/mandos/trunk : revision 44

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# following functions: "AvahiService.add", "AvahiService.remove",

10

# "server_state_changed", "entry_group_state_changed", and some lines

11

# in "main".

12

#

13

# Everything else is

14

15

#

16

# This program is free software: you can redistribute it and/or modify

17

# it under the terms of the GNU General Public License as published by

18

# the Free Software Foundation, either version 3 of the License, or

19

# (at your option) any later version.

20

#

21

# This program is distributed in the hope that it will be useful,

22

# but WITHOUT ANY WARRANTY; without even the implied warranty of

23

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

24

# GNU General Public License for more details.

25

#

26

# You should have received a copy of the GNU General Public License

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

28

#

29

# Contact the authors at <mandos@fukt.bsnet.se>.

30

#

3

31

4

32

from __future__ import division

5

33

24

52

import subprocess

25

53

import atexit

26

54

import stat

55

import logging

56

import logging.handlers

27

57

28

58

import dbus

29

59

import gobject

31

61

from dbus.mainloop.glib import DBusGMainLoop

32

62

import ctypes

33

63

34

import logging

35

import logging.handlers

64

# Brief description of the operation of this program:

65

#

66

# This server announces itself as a Zeroconf service. Connecting

67

# clients use the TLS protocol, with the unusual quirk that this

68

# server program acts as a TLS "client" while a connecting client acts

69

# as a TLS "server". The client (acting as a TLS "server") must

70

# supply an OpenPGP certificate, and the fingerprint of this

71

# certificate is used by this server to look up (in a list read from a

72

# file at start time) which binary blob to give the client. No other

73

# authentication or authorization is done by this server.

74

36

75

37

76

logger = logging.Logger('mandos')

38

77

syslogger = logging.handlers.SysLogHandler\

42

81

logger.addHandler(syslogger)

43

82

del syslogger

44

83

45

# This variable is used to optionally bind to a specified interface.

46

# It is a global variable to fit in with the other variables from the

47

# Avahi server example code.

48

serviceInterface = avahi.IF_UNSPEC

49

# From the Avahi server example code:

50

serviceName = "Mandos"

51

serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html

52

servicePort = None # Not known at startup

53

serviceTXT = [] # TXT record for the service

54

domain = "" # Domain to publish on, default to .local

55

host = "" # Host to publish records for, default to localhost

56

group = None #our entry group

57

rename_count = 12 # Counter so we only rename after collisions a

58

# sensible number of times

84

85

class AvahiError(Exception):

86

def __init__(self, value):

87

self.value = value

88

def __str__(self):

89

return repr(self.value)

90

91

class AvahiServiceError(AvahiError):

92

pass

93

94

class AvahiGroupError(AvahiError):

95

pass

96

97

98

class AvahiService(object):

99

"""

100

interface: integer; avahi.IF_UNSPEC or an interface index.

101

Used to optionally bind to the specified interface.

102

name = string; Example: "Mandos"

103

type = string; Example: "_mandos._tcp".

104

See <http://www.dns-sd.org/ServiceTypes.html>

105

port = integer; what port to announce

106

TXT = list of strings; TXT record for the service

107

domain = string; Domain to publish on, default to .local if empty.

108

host = string; Host to publish records for, default to localhost

109

if empty.

110

max_renames = integer; maximum number of renames

111

rename_count = integer; counter so we only rename after collisions

112

a sensible number of times

113

"""

114

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

115

type = None, port = None, TXT = None, domain = "",

116

host = "", max_renames = 12):

117

"""An Avahi (Zeroconf) service. """

118

self.interface = interface

119

self.name = name

120

self.type = type

121

self.port = port

122

if TXT is None:

123

self.TXT = []

124

else:

125

self.TXT = TXT

126

self.domain = domain

127

self.host = host

128

self.rename_count = 0

129

def rename(self):

130

"""Derived from the Avahi example code"""

131

if self.rename_count >= self.max_renames:

132

logger.critical(u"No suitable service name found after %i"

133

u" retries, exiting.", rename_count)

134

raise AvahiServiceError("Too many renames")

135

name = server.GetAlternativeServiceName(name)

