/mandos/trunk : revision 44

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# following functions: "add_service", "remove_service",

9

# following functions: "AvahiService.add", "AvahiService.remove",

10

# "server_state_changed", "entry_group_state_changed", and some lines

11

# in "main".

12

#

13

14

# Påhlsson.

13

# Everything else is

14

15

#

16

# This program is free software: you can redistribute it and/or modify

17

# it under the terms of the GNU General Public License as published by

26

# You should have received a copy of the GNU General Public License

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

28

#

29

# Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and

30

# <https://www.fukt.bsnet.se/~teddy/>.

29

# Contact the authors at <mandos@fukt.bsnet.se>.

31

30

#

32

31

33

32

from __future__ import division

66

65

#

67

66

# This server announces itself as a Zeroconf service. Connecting

68

67

# clients use the TLS protocol, with the unusual quirk that this

69

# server program acts as a TLS "client" while the connecting clients

70

# acts as a TLS "server". The clients (acting as a TLS "server") must

68

# server program acts as a TLS "client" while a connecting client acts

69

# as a TLS "server". The client (acting as a TLS "server") must

71

70

# supply an OpenPGP certificate, and the fingerprint of this

72

71

# certificate is used by this server to look up (in a list read from a

73

72

# file at start time) which binary blob to give the client. No other

82

81

logger.addHandler(syslogger)

83

82

del syslogger

84

83

85

# This variable is used to optionally bind to a specified interface.

86

# It is a global variable to fit in with the other variables from the

87

# Avahi example code.

88

serviceInterface = avahi.IF_UNSPEC

84

85

class AvahiError(Exception):

86

def __init__(self, value):

87

self.value = value

88

def __str__(self):

89

return repr(self.value)

90

91

class AvahiServiceError(AvahiError):

92

pass

93

94

class AvahiGroupError(AvahiError):

95

pass

96

97

98

class AvahiService(object):

99

"""

100

interface: integer; avahi.IF_UNSPEC or an interface index.

101

Used to optionally bind to the specified interface.

102

name = string; Example: "Mandos"

103

type = string; Example: "_mandos._tcp".

104

See <http://www.dns-sd.org/ServiceTypes.html>

105

port = integer; what port to announce

106

TXT = list of strings; TXT record for the service

107

domain = string; Domain to publish on, default to .local if empty.

108

host = string; Host to publish records for, default to localhost

109

if empty.

110

max_renames = integer; maximum number of renames

111

rename_count = integer; counter so we only rename after collisions

112

a sensible number of times

113

"""

114

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

115

type = None, port = None, TXT = None, domain = "",

116

host = "", max_renames = 12):

117

"""An Avahi (Zeroconf) service. """

118

self.interface = interface

119

self.name = name

120

self.type = type

121

self.port = port

122

if TXT is None:

123

self.TXT = []

124

else:

125

self.TXT = TXT

126

self.domain = domain

127

self.host = host

128

self.rename_count = 0

129

def rename(self):

130

"""Derived from the Avahi example code"""

131

if self.rename_count >= self.max_renames:

132

logger.critical(u"No suitable service name found after %i"

133

u" retries, exiting.", rename_count)

134

raise AvahiServiceError("Too many renames")

135

name = server.GetAlternativeServiceName(name)

136

logger.error(u"Changing name to %r ...", name)

137

self.remove()

138

self.add()

139

self.rename_count += 1

140

def remove(self):

141

"""Derived from the Avahi example code"""

142

if group is not None:

143

group.Reset()

144

def add(self):

145

"""Derived from the Avahi example code"""

146

global group

147

if group is None:

148

group = dbus.Interface\

149

(bus.get_object(avahi.DBUS_NAME,

150

server.EntryGroupNew()),

151

avahi.DBUS_INTERFACE_ENTRY_GROUP)

152

group.connect_to_signal('StateChanged',

153

entry_group_state_changed)

154

logger.debug(u"Adding service '%s' of type '%s' ...",

155

service.name, service.type)

156

group.AddService(

157

self.interface, # interface

158

avahi.PROTO_INET6, # protocol

159

dbus.UInt32(0), # flags

160

self.name, self.type,

161

self.domain, self.host,

162

dbus.UInt16(self.port),

163

avahi.string_array_to_txt_array(self.TXT))

