/mandos/trunk : revision 24.1.25

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add" and "remove" in the "AvahiService" class, the

10

# "server_state_changed" and "entry_group_state_changed" functions,

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

#

16

# This program is free software: you can redistribute it and/or modify

17

# it under the terms of the GNU General Public License as published by

18

# the Free Software Foundation, either version 3 of the License, or

19

# (at your option) any later version.

20

#

21

# This program is distributed in the hope that it will be useful,

22

# but WITHOUT ANY WARRANTY; without even the implied warranty of

23

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

24

# GNU General Public License for more details.

25

#

26

# You should have received a copy of the GNU General Public License

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

28

#

29

# Contact the authors at <mandos@fukt.bsnet.se>.

30

#

31

32

from __future__ import division

33

34

import SocketServer

35

import socket

36

import select

37

from optparse import OptionParser

38

import datetime

39

import errno

40

import gnutls.crypto

41

import gnutls.connection

42

import gnutls.errors

43

import gnutls.library.functions

44

import gnutls.library.constants

45

import gnutls.library.types

46

import ConfigParser

47

import sys

48

import re

49

import os

50

import signal

51

from sets import Set

52

import subprocess

53

import atexit

54

import stat

55

import logging

56

import logging.handlers

57

58

import dbus

59

import gobject

60

import avahi

61

from dbus.mainloop.glib import DBusGMainLoop

62

import ctypes

63

64

65

logger = logging.Logger('mandos')

66

syslogger = logging.handlers.SysLogHandler\

67

(facility = logging.handlers.SysLogHandler.LOG_DAEMON)

68

syslogger.setFormatter(logging.Formatter\

69

('%(levelname)s: %(message)s'))

70

logger.addHandler(syslogger)

71

del syslogger

72

73

74

class AvahiError(Exception):

75

def __init__(self, value):

76

self.value = value

77

def __str__(self):

78

return repr(self.value)

79

80

class AvahiServiceError(AvahiError):

81

pass

82

83

class AvahiGroupError(AvahiError):

84

pass

85

86

87

class AvahiService(object):

88

"""An Avahi (Zeroconf) service.

89

Attributes:

90

interface: integer; avahi.IF_UNSPEC or an interface index.

91

Used to optionally bind to the specified interface.

92

name: string; Example: 'Mandos'

93

type: string; Example: '_mandos._tcp'.

94

See <http://www.dns-sd.org/ServiceTypes.html>

95

port: integer; what port to announce

96

TXT: list of strings; TXT record for the service

97

domain: string; Domain to publish on, default to .local if empty.

98

host: string; Host to publish records for, default is localhost

99

max_renames: integer; maximum number of renames

100

rename_count: integer; counter so we only rename after collisions

101

a sensible number of times

102

"""

103

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

104

type = None, port = None, TXT = None, domain = "",

105

host = "", max_renames = 12):

106

self.interface = interface

107

self.name = name

108

self.type = type

109

self.port = port

110

if TXT is None:

111

self.TXT = []

112

else:

113

self.TXT = TXT

114

self.domain = domain

115

self.host = host

116

self.rename_count = 0

117

def rename(self):

118

"""Derived from the Avahi example code"""

119

if self.rename_count >= self.max_renames:

120

logger.critical(u"No suitable service name found after %i"

121

u" retries, exiting.", rename_count)

122

raise AvahiServiceError("Too many renames")

123

name = server.GetAlternativeServiceName(name)

124

logger.error(u"Changing name to %r ...", name)

125

self.remove()

126

self.add()

127

self.rename_count += 1

128

def remove(self):

129

"""Derived from the Avahi example code"""

130

if group is not None:

131

group.Reset()

132

def add(self):

133

"""Derived from the Avahi example code"""

134

global group

135

if group is None:

136

group = dbus.Interface\

137

(bus.get_object(avahi.DBUS_NAME,

138

server.EntryGroupNew()),

139

avahi.DBUS_INTERFACE_ENTRY_GROUP)

140

group.connect_to_signal('StateChanged',

141

entry_group_state_changed)

142

logger.debug(u"Adding service '%s' of type '%s' ...",

143

service.name, service.type)

144

group.AddService(

145

self.interface, # interface

146

avahi.PROTO_INET6, # protocol

147

dbus.UInt32(0), # flags

148

self.name, self.type,

149

self.domain, self.host,

150

dbus.UInt16(self.port),

151

avahi.string_array_to_txt_array(self.TXT))

152

group.Commit()

153

154

# From the Avahi example code:

155

group = None # our entry group

156

# End of Avahi example code

157

158

159

class Client(object):

160

"""A representation of a client host served by this server.

