To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 46
- compare with another revision
- download diff
- download tarball
- view history from revision 46
- Committer: Teddy Hogeborn
- Date: 2008-08-04 23:38:26 UTC
- mfrom: (24.1.20 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080804233826-idy7v8x36llseue0
* network-protocol.txt: New.
* server.py (daemon): Do the double fork thing.
* server.py (daemon): Do the double fork thing.
- files added:
- network-protocol.txt
- files removed:
- ca.pem
- files renamed:
- mandos-clients.conf => clients.conf
- files modified:
- Makefile
added
removed
server.py
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# following functions: "add_service", "remove_service",
10
# "server_state_changed", "entry_group_state_changed", and some lines
11
# in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
# Everything else is Copyright © 2007-2008 Teddy Hogeborn and Björn
14
# Påhlsson.
13
# Everything else is
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
15
15
#
16
16
# This program is free software: you can redistribute it and/or modify
17
17
# it under the terms of the GNU General Public License as published by
26
26
# You should have received a copy of the GNU General Public License
27
27
# along with this program. If not, see <http://www.gnu.org/licenses/>.
28
28
#
29
# Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
30
# <https://www.fukt.bsnet.se/~teddy/>.
29
# Contact the authors at <mandos@fukt.bsnet.se>.
31
30
#
32
31
33
32
from __future__ import division
62
61
from dbus.mainloop.glib import DBusGMainLoop
63
62
import ctypes
64
63
65
# Brief description of the operation of this program:
66
#
67
# This server announces itself as a Zeroconf service. Connecting
68
# clients use the TLS protocol, with the unusual quirk that this
69
# server program acts as a TLS "client" while the connecting clients
70
# acts as a TLS "server". The clients (acting as a TLS "server") must
71
# supply an OpenPGP certificate, and the fingerprint of this
72
# certificate is used by this server to look up (in a list read from a
73
# file at start time) which binary blob to give the client. No other
74
# authentication or authorization is done by this server.
75
76
64
77
65
logger = logging.Logger('mandos')
78
66
syslogger = logging.handlers.SysLogHandler\
82
70
logger.addHandler(syslogger)
83
71
del syslogger
84
72
85
# This variable is used to optionally bind to a specified interface.
86
# It is a global variable to fit in with the other variables from the
87
# Avahi example code.
88
serviceInterface = avahi.IF_UNSPEC
73
74
class AvahiError(Exception):
75
def __init__(self, value):
76
self.value = value
77
def __str__(self):
78
return repr(self.value)
79
80
class AvahiServiceError(AvahiError):
81
pass
82
83
class AvahiGroupError(AvahiError):
84
pass
85
86
87
class AvahiService(object):
88
"""An Avahi (Zeroconf) service.
89
Attributes:
90
interface: integer; avahi.IF_UNSPEC or an interface index.
91
Used to optionally bind to the specified interface.
92
name: string; Example: 'Mandos'
93
type: string; Example: '_mandos._tcp'.
94
See <http://www.dns-sd.org/ServiceTypes.html>
95
port: integer; what port to announce
96
TXT: list of strings; TXT record for the service
97
domain: string; Domain to publish on, default to .local if empty.
