/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to server.py

  • Committer: Teddy Hogeborn
  • Date: 2008-07-29 03:35:39 UTC
  • Revision ID: teddy@fukt.bsnet.se-20080729033539-08zecoj3jwlkpjhw
* server.conf: New file.

* mandos-clients.conf: Renamed to clients.conf.

* Makefile (FORTIFY): New.
  (CFLAGS): Include $(FORTIFY).

* plugins.d/mandosclient.c (main): New "if_index" variable.  Bug fix:
                                   check if interface exists.  New
                                   "--connect" option.

* server.py (serviceInterface): Removed; replaced by
                                "AvahiService.interface".  All users
                                changed.
  (AvahiError, AvahiServiceError, AvahiGroupError): New exception
                                                    classes.
  (AvahiService): New class.
  (serviceName): Removed; replaced by "AvahiService.name".  All users
                 changed.
  (serviceType): Removed; replaced by "AvahiService.type".  All users
                 changed.
  (servicePort): Removed; replaced by "AvahiService.port".  All users
                 changed.
  (serviceTXT): Removed; replaced by "AvahiService.TXT".  All users
                changed.
  (domain): Removed; replaced by "AvahiService.domain".  All users
            changed.
  (host): Removed; replaced by "AvahiService.host".  All users
          changed.
  (rename_count): Removed; replaced by "AvahiService.rename_count" and
                 "AvahiService.max_renames".  All users changed.
  (Client.__init__): If no secret or secfile, raise TypeError instead
                     of RuntimeError.
  (Client.last_seen): Renamed to "Client.last_checked_ok".  All users
                      changed.
  (Client.stop, Client.stop_checker): Use "getattr" with default value
                                      instead of "hasattr".
  (Client.still_valid): Removed "now" argument.
  (Client.handle): Separate the "no client found" and "client invalid"
                   cases for clearer code.
  (IPv6_TCPServer.__init__): "options" argument replaced by
                             "settings".  All callers changed.
  (IPv6_TCPServer.options): Replaced by "IPv6_TCPServer.settings".
                            All users changed.
  (IPv6_TCPServer.server_bind): Use getattr instead of hasattr.
  (add_service): Removed; replaced by "AvahiService.add".  All callers
                 changed.
  (remove_service): Removed; replaced by "AvahiService.remove".  All
                    callers changed.
  (entry_group_state_changed): On entry group collision, call the new
                               AvahiService.rename method.  Raise
                               AvahiGroupError on group error.
  (if_nametoindex): Use ctypes.utils.find_library to locate the C
                    library.  Cache the result.  Loop on EINTR.
  (daemon): Use os.path.devnull to locate "/dev/null".
  (killme): Removed.  All callers changed to do "sys.exit()" instead,
            except where stated otherwise.
  (main): Removed "exitstatus".  Removed all default values from all
          non-bool options.  New option "--configdir".  New variables
          "server_defaults" and "server_settings", read from
          "%(configdir)s/server.conf".  Let any supplied command line
          options override server settings.   Variable "defaults"
          renamed to "client_defaults", which is read from
          "clients.conf" instead of "mandos-clients.conf".  New global
          AvahiService object "service" replaces old global variables.
          Catch AvahiError and exit with error if caught.

Show diffs side-by-side

added added

removed removed

Lines of Context:
server.py
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
 
# following functions: "add_service", "remove_service",
 
9
# following functions: "AvahiService.add", "AvahiService.remove",
10
10
# "server_state_changed", "entry_group_state_changed", and some lines
11
11
# in "main".
12
12
# 
13
 
# Everything else is Copyright © 2007-2008 Teddy Hogeborn and Björn
14
 
# Påhlsson.
 
13
# Everything else is
 
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
15
15
# 
16
16
# This program is free software: you can redistribute it and/or modify
17
17
# it under the terms of the GNU General Public License as published by
26
26
# You should have received a copy of the GNU General Public License
27
27
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
28
28
# 
29
 
# Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
30
 
# <https://www.fukt.bsnet.se/~teddy/>.
 
29
# Contact the authors at <mandos@fukt.bsnet.se>.
31
30
# 
32
31
 
33
32
from __future__ import division
66
65
# 
67
66
# This server announces itself as a Zeroconf service.  Connecting
68
67
# clients use the TLS protocol, with the unusual quirk that this
69
 