161

Attributes:

162

name: string; from the config file, used in log messages

163

fingerprint: string (40 or 32 hexadecimal digits); used to

164

uniquely identify the client

165

secret: bytestring; sent verbatim (over TLS) to client

166

fqdn: string (FQDN); available for use by the checker command

167

created: datetime.datetime(); object creation, not client host

168

last_checked_ok: datetime.datetime() or None if not yet checked OK

169

timeout: datetime.timedelta(); How long from last_checked_ok

170

until this client is invalid

171

interval: datetime.timedelta(); How often to start a new checker

172

stop_hook: If set, called by stop() as stop_hook(self)

173

checker: subprocess.Popen(); a running checker process used

174

to see if the client lives.

175

'None' if no process is running.

176

checker_initiator_tag: a gobject event source tag, or None

177

stop_initiator_tag: - '' -

178

checker_callback_tag: - '' -

179

checker_command: string; External command which is run to check if

180

client lives. %() expansions are done at

181

runtime with vars(self) as dict, so that for

182

instance %(name)s can be used in the command.

183

Private attibutes:

184

_timeout: Real variable for 'timeout'

185

_interval: Real variable for 'interval'

186

_timeout_milliseconds: Used when calling gobject.timeout_add()

187

_interval_milliseconds: - '' -

188

"""

189

def _set_timeout(self, timeout):

190

"Setter function for 'timeout' attribute"

191

self._timeout = timeout

192

self._timeout_milliseconds = ((self.timeout.days

193

* 24 * 60 * 60 * 1000)

194

+ (self.timeout.seconds * 1000)

195

+ (self.timeout.microseconds

196

// 1000))

197

timeout = property(lambda self: self._timeout,

198

_set_timeout)

199

del _set_timeout

200

def _set_interval(self, interval):

201

"Setter function for 'interval' attribute"

202

self._interval = interval

203

self._interval_milliseconds = ((self.interval.days

204

* 24 * 60 * 60 * 1000)

205

+ (self.interval.seconds

206

* 1000)

207

+ (self.interval.microseconds

208

// 1000))

209

interval = property(lambda self: self._interval,

210

_set_interval)

211

del _set_interval

212

def __init__(self, name = None, stop_hook=None, config={}):

213

"""Note: the 'checker' key in 'config' sets the

214

'checker_command' attribute and *not* the 'checker'

215

attribute."""

216

self.name = name

217

logger.debug(u"Creating client %r", self.name)

218

# Uppercase and remove spaces from fingerprint for later

219

# comparison purposes with return value from the fingerprint()

220

# function

221

self.fingerprint = config["fingerprint"].upper()\

222

.replace(u" ", u"")

223

logger.debug(u" Fingerprint: %s", self.fingerprint)

224

if "secret" in config:

225

self.secret = config["secret"].decode(u"base64")

226

elif "secfile" in config:

227

sf = open(config["secfile"])

228

self.secret = sf.read()

229

sf.close()

230

else:

231

raise TypeError(u"No secret or secfile for client %s"

232

% self.name)

233

self.fqdn = config.get("fqdn", "")

234

self.created = datetime.datetime.now()

235

self.last_checked_ok = None

236

self.timeout = string_to_delta(config["timeout"])

237

self.interval = string_to_delta(config["interval"])

238

self.stop_hook = stop_hook

239

self.checker = None

240

self.checker_initiator_tag = None

241

self.stop_initiator_tag = None

242

self.checker_callback_tag = None

243

self.check_command = config["checker"]

