/mandos/trunk : revision 47

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add" and "remove" in the "AvahiService" class, the

10

# "server_state_changed" and "entry_group_state_changed" functions,

11

# and some lines in "main".

12

#

13

# Everything else is

14

15

#

16

# This program is free software: you can redistribute it and/or modify

17

# it under the terms of the GNU General Public License as published by

18

# the Free Software Foundation, either version 3 of the License, or

19

# (at your option) any later version.

20

#

21

# This program is distributed in the hope that it will be useful,

22

# but WITHOUT ANY WARRANTY; without even the implied warranty of

23

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

24

# GNU General Public License for more details.

25

#

26

# You should have received a copy of the GNU General Public License

27

# along with this program. If not, see <http://www.gnu.org/licenses/>.

28

#

29

# Contact the authors at <mandos@fukt.bsnet.se>.

30

#

31

32

from __future__ import division

33

34

import SocketServer

35

import socket

36

import select

37

from optparse import OptionParser

38

import datetime

39

import errno

40

import gnutls.crypto

41

import gnutls.connection

42

import gnutls.errors

43

import gnutls.library.functions

44

import gnutls.library.constants

45

import gnutls.library.types

46

import ConfigParser

47

import sys

48

import re

49

import os

50

import signal

51

from sets import Set

52

import subprocess

53

import atexit

54

import stat

55

import logging

56

import logging.handlers

57

58

import dbus

59

import gobject

60

import avahi

61

from dbus.mainloop.glib import DBusGMainLoop

62

import ctypes

63

64

65

logger = logging.Logger('mandos')

66

syslogger = logging.handlers.SysLogHandler\

67

(facility = logging.handlers.SysLogHandler.LOG_DAEMON)

68

syslogger.setFormatter(logging.Formatter\

69

('%(levelname)s: %(message)s'))

70

logger.addHandler(syslogger)

71

del syslogger

72

73

74

class AvahiError(Exception):

75

def __init__(self, value):

76

self.value = value

77

def __str__(self):

78

return repr(self.value)

79

80

class AvahiServiceError(AvahiError):

81

pass

82

83

class AvahiGroupError(AvahiError):

84

pass

85

86

87

class AvahiService(object):

88

"""An Avahi (Zeroconf) service.

89

Attributes:

90

interface: integer; avahi.IF_UNSPEC or an interface index.

91

Used to optionally bind to the specified interface.

92

name: string; Example: 'Mandos'

93

type: string; Example: '_mandos._tcp'.

94

See <http://www.dns-sd.org/ServiceTypes.html>

95

port: integer; what port to announce

96

TXT: list of strings; TXT record for the service

97

domain: string; Domain to publish on, default to .local if empty.

98

host: string; Host to publish records for, default is localhost

99

max_renames: integer; maximum number of renames

100

rename_count: integer; counter so we only rename after collisions

101

a sensible number of times

102

"""

103

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

104

type = None, port = None, TXT = None, domain = "",

105

host = "", max_renames = 12):

106

self.interface = interface

107

self.name = name

108

self.type = type

109

self.port = port

110

if TXT is None:

111

self.TXT = []

112

else:

113

self.TXT = TXT

114

self.domain = domain

115

self.host = host

116

self.rename_count = 0

117

def rename(self):

118

"""Derived from the Avahi example code"""

119

if self.rename_count >= self.max_renames:

120

logger.critical(u"No suitable service name found after %i"

121

u" retries, exiting.", rename_count)

122

raise AvahiServiceError("Too many renames")

123

name = server.GetAlternativeServiceName(name)

124

logger.error(u"Changing name to %r ...", name)

125

self.remove()

126

self.add()

127

self.rename_count += 1

128

def remove(self):

129

"""Derived from the Avahi example code"""

130

if group is not None:

131

group.Reset()

132

def add(self):

133

"""Derived from the Avahi example code"""

134

global group

135

if group is None:

136

group = dbus.Interface\

137

(bus.get_object(avahi.DBUS_NAME,

138

server.EntryGroupNew()),

139

avahi.DBUS_INTERFACE_ENTRY_GROUP)

