/mandos/release : revision 237.7.751

1

#!/usr/bin/python3 -bI

2

# -*- coding: utf-8; lexical-binding: t -*-

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This file is part of Mandos.

18

#

31

#

32

# Contact the authors at <mandos@recompile.se>.

33

#

34

35

from __future__ import (division, absolute_import, print_function,

35

36

unicode_literals)

36

37

39

40

except ImportError:

40

41

pass

41

42

import sys

43

import unittest

44

import argparse

45

import logging

46

import os

47

43

try:

48

44

import SocketServer as socketserver

49

45

except ImportError:

50

46

import socketserver

51

47

import socket

48

import argparse

52

49

import datetime

53

50

import errno

54

51

try:

55

52

import ConfigParser as configparser

56

53

except ImportError:

57

54

import configparser

55

import sys

58

56

import re

57

import os

59

58

import signal

60

59

import subprocess

61

60

import atexit

62

61

import stat

62

import logging

63

import logging.handlers

64

import pwd

65

import contextlib

77

import itertools

78

import collections

79

import codecs

80

import unittest

80

81

import random

81

import shlex

82

83

import dbus

84

import dbus.service

93

if sys.version_info.major == 2:

94

__metaclass__ = type

95

str = unicode

96

input = raw_input

97

96

98

97

# Add collections.abc.Callable if it does not exist

99

98

try:

104

103

collections.abc = abc

105

104

del abc

106

105

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Add os.set_inheritable if it does not exist

114

try:

115

os.set_inheritable

116

except AttributeError:

117

def set_inheritable(fd, inheritable):

118

flags = fcntl.fcntl(fd, fcntl.F_GETFD)

119

if inheritable and ((flags & fcntl.FD_CLOEXEC) != 0):

120

fcntl.fcntl(fd, fcntl.F_SETFL, flags & ~fcntl.FD_CLOEXEC)

121

elif (not inheritable) and ((flags & fcntl.FD_CLOEXEC) == 0):

122

fcntl.fcntl(fd, fcntl.F_SETFL, flags | fcntl.FD_CLOEXEC)

123

os.set_inheritable = set_inheritable

124

del set_inheritable

125

126

106

# Show warnings by default

127

107

if not sys.warnoptions:

128

108

import warnings

156

136

if sys.version_info < (3, 2):

157

137

configparser.Configparser = configparser.SafeConfigParser

158

138

159

version = "1.8.18"

139

version = "1.8.9"

160

140

stored_state_file = "clients.pickle"

161

141

162

log = logging.getLogger(os.path.basename(sys.argv[0]))

142

logger = logging.getLogger()

163

143

logging.captureWarnings(True) # Show warnings via the logging system

164

144

syslogger = None

165

145

202

182

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

203

183

address="/dev/log"))

204

184

syslogger.setFormatter(logging.Formatter

205

("Mandos [%(process)d]: %(levelname)s:"

206

" %(message)s"))

207

log.addHandler(syslogger)

185

('Mandos [%(process)d]: %(levelname)s:'

186

' %(message)s'))

187

logger.addHandler(syslogger)

208

188

209

189

if debug:

210

190

console = logging.StreamHandler()

211

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

212

" [%(process)d]:"

213

" %(levelname)s:"

214

" %(message)s"))

215

log.addHandler(console)

216

log.setLevel(level)

191

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

192

' [%(process)d]:'

193

' %(levelname)s:'

194

' %(message)s'))

195

logger.addHandler(console)

196

logger.setLevel(level)

217

197

218

198

219

199

class PGPError(Exception):

237

217

except OSError as e:

238

218

if e.errno != errno.ENOENT:

239

219

raise

240

self.gnupgargs = ["--batch",

241

"--homedir", self.tempdir,

242

"--force-mdc",

243

"--quiet"]

220

self.gnupgargs = ['--batch',

221

'--homedir', self.tempdir,

222

'--force-mdc',

223

'--quiet']

244

224

# Only GPG version 1 has the --no-use-agent option.

245

225

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

246

226

self.gnupgargs.append("--no-use-agent")

285

265

dir=self.tempdir) as passfile:

286

266

passfile.write(passphrase)

287

267

passfile.flush()

288

proc = subprocess.Popen([self.gpg, "--symmetric",

289

"--passphrase-file",

268

proc = subprocess.Popen([self.gpg, '--symmetric',

269

'--passphrase-file',

290

270

passfile.name]

291

271

+ self.gnupgargs,

292

272

stdin=subprocess.PIPE,

303

283

dir=self.tempdir) as passfile:

304

284

passfile.write(passphrase)

305

285

passfile.flush()

306

proc = subprocess.Popen([self.gpg, "--decrypt",

307

"--passphrase-file",

286

proc = subprocess.Popen([self.gpg, '--decrypt',

287

'--passphrase-file',

308

288

passfile.name]

309

289

+ self.gnupgargs,

310

290

stdin=subprocess.PIPE,

363

343

Attributes:

364

344

interface: integer; avahi.IF_UNSPEC or an interface index.

365

345

Used to optionally bind to the specified interface.

366

name: string; Example: "Mandos"

367

type: string; Example: "_mandos._tcp".

346

name: string; Example: 'Mandos'

347

type: string; Example: '_mandos._tcp'.

368

348

See <https://www.iana.org/assignments/service-names-port-numbers>

369

349

port: integer; what port to announce

370

350

TXT: list of strings; TXT record for the service

407

387

def rename(self, remove=True):

408

388

"""Derived from the Avahi example code"""

409

389

if self.rename_count >= self.max_renames:

410

log.critical("No suitable Zeroconf service name found"

411

" after %i retries, exiting.",

412

self.rename_count)

390

logger.critical("No suitable Zeroconf service name found"

391

" after %i retries, exiting.",

392

self.rename_count)

413

393

raise AvahiServiceError("Too many renames")

414

394

self.name = str(

415

395

self.server.GetAlternativeServiceName(self.name))

416

396

self.rename_count += 1

417

log.info("Changing Zeroconf service name to %r ...",

418

self.name)

397

logger.info("Changing Zeroconf service name to %r ...",

398

self.name)

419

399

if remove:

420

400

self.remove()

421

401

try:

423

403

except dbus.exceptions.DBusException as error:

424

404

if (error.get_dbus_name()

425

405

== "org.freedesktop.Avahi.CollisionError"):

426

log.info("Local Zeroconf service name collision.")

406

logger.info("Local Zeroconf service name collision.")

427

407

return self.rename(remove=False)

428

408

else:

429

log.critical("D-Bus Exception", exc_info=error)

409

logger.critical("D-Bus Exception", exc_info=error)

430

410

self.cleanup()

431

411

os._exit(1)

432

412

448

428

avahi.DBUS_INTERFACE_ENTRY_GROUP)

449

429

self.entry_group_state_changed_match = (

450

430

self.group.connect_to_signal(

451

"StateChanged", self.entry_group_state_changed))

452

log.debug("Adding Zeroconf service '%s' of type '%s' ...",

453

self.name, self.type)

431

'StateChanged', self.entry_group_state_changed))

432

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

433

self.name, self.type)

454

434

self.group.AddService(

455

435

self.interface,

456

436

self.protocol,

463

443

464

444

def entry_group_state_changed(self, state, error):

465

445

"""Derived from the Avahi example code"""

466

log.debug("Avahi entry group state change: %i", state)

446

logger.debug("Avahi entry group state change: %i", state)

467

447

468

448

if state == avahi.ENTRY_GROUP_ESTABLISHED:

469

log.debug("Zeroconf service established.")

