To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to server.py
- browse files at revision 9
- compare with another revision
- download diff
- download tarball
- view history from revision 9
- Committer: Teddy Hogeborn
- Date: 2008-01-30 17:28:18 UTC
- Revision ID: teddy@fukt.bsnet.se-20080130172818-fnrq2xmtg1wa8wo2
* client.cpp (main): Get t_old early since it is used on error exits.
* server.py (Client.checker): New attribute.
(Client.check_action, Client.start_checker, Client.stop_checker,
Client.fileno, Client.next_stop, Client.still_valid,
Client.it_is_time_to_check): New methods.
(Client.handle_request): Alias to "check_action".
(main): Stop all started checkers on exit. Exit cleanly on keyboard
interrupt.
* server.py (Client.checker): New attribute.
(Client.check_action, Client.start_checker, Client.stop_checker,
Client.fileno, Client.next_stop, Client.still_valid,
Client.it_is_time_to_check): New methods.
(Client.handle_request): Alias to "check_action".
(main): Stop all started checkers on exit. Exit cleanly on keyboard
interrupt.
- files added:
- client.cpp
- files removed:
- plugbasedclient.c
- plugins.d
- files modified:
- Makefile
added
removed
server.py
1
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
4
from __future__ import division
5
2
6
3
import SocketServer
7
4
import socket
12
9
import gnutls.crypto
13
10
import gnutls.connection
14
11
import gnutls.errors
15
import gnutls.library.functions
16
import gnutls.library.constants
17
import gnutls.library.types
18
12
import ConfigParser
19
13
import sys
20
14
import re
21
15
import os
22
16
import signal
23
from sets import Set
24
import subprocess
25
import atexit
26
import stat
27
28
import dbus
29
import gobject
30
import avahi
31
from dbus.mainloop.glib import DBusGMainLoop
32
import ctypes
33
34
import logging
35
import logging.handlers
36
37
logger = logging.Logger('mandos')
38
syslogger = logging.handlers.SysLogHandler\
39
(facility = logging.handlers.SysLogHandler.LOG_DAEMON)
40
syslogger.setFormatter(logging.Formatter\
41
('%(levelname)s: %(message)s'))
42
logger.addHandler(syslogger)
43
del syslogger
44
45
# This variable is used to optionally bind to a specified interface.
46
# It is a global variable to fit in with the other variables from the
47
# Avahi server example code.
48
serviceInterface = avahi.IF_UNSPEC
49
# From the Avahi server example code:
50
serviceName = "Mandos"
51
serviceType = "_mandos._tcp" # http://www.dns-sd.org/ServiceTypes.html
52
servicePort = None # Not known at startup
53
serviceTXT = [] # TXT record for the service
54
domain = "" # Domain to publish on, default to .local
55
host = "" # Host to publish records for, default to localhost
56
group = None #our entry group
57
rename_count = 12 # Counter so we only rename after collisions a
58
# sensible number of times
59
# End of Avahi example code
60
61
17
62
18
class Client(object):
63
"""A representation of a client host served by this server.
64
Attributes:
65
name: string; from the config file, used in log messages
66
fingerprint: string (40 or 32 hexadecimal digits); used to
67
uniquely identify the client
68
secret: bytestring; sent verbatim (over TLS) to client
69
fqdn: string (FQDN); available for use by the checker command
70
created: datetime.datetime()
71
last_seen: datetime.datetime() or None if not yet seen
72
timeout: datetime.timedelta(); How long from last_seen until
73
this client is invalid
74
interval: datetime.timedelta(); How often to start a new checker
75
stop_hook: If set, called by stop() as stop_hook(self)
76
checker: subprocess.Popen(); a running checker process used
77
to see if the client lives.
78
Is None if no process is running.
79
checker_initiator_tag: a gobject event source tag, or None
80
stop_initiator_tag: - '' -
81
checker_callback_tag: - '' -
82
checker_command: string; External command which is run to check if
83
client lives. %()s expansions are done at
84
runtime with vars(self) as dict, so that for
85
instance %(name)s can be used in the command.