164

group.Commit()

165

89

166

# From the Avahi example code:

90

serviceName = "Mandos"

91

serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html

92

servicePort = None # Not known at startup

93

serviceTXT = [] # TXT record for the service

94

domain = "" # Domain to publish on, default to .local

95

host = "" # Host to publish records for, default to localhost

96

group = None #our entry group

97

rename_count = 12 # Counter so we only rename after collisions a

98

# sensible number of times

167

group = None # our entry group

99

168

# End of Avahi example code

100

169

101

170

107

176

uniquely identify the client

108

177

secret: bytestring; sent verbatim (over TLS) to client

109

178

fqdn: string (FQDN); available for use by the checker command

110

created: datetime.datetime()

111

last_seen: datetime.datetime() or None if not yet seen

112

timeout: datetime.timedelta(); How long from last_seen until

113

this client is invalid

179

created: datetime.datetime(); object creation, not client host

180

last_checked_ok: datetime.datetime() or None if not yet checked OK

181

timeout: datetime.timedelta(); How long from last_checked_ok

182

until this client is invalid

114

183

interval: datetime.timedelta(); How often to start a new checker

115

184

stop_hook: If set, called by stop() as stop_hook(self)

116

185

checker: subprocess.Popen(); a running checker process used

117

186

to see if the client lives.

118

Is None if no process is running.

187

'None' if no process is running.

119

188

checker_initiator_tag: a gobject event source tag, or None

120

189

stop_initiator_tag: - '' -

121

190

checker_callback_tag: - '' -

122

191

checker_command: string; External command which is run to check if

123

client lives. %()s expansions are done at

192

client lives. %() expansions are done at

124

193

runtime with vars(self) as dict, so that for

125

194

instance %(name)s can be used in the command.

126

195

Private attibutes:

127

196

_timeout: Real variable for 'timeout'

128

197

_interval: Real variable for 'interval'

129

_timeout_milliseconds: Used by gobject.timeout_add()

198

_timeout_milliseconds: Used when calling gobject.timeout_add()

130

199

_interval_milliseconds: - '' -

131

200

"""

132

201

def _set_timeout(self, timeout):

152

221

interval = property(lambda self: self._interval,

153

222

_set_interval)

154

223

del _set_interval

155

def __init__(self, name=None, options=None, stop_hook=None,

156

fingerprint=None, secret=None, secfile=None,

157

fqdn=None, timeout=None, interval=-1, checker=None):

224

def __init__(self, name = None, stop_hook=None, config={}):

158

225

"""Note: the 'checker' argument sets the 'checker_command'

159

226

attribute and not the 'checker' attribute.."""

160

227

self.name = name

228

logger.debug(u"Creating client %r", self.name)

161

229

# Uppercase and remove spaces from fingerprint

162

230

# for later comparison purposes with return value of

163

231

# the fingerprint() function

164

self.fingerprint = fingerprint.upper().replace(u" ", u"")

165

if secret:

166

self.secret = secret.decode(u"base64")

167

elif secfile:

168

sf = open(secfile)

232

self.fingerprint = config["fingerprint"].upper()\

233

.replace(u" ", u"")

234

logger.debug(u" Fingerprint: %s", self.fingerprint)

235

if "secret" in config:

236

self.secret = config["secret"].decode(u"base64")

237

elif "secfile" in config:

238

sf = open(config["secfile"])

169

239

self.secret = sf.read()

170

240

sf.close()

171

241

else:

172

raise RuntimeError(u"No secret or secfile for client %s"

173

% self.name)

174

self.fqdn = fqdn # string

242

raise TypeError(u"No secret or secfile for client %s"

243

% self.name)

244

self.fqdn = config.get("fqdn", "")

175

245

self.created = datetime.datetime.now()

176

self.last_seen = None

177

if timeout is None:

178

self.timeout = options.timeout

179

else:

180

self.timeout = string_to_delta(timeout)

181

if interval == -1:

182

self.interval = options.interval

183

else:

184

self.interval = string_to_delta(interval)

246

self.last_checked_ok = None

247

self.timeout = string_to_delta(config["timeout"])

248

self.interval = string_to_delta(config["interval"])

185

249

self.stop_hook = stop_hook

186

250

self.checker = None

187

251

self.checker_initiator_tag = None

188

252

self.stop_initiator_tag = None

189

253

self.checker_callback_tag = None

190

self.check_command = checker

254

self.check_command = config["checker"]

191

255

def start(self):

192

256

"""Start this client's checker and timeout hooks"""

193

257

# Schedule a new checker to be started an 'interval' from now,

203

267

self.stop)

204

268

def stop(self):

205

269

"""Stop this client.