98
host: string; Host to publish records for, default is localhost
99
max_renames: integer; maximum number of renames
100
rename_count: integer; counter so we only rename after collisions
101
a sensible number of times
102
"""
103
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
104
type = None, port = None, TXT = None, domain = "",
105
host = "", max_renames = 12):
106
self.interface = interface
107
self.name = name
108
self.type = type
109
self.port = port
110
if TXT is None:
111
self.TXT = []
112
else:
113
self.TXT = TXT
114
self.domain = domain
115
self.host = host
116
self.rename_count = 0
117
def rename(self):
118
"""Derived from the Avahi example code"""
119
if self.rename_count >= self.max_renames:
120
logger.critical(u"No suitable service name found after %i"
121
u" retries, exiting.", rename_count)
122
raise AvahiServiceError("Too many renames")
123
name = server.GetAlternativeServiceName(name)
124
logger.error(u"Changing name to %r ...", name)
125
self.remove()
126
self.add()
127
self.rename_count += 1
128
def remove(self):
129
"""Derived from the Avahi example code"""
130
if group is not None:
131
group.Reset()
132
def add(self):
133
"""Derived from the Avahi example code"""
134
global group
135
if group is None:
136
group = dbus.Interface\
137
(bus.get_object(avahi.DBUS_NAME,
138
server.EntryGroupNew()),
139
avahi.DBUS_INTERFACE_ENTRY_GROUP)
140
group.connect_to_signal('StateChanged',
141
entry_group_state_changed)
142
logger.debug(u"Adding service '%s' of type '%s' ...",
143
service.name, service.type)
144
group.AddService(
145
self.interface, # interface
146
avahi.PROTO_INET6, # protocol
147
dbus.UInt32(0), # flags
148
self.name, self.type,
149
self.domain, self.host,
150
dbus.UInt16(self.port),
151
avahi.string_array_to_txt_array(self.TXT))
152
group.Commit()
153
89
154
# From the Avahi example code:
90
serviceName = None
91
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
92
servicePort = None # Not known at startup
93
serviceTXT = [] # TXT record for the service
94
domain = "" # Domain to publish on, default to .local
95
host = "" # Host to publish records for, default to localhost
96
group = None #our entry group
97
rename_count = 12 # Counter so we only rename after collisions a
98
# sensible number of times
155
group = None # our entry group
99
156
# End of Avahi example code
100
157
101
158
107
164
uniquely identify the client
108
165
secret: bytestring; sent verbatim (over TLS) to client
109
166
fqdn: string (FQDN); available for use by the checker command
110
created: datetime.datetime()
111
last_seen: datetime.datetime() or None if not yet seen
112
timeout: datetime.timedelta(); How long from last_seen until
113
this client is invalid
167
created: datetime.datetime(); object creation, not client host
168
last_checked_ok: datetime.datetime() or None if not yet checked OK
169
timeout: datetime.timedelta(); How long from last_checked_ok
170
until this client is invalid
114
171
interval: datetime.timedelta(); How often to start a new checker
115
172
stop_hook: If set, called by stop() as stop_hook(self)
116
173
checker: subprocess.Popen(); a running checker process used
117
174
to see if the client lives.
118
Is None if no process is running.
175
'None' if no process is running.
119
176
checker_initiator_tag: a gobject event source tag, or None
120
177
stop_initiator_tag: - '' -
121
178
checker_callback_tag: - '' -
122
179
checker_command: string; External command which is run to check if
123
client lives. %()s expansions are done at
180
client lives. %() expansions are done at
124
181
runtime with vars(self) as dict, so that for
125
182
instance %(name)s can be used in the command.
126
183
Private attibutes:
127
184
_timeout: Real variable for 'timeout'
128
185
_interval: Real variable for 'interval'
129
_timeout_milliseconds: Used by gobject.timeout_add()
186
_timeout_milliseconds: Used when calling gobject.timeout_add()
130
187
_interval_milliseconds: - '' -
131
188
"""
132
189
def _set_timeout(self, timeout):
152
209
interval = property(lambda self: self._interval,
153
210
_set_interval)
154
211
del _set_interval
155
def __init__(self, name=None, stop_hook=None, fingerprint=None,
156
secret=None, secfile=None, fqdn=None, timeout=None,
157
interval=-1, checker=None):
158
"""Note: the 'checker' argument sets the 'checker_command'
159
attribute and not the 'checker' attribute.."""
212
def __init__(self, name = None, stop_hook=None, config={}):
213
"""Note: the 'checker' key in 'config' sets the
214
'checker_command' attribute and *not* the 'checker'
215
attribute."""