# server program acts as a TLS "client" while the connecting clients
70
 
# acts as a TLS "server".  The clients (acting as a TLS "server") must
 
68
# server program acts as a TLS "client" while a connecting client acts
 
69
# as a TLS "server".  The client (acting as a TLS "server") must
71
70
# supply an OpenPGP certificate, and the fingerprint of this
72
71
# certificate is used by this server to look up (in a list read from a
73
72
# file at start time) which binary blob to give the client.  No other
82
81
logger.addHandler(syslogger)
83
82
del syslogger
84
83
 
85
 
# This variable is used to optionally bind to a specified interface.
86
 
# It is a global variable to fit in with the other variables from the
87
 
# Avahi example code.
88
 
serviceInterface = avahi.IF_UNSPEC
 
84
 
 
85
class AvahiError(Exception):
 
86
    def __init__(self, value):
 
87
        self.value = value
 
88
    def __str__(self):
 
89
        return repr(self.value)
 
90
 
 
91
class AvahiServiceError(AvahiError):
 
92
    pass
 
93
 
 
94
class AvahiGroupError(AvahiError):
 
95
    pass
 
96
 
 
97
 
 
98
class AvahiService(object):
 
99
    """
 
100
    interface: integer; avahi.IF_UNSPEC or an interface index.
 
101
               Used to optionally bind to the specified interface.
 
102
    name = string; Example: "Mandos"
 
103
    type = string; Example: "_mandos._tcp".
 
104
                   See <http://www.dns-sd.org/ServiceTypes.html>
 
105
    port = integer; what port to announce
 
106
    TXT = list of strings; TXT record for the service
 
107
    domain = string; Domain to publish on, default to .local if empty.
 
108
    host = string; Host to publish records for, default to localhost
 
109
                   if empty.
 
110
    max_renames = integer; maximum number of renames
 
111
    rename_count = integer; counter so we only rename after collisions
 
112
                   a sensible number of times
 
113
    """
 
114
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
 
115
                 type = None, port = None, TXT = None, domain = "",
 
116
                 host = "", max_renames = 12):
 
117
        """An Avahi (Zeroconf) service. """
 
118
        self.interface = interface
 
119
        self.name = name
 
120
        self.type = type
 
121
        self.port = port
 
122
        if TXT is None:
 
123
            self.TXT = []
 
124
        else:
 
125
            self.TXT = TXT
 
126
        self.domain = domain
 
127
        self.host = host
 
128
        self.rename_count = 0
 
129
    def rename(self):
 
130
        """Derived from the Avahi example code"""
 
131
        if self.rename_count >= self.max_renames:
 
132
            logger.critical(u"No suitable service name found after %i"
 
133
                            u" retries, exiting.", rename_count)
 
134
            raise AvahiServiceError("Too many renames")
 
135
        name = server.GetAlternativeServiceName(name)
 
136
        logger.notice(u"Changing name to %r ...", name)
 
137
        self.remove()
 
138
        self.add()
 
139
        self.rename_count += 1
 
140
    def remove(self):
 
141
        """Derived from the Avahi example code"""
 
142
        if group is not None:
 
143
            group.Reset()
 
144
    def add(self):
 
145
        """Derived from the Avahi example code"""
 
146
        global group
 
147
        if group is None:
 
148
            group = dbus.Interface\
 
149
                    (bus.get_object(avahi.DBUS_NAME,
 
150
                                    server.EntryGroupNew()),
 
151
                     avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
152
            group.connect_to_signal('StateChanged',
 
153
                                    entry_group_state_changed)
 
154
        logger.debug(u"Adding service '%s' of type '%s' ...",
 
155
                     service.name, service.type)
 
156
        group.AddService(
 
157
                self.interface,         # interface
 
158
                avahi.PROTO_INET6,      # protocol
 
159
                dbus.UInt32(0),         # flags
 
160
                self.name, self.type,
 
161
                self.domain, self.host,
 
162
                dbus.UInt16(self.port),
 
163
                avahi.string_array_to_txt_array(self.TXT))
 
164
        group.Commit()
 