206

The possibility that this client might be restarted is left

207

open, but not currently used."""

270

The possibility that a client might be restarted is left open,

271

but not currently used."""

208

272

# If this client doesn't have a secret, it is already stopped.

209

273

if self.secret:

210

logger.debug(u"Stopping client %s", self.name)

274

logger.info(u"Stopping client %s", self.name)

211

275

self.secret = None

212

276

else:

213

277

return False

214

if hasattr(self, "stop_initiator_tag") \

215

and self.stop_initiator_tag:

278

if getattr(self, "stop_initiator_tag", False):

216

279

gobject.source_remove(self.stop_initiator_tag)

217

280

self.stop_initiator_tag = None

218

if hasattr(self, "checker_initiator_tag") \

219

and self.checker_initiator_tag:

281

if getattr(self, "checker_initiator_tag", False):

220

282

gobject.source_remove(self.checker_initiator_tag)

221

283

self.checker_initiator_tag = None

222

284

self.stop_checker()

234

296

self.checker = None

235

297

if os.WIFEXITED(condition) \

236

298

and (os.WEXITSTATUS(condition) == 0):

237

logger.debug(u"Checker for %(name)s succeeded",

238

vars(self))

239

self.last_seen = now

299

logger.info(u"Checker for %(name)s succeeded",

300

vars(self))

301

self.last_checked_ok = now

240

302

gobject.source_remove(self.stop_initiator_tag)

241

303

self.stop_initiator_tag = gobject.timeout_add\

242

304

(self._timeout_milliseconds,

245

307

logger.warning(u"Checker for %(name)s crashed?",

246

308

vars(self))

247

309

else:

248

logger.debug(u"Checker for %(name)s failed",

249

vars(self))

310

logger.info(u"Checker for %(name)s failed",

311

vars(self))

250

312

def start_checker(self):

251

313

"""Start a new checker subprocess if one is not running.

252

314

If a checker already exists, leave it running and do

261

323

# is as it should be.

262

324

if self.checker is None:

263

325

try:

326

# In case check_command has exactly one % operator

264

327

command = self.check_command % self.fqdn

265

328

except TypeError:

329

# Escape attributes for the shell

266

330

escaped_attrs = dict((key, re.escape(str(val)))

267

331

for key, val in

268

332

vars(self).iteritems())

269

333

try:

270

334

command = self.check_command % escaped_attrs

271

335

except TypeError, error:

272

logger.critical(u'Could not format string "%s":'

273

u' %s', self.check_command, error)

336

logger.error(u'Could not format string "%s":'

337

u' %s', self.check_command, error)

274

338

return True # Try again later

275

339

try:

276

logger.debug(u"Starting checker %r for %s",

277

command, self.name)

278

self.checker = subprocess.\

279

Popen(command,

280

close_fds=True, shell=True,

281

cwd="/")

340

logger.info(u"Starting checker %r for %s",

341

command, self.name)

342

self.checker = subprocess.Popen(command,

343

close_fds=True,

344

shell=True, cwd="/")

282

345

self.checker_callback_tag = gobject.child_watch_add\

283

346

(self.checker.pid,

284

347

self.checker_callback)

292

355

if self.checker_callback_tag:

293

356

gobject.source_remove(self.checker_callback_tag)

294

357

self.checker_callback_tag = None

295

if not hasattr(self, "checker") or self.checker is None:

358

if getattr(self, "checker", None) is None:

296

359

return

297

360

logger.debug("Stopping checker for %(name)s", vars(self))

298

361

try:

301

364

#if self.checker.poll() is None:

302

365

# os.kill(self.checker.pid, signal.SIGKILL)

303

366

except OSError, error:

304

if error.errno != errno.ESRCH:

367

if error.errno != errno.ESRCH: # No such process

305

368

raise

306

369

self.checker = None

307

def still_valid(self, now=None):

370

def still_valid(self):

308

371

"""Has the timeout not yet passed for this client?"""