86
Private attibutes:
87
_timeout: Real variable for 'timeout'
88
_interval: Real variable for 'interval'
89
_timeout_milliseconds: Used by gobject.timeout_add()
90
_interval_milliseconds: - '' -
91
"""
92
def _set_timeout(self, timeout):
93
"Setter function for 'timeout' attribute"
94
self._timeout = timeout
95
self._timeout_milliseconds = ((self.timeout.days
96
* 24 * 60 * 60 * 1000)
97
+ (self.timeout.seconds * 1000)
98
+ (self.timeout.microseconds
99
// 1000))
100
timeout = property(lambda self: self._timeout,
101
_set_timeout)
102
del _set_timeout
103
def _set_interval(self, interval):
104
"Setter function for 'interval' attribute"
105
self._interval = interval
106
self._interval_milliseconds = ((self.interval.days
107
* 24 * 60 * 60 * 1000)
108
+ (self.interval.seconds
109
* 1000)
110
+ (self.interval.microseconds
111
// 1000))
112
interval = property(lambda self: self._interval,
113
_set_interval)
114
del _set_interval
115
def __init__(self, name=None, options=None, stop_hook=None,
116
fingerprint=None, secret=None, secfile=None,
117
fqdn=None, timeout=None, interval=-1, checker=None):
19
def __init__(self, name=None, options=None, dn=None,
20
password=None, passfile=None, fqdn=None,
21
timeout=None, interval=-1):
118
22
self.name = name
119
# Uppercase and remove spaces from fingerprint
120
# for later comparison purposes with return value of
121
# the fingerprint() function
122
self.fingerprint = fingerprint.upper().replace(u" ", u"")
123
if secret:
124
self.secret = secret.decode(u"base64")
125
elif secfile:
126
sf = open(secfile)
127
self.secret = sf.read()
128
sf.close()
23
self.dn = dn
24
if password:
25
self.password = password
26
elif passfile:
27
self.password = open(passfile).readall()
129
28
else:
130
raise RuntimeError(u"No secret or secfile for client %s"
131
% self.name)
29
print "No Password or Passfile in client config file"
30
# raise RuntimeError XXX
31
self.password = "gazonk"
132
32
self.fqdn = fqdn # string
133
33
self.created = datetime.datetime.now()
134
self.last_seen = None
34
self.last_seen = None # datetime.datetime()
135
35
if timeout is None:
136
self.timeout = options.timeout
137
else:
138
self.timeout = string_to_delta(timeout)
36
timeout = options.timeout
37
self.timeout = timeout # datetime.timedelta()
139
38
if interval == -1:
140
self.interval = options.interval
141
else:
142
self.interval = string_to_delta(interval)
143
self.stop_hook = stop_hook
144
self.checker = None
145
self.checker_initiator_tag = None
146
self.stop_initiator_tag = None
147
self.checker_callback_tag = None
148
self.check_command = checker
149
def start(self):
150
"""Start this clients checker and timeout hooks"""
151
# Schedule a new checker to be started an 'interval' from now,
152
# and every interval from then on.
153
self.checker_initiator_tag = gobject.timeout_add\
154
(self._interval_milliseconds,
155
self.start_checker)
156
# Also start a new checker *right now*.
157
self.start_checker()
158
# Schedule a stop() when 'timeout' has passed
159
self.stop_initiator_tag = gobject.timeout_add\
160
(self._timeout_milliseconds,
161
self.stop)
162
def stop(self):
163
"""Stop this client.
164
The possibility that this client might be restarted is left
165
open, but not currently used."""