244

def start(self):

245

"""Start this client's checker and timeout hooks"""

246

# Schedule a new checker to be started an 'interval' from now,

247

# and every interval from then on.

248

self.checker_initiator_tag = gobject.timeout_add\

249

(self._interval_milliseconds,

250

self.start_checker)

251

# Also start a new checker *right now*.

252

self.start_checker()

253

# Schedule a stop() when 'timeout' has passed

254

self.stop_initiator_tag = gobject.timeout_add\

255

(self._timeout_milliseconds,

256

self.stop)

257

def stop(self):

258

"""Stop this client.

259

The possibility that a client might be restarted is left open,

260

but not currently used."""

261

# If this client doesn't have a secret, it is already stopped.

262

if self.secret:

263

logger.info(u"Stopping client %s", self.name)

264

self.secret = None

265

else:

266

return False

267

if getattr(self, "stop_initiator_tag", False):

268

gobject.source_remove(self.stop_initiator_tag)

269

self.stop_initiator_tag = None

270

if getattr(self, "checker_initiator_tag", False):

271

gobject.source_remove(self.checker_initiator_tag)

272

self.checker_initiator_tag = None

273

self.stop_checker()

274

if self.stop_hook:

275

self.stop_hook(self)

276

# Do not run this again if called by a gobject.timeout_add

277

return False

278

def __del__(self):

279

self.stop_hook = None

280

self.stop()

281

def checker_callback(self, pid, condition):

282

"""The checker has completed, so take appropriate actions."""

283

now = datetime.datetime.now()

284

self.checker_callback_tag = None

285

self.checker = None

286

if os.WIFEXITED(condition) \

287

and (os.WEXITSTATUS(condition) == 0):

288

logger.info(u"Checker for %(name)s succeeded",

289

vars(self))

290

self.last_checked_ok = now

291

gobject.source_remove(self.stop_initiator_tag)

292

self.stop_initiator_tag = gobject.timeout_add\

293

(self._timeout_milliseconds,

294

self.stop)

295

elif not os.WIFEXITED(condition):

296

logger.warning(u"Checker for %(name)s crashed?",

297

vars(self))

298

else:

299

logger.info(u"Checker for %(name)s failed",

300

vars(self))

301

def start_checker(self):

302

"""Start a new checker subprocess if one is not running.

303

If a checker already exists, leave it running and do

304

nothing."""

305

# The reason for not killing a running checker is that if we

306

# did that, then if a checker (for some reason) started

307

# running slowly and taking more than 'interval' time, the

308

# client would inevitably timeout, since no checker would get

309

# a chance to run to completion. If we instead leave running

310

# checkers alone, the checker would have to take more time

311

# than 'timeout' for the client to be declared invalid, which

312

# is as it should be.

313

if self.checker is None:

314

try:

315

# In case check_command has exactly one % operator

316

command = self.check_command % self.fqdn

317

except TypeError:

318

# Escape attributes for the shell

319

escaped_attrs = dict((key, re.escape(str(val)))

320

for key, val in

321

vars(self).iteritems())

322

try:

323

command = self.check_command % escaped_attrs

324

except TypeError, error:

325

logger.error(u'Could not format string "%s":'

326

u' %s', self.check_command, error)

327

return True # Try again later

328

try:

329

logger.info(u"Starting checker %r for %s",

330

command, self.name)

331

self.checker = subprocess.Popen(command,

332

close_fds=True,

333

shell=True, cwd="/")

334

self.checker_callback_tag = gobject.child_watch_add\

335

(self.checker.pid,

336

self.checker_callback)

337

except subprocess.OSError, error:

338

logger.error(u"Failed to start subprocess: %s",

339

error)

340

# Re-run this periodically if run by gobject.timeout_add

341

return True

342

def stop_checker(self):

343

"""Force the checker process, if any, to stop."""