309

if now is None:

310

now = datetime.datetime.now()

311

if self.last_seen is None:

372

now = datetime.datetime.now()

373

if self.last_checked_ok is None:

312

374

return now < (self.created + self.timeout)

313

375

else:

314

return now < (self.last_seen + self.timeout)

376

return now < (self.last_checked_ok + self.timeout)

315

377

316

378

317

379

def peer_certificate(session):

368

430

Note: This will run in its own forked process."""

369

431

370

432

def handle(self):

371

logger.debug(u"TCP connection from: %s",

433

logger.info(u"TCP connection from: %s",

372

434

unicode(self.client_address))

373

session = gnutls.connection.ClientSession(self.request,

374

gnutls.connection.\

375

X509Credentials())

435

session = gnutls.connection.ClientSession\

436

(self.request, gnutls.connection.X509Credentials())

437

438

line = self.request.makefile().readline()

439

logger.debug(u"Protocol version: %r", line)

440

try:

441

if int(line.strip().split()[0]) > 1:

442

raise RuntimeError

443

except (ValueError, IndexError, RuntimeError), error:

444

logger.error(u"Unknown protocol version: %s", error)

445

return

446

447

# Note: gnutls.connection.X509Credentials is really a generic

448

# GnuTLS certificate credentials object so long as no X.509

449

# keys are added to it. Therefore, we can use it here despite

450

# using OpenPGP certificates.

376

451

377

452

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

378

453

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

379

454

# "+DHE-DSS"))

380

priority = "SECURE256"

381

455

priority = "NORMAL" # Fallback default, since this

456

# MUST be set.

457

if self.server.settings["priority"]:

458

priority = self.server.settings["priority"]

382

459

gnutls.library.functions.gnutls_priority_set_direct\

383

460

(session._c_object, priority, None);

384

461

385

462

try:

386

463

session.handshake()

387

464

except gnutls.errors.GNUTLSError, error:

388

logger.debug(u"Handshake failed: %s", error)

465

logger.warning(u"Handshake failed: %s", error)

389

466

# Do not run session.bye() here: the session is not

390

467

# established. Just abandon the request.

391

468

return

392

469

try:

393

470

fpr = fingerprint(peer_certificate(session))

394

471

except (TypeError, gnutls.errors.GNUTLSError), error:

395

logger.debug(u"Bad certificate: %s", error)

472

logger.warning(u"Bad certificate: %s", error)

396

473

session.bye()

397

474

return

398

475

logger.debug(u"Fingerprint: %s", fpr)

401

478

if c.fingerprint == fpr:

402

479

client = c

403

480

break

481

if not client:

482

logger.warning(u"Client not found for fingerprint: %s",

483

fpr)

484

session.bye()

485

return

404

486

# Have to check if client.still_valid(), since it is possible

405

487

# that the client timed out while establishing the GnuTLS

406

488

# session.

407

if (not client) or (not client.still_valid()):

408

if client:

409

logger.debug(u"Client %(name)s is invalid",

410

vars(client))

411

else:

412

logger.debug(u"Client not found for fingerprint: %s",

413

fpr)

489

if not client.still_valid():

490

logger.warning(u"Client %(name)s is invalid",

491

vars(client))

414

492

session.bye()

415

493

return

416

494

sent_size = 0

426

504

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

427

505

"""IPv6 TCP server. Accepts 'None' as address and/or port.

428

506

Attributes:

429

options: Command line options

507

settings: Server settings

430

508

clients: Set() of Client objects

431

509

"""

432

510

address_family = socket.AF_INET6

433

511

def __init__(self, *args, **kwargs):

434

if "options" in kwargs:

435

self.options = kwargs["options"]

436

del kwargs["options"]

512

if "settings" in kwargs:

513

self.settings = kwargs["settings"]

514

del kwargs["settings"]

437

515

if "clients" in kwargs:

438

516

self.clients = kwargs["clients"]

439

517

del kwargs["clients"]

442

520

"""This overrides the normal server_bind() function

443

521

to bind to an interface if one was specified, and also NOT to

444

522

bind to an address or port if they were not specified."""

