/mandos/trunk : revision 24.1.5

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# following functions: "AvahiService.add", "AvahiService.remove",

9

# following functions: "add_service", "remove_service",

10

# "server_state_changed", "entry_group_state_changed", and some lines

11

# in "main".

12

#

13

# Everything else is

14

13

14

# Påhlsson.

15

#

16

# This program is free software: you can redistribute it and/or modify

17

# it under the terms of the GNU General Public License as published by

26

# You should have received a copy of the GNU General Public License

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

28

#

29

# Contact the authors at <mandos@fukt.bsnet.se>.

29

# Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and

30

# <https://www.fukt.bsnet.se/~teddy/>.

30

31

#

31

32

33

from __future__ import division

65

66

#

66

67

# This server announces itself as a Zeroconf service. Connecting

67

68

# clients use the TLS protocol, with the unusual quirk that this

68

# server program acts as a TLS "client" while a connecting client acts

69

# as a TLS "server". The client (acting as a TLS "server") must

69

# server program acts as a TLS "client" while the connecting clients

70

# acts as a TLS "server". The clients (acting as a TLS "server") must

70

71

# supply an OpenPGP certificate, and the fingerprint of this

71

72

# certificate is used by this server to look up (in a list read from a

72

73

# file at start time) which binary blob to give the client. No other

81

82

logger.addHandler(syslogger)

82

83

del syslogger

83

84

85

class AvahiError(Exception):

86

def __init__(self, value):

87

self.value = value

88

def __str__(self):

89

return repr(self.value)

90

91

class AvahiServiceError(AvahiError):

92

pass

93

94

class AvahiGroupError(AvahiError):

95

pass

96

97

98

class AvahiService(object):

99

"""An Avahi (Zeroconf) service.

100

Attributes:

101

interface: integer; avahi.IF_UNSPEC or an interface index.

102

Used to optionally bind to the specified interface.

103

name: string; Example: 'Mandos'

104

type: string; Example: '_mandos._tcp'.

105

See <http://www.dns-sd.org/ServiceTypes.html>

106

port: integer; what port to announce

107

TXT: list of strings; TXT record for the service

108

domain: string; Domain to publish on, default to .local if empty.

109

host: string; Host to publish records for, default is localhost

110

max_renames: integer; maximum number of renames

111

rename_count: integer; counter so we only rename after collisions

112

a sensible number of times

113

"""

114

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

115

type = None, port = None, TXT = None, domain = "",

116

host = "", max_renames = 12):

117

self.interface = interface

118

self.name = name

119

self.type = type

120

self.port = port

121

if TXT is None:

122

self.TXT = []

123

else:

124

self.TXT = TXT

125

self.domain = domain

126

self.host = host

127

self.rename_count = 0

128

def rename(self):

129

"""Derived from the Avahi example code"""

130

if self.rename_count >= self.max_renames:

131

logger.critical(u"No suitable service name found after %i"

132

u" retries, exiting.", rename_count)

133

raise AvahiServiceError("Too many renames")

134

name = server.GetAlternativeServiceName(name)

135

logger.error(u"Changing name to %r ...", name)

136

self.remove()

137

self.add()

138

self.rename_count += 1

139

def remove(self):

140

"""Derived from the Avahi example code"""

141

if group is not None:

142

group.Reset()

143

def add(self):

144

"""Derived from the Avahi example code"""

145

global group

146

if group is None:

147

group = dbus.Interface\

148

(bus.get_object(avahi.DBUS_NAME,

149

server.EntryGroupNew()),

150

avahi.DBUS_INTERFACE_ENTRY_GROUP)

151

group.connect_to_signal('StateChanged',

152

entry_group_state_changed)

153

logger.debug(u"Adding service '%s' of type '%s' ...",

154

service.name, service.type)