165
 
89
166
# From the Avahi example code:
90
 
serviceName = None
91
 
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
92
 
servicePort = None                      # Not known at startup
93
 
serviceTXT = []                         # TXT record for the service
94
 
domain = ""                  # Domain to publish on, default to .local
95
 
host = ""          # Host to publish records for, default to localhost
96
 
group = None #our entry group
97
 
rename_count = 12       # Counter so we only rename after collisions a
98
 
                        # sensible number of times
 
167
group = None                            # our entry group
99
168
# End of Avahi example code
100
169
 
101
170
 
107
176
                 uniquely identify the client
108
177
    secret:    bytestring; sent verbatim (over TLS) to client
109
178
    fqdn:      string (FQDN); available for use by the checker command
110
 
    created:   datetime.datetime()
111
 
    last_seen: datetime.datetime() or None if not yet seen
112
 
    timeout:   datetime.timedelta(); How long from last_seen until
113
 
                                     this client is invalid
 
179
    created:   datetime.datetime(); object creation, not client host
 
180
    last_checked_ok: datetime.datetime() or None if not yet checked OK
 
181
    timeout:   datetime.timedelta(); How long from last_checked_ok
 
182
                                     until this client is invalid
114
183
    interval:  datetime.timedelta(); How often to start a new checker
115
184
    stop_hook: If set, called by stop() as stop_hook(self)
116
185
    checker:   subprocess.Popen(); a running checker process used
117
186
                                   to see if the client lives.
118
 
                                   Is None if no process is running.
 
187
                                   'None' if no process is running.
119
188
    checker_initiator_tag: a gobject event source tag, or None
120
189
    stop_initiator_tag:    - '' -
121
190
    checker_callback_tag:  - '' -
122
191
    checker_command: string; External command which is run to check if
123
 
                     client lives.  %()s expansions are done at
 
192
                     client lives.  %() expansions are done at
124
193
                     runtime with vars(self) as dict, so that for
125
194
                     instance %(name)s can be used in the command.
126
195
    Private attibutes:
127
196
    _timeout: Real variable for 'timeout'
128
197
    _interval: Real variable for 'interval'
129
 
    _timeout_milliseconds: Used by gobject.timeout_add()
 
198
    _timeout_milliseconds: Used when calling gobject.timeout_add()
130
199
    _interval_milliseconds: - '' -
131
200
    """
132
201
    def _set_timeout(self, timeout):
171
240
            self.secret = sf.read()
172
241
            sf.close()
173
242
        else:
174
 
            raise RuntimeError(u"No secret or secfile for client %s"
175
 
                               % self.name)
176
 
        self.fqdn = fqdn                # string
 
243
            raise TypeError(u"No secret or secfile for client %s"
 
244
                            % self.name)
 
245
        self.fqdn = fqdn
177
246
        self.created = datetime.datetime.now()
178
 
        self.last_seen = None
 
247
        self.last_checked_ok = None
179
248
        self.timeout = string_to_delta(timeout)
180
249
        self.interval = string_to_delta(interval)
181
250
        self.stop_hook = stop_hook
199
268
                                   self.stop)
200
269
    def stop(self):
201
270
        """Stop this client.
202
 
        The possibility that this client might be restarted is left
203
 
        open, but not currently used."""
 
271
        The possibility that a client might be restarted is left open,
 
272
        but not currently used."""
204
273
        # If this client doesn't have a secret, it is already stopped.
205
274
        if self.secret:
206
275
            logger.debug(u"Stopping client %s", self.name)
207
276
            self.secret = None
208
277
        else:
209
278
            return False
210
 
        if hasattr(self, "stop_initiator_tag") \
211
 
               and self.stop_initiator_tag:
 
279
        if getattr(self, "stop_initiator_tag", False):
212
280
            gobject.source_remove(self.stop_initiator_tag)
213
281
            self.stop_initiator_tag = None
214
 
        if hasattr(self, "checker_initiator_tag") \
215
 
               and self.checker_initiator_tag:
 