136

logger.error(u"Changing name to %r ...", name)

137

self.remove()

138

self.add()

139

self.rename_count += 1

140

def remove(self):

141

"""Derived from the Avahi example code"""

142

if group is not None:

143

group.Reset()

144

def add(self):

145

"""Derived from the Avahi example code"""

146

global group

147

if group is None:

148

group = dbus.Interface\

149

(bus.get_object(avahi.DBUS_NAME,

150

server.EntryGroupNew()),

151

avahi.DBUS_INTERFACE_ENTRY_GROUP)

152

group.connect_to_signal('StateChanged',

153

entry_group_state_changed)

154

logger.debug(u"Adding service '%s' of type '%s' ...",

155

service.name, service.type)

156

group.AddService(

157

self.interface, # interface

158

avahi.PROTO_INET6, # protocol

159

dbus.UInt32(0), # flags

160

self.name, self.type,

161

self.domain, self.host,

162

dbus.UInt16(self.port),

163

avahi.string_array_to_txt_array(self.TXT))

164

group.Commit()

165

166

# From the Avahi example code:

167

group = None # our entry group

59

168

# End of Avahi example code

60

169

61

170

67

176

uniquely identify the client

68

177

secret: bytestring; sent verbatim (over TLS) to client

69

178

fqdn: string (FQDN); available for use by the checker command

70

created: datetime.datetime()

71

last_seen: datetime.datetime() or None if not yet seen

72

timeout: datetime.timedelta(); How long from last_seen until

73

this client is invalid

179

created: datetime.datetime(); object creation, not client host

180

last_checked_ok: datetime.datetime() or None if not yet checked OK

181

timeout: datetime.timedelta(); How long from last_checked_ok

182

until this client is invalid

74

183

interval: datetime.timedelta(); How often to start a new checker

75

184

stop_hook: If set, called by stop() as stop_hook(self)

76

185

checker: subprocess.Popen(); a running checker process used

77

186

to see if the client lives.

78

Is None if no process is running.

187

'None' if no process is running.

79

188

checker_initiator_tag: a gobject event source tag, or None

80

189

stop_initiator_tag: - '' -

81

190

checker_callback_tag: - '' -

82

191

checker_command: string; External command which is run to check if

83

client lives. %()s expansions are done at

192

client lives. %() expansions are done at

84

193

runtime with vars(self) as dict, so that for

85

194

instance %(name)s can be used in the command.

86

195

Private attibutes:

87

196

_timeout: Real variable for 'timeout'

88

197

_interval: Real variable for 'interval'

89

_timeout_milliseconds: Used by gobject.timeout_add()

198

_timeout_milliseconds: Used when calling gobject.timeout_add()

90

199

_interval_milliseconds: - '' -

91

200

"""

92

201

def _set_timeout(self, timeout):

112

221

interval = property(lambda self: self._interval,

113

222

_set_interval)

114

223

del _set_interval

115

def __init__(self, name=None, options=None, stop_hook=None,

116

fingerprint=None, secret=None, secfile=None,

117

fqdn=None, timeout=None, interval=-1, checker=None):

224

def __init__(self, name = None, stop_hook=None, config={}):

225

"""Note: the 'checker' argument sets the 'checker_command'

226

attribute and not the 'checker' attribute.."""

118

227

self.name = name

228

logger.debug(u"Creating client %r", self.name)

119

229

# Uppercase and remove spaces from fingerprint

120

230

# for later comparison purposes with return value of

121

231

# the fingerprint() function

122

self.fingerprint = fingerprint.upper().replace(u" ", u"")

123

if secret:

124

self.secret = secret.decode(u"base64")

125

elif secfile:

126

sf = open(secfile)

232

self.fingerprint = config["fingerprint"].upper()\

233

.replace(u" ", u"")

234

logger.debug(u" Fingerprint: %s", self.fingerprint)

235

if "secret" in config:

236

self.secret = config["secret"].decode(u"base64")

237

elif "secfile" in config:

238

sf = open(config["secfile"])

127

239

self.secret = sf.read()

128

240

sf.close()

129

241

else:

130

raise RuntimeError(u"No secret or secfile for client %s"

131

% self.name)