155

group.AddService(

156

self.interface, # interface

157

avahi.PROTO_INET6, # protocol

158

dbus.UInt32(0), # flags

159

self.name, self.type,

160

self.domain, self.host,

161

dbus.UInt16(self.port),

162

avahi.string_array_to_txt_array(self.TXT))

163

group.Commit()

164

85

# This variable is used to optionally bind to a specified interface.

86

# It is a global variable to fit in with the other variables from the

87

# Avahi example code.

88

serviceInterface = avahi.IF_UNSPEC

165

89

# From the Avahi example code:

166

group = None # our entry group

90

serviceName = None

91

serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html

92

servicePort = None # Not known at startup

93

serviceTXT = [] # TXT record for the service

94

domain = "" # Domain to publish on, default to .local

95

host = "" # Host to publish records for, default to localhost

96

group = None #our entry group

97

rename_count = 12 # Counter so we only rename after collisions a

98

# sensible number of times

167

99

# End of Avahi example code

168

100

169

101

175

107

uniquely identify the client

176

108

secret: bytestring; sent verbatim (over TLS) to client

177

109

fqdn: string (FQDN); available for use by the checker command

178

created: datetime.datetime(); object creation, not client host

179

last_checked_ok: datetime.datetime() or None if not yet checked OK

180

timeout: datetime.timedelta(); How long from last_checked_ok

181

until this client is invalid

110

created: datetime.datetime()

111

last_seen: datetime.datetime() or None if not yet seen

112

timeout: datetime.timedelta(); How long from last_seen until

113

this client is invalid

182

114

interval: datetime.timedelta(); How often to start a new checker

183

115

stop_hook: If set, called by stop() as stop_hook(self)

184

116

checker: subprocess.Popen(); a running checker process used

185

117

to see if the client lives.

186

'None' if no process is running.

118

Is None if no process is running.

187

119

checker_initiator_tag: a gobject event source tag, or None

188

120

stop_initiator_tag: - '' -

189

121

checker_callback_tag: - '' -

190

122

checker_command: string; External command which is run to check if

191

client lives. %() expansions are done at

123

client lives. %()s expansions are done at

192

124

runtime with vars(self) as dict, so that for

193

125

instance %(name)s can be used in the command.

194

126

Private attibutes:

195

127

_timeout: Real variable for 'timeout'

196

128

_interval: Real variable for 'interval'

197

_timeout_milliseconds: Used when calling gobject.timeout_add()

129

_timeout_milliseconds: Used by gobject.timeout_add()

198

130

_interval_milliseconds: - '' -

199

131

"""

200

132

def _set_timeout(self, timeout):

220

152

interval = property(lambda self: self._interval,

221

153

_set_interval)

222

154

del _set_interval

223

def __init__(self, name = None, stop_hook=None, config={}):

224

"""Note: the 'checker' key in 'config' sets the

225

'checker_command' attribute and *not* the 'checker'

226

attribute."""

155

def __init__(self, name=None, stop_hook=None, fingerprint=None,

156

secret=None, secfile=None, fqdn=None, timeout=None,

157

interval=-1, checker=None):

158

"""Note: the 'checker' argument sets the 'checker_command'

159

attribute and not the 'checker' attribute.."""

227

160

self.name = name

228

161

logger.debug(u"Creating client %r", self.name)

229

# Uppercase and remove spaces from fingerprint for later

230

# comparison purposes with return value from the fingerprint()

231

# function

232

self.fingerprint = config["fingerprint"].upper()\

233

.replace(u" ", u"")

162

# Uppercase and remove spaces from fingerprint

163

# for later comparison purposes with return value of

164

# the fingerprint() function

165

self.fingerprint = fingerprint.upper().replace(u" ", u"")

234

166

logger.debug(u" Fingerprint: %s", self.fingerprint)

235

if "secret" in config:

236

self.secret = config["secret"].decode(u"base64")

237

elif "secfile" in config:

238

sf = open(config["secfile"])

167

if secret:

168

self.secret = secret.decode(u"base64")