282
        if getattr(self, "checker_initiator_tag", False):
216
283
            gobject.source_remove(self.checker_initiator_tag)
217
284
            self.checker_initiator_tag = None
218
285
        self.stop_checker()
232
299
               and (os.WEXITSTATUS(condition) == 0):
233
300
            logger.debug(u"Checker for %(name)s succeeded",
234
301
                         vars(self))
235
 
            self.last_seen = now
 
302
            self.last_checked_ok = now
236
303
            gobject.source_remove(self.stop_initiator_tag)
237
304
            self.stop_initiator_tag = gobject.timeout_add\
238
305
                                      (self._timeout_milliseconds,
257
324
        # is as it should be.
258
325
        if self.checker is None:
259
326
            try:
 
327
                # In case check_command has exactly one % operator
260
328
                command = self.check_command % self.fqdn
261
329
            except TypeError:
 
330
                # Escape attributes for the shell
262
331
                escaped_attrs = dict((key, re.escape(str(val)))
263
332
                                     for key, val in
264
333
                                     vars(self).iteritems())
265
334
                try:
266
335
                    command = self.check_command % escaped_attrs
267
336
                except TypeError, error:
268
 
                    logger.critical(u'Could not format string "%s":'
269
 
                                    u' %s', self.check_command, error)
 
337
                    logger.error(u'Could not format string "%s":'
 
338
                                 u' %s', self.check_command, error)
270
339
                    return True # Try again later
271
340
            try:
272
341
                logger.debug(u"Starting checker %r for %s",
273
342
                             command, self.name)
274
 
                self.checker = subprocess.\
275
 
                               Popen(command,
276
 
                                     close_fds=True, shell=True,
277
 
                                     cwd="/")
 
343
                self.checker = subprocess.Popen(command,
 
344
                                                close_fds=True,
 
345
                                                shell=True, cwd="/")
278
346
                self.checker_callback_tag = gobject.child_watch_add\
279
347
                                            (self.checker.pid,
280
348
                                             self.checker_callback)
288
356
        if self.checker_callback_tag:
289
357
            gobject.source_remove(self.checker_callback_tag)
290
358
            self.checker_callback_tag = None
291
 
        if not hasattr(self, "checker") or self.checker is None:
 
359
        if getattr(self, "checker", None) is None:
292
360
            return
293
361
        logger.debug("Stopping checker for %(name)s", vars(self))
294
362
        try:
297
365
            #if self.checker.poll() is None:
298
366
            #    os.kill(self.checker.pid, signal.SIGKILL)
299
367
        except OSError, error:
300
 
            if error.errno != errno.ESRCH:
 
368
            if error.errno != errno.ESRCH: # No such process
301
369
                raise
302
370
        self.checker = None
303
 
    def still_valid(self, now=None):
 
371
    def still_valid(self):
304
372
        """Has the timeout not yet passed for this client?"""
305
 
        if now is None:
306
 
            now = datetime.datetime.now()
307
 
        if self.last_seen is None:
 
373
        now = datetime.datetime.now()
 
374
        if self.last_checked_ok is None:
308
375
            return now < (self.created + self.timeout)
309
376
        else:
310
 
            return now < (self.last_seen + self.timeout)
 
377
            return now < (self.last_checked_ok + self.timeout)
311
378
 
312
379
 
313
380
def peer_certificate(session):
366
433
    def handle(self):
367
434
        logger.debug(u"TCP connection from: %s",
368
435
                     unicode(self.client_address))
369
 
        session = gnutls.connection.ClientSession(self.request,
370
 
                                                  gnutls.connection.\
371
 
                                                  X509Credentials())
 
436
        session = gnutls.connection.ClientSession\
 
437
                  (self.request, gnutls.connection.X509Credentials())
 
438
        # Note: gnutls.connection.X509Credentials is really a generic
 
439
        # GnuTLS certificate credentials object so long as no X.509
 
440
        # keys are added to it.  Therefore, we can use it here despite
 
441
        # using OpenPGP certificates.
372
442
        
373
443
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
374
444
        #                "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
375
445
        #                "+DHE-DSS"))
376
 
        priority = "NORMAL"
377
 
        if self.server.options.priority:
378
 
            priority = self.server.options.priority
 
446
        priority = "NORMAL"             # Fallback default, since this
 
447
                                        # MUST be set.
 
