/mandos/release : revision 237.7.709

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

77

import itertools

78

import collections

79

import codecs

80

import unittest

81

import random

82

80

83

81

import dbus

84

82

import dbus.service

92

90

93

91

if sys.version_info.major == 2:

94

92

__metaclass__ = type

95

str = unicode

96

97

# Add collections.abc.Callable if it does not exist

98

try:

99

collections.abc.Callable

100

except AttributeError:

101

class abc:

102

Callable = collections.Callable

103

collections.abc = abc

104

del abc

105

106

# Show warnings by default

107

if not sys.warnoptions:

108

import warnings

109

warnings.simplefilter("default")

110

93

111

94

# Try to find the value of SO_BINDTODEVICE:

112

95

try:

133

116

# No value found

134

117

SO_BINDTODEVICE = None

135

118

119

if sys.version_info.major == 2:

120

str = unicode

121

136

122

if sys.version_info < (3, 2):

137

123

configparser.Configparser = configparser.SafeConfigParser

138

124

139

version = "1.8.9"

125

version = "1.8.7"

140

126

stored_state_file = "clients.pickle"

141

127

142

128

logger = logging.getLogger()

143

logging.captureWarnings(True) # Show warnings via the logging system

144

129

syslogger = None

145

130

146

131

try:

211

196

output = subprocess.check_output(["gpgconf"])

212

197

for line in output.splitlines():

213

198

name, text, path = line.split(b":")

214

if name == b"gpg":

199

if name == "gpg":

215

200

self.gpg = path

216

201

break

217

202

except OSError as e:

222

207

'--force-mdc',

223

208

'--quiet']

224

209

# Only GPG version 1 has the --no-use-agent option.

225

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

210

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

226

211

self.gnupgargs.append("--no-use-agent")

227

212

228

213

def __enter__(self):

1045

1030

if self.checker_initiator_tag is not None:

1046

1031

GLib.source_remove(self.checker_initiator_tag)

1047

1032

self.checker_initiator_tag = GLib.timeout_add(

1048

random.randrange(int(self.interval.total_seconds() * 1000

1049

+ 1)),

1033

int(self.interval.total_seconds() * 1000),

1050

1034

self.start_checker)

1051

1035

# Schedule a disable() when 'timeout' has passed

1052

1036

if self.disable_initiator_tag is not None:

1062

1046

# Read return code from connection (see call_pipe)

1063

1047

returncode = connection.recv()

1064

1048

connection.close()

1065

if self.checker is not None:

1066

self.checker.join()

1049

self.checker.join()

1067

1050

self.checker_callback_tag = None

1068

1051

self.checker = None

1069

1052

1160

1143

kwargs=popen_args)

1161

1144

self.checker.start()

1162

1145

self.checker_callback_tag = GLib.io_add_watch(

1163

GLib.IOChannel.unix_new(pipe[0].fileno()),

1164

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1146

pipe[0].fileno(), GLib.IO_IN,

1165

1147

self.checker_callback, pipe[0], command)

1166

1148

# Re-run this periodically if run by GLib.timeout_add

1167

1149

return True

1422

1404

raise ValueError("Byte arrays not supported for non-"

1423

1405

"'ay' signature {!r}"

1424

1406

.format(prop._dbus_signature))

1425

value = dbus.ByteArray(bytes(value))

1407

value = dbus.ByteArray(b''.join(chr(byte)

1408

for byte in value))

1426

1409

prop(value)

1427

1410

1428

1411

@dbus.service.method(dbus.PROPERTIES_IFACE,

2690

2673

def add_pipe(self, parent_pipe, proc):

2691

2674

# Call "handle_ipc" for both data and EOF events

2692

2675

GLib.io_add_watch(

2693

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2694

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2676

parent_pipe.fileno(),

2677

GLib.IO_IN | GLib.IO_HUP,

2695

2678

functools.partial(self.handle_ipc,

2696

2679

parent_pipe=parent_pipe,

2697

2680

proc=proc))

2735

2718

return False

2736

2719

2737

2720

GLib.io_add_watch(

2738

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2739

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2721

parent_pipe.fileno(),

2722

GLib.IO_IN | GLib.IO_HUP,

2740

2723

functools.partial(self.handle_ipc,

2741

2724

parent_pipe=parent_pipe,

2742

2725

proc=proc,

2757

2740

if command == 'getattr':

2758

2741

attrname = request[1]

2759

2742

if isinstance(client_object.__getattribute__(attrname),

2760

collections.abc.Callable):

2743

collections.Callable):

2761

2744

parent_pipe.send(('function', ))

2762

2745

else:

2763

2746

parent_pipe.send((

2774

2757

def rfc3339_duration_to_delta(duration):

2775

2758

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2776

2759

2777

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2778

True

2779

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2780

True

2781

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2782

True

2783

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2784

True

2785

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2786

True

2787

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2788

True

2789

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2790

True

2760

>>> rfc3339_duration_to_delta("P7D")