449

logger.debug("Zeroconf service established.")

470

450

elif state == avahi.ENTRY_GROUP_COLLISION:

471

log.info("Zeroconf service name collision.")

451

logger.info("Zeroconf service name collision.")

472

452

self.rename()

473

453

elif state == avahi.ENTRY_GROUP_FAILURE:

474

log.critical("Avahi: Error in group state changed %s",

475

str(error))

454

logger.critical("Avahi: Error in group state changed %s",

455

str(error))

476

456

raise AvahiGroupError("State changed: {!s}".format(error))

477

457

478

458

def cleanup(self):

488

468

489

469

def server_state_changed(self, state, error=None):

490

470

"""Derived from the Avahi example code"""

491

log.debug("Avahi server state change: %i", state)

471

logger.debug("Avahi server state change: %i", state)

492

472

bad_states = {

493

473

avahi.SERVER_INVALID: "Zeroconf server invalid",

494

474

avahi.SERVER_REGISTERING: None,

498

478

if state in bad_states:

499

479

if bad_states[state] is not None:

500

480

if error is None:

501

log.error(bad_states[state])

481

logger.error(bad_states[state])

502

482

else:

503

log.error(bad_states[state] + ": %r", error)

483

logger.error(bad_states[state] + ": %r", error)

504

484

self.cleanup()

505

485

elif state == avahi.SERVER_RUNNING:

506

486

try:

508

488

except dbus.exceptions.DBusException as error:

509

489

if (error.get_dbus_name()

510

490

== "org.freedesktop.Avahi.CollisionError"):

511

log.info("Local Zeroconf service name collision.")

491

logger.info("Local Zeroconf service name"

492

" collision.")

512

493

return self.rename(remove=False)

513

494

else:

514

log.critical("D-Bus Exception", exc_info=error)

495

logger.critical("D-Bus Exception", exc_info=error)

515

496

self.cleanup()

516

497

os._exit(1)

517

498

else:

518

499

if error is None:

519

log.debug("Unknown state: %r", state)

500

logger.debug("Unknown state: %r", state)

520

501

else:

521

log.debug("Unknown state: %r: %r", state, error)

502

logger.debug("Unknown state: %r: %r", state, error)

522

503

523

504

def activate(self):

524

505

"""Derived from the Avahi example code"""

536

517

class AvahiServiceToSyslog(AvahiService):

537

518

def rename(self, *args, **kwargs):

538

519

"""Add the new name to the syslog messages"""

539

ret = super(AvahiServiceToSyslog, self).rename(*args,

540

**kwargs)

520

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

541

521

syslogger.setFormatter(logging.Formatter(

542

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

522

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

543

523

.format(self.name)))

544

524

return ret

545

525

575

555

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

576

556

577

557

# Types

578

class _session_int(ctypes.Structure):

558

class session_int(ctypes.Structure):

579

559

_fields_ = []

580

session_t = ctypes.POINTER(_session_int)

560

session_t = ctypes.POINTER(session_int)

581

561

582

562

class certificate_credentials_st(ctypes.Structure):

583

563

_fields_ = []

586

566

certificate_type_t = ctypes.c_int

587

567

588

568

class datum_t(ctypes.Structure):

589

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

590

("size", ctypes.c_uint)]

569

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

570

('size', ctypes.c_uint)]

591

571

592

class _openpgp_crt_int(ctypes.Structure):

572

class openpgp_crt_int(ctypes.Structure):

593

573

_fields_ = []

594

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

574

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

595

575

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

596

576

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

597

577

credentials_type_t = ctypes.c_int

606

586

# gnutls.strerror()

607

587

self.code = code

608

588

if message is None and code is not None:

609

message = gnutls.strerror(code).decode(

610

"utf-8", errors="replace")

589

message = gnutls.strerror(code)

611

590

return super(gnutls.Error, self).__init__(

612

591

message, *args)

613

592

614

593

class CertificateSecurityError(Error):

615

594

pass

616

595

617

class PointerTo:

618

def __init__(self, cls):

619

self.cls = cls

620

621

def from_param(self, obj):

622

if not isinstance(obj, self.cls):

623

raise TypeError("Not of type {}: {!r}"

624

.format(self.cls.__name__, obj))

625

return ctypes.byref(obj.from_param(obj))

626

627

class CastToVoidPointer:

628

def __init__(self, cls):

629

self.cls = cls

630

631

def from_param(self, obj):

632

if not isinstance(obj, self.cls):

633

raise TypeError("Not of type {}: {!r}"

634

.format(self.cls.__name__, obj))

635

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

636

637

class With_from_param:

638

@classmethod

639

def from_param(cls, obj):

640

return obj._as_parameter_

641

642

596

# Classes

643

class Credentials(With_from_param):

597

class Credentials:

644

598

def __init__(self):

645

self._as_parameter_ = gnutls.certificate_credentials_t()

646

gnutls.certificate_allocate_credentials(self)

599

self._c_object = gnutls.certificate_credentials_t()

600

gnutls.certificate_allocate_credentials(

601

ctypes.byref(self._c_object))

647

602

self.type = gnutls.CRD_CERTIFICATE

648

603

649

604

def __del__(self):

650

gnutls.certificate_free_credentials(self)

605

gnutls.certificate_free_credentials(self._c_object)

651

606

652

class ClientSession(With_from_param):

607

class ClientSession:

653

608

def __init__(self, socket, credentials=None):

654

self._as_parameter_ = gnutls.session_t()

609

self._c_object = gnutls.session_t()

655

610

gnutls_flags = gnutls.CLIENT

656

611

if gnutls.check_version(b"3.5.6"):

657

612

gnutls_flags |= gnutls.NO_TICKETS

658

613

if gnutls.has_rawpk:

659

614

gnutls_flags |= gnutls.ENABLE_RAWPK

660

gnutls.init(self, gnutls_flags)

615

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

661

616

del gnutls_flags

662

gnutls.set_default_priority(self)

663

gnutls.transport_set_ptr(self, socket.fileno())

664

gnutls.handshake_set_private_extensions(self, True)

617

gnutls.set_default_priority(self._c_object)

618

gnutls.transport_set_ptr(self._c_object, socket.fileno())

619

gnutls.handshake_set_private_extensions(self._c_object,

620

True)

665

621

self.socket = socket

666

622

if credentials is None:

667

623

credentials = gnutls.Credentials()

668

gnutls.credentials_set(self, credentials.type,

669

credentials)

624

gnutls.credentials_set(self._c_object, credentials.type,

625

ctypes.cast(credentials._c_object,

626

ctypes.c_void_p))

670

627

self.credentials = credentials

671

628

672

629

def __del__(self):

673

gnutls.deinit(self)

630

gnutls.deinit(self._c_object)

674

631

675

632

def handshake(self):

676

return gnutls.handshake(self)

633

return gnutls.handshake(self._c_object)

677

634

678

635

def send(self, data):

679

636

data = bytes(data)

680

637

data_len = len(data)

681

638

while data_len > 0:

682

data_len -= gnutls.record_send(self, data[-data_len:],

639

data_len -= gnutls.record_send(self._c_object,

640

data[-data_len:],

683

641

data_len)

684

642

685

643

def bye(self):

686

return gnutls.bye(self, gnutls.SHUT_RDWR)

644

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

687

645

688

646

# Error handling functions

689

647

def _error_code(result):

690

648

"""A function to raise exceptions on errors, suitable

691

for the "restype" attribute on ctypes functions"""

692

if result >= gnutls.E_SUCCESS:

649

for the 'restype' attribute on ctypes functions"""

650

if result >= 0:

693

651

return result

694

652

if result == gnutls.E_NO_CERTIFICATE_FOUND:

695

653

raise gnutls.CertificateSecurityError(code=result)

696

654

raise gnutls.Error(code=result)

697

655

698

def _retry_on_error(result, func, arguments,

699

_error_code=_error_code):

656

def _retry_on_error(result, func, arguments):

700

657

"""A function to retry on some errors, suitable

701

for the "errcheck" attribute on ctypes functions"""

702

while result < gnutls.E_SUCCESS:

658

for the 'errcheck' attribute on ctypes functions"""

659

while result < 0:

703

660

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

704

661

return _error_code(result)

705

662

result = func(*arguments)

710

667

711

668

# Functions

712

669

priority_set_direct = _library.gnutls_priority_set_direct

713

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

670

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

714

671

ctypes.POINTER(ctypes.c_char_p)]

715

672

priority_set_direct.restype = _error_code

716

673

717

674

init = _library.gnutls_init

718

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

675

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

719

676

init.restype = _error_code

720

677

721

678

set_default_priority = _library.gnutls_set_default_priority

722

set_default_priority.argtypes = [ClientSession]

679

set_default_priority.argtypes = [session_t]

723

680

set_default_priority.restype = _error_code

724

681

725

682

record_send = _library.gnutls_record_send

726

record_send.argtypes = [ClientSession, ctypes.c_void_p,

683

record_send.argtypes = [session_t, ctypes.c_void_p,

727

684

ctypes.c_size_t]

728

685

record_send.restype = ctypes.c_ssize_t

729

686

record_send.errcheck = _retry_on_error

731

688

certificate_allocate_credentials = (

732

689

_library.gnutls_certificate_allocate_credentials)

733

690

certificate_allocate_credentials.argtypes = [

734

PointerTo(Credentials)]

691

ctypes.POINTER(certificate_credentials_t)]

735

692

certificate_allocate_credentials.restype = _error_code

736

693

737

694

certificate_free_credentials = (

738

695

_library.gnutls_certificate_free_credentials)

739

certificate_free_credentials.argtypes = [Credentials]

696

certificate_free_credentials.argtypes = [

697

certificate_credentials_t]

740

698

certificate_free_credentials.restype = None

741

699

742

700

handshake_set_private_extensions = (

743

701

_library.gnutls_handshake_set_private_extensions)

744

handshake_set_private_extensions.argtypes = [ClientSession,

702

handshake_set_private_extensions.argtypes = [session_t,

745

703

ctypes.c_int]

746

704

handshake_set_private_extensions.restype = None

747

705

748

706

credentials_set = _library.gnutls_credentials_set

749

credentials_set.argtypes = [ClientSession, credentials_type_t,

750

CastToVoidPointer(Credentials)]

707

credentials_set.argtypes = [session_t, credentials_type_t,

708

ctypes.c_void_p]

751

709

credentials_set.restype = _error_code

752

710

753

711

strerror = _library.gnutls_strerror

755

713

strerror.restype = ctypes.c_char_p

756

714

757

715

certificate_type_get = _library.gnutls_certificate_type_get

758

certificate_type_get.argtypes = [ClientSession]

716

certificate_type_get.argtypes = [session_t]

759

717

certificate_type_get.restype = _error_code

760

718

761

719

certificate_get_peers = _library.gnutls_certificate_get_peers

762

certificate_get_peers.argtypes = [ClientSession,

720

certificate_get_peers.argtypes = [session_t,

763

721

ctypes.POINTER(ctypes.c_uint)]

764

722

certificate_get_peers.restype = ctypes.POINTER(datum_t)

765

723

772

730

global_set_log_function.restype = None

773

731

774

732

deinit = _library.gnutls_deinit

775

deinit.argtypes = [ClientSession]

733

deinit.argtypes = [session_t]

776

734

deinit.restype = None

777

735

778

736

handshake = _library.gnutls_handshake

779

handshake.argtypes = [ClientSession]

780

handshake.restype = ctypes.c_int

737

handshake.argtypes = [session_t]

738

handshake.restype = _error_code

781

739

handshake.errcheck = _retry_on_error

782

740

783

741

transport_set_ptr = _library.gnutls_transport_set_ptr

784

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

742

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

785

743

transport_set_ptr.restype = None

786

744

787

745

bye = _library.gnutls_bye

788

bye.argtypes = [ClientSession, close_request_t]

789

bye.restype = ctypes.c_int

746

bye.argtypes = [session_t, close_request_t]

747

bye.restype = _error_code

790

748

bye.errcheck = _retry_on_error

791

749

792

750

check_version = _library.gnutls_check_version

809

767

810

768

x509_crt_fmt_t = ctypes.c_int

811

769

812

# All the function declarations below are from

813

# gnutls/abstract.h

770

# All the function declarations below are from gnutls/abstract.h

814

771

pubkey_init = _library.gnutls_pubkey_init

815

772

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

816

773

pubkey_init.restype = _error_code

830

787

pubkey_deinit.argtypes = [pubkey_t]

831

788

pubkey_deinit.restype = None

832

789

else:

833

# All the function declarations below are from

834

# gnutls/openpgp.h

790

# All the function declarations below are from gnutls/openpgp.h

835

791

836

792

openpgp_crt_init = _library.gnutls_openpgp_crt_init

837

793

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

843

799

openpgp_crt_fmt_t]

844

800

openpgp_crt_import.restype = _error_code

845

801

846

openpgp_crt_verify_self = \

847

_library.gnutls_openpgp_crt_verify_self

848

openpgp_crt_verify_self.argtypes = [

849

openpgp_crt_t,

850

ctypes.c_uint,

851

ctypes.POINTER(ctypes.c_uint),

852

]

802

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

803

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

804

ctypes.POINTER(ctypes.c_uint)]

853

805

openpgp_crt_verify_self.restype = _error_code

854

806

855

807

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

866

818

867

819

if check_version(b"3.6.4"):

868

820

certificate_type_get2 = _library.gnutls_certificate_type_get2

869

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

821

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

870

822

certificate_type_get2.restype = _error_code

871

823

872

824

# Remove non-public functions

888

840

"""A representation of a client host served by this server.

889

841

890

842

Attributes:

891

approved: bool(); None if not yet approved/disapproved

843

approved: bool(); 'None' if not yet approved/disapproved

892

844

approval_delay: datetime.timedelta(); Time to wait for approval

893

845

approval_duration: datetime.timedelta(); Duration of one approval

894

846

checker: multiprocessing.Process(); a running checker process used

895

to see if the client lives. None if no process is

847

to see if the client lives. 'None' if no process is

896

848

running.