169

elif secfile:

170

sf = open(secfile)

239

171

self.secret = sf.read()

240

172

sf.close()

241

173

else:

242

raise TypeError(u"No secret or secfile for client %s"

243

% self.name)

244

self.fqdn = config.get("fqdn", "")

174

raise RuntimeError(u"No secret or secfile for client %s"

175

% self.name)

176

self.fqdn = fqdn # string

245

177

self.created = datetime.datetime.now()

246

self.last_checked_ok = None

247

self.timeout = string_to_delta(config["timeout"])

248

self.interval = string_to_delta(config["interval"])

178

self.last_seen = None

179

self.timeout = string_to_delta(timeout)

180

self.interval = string_to_delta(interval)

249

181

self.stop_hook = stop_hook

250

182

self.checker = None

251

183

self.checker_initiator_tag = None

252

184

self.stop_initiator_tag = None

253

185

self.checker_callback_tag = None

254

self.check_command = config["checker"]

186

self.check_command = checker

255

187

def start(self):

256

188

"""Start this client's checker and timeout hooks"""

257

189

# Schedule a new checker to be started an 'interval' from now,

267

199

self.stop)

268

200

def stop(self):

269

201

"""Stop this client.

270

The possibility that a client might be restarted is left open,

271

but not currently used."""

202

The possibility that this client might be restarted is left

203

open, but not currently used."""

272

204

# If this client doesn't have a secret, it is already stopped.

273

205

if self.secret:

274

logger.info(u"Stopping client %s", self.name)

206

logger.debug(u"Stopping client %s", self.name)

275

207

self.secret = None

276

208

else:

277

209

return False

278

if getattr(self, "stop_initiator_tag", False):

210

if hasattr(self, "stop_initiator_tag") \

211

and self.stop_initiator_tag:

279

212

gobject.source_remove(self.stop_initiator_tag)

280

213

self.stop_initiator_tag = None

281

if getattr(self, "checker_initiator_tag", False):

214

if hasattr(self, "checker_initiator_tag") \

215

and self.checker_initiator_tag:

282

216

gobject.source_remove(self.checker_initiator_tag)

283

217

self.checker_initiator_tag = None

284

218

self.stop_checker()

296

230

self.checker = None

297

231

if os.WIFEXITED(condition) \

298

232

and (os.WEXITSTATUS(condition) == 0):

299

logger.info(u"Checker for %(name)s succeeded",

300

vars(self))

301

self.last_checked_ok = now

233

logger.debug(u"Checker for %(name)s succeeded",

234

vars(self))

235

self.last_seen = now

302

236

gobject.source_remove(self.stop_initiator_tag)

303

237

self.stop_initiator_tag = gobject.timeout_add\

304

238

(self._timeout_milliseconds,

307

241

logger.warning(u"Checker for %(name)s crashed?",

308

242

vars(self))

309

243

else:

310

logger.info(u"Checker for %(name)s failed",

311

vars(self))

244

logger.debug(u"Checker for %(name)s failed",

245

vars(self))

312

246

def start_checker(self):

313

247

"""Start a new checker subprocess if one is not running.

314

248

If a checker already exists, leave it running and do

323

257

# is as it should be.

324

258

if self.checker is None:

325

259

try:

326

# In case check_command has exactly one % operator

327

260

command = self.check_command % self.fqdn

328

261

except TypeError:

329

# Escape attributes for the shell

330

262

escaped_attrs = dict((key, re.escape(str(val)))

331

263

for key, val in

332

264

vars(self).iteritems())

333

265

try:

334

266

command = self.check_command % escaped_attrs

335

267

except TypeError, error:

336

logger.error(u'Could not format string "%s":'

337

u' %s', self.check_command, error)

268

logger.critical(u'Could not format string "%s":'

269

u' %s', self.check_command, error)

338

270

return True # Try again later

339

271

try:

340

logger.info(u"Starting checker %r for %s",

341

command, self.name)

342

self.checker = subprocess.Popen(command,

343

close_fds=True,

344

shell=True, cwd="/")

272

logger.debug(u"Starting checker %r for %s",

273

command, self.name)

274

self.checker = subprocess.\

275

Popen(command,

276

close_fds=True, shell=True,

277

cwd="/")

345

278

self.checker_callback_tag = gobject.child_watch_add\

346

279

(self.checker.pid,

347

280

self.checker_callback)

355

288

if self.checker_callback_tag:

356

289

gobject.source_remove(self.checker_callback_tag)

357

290

self.checker_callback_tag = None

358

if getattr(self, "checker", None) is None:

291

if not hasattr(self, "checker") or self.checker is None:

359

292

return

360

293

logger.debug("Stopping checker for %(name)s", vars(self))

361

294

try:

364

297

#if self.checker.poll() is None:

365

298

# os.kill(self.checker.pid, signal.SIGKILL)

366

299

except OSError, error:

367

if error.errno != errno.ESRCH: # No such process

300

if error.errno != errno.ESRCH:

368

301

raise

369

302

self.checker = None

370

def still_valid(self):

303

def still_valid(self, now=None):

371

304

"""Has the timeout not yet passed for this client?"""

372

now = datetime.datetime.now()

373

if self.last_checked_ok is None:

305

if now is None:

306

now = datetime.datetime.now()

307

if self.last_seen is None:

374

308

return now < (self.created + self.timeout)

375

309

else:

376

return now < (self.last_checked_ok + self.timeout)

310

return now < (self.last_seen + self.timeout)

377

311

378

312

379

313

def peer_certificate(session):

395

329

396

330

def fingerprint(openpgp):

397

331

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

332

# New empty GnuTLS certificate

333

crt = gnutls.library.types.gnutls_openpgp_crt_t()

334

gnutls.library.functions.gnutls_openpgp_crt_init\

335

(ctypes.byref(crt))

398

336

# New GnuTLS "datum" with the OpenPGP public key

399

337

datum = gnutls.library.types.gnutls_datum_t\

400

338

(ctypes.cast(ctypes.c_char_p(openpgp),

401

339

ctypes.POINTER(ctypes.c_ubyte)),

402

340

ctypes.c_uint(len(openpgp)))

403

# New empty GnuTLS certificate

404

crt = gnutls.library.types.gnutls_openpgp_crt_t()

405

gnutls.library.functions.gnutls_openpgp_crt_init\

406

(ctypes.byref(crt))

407

341

# Import the OpenPGP public key into the certificate

408

gnutls.library.functions.gnutls_openpgp_crt_import\

409

(crt, ctypes.byref(datum),

410

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

342

ret = gnutls.library.functions.gnutls_openpgp_crt_import\

343

(crt,

344

ctypes.byref(datum),

345

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

411

346

# New buffer for the fingerprint

412

347

buffer = ctypes.create_string_buffer(20)

413

348

buffer_length = ctypes.c_size_t()

429

364

Note: This will run in its own forked process."""

430

365

431

366

def handle(self):

432

logger.info(u"TCP connection from: %s",

367

logger.debug(u"TCP connection from: %s",

433

368

unicode(self.client_address))

434

session = gnutls.connection.ClientSession\

435

(self.request, gnutls.connection.X509Credentials())

436

437

line = self.request.makefile().readline()

438

logger.debug(u"Protocol version: %r", line)

439

try:

440

if int(line.strip().split()[0]) > 1:

441

raise RuntimeError

442

except (ValueError, IndexError, RuntimeError), error:

443

logger.error(u"Unknown protocol version: %s", error)

444

return

445

446

# Note: gnutls.connection.X509Credentials is really a generic

447

# GnuTLS certificate credentials object so long as no X.509

448

# keys are added to it. Therefore, we can use it here despite

449

# using OpenPGP certificates.

369

session = gnutls.connection.ClientSession(self.request,

370

gnutls.connection.\

371

X509Credentials())