448
        if self.server.settings["priority"]:
 
449
            priority = self.server.settings["priority"]
379
450
        gnutls.library.functions.gnutls_priority_set_direct\
380
451
            (session._c_object, priority, None);
381
452
        
398
469
            if c.fingerprint == fpr:
399
470
                client = c
400
471
                break
 
472
        if not client:
 
473
            logger.debug(u"Client not found for fingerprint: %s", fpr)
 
474
            session.bye()
 
475
            return
401
476
        # Have to check if client.still_valid(), since it is possible
402
477
        # that the client timed out while establishing the GnuTLS
403
478
        # session.
404
 
        if (not client) or (not client.still_valid()):
405
 
            if client:
406
 
                logger.debug(u"Client %(name)s is invalid",
407
 
                             vars(client))
408
 
            else:
409
 
                logger.debug(u"Client not found for fingerprint: %s",
410
 
                             fpr)
 
479
        if not client.still_valid():
 
480
            logger.debug(u"Client %(name)s is invalid", vars(client))
411
481
            session.bye()
412
482
            return
413
483
        sent_size = 0
423
493
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
424
494
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
425
495
    Attributes:
426
 
        options:        Command line options
 
496
        settings:       Server settings
427
497
        clients:        Set() of Client objects
428
498
    """
429
499
    address_family = socket.AF_INET6
430
500
    def __init__(self, *args, **kwargs):
431
 
        if "options" in kwargs:
432
 
            self.options = kwargs["options"]
433
 
            del kwargs["options"]
 
501
        if "settings" in kwargs:
 
502
            self.settings = kwargs["settings"]
 
503
            del kwargs["settings"]
434
504
        if "clients" in kwargs:
435
505
            self.clients = kwargs["clients"]
436
506
            del kwargs["clients"]
439
509
        """This overrides the normal server_bind() function
440
510
        to bind to an interface if one was specified, and also NOT to
441
511
        bind to an address or port if they were not specified."""
442
 
        if self.options.interface:
443
 
            if not hasattr(socket, "SO_BINDTODEVICE"):
444
 
                # From /usr/include/asm-i486/socket.h
445
 
                socket.SO_BINDTODEVICE = 25
 
512
        if self.settings["interface"] != avahi.IF_UNSPEC:
 
513
            # 25 is from /usr/include/asm-i486/socket.h
 
514
            SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
446
515
            try:
447
516
                self.socket.setsockopt(socket.SOL_SOCKET,
448
 
                                       socket.SO_BINDTODEVICE,
449
 
                                       self.options.interface)
 
517
                                       SO_BINDTODEVICE,
 
518
                                       self.settings["interface"])
450
519
            except socket.error, error:
451
520
                if error[0] == errno.EPERM:
452
521
                    logger.warning(u"No permission to"
453
522
                                   u" bind to interface %s",
454
 
                                   self.options.interface)
 
523
                                   self.settings["interface"])
455
524
                else:
456
525
                    raise error
457
526
        # Only bind(2) the socket if we really need to.
500
569
    return delta
501
570
 
502
571
 
503
 
def add_service():
504
 
    """Derived from the Avahi example code"""
505
 
    global group, serviceName, serviceType, servicePort, serviceTXT, \
506
 
           domain, host
507
 
    if group is None:
508
 
        group = dbus.Interface(
509
 
                bus.get_object( avahi.DBUS_NAME,
510
 
                                server.EntryGroupNew()),
511
 
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
512
 
        group.connect_to_signal('StateChanged',
513
 
                                entry_group_state_changed)
514
 
    logger.debug(u"Adding service '%s' of type '%s' ...",
515
 
                 serviceName, serviceType)
516
 
    
517
 
    group.AddService(
518
 
            serviceInterface,           # interface
519
 
            avahi.PROTO_INET6,          # protocol
520
 
            dbus.UInt32(0),             # flags
521
 
            serviceName, serviceType,
522
 
            domain, host,
523
 
            dbus.UInt16(servicePort),
524
 
            avahi.string_array_to_txt_array(serviceTXT))
525
 
    group.Commit()
526
 
 
527
 
 
528
 
def remove_service():
529
 
    """From the Avahi example code"""
530
 
    global group
531
 
    
532
 
    if not group is None:
533
 
        group.Reset()
534
 
 
535
 
 
536
572
def server_state_changed(state):
537
573
    """Derived from the Avahi example code"""
538
574
    if state == avahi.SERVER_COLLISION:
539
575
        logger.warning(u"Server name collision")
540
 
        remove_service()
 