897

849

checker_callback_tag: a GLib event source tag, or None

898

850

checker_command: string; External command which is run to check

974

926

# key_id() and fingerprint() functions

975

927

client["key_id"] = (section.get("key_id", "").upper()

976

928

.replace(" ", ""))

977

client["fingerprint"] = (section.get("fingerprint",

978

"").upper()

929

client["fingerprint"] = (section["fingerprint"].upper()

979

930

.replace(" ", ""))

980

if not (client["key_id"] or client["fingerprint"]):

981

log.error("Skipping client %s without key_id or"

982

" fingerprint", client_name)

983

del settings[client_name]

984

continue

985

931

if "secret" in section:

986

932

client["secret"] = codecs.decode(section["secret"]

987

933

.encode("utf-8"),

1028

974

self.last_enabled = None

1029

975

self.expires = None

1030

976

1031

log.debug("Creating client %r", self.name)

1032

log.debug(" Key ID: %s", self.key_id)

1033

log.debug(" Fingerprint: %s", self.fingerprint)

977

logger.debug("Creating client %r", self.name)

978

logger.debug(" Key ID: %s", self.key_id)

979

logger.debug(" Fingerprint: %s", self.fingerprint)

1034

980

self.created = settings.get("created",

1035

981

datetime.datetime.utcnow())

1036

982

1064

1010

if getattr(self, "enabled", False):

1065

1011

# Already enabled

1066

1012

return

1013

self.expires = datetime.datetime.utcnow() + self.timeout

1067

1014

self.enabled = True

1068

1015

self.last_enabled = datetime.datetime.utcnow()

1069

1016

self.init_checker()

1074

1021

if not getattr(self, "enabled", False):

1075

1022

return False

1076

1023

if not quiet:

1077

log.info("Disabling client %s", self.name)

1024

logger.info("Disabling client %s", self.name)

1078

1025

if getattr(self, "disable_initiator_tag", None) is not None:

1079

1026

GLib.source_remove(self.disable_initiator_tag)

1080

1027

self.disable_initiator_tag = None

1092

1039

def __del__(self):

1093

1040

self.disable()

1094

1041

1095

def init_checker(self, randomize_start=False):

1096

# Schedule a new checker to be started a randomly selected

1097

# time (a fraction of 'interval') from now. This spreads out

1098

# the startup of checkers over time when the server is

1099

# started.

1042

def init_checker(self):

1043

# Schedule a new checker to be started an 'interval' from now,

1044

# and every interval from then on.

1100

1045

if self.checker_initiator_tag is not None:

1101

1046

GLib.source_remove(self.checker_initiator_tag)

1102

interval_milliseconds = int(self.interval.total_seconds()

1103

* 1000)

1104

if randomize_start:

1105

delay_milliseconds = random.randrange(

1106

interval_milliseconds + 1)

1107

else:

1108

delay_milliseconds = interval_milliseconds

1109

1047

self.checker_initiator_tag = GLib.timeout_add(

1110

delay_milliseconds, self.start_checker, randomize_start)

1111

delay = datetime.timedelta(0, 0, 0, delay_milliseconds)

1112

# A checker might take up to an 'interval' of time, so we can

1113

# expire at the soonest one interval after a checker was

1114

# started. Since the initial checker is delayed, the expire

1115

# time might have to be extended.

1116

now = datetime.datetime.utcnow()

1117

self.expires = now + delay + self.interval

1118

# Schedule a disable() at expire time

1048

random.randrange(int(self.interval.total_seconds() * 1000

1049

+ 1)),

1050

self.start_checker)

1051

# Schedule a disable() when 'timeout' has passed

1119

1052

if self.disable_initiator_tag is not None:

1120

1053

GLib.source_remove(self.disable_initiator_tag)

1121

1054

self.disable_initiator_tag = GLib.timeout_add(

1122

int((self.expires - now).total_seconds() * 1000),

1123

self.disable)

1055

int(self.timeout.total_seconds() * 1000), self.disable)

1056

# Also start a new checker *right now*.

1057

self.start_checker()

1124

1058

1125

1059

def checker_callback(self, source, condition, connection,

1126

1060

command):

1137

1071

self.last_checker_status = returncode

1138

1072

self.last_checker_signal = None

1139

1073

if self.last_checker_status == 0:

1140

log.info("Checker for %(name)s succeeded", vars(self))

1074

logger.info("Checker for %(name)s succeeded",

1075

vars(self))

1141

1076

self.checked_ok()

1142

1077

else:

1143

log.info("Checker for %(name)s failed", vars(self))

1078

logger.info("Checker for %(name)s failed", vars(self))

1144

1079

else:

1145

1080

self.last_checker_status = -1

1146

1081

self.last_checker_signal = -returncode

1147

log.warning("Checker for %(name)s crashed?", vars(self))

1082

logger.warning("Checker for %(name)s crashed?",

1083

vars(self))

1148

1084

return False

1149

1085

1150

1086

def checked_ok(self):

1169

1105

def need_approval(self):

1170

1106

self.last_approval_request = datetime.datetime.utcnow()

1171

1107

1172

def start_checker(self, start_was_randomized=False):

1108

def start_checker(self):

1173

1109

"""Start a new checker subprocess if one is not running.

1174

1110

1175

1111

If a checker already exists, leave it running and do

1184

1120

# should be.

1185

1121

1186

1122

if self.checker is not None and not self.checker.is_alive():

1187

log.warning("Checker was not alive; joining")

1123

logger.warning("Checker was not alive; joining")

1188

1124

self.checker.join()

1189

1125

self.checker = None

1190

1126

# Start a new checker if needed

1191

1127

if self.checker is None:

1192

1128

# Escape attributes for the shell

1193

1129

escaped_attrs = {

1194

attr: shlex.quote(str(getattr(self, attr)))

1130

attr: re.escape(str(getattr(self, attr)))

1195

1131

for attr in self.runtime_expansions}

1196

1132

try:

1197

1133

command = self.checker_command % escaped_attrs

1198

1134

except TypeError as error:

1199

log.error('Could not format string "%s"',

1200

self.checker_command, exc_info=error)

1135

logger.error('Could not format string "%s"',

1136

self.checker_command,

1137

exc_info=error)

1201

1138

return True # Try again later

1202

1139

self.current_checker_command = command

1203

log.info("Starting checker %r for %s", command, self.name)

1140

logger.info("Starting checker %r for %s", command,

1141

self.name)

1204

1142

# We don't need to redirect stdout and stderr, since

1205

1143

# in normal mode, that is already done by daemon(),

1206

1144

# and in debug mode we don't want to. (Stdin is

1225

1163

GLib.IOChannel.unix_new(pipe[0].fileno()),

1226

1164

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1227

1165

self.checker_callback, pipe[0], command)

1228

if start_was_randomized:

1229

# We were started after a random delay; Schedule a new

1230

# checker to be started an 'interval' from now, and every

1231

# interval from then on.

1232

now = datetime.datetime.utcnow()

1233

self.checker_initiator_tag = GLib.timeout_add(

1234

int(self.interval.total_seconds() * 1000),

1235

self.start_checker)

1236

self.expires = max(self.expires, now + self.interval)

1237

# Don't start a new checker again after same random delay

1238

return False

1239

1166

# Re-run this periodically if run by GLib.timeout_add

1240

1167

return True

1241

1168

1246

1173

self.checker_callback_tag = None

1247

1174

if getattr(self, "checker", None) is None:

1248

1175

return

1249

log.debug("Stopping checker for %(name)s", vars(self))

1176

logger.debug("Stopping checker for %(name)s", vars(self))

1250

1177

self.checker.terminate()

1251

1178

self.checker = None

1252

1179

1279

1206

func._dbus_name = func.__name__

1280

1207

if func._dbus_name.endswith("_dbus_property"):

1281

1208

func._dbus_name = func._dbus_name[:-14]

1282

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

1209

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1283

1210

return func

1284

1211

1285

1212

return decorator

1374

1301

1375

1302

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1376

1303

out_signature="s",

1377

path_keyword="object_path",

1378

connection_keyword="connection")

1304

path_keyword='object_path',

1305

connection_keyword='connection')

1379

1306

def Introspect(self, object_path, connection):

1380

1307

"""Overloading of standard D-Bus method.