450

372

451

373

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

452

374

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

453

375

# "+DHE-DSS"))

454

priority = "NORMAL" # Fallback default, since this

455

# MUST be set.

456

if self.server.settings["priority"]:

457

priority = self.server.settings["priority"]

376

priority = "NORMAL"

377

if self.server.options.priority:

378

priority = self.server.options.priority

458

379

gnutls.library.functions.gnutls_priority_set_direct\

459

380

(session._c_object, priority, None);

460

381

461

382

try:

462

383

session.handshake()

463

384

except gnutls.errors.GNUTLSError, error:

464

logger.warning(u"Handshake failed: %s", error)

385

logger.debug(u"Handshake failed: %s", error)

465

386

# Do not run session.bye() here: the session is not

466

387

# established. Just abandon the request.

467

388

return

468

389

try:

469

390

fpr = fingerprint(peer_certificate(session))

470

391

except (TypeError, gnutls.errors.GNUTLSError), error:

471

logger.warning(u"Bad certificate: %s", error)

392

logger.debug(u"Bad certificate: %s", error)

472

393

session.bye()

473

394

return

474

395

logger.debug(u"Fingerprint: %s", fpr)

477

398

if c.fingerprint == fpr:

478

399

client = c

479

400

break

480

if not client:

481

logger.warning(u"Client not found for fingerprint: %s",

482

fpr)

483

session.bye()

484

return

485

401

# Have to check if client.still_valid(), since it is possible

486

402

# that the client timed out while establishing the GnuTLS

487

403

# session.

488

if not client.still_valid():

489

logger.warning(u"Client %(name)s is invalid",

490

vars(client))

404

if (not client) or (not client.still_valid()):

405

if client:

406

logger.debug(u"Client %(name)s is invalid",

407

vars(client))

408

else:

409

logger.debug(u"Client not found for fingerprint: %s",

410

fpr)

491

411

session.bye()

492

412

return

493

413

sent_size = 0

503

423

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

504

424

"""IPv6 TCP server. Accepts 'None' as address and/or port.

505

425

Attributes:

506

settings: Server settings

426

options: Command line options

507

427

clients: Set() of Client objects

508

428

"""

509

429

address_family = socket.AF_INET6

510

430

def __init__(self, *args, **kwargs):

511

if "settings" in kwargs:

512

self.settings = kwargs["settings"]

513

del kwargs["settings"]

431

if "options" in kwargs:

432

self.options = kwargs["options"]

433

del kwargs["options"]

514

434

if "clients" in kwargs:

515

435

self.clients = kwargs["clients"]

516

436

del kwargs["clients"]

519

439

"""This overrides the normal server_bind() function

520

440

to bind to an interface if one was specified, and also NOT to

521

441

bind to an address or port if they were not specified."""

522

if self.settings["interface"]:

523

# 25 is from /usr/include/asm-i486/socket.h

524

SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)

442

if self.options.interface:

443

if not hasattr(socket, "SO_BINDTODEVICE"):

444

# From /usr/include/asm-i486/socket.h

445

socket.SO_BINDTODEVICE = 25

525

446

try:

526

447

self.socket.setsockopt(socket.SOL_SOCKET,

527

SO_BINDTODEVICE,

528

self.settings["interface"])

448

socket.SO_BINDTODEVICE,

449

self.options.interface)

529

450

except socket.error, error:

530

451

if error[0] == errno.EPERM:

531

logger.error(u"No permission to"

532

u" bind to interface %s",

533

self.settings["interface"])

452

logger.warning(u"No permission to"

453

u" bind to interface %s",

454

self.options.interface)

534

455

else:

535

456

raise error

536

457

# Only bind(2) the socket if we really need to.

579

500

return delta

580

501

581

502

503

def add_service():