445

if self.options.interface:

446

if not hasattr(socket, "SO_BINDTODEVICE"):

447

# From /usr/include/asm-i486/socket.h

448

socket.SO_BINDTODEVICE = 25

523

if self.settings["interface"]:

524

# 25 is from /usr/include/asm-i486/socket.h

525

SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)

449

526

try:

450

527

self.socket.setsockopt(socket.SOL_SOCKET,

451

socket.SO_BINDTODEVICE,

452

self.options.interface)

528

SO_BINDTODEVICE,

529

self.settings["interface"])

453

530

except socket.error, error:

454

531

if error[0] == errno.EPERM:

455

logger.warning(u"No permission to"

456

u" bind to interface %s",

457

self.options.interface)

532

logger.error(u"No permission to"

533

u" bind to interface %s",

534

self.settings["interface"])

458

535

else:

459

536

raise error

460

537

# Only bind(2) the socket if we really need to.

503

580

return delta

504

581

505

582

506

def add_service():

507

"""Derived from the Avahi example code"""

508

global group, serviceName, serviceType, servicePort, serviceTXT, \

509

domain, host

510

if group is None:

511

group = dbus.Interface(

512

bus.get_object( avahi.DBUS_NAME,

513

server.EntryGroupNew()),

514

avahi.DBUS_INTERFACE_ENTRY_GROUP)

515

group.connect_to_signal('StateChanged',

516

entry_group_state_changed)

517

logger.debug(u"Adding service '%s' of type '%s' ...",

518

serviceName, serviceType)

519

520

group.AddService(

521

serviceInterface, # interface

522

avahi.PROTO_INET6, # protocol

523

dbus.UInt32(0), # flags

524

serviceName, serviceType,

525

domain, host,

526

dbus.UInt16(servicePort),

527

avahi.string_array_to_txt_array(serviceTXT))

528

group.Commit()

529

530

531

def remove_service():

532

"""From the Avahi example code"""

533

global group

534

535

if not group is None:

536

group.Reset()

537

538

539

583

def server_state_changed(state):

540

584

"""Derived from the Avahi example code"""

541

585

if state == avahi.SERVER_COLLISION:

542

logger.warning(u"Server name collision")

543

remove_service()

586

logger.error(u"Server name collision")

587

service.remove()

544

588

elif state == avahi.SERVER_RUNNING:

545

add_service()

589

service.add()

546

590

547

591

548

592

def entry_group_state_changed(state, error):

549

593

"""Derived from the Avahi example code"""

550

global serviceName, server, rename_count

551

552

594

logger.debug(u"state change: %i", state)

553

595

554

596

if state == avahi.ENTRY_GROUP_ESTABLISHED:

555

597

logger.debug(u"Service established.")

556

598

elif state == avahi.ENTRY_GROUP_COLLISION:

557

558

rename_count = rename_count - 1

559

if rename_count > 0:

560

name = server.GetAlternativeServiceName(name)

561

logger.warning(u"Service name collision, "

562

u"changing name to '%s' ...", name)

563

remove_service()

564

add_service()

565

566

else:

567

logger.error(u"No suitable service name found after %i"

568

u" retries, exiting.", n_rename)

569

killme(1)

599

logger.warning(u"Service name collision.")

600

service.rename()

570

601

elif state == avahi.ENTRY_GROUP_FAILURE:

571

logger.error(u"Error in group state changed %s",

572

unicode(error))

573

killme(1)

574

602

logger.critical(u"Error in group state changed %s",

603

unicode(error))

604

raise AvahiGroupError("State changed: %s", str(error))

575

605

576

606

def if_nametoindex(interface):

577

"""Call the C function if_nametoindex()"""

607

"""Call the C function if_nametoindex(), or equivalent"""

608

global if_nametoindex

578

609

try:

579

libc = ctypes.cdll.LoadLibrary("libc.so.6")

580

return libc.if_nametoindex(interface)

610

if "ctypes.util" not in sys.modules:

611

import ctypes.util

612

if_nametoindex = ctypes.cdll.LoadLibrary\

613

(ctypes.util.find_library("c")).if_nametoindex

581

614

except (OSError, AttributeError):

582

615

if "struct" not in sys.modules:

583

616

import struct

584

617

if "fcntl" not in sys.modules:

585

618

import fcntl

586

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

587

s = socket.socket()