1381

1308

1430

1357

document.unlink()

1431

1358

except (AttributeError, xml.dom.DOMException,

1432

1359

xml.parsers.expat.ExpatError) as error:

1433

log.error("Failed to override Introspection method",

1434

exc_info=error)

1360

logger.error("Failed to override Introspection method",

1361

exc_info=error)

1435

1362

return xmlstring

1436

1363

1437

1364

1534

1461

1535

1462

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1536

1463

out_signature="s",

1537

path_keyword="object_path",

1538

connection_keyword="connection")

1464

path_keyword='object_path',

1465

connection_keyword='connection')

1539

1466

def Introspect(self, object_path, connection):

1540

1467

"""Overloading of standard D-Bus method.

1541

1468

1597

1524

document.unlink()

1598

1525

except (AttributeError, xml.dom.DOMException,

1599

1526

xml.parsers.expat.ExpatError) as error:

1600

log.error("Failed to override Introspection method",

1601

exc_info=error)

1527

logger.error("Failed to override Introspection method",

1528

exc_info=error)

1602

1529

return xmlstring

1603

1530

1604

1531

1636

1563

1637

1564

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1638

1565

out_signature="s",

1639

path_keyword="object_path",

1640

connection_keyword="connection")

1566

path_keyword='object_path',

1567

connection_keyword='connection')

1641

1568

def Introspect(self, object_path, connection):

1642

1569

"""Overloading of standard D-Bus method.

1643

1570

1668

1595

document.unlink()

1669

1596

except (AttributeError, xml.dom.DOMException,

1670

1597

xml.parsers.expat.ExpatError) as error:

1671

log.error("Failed to override Introspection method",

1672

exc_info=error)

1598

logger.error("Failed to override Introspection method",

1599

exc_info=error)

1673

1600

return xmlstring

1674

1601

1675

1602

2309

2236

class ProxyClient:

2310

2237

def __init__(self, child_pipe, key_id, fpr, address):

2311

2238

self._pipe = child_pipe

2312

self._pipe.send(("init", key_id, fpr, address))

2239

self._pipe.send(('init', key_id, fpr, address))

2313

2240

if not self._pipe.recv():

2314

2241

raise KeyError(key_id or fpr)

2315

2242

2316

2243

def __getattribute__(self, name):

2317

if name == "_pipe":

2244

if name == '_pipe':

2318

2245

return super(ProxyClient, self).__getattribute__(name)

2319

self._pipe.send(("getattr", name))

2246

self._pipe.send(('getattr', name))

2320

2247

data = self._pipe.recv()

2321

if data[0] == "data":

2248

if data[0] == 'data':

2322

2249

return data[1]

2323

if data[0] == "function":

2250

if data[0] == 'function':

2324

2251

2325

2252

def func(*args, **kwargs):

2326

self._pipe.send(("funcall", name, args, kwargs))

2253

self._pipe.send(('funcall', name, args, kwargs))

2327

2254

return self._pipe.recv()[1]

2328

2255

2329

2256

return func

2330

2257

2331

2258

def __setattr__(self, name, value):

2332

if name == "_pipe":

2259

if name == '_pipe':

2333

2260

return super(ProxyClient, self).__setattr__(name, value)

2334

self._pipe.send(("setattr", name, value))

2261

self._pipe.send(('setattr', name, value))

2335

2262

2336

2263

2337

2264

class ClientHandler(socketserver.BaseRequestHandler, object):

2342

2269

2343

2270

def handle(self):

2344

2271

with contextlib.closing(self.server.child_pipe) as child_pipe:

2345

log.info("TCP connection from: %s",

2346

str(self.client_address))

2347

log.debug("Pipe FD: %d", self.server.child_pipe.fileno())

2272

logger.info("TCP connection from: %s",

2273

str(self.client_address))

2274

logger.debug("Pipe FD: %d",

2275

self.server.child_pipe.fileno())

2348

2276

2349

2277

session = gnutls.ClientSession(self.request)

2350

2278

2351

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2279

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2352

2280

# "+AES-256-CBC", "+SHA1",

2353

2281

# "+COMP-NULL", "+CTYPE-OPENPGP",

2354

2282

# "+DHE-DSS"))

2356

2284

priority = self.server.gnutls_priority

2357

2285

if priority is None:

2358

2286

priority = "NORMAL"

2359

gnutls.priority_set_direct(session,

2360

priority.encode("utf-8"), None)

2287

gnutls.priority_set_direct(session._c_object,

2288

priority.encode("utf-8"),

2289

None)

2361

2290

2362

2291

# Start communication using the Mandos protocol

2363

2292

# Get protocol number

2364

2293

line = self.request.makefile().readline()

2365

log.debug("Protocol version: %r", line)

2294

logger.debug("Protocol version: %r", line)

2366

2295

try:

2367

2296

if int(line.strip().split()[0]) > 1:

2368

2297

raise RuntimeError(line)

2369

2298

except (ValueError, IndexError, RuntimeError) as error:

2370

log.error("Unknown protocol version: %s", error)

2299

logger.error("Unknown protocol version: %s", error)

2371

2300

return

2372

2301

2373

2302

# Start GnuTLS connection

2374

2303

try:

2375

2304

session.handshake()

2376

2305

except gnutls.Error as error:

2377

log.warning("Handshake failed: %s", error)

2306

logger.warning("Handshake failed: %s", error)

2378

2307

# Do not run session.bye() here: the session is not

2379

2308

# established. Just abandon the request.

2380

2309

return

2381

log.debug("Handshake succeeded")

2310

logger.debug("Handshake succeeded")

2382

2311

2383

2312

approval_required = False

2384

2313

try:

2388

2317

key_id = self.key_id(

2389

2318

self.peer_certificate(session))

2390

2319

except (TypeError, gnutls.Error) as error:

2391

log.warning("Bad certificate: %s", error)

2320

logger.warning("Bad certificate: %s", error)

2392

2321

return

2393

log.debug("Key ID: %s",

2394

key_id.decode("utf-8",

2395

errors="replace"))

2322

logger.debug("Key ID: %s", key_id)

2396

2323

2397

2324

else:

2398

2325

key_id = b""

2400

2327

fpr = self.fingerprint(

2401

2328

self.peer_certificate(session))

2402

2329

except (TypeError, gnutls.Error) as error:

2403

log.warning("Bad certificate: %s", error)

2330

logger.warning("Bad certificate: %s", error)

2404

2331

return

2405

log.debug("Fingerprint: %s", fpr)

2332

logger.debug("Fingerprint: %s", fpr)

2406

2333

2407

2334

try:

2408

2335

client = ProxyClient(child_pipe, key_id, fpr,

2417

2344

2418

2345

while True:

2419

2346

if not client.enabled:

2420

log.info("Client %s is disabled", client.name)

2347

logger.info("Client %s is disabled",

2348

client.name)

2421

2349

if self.server.use_dbus:

2422

2350

# Emit D-Bus signal

2423

2351

client.Rejected("Disabled")

2427

2355

# We are approved or approval is disabled

2428

2356

break

2429

2357

elif client.approved is None:

2430

log.info("Client %s needs approval",

2431

client.name)

2358

logger.info("Client %s needs approval",

2359

client.name)

2432

2360

if self.server.use_dbus:

2433

2361

# Emit D-Bus signal

2434

2362

client.NeedApproval(

2435

2363

client.approval_delay.total_seconds()

2436

2364

* 1000, client.approved_by_default)

2437

2365

else:

2438

log.warning("Client %s was not approved",

2439

client.name)

2366

logger.warning("Client %s was not approved",

2367

client.name)

2440

2368

if self.server.use_dbus:

2441

2369

# Emit D-Bus signal

2442

2370

client.Rejected("Denied")

2450

2378

time2 = datetime.datetime.now()