504

"""Derived from the Avahi example code"""

505

global group, serviceName, serviceType, servicePort, serviceTXT, \

506

domain, host

507

if group is None:

508

group = dbus.Interface(

509

bus.get_object( avahi.DBUS_NAME,

510

server.EntryGroupNew()),

511

avahi.DBUS_INTERFACE_ENTRY_GROUP)

512

group.connect_to_signal('StateChanged',

513

entry_group_state_changed)

514

logger.debug(u"Adding service '%s' of type '%s' ...",

515

serviceName, serviceType)

516

517

group.AddService(

518

serviceInterface, # interface

519

avahi.PROTO_INET6, # protocol

520

dbus.UInt32(0), # flags

521

serviceName, serviceType,

522

domain, host,

523

dbus.UInt16(servicePort),

524

avahi.string_array_to_txt_array(serviceTXT))

525

group.Commit()

526

527

528

def remove_service():

529

"""From the Avahi example code"""

530

global group

531

532

if not group is None:

533

group.Reset()

534

535

582

536

def server_state_changed(state):

583

537

"""Derived from the Avahi example code"""

584

538

if state == avahi.SERVER_COLLISION:

585

logger.error(u"Server name collision")

586

service.remove()

539

logger.warning(u"Server name collision")

540

remove_service()

587

541

elif state == avahi.SERVER_RUNNING:

588

service.add()

542

add_service()

589

543

590

544

591

545

def entry_group_state_changed(state, error):

592

546

"""Derived from the Avahi example code"""

547

global serviceName, server, rename_count

548

593

549

logger.debug(u"state change: %i", state)

594

550

595

551

if state == avahi.ENTRY_GROUP_ESTABLISHED:

596

552

logger.debug(u"Service established.")

597

553

elif state == avahi.ENTRY_GROUP_COLLISION:

598

logger.warning(u"Service name collision.")

599

service.rename()

554

555

rename_count = rename_count - 1

556

if rename_count > 0:

557

name = server.GetAlternativeServiceName(name)

558

logger.warning(u"Service name collision, "

559

u"changing name to '%s' ...", name)

560

remove_service()

561

add_service()

562

563

else:

564

logger.error(u"No suitable service name found after %i"

565

u" retries, exiting.", n_rename)

566

killme(1)

600

567

elif state == avahi.ENTRY_GROUP_FAILURE:

601

logger.critical(u"Error in group state changed %s",

602

unicode(error))

603

raise AvahiGroupError("State changed: %s", str(error))

568

logger.error(u"Error in group state changed %s",

569

unicode(error))

570

killme(1)

571

604

572

605

573

def if_nametoindex(interface):

606

"""Call the C function if_nametoindex(), or equivalent"""

607

global if_nametoindex

574

"""Call the C function if_nametoindex()"""

608

575

try:

609

if "ctypes.util" not in sys.modules:

610

import ctypes.util

611

if_nametoindex = ctypes.cdll.LoadLibrary\

612

(ctypes.util.find_library("c")).if_nametoindex

576

libc = ctypes.cdll.LoadLibrary("libc.so.6")

577

return libc.if_nametoindex(interface)

613

578

except (OSError, AttributeError):

614

579

if "struct" not in sys.modules:

615

580

import struct

616

581

if "fcntl" not in sys.modules:

617

582

import fcntl

618

def if_nametoindex(interface):

619

"Get an interface index the hard way, i.e. using fcntl()"

620

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

621

s = socket.socket()

622

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

623

struct.pack("16s16x", interface))

624

s.close()

625

interface_index = struct.unpack("I", ifreq[16:20])[0]

626

return interface_index

627

return if_nametoindex(interface)

583

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

584

s = socket.socket()

585

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

586

struct.pack("16s16x", interface))

587

s.close()

588

interface_index = struct.unpack("I", ifreq[16:20])[0]

589

return interface_index

628

590

629

591

630

592

def daemon(nochdir, noclose):