2761

datetime.timedelta(7)

2762

>>> rfc3339_duration_to_delta("PT60S")

2763

datetime.timedelta(0, 60)

2764

>>> rfc3339_duration_to_delta("PT60M")

2765

datetime.timedelta(0, 3600)

2766

>>> rfc3339_duration_to_delta("PT24H")

2767

datetime.timedelta(1)

2768

>>> rfc3339_duration_to_delta("P1W")

2769

datetime.timedelta(7)

2770

>>> rfc3339_duration_to_delta("PT5M30S")

2771

datetime.timedelta(0, 330)

2772

>>> rfc3339_duration_to_delta("P1DT3M20S")

2773

datetime.timedelta(1, 200)

2791

2774

"""

2792

2775

2793

2776

# Parsing an RFC 3339 duration with regular expressions is not

2873

2856

def string_to_delta(interval):

2874

2857

"""Parse a string and return a datetime.timedelta

2875

2858

2876

>>> string_to_delta('7d') == datetime.timedelta(7)

2877

True

2878

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2879

True

2880

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2881

True

2882

>>> string_to_delta('24h') == datetime.timedelta(1)

2883

True

2884

>>> string_to_delta('1w') == datetime.timedelta(7)

2885

True

2886

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2887

True

2859

>>> string_to_delta('7d')

2860

datetime.timedelta(7)

2861

>>> string_to_delta('60s')

2862

datetime.timedelta(0, 60)

2863

>>> string_to_delta('60m')

2864

datetime.timedelta(0, 3600)

2865

>>> string_to_delta('24h')

2866

datetime.timedelta(1)

2867

>>> string_to_delta('1w')

2868

datetime.timedelta(7)

2869

>>> string_to_delta('5m 30s')

2870

datetime.timedelta(0, 330)

2888

2871

"""

2889

2872

2890

2873

try:

2992

2975

2993

2976

options = parser.parse_args()

2994

2977

2978

if options.check:

2979

import doctest

2980

fail_count, test_count = doctest.testmod()

2981

sys.exit(os.EX_OK if fail_count == 0 else 1)

2982

2995

2983

# Default values for config file for server-global settings

2996

2984

if gnutls.has_rawpk:

2997

2985

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3260

3248

if isinstance(s, bytes)

3261

3249

else s) for s in

3262

3250

value["client_structure"]]

3263

# .name, .host, and .checker_command

3264

for k in ("name", "host", "checker_command"):

3251

# .name & .host

3252

for k in ("name", "host"):

3265

3253

if isinstance(value[k], bytes):

3266

3254

value[k] = value[k].decode("utf-8")

3267

3255

if "key_id" not in value:

3277

3265

for key, value in

3278

3266

bytes_old_client_settings.items()}

3279

3267

del bytes_old_client_settings

3280

# .host and .checker_command

3268

# .host

3281

3269

for value in old_client_settings.values():

3282

for attribute in ("host", "checker_command"):

3283

if isinstance(value[attribute], bytes):

3284

value[attribute] = (value[attribute]

3285

.decode("utf-8"))

3270

if isinstance(value["host"], bytes):

3271

value["host"] = (value["host"]

3272

.decode("utf-8"))

3286

3273

os.remove(stored_state_path)

3287

3274

except IOError as e:

3288

3275

if e.errno == errno.ENOENT:

3613

3600

sys.exit(1)

3614

3601

# End of Avahi example code

3615

3602

3616

GLib.io_add_watch(

3617

GLib.IOChannel.unix_new(tcp_server.fileno()),

3618

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3619

lambda *args, **kwargs: (tcp_server.handle_request

3620

(*args[2:], **kwargs) or True))

3603

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3604

lambda *args, **kwargs:

3605

(tcp_server.handle_request

3606

(*args[2:], **kwargs) or True))

3621

3607

3622

3608

logger.debug("Starting main loop")

3623

3609

main_loop.run()

3633

3619

# Must run before the D-Bus bus name gets deregistered

3634

3620

cleanup()

3635

3621

3636

3637

def should_only_run_tests():

3638

parser = argparse.ArgumentParser(add_help=False)

3639

parser.add_argument("--check", action='store_true')

3640

args, unknown_args = parser.parse_known_args()

3641

run_tests = args.check

3642

if run_tests:

3643

# Remove --check argument from sys.argv

3644

sys.argv[1:] = unknown_args

3645

return run_tests

3646

3647

# Add all tests from doctest strings

3648

def load_tests(loader, tests, none):

3649

import doctest

3650

tests.addTests(doctest.DocTestSuite())

3651

return tests

3652

3622

3653

3623

if __name__ == '__main__':

3654

try:

3655

if should_only_run_tests():

3656

# Call using ./mandos --check [--verbose]

3657

unittest.main()

3658

else:

3659

main()

3660

finally:

3661

logging.shutdown()

3624

main()