132

self.fqdn = fqdn # string

242

raise TypeError(u"No secret or secfile for client %s"

243

% self.name)

244

self.fqdn = config.get("fqdn", "")

133

245

self.created = datetime.datetime.now()

134

self.last_seen = None

135

if timeout is None:

136

self.timeout = options.timeout

137

else:

138

self.timeout = string_to_delta(timeout)

139

if interval == -1:

140

self.interval = options.interval

141

else:

142

self.interval = string_to_delta(interval)

246

self.last_checked_ok = None

247

self.timeout = string_to_delta(config["timeout"])

248

self.interval = string_to_delta(config["interval"])

143

249

self.stop_hook = stop_hook

144

250

self.checker = None

145

251

self.checker_initiator_tag = None

146

252

self.stop_initiator_tag = None

147

253

self.checker_callback_tag = None

148

self.check_command = checker

254

self.check_command = config["checker"]

149

255

def start(self):

150

"""Start this clients checker and timeout hooks"""

256

"""Start this client's checker and timeout hooks"""

151

257

# Schedule a new checker to be started an 'interval' from now,

152

258

# and every interval from then on.

153

259

self.checker_initiator_tag = gobject.timeout_add\

161

267

self.stop)

162

268

def stop(self):

163

269

"""Stop this client.

164

The possibility that this client might be restarted is left

165

open, but not currently used."""

166

logger.debug(u"Stopping client %s", self.name)

167

self.secret = None

168

if self.stop_initiator_tag:

270

The possibility that a client might be restarted is left open,

271

but not currently used."""

272

# If this client doesn't have a secret, it is already stopped.

273

if self.secret:

274

logger.info(u"Stopping client %s", self.name)

275

self.secret = None

276

else:

277

return False

278

if getattr(self, "stop_initiator_tag", False):

169

279

gobject.source_remove(self.stop_initiator_tag)

170

280

self.stop_initiator_tag = None

171

if self.checker_initiator_tag:

281

if getattr(self, "checker_initiator_tag", False):

172

282

gobject.source_remove(self.checker_initiator_tag)

173

283

self.checker_initiator_tag = None

174

284

self.stop_checker()

177

287

# Do not run this again if called by a gobject.timeout_add

178

288

return False

179

289

def __del__(self):

180

# Some code duplication here and in stop()

181

if hasattr(self, "stop_initiator_tag") \

182

and self.stop_initiator_tag:

183

gobject.source_remove(self.stop_initiator_tag)

184

self.stop_initiator_tag = None

185

if hasattr(self, "checker_initiator_tag") \

186

and self.checker_initiator_tag:

187

gobject.source_remove(self.checker_initiator_tag)

188

self.checker_initiator_tag = None

189

self.stop_checker()

290

self.stop_hook = None

291

self.stop()

190

292

def checker_callback(self, pid, condition):

191

293

"""The checker has completed, so take appropriate actions."""

192

294

now = datetime.datetime.now()

295

self.checker_callback_tag = None

296

self.checker = None

193

297

if os.WIFEXITED(condition) \

194

298

and (os.WEXITSTATUS(condition) == 0):

195

logger.debug(u"Checker for %(name)s succeeded",

196

vars(self))

197

self.last_seen = now

299

logger.info(u"Checker for %(name)s succeeded",

300

vars(self))

301

self.last_checked_ok = now

198

302

gobject.source_remove(self.stop_initiator_tag)

199

303

self.stop_initiator_tag = gobject.timeout_add\

200

304

(self._timeout_milliseconds,

203

307

logger.warning(u"Checker for %(name)s crashed?",

204

308

vars(self))

205

309

else:

206

logger.debug(u"Checker for %(name)s failed",

207

vars(self))

208

self.checker = None

209

self.checker_callback_tag = None

310

logger.info(u"Checker for %(name)s failed",

311

vars(self))

210

312

def start_checker(self):

211

313

"""Start a new checker subprocess if one is not running.

212

314

If a checker already exists, leave it running and do

213

315

nothing."""