576
        service.remove()
541
577
    elif state == avahi.SERVER_RUNNING:
542
 
        add_service()
 
578
        service.add()
543
579
 
544
580
 
545
581
def entry_group_state_changed(state, error):
546
582
    """Derived from the Avahi example code"""
547
 
    global serviceName, server, rename_count
548
 
    
549
583
    logger.debug(u"state change: %i", state)
550
584
    
551
585
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
552
586
        logger.debug(u"Service established.")
553
587
    elif state == avahi.ENTRY_GROUP_COLLISION:
554
 
        
555
 
        rename_count = rename_count - 1
556
 
        if rename_count > 0:
557
 
            name = server.GetAlternativeServiceName(name)
558
 
            logger.warning(u"Service name collision, "
559
 
                           u"changing name to '%s' ...", name)
560
 
            remove_service()
561
 
            add_service()
562
 
            
563
 
        else:
564
 
            logger.error(u"No suitable service name found after %i"
565
 
                         u" retries, exiting.", n_rename)
566
 
            killme(1)
 
588
        logger.warning(u"Service name collision.")
 
589
        service.rename()
567
590
    elif state == avahi.ENTRY_GROUP_FAILURE:
568
 
        logger.error(u"Error in group state changed %s",
569
 
                     unicode(error))
570
 
        killme(1)
571
 
 
572
 
 
573
 
def if_nametoindex(interface):
574
 
    """Call the C function if_nametoindex()"""
 
591
        logger.critical(u"Error in group state changed %s",
 
592
                        unicode(error))
 
593
        raise AvahiGroupError("State changed: %s", str(error))
 
594
 
 
595
def if_nametoindex(interface, _func=[None]):
 
596
    """Call the C function if_nametoindex(), or equivalent"""
 
597
    if _func[0] is not None:
 
598
        return _func[0](interface)
575
599
    try:
576
 
        libc = ctypes.cdll.LoadLibrary("libc.so.6")
577
 
        return libc.if_nametoindex(interface)
 
600
        if "ctypes.util" not in sys.modules:
 
601
            import ctypes.util
 
602
        while True:
 
603
            try:
 
604
                libc = ctypes.cdll.LoadLibrary\
 
605
                       (ctypes.util.find_library("c"))
 
606
                func[0] = libc.if_nametoindex
 
607
                return _func[0](interface)
 
608
            except IOError, e:
 
609
                if e != errno.EINTR:
 
610
                    raise
578
611
    except (OSError, AttributeError):
579
612
        if "struct" not in sys.modules:
580
613
            import struct
581
614
        if "fcntl" not in sys.modules:
582
615
            import fcntl
583
 
        SIOCGIFINDEX = 0x8933      # From /usr/include/linux/sockios.h
584
 
        s = socket.socket()
585
 
        ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
586
 
                            struct.pack("16s16x", interface))
587
 
        s.close()
588
 
        interface_index = struct.unpack("I", ifreq[16:20])[0]
589
 
        return interface_index
 
616
        def the_hard_way(interface):
 
617
            "Get an interface index the hard way, i.e. using fcntl()"
 
618
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
619
            s = socket.socket()
 
620
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
621
                                struct.pack("16s16x", interface))
 
622
            s.close()
 
623
            interface_index = struct.unpack("I", ifreq[16:20])[0]
 
624
            return interface_index
 
625
        _func[0] = the_hard_way
 
626
        return _func[0](interface)
590
627
 
591
628
 
592
629
def daemon(nochdir, noclose):
599
636
        os.chdir("/")
600
637
    if not noclose:
601
638
        # Close all standard open file descriptors
602
 
        null = os.open("/dev/null", os.O_NOCTTY | os.O_RDWR)
 
639
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
603
640
        if not stat.S_ISCHR(os.fstat(null).st_mode):
604
641
            raise OSError(errno.ENODEV,
605
642
                          "/dev/null not a character device")
610
647
            os.close(null)
611
648
 