2451

2379

if (time2 - time) >= delay:

2452

2380

if not client.approved_by_default:

2453

log.warning("Client %s timed out while"

2454

" waiting for approval",

2455

client.name)

2381

logger.warning("Client %s timed out while"

2382

" waiting for approval",

2383

client.name)

2456

2384

if self.server.use_dbus:

2457

2385

# Emit D-Bus signal

2458

2386

client.Rejected("Approval timed out")

2465

2393

try:

2466

2394

session.send(client.secret)

2467

2395

except gnutls.Error as error:

2468

log.warning("gnutls send failed", exc_info=error)

2396

logger.warning("gnutls send failed",

2397

exc_info=error)

2469

2398

return

2470

2399

2471

log.info("Sending secret to %s", client.name)

2400

logger.info("Sending secret to %s", client.name)

2472

2401

# bump the timeout using extended_timeout

2473

2402

client.bump_timeout(client.extended_timeout)

2474

2403

if self.server.use_dbus:

2481

2410

try:

2482

2411

session.bye()

2483

2412

except gnutls.Error as error:

2484

log.warning("GnuTLS bye failed", exc_info=error)

2413

logger.warning("GnuTLS bye failed",

2414

exc_info=error)

2485

2415

2486

2416

@staticmethod

2487

2417

def peer_certificate(session):

2488

2418

"Return the peer's certificate as a bytestring"

2489

2419

try:

2490

cert_type = gnutls.certificate_type_get2(

2491

session, gnutls.CTYPE_PEERS)

2420

cert_type = gnutls.certificate_type_get2(session._c_object,

2421

gnutls.CTYPE_PEERS)

2492

2422

except AttributeError:

2493

cert_type = gnutls.certificate_type_get(session)

2423

cert_type = gnutls.certificate_type_get(session._c_object)

2494

2424

if gnutls.has_rawpk:

2495

2425

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2496

2426

else:

2497

2427

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2498

2428

# If not a valid certificate type...

2499

2429

if cert_type not in valid_cert_types:

2500

log.info("Cert type %r not in %r", cert_type,

2501

valid_cert_types)

2430

logger.info("Cert type %r not in %r", cert_type,

2431

valid_cert_types)

2502

2432

# ...return invalid data

2503

2433

return b""

2504

2434

list_size = ctypes.c_uint(1)

2505

2435

cert_list = (gnutls.certificate_get_peers

2506

(session, ctypes.byref(list_size)))

2436

(session._c_object, ctypes.byref(list_size)))

2507

2437

if not bool(cert_list) and list_size.value != 0:

2508

2438

raise gnutls.Error("error getting peer certificate")

2509

2439

if list_size.value == 0:

2531

2461

buf = ctypes.create_string_buffer(32)

2532

2462

buf_len = ctypes.c_size_t(len(buf))

2533

2463

# Get the key ID from the raw public key into the buffer

2534

gnutls.pubkey_get_key_id(

2535

pubkey,

2536

gnutls.KEYID_USE_SHA256,

2537

ctypes.cast(ctypes.byref(buf),

2538

ctypes.POINTER(ctypes.c_ubyte)),

2539

ctypes.byref(buf_len))

2464

gnutls.pubkey_get_key_id(pubkey,

2465

gnutls.KEYID_USE_SHA256,

2466

ctypes.cast(ctypes.byref(buf),

2467

ctypes.POINTER(ctypes.c_ubyte)),

2468

ctypes.byref(buf_len))

2540

2469

# Deinit the certificate

2541

2470

gnutls.pubkey_deinit(pubkey)

2542

2471

2623

2552

2624

2553

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2625

2554

socketserver.TCPServer):

2626

"""IPv6-capable TCP server. Accepts None as address and/or port

2555

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2627

2556

2628

2557

Attributes:

2629

2558

enabled: Boolean; whether this server is activated yet

2680

2609

if SO_BINDTODEVICE is None:

2681

2610

# Fall back to a hard-coded value which seems to be

2682

2611

# common enough.

2683

log.warning("SO_BINDTODEVICE not found, trying 25")

2612

logger.warning("SO_BINDTODEVICE not found, trying 25")

2684

2613

SO_BINDTODEVICE = 25

2685

2614

try:

2686

2615

self.socket.setsockopt(

2688

2617

(self.interface + "\0").encode("utf-8"))

2689

2618

except socket.error as error:

2690

2619

if error.errno == errno.EPERM:

2691

log.error("No permission to bind to interface %s",

2692

self.interface)

2620

logger.error("No permission to bind to"

2621

" interface %s", self.interface)

2693

2622

elif error.errno == errno.ENOPROTOOPT:

2694

log.error("SO_BINDTODEVICE not available; cannot"

2695

" bind to interface %s", self.interface)

2623

logger.error("SO_BINDTODEVICE not available;"

2624

" cannot bind to interface %s",

2625

self.interface)

2696

2626

elif error.errno == errno.ENODEV:

2697

log.error("Interface %s does not exist, cannot"

2698

" bind", self.interface)

2627

logger.error("Interface %s does not exist,"

2628

" cannot bind", self.interface)

2699

2629

else:

2700

2630

raise

2701

2631

# Only bind(2) the socket if we really need to.

2780

2710

request = parent_pipe.recv()

2781

2711

command = request[0]

2782

2712

2783

if command == "init":

2713

if command == 'init':

2784

2714

key_id = request[1].decode("ascii")

2785

2715

fpr = request[2].decode("ascii")

2786

2716

address = request[3]

2787

2717

2788

2718

for c in self.clients.values():

2789

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2790

"27AE41E4649B934CA495991B7852B855"):

2719

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2791

2720

continue

2792

2721

if key_id and c.key_id == key_id:

2793

2722

client = c

2796

2725

client = c

2797

2726

break

2798

2727

else:

2799

log.info("Client not found for key ID: %s, address:"

2800

" %s", key_id or fpr, address)

2728

logger.info("Client not found for key ID: %s, address"

2729

": %s", key_id or fpr, address)

2801

2730

if self.use_dbus:

2802

2731

# Emit D-Bus signal

2803

2732

mandos_dbus_service.ClientNotFound(key_id or fpr,

2816

2745

# remove the old hook in favor of the new above hook on

2817

2746

# same fileno

2818

2747

return False

2819

if command == "funcall":

2748

if command == 'funcall':

2820

2749

funcname = request[1]

2821

2750

args = request[2]

2822

2751

kwargs = request[3]

2823

2752

2824

parent_pipe.send(("data", getattr(client_object,

2753

parent_pipe.send(('data', getattr(client_object,

2825

2754

funcname)(*args,

2826

2755

**kwargs)))

2827

2756

2828

if command == "getattr":

2757

if command == 'getattr':

2829

2758

attrname = request[1]

2830

2759

if isinstance(client_object.__getattribute__(attrname),

2831

2760

collections.abc.Callable):

2832

parent_pipe.send(("function", ))

2761

parent_pipe.send(('function', ))

2833

2762

else:

2834

2763

parent_pipe.send((

2835

"data", client_object.__getattribute__(attrname)))

2764

'data', client_object.__getattribute__(attrname)))

2836

2765

2837

if command == "setattr":

2766

if command == 'setattr':

2838

2767

attrname = request[1]

2839

2768

value = request[2]

2840

2769

setattr(client_object, attrname, value)

2845

2774

def rfc3339_duration_to_delta(duration):