588

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

589

struct.pack("16s16x", interface))

590

s.close()

591

interface_index = struct.unpack("I", ifreq[16:20])[0]

592

return interface_index

619

def if_nametoindex(interface):

620

"Get an interface index the hard way, i.e. using fcntl()"

621

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

622

s = socket.socket()

623

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

624

struct.pack("16s16x", interface))

625

s.close()

626

interface_index = struct.unpack("I", ifreq[16:20])[0]

627

return interface_index

628

return if_nametoindex(interface)

593

629

594

630

595

631

def daemon(nochdir, noclose):

602

638

os.chdir("/")

603

639

if not noclose:

604

640

# Close all standard open file descriptors

605

null = os.open("/dev/null", os.O_NOCTTY | os.O_RDWR)

641

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

606

642

if not stat.S_ISCHR(os.fstat(null).st_mode):

607

643

raise OSError(errno.ENODEV,

608

644

"/dev/null not a character device")

613

649

os.close(null)

614

650

615

651

616

def killme(status = 0):

617

logger.debug("Stopping server with exit status %d", status)

618

exitstatus = status

619

if main_loop_started:

620

main_loop.quit()

621

else:

622

sys.exit(status)

623

624

625

652

def main():

626

global exitstatus

627

exitstatus = 0

628

653

global main_loop_started

629

654

main_loop_started = False

630

655

631

656

parser = OptionParser()

632

657

parser.add_option("-i", "--interface", type="string",

633

default=None, metavar="IF",

634

help="Bind to interface IF")

635

parser.add_option("-a", "--address", type="string", default=None,

658

metavar="IF", help="Bind to interface IF")

659

parser.add_option("-a", "--address", type="string",

636

660

help="Address to listen for requests on")

637

parser.add_option("-p", "--port", type="int", default=None,

661

parser.add_option("-p", "--port", type="int",

638

662

help="Port number to receive requests on")

639

parser.add_option("--timeout", type="string", # Parsed later

640

default="1h",

641

help="Amount of downtime allowed for clients")

642

parser.add_option("--interval", type="string", # Parsed later

643

default="5m",

644

help="How often to check that a client is up")

645

663

parser.add_option("--check", action="store_true", default=False,

646

664

help="Run self-test")

647

665

parser.add_option("--debug", action="store_true", default=False,

648

help="Debug mode")

666

help="Debug mode; run in foreground and log to"

667

" terminal")

668

parser.add_option("--priority", type="string", help="GnuTLS"

669

" priority string (see GnuTLS documentation)")

670

parser.add_option("--servicename", type="string", metavar="NAME",

671

help="Zeroconf service name")

672

parser.add_option("--configdir", type="string",

673

default="/etc/mandos", metavar="DIR",

674

help="Directory to search for configuration"

675

" files")

649

676

(options, args) = parser.parse_args()

650

677

651

678

if options.check:

653

680

doctest.testmod()

654

681

sys.exit()

655

682

656

# Parse the time arguments

657

try:

658

options.timeout = string_to_delta(options.timeout)

659

except ValueError:

660

parser.error("option --timeout: Unparseable time")

661

try:

662

options.interval = string_to_delta(options.interval)

663

except ValueError:

664

parser.error("option --interval: Unparseable time")

665

666

# Parse config file

667

defaults = { "checker": "fping -q -- %%(fqdn)s" }

668

client_config = ConfigParser.SafeConfigParser(defaults)

669

#client_config.readfp(open("global.conf"), "global.conf")

670

client_config.read("mandos-clients.conf")

683

# Default values for config file for server-global settings

684

server_defaults = { "interface": "",

685

"address": "",

686

"port": "",

687

"debug": "False",

688

"priority":

689

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

690

"servicename": "Mandos",

691

}

692

693

# Parse config file for server-global settings

694

server_config = ConfigParser.SafeConfigParser(server_defaults)

695

del server_defaults

696

server_config.read(os.path.join(options.configdir, "server.conf"))

697

server_section = "server"

698

# Convert the SafeConfigParser object to a dict

699

server_settings = dict(server_config.items(server_section))

700

# Use getboolean on the boolean config option

701

server_settings["debug"] = server_config.getboolean\

702

(server_section, "debug")