316

# The reason for not killing a running checker is that if we

317

# did that, then if a checker (for some reason) started

318

# running slowly and taking more than 'interval' time, the

319

# client would inevitably timeout, since no checker would get

320

# a chance to run to completion. If we instead leave running

321

# checkers alone, the checker would have to take more time

322

# than 'timeout' for the client to be declared invalid, which

323

# is as it should be.

214

324

if self.checker is None:

215

325

try:

326

# In case check_command has exactly one % operator

216

327

command = self.check_command % self.fqdn

217

328

except TypeError:

329

# Escape attributes for the shell

218

330

escaped_attrs = dict((key, re.escape(str(val)))

219

331

for key, val in

220

332

vars(self).iteritems())

221

333

try:

222

334

command = self.check_command % escaped_attrs

223

335

except TypeError, error:

224

logger.critical(u'Could not format string "%s":'

225

u' %s', self.check_command, error)

336

logger.error(u'Could not format string "%s":'

337

u' %s', self.check_command, error)

226

338

return True # Try again later

227

339

try:

228

logger.debug(u"Starting checker %r for %s",

229

command, self.name)

230

self.checker = subprocess.\

231

Popen(command,

232

close_fds=True, shell=True,

233

cwd="/")

340

logger.info(u"Starting checker %r for %s",

341

command, self.name)

342

self.checker = subprocess.Popen(command,

343

close_fds=True,

344

shell=True, cwd="/")

234

345

self.checker_callback_tag = gobject.child_watch_add\

235

346

(self.checker.pid,

236

347

self.checker_callback)

241

352

return True

242

353

def stop_checker(self):

243

354

"""Force the checker process, if any, to stop."""

244

if not hasattr(self, "checker") or self.checker is None:

355

if self.checker_callback_tag:

356

gobject.source_remove(self.checker_callback_tag)

357

self.checker_callback_tag = None

358

if getattr(self, "checker", None) is None:

245

359

return

246

gobject.source_remove(self.checker_callback_tag)

247

self.checker_callback_tag = None

248

os.kill(self.checker.pid, signal.SIGTERM)

249

if self.checker.poll() is None:

250

os.kill(self.checker.pid, signal.SIGKILL)

360

logger.debug("Stopping checker for %(name)s", vars(self))

361

try:

362

os.kill(self.checker.pid, signal.SIGTERM)

363

#os.sleep(0.5)

364

#if self.checker.poll() is None:

365

# os.kill(self.checker.pid, signal.SIGKILL)

366

except OSError, error:

367

if error.errno != errno.ESRCH: # No such process

368

raise

251

369

self.checker = None

252

def still_valid(self, now=None):

370

def still_valid(self):

253

371

"""Has the timeout not yet passed for this client?"""

254

if now is None:

255

now = datetime.datetime.now()

256

if self.last_seen is None:

372

now = datetime.datetime.now()

373

if self.last_checked_ok is None:

257

374

return now < (self.created + self.timeout)

258

375

else:

259

return now < (self.last_seen + self.timeout)

376

return now < (self.last_checked_ok + self.timeout)

260

377

261

378

262

379

def peer_certificate(session):

263

"Return an OpenPGP data packet string for the peer's certificate"

380

"Return the peer's OpenPGP certificate as a bytestring"

264

381

# If not an OpenPGP certificate...

265

382

if gnutls.library.functions.gnutls_certificate_type_get\

266

383

(session._c_object) \

277

394

278

395

279

396

def fingerprint(openpgp):

280

"Convert an OpenPGP data string to a hexdigit fingerprint string"

397

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

281

398

# New empty GnuTLS certificate

282

399

crt = gnutls.library.types.gnutls_openpgp_crt_t()

283

400

gnutls.library.functions.gnutls_openpgp_crt_init\

313

430

Note: This will run in its own forked process."""