160
216
self.name = name
161
217
logger.debug(u"Creating client %r", self.name)
162
# Uppercase and remove spaces from fingerprint
163
# for later comparison purposes with return value of
164
# the fingerprint() function
165
self.fingerprint = fingerprint.upper().replace(u" ", u"")
218
# Uppercase and remove spaces from fingerprint for later
219
# comparison purposes with return value from the fingerprint()
220
# function
221
self.fingerprint = config["fingerprint"].upper()\
222
.replace(u" ", u"")
166
223
logger.debug(u" Fingerprint: %s", self.fingerprint)
167
if secret:
168
self.secret = secret.decode(u"base64")
169
elif secfile:
170
sf = open(secfile)
224
if "secret" in config:
225
self.secret = config["secret"].decode(u"base64")
226
elif "secfile" in config:
227
sf = open(config["secfile"])
171
228
self.secret = sf.read()
172
229
sf.close()
173
230
else:
174
raise RuntimeError(u"No secret or secfile for client %s"
175
% self.name)
176
self.fqdn = fqdn # string
231
raise TypeError(u"No secret or secfile for client %s"
232
% self.name)
233
self.fqdn = config.get("fqdn", "")
177
234
self.created = datetime.datetime.now()
178
self.last_seen = None
179
self.timeout = string_to_delta(timeout)
180
self.interval = string_to_delta(interval)
235
self.last_checked_ok = None
236
self.timeout = string_to_delta(config["timeout"])
237
self.interval = string_to_delta(config["interval"])
181
238
self.stop_hook = stop_hook
182
239
self.checker = None
183
240
self.checker_initiator_tag = None
184
241
self.stop_initiator_tag = None
185
242
self.checker_callback_tag = None
186
self.check_command = checker
243
self.check_command = config["checker"]
187
244
def start(self):
188
245
"""Start this client's checker and timeout hooks"""
189
246
# Schedule a new checker to be started an 'interval' from now,
199
256
self.stop)
200
257
def stop(self):
201
258
"""Stop this client.
202
The possibility that this client might be restarted is left
203
open, but not currently used."""
259
The possibility that a client might be restarted is left open,
260
but not currently used."""
204
261
# If this client doesn't have a secret, it is already stopped.
205
262
if self.secret:
206
logger.debug(u"Stopping client %s", self.name)
263
logger.info(u"Stopping client %s", self.name)
207
264
self.secret = None
208
265
else:
209
266
return False
210
if hasattr(self, "stop_initiator_tag") \
211
and self.stop_initiator_tag:
267
if getattr(self, "stop_initiator_tag", False):
212
268
gobject.source_remove(self.stop_initiator_tag)
213
269
self.stop_initiator_tag = None
214
if hasattr(self, "checker_initiator_tag") \
215
and self.checker_initiator_tag:
270
if getattr(self, "checker_initiator_tag", False):
216
271
gobject.source_remove(self.checker_initiator_tag)
217
272
self.checker_initiator_tag = None
218
273
self.stop_checker()
230
285
self.checker = None
231
286
if os.WIFEXITED(condition) \
232
287
and (os.WEXITSTATUS(condition) == 0):
233
logger.debug(u"Checker for %(name)s succeeded",
234
vars(self))
235
self.last_seen = now
288
logger.info(u"Checker for %(name)s succeeded",
289
vars(self))
290
self.last_checked_ok = now
236
291
gobject.source_remove(self.stop_initiator_tag)
237
292
self.stop_initiator_tag = gobject.timeout_add\
238
293
(self._timeout_milliseconds,
241
296
logger.warning(u"Checker for %(name)s crashed?",
242
297
vars(self))
243
298
else:
244
logger.debug(u"Checker for %(name)s failed",
245
vars(self))
299
logger.info(u"Checker for %(name)s failed",
300
vars(self))
246
301
def start_checker(self):
247
302
"""Start a new checker subprocess if one is not running.
248
303
If a checker already exists, leave it running and do
257
312
# is as it should be.
258
313
if self.checker is None:
259
314
try:
315
# In case check_command has exactly one % operator
260
316
command = self.check_command % self.fqdn
261
317
except TypeError:
318
# Escape attributes for the shell
262
319
escaped_attrs = dict((key, re.escape(str(val)))
263
320
for key, val in
264
321
vars(self).iteritems())
265
322
try:
266
323
command = self.check_command % escaped_attrs
267
324
except TypeError, error:
268
logger.critical(u'Could not format string "%s":'
269
u' %s', self.check_command, error)
325
logger.error(u'Could not format string "%s":'
326
u' %s', self.check_command, error)
270
327
return True # Try again later
271
328
try:
272
logger.debug(u"Starting checker %r for %s",
273
command, self.name)
274
self.checker = subprocess.\
275
Popen(command,
276
close_fds=True, shell=True,
277
cwd="/")
329
logger.info(u"Starting checker %r for %s",
330
command, self.name)
331
self.checker = subprocess.Popen(command,
332
close_fds=True,
333
shell=True, cwd="/")
278
334
self.checker_callback_tag = gobject.child_watch_add\
279
335
(self.checker.pid,
280
336
self.checker_callback)
288
344
if self.checker_callback_tag:
289
345
gobject.source_remove(self.checker_callback_tag)
290
346
self.checker_callback_tag = None
291
if not hasattr(self, "checker") or self.checker is None:
347
if getattr(self, "checker", None) is None:
292
348
return
293
349
logger.debug("Stopping checker for %(name)s", vars(self))
294
350
try:
297
353
#if self.checker.poll() is None:
298
354
# os.kill(self.checker.pid, signal.SIGKILL)
299
355
except OSError, error:
300
if error.errno != errno.ESRCH:
356
if error.errno != errno.ESRCH: # No such process
301
357
raise
302
358
self.checker = None
303
def still_valid(self, now=None):
359
def still_valid(self):
304
360
"""Has the timeout not yet passed for this client?"""
305
if now is None:
306
now = datetime.datetime.now()
307
if self.last_seen is None:
361
now = datetime.datetime.now()
362
if self.last_checked_ok is None:
308
363
return now < (self.created + self.timeout)
309
364
else:
310
return now < (self.last_seen + self.timeout)
365
return now < (self.last_checked_ok + self.timeout)
311
366
312
367
313
368
def peer_certificate(session):
329
384
330
385
def fingerprint(openpgp):
331
386
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
332
# New empty GnuTLS certificate
333
crt = gnutls.library.types.gnutls_openpgp_crt_t()
334
gnutls.library.functions.gnutls_openpgp_crt_init\
335
(ctypes.byref(crt))
336
387
# New GnuTLS "datum" with the OpenPGP public key
337
388
datum = gnutls.library.types.gnutls_datum_t\
338
389
(ctypes.cast(ctypes.c_char_p(openpgp),
339
390
ctypes.POINTER(ctypes.c_ubyte)),
340
391
ctypes.c_uint(len(openpgp)))
392
# New empty GnuTLS certificate
393
crt = gnutls.library.types.gnutls_openpgp_crt_t()
394
gnutls.library.functions.gnutls_openpgp_crt_init\
395
(ctypes.byref(crt))
341
396
# Import the OpenPGP public key into the certificate
342
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
343
(crt,
344
ctypes.byref(datum),
345
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
397
gnutls.library.functions.gnutls_openpgp_crt_import\
398
(crt, ctypes.byref(datum),
399
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
346
400
# New buffer for the fingerprint
347
401
buffer = ctypes.create_string_buffer(20)
348
402
buffer_length = ctypes.c_size_t()
364
418
Note: This will run in its own forked process."""