166
logger.debug(u"Stopping client %s", self.name)
167
self.secret = None
168
if self.stop_initiator_tag:
169
gobject.source_remove(self.stop_initiator_tag)
170
self.stop_initiator_tag = None
171
if self.checker_initiator_tag:
172
gobject.source_remove(self.checker_initiator_tag)
173
self.checker_initiator_tag = None
174
self.stop_checker()
175
if self.stop_hook:
176
self.stop_hook(self)
177
# Do not run this again if called by a gobject.timeout_add
178
return False
179
def __del__(self):
180
# Some code duplication here and in stop()
181
if hasattr(self, "stop_initiator_tag") \
182
and self.stop_initiator_tag:
183
gobject.source_remove(self.stop_initiator_tag)
184
self.stop_initiator_tag = None
185
if hasattr(self, "checker_initiator_tag") \
186
and self.checker_initiator_tag:
187
gobject.source_remove(self.checker_initiator_tag)
188
self.checker_initiator_tag = None
189
self.stop_checker()
190
def checker_callback(self, pid, condition):
191
"""The checker has completed, so take appropriate actions."""
192
now = datetime.datetime.now()
193
if os.WIFEXITED(condition) \
194
and (os.WEXITSTATUS(condition) == 0):
195
logger.debug(u"Checker for %(name)s succeeded",
196
vars(self))
39
interval = options.interval
40
self.interval = interval # datetime.timedelta()
41
self.next_check = datetime.datetime.now() # datetime.datetime()
42
self.checker = None # or a subprocess.Popen()
43
def check_action(self, now=None):
44
"""The checker said something and might have completed.
45
Check if is has, and take appropriate actions."""
46
if self.checker.poll() is None:
47
# False alarm, no result yet
48
#self.checker.read()
49
return
50
if now is None:
51
now = datetime.datetime.now()
52
if self.checker.returncode == 0:
197
53
self.last_seen = now
198
gobject.source_remove(self.stop_initiator_tag)
199
self.stop_initiator_tag = gobject.timeout_add\
200
(self._timeout_milliseconds,
201
self.stop)
202
elif not os.WIFEXITED(condition):
203
logger.warning(u"Checker for %(name)s crashed?",
204
vars(self))
205
else:
206
logger.debug(u"Checker for %(name)s failed",
207
vars(self))
208
self.checker = None
209
self.checker_callback_tag = None
54
while self.next_check <= now:
55
self.next_check += self.interval
56
handle_request = check_action
210
57
def start_checker(self):
211
"""Start a new checker subprocess if one is not running.
212
If a checker already exists, leave it running and do
213
nothing."""
214
if self.checker is None:
215
try:
216
command = self.check_command % self.fqdn
217
except TypeError:
218
escaped_attrs = dict((key, re.escape(str(val)))
219
for key, val in
220
vars(self).iteritems())
221
try:
222
command = self.check_command % escaped_attrs
223
except TypeError, error:
224
logger.critical(u'Could not format string "%s":'
225
u' %s', self.check_command, error)
226
return True # Try again later
227
try:
228
logger.debug(u"Starting checker %r for %s",
229
command, self.name)
230
self.checker = subprocess.\
231
Popen(command,
232
close_fds=True, shell=True,
233
cwd="/")
234
self.checker_callback_tag = gobject.child_watch_add\
235
(self.checker.pid,
236
self.checker_callback)
237
except subprocess.OSError, error:
238
logger.error(u"Failed to start subprocess: %s",
239
error)
240
# Re-run this periodically if run by gobject.timeout_add
241
return True
58
self.stop_checker()
59
try:
60
self.checker = subprocess.Popen("sleep 1; fping -q -- %s"
61
% re.escape(self.fqdn),
62
stdout=subprocess.PIPE,
63
close_fds=True,
64
shell=True, cwd="/")
65
except subprocess.OSError, e:
66
print "Failed to start subprocess:", e
242
67
def stop_checker(self):
243
"""Force the checker process, if any, to stop."""