314

431

315

432

def handle(self):

316

logger.debug(u"TCP connection from: %s",

433

logger.info(u"TCP connection from: %s",

317

434

unicode(self.client_address))

318

session = gnutls.connection.ClientSession(self.request,

319

gnutls.connection.\

320

X509Credentials())

435

session = gnutls.connection.ClientSession\

436

(self.request, gnutls.connection.X509Credentials())

437

438

line = self.request.makefile().readline()

439

logger.debug(u"Protocol version: %r", line)

440

try:

441

if int(line.strip().split()[0]) > 1:

442

raise RuntimeError

443

except (ValueError, IndexError, RuntimeError), error:

444

logger.error(u"Unknown protocol version: %s", error)

445

return

446

447

# Note: gnutls.connection.X509Credentials is really a generic

448

# GnuTLS certificate credentials object so long as no X.509

449

# keys are added to it. Therefore, we can use it here despite

450

# using OpenPGP certificates.

321

451

322

452

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

323

453

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

324

454

# "+DHE-DSS"))

325

priority = "SECURE256"

326

455

priority = "NORMAL" # Fallback default, since this

456

# MUST be set.

457

if self.server.settings["priority"]:

458

priority = self.server.settings["priority"]

327

459

gnutls.library.functions.gnutls_priority_set_direct\

328

460

(session._c_object, priority, None);

329

461

330

462

try:

331

463

session.handshake()

332

464

except gnutls.errors.GNUTLSError, error:

333

logger.debug(u"Handshake failed: %s", error)

465

logger.warning(u"Handshake failed: %s", error)

334

466

# Do not run session.bye() here: the session is not

335

467

# established. Just abandon the request.

336

468

return

337

469

try:

338

470

fpr = fingerprint(peer_certificate(session))

339

471

except (TypeError, gnutls.errors.GNUTLSError), error:

340

logger.debug(u"Bad certificate: %s", error)

472

logger.warning(u"Bad certificate: %s", error)

341

473

session.bye()

342

474

return

343

475

logger.debug(u"Fingerprint: %s", fpr)

344

476

client = None

345

for c in clients:

477

for c in self.server.clients:

346

478

if c.fingerprint == fpr:

347

479

client = c

348

480

break

481

if not client:

482

logger.warning(u"Client not found for fingerprint: %s",

483

fpr)

484

session.bye()

485

return

349

486

# Have to check if client.still_valid(), since it is possible

350

487

# that the client timed out while establishing the GnuTLS

351

488

# session.

352

if (not client) or (not client.still_valid()):

353

if client:

354

logger.debug(u"Client %(name)s is invalid",

355

vars(client))

356

else:

357

logger.debug(u"Client not found for fingerprint: %s",

358

fpr)

489

if not client.still_valid():

490

logger.warning(u"Client %(name)s is invalid",

491

vars(client))

359

492

session.bye()

360

493

return

361

494

sent_size = 0

371

504

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

372

505

"""IPv6 TCP server. Accepts 'None' as address and/or port.

373

506

Attributes:

374

options: Command line options

507

settings: Server settings

375

508

clients: Set() of Client objects

376

509

"""

377

510

address_family = socket.AF_INET6

378

511

def __init__(self, *args, **kwargs):

379

if "options" in kwargs:

380

self.options = kwargs["options"]

381

del kwargs["options"]

512

if "settings" in kwargs:

513

self.settings = kwargs["settings"]

514

del kwargs["settings"]

382

515

if "clients" in kwargs:

383

516

self.clients = kwargs["clients"]

384

517

del kwargs["clients"]

387

520

"""This overrides the normal server_bind() function

388

521

to bind to an interface if one was specified, and also NOT to

389

522

bind to an address or port if they were not specified."""

390

if self.options.interface:

391

if not hasattr(socket, "SO_BINDTODEVICE"):

392

# From /usr/include/asm-i486/socket.h

393

socket.SO_BINDTODEVICE = 25

523

if self.settings["interface"]:

524

# 25 is from /usr/include/asm-i486/socket.h

525

SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)

394

526

try:

395

527

self.socket.setsockopt(socket.SOL_SOCKET,

396

socket.SO_BINDTODEVICE,

397

self.options.interface)

528

SO_BINDTODEVICE,

529

self.settings["interface"])

398

530

except socket.error, error:

399

531

if error[0] == errno.EPERM:

400

logger.warning(u"No permission to"

401

u" bind to interface %s",

402

self.options.interface)

532

logger.error(u"No permission to"

533

u" bind to interface %s",

534

self.settings["interface"])

403

535

else:

404

536

raise error

405

537

# Only bind(2) the socket if we really need to.

448

580

return delta

449

581

450

582

451

def add_service():