344

if self.checker_callback_tag:

345

gobject.source_remove(self.checker_callback_tag)

346

self.checker_callback_tag = None

347

if getattr(self, "checker", None) is None:

348

return

349

logger.debug("Stopping checker for %(name)s", vars(self))

350

try:

351

os.kill(self.checker.pid, signal.SIGTERM)

352

#os.sleep(0.5)

353

#if self.checker.poll() is None:

354

# os.kill(self.checker.pid, signal.SIGKILL)

355

except OSError, error:

356

if error.errno != errno.ESRCH: # No such process

357

raise

358

self.checker = None

359

def still_valid(self):

360

"""Has the timeout not yet passed for this client?"""

361

now = datetime.datetime.now()

362

if self.last_checked_ok is None:

363

return now < (self.created + self.timeout)

364

else:

365

return now < (self.last_checked_ok + self.timeout)

366

367

368

def peer_certificate(session):

369

"Return the peer's OpenPGP certificate as a bytestring"

370

# If not an OpenPGP certificate...

371

if gnutls.library.functions.gnutls_certificate_type_get\

372

(session._c_object) \

373

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:

374

# ...do the normal thing

375

return session.peer_certificate

376

list_size = ctypes.c_uint()

377

cert_list = gnutls.library.functions.gnutls_certificate_get_peers\

378

(session._c_object, ctypes.byref(list_size))

379

if list_size.value == 0:

380

return None

381

cert = cert_list[0]

382

return ctypes.string_at(cert.data, cert.size)

383

384

385

def fingerprint(openpgp):

386

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

387

# New GnuTLS "datum" with the OpenPGP public key

388

datum = gnutls.library.types.gnutls_datum_t\

389

(ctypes.cast(ctypes.c_char_p(openpgp),

390

ctypes.POINTER(ctypes.c_ubyte)),

391

ctypes.c_uint(len(openpgp)))

392

# New empty GnuTLS certificate

393

crt = gnutls.library.types.gnutls_openpgp_crt_t()

394

gnutls.library.functions.gnutls_openpgp_crt_init\

395

(ctypes.byref(crt))

396

# Import the OpenPGP public key into the certificate

397

gnutls.library.functions.gnutls_openpgp_crt_import\

398

(crt, ctypes.byref(datum),

399

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

400

# New buffer for the fingerprint

401

buffer = ctypes.create_string_buffer(20)

402

buffer_length = ctypes.c_size_t()

403

# Get the fingerprint from the certificate into the buffer

404

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\

405

(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))

406

# Deinit the certificate

407

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

408

# Convert the buffer to a Python bytestring

409

fpr = ctypes.string_at(buffer, buffer_length.value)

410

# Convert the bytestring to hexadecimal notation

411

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

412

return hex_fpr

413

414

415

class tcp_handler(SocketServer.BaseRequestHandler, object):

416

"""A TCP request handler class.

417

Instantiated by IPv6_TCPServer for each request to handle it.

418

Note: This will run in its own forked process."""

419

420

def handle(self):

421

logger.info(u"TCP connection from: %s",

422

unicode(self.client_address))

423

session = gnutls.connection.ClientSession\

424

(self.request, gnutls.connection.X509Credentials())

425

426

line = self.request.makefile().readline()

427

logger.debug(u"Protocol version: %r", line)

428

try:

429

if int(line.strip().split()[0]) > 1:

430

raise RuntimeError

431

except (ValueError, IndexError, RuntimeError), error:

432

logger.error(u"Unknown protocol version: %s", error)

433

return

434

435

# Note: gnutls.connection.X509Credentials is really a generic

436

# GnuTLS certificate credentials object so long as no X.509

437

# keys are added to it. Therefore, we can use it here despite

438

# using OpenPGP certificates.

439

440

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

441

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

442

# "+DHE-DSS"))

443

priority = "NORMAL" # Fallback default, since this

444

# MUST be set.

445

if self.server.settings["priority"]:

446

priority = self.server.settings["priority"]

447

gnutls.library.functions.gnutls_priority_set_direct\

448

(session._c_object, priority, None);

449

450

try:

451

session.handshake()

452

except gnutls.errors.GNUTLSError, error:

453

logger.warning(u"Handshake failed: %s", error)

454

# Do not run session.bye() here: the session is not

455

# established. Just abandon the request.

456

return

457

try:

458

fpr = fingerprint(peer_certificate(session))

459

except (TypeError, gnutls.errors.GNUTLSError), error:

460

logger.warning(u"Bad certificate: %s", error)

461

session.bye()

462

return

463

logger.debug(u"Fingerprint: %s", fpr)

464

client = None

465

for c in self.server.clients:

466

if c.fingerprint == fpr:

467

client = c

468

break

469

if not client:

470

logger.warning(u"Client not found for fingerprint: %s",

471

fpr)

472

session.bye()

473

return

474

# Have to check if client.still_valid(), since it is possible

475

# that the client timed out while establishing the GnuTLS

476

# session.

477

if not client.still_valid():

478

logger.warning(u"Client %(name)s is invalid",

479

vars(client))

480

session.bye()

481

return

482

sent_size = 0

483

while sent_size < len(client.secret):

484

sent = session.send(client.secret[sent_size:])

485

logger.debug(u"Sent: %d, remaining: %d",

486

sent, len(client.secret)

487

- (sent_size + sent))

488

sent_size += sent

489

session.bye()

490

491

492

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

493

"""IPv6 TCP server. Accepts 'None' as address and/or port.

494

Attributes:

495

settings: Server settings

496

clients: Set() of Client objects

497

"""

498

address_family = socket.AF_INET6

499

def __init__(self, *args, **kwargs):

500

if "settings" in kwargs:

501

self.settings = kwargs["settings"]

502

del kwargs["settings"]

503

if "clients" in kwargs:

504

self.clients = kwargs["clients"]

505

del kwargs["clients"]

506

return super(type(self), self).__init__(*args, **kwargs)

507

def server_bind(self):

508

"""This overrides the normal server_bind() function

509

to bind to an interface if one was specified, and also NOT to

510

bind to an address or port if they were not specified."""

511

if self.settings["interface"]:

512

# 25 is from /usr/include/asm-i486/socket.h

513

SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)

514

try:

515

self.socket.setsockopt(socket.SOL_SOCKET,

516

SO_BINDTODEVICE,

517

self.settings["interface"])

518

except socket.error, error:

519

if error[0] == errno.EPERM:

520

logger.error(u"No permission to"

521

u" bind to interface %s",

522

self.settings["interface"])

523

else:

524

raise error

525

# Only bind(2) the socket if we really need to.

526

if self.server_address[0] or self.server_address[1]:

527

if not self.server_address[0]:

528

in6addr_any = "::"

529

self.server_address = (in6addr_any,

530

self.server_address[1])

531

elif not self.server_address[1]:

532

self.server_address = (self.server_address[0],

533

0)

534

# if self.settings["interface"]:

535

# self.server_address = (self.server_address[0],

536

# 0, # port

537

# 0, # flowinfo

538

# if_nametoindex

539

# (self.settings

540

# ["interface"]))

541

return super(type(self), self).server_bind()

542

543

544

def string_to_delta(interval):

545

"""Parse a string and return a datetime.timedelta

546

547

>>> string_to_delta('7d')

548

datetime.timedelta(7)

549

>>> string_to_delta('60s')

550

datetime.timedelta(0, 60)

551

>>> string_to_delta('60m')

552

datetime.timedelta(0, 3600)

553

>>> string_to_delta('24h')

554

datetime.timedelta(1)

555

>>> string_to_delta(u'1w')

556

datetime.timedelta(7)

557

"""

558

try:

559

suffix=unicode(interval[-1])

560

value=int(interval[:-1])

561

if suffix == u"d":

562

delta = datetime.timedelta(value)

563

elif suffix == u"s":

564

delta = datetime.timedelta(0, value)

565

elif suffix == u"m":

566

delta = datetime.timedelta(0, 0, 0, 0, value)

567

elif suffix == u"h":

568

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

569

elif suffix == u"w":

570

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

571

else:

572

raise ValueError

573

except (ValueError, IndexError):

574

raise ValueError

575

return delta

576

577

578

def server_state_changed(state):

579

"""Derived from the Avahi example code"""

580

if state == avahi.SERVER_COLLISION:

581

logger.error(u"Server name collision")

582

service.remove()

583

elif state == avahi.SERVER_RUNNING:

584

service.add()

585

586

587

def entry_group_state_changed(state, error):

588

"""Derived from the Avahi example code"""

589

logger.debug(u"state change: %i", state)

590

591

if state == avahi.ENTRY_GROUP_ESTABLISHED:

592

logger.debug(u"Service established.")