140

group.connect_to_signal('StateChanged',

141

entry_group_state_changed)

142

logger.debug(u"Adding service '%s' of type '%s' ...",

143

service.name, service.type)

144

group.AddService(

145

self.interface, # interface

146

avahi.PROTO_INET6, # protocol

147

dbus.UInt32(0), # flags

148

self.name, self.type,

149

self.domain, self.host,

150

dbus.UInt16(self.port),

151

avahi.string_array_to_txt_array(self.TXT))

152

group.Commit()

153

154

# From the Avahi example code:

155

group = None # our entry group

156

# End of Avahi example code

157

158

159

class Client(object):

160

"""A representation of a client host served by this server.

161

Attributes:

162

name: string; from the config file, used in log messages

163

fingerprint: string (40 or 32 hexadecimal digits); used to

164

uniquely identify the client

165

secret: bytestring; sent verbatim (over TLS) to client

166

fqdn: string (FQDN); available for use by the checker command

167

created: datetime.datetime(); object creation, not client host

168

last_checked_ok: datetime.datetime() or None if not yet checked OK

169

timeout: datetime.timedelta(); How long from last_checked_ok

170

until this client is invalid

171

interval: datetime.timedelta(); How often to start a new checker

172

stop_hook: If set, called by stop() as stop_hook(self)

173

checker: subprocess.Popen(); a running checker process used

174

to see if the client lives.

175

'None' if no process is running.

176

checker_initiator_tag: a gobject event source tag, or None

177

stop_initiator_tag: - '' -

178

checker_callback_tag: - '' -

179

checker_command: string; External command which is run to check if

180

client lives. %() expansions are done at

181

runtime with vars(self) as dict, so that for

182

instance %(name)s can be used in the command.

183

Private attibutes:

184

_timeout: Real variable for 'timeout'

185

_interval: Real variable for 'interval'

186

_timeout_milliseconds: Used when calling gobject.timeout_add()

187

_interval_milliseconds: - '' -

188

"""

189

def _set_timeout(self, timeout):

190

"Setter function for 'timeout' attribute"

191

self._timeout = timeout

192

self._timeout_milliseconds = ((self.timeout.days

193

* 24 * 60 * 60 * 1000)

194

+ (self.timeout.seconds * 1000)

195

+ (self.timeout.microseconds

196

// 1000))

197

timeout = property(lambda self: self._timeout,

198

_set_timeout)

199

del _set_timeout

200

def _set_interval(self, interval):

201

"Setter function for 'interval' attribute"

202

self._interval = interval

203

self._interval_milliseconds = ((self.interval.days

204

* 24 * 60 * 60 * 1000)

205

+ (self.interval.seconds

206

* 1000)

207

+ (self.interval.microseconds

208

// 1000))

209

interval = property(lambda self: self._interval,

210

_set_interval)

211

del _set_interval

212

def __init__(self, name = None, stop_hook=None, config={}):

213

"""Note: the 'checker' key in 'config' sets the

214

'checker_command' attribute and *not* the 'checker'

215

attribute."""

216

self.name = name

217

logger.debug(u"Creating client %r", self.name)

218

# Uppercase and remove spaces from fingerprint for later

219

# comparison purposes with return value from the fingerprint()

220

# function

221

self.fingerprint = config["fingerprint"].upper()\

222

.replace(u" ", u"")

223

logger.debug(u" Fingerprint: %s", self.fingerprint)

224

if "secret" in config:

225

self.secret = config["secret"].decode(u"base64")

226

elif "secfile" in config:

227

sf = open(config["secfile"])

228

self.secret = sf.read()

229

sf.close()

230

else:

231

raise TypeError(u"No secret or secfile for client %s"

232

% self.name)

233

self.fqdn = config.get("fqdn", "")

234

self.created = datetime.datetime.now()

235

self.last_checked_ok = None

236

self.timeout = string_to_delta(config["timeout"])

237

self.interval = string_to_delta(config["interval"])