365
419
366
420
def handle(self):
367
logger.debug(u"TCP connection from: %s",
421
logger.info(u"TCP connection from: %s",
368
422
unicode(self.client_address))
369
session = gnutls.connection.ClientSession(self.request,
370
gnutls.connection.\
371
X509Credentials())
423
session = gnutls.connection.ClientSession\
424
(self.request, gnutls.connection.X509Credentials())
425
426
line = self.request.makefile().readline()
427
logger.debug(u"Protocol version: %r", line)
428
try:
429
if int(line.strip().split()[0]) > 1:
430
raise RuntimeError
431
except (ValueError, IndexError, RuntimeError), error:
432
logger.error(u"Unknown protocol version: %s", error)
433
return
434
435
# Note: gnutls.connection.X509Credentials is really a generic
436
# GnuTLS certificate credentials object so long as no X.509
437
# keys are added to it. Therefore, we can use it here despite
438
# using OpenPGP certificates.
372
439
373
440
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
374
441
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
375
442
# "+DHE-DSS"))
376
priority = "NORMAL"
377
if self.server.options.priority:
378
priority = self.server.options.priority
443
priority = "NORMAL" # Fallback default, since this
444
# MUST be set.
445
if self.server.settings["priority"]:
446
priority = self.server.settings["priority"]
379
447
gnutls.library.functions.gnutls_priority_set_direct\
380
448
(session._c_object, priority, None);
381
449
382
450
try:
383
451
session.handshake()
384
452
except gnutls.errors.GNUTLSError, error:
385
logger.debug(u"Handshake failed: %s", error)
453
logger.warning(u"Handshake failed: %s", error)
386
454
# Do not run session.bye() here: the session is not
387
455
# established. Just abandon the request.
388
456
return
389
457
try:
390
458
fpr = fingerprint(peer_certificate(session))
391
459
except (TypeError, gnutls.errors.GNUTLSError), error:
392
logger.debug(u"Bad certificate: %s", error)
460
logger.warning(u"Bad certificate: %s", error)
393
461
session.bye()
394
462
return
395
463
logger.debug(u"Fingerprint: %s", fpr)
398
466
if c.fingerprint == fpr:
399
467
client = c
400
468
break
469
if not client:
470
logger.warning(u"Client not found for fingerprint: %s",
471
fpr)
472
session.bye()
473
return
401
474
# Have to check if client.still_valid(), since it is possible
402
475
# that the client timed out while establishing the GnuTLS
403
476
# session.
404
if (not client) or (not client.still_valid()):
405
if client:
406
logger.debug(u"Client %(name)s is invalid",
407
vars(client))
408
else:
409
logger.debug(u"Client not found for fingerprint: %s",
410
fpr)
477
if not client.still_valid():
478
logger.warning(u"Client %(name)s is invalid",
479
vars(client))
411
480
session.bye()
412
481
return
413
482
sent_size = 0
423
492
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
424
493
"""IPv6 TCP server. Accepts 'None' as address and/or port.
425
494
Attributes:
426
options: Command line options
495
settings: Server settings
427
496
clients: Set() of Client objects
428
497
"""
429
498
address_family = socket.AF_INET6
430
499
def __init__(self, *args, **kwargs):
431
if "options" in kwargs:
432
self.options = kwargs["options"]
433
del kwargs["options"]
500
if "settings" in kwargs:
501
self.settings = kwargs["settings"]
502
del kwargs["settings"]
434
503
if "clients" in kwargs:
435
504
self.clients = kwargs["clients"]
436
505
del kwargs["clients"]
439
508
"""This overrides the normal server_bind() function
440
509
to bind to an interface if one was specified, and also NOT to
441
510
bind to an address or port if they were not specified."""
442
if self.options.interface:
443
if not hasattr(socket, "SO_BINDTODEVICE"):
444
# From /usr/include/asm-i486/socket.h
445
socket.SO_BINDTODEVICE = 25
511
if self.settings["interface"]:
512
# 25 is from /usr/include/asm-i486/socket.h
513
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
446
514
try:
447
515
self.socket.setsockopt(socket.SOL_SOCKET,
448
socket.SO_BINDTODEVICE,
449
self.options.interface)
516
SO_BINDTODEVICE,
517
self.settings["interface"])
450
518
except socket.error, error:
451
519
if error[0] == errno.EPERM:
452
logger.warning(u"No permission to"
453
u" bind to interface %s",
454
self.options.interface)
520
logger.error(u"No permission to"
521
u" bind to interface %s",
522
self.settings["interface"])
455
523
else:
456
524
raise error
457
525
# Only bind(2) the socket if we really need to.
500
568
return delta
501
569
502
570
503
def add_service():
504
"""Derived from the Avahi example code"""
505
global group, serviceName, serviceType, servicePort, serviceTXT, \
506
domain, host
507
if group is None:
508
group = dbus.Interface(
509
bus.get_object( avahi.DBUS_NAME,
510
server.EntryGroupNew()),
511
avahi.DBUS_INTERFACE_ENTRY_GROUP)
512
group.connect_to_signal('StateChanged',
513
entry_group_state_changed)
514
logger.debug(u"Adding service '%s' of type '%s' ...",
515
serviceName, serviceType)
516
517
group.AddService(
518
serviceInterface, # interface
519
avahi.PROTO_INET6, # protocol
520
dbus.UInt32(0), # flags
521
serviceName, serviceType,
522
domain, host,
523
dbus.UInt16(servicePort),
524
avahi.string_array_to_txt_array(serviceTXT))
525
group.Commit()
526
527
528
def remove_service():
529
"""From the Avahi example code"""
530
global group
531
532
if not group is None:
533
group.Reset()
534
535
536
571
def server_state_changed(state):
537
572
"""Derived from the Avahi example code"""
538
573
if state == avahi.SERVER_COLLISION:
539
logger.warning(u"Server name collision")
540
remove_service()
574
logger.error(u"Server name collision")
575
service.remove()
541
576
elif state == avahi.SERVER_RUNNING:
542
add_service()
577
service.add()
543
578
544
579
545
580
def entry_group_state_changed(state, error):
546
581
"""Derived from the Avahi example code"""
547
global serviceName, server, rename_count
548
549
582
logger.debug(u"state change: %i", state)
550
583
551
584
if state == avahi.ENTRY_GROUP_ESTABLISHED:
552
585
logger.debug(u"Service established.")
553
586
elif state == avahi.ENTRY_GROUP_COLLISION:
554
555
rename_count = rename_count - 1
556
if rename_count > 0:
557
name = server.GetAlternativeServiceName(name)
558
logger.warning(u"Service name collision, "
559
u"changing name to '%s' ...", name)
560
remove_service()
561
add_service()
562
563
else:
564
logger.error(u"No suitable service name found after %i"
565
u" retries, exiting.", n_rename)
566
killme(1)
587
logger.warning(u"Service name collision.")
588
service.rename()
567
589
elif state == avahi.ENTRY_GROUP_FAILURE:
568
logger.error(u"Error in group state changed %s",
569
unicode(error))
570
killme(1)
571
590
logger.critical(u"Error in group state changed %s",
591
unicode(error))
592
raise AvahiGroupError("State changed: %s", str(error))
572
593
573
594
def if_nametoindex(interface):
574
"""Call the C function if_nametoindex()"""
595
"""Call the C function if_nametoindex(), or equivalent"""
596
global if_nametoindex
575
597
try:
576
libc = ctypes.cdll.LoadLibrary("libc.so.6")
577
return libc.if_nametoindex(interface)
598
if "ctypes.util" not in sys.modules:
599
import ctypes.util
600
if_nametoindex = ctypes.cdll.LoadLibrary\
601
(ctypes.util.find_library("c")).if_nametoindex
578
602
except (OSError, AttributeError):
579
603
if "struct" not in sys.modules:
580
604
import struct
581
605
if "fcntl" not in sys.modules:
582
606
import fcntl
583
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
584
s = socket.socket()
585
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
586
struct.pack("16s16x", interface))
587
s.close()
588
interface_index = struct.unpack("I", ifreq[16:20])[0]
589
return interface_index
607
def if_nametoindex(interface):
608
"Get an interface index the hard way, i.e. using fcntl()"
609
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
610
s = socket.socket()
611
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
612
struct.pack("16s16x", interface))
613
s.close()
614
interface_index = struct.unpack("I", ifreq[16:20])[0]