244
if not hasattr(self, "checker") or self.checker is None:
68
if self.checker is None:
245
69
return
246
gobject.source_remove(self.checker_callback_tag)
247
self.checker_callback_tag = None
248
70
os.kill(self.checker.pid, signal.SIGTERM)
249
71
if self.checker.poll() is None:
250
72
os.kill(self.checker.pid, signal.SIGKILL)
251
73
self.checker = None
74
__del__ = stop_checker
75
def fileno(self):
76
if self.checker is None:
77
return None
78
return self.checker.stdout.fileno()
79
def next_stop(self):
80
"""The time when something must be done about this client"""
81
return min(self.last_seen + self.timeout, self.next_check)
252
82
def still_valid(self, now=None):
253
"""Has the timeout not yet passed for this client?"""
254
if now is None:
255
now = datetime.datetime.now()
256
if self.last_seen is None:
257
return now < (self.created + self.timeout)
258
else:
259
return now < (self.last_seen + self.timeout)
260
261
262
def peer_certificate(session):
263
"Return an OpenPGP data packet string for the peer's certificate"
264
# If not an OpenPGP certificate...
265
if gnutls.library.functions.gnutls_certificate_type_get\
266
(session._c_object) \
267
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP:
268
# ...do the normal thing
269
return session.peer_certificate
270
list_size = ctypes.c_uint()
271
cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
272
(session._c_object, ctypes.byref(list_size))
273
if list_size.value == 0:
274
return None
275
cert = cert_list[0]
276
return ctypes.string_at(cert.data, cert.size)
277
278
279
def fingerprint(openpgp):
280
"Convert an OpenPGP data string to a hexdigit fingerprint string"
281
# New empty GnuTLS certificate
282
crt = gnutls.library.types.gnutls_openpgp_crt_t()
283
gnutls.library.functions.gnutls_openpgp_crt_init\
284
(ctypes.byref(crt))
285
# New GnuTLS "datum" with the OpenPGP public key
286
datum = gnutls.library.types.gnutls_datum_t\
287
(ctypes.cast(ctypes.c_char_p(openpgp),
288
ctypes.POINTER(ctypes.c_ubyte)),
289
ctypes.c_uint(len(openpgp)))
290
# Import the OpenPGP public key into the certificate
291
ret = gnutls.library.functions.gnutls_openpgp_crt_import\
292
(crt,
293
ctypes.byref(datum),
294
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
295
# New buffer for the fingerprint
296
buffer = ctypes.create_string_buffer(20)
297
buffer_length = ctypes.c_size_t()
298
# Get the fingerprint from the certificate into the buffer
299
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
300
(crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
301
# Deinit the certificate
302
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
303
# Convert the buffer to a Python bytestring
304
fpr = ctypes.string_at(buffer, buffer_length.value)
305
# Convert the bytestring to hexadecimal notation
306
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
307
return hex_fpr
83
"""Has this client's timeout not passed?"""
84
if now is None:
85
now = datetime.datetime.now()
86
return now < (self.last_seen + timeout)
87
def it_is_time_to_check(self, now=None):
88
if now is None:
89
now = datetime.datetime.now()
90
return self.next_check <= now
91
92
93
class server_metaclass(type):
94
"Common behavior for the UDP and TCP server classes"
95
def __new__(cls, name, bases, attrs):
96
attrs["address_family"] = socket.AF_INET6
97
attrs["allow_reuse_address"] = True
98
def server_bind(self):
99
if self.options.interface:
100
if not hasattr(socket, "SO_BINDTODEVICE"):
101
# From /usr/include/asm-i486/socket.h
102
socket.SO_BINDTODEVICE = 25
103
try:
104
self.socket.setsockopt(socket.SOL_SOCKET,
105
socket.SO_BINDTODEVICE,
106
self.options.interface)
107
except socket.error, error:
108
if error[0] == errno.EPERM:
109
print "Warning: No permission to bind to interface", \
110
self.options.interface
111
else:
112
raise error
113
return super(type(self), self).server_bind()
114
attrs["server_bind"] = server_bind
115
def init(self, *args, **kwargs):
116
if "options" in kwargs:
117
self.options = kwargs["options"]
118
del kwargs["options"]
119
if "clients" in kwargs:
120
self.clients = kwargs["clients"]
121
del kwargs["clients"]
122
if "credentials" in kwargs:
123
self.credentials = kwargs["credentials"]
124
del kwargs["credentials"]
125
return super(type(self), self).__init__(*args, **kwargs)
126
attrs["__init__"] = init
127
return type.__new__(cls, name, bases, attrs)
128
129
130
class udp_handler(SocketServer.DatagramRequestHandler, object):
131
def handle(self):
132
self.wfile.write("Polo")
133
print "UDP request answered"
134
135
136
class IPv6_UDPServer(SocketServer.UDPServer, object):
137
__metaclass__ = server_metaclass
138
def verify_request(self, request, client_address):
139
print "UDP request came"
140
return request[0] == "Marco"
308
141
309
142
310
143
class tcp_handler(SocketServer.BaseRequestHandler, object):
311
"""A TCP request handler class.
