Now listening on address %r, port %d,"
1467
" flowinfo %d, scope_id %d"
1468
% tcp_server.socket.getsockname())
1469
else: # IPv4
1470
logger.info(u"Now listening on address %r, port %d"
1471
% tcp_server.socket.getsockname())
897
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
898
u" scope_id %d" % tcp_server.socket.getsockname())
1472
899
1473
900
#service.interface = tcp_server.socket.getsockname()[3]
1474
901
1475
902
try:
1476
903
# From the Avahi example code
904
server.connect_to_signal("StateChanged", server_state_changed)
1477
905
try:
1478
service.activate()
906
server_state_changed(server.GetState())
1479
907
except dbus.exceptions.DBusException, error:
1480
908
logger.critical(u"DBusException: %s", error)
1481
909
sys.exit(1)
1483
911
1484
912
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
1485
913
lambda *args, **kwargs:
1486
(tcp_server.handle_request
1487
(*args[2:], **kwargs) or True))
914
tcp_server.handle_request\
915
(*args[2:], **kwargs) or True)
1488
916
1489
917
logger.debug(u"Starting main loop")
1490
918
main_loop.run()
1491
919
except AvahiError, error:
1492
logger.critical(u"AvahiError: %s", error)
920
logger.critical(u"AvahiError: %s" + unicode(error))
1493
921
sys.exit(1)
1494
922
except KeyboardInterrupt:
1495
923
if debug:
1496
print >> sys.stderr
1497
logger.debug(u"Server received KeyboardInterrupt")
1498
logger.debug(u"Server exiting")
924
print
1499
925
1500
926
if __name__ == '__main__':
1501
927
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0