612
649
 
613
 
def killme(status = 0):
614
 
    logger.debug("Stopping server with exit status %d", status)
615
 
    exitstatus = status
616
 
    if main_loop_started:
617
 
        main_loop.quit()
618
 
    else:
619
 
        sys.exit(status)
620
 
 
621
 
 
622
650
def main():
623
 
    global exitstatus
624
 
    exitstatus = 0
625
651
    global main_loop_started
626
652
    main_loop_started = False
627
653
    
628
654
    parser = OptionParser()
629
655
    parser.add_option("-i", "--interface", type="string",
630
 
                      default=None, metavar="IF",
631
 
                      help="Bind to interface IF")
632
 
    parser.add_option("-a", "--address", type="string", default=None,
 
656
                      metavar="IF", help="Bind to interface IF")
 
657
    parser.add_option("-a", "--address", type="string",
633
658
                      help="Address to listen for requests on")
634
 
    parser.add_option("-p", "--port", type="int", default=None,
 
659
    parser.add_option("-p", "--port", type="int",
635
660
                      help="Port number to receive requests on")
636
661
    parser.add_option("--check", action="store_true", default=False,
637
662
                      help="Run self-test")
638
663
    parser.add_option("--debug", action="store_true", default=False,
639
 
                      help="Debug mode")
640
 
    parser.add_option("--priority", type="string",
641
 
                      default="SECURE256",
642
 
                      help="GnuTLS priority string"
643
 
                      " (see GnuTLS documentation)")
644
 
    parser.add_option("--servicename", type="string",
645
 
                      default="Mandos", help="Zeroconf service name")
 
664
                      help="Debug mode; run in foreground and log to"
 
665
                      " terminal")
 
666
    parser.add_option("--priority", type="string", help="GnuTLS"
 
667
                      " priority string (see GnuTLS documentation)")
 
668
    parser.add_option("--servicename", type="string", metavar="NAME",
 
669
                      help="Zeroconf service name")
 
670
    parser.add_option("--configdir", type="string",
 
671
                      default="/etc/mandos", metavar="DIR",
 
672
                      help="Directory to search for configuration"
 
673
                      " files")
646
674
    (options, args) = parser.parse_args()
647
675
    
648
676
    if options.check:
650
678
        doctest.testmod()
651
679
        sys.exit()
652
680
    
653
 
    # Parse config file
654
 
    defaults = { "timeout": "1h",
655
 
                 "interval": "5m",
656
 
                 "checker": "fping -q -- %%(fqdn)s",
657
 
                 }
658
 
    client_config = ConfigParser.SafeConfigParser(defaults)
659
 
    #client_config.readfp(open("global.conf"), "global.conf")
660
 
    client_config.read("mandos-clients.conf")
661
 
    
662
 
    global serviceName
663
 
    serviceName = options.servicename;
 
681
    # Default values for config file for server-global settings
 
682
    server_defaults = { "interface": "",
 
683
                        "address": "",
 
684
                        "port": "",
 
685
                        "debug": "False",
 
686
                        "priority":
 
687
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
688
                        "servicename": "Mandos",
 
689
                        }
 
690
    
 
691
    # Parse config file for server-global settings
 
692
    server_config = ConfigParser.SafeConfigParser(server_defaults)
 
693
    del server_defaults
 
694
    server_config.read(os.path.join(options.configdir, "server.conf"))
 
695
    server_section = "server"
 
696
    # Convert the SafeConfigParser object to a dict
 
697
    server_settings = dict(server_config.items(server_section))
 
698
    # Use getboolean on the boolean config option
 
699
    server_settings["debug"] = server_config.getboolean\
 
700
                               (server_section, "debug")
 
701
    del server_config
 
702
    if not server_settings["interface"]:
 
703
        server_settings["interface"] = avahi.IF_UNSPEC
 
704
    
 
705
    # Override the settings from the config file with command line
 
706
    # options, if set.
 