312
Instantiated by IPv6_TCPServer for each request to handle it.
313
Note: This will run in its own forked process."""
314
315
144
def handle(self):
316
logger.debug(u"TCP connection from: %s",
317
unicode(self.client_address))
318
session = gnutls.connection.ClientSession(self.request,
319
gnutls.connection.\
320
X509Credentials())
321
322
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
323
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
324
# "+DHE-DSS"))
325
priority = "SECURE256"
326
327
gnutls.library.functions.gnutls_priority_set_direct\
328
(session._c_object, priority, None);
329
330
try:
331
session.handshake()
332
except gnutls.errors.GNUTLSError, error:
333
logger.debug(u"Handshake failed: %s", error)
334
# Do not run session.bye() here: the session is not
335
# established. Just abandon the request.
336
return
337
try:
338
fpr = fingerprint(peer_certificate(session))
339
except (TypeError, gnutls.errors.GNUTLSError), error:
340
logger.debug(u"Bad certificate: %s", error)
341
session.bye()
342
return
343
logger.debug(u"Fingerprint: %s", fpr)
344
client = None
345
for c in clients:
346
if c.fingerprint == fpr:
347
client = c
348
break
349
# Have to check if client.still_valid(), since it is possible
350
# that the client timed out while establishing the GnuTLS
351
# session.
352
if (not client) or (not client.still_valid()):
353
if client:
354
logger.debug(u"Client %(name)s is invalid",
355
vars(client))
356
else:
357
logger.debug(u"Client not found for fingerprint: %s",
358
fpr)
359
session.bye()
360
return
361
sent_size = 0
362
while sent_size < len(client.secret):
363
sent = session.send(client.secret[sent_size:])
364
logger.debug(u"Sent: %d, remaining: %d",
365
sent, len(client.secret)
366
- (sent_size + sent))
367
sent_size += sent
145
print "TCP request came"
146
print "Request:", self.request
147
print "Client Address:", self.client_address
148
print "Server:", self.server
149
session = gnutls.connection.ServerSession(self.request,
150
self.server.credentials)
151
session.handshake()
152
if session.peer_certificate:
153
print "DN:", session.peer_certificate.subject
154
try:
155
session.verify_peer()
156
except gnutls.errors.CertificateError, error:
157
print "Verify failed", error
158
session.bye()
159
return
160
try:
161
session.send(dict((client.dn, client.password)
162
for client in self.server.clients)
163
[session.peer_certificate.subject])
164
except KeyError:
165
session.send("gazonk")
166
# Log maybe? XXX
368
167
session.bye()
369
168
370
169
371
170
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
372
"""IPv6 TCP server. Accepts 'None' as address and/or port.