637

599

os.chdir("/")

638

600

if not noclose:

639

601

# Close all standard open file descriptors

640

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

602

null = os.open("/dev/null", os.O_NOCTTY | os.O_RDWR)

641

603

if not stat.S_ISCHR(os.fstat(null).st_mode):

642

604

raise OSError(errno.ENODEV,

643

605

"/dev/null not a character device")

648

610

os.close(null)

649

611

650

612

613

def killme(status = 0):

614

logger.debug("Stopping server with exit status %d", status)

615

exitstatus = status

616

if main_loop_started:

617

main_loop.quit()

618

else:

619

sys.exit(status)

620

621

651

622

def main():

623

global exitstatus

624

exitstatus = 0

652

625

global main_loop_started

653

626

main_loop_started = False

654

627

655

628

parser = OptionParser()

656

629

parser.add_option("-i", "--interface", type="string",

657

metavar="IF", help="Bind to interface IF")

658

parser.add_option("-a", "--address", type="string",

630

default=None, metavar="IF",

631

help="Bind to interface IF")

632

parser.add_option("-a", "--address", type="string", default=None,

659

633

help="Address to listen for requests on")

660

parser.add_option("-p", "--port", type="int",

634

parser.add_option("-p", "--port", type="int", default=None,

661

635

help="Port number to receive requests on")

662

636

parser.add_option("--check", action="store_true", default=False,

663

637

help="Run self-test")

664

638

parser.add_option("--debug", action="store_true", default=False,

665

help="Debug mode; run in foreground and log to"

666

" terminal")

667

parser.add_option("--priority", type="string", help="GnuTLS"

668

" priority string (see GnuTLS documentation)")

669

parser.add_option("--servicename", type="string", metavar="NAME",

670

help="Zeroconf service name")

671

parser.add_option("--configdir", type="string",

672

default="/etc/mandos", metavar="DIR",

673

help="Directory to search for configuration"

674

" files")

639

help="Debug mode")

640

parser.add_option("--priority", type="string",

641

default="SECURE256",

642

help="GnuTLS priority string"

643

" (see GnuTLS documentation)")

644

parser.add_option("--servicename", type="string",

645

default="Mandos", help="Zeroconf service name")

675

646

(options, args) = parser.parse_args()

676

647

677

648

if options.check:

679

650

doctest.testmod()

680

651

sys.exit()

681

652

682

# Default values for config file for server-global settings

683

server_defaults = { "interface": "",

684

"address": "",

685

"port": "",

686

"debug": "False",

687

"priority":

688

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

689

"servicename": "Mandos",

690

}

691

692

# Parse config file for server-global settings

693

server_config = ConfigParser.SafeConfigParser(server_defaults)

694

del server_defaults

695

server_config.read(os.path.join(options.configdir, "server.conf"))

696

server_section = "server"

697

# Convert the SafeConfigParser object to a dict

698

server_settings = dict(server_config.items(server_section))

699

# Use getboolean on the boolean config option

700

server_settings["debug"] = server_config.getboolean\

701

(server_section, "debug")

702

del server_config

703

704

# Override the settings from the config file with command line

705

# options, if set.

706

for option in ("interface", "address", "port", "debug",

707

"priority", "servicename", "configdir"):

708

value = getattr(options, option)

709

if value is not None:

710

server_settings[option] = value

711

del options

712

# Now we have our good server settings in "server_settings"

713

714

# Parse config file with clients

715

client_defaults = { "timeout": "1h",

716

"interval": "5m",

717

"checker": "fping -q -- %%(fqdn)s",

718

}

719

client_config = ConfigParser.SafeConfigParser(client_defaults)

720

client_config.read(os.path.join(server_settings["configdir"],

721

"clients.conf"))

722

723

global service

724

service = AvahiService(name = server_settings["servicename"],

725

type = "_mandos._tcp", );