615
return interface_index
616
return if_nametoindex(interface)
590
617
591
618
592
619
def daemon(nochdir, noclose):
597
624
os.setsid()
598
625
if not nochdir:
599
626
os.chdir("/")
627
if os.fork():
628
sys.exit()
600
629
if not noclose:
601
630
# Close all standard open file descriptors
602
null = os.open("/dev/null", os.O_NOCTTY | os.O_RDWR)
631
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
603
632
if not stat.S_ISCHR(os.fstat(null).st_mode):
604
633
raise OSError(errno.ENODEV,
605
634
"/dev/null not a character device")
610
639
os.close(null)
611
640
612
641
613
def killme(status = 0):
614
logger.debug("Stopping server with exit status %d", status)
615
exitstatus = status
616
if main_loop_started:
617
main_loop.quit()
618
else:
619
sys.exit(status)
620
621
622
642
def main():
623
global exitstatus
624
exitstatus = 0
625
643
global main_loop_started
626
644
main_loop_started = False
627
645
628
646
parser = OptionParser()
629
647
parser.add_option("-i", "--interface", type="string",
630
default=None, metavar="IF",
631
help="Bind to interface IF")
632
parser.add_option("-a", "--address", type="string", default=None,
648
metavar="IF", help="Bind to interface IF")
649
parser.add_option("-a", "--address", type="string",
633
650
help="Address to listen for requests on")
634
parser.add_option("-p", "--port", type="int", default=None,
651
parser.add_option("-p", "--port", type="int",
635
652
help="Port number to receive requests on")
636
653
parser.add_option("--check", action="store_true", default=False,
637
654
help="Run self-test")
638
655
parser.add_option("--debug", action="store_true", default=False,
639
help="Debug mode")
640
parser.add_option("--priority", type="string",
641
default="SECURE256",
642
help="GnuTLS priority string"
643
" (see GnuTLS documentation)")
644
parser.add_option("--servicename", type="string",
645
default="Mandos", help="Zeroconf service name")
656
help="Debug mode; run in foreground and log to"
657
" terminal")
658
parser.add_option("--priority", type="string", help="GnuTLS"
659
" priority string (see GnuTLS documentation)")
660
parser.add_option("--servicename", type="string", metavar="NAME",
661
help="Zeroconf service name")
662
parser.add_option("--configdir", type="string",
663
default="/etc/mandos", metavar="DIR",
664
help="Directory to search for configuration"
665
" files")
646
666
(options, args) = parser.parse_args()
647
667
648
668
if options.check:
650
670
doctest.testmod()
651
671
sys.exit()
652
672
653
# Parse config file
654
defaults = { "timeout": "1h",
655
"interval": "5m",
656
"checker": "fping -q -- %%(fqdn)s",
657
}
658
client_config = ConfigParser.SafeConfigParser(defaults)
659
#client_config.readfp(open("global.conf"), "global.conf")
660
client_config.read("mandos-clients.conf")
661
662
global serviceName
663
serviceName = options.servicename;
673
# Default values for config file for server-global settings
674
server_defaults = { "interface": "",
675
"address": "",
676
"port": "",
677
"debug": "False",
678
"priority":
679
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
680
"servicename": "Mandos",
681
}
682
683
# Parse config file for server-global settings
684
server_config = ConfigParser.SafeConfigParser(server_defaults)
685
del server_defaults
686
server_config.read(os.path.join(options.configdir, "server.conf"))
687
server_section = "server"
688
# Convert the SafeConfigParser object to a dict
689
server_settings = dict(server_config.items(server_section))
690
# Use getboolean on the boolean config option
691
server_settings["debug"] = server_config.getboolean\
692
(server_section, "debug")