452

"""From the Avahi server example code"""

453

global group, serviceName, serviceType, servicePort, serviceTXT, \

454

domain, host

455

if group is None:

456

group = dbus.Interface(

457

bus.get_object( avahi.DBUS_NAME,

458

server.EntryGroupNew()),

459

avahi.DBUS_INTERFACE_ENTRY_GROUP)

460

group.connect_to_signal('StateChanged',

461

entry_group_state_changed)

462

logger.debug(u"Adding service '%s' of type '%s' ...",

463

serviceName, serviceType)

464

465

group.AddService(

466

serviceInterface, # interface

467

avahi.PROTO_INET6, # protocol

468

dbus.UInt32(0), # flags

469

serviceName, serviceType,

470

domain, host,

471

dbus.UInt16(servicePort),

472

avahi.string_array_to_txt_array(serviceTXT))

473

group.Commit()

474

475

476

def remove_service():

477

"""From the Avahi server example code"""

478

global group

479

480

if not group is None:

481

group.Reset()

482

483

484

583

def server_state_changed(state):

485

"""From the Avahi server example code"""

584

"""Derived from the Avahi example code"""

486

585

if state == avahi.SERVER_COLLISION:

487

logger.warning(u"Server name collision")

488

remove_service()

586

logger.error(u"Server name collision")

587

service.remove()

489

588

elif state == avahi.SERVER_RUNNING:

490

add_service()

589

service.add()

491

590

492

591

493

592

def entry_group_state_changed(state, error):

494

"""From the Avahi server example code"""

495

global serviceName, server, rename_count

496

593

"""Derived from the Avahi example code"""

497

594

logger.debug(u"state change: %i", state)

498

595

499

596

if state == avahi.ENTRY_GROUP_ESTABLISHED:

500

597

logger.debug(u"Service established.")

501

598

elif state == avahi.ENTRY_GROUP_COLLISION:

502

503

rename_count = rename_count - 1

504

if rename_count > 0:

505

name = server.GetAlternativeServiceName(name)

506

logger.warning(u"Service name collision, "

507

u"changing name to '%s' ...", name)

508

remove_service()

509

add_service()

510

511

else:

512

logger.error(u"No suitable service name found after %i"

513

u" retries, exiting.", n_rename)

514

killme(1)

599

logger.warning(u"Service name collision.")

600

service.rename()

515

601

elif state == avahi.ENTRY_GROUP_FAILURE:

516

logger.error(u"Error in group state changed %s",

517

unicode(error))

518

killme(1)

519

602

logger.critical(u"Error in group state changed %s",

603

unicode(error))

604

raise AvahiGroupError("State changed: %s", str(error))

520

605

521

606

def if_nametoindex(interface):

522

"""Call the C function if_nametoindex()"""

607

"""Call the C function if_nametoindex(), or equivalent"""

608

global if_nametoindex

523

609

try:

524

libc = ctypes.cdll.LoadLibrary("libc.so.6")

525

return libc.if_nametoindex(interface)

610

if "ctypes.util" not in sys.modules:

611

import ctypes.util

612

if_nametoindex = ctypes.cdll.LoadLibrary\

613

(ctypes.util.find_library("c")).if_nametoindex

526

614

except (OSError, AttributeError):

527

615

if "struct" not in sys.modules:

528

616

import struct

529

617

if "fcntl" not in sys.modules:

530

618

import fcntl

531

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

532

s = socket.socket()

533

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

534

struct.pack("16s16x", interface))

535

s.close()

536

interface_index = struct.unpack("I", ifreq[16:20])[0]

537

return interface_index

619

def if_nametoindex(interface):

620

"Get an interface index the hard way, i.e. using fcntl()"

621

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

622

s = socket.socket()

623

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

624

struct.pack("16s16x", interface))

625

s.close()

626

interface_index = struct.unpack("I", ifreq[16:20])[0]

627

return interface_index

628

return if_nametoindex(interface)

538

629

539

630

540

631

def daemon(nochdir, noclose):

547

638

os.chdir("/")

548

639

if not noclose:

549

640

# Close all standard open file descriptors

550

null = os.open("/dev/null", os.O_NOCTTY | os.O_RDWR)

641

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

551

642

if not stat.S_ISCHR(os.fstat(null).st_mode):

552

643

raise OSError(errno.ENODEV,

553

644

"/dev/null not a character device")

558

649

os.close(null)

559

650

560

651

561

def killme(status = 0):

562

logger.debug("Stopping server with exit status %d", status)

563

exitstatus = status

564

if main_loop_started:

565

main_loop.quit()

566

else:

567

sys.exit(status)

568

569

570

if __name__ == '__main__':

571

exitstatus = 0

652

def main():

653

global main_loop_started

572

654

main_loop_started = False

655

573

656

parser = OptionParser()

574

657

parser.add_option("-i", "--interface", type="string",

575

default=None, metavar="IF",

576

help="Bind to interface IF")

577

parser.add_option("-p", "--port", type="int", default=None,

658

metavar="IF", help="Bind to interface IF")

659

parser.add_option("-a", "--address", type="string",

660

help="Address to listen for requests on")

661

parser.add_option("-p", "--port", type="int",

578

662

help="Port number to receive requests on")

579

parser.add_option("--timeout", type="string", # Parsed later

580

default="1h",

581

help="Amount of downtime allowed for clients")

582

parser.add_option("--interval", type="string", # Parsed later

583

default="5m",

584

help="How often to check that a client is up")

585

663

parser.add_option("--check", action="store_true", default=False,

586

664

help="Run self-test")

587

665

parser.add_option("--debug", action="store_true", default=False,

588

help="Debug mode")

666

help="Debug mode; run in foreground and log to"

667

" terminal")

668

parser.add_option("--priority", type="string", help="GnuTLS"

669

" priority string (see GnuTLS documentation)")

670

parser.add_option("--servicename", type="string", metavar="NAME",

671

help="Zeroconf service name")

672

parser.add_option("--configdir", type="string",

673

default="/etc/mandos", metavar="DIR",

674

help="Directory to search for configuration"

675

" files")

589

676

(options, args) = parser.parse_args()

590

677

591

678

if options.check:

593

680

doctest.testmod()

594

681

sys.exit()

595

682

596

# Parse the time arguments

597

try:

598

options.timeout = string_to_delta(options.timeout)

599

except ValueError:

600

parser.error("option --timeout: Unparseable time")

601

try:

602

options.interval = string_to_delta(options.interval)

603

except ValueError:

604

parser.error("option --interval: Unparseable time")

605

606

# Parse config file

607

defaults = { "checker": "fping -q -- %%(fqdn)s" }

608

client_config = ConfigParser.SafeConfigParser(defaults)

609

#client_config.readfp(open("secrets.conf"), "secrets.conf")

610

client_config.read("mandos-clients.conf")

611

612

# From the Avahi server example code

683

# Default values for config file for server-global settings

684

server_defaults = { "interface": "",

685

"address": "",

686

"port": "",

687

"debug": "False",

688

"priority":

689

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

690

"servicename": "Mandos",

691

}

692

693

# Parse config file for server-global settings

694

server_config = ConfigParser.SafeConfigParser(server_defaults)

695

del server_defaults

696

server_config.read(os.path.join(options.configdir, "server.conf"))

697

server_section = "server"

698

# Convert the SafeConfigParser object to a dict

699

server_settings = dict(server_config.items(server_section))

700

# Use getboolean on the boolean config option

701

server_settings["debug"] = server_config.getboolean\

702

(server_section, "debug")

703

del server_config

704

705

# Override the settings from the config file with command line

706

# options, if set.

707

for option in ("interface", "address", "port", "debug",

708

"priority", "servicename", "configdir"):

709

value = getattr(options, option)

710

if value is not None:

711

server_settings[option] = value

712

del options

713

# Now we have our good server settings in "server_settings"

714

715

# Parse config file with clients

716

client_defaults = { "timeout": "1h",

717

"interval": "5m",

718

"checker": "fping -q -- %%(fqdn)s",

719

}

720

client_config = ConfigParser.SafeConfigParser(client_defaults)

721

client_config.read(os.path.join(server_settings["configdir"],

722

"clients.conf"))