593

elif state == avahi.ENTRY_GROUP_COLLISION:

594

logger.warning(u"Service name collision.")

595

service.rename()

596

elif state == avahi.ENTRY_GROUP_FAILURE:

597

logger.critical(u"Error in group state changed %s",

598

unicode(error))

599

raise AvahiGroupError("State changed: %s", str(error))

600

601

def if_nametoindex(interface):

602

"""Call the C function if_nametoindex(), or equivalent"""

603

global if_nametoindex

604

try:

605

if "ctypes.util" not in sys.modules:

606

import ctypes.util

607

if_nametoindex = ctypes.cdll.LoadLibrary\

608

(ctypes.util.find_library("c")).if_nametoindex

609

except (OSError, AttributeError):

610

if "struct" not in sys.modules:

611

import struct

612

if "fcntl" not in sys.modules:

613

import fcntl

614

def if_nametoindex(interface):

615

"Get an interface index the hard way, i.e. using fcntl()"

616

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

617

s = socket.socket()

618

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

619

struct.pack("16s16x", interface))

620

s.close()

621

interface_index = struct.unpack("I", ifreq[16:20])[0]

622

return interface_index

623

return if_nametoindex(interface)

624

625

626

def daemon(nochdir = False, noclose = False):

627

"""See daemon(3). Standard BSD Unix function.

628

This should really exist as os.daemon, but it doesn't (yet)."""

629

if os.fork():

630

sys.exit()

631

os.setsid()

632

if not nochdir:

633

os.chdir("/")

634

if os.fork():

635

sys.exit()

636

if not noclose:

637

# Close all standard open file descriptors

638

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

639

if not stat.S_ISCHR(os.fstat(null).st_mode):

640

raise OSError(errno.ENODEV,

641

"/dev/null not a character device")

642

os.dup2(null, sys.stdin.fileno())

643

os.dup2(null, sys.stdout.fileno())

644

os.dup2(null, sys.stderr.fileno())

645

if null > 2:

646

os.close(null)

647

648

649

def main():

650

global main_loop_started

651

main_loop_started = False

652

653

parser = OptionParser()

654

parser.add_option("-i", "--interface", type="string",

655

metavar="IF", help="Bind to interface IF")

656

parser.add_option("-a", "--address", type="string",

657

help="Address to listen for requests on")

658

parser.add_option("-p", "--port", type="int",

659

help="Port number to receive requests on")

660

parser.add_option("--check", action="store_true", default=False,

661

help="Run self-test")

662

parser.add_option("--debug", action="store_true",

663

help="Debug mode; run in foreground and log to"

664

" terminal")

665

parser.add_option("--priority", type="string", help="GnuTLS"

666

" priority string (see GnuTLS documentation)")

667

parser.add_option("--servicename", type="string", metavar="NAME",

668

help="Zeroconf service name")

669

parser.add_option("--configdir", type="string",

670

default="/etc/mandos", metavar="DIR",

671

help="Directory to search for configuration"

672

" files")

673

(options, args) = parser.parse_args()

674

675

if options.check:

676

import doctest

677

doctest.testmod()

678

sys.exit()

679

680

# Default values for config file for server-global settings

681

server_defaults = { "interface": "",

682

"address": "",

683

"port": "",

684

"debug": "False",

685

"priority":

686

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

687

"servicename": "Mandos",

688

}

689

690

# Parse config file for server-global settings

691

server_config = ConfigParser.SafeConfigParser(server_defaults)