373
Attributes:
374
options: Command line options
375
clients: Set() of Client objects
376
"""
377
address_family = socket.AF_INET6
378
def __init__(self, *args, **kwargs):
379
if "options" in kwargs:
380
self.options = kwargs["options"]
381
del kwargs["options"]
382
if "clients" in kwargs:
383
self.clients = kwargs["clients"]
384
del kwargs["clients"]
385
return super(type(self), self).__init__(*args, **kwargs)
386
def server_bind(self):
387
"""This overrides the normal server_bind() function
388
to bind to an interface if one was specified, and also NOT to
389
bind to an address or port if they were not specified."""
390
if self.options.interface:
391
if not hasattr(socket, "SO_BINDTODEVICE"):
392
# From /usr/include/asm-i486/socket.h
393
socket.SO_BINDTODEVICE = 25
394
try:
395
self.socket.setsockopt(socket.SOL_SOCKET,
396
socket.SO_BINDTODEVICE,
397
self.options.interface)
398
except socket.error, error:
399
if error[0] == errno.EPERM:
400
logger.warning(u"No permission to"
401
u" bind to interface %s",
402
self.options.interface)
403
else:
404
raise error
405
# Only bind(2) the socket if we really need to.
406
if self.server_address[0] or self.server_address[1]:
407
if not self.server_address[0]:
408
in6addr_any = "::"
409
self.server_address = (in6addr_any,
410
self.server_address[1])
411
elif self.server_address[1] is None:
412
self.server_address = (self.server_address[0],
413
0)
414
return super(type(self), self).server_bind()
415
171
__metaclass__ = server_metaclass
172
request_queue_size = 1024
173
174
175
in6addr_any = "::"
416
176
417
177
def string_to_delta(interval):
418
178
"""Parse a string and return a datetime.timedelta
448
208
return delta
449
209
450
210
451
def add_service():
452
"""From the Avahi server example code"""
453
global group, serviceName, serviceType, servicePort, serviceTXT, \
454
domain, host
455
if group is None:
456
group = dbus.Interface(
457
bus.get_object( avahi.DBUS_NAME,
458
server.EntryGroupNew()),
459
avahi.DBUS_INTERFACE_ENTRY_GROUP)
460
group.connect_to_signal('StateChanged',
461
entry_group_state_changed)
462
logger.debug(u"Adding service '%s' of type '%s' ...",
463
serviceName, serviceType)
464
465
group.AddService(
466
serviceInterface, # interface
467
avahi.PROTO_INET6, # protocol
468
dbus.UInt32(0), # flags
469
serviceName, serviceType,
470
domain, host,
471
dbus.UInt16(servicePort),
472
avahi.string_array_to_txt_array(serviceTXT))
473
group.Commit()
474
475
476
def remove_service():
477
"""From the Avahi server example code"""
478
global group
479
480
if not group is None:
481
group.Reset()
482
483
484
def server_state_changed(state):
485
"""From the Avahi server example code"""
486
if state == avahi.SERVER_COLLISION:
487
logger.warning(u"Server name collision")
488
remove_service()
489
elif state == avahi.SERVER_RUNNING:
490
add_service()
491
492
493
def entry_group_state_changed(state, error):
494
"""From the Avahi server example code"""
495
global serviceName, server, rename_count
496
497
logger.debug(u"state change: %i", state)
498
499
if state == avahi.ENTRY_GROUP_ESTABLISHED:
500
logger.debug(u"Service established.")
501
elif state == avahi.ENTRY_GROUP_COLLISION:
502
503
rename_count = rename_count - 1
504
if rename_count > 0:
505
name = server.GetAlternativeServiceName(name)
506
logger.warning(u"Service name collision, "
507
u"changing name to '%s' ...", name)
508
remove_service()
509
add_service()
510
511
else:
512
logger.error(u"No suitable service name found after %i"
513
u" retries, exiting.", n_rename)
514
killme(1)
515
elif state == avahi.ENTRY_GROUP_FAILURE:
516
logger.error(u"Error in group state changed %s",
517
unicode(error))
518
killme(1)
519
520
521
def if_nametoindex(interface):
522
"""Call the C function if_nametoindex()"""
523
try:
524
libc = ctypes.cdll.LoadLibrary("libc.so.6")
525
return libc.if_nametoindex(interface)
526
except (OSError, AttributeError):
527
if "struct" not in sys.modules:
528
import struct
529
if "fcntl" not in sys.modules:
530
import fcntl
531
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
532
s = socket.socket()
533
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
534
struct.pack("16s16x", interface))
535
s.close()
536
interface_index = struct.unpack("I", ifreq[16:20])[0]
537
return interface_index
538
539
540
def daemon(nochdir, noclose):
541
"""See daemon(3). Standard BSD Unix function.