707
    for option in ("interface", "address", "port", "debug",
 
708
                   "priority", "servicename", "configdir"):
 
709
        value = getattr(options, option)
 
710
        if value is not None:
 
711
            server_settings[option] = value
 
712
    del options
 
713
    # Now we have our good server settings in "server_settings"
 
714
    
 
715
    # Parse config file with clients
 
716
    client_defaults = { "timeout": "1h",
 
717
                        "interval": "5m",
 
718
                        "checker": "fping -q -- %%(fqdn)s",
 
719
                        }
 
720
    client_config = ConfigParser.SafeConfigParser(client_defaults)
 
721
    client_config.read(os.path.join(server_settings["configdir"],
 
722
                                    "clients.conf"))
 
723
    
 
724
    global service
 
725
    service = AvahiService(name = server_settings["servicename"],
 
726
                           type = "_mandos._tcp", );
664
727
    
665
728
    global main_loop
666
729
    global bus
674
737
            avahi.DBUS_INTERFACE_SERVER )
675
738
    # End of Avahi example code
676
739
    
677
 
    debug = options.debug
 
740
    debug = server_settings["debug"]
678
741
    
679
742
    if debug:
680
743
        console = logging.StreamHandler()
689
752
        clients.remove(client)
690
753
        if not clients:
691
754
            logger.debug(u"No clients left, exiting")
692
 
            killme()
 
755
            sys.exit()
693
756
    
694
757
    clients.update(Set(Client(name=section,
695
758
                              stop_hook = remove_from_clients,
718
781
    
719
782
    if not debug:
720
783
        signal.signal(signal.SIGINT, signal.SIG_IGN)
721
 
    signal.signal(signal.SIGHUP, lambda signum, frame: killme())
722
 
    signal.signal(signal.SIGTERM, lambda signum, frame: killme())
 
784
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
 
785
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
723
786
    
724
787
    for client in clients:
725
788
        client.start()
726
789
    
727
 
    tcp_server = IPv6_TCPServer((options.address, options.port),
 
790
    tcp_server = IPv6_TCPServer((server_settings["address"],
 
791
                                 server_settings["port"]),
728
792
                                tcp_handler,
729
 
                                options=options,
 
793
                                settings=server_settings,
730
794
                                clients=clients)
731
 
    # Find out what random port we got
732
 
    global servicePort
733
 
    servicePort = tcp_server.socket.getsockname()[1]
734
 
    logger.debug(u"Now listening on port %d", servicePort)
735
 
    
736
 
    if options.interface is not None:
737
 
        global serviceInterface
738
 
        serviceInterface = if_nametoindex(options.interface)
739
 
    
740
 
    # From the Avahi example code
741
 
    server.connect_to_signal("StateChanged", server_state_changed)
742
 
    try:
743
 
        server_state_changed(server.GetState())
744
 
    except dbus.exceptions.DBusException, error:
745
 
        logger.critical(u"DBusException: %s", error)
746
 
        killme(1)
747
 
    # End of Avahi example code
748
 
    
749
 
    gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
750
 
                         lambda *args, **kwargs:
751
 
                         tcp_server.handle_request(*args[2:],
752
 
                                                   **kwargs) or True)
753
 
    try:
 
795
    # Find out what port we got
 
796
    service.port = tcp_server.socket.getsockname()[1]
 
797
    logger.debug(u"Now listening on port %d", service.port)
 
798
    
 
799
    if not server_settings["interface"]:
 
800
        service.interface = if_nametoindex\
 
801
                            (server_settings["interface"])
 
802
    
 
803
    try:
 
804
        # From the Avahi example code
 
805
        server.connect_to_signal("StateChanged", server_state_changed)
 
806
        try:
 
807
            server_state_changed(server.GetState())
 
808
        except dbus.exceptions.DBusException, error:
 
809
            logger.critical(u"DBusException: %s", error)
 
810
            sys.exit(1)
 
811
        # End of Avahi example code
 
812
        
 
813
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
 
814
                             lambda *args, **kwargs:
 
815
                             tcp_server.handle_request\
 
816
                             (*args[2:], **kwargs) or True)
 
817
        
754
818
        logger.debug("Starting main loop")
755
819
        main_loop_started = True
756
820
        main_loop.run()
 
821
    except AvahiError, error:
 
822
        logger.critical(u"AvahiError: %s" + unicode(error))
 
823
        sys.exit(1)
757
824
    except KeyboardInterrupt:
758
825
        if debug:
759
826
            print
760
 
    
761
 
    sys.exit(exitstatus)
762
827
 
763
828
if __name__ == '__main__':
764
829
    main()