693
del server_config
694
695
# Override the settings from the config file with command line
696
# options, if set.
697
for option in ("interface", "address", "port", "debug",
698
"priority", "servicename", "configdir"):
699
value = getattr(options, option)
700
if value is not None:
701
server_settings[option] = value
702
del options
703
# Now we have our good server settings in "server_settings"
704
705
# Parse config file with clients
706
client_defaults = { "timeout": "1h",
707
"interval": "5m",
708
"checker": "fping -q -- %%(fqdn)s",
709
}
710
client_config = ConfigParser.SafeConfigParser(client_defaults)
711
client_config.read(os.path.join(server_settings["configdir"],
712
"clients.conf"))
713
714
global service
715
service = AvahiService(name = server_settings["servicename"],
716
type = "_mandos._tcp", );
717
if server_settings["interface"]:
718
service.interface = if_nametoindex(server_settings["interface"])
664
719
665
720
global main_loop
666
721
global bus
674
729
avahi.DBUS_INTERFACE_SERVER )
675
730
# End of Avahi example code
676
731
677
debug = options.debug
732
debug = server_settings["debug"]
678
733
679
734
if debug:
680
735
console = logging.StreamHandler()
688
743
def remove_from_clients(client):
689
744
clients.remove(client)
690
745
if not clients:
691
logger.debug(u"No clients left, exiting")
692
killme()
746
logger.critical(u"No clients left, exiting")
747
sys.exit()
693
748
694
clients.update(Set(Client(name=section,
749
clients.update(Set(Client(name = section,
695
750
stop_hook = remove_from_clients,
696
**(dict(client_config\
697
.items(section))))
751
config
752
= dict(client_config.items(section)))
698
753
for section in client_config.sections()))
699
754
700
755
if not debug:
718
773
719
774
if not debug:
720
775
signal.signal(signal.SIGINT, signal.SIG_IGN)
721
signal.signal(signal.SIGHUP, lambda signum, frame: killme())
722
signal.signal(signal.SIGTERM, lambda signum, frame: killme())
776
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
777
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
723
778
724
779
for client in clients:
725
780
client.start()
726
781
727
tcp_server = IPv6_TCPServer((options.address, options.port),
782
tcp_server = IPv6_TCPServer((server_settings["address"],
783
server_settings["port"]),
728
784
tcp_handler,
729
options=options,
785
settings=server_settings,
730
786
clients=clients)
731
# Find out what random port we got
732
global servicePort
733
servicePort = tcp_server.socket.getsockname()[1]
734
logger.debug(u"Now listening on port %d", servicePort)
735
736
if options.interface is not None:
737
global serviceInterface
738
serviceInterface = if_nametoindex(options.interface)
739
740
# From the Avahi example code
741
server.connect_to_signal("StateChanged", server_state_changed)
742
try:
743
server_state_changed(server.GetState())
744
except dbus.exceptions.DBusException, error:
745
logger.critical(u"DBusException: %s", error)
746
killme(1)
747
# End of Avahi example code
748
749
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
750
lambda *args, **kwargs:
751
tcp_server.handle_request(*args[2:],
752
**kwargs) or True)
753
try:
787
# Find out what port we got
788
service.port = tcp_server.socket.getsockname()[1]
789
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
790
u" scope_id %d" % tcp_server.socket.getsockname())
791
792
#service.interface = tcp_server.socket.getsockname()[3]
793
794
try:
795
# From the Avahi example code
796
server.connect_to_signal("StateChanged", server_state_changed)
797
try:
798
server_state_changed(server.GetState())
799
except dbus.exceptions.DBusException, error:
800
logger.critical(u"DBusException: %s", error)
801
sys.exit(1)
802
# End of Avahi example code
803
804
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
805
lambda *args, **kwargs:
806
tcp_server.handle_request\
807
(*args[2:], **kwargs) or True)
808
754
809
logger.debug("Starting main loop")
755
810
main_loop_started = True
756
811
main_loop.run()
812
except AvahiError, error:
813
logger.critical(u"AvahiError: %s" + unicode(error))
814
sys.exit(1)
757
815
except KeyboardInterrupt:
758
816
if debug:
759
817
print
760
761
sys.exit(exitstatus)
762
818
763
819
if __name__ == '__main__':
764
820
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0