542
This should really exist as os.daemon, but it doesn't (yet)."""
543
if os.fork():
544
sys.exit()
545
os.setsid()
546
if not nochdir:
547
os.chdir("/")
548
if not noclose:
549
# Close all standard open file descriptors
550
null = os.open("/dev/null", os.O_NOCTTY | os.O_RDWR)
551
if not stat.S_ISCHR(os.fstat(null).st_mode):
552
raise OSError(errno.ENODEV,
553
"/dev/null not a character device")
554
os.dup2(null, sys.stdin.fileno())
555
os.dup2(null, sys.stdout.fileno())
556
os.dup2(null, sys.stderr.fileno())
557
if null > 2:
558
os.close(null)
559
560
561
def killme(status = 0):
562
logger.debug("Stopping server with exit status %d", status)
563
exitstatus = status
564
if main_loop_started:
565
main_loop.quit()
566
else:
567
sys.exit(status)
568
569
570
if __name__ == '__main__':
571
exitstatus = 0
572
main_loop_started = False
211
def main():
573
212
parser = OptionParser()
574
213
parser.add_option("-i", "--interface", type="string",
575
default=None, metavar="IF",
576
help="Bind to interface IF")
577
parser.add_option("-p", "--port", type="int", default=None,
214
default="eth0", metavar="IF",
215
help="Interface to bind to")
216
parser.add_option("--cert", type="string", default="cert.pem",
217
metavar="FILE",
218
help="Public key certificate to use")
219
parser.add_option("--key", type="string", default="key.pem",
220
metavar="FILE",
221
help="Private key to use")
222
parser.add_option("--ca", type="string", default="ca.pem",
223
metavar="FILE",
224
help="Certificate Authority certificate to use")
225
parser.add_option("--crl", type="string", default="crl.pem",
226
metavar="FILE",
227
help="Certificate Revokation List to use")
228
parser.add_option("-p", "--port", type="int", default=49001,
578
229
help="Port number to receive requests on")
579
parser.add_option("--timeout", type="string", # Parsed later
580
default="1h",
230
parser.add_option("--dh", type="int", metavar="BITS",
231
help="DH group to use")
232
parser.add_option("-t", "--timeout", type="string", # Parsed later
233
default="15m",
581
234
help="Amount of downtime allowed for clients")
582
235
parser.add_option("--interval", type="string", # Parsed later
583
236
default="5m",
584
237
help="How often to check that a client is up")
585
238
parser.add_option("--check", action="store_true", default=False,
586
239
help="Run self-test")
587
parser.add_option("--debug", action="store_true", default=False,
588
help="Debug mode")
589
240
(options, args) = parser.parse_args()
590
241
591
242
if options.check:
592
243
import doctest
593
244
doctest.testmod()
598
249
options.timeout = string_to_delta(options.timeout)
599
250
except ValueError:
600
251
parser.error("option --timeout: Unparseable time")
252
601
253
try:
602
254
options.interval = string_to_delta(options.interval)
603
255
except ValueError:
604
256
parser.error("option --interval: Unparseable time")
605
257
258
cert = gnutls.crypto.X509Certificate(open(options.cert).read())
259
key = gnutls.crypto.X509PrivateKey(open(options.key).read())
260
ca = gnutls.crypto.X509Certificate(open(options.ca).read())
261
crl = gnutls.crypto.X509CRL(open(options.crl).read())
262
cred = gnutls.connection.X509Credentials(cert, key, [ca], [crl])
263
606
264
# Parse config file
607
defaults = { "checker": "fping -q -- %%(fqdn)s" }
608
client_config = ConfigParser.SafeConfigParser(defaults)
609
#client_config.readfp(open("secrets.conf"), "secrets.conf")
610
client_config.read("mandos-clients.conf")
611
612
# From the Avahi server example code
613
DBusGMainLoop(set_as_default=True )
614
main_loop = gobject.MainLoop()
615
bus = dbus.SystemBus()
616
server = dbus.Interface(
617
bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
618
avahi.DBUS_INTERFACE_SERVER )
619
# End of Avahi example code
620
621
debug = options.debug
622
623
if debug:
624
console = logging.StreamHandler()
625
# console.setLevel(logging.DEBUG)
626
console.setFormatter(logging.Formatter\
627
('%(levelname)s: %(message)s'))
628
logger.addHandler(console)
629
del console
630
631
clients = Set()
632
def remove_from_clients(client):
633
clients.remove(client)
634
if not clients:
635
logger.debug(u"No clients left, exiting")
636
killme()
637
638
clients.update(Set(Client(name=section, options=options,
639
stop_hook = remove_from_clients,
640
**(dict(client_config\
641
.items(section))))
642
for section in client_config.sections()))
643
644
if not debug:
645
daemon(False, False)
646
647
def cleanup():
648
"Cleanup function; run on exit"
649
global group
650
# From the Avahi server example code
651
if not group is None:
652
group.Free()
653
group = None
654
# End of Avahi example code
655
656
for client in clients:
657
client.stop_hook = None
658
client.stop()
659
660
atexit.register(cleanup)
661
662
if not debug:
663
signal.signal(signal.SIGINT, signal.SIG_IGN)
664
signal.signal(signal.SIGHUP, lambda signum, frame: killme())
665
signal.signal(signal.SIGTERM, lambda signum, frame: killme())
666
667
for client in clients:
668
client.start()
669
670
tcp_server = IPv6_TCPServer((None, options.port),
265
defaults = {}
266
client_config_object = ConfigParser.SafeConfigParser(defaults)
267
client_config_object.read("mandos-clients.conf")
268
clients = [Client(name=section, options=options,
269
**(dict(client_config_object.items(section))))
270
for section in client_config_object.sections()]
271
272
udp_server = IPv6_UDPServer((in6addr_any, options.port),
273
udp_handler,
274
options=options)
275
276
tcp_server = IPv6_TCPServer((in6addr_any, options.port),
671
277
tcp_handler,
672
278
options=options,
673
clients=clients)
674
# Find out what random port we got
675
servicePort = tcp_server.socket.getsockname()[1]
676
logger.debug(u"Now listening on port %d", servicePort)
677
678
if options.interface is not None:
679
serviceInterface = if_nametoindex(options.interface)
680
681
# From the Avahi server example code
682
server.connect_to_signal("StateChanged", server_state_changed)
683
try:
684
server_state_changed(server.GetState())
685
except dbus.exceptions.DBusException, error:
686
logger.critical(u"DBusException: %s", error)
687
killme(1)
688
# End of Avahi example code
689
690
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
691
lambda *args, **kwargs:
692
tcp_server.handle_request(*args[2:],
693
**kwargs) or True)
694
try:
695
main_loop_started = True
696
main_loop.run()
697
except KeyboardInterrupt:
698
if debug:
699
print
700
701
sys.exit(exitstatus)
279
clients=clients,
280
credentials=cred)
281
282
while True:
283
try:
284
input, out, err = select.select((udp_server,
285
tcp_server), (), ())
286
if not input:
287
pass
288
else:
289
for obj in input:
290
obj.handle_request()
291
except KeyboardInterrupt:
292
break
293
294
# Cleanup here
295
for client in clients:
296
client.stop_checker()
297
298
299
if __name__ == "__main__":
300
main()
301
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0