238

self.stop_hook = stop_hook

239

self.checker = None

240

self.checker_initiator_tag = None

241

self.stop_initiator_tag = None

242

self.checker_callback_tag = None

243

self.check_command = config["checker"]

244

def start(self):

245

"""Start this client's checker and timeout hooks"""

246

# Schedule a new checker to be started an 'interval' from now,

247

# and every interval from then on.

248

self.checker_initiator_tag = gobject.timeout_add\

249

(self._interval_milliseconds,

250

self.start_checker)

251

# Also start a new checker *right now*.

252

self.start_checker()

253

# Schedule a stop() when 'timeout' has passed

254

self.stop_initiator_tag = gobject.timeout_add\

255

(self._timeout_milliseconds,

256

self.stop)

257

def stop(self):

258

"""Stop this client.

259

The possibility that a client might be restarted is left open,

260

but not currently used."""

261

# If this client doesn't have a secret, it is already stopped.

262

if self.secret:

263

logger.info(u"Stopping client %s", self.name)

264

self.secret = None

265

else:

266

return False

267

if getattr(self, "stop_initiator_tag", False):

268

gobject.source_remove(self.stop_initiator_tag)

269

self.stop_initiator_tag = None

270

if getattr(self, "checker_initiator_tag", False):

271

gobject.source_remove(self.checker_initiator_tag)

272

self.checker_initiator_tag = None

273

self.stop_checker()

274

if self.stop_hook:

275

self.stop_hook(self)

276

# Do not run this again if called by a gobject.timeout_add

277

return False

278

def __del__(self):

279

self.stop_hook = None

280

self.stop()

281

def checker_callback(self, pid, condition):

282

"""The checker has completed, so take appropriate actions."""

283

now = datetime.datetime.now()

284

self.checker_callback_tag = None

285

self.checker = None

286

if os.WIFEXITED(condition) \

287

and (os.WEXITSTATUS(condition) == 0):

288

logger.info(u"Checker for %(name)s succeeded",

289

vars(self))

290

self.last_checked_ok = now

291

gobject.source_remove(self.stop_initiator_tag)

292

self.stop_initiator_tag = gobject.timeout_add\

293

(self._timeout_milliseconds,

294

self.stop)

295

elif not os.WIFEXITED(condition):

296

logger.warning(u"Checker for %(name)s crashed?",

297

vars(self))

298

else:

299

logger.info(u"Checker for %(name)s failed",

300

vars(self))

301

def start_checker(self):

302

"""Start a new checker subprocess if one is not running.

303

If a checker already exists, leave it running and do

304

nothing."""

305

# The reason for not killing a running checker is that if we

306

# did that, then if a checker (for some reason) started

307

# running slowly and taking more than 'interval' time, the

308

# client would inevitably timeout, since no checker would get

309

# a chance to run to completion. If we instead leave running

310

# checkers alone, the checker would have to take more time

311

# than 'timeout' for the client to be declared invalid, which

312

# is as it should be.

313

if self.checker is None:

314

try:

315

# In case check_command has exactly one % operator

316

command = self.check_command % self.fqdn

317

except TypeError:

318

# Escape attributes for the shell

319

escaped_attrs = dict((key, re.escape(str(val)))

320

for key, val in

321

vars(self).iteritems())

322

try:

323

command = self.check_command % escaped_attrs

324

except TypeError, error:

325

logger.error(u'Could not format string "%s":'

326

u' %s', self.check_command, error)

327

return True # Try again later

328

try:

329

logger.info(u"Starting checker %r for %s",

330

command, self.name)

331

self.checker = subprocess.Popen(command,

332

close_fds=True,

333

shell=True, cwd="/")

334

self.checker_callback_tag = gobject.child_watch_add\

335

(self.checker.pid,

336

self.checker_callback)

337

except subprocess.OSError, error:

338

logger.error(u"Failed to start subprocess: %s",

339

error)

340

# Re-run this periodically if run by gobject.timeout_add

341

return True

342

def stop_checker(self):

343

"""Force the checker process, if any, to stop."""

344

if self.checker_callback_tag:

345

gobject.source_remove(self.checker_callback_tag)

346

self.checker_callback_tag = None

347

if getattr(self, "checker", None) is None:

348

return

349

logger.debug("Stopping checker for %(name)s", vars(self))

350

try:

351

os.kill(self.checker.pid, signal.SIGTERM)

352

#os.sleep(0.5)

353

#if self.checker.poll() is None:

354

# os.kill(self.checker.pid, signal.SIGKILL)

355

except OSError, error:

356

if error.errno != errno.ESRCH: # No such process

357

raise

358

self.checker = None

359

def still_valid(self):

360

"""Has the timeout not yet passed for this client?"""

361

now = datetime.datetime.now()

362

if self.last_checked_ok is None:

363

return now < (self.created + self.timeout)

364

else:

365

return now < (self.last_checked_ok + self.timeout)

366

367

368

def peer_certificate(session):

369

"Return the peer's OpenPGP certificate as a bytestring"

370

# If not an OpenPGP certificate...

371

if gnutls.library.functions.gnutls_certificate_type_get\

372

(session._c_object) \

373

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:

374

# ...do the normal thing

375

return session.peer_certificate

376

list_size = ctypes.c_uint()

377

cert_list = gnutls.library.functions.gnutls_certificate_get_peers\

378

(session._c_object, ctypes.byref(list_size))

379

if list_size.value == 0:

380

return None

381

cert = cert_list[0]

382

return ctypes.string_at(cert.data, cert.size)

383

384

385

def fingerprint(openpgp):

386

"Convert an OpenPGP bytestring to a hexdigit fingerprint string"

387

# New GnuTLS "datum" with the OpenPGP public key

388

datum = gnutls.library.types.gnutls_datum_t\

389

(ctypes.cast(ctypes.c_char_p(openpgp),

390

ctypes.POINTER(ctypes.c_ubyte)),

391

ctypes.c_uint(len(openpgp)))

392

# New empty GnuTLS certificate

393

crt = gnutls.library.types.gnutls_openpgp_crt_t()

394

gnutls.library.functions.gnutls_openpgp_crt_init\

395

(ctypes.byref(crt))

396

# Import the OpenPGP public key into the certificate

397

gnutls.library.functions.gnutls_openpgp_crt_import\

398

(crt, ctypes.byref(datum),

399

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

400

# New buffer for the fingerprint

401

buffer = ctypes.create_string_buffer(20)

402

buffer_length = ctypes.c_size_t()

403

# Get the fingerprint from the certificate into the buffer

404

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\

405

(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))

406

# Deinit the certificate

407

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

408

# Convert the buffer to a Python bytestring

409

fpr = ctypes.string_at(buffer, buffer_length.value)

410

# Convert the bytestring to hexadecimal notation

411

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

412

return hex_fpr

413

414

415

class tcp_handler(SocketServer.BaseRequestHandler, object):

416

"""A TCP request handler class.

417

Instantiated by IPv6_TCPServer for each request to handle it.

418

Note: This will run in its own forked process."""

419

420

def handle(self):

421

logger.info(u"TCP connection from: %s",

422

unicode(self.client_address))

423

session = gnutls.connection.ClientSession\

424

(self.request, gnutls.connection.X509Credentials())

425

426

line = self.request.makefile().readline()

427

logger.debug(u"Protocol version: %r", line)

428

try:

429

if int(line.strip().split()[0]) > 1:

430

raise RuntimeError

431

except (ValueError, IndexError, RuntimeError), error:

432

logger.error(u"Unknown protocol version: %s", error)

433

return

434

435

# Note: gnutls.connection.X509Credentials is really a generic

436

# GnuTLS certificate credentials object so long as no X.509

437

# keys are added to it. Therefore, we can use it here despite

438

# using OpenPGP certificates.

439

440

#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",

441

# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",

442

# "+DHE-DSS"))

443

priority = "NORMAL" # Fallback default, since this

444

# MUST be set.

445

if self.server.settings["priority"]:

446

priority = self.server.settings["priority"]

447

gnutls.library.functions.gnutls_priority_set_direct\

448

(session._c_object, priority, None);

449

450

try:

451

session.handshake()

452

except gnutls.errors.GNUTLSError, error:

453

logger.warning(u"Handshake failed: %s", error)

454

# Do not run session.bye() here: the session is not

455

# established. Just abandon the request.

456

return

457

try:

458

fpr = fingerprint(peer_certificate(session))

459

except (TypeError, gnutls.errors.GNUTLSError), error:

460

logger.warning(u"Bad certificate: %s", error)

461

session.bye()

462

return

463

logger.debug(u"Fingerprint: %s", fpr)

464

client = None

465

for c in self.server.clients:

466

if c.fingerprint == fpr:

467

client = c

468

break

469

if not client:

470

logger.warning(u"Client not found for fingerprint: %s",

471

fpr)

472

session.bye()

473

return

474

# Have to check if client.still_valid(), since it is possible

475

# that the client timed out while establishing the GnuTLS

476

# session.

477

if not client.still_valid():

478

logger.warning(u"Client %(name)s is invalid",

479

vars(client))

480

session.bye()

481

return

482

sent_size = 0

483

while sent_size < len(client.secret):

484

sent = session.send(client.secret[sent_size:])

485

logger.debug(u"Sent: %d, remaining: %d",

486

sent, len(client.secret)

487

- (sent_size + sent))

488

sent_size += sent

489

session.bye()

490

491

492

class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):

493

"""IPv6 TCP server. Accepts 'None' as address and/or port.

494

Attributes:

495

settings: Server settings

496

clients: Set() of Client objects

497

"""

498

address_family = socket.AF_INET6

499

def __init__(self, *args, **kwargs):

500

if "settings" in kwargs:

501

self.settings = kwargs["settings"]

502

del kwargs["settings"]

503

if "clients" in kwargs:

504

self.clients = kwargs["clients"]

505

del kwargs["clients"]

506

return super(type(self), self).__init__(*args, **kwargs)

507

def server_bind(self):

508

"""This overrides the normal server_bind() function

509

to bind to an interface if one was specified, and also NOT to

510

bind to an address or port if they were not specified."""

511

if self.settings["interface"]:

512

# 25 is from /usr/include/asm-i486/socket.h

513

SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)

514

try:

515

self.socket.setsockopt(socket.SOL_SOCKET,

516

SO_BINDTODEVICE,

517

self.settings["interface"])

518

except socket.error, error:

519

if error[0] == errno.EPERM:

520

logger.error(u"No permission to"

521

u" bind to interface %s",

522

self.settings["interface"])

523

else:

524

raise error

525

# Only bind(2) the socket if we really need to.

526

if self.server_address[0] or self.server_address[1]:

527

if not self.server_address[0]:

528

in6addr_any = "::"

529

self.server_address = (in6addr_any,

530

self.server_address[1])

531

elif self.server_address[1] is None:

532

self.server_address = (self.server_address[0],

533

0)

534

return super(type(self), self).server_bind()

535

536

537

def string_to_delta(interval):

538

"""Parse a string and return a datetime.timedelta

539

540

>>> string_to_delta('7d')

541

datetime.timedelta(7)

542

>>> string_to_delta('60s')

543

datetime.timedelta(0, 60)

544

>>> string_to_delta('60m')

545

datetime.timedelta(0, 3600)

546

>>> string_to_delta('24h')

547

datetime.timedelta(1)

548

>>> string_to_delta(u'1w')

549

datetime.timedelta(7)

550

"""

551

try:

552

suffix=unicode(interval[-1])

553

value=int(interval[:-1])

554

if suffix == u"d":

555

delta = datetime.timedelta(value)

556

elif suffix == u"s":

557

delta = datetime.timedelta(0, value)

558

elif suffix == u"m":

559

delta = datetime.timedelta(0, 0, 0, 0, value)

560

elif suffix == u"h":

561

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

562

elif suffix == u"w":

563

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

564

else:

565

raise ValueError

566

except (ValueError, IndexError):

567

raise ValueError

568

return delta

569

570

571

def server_state_changed(state):

572

"""Derived from the Avahi example code"""

573

if state == avahi.SERVER_COLLISION:

574

logger.error(u"Server name collision")

575

service.remove()

576

elif state == avahi.SERVER_RUNNING:

577

service.add()

578

579

580

def entry_group_state_changed(state, error):

581

"""Derived from the Avahi example code"""

582

logger.debug(u"state change: %i", state)

583

584

if state == avahi.ENTRY_GROUP_ESTABLISHED:

585

logger.debug(u"Service established.")

586

elif state == avahi.ENTRY_GROUP_COLLISION:

587

logger.warning(u"Service name collision.")

588

service.rename()

589

elif state == avahi.ENTRY_GROUP_FAILURE:

590

logger.critical(u"Error in group state changed %s",

591

unicode(error))

592

raise AvahiGroupError("State changed: %s", str(error))

593

594

def if_nametoindex(interface):

595

"""Call the C function if_nametoindex(), or equivalent"""

596

global if_nametoindex

597

try:

598

if "ctypes.util" not in sys.modules:

599

import ctypes.util

600

if_nametoindex = ctypes.cdll.LoadLibrary\

601

(ctypes.util.find_library("c")).if_nametoindex

602

except (OSError, AttributeError):

603

if "struct" not in sys.modules:

604

import struct

605

if "fcntl" not in sys.modules:

606

import fcntl

607

def if_nametoindex(interface):

608

"Get an interface index the hard way, i.e. using fcntl()"

609

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

610

s = socket.socket()

611

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

612

struct.pack("16s16x", interface))

613

s.close()

614

interface_index = struct.unpack("I", ifreq[16:20])[0]

615

return interface_index

616

return if_nametoindex(interface)

617

618

619

def daemon(nochdir = False, noclose = False):

620

"""See daemon(3). Standard BSD Unix function.

621

This should really exist as os.daemon, but it doesn't (yet)."""

622

if os.fork():

623

sys.exit()

624

os.setsid()

625

if not nochdir:

626

os.chdir("/")

627

if os.fork():

628

sys.exit()

629

if not noclose:

630

# Close all standard open file descriptors

631

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

632

if not stat.S_ISCHR(os.fstat(null).st_mode):

633

raise OSError(errno.ENODEV,

634

"/dev/null not a character device")

635

os.dup2(null, sys.stdin.fileno())

636

os.dup2(null, sys.stdout.fileno())

637

os.dup2(null, sys.stderr.fileno())

638

if null > 2:

639

os.close(null)

640

641

642

def main():

643

global main_loop_started

644

main_loop_started = False

645

646

parser = OptionParser()

647

parser.add_option("-i", "--interface", type="string",

648

metavar="IF", help="Bind to interface IF")

649

parser.add_option("-a", "--address", type="string",

650

help="Address to listen for requests on")

651

parser.add_option("-p", "--port", type="int",

652

help="Port number to receive requests on")

653

parser.add_option("--check", action="store_true", default=False,

654

help="Run self-test")

655

parser.add_option("--debug", action="store_true", default=False,

656

help="Debug mode; run in foreground and log to"

657

" terminal")

658

parser.add_option("--priority", type="string", help="GnuTLS"

659

" priority string (see GnuTLS documentation)")

660

parser.add_option("--servicename", type="string", metavar="NAME",

661

help="Zeroconf service name")

662

parser.add_option("--configdir", type="string",

663

default="/etc/mandos", metavar="DIR",

664

help="Directory to search for configuration"

665

" files")

666

(options, args) = parser.parse_args()

667

668

if options.check:

669

import doctest

670

doctest.testmod()

671

sys.exit()

672

673

# Default values for config file for server-global settings

674

server_defaults = { "interface": "",

675

"address": "",

676

"port": "",

677

"debug": "False",

678

"priority":

679

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

680

"servicename": "Mandos",

681

}

682

683

# Parse config file for server-global settings

684

server_config = ConfigParser.SafeConfigParser(server_defaults)

685

del server_defaults

686

server_config.read(os.path.join(options.configdir, "mandos.conf"))

687

server_section = "server"

688

# Convert the SafeConfigParser object to a dict

689

server_settings = dict(server_config.items(server_section))

690

# Use getboolean on the boolean config option

691

server_settings["debug"] = server_config.getboolean\

692

(server_section, "debug")

693

del server_config

694

695

# Override the settings from the config file with command line

696

# options, if set.

697

for option in ("interface", "address", "port", "debug",

698

"priority", "servicename", "configdir"):

699

value = getattr(options, option)

700

if value is not None:

701

server_settings[option] = value

702

del options

703

# Now we have our good server settings in "server_settings"

704

705

# Parse config file with clients

706

client_defaults = { "timeout": "1h",

707

"interval": "5m",

708

"checker": "fping -q -- %%(fqdn)s",

709

}

710

client_config = ConfigParser.SafeConfigParser(client_defaults)

711

client_config.read(os.path.join(server_settings["configdir"],

712

"clients.conf"))

713

714

global service

715

service = AvahiService(name = server_settings["servicename"],

716

type = "_mandos._tcp", );

717

if server_settings["interface"]:

718

service.interface = if_nametoindex(server_settings["interface"])

719

720

global main_loop

721

global bus

722

global server

723

# From the Avahi example code

724

DBusGMainLoop(set_as_default=True )

725

main_loop = gobject.MainLoop()

726

bus = dbus.SystemBus()

727

server = dbus.Interface(

728

bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),

729

avahi.DBUS_INTERFACE_SERVER )

730

# End of Avahi example code

731

732

debug = server_settings["debug"]

733

734

if debug:

735

console = logging.StreamHandler()

736

# console.setLevel(logging.DEBUG)

737

console.setFormatter(logging.Formatter\

738

('%(levelname)s: %(message)s'))

739

logger.addHandler(console)

740

del console

741

742

clients = Set()

743

def remove_from_clients(client):

744

clients.remove(client)

745

if not clients:

746

logger.critical(u"No clients left, exiting")

747

sys.exit()

748

749

clients.update(Set(Client(name = section,

750

stop_hook = remove_from_clients,

751

config

752

= dict(client_config.items(section)))

753

for section in client_config.sections()))

754

755

if not debug:

756

daemon()

757

758

def cleanup():

759

"Cleanup function; run on exit"

760

global group

761

# From the Avahi example code

762

if not group is None:

763

group.Free()

764

group = None

765

# End of Avahi example code

766

767

while clients:

768

client = clients.pop()

769

client.stop_hook = None

770

client.stop()

771

772

atexit.register(cleanup)

773

774

if not debug:

775

signal.signal(signal.SIGINT, signal.SIG_IGN)

776

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

777

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

778

779

for client in clients:

780

client.start()

781

782

tcp_server = IPv6_TCPServer((server_settings["address"],

783

server_settings["port"]),

784

tcp_handler,

785

settings=server_settings,

786

clients=clients)

787

# Find out what port we got

788

service.port = tcp_server.socket.getsockname()[1]

789

logger.info(u"Now listening on address %r, port %d, flowinfo %d,"

790

u" scope_id %d" % tcp_server.socket.getsockname())

791

792

#service.interface = tcp_server.socket.getsockname()[3]

793

794

try:

795

# From the Avahi example code

796

server.connect_to_signal("StateChanged", server_state_changed)

797

try:

798

server_state_changed(server.GetState())

799

except dbus.exceptions.DBusException, error:

800

logger.critical(u"DBusException: %s", error)

801

sys.exit(1)

802

# End of Avahi example code

803

804

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

805

lambda *args, **kwargs:

806

tcp_server.handle_request\

807

(*args[2:], **kwargs) or True)

808

809

logger.debug("Starting main loop")

810

main_loop_started = True

811

main_loop.run()

812

except AvahiError, error:

813

logger.critical(u"AvahiError: %s" + unicode(error))

814

sys.exit(1)

815

except KeyboardInterrupt:

816

if debug:

817

print

818

819

if __name__ == '__main__':

820

main()