726

if server_settings["interface"]:

727

service.interface = if_nametoindex(server_settings["interface"])

653

# Parse config file

654

defaults = { "timeout": "1h",

655

"interval": "5m",

656

"checker": "fping -q -- %%(fqdn)s",

657

}

658

client_config = ConfigParser.SafeConfigParser(defaults)

659

#client_config.readfp(open("global.conf"), "global.conf")

660

client_config.read("mandos-clients.conf")

661

662

global serviceName

663

serviceName = options.servicename;

728

664

729

665

global main_loop

730

666

global bus

738

674

avahi.DBUS_INTERFACE_SERVER )

739

675

# End of Avahi example code

740

676

741

debug = server_settings["debug"]

677

debug = options.debug

742

678

743

679

if debug:

744

680

console = logging.StreamHandler()

752

688

def remove_from_clients(client):

753

689

clients.remove(client)

754

690

if not clients:

755

logger.critical(u"No clients left, exiting")

756

sys.exit()

691

logger.debug(u"No clients left, exiting")

692

killme()

757

693

758

clients.update(Set(Client(name = section,

694

clients.update(Set(Client(name=section,

759

695

stop_hook = remove_from_clients,

760

config

761

= dict(client_config.items(section)))

696

**(dict(client_config\

697

.items(section))))

762

698

for section in client_config.sections()))

763

699

764

700

if not debug:

782

718

783

719

if not debug:

784

720

signal.signal(signal.SIGINT, signal.SIG_IGN)

785

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

786

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

721

signal.signal(signal.SIGHUP, lambda signum, frame: killme())

722

signal.signal(signal.SIGTERM, lambda signum, frame: killme())

787

723

788

724

for client in clients:

789

725

client.start()

790

726

791

tcp_server = IPv6_TCPServer((server_settings["address"],

792

server_settings["port"]),

727

tcp_server = IPv6_TCPServer((options.address, options.port),

793

728

tcp_handler,

794

settings=server_settings,

729

options=options,

795

730

clients=clients)

796

# Find out what port we got

797

service.port = tcp_server.socket.getsockname()[1]

798

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

799

u" scope_id %d" % tcp_server.socket.getsockname())

800

801

#service.interface = tcp_server.socket.getsockname()[3]

802

803

try:

804

# From the Avahi example code

805

server.connect_to_signal("StateChanged", server_state_changed)

806

try:

807

server_state_changed(server.GetState())

808

except dbus.exceptions.DBusException, error:

809

logger.critical(u"DBusException: %s", error)

810

sys.exit(1)

811

# End of Avahi example code

812

813

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

814

lambda *args, **kwargs:

815

tcp_server.handle_request\

816

(*args[2:], **kwargs) or True)

817

731

# Find out what random port we got

732

global servicePort

733

servicePort = tcp_server.socket.getsockname()[1]

734

logger.debug(u"Now listening on port %d", servicePort)

735

736

if options.interface is not None:

737

global serviceInterface

738

serviceInterface = if_nametoindex(options.interface)

739

740

# From the Avahi example code

741

server.connect_to_signal("StateChanged", server_state_changed)

742

try:

743

server_state_changed(server.GetState())

744

except dbus.exceptions.DBusException, error:

745

logger.critical(u"DBusException: %s", error)

746

killme(1)

747

# End of Avahi example code

748

749

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

750

lambda *args, **kwargs:

751

tcp_server.handle_request(*args[2:],

752

**kwargs) or True)

753

try:

818

754

logger.debug("Starting main loop")

819

755

main_loop_started = True

820

756

main_loop.run()

821

except AvahiError, error:

822

logger.critical(u"AvahiError: %s" + unicode(error))

823

sys.exit(1)

824

757

except KeyboardInterrupt:

825

758

if debug:

826

759

print

760

761

sys.exit(exitstatus)

827

762

828

763

if __name__ == '__main__':

829

764

main()