692

del server_defaults

693

server_config.read(os.path.join(options.configdir, "mandos.conf"))

694

server_section = "server"

695

# Convert the SafeConfigParser object to a dict

696

server_settings = dict(server_config.items(server_section))

697

# Use getboolean on the boolean config option

698

server_settings["debug"] = server_config.getboolean\

699

(server_section, "debug")

700

del server_config

701

702

# Override the settings from the config file with command line

703

# options, if set.

704

for option in ("interface", "address", "port", "debug",

705

"priority", "servicename", "configdir"):

706

value = getattr(options, option)

707

if value is not None:

708

server_settings[option] = value

709

del options

710

# Now we have our good server settings in "server_settings"

711

712

# Parse config file with clients

713

client_defaults = { "timeout": "1h",

714

"interval": "5m",

715

"checker": "fping -q -- %%(fqdn)s",

716

}

717

client_config = ConfigParser.SafeConfigParser(client_defaults)

718

client_config.read(os.path.join(server_settings["configdir"],

719

"clients.conf"))

720

721

global service

722

service = AvahiService(name = server_settings["servicename"],

723

type = "_mandos._tcp", );

724

if server_settings["interface"]:

725

service.interface = if_nametoindex(server_settings["interface"])

726

727

global main_loop

728

global bus

729

global server

730

# From the Avahi example code

731

DBusGMainLoop(set_as_default=True )

732

main_loop = gobject.MainLoop()

733

bus = dbus.SystemBus()

734

server = dbus.Interface(

735

bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),

736

avahi.DBUS_INTERFACE_SERVER )

737

# End of Avahi example code

738

739

debug = server_settings["debug"]

740

741

if debug:

742

console = logging.StreamHandler()

743

# console.setLevel(logging.DEBUG)

744

console.setFormatter(logging.Formatter\

745

('%(levelname)s: %(message)s'))

746

logger.addHandler(console)

747

del console

748

749

clients = Set()

750

def remove_from_clients(client):

751

clients.remove(client)

752

if not clients:

753

logger.critical(u"No clients left, exiting")

754

sys.exit()

755

756

clients.update(Set(Client(name = section,

757

stop_hook = remove_from_clients,

758

config

759

= dict(client_config.items(section)))

760

for section in client_config.sections()))

761

762

if not debug:

763

daemon()

764

765

def cleanup():

766

"Cleanup function; run on exit"

767

global group

768

# From the Avahi example code

769

if not group is None:

770

group.Free()

771

group = None

772

# End of Avahi example code

773

774

while clients:

775

client = clients.pop()

776

client.stop_hook = None

777

client.stop()

778

779

atexit.register(cleanup)

780

781

if not debug:

782

signal.signal(signal.SIGINT, signal.SIG_IGN)

783

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

784

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

785

786

for client in clients:

787

client.start()

788

789

tcp_server = IPv6_TCPServer((server_settings["address"],

790

server_settings["port"]),

791

tcp_handler,

792

settings=server_settings,

793

clients=clients)

794

# Find out what port we got

795

service.port = tcp_server.socket.getsockname()[1]

796

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

797

u" scope_id %d" % tcp_server.socket.getsockname())

798

799

#service.interface = tcp_server.socket.getsockname()[3]

800

801

try:

802

# From the Avahi example code

803

server.connect_to_signal("StateChanged", server_state_changed)

804

try:

805

server_state_changed(server.GetState())

806

except dbus.exceptions.DBusException, error:

807

logger.critical(u"DBusException: %s", error)

808

sys.exit(1)

809

# End of Avahi example code

810

811

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

812

lambda *args, **kwargs:

813

tcp_server.handle_request\

814

(*args[2:], **kwargs) or True)

815

816

logger.debug("Starting main loop")

817

main_loop_started = True

818

main_loop.run()

819

except AvahiError, error:

820

logger.critical(u"AvahiError: %s" + unicode(error))

821

sys.exit(1)

822

except KeyboardInterrupt:

823

if debug:

824

print

825

826

if __name__ == '__main__':

827

main()