703

del server_config

704

705

# Override the settings from the config file with command line

706

# options, if set.

707

for option in ("interface", "address", "port", "debug",

708

"priority", "servicename", "configdir"):

709

value = getattr(options, option)

710

if value is not None:

711

server_settings[option] = value

712

del options

713

# Now we have our good server settings in "server_settings"

714

715

# Parse config file with clients

716

client_defaults = { "timeout": "1h",

717

"interval": "5m",

718

"checker": "fping -q -- %%(fqdn)s",

719

}

720

client_config = ConfigParser.SafeConfigParser(client_defaults)

721

client_config.read(os.path.join(server_settings["configdir"],

722

"clients.conf"))

723

724

global service

725

service = AvahiService(name = server_settings["servicename"],

726

type = "_mandos._tcp", );

727

if server_settings["interface"]:

728

service.interface = if_nametoindex(server_settings["interface"])

671

729

672

730

global main_loop

673

731

global bus

681

739

avahi.DBUS_INTERFACE_SERVER )

682

740

# End of Avahi example code

683

741

684

debug = options.debug

742

debug = server_settings["debug"]

685

743

686

744

if debug:

687

745

console = logging.StreamHandler()

695

753

def remove_from_clients(client):

696

754

clients.remove(client)

697

755

if not clients:

698

logger.debug(u"No clients left, exiting")

699

killme()

756

logger.critical(u"No clients left, exiting")

757

sys.exit()

700

758

701

clients.update(Set(Client(name=section, options=options,

759

clients.update(Set(Client(name = section,

702

760

stop_hook = remove_from_clients,

703

**(dict(client_config\

704

.items(section))))

761

config

762

= dict(client_config.items(section)))

705

763

for section in client_config.sections()))

706

764

707

765

if not debug:

725

783

726

784

if not debug:

727

785

signal.signal(signal.SIGINT, signal.SIG_IGN)

728

signal.signal(signal.SIGHUP, lambda signum, frame: killme())

729

signal.signal(signal.SIGTERM, lambda signum, frame: killme())

786

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

787

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

730

788

731

789

for client in clients:

732

790

client.start()

733

791

734

tcp_server = IPv6_TCPServer((options.address, options.port),

792

tcp_server = IPv6_TCPServer((server_settings["address"],

793

server_settings["port"]),

735

794

tcp_handler,

736

options=options,

795

settings=server_settings,

737

796

clients=clients)

738

# Find out what random port we got

739

global servicePort

740

servicePort = tcp_server.socket.getsockname()[1]

741

logger.debug(u"Now listening on port %d", servicePort)

742

743

if options.interface is not None:

744

global serviceInterface

745

serviceInterface = if_nametoindex(options.interface)

746

747

# From the Avahi example code

748

server.connect_to_signal("StateChanged", server_state_changed)

749

try:

750

server_state_changed(server.GetState())

751

except dbus.exceptions.DBusException, error:

752

logger.critical(u"DBusException: %s", error)

753

killme(1)

754

# End of Avahi example code

755

756

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

757

lambda *args, **kwargs:

758

tcp_server.handle_request(*args[2:],

759

**kwargs) or True)

760

try:

797

# Find out what port we got

798

service.port = tcp_server.socket.getsockname()[1]

799

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

800

u" scope_id %d" % tcp_server.socket.getsockname())

801

802

#service.interface = tcp_server.socket.getsockname()[3]

803

804

try:

805

# From the Avahi example code

806

server.connect_to_signal("StateChanged", server_state_changed)

807

try:

808

server_state_changed(server.GetState())

809

except dbus.exceptions.DBusException, error:

810

logger.critical(u"DBusException: %s", error)

811

sys.exit(1)

812

# End of Avahi example code

813

814

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

815

lambda *args, **kwargs:

816

tcp_server.handle_request\

817

(*args[2:], **kwargs) or True)

818

761

819

logger.debug("Starting main loop")

762

820

main_loop_started = True

763

821

main_loop.run()

822

except AvahiError, error:

823

logger.critical(u"AvahiError: %s" + unicode(error))

824

sys.exit(1)

764

825

except KeyboardInterrupt:

765

826

if debug:

766

827

print

767

768

sys.exit(exitstatus)

769

828

770

829

if __name__ == '__main__':

771

830

main()