723

724

global service

725

service = AvahiService(name = server_settings["servicename"],

726

type = "_mandos._tcp", );

727

if server_settings["interface"]:

728

service.interface = if_nametoindex(server_settings["interface"])

729

730

global main_loop

731

global bus

732

global server

733

# From the Avahi example code

613

734

DBusGMainLoop(set_as_default=True )

614

735

main_loop = gobject.MainLoop()

615

736

bus = dbus.SystemBus()

618

739

avahi.DBUS_INTERFACE_SERVER )

619

740

# End of Avahi example code

620

741

621

debug = options.debug

742

debug = server_settings["debug"]

622

743

623

744

if debug:

624

745

console = logging.StreamHandler()

632

753

def remove_from_clients(client):

633

754

clients.remove(client)

634

755

if not clients:

635

logger.debug(u"No clients left, exiting")

636

killme()

756

logger.critical(u"No clients left, exiting")

757

sys.exit()

637

758

638

clients.update(Set(Client(name=section, options=options,

759

clients.update(Set(Client(name = section,

639

760

stop_hook = remove_from_clients,

640

**(dict(client_config\

641

.items(section))))

761

config

762

= dict(client_config.items(section)))

642

763

for section in client_config.sections()))

643

764

644

765

if not debug:

647

768

def cleanup():

648

769

"Cleanup function; run on exit"

649

770

global group

650

# From the Avahi server example code

771

# From the Avahi example code

651

772

if not group is None:

652

773

group.Free()

653

774

group = None

654

775

# End of Avahi example code

655

776

656

for client in clients:

777

while clients:

778

client = clients.pop()

657

779

client.stop_hook = None

658

780

client.stop()

659

781

661

783

662

784

if not debug:

663

785

signal.signal(signal.SIGINT, signal.SIG_IGN)

664

signal.signal(signal.SIGHUP, lambda signum, frame: killme())

665

signal.signal(signal.SIGTERM, lambda signum, frame: killme())

786

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

787

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

666

788

667

789

for client in clients:

668

790

client.start()

669

791

670

tcp_server = IPv6_TCPServer((None, options.port),

792

tcp_server = IPv6_TCPServer((server_settings["address"],

793

server_settings["port"]),

671

794

tcp_handler,

672

options=options,

795

settings=server_settings,

673

796

clients=clients)

674

# Find out what random port we got

675

servicePort = tcp_server.socket.getsockname()[1]

676

logger.debug(u"Now listening on port %d", servicePort)

677

678

if options.interface is not None:

679

serviceInterface = if_nametoindex(options.interface)

680

681

# From the Avahi server example code

682

server.connect_to_signal("StateChanged", server_state_changed)

683

try:

684

server_state_changed(server.GetState())

685

except dbus.exceptions.DBusException, error:

686

logger.critical(u"DBusException: %s", error)

687

killme(1)

688

# End of Avahi example code

689

690

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

691

lambda *args, **kwargs:

692

tcp_server.handle_request(*args[2:],

693

**kwargs) or True)

694

try:

797

# Find out what port we got

798

service.port = tcp_server.socket.getsockname()[1]

799

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

800

u" scope_id %d" % tcp_server.socket.getsockname())

801

802

#service.interface = tcp_server.socket.getsockname()[3]

803

804

try:

805

# From the Avahi example code

806

server.connect_to_signal("StateChanged", server_state_changed)

807

try:

808

server_state_changed(server.GetState())

809

except dbus.exceptions.DBusException, error:

810

logger.critical(u"DBusException: %s", error)

811

sys.exit(1)

812

# End of Avahi example code

813

814

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

815

lambda *args, **kwargs:

816

tcp_server.handle_request\

817

(*args[2:], **kwargs) or True)

818

819

logger.debug("Starting main loop")

695

820

main_loop_started = True

696

821

main_loop.run()

822

except AvahiError, error:

823

logger.critical(u"AvahiError: %s" + unicode(error))

824

sys.exit(1)

697

825

except KeyboardInterrupt:

698

826

if debug:

699

827

print

700

701

sys.exit(exitstatus)

828

829

if __name__ == '__main__':

830

main()