2846

2775

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2847

2776

2848

>>> timedelta = datetime.timedelta

2849

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2850

True

2851

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2852

True

2853

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2854

True

2855

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2856

True

2857

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2858

True

2859

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2860

True

2861

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2862

True

2863

>>> del timedelta

2777

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2778

True

2779

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2780

True

2781

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2782

True

2783

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2784

True

2785

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2786

True

2787

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2788

True

2789

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2790

True

2864

2791

"""

2865

2792

2866

2793

# Parsing an RFC 3339 duration with regular expressions is not

2946

2873

def string_to_delta(interval):

2947

2874

"""Parse a string and return a datetime.timedelta

2948

2875

2949

>>> string_to_delta("7d") == datetime.timedelta(7)

2950

True

2951

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2952

True

2953

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2954

True

2955

>>> string_to_delta("24h") == datetime.timedelta(1)

2956

True

2957

>>> string_to_delta("1w") == datetime.timedelta(7)

2958

True

2959

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2876

>>> string_to_delta('7d') == datetime.timedelta(7)

2877

True

2878

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2879

True

2880

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2881

True

2882

>>> string_to_delta('24h') == datetime.timedelta(1)

2883

True

2884

>>> string_to_delta('1w') == datetime.timedelta(7)

2885

True

2886

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2960

2887

True

2961

2888

"""

2962

2889

3109

3036

# Later, stdin will, and stdout and stderr might, be dup'ed

3110

3037

# over with an opened os.devnull. But we don't want this to

3111

3038

# happen with a supplied network socket.

3112

while 0 <= server_settings["socket"] <= 2:

3039

if 0 <= server_settings["socket"] <= 2:

3113

3040

server_settings["socket"] = os.dup(server_settings

3114

3041

["socket"])

3115

os.set_inheritable(server_settings["socket"], False)

3116

3042

del server_config

3117

3043

3118

3044

# Override the settings from the config file with command line

3167

3093

3168

3094

if server_settings["servicename"] != "Mandos":

3169

3095

syslogger.setFormatter(

3170

logging.Formatter("Mandos ({}) [%(process)d]:"

3171

" %(levelname)s: %(message)s".format(

3096

logging.Formatter('Mandos ({}) [%(process)d]:'

3097

' %(levelname)s: %(message)s'.format(

3172

3098

server_settings["servicename"])))

3173

3099

3174

3100

# Parse config file with clients

3198

3124

try:

3199

3125

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

3200

3126

except IOError as e:

3201

log.error("Could not open file %r", pidfilename,

3202

exc_info=e)

3127

logger.error("Could not open file %r", pidfilename,

3128

exc_info=e)

3203

3129

3204

3130

for name, group in (("_mandos", "_mandos"),

3205

3131

("mandos", "mandos"),

3216

3142

try:

3217

3143

os.setgid(gid)

3218

3144

os.setuid(uid)

3219

log.debug("Did setuid/setgid to %s:%s", uid, gid)

3145

if debug:

3146

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3147

gid))

3220

3148

except OSError as error:

3221

log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,

3222

os.strerror(error.errno))

3149

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3150

.format(uid, gid, os.strerror(error.errno)))

3223

3151

if error.errno != errno.EPERM:

3224

3152

raise

3225

3153

3232

3160

3233

3161

@gnutls.log_func

3234

3162

def debug_gnutls(level, string):

3235

log.debug("GnuTLS: %s",

3236

string[:-1].decode("utf-8", errors="replace"))

3163

logger.debug("GnuTLS: %s", string[:-1])

3237

3164

3238

3165

gnutls.global_set_log_function(debug_gnutls)

3239

3166

3257

3184

# From the Avahi example code

3258

3185

DBusGMainLoop(set_as_default=True)

3259

3186

main_loop = GLib.MainLoop()

3260

if use_dbus or zeroconf:

3261

bus = dbus.SystemBus()

3187

bus = dbus.SystemBus()

3262

3188

# End of Avahi example code

3263

3189

if use_dbus:

3264

3190

try:

3269

3195

"se.bsnet.fukt.Mandos", bus,

3270

3196

do_not_queue=True)

3271

3197

except dbus.exceptions.DBusException as e:

3272

log.error("Disabling D-Bus:", exc_info=e)

3198

logger.error("Disabling D-Bus:", exc_info=e)

3273

3199

use_dbus = False

3274

3200

server_settings["use_dbus"] = False

3275

3201

tcp_server.use_dbus = False

3360

3286

os.remove(stored_state_path)

3361

3287

except IOError as e:

3362

3288

if e.errno == errno.ENOENT:

3363

log.warning("Could not load persistent state:"

3364

" %s", os.strerror(e.errno))

3289

logger.warning("Could not load persistent state:"

3290

" {}".format(os.strerror(e.errno)))

3365

3291

else:

3366

log.critical("Could not load persistent state:",

3367

exc_info=e)

3292

logger.critical("Could not load persistent state:",

3293

exc_info=e)

3368

3294

raise

3369

3295

except EOFError as e:

3370

log.warning("Could not load persistent state: EOFError:",

3371

exc_info=e)

3296

logger.warning("Could not load persistent state: "

3297

"EOFError:",

3298

exc_info=e)

3372

3299

3373

3300

with PGPEngine() as pgp:

3374

3301

for client_name, client in clients_data.items():

3401

3328

if client["enabled"]:

3402

3329

if datetime.datetime.utcnow() >= client["expires"]:

3403

3330

if not client["last_checked_ok"]:

3404

log.warning("disabling client %s - Client"

3405

" never performed a successful"

3406

" checker", client_name)

3331

logger.warning(

3332

"disabling client {} - Client never "

3333

"performed a successful checker".format(

3334

client_name))

3407

3335

client["enabled"] = False

3408

3336

elif client["last_checker_status"] != 0:

3409

log.warning("disabling client %s - Client"

3410

" last checker failed with error"

3411

" code %s", client_name,

3412

client["last_checker_status"])

3337

logger.warning(

3338

"disabling client {} - Client last"

3339

" checker failed with error code"

3340

" {}".format(

3341

client_name,

3342

client["last_checker_status"]))

3413

3343

client["enabled"] = False

3414

3344

else:

3415

3345

client["expires"] = (

3416

3346

datetime.datetime.utcnow()

3417

3347

+ client["timeout"])

3418

log.debug("Last checker succeeded, keeping %s"

3419

" enabled", client_name)

3348

logger.debug("Last checker succeeded,"

3349

" keeping {} enabled".format(

3350

client_name))

3420

3351

try:

3421

3352

client["secret"] = pgp.decrypt(

3422

3353

client["encrypted_secret"],

3423

3354

client_settings[client_name]["secret"])

3424

3355

except PGPError:

3425

3356

# If decryption fails, we use secret from new settings

3426

log.debug("Failed to decrypt %s old secret",

3427

client_name)

3357

logger.debug("Failed to decrypt {} old secret".format(

3358

client_name))

3428

3359

client["secret"] = (client_settings[client_name]

3429

3360

["secret"])

3430

3361

3444

3375

server_settings=server_settings)

3445

3376

3446

3377

if not tcp_server.clients:

3447

log.warning("No clients defined")

3378

logger.warning("No clients defined")

3448

3379

3449

3380

if not foreground:

3450

3381

if pidfile is not None:

3453

3384

with pidfile:

3454

3385

print(pid, file=pidfile)

3455

3386

except IOError:

3456

log.error("Could not write to file %r with PID %d",

3457

pidfilename, pid)

3387

logger.error("Could not write to file %r with PID %d",

3388

pidfilename, pid)

3458

3389

del pidfile

3459

3390

del pidfilename

3460

3391

3610

3541

3611

3542

try:

3612

3543

with tempfile.NamedTemporaryFile(

3613

mode="wb",

3544

mode='wb',

3614

3545

suffix=".pickle",

3615

prefix="clients-",

3546

prefix='clients-',

3616

3547

dir=os.path.dirname(stored_state_path),

3617

3548

delete=False) as stored_state:

3618

3549

pickle.dump((clients, client_settings), stored_state,

3626

3557

except NameError:

3627

3558

pass

3628

3559

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3629

log.warning("Could not save persistent state: %s",

3630

os.strerror(e.errno))

3560

logger.warning("Could not save persistent state: {}"

3561

.format(os.strerror(e.errno)))

3631

3562

else:

3632

log.warning("Could not save persistent state:",

3633

exc_info=e)

3563

logger.warning("Could not save persistent state:",

3564

exc_info=e)

3634

3565

raise

3635

3566

3636

3567

# Delete all clients, and settings from config

3653

3584

mandos_dbus_service.client_added_signal(client)

3654

3585

# Need to initiate checking of clients

3655

3586

if client.enabled:

3656

client.init_checker(randomize_start=True)

3587

client.init_checker()

3657

3588

3658

3589

tcp_server.enable()

3659

3590

tcp_server.server_activate()

3662

3593

if zeroconf:

3663

3594

service.port = tcp_server.socket.getsockname()[1]

3664

3595

if use_ipv6:

3665

log.info("Now listening on address %r, port %d, flowinfo %d,"

3666

" scope_id %d", *tcp_server.socket.getsockname())

3596

logger.info("Now listening on address %r, port %d,"

3597

" flowinfo %d, scope_id %d",

3598

*tcp_server.socket.getsockname())

3667

3599

else: # IPv4

3668

log.info("Now listening on address %r, port %d",

3669

*tcp_server.socket.getsockname())

3600

logger.info("Now listening on address %r, port %d",

3601

*tcp_server.socket.getsockname())

3670

3602

3671

3603

# service.interface = tcp_server.socket.getsockname()[3]

3672

3604

3676

3608

try:

3677

3609

service.activate()

3678

3610

except dbus.exceptions.DBusException as error:

3679

log.critical("D-Bus Exception", exc_info=error)

3611

logger.critical("D-Bus Exception", exc_info=error)

3680

3612

cleanup()

3681

3613

sys.exit(1)

3682

3614

# End of Avahi example code

3687

3619

lambda *args, **kwargs: (tcp_server.handle_request

3688

3620

(*args[2:], **kwargs) or True))

3689

3621

3690

log.debug("Starting main loop")

3622

logger.debug("Starting main loop")

3691

3623

main_loop.run()

3692

3624

except AvahiError as error:

3693

log.critical("Avahi Error", exc_info=error)

3625

logger.critical("Avahi Error", exc_info=error)

3694

3626

cleanup()

3695

3627

sys.exit(1)

3696

3628

except KeyboardInterrupt:

3697

3629

if debug:

3698

3630

print("", file=sys.stderr)

3699

log.debug("Server received KeyboardInterrupt")

3700

log.debug("Server exiting")

3631

logger.debug("Server received KeyboardInterrupt")

3632

logger.debug("Server exiting")

3701

3633

# Must run before the D-Bus bus name gets deregistered

3702

3634

cleanup()

3703

3635

3704

3636

3705

def parse_test_args():

3706

# type: () -> argparse.Namespace

3637

def should_only_run_tests():

3707

3638

parser = argparse.ArgumentParser(add_help=False)

3708

parser.add_argument("--check", action="store_true")

3709

parser.add_argument("--prefix", )

3639

parser.add_argument("--check", action='store_true')

3710

3640

args, unknown_args = parser.parse_known_args()

3711

if args.check:

3712

# Remove test options from sys.argv

3641

run_tests = args.check

3642

if run_tests:

3643

# Remove --check argument from sys.argv

3713

3644

sys.argv[1:] = unknown_args

3714

return args

3645

return run_tests

3715

3646

3716

3647

# Add all tests from doctest strings

3717

3648

def load_tests(loader, tests, none):

3719

3650

tests.addTests(doctest.DocTestSuite())

3720

3651

return tests

3721

3652

3722

if __name__ == "__main__":

3723

options = parse_test_args()

3653

if __name__ == '__main__':

3724

3654

try:

3725

if options.check:

3726

extra_test_prefix = options.prefix

3727

if extra_test_prefix is not None:

3728

if not (unittest.main(argv=[""], exit=False)

3729

.result.wasSuccessful()):

3730

sys.exit(1)

3731

class ExtraTestLoader(unittest.TestLoader):

3732

testMethodPrefix = extra_test_prefix

3733

# Call using ./scriptname --test [--verbose]

3734

unittest.main(argv=[""], testLoader=ExtraTestLoader())

3735

else:

3736

unittest.main(argv=[""])

3655

if should_only_run_tests():

3656

# Call using ./mandos --check [--verbose]

3657

unittest.main()

3737

3658

else:

3738

3659

main()

3739

3660

finally:

3740

3661

logging.shutdown()

3741

3742

# Local Variables:

3743

# run-tests:

3744

# (lambda (&optional extra)

3745

# (if (not (funcall run-tests-in-test-buffer default-directory

3746

# extra))

3747

# (funcall show-test-buffer-in-test-window)

3748

# (funcall remove-test-window)

3749

# (if extra (message "Extra tests run successfully!"))))

3750

# run-tests-in-test-buffer:

3751

# (lambda (dir &optional extra)

3752

# (with-current-buffer (get-buffer-create "*Test*")

3753

# (setq buffer-read-only nil

3754

# default-directory dir)

3755

# (erase-buffer)

3756

# (compilation-mode))

3757

# (let ((process-result

3758

# (let ((inhibit-read-only t))

3759

# (process-file-shell-command

3760

# (funcall get-command-line extra) nil "*Test*"))))

3761

# (and (numberp process-result)

3762

# (= process-result 0))))

3763

# get-command-line:

3764

# (lambda (&optional extra)

3765

# (let ((quoted-script

3766

# (shell-quote-argument (funcall get-script-name))))

3767

# (format

3768

# (concat "%s --check" (if extra " --prefix=atest" ""))

3769

# quoted-script)))

3770

# get-script-name:

3771

# (lambda ()

3772

# (if (fboundp 'file-local-name)

3773

# (file-local-name (buffer-file-name))

3774

# (or (file-remote-p (buffer-file-name) 'localname)

3775

# (buffer-file-name))))

3776

# remove-test-window:

3777

# (lambda ()

3778

# (let ((test-window (get-buffer-window "*Test*")))

3779

# (if test-window (delete-window test-window))))

3780

# show-test-buffer-in-test-window:

3781

# (lambda ()

3782

# (when (not (get-buffer-window-list "*Test*"))

3783

# (setq next-error-last-buffer (get-buffer "*Test*"))

3784

# (let* ((side (if (>= (window-width) 146) 'right 'bottom))

3785

# (display-buffer-overriding-action

3786

# `((display-buffer-in-side-window) (side . ,side)

3787

# (window-height . fit-window-to-buffer)

3788

# (window-width . fit-window-to-buffer))))

3789

# (display-buffer "*Test*"))))

3790

# eval:

3791

# (progn

3792

# (let* ((run-extra-tests (lambda () (interactive)

3793

# (funcall run-tests t)))

3794

# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t

3795

# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c

3796

# (setq minor-mode-overriding-map-alist

3797

# (cons `(run-tests . ,outer-keymap)

3798

# minor-mode-overriding-map-alist)))

3799

# (add-hook 'after-save-hook run-tests 90 t))

3800

# End: