/mandos/release : revision 237.7.753

1

#!/usr/bin/python3 -bI

2

# -*- coding: utf-8; lexical-binding: t -*-

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This file is part of Mandos.

18

#

31

#

32

# Contact the authors at <mandos@recompile.se>.

33

#

34

35

from __future__ import (division, absolute_import, print_function,

35

36

unicode_literals)

36

37

39

40

except ImportError:

40

41

pass

41

42

import sys

43

import unittest

44

import argparse

45

import logging

46

import os

47

43

try:

48

44

import SocketServer as socketserver

49

45

except ImportError:

50

46

import socketserver

51

47

import socket

48

import argparse

52

49

import datetime

53

50

import errno

54

51

try:

55

52

import ConfigParser as configparser

56

53

except ImportError:

57

54

import configparser

55

import sys

58

56

import re

57

import os

59

58

import signal

60

59

import subprocess

61

60

import atexit

62

61

import stat

62

import logging

63

import logging.handlers

64

import pwd

65

import contextlib

77

import itertools

78

import collections

79

import codecs

80

import unittest

80

81

import random

81

82

import shlex

82

83

93

94

if sys.version_info.major == 2:

94

95

__metaclass__ = type

95

96

str = unicode

96

input = raw_input

97

98

# Add collections.abc.Callable if it does not exist

99

try:

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Add os.set_inheritable if it does not exist

114

try:

115

os.set_inheritable

116

except AttributeError:

117

def set_inheritable(fd, inheritable):

118

flags = fcntl.fcntl(fd, fcntl.F_GETFD)

119

if inheritable and ((flags & fcntl.FD_CLOEXEC) != 0):

120

fcntl.fcntl(fd, fcntl.F_SETFL, flags & ~fcntl.FD_CLOEXEC)

121

elif (not inheritable) and ((flags & fcntl.FD_CLOEXEC) == 0):

122

fcntl.fcntl(fd, fcntl.F_SETFL, flags | fcntl.FD_CLOEXEC)

123

os.set_inheritable = set_inheritable

124

del set_inheritable

125

126

113

# Show warnings by default

127

114

if not sys.warnoptions:

128

115

import warnings

156

143

if sys.version_info < (3, 2):

157

144

configparser.Configparser = configparser.SafeConfigParser

158

145

159

version = "1.8.17"

146

version = "1.8.9"

160

147

stored_state_file = "clients.pickle"

161

148

162

log = logging.getLogger(os.path.basename(sys.argv[0]))

149

logger = logging.getLogger()

163

150

logging.captureWarnings(True) # Show warnings via the logging system

164

151

syslogger = None

165

152

202

189

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

203

190

address="/dev/log"))

204

191

syslogger.setFormatter(logging.Formatter

205

("Mandos [%(process)d]: %(levelname)s:"

206

" %(message)s"))

207

log.addHandler(syslogger)

192

('Mandos [%(process)d]: %(levelname)s:'

193

' %(message)s'))

194

logger.addHandler(syslogger)

208

195

209

196

if debug:

210

197

console = logging.StreamHandler()

211

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

212

" [%(process)d]:"

213

" %(levelname)s:"

214

" %(message)s"))

215

log.addHandler(console)

216

log.setLevel(level)

198

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

199

' [%(process)d]:'

200

' %(levelname)s:'

201

' %(message)s'))

202

logger.addHandler(console)

203

logger.setLevel(level)

217

204

218

205

219

206

class PGPError(Exception):

237

224

except OSError as e:

238

225

if e.errno != errno.ENOENT:

239

226

raise

240

self.gnupgargs = ["--batch",

241

"--homedir", self.tempdir,

242

"--force-mdc",

243

"--quiet"]

227

self.gnupgargs = ['--batch',

228

'--homedir', self.tempdir,

229

'--force-mdc',

230

'--quiet']

244

231

# Only GPG version 1 has the --no-use-agent option.

245

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

246

233

self.gnupgargs.append("--no-use-agent")

285

272

dir=self.tempdir) as passfile:

286

273

passfile.write(passphrase)

287

274

passfile.flush()

288

proc = subprocess.Popen([self.gpg, "--symmetric",

289

"--passphrase-file",

275

proc = subprocess.Popen([self.gpg, '--symmetric',

276

'--passphrase-file',

290

277

passfile.name]

291

278

+ self.gnupgargs,

292

279

stdin=subprocess.PIPE,

303

290

dir=self.tempdir) as passfile:

304

291

passfile.write(passphrase)

305

292

passfile.flush()

306

proc = subprocess.Popen([self.gpg, "--decrypt",

307

"--passphrase-file",

293

proc = subprocess.Popen([self.gpg, '--decrypt',

294

'--passphrase-file',

308

295

passfile.name]

309

296

+ self.gnupgargs,

310

297

stdin=subprocess.PIPE,

363

350

Attributes:

364

351

interface: integer; avahi.IF_UNSPEC or an interface index.

365

352

Used to optionally bind to the specified interface.

366

name: string; Example: "Mandos"

367

type: string; Example: "_mandos._tcp".

353

name: string; Example: 'Mandos'

354

type: string; Example: '_mandos._tcp'.

368

355

See <https://www.iana.org/assignments/service-names-port-numbers>

369

356

port: integer; what port to announce

370

357

TXT: list of strings; TXT record for the service

407

394

def rename(self, remove=True):

408

395

"""Derived from the Avahi example code"""

409

396

if self.rename_count >= self.max_renames:

410

log.critical("No suitable Zeroconf service name found"

411

" after %i retries, exiting.",

412

self.rename_count)

397

logger.critical("No suitable Zeroconf service name found"

398

" after %i retries, exiting.",

399

self.rename_count)

413

400

raise AvahiServiceError("Too many renames")

414

401

self.name = str(

415

402

self.server.GetAlternativeServiceName(self.name))

416

403

self.rename_count += 1

417

log.info("Changing Zeroconf service name to %r ...",

418

self.name)

404

logger.info("Changing Zeroconf service name to %r ...",

405

self.name)

419

406

if remove:

420

407

self.remove()

421

408

try:

423

410

except dbus.exceptions.DBusException as error:

424

411

if (error.get_dbus_name()

425

412

== "org.freedesktop.Avahi.CollisionError"):

426

log.info("Local Zeroconf service name collision.")

413

logger.info("Local Zeroconf service name collision.")

427

414

return self.rename(remove=False)

428

415

else:

429

log.critical("D-Bus Exception", exc_info=error)

416

logger.critical("D-Bus Exception", exc_info=error)

430

417

self.cleanup()

431

418

os._exit(1)

432

419

448

435

avahi.DBUS_INTERFACE_ENTRY_GROUP)

449

436

self.entry_group_state_changed_match = (

450

437

self.group.connect_to_signal(

451

"StateChanged", self.entry_group_state_changed))

452

log.debug("Adding Zeroconf service '%s' of type '%s' ...",

453

self.name, self.type)

438

'StateChanged', self.entry_group_state_changed))

439

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

440

self.name, self.type)

454

441

self.group.AddService(

455

442

self.interface,

456

443

self.protocol,

463

450

464

451

def entry_group_state_changed(self, state, error):

465

452

"""Derived from the Avahi example code"""

466

log.debug("Avahi entry group state change: %i", state)

453

logger.debug("Avahi entry group state change: %i", state)

467

454

468

455

if state == avahi.ENTRY_GROUP_ESTABLISHED:

469

log.debug("Zeroconf service established.")

456

logger.debug("Zeroconf service established.")

470

457

elif state == avahi.ENTRY_GROUP_COLLISION:

471

log.info("Zeroconf service name collision.")

458

logger.info("Zeroconf service name collision.")

472

459

self.rename()

473

460

elif state == avahi.ENTRY_GROUP_FAILURE:

474

log.critical("Avahi: Error in group state changed %s",

475

str(error))

461

logger.critical("Avahi: Error in group state changed %s",

462

str(error))

476

463

raise AvahiGroupError("State changed: {!s}".format(error))

477

464

478

465

def cleanup(self):

488

475

489

476

def server_state_changed(self, state, error=None):

490

477

"""Derived from the Avahi example code"""

491

log.debug("Avahi server state change: %i", state)

478

logger.debug("Avahi server state change: %i", state)

492

479

bad_states = {

493

480

avahi.SERVER_INVALID: "Zeroconf server invalid",

494

481

avahi.SERVER_REGISTERING: None,

498

485

if state in bad_states:

499

486

if bad_states[state] is not None:

500

487

if error is None:

501

log.error(bad_states[state])

488

logger.error(bad_states[state])

502

489

else:

503

log.error(bad_states[state] + ": %r", error)

490

logger.error(bad_states[state] + ": %r", error)

504

491

self.cleanup()

505

492

elif state == avahi.SERVER_RUNNING:

506

493

try:

508

495

except dbus.exceptions.DBusException as error:

509

496

if (error.get_dbus_name()

510

497

== "org.freedesktop.Avahi.CollisionError"):

511

log.info("Local Zeroconf service name collision.")

498

logger.info("Local Zeroconf service name"

499

" collision.")

512

500

return self.rename(remove=False)

513

501

else:

514

log.critical("D-Bus Exception", exc_info=error)

502

logger.critical("D-Bus Exception", exc_info=error)

515

503

self.cleanup()

516

504

os._exit(1)

517

505

else:

518

506

if error is None:

519

log.debug("Unknown state: %r", state)

507

logger.debug("Unknown state: %r", state)

520

508

else:

521

log.debug("Unknown state: %r: %r", state, error)

509

logger.debug("Unknown state: %r: %r", state, error)

522

510

523

511

def activate(self):

524

512

"""Derived from the Avahi example code"""

536

524

class AvahiServiceToSyslog(AvahiService):

537

525

def rename(self, *args, **kwargs):

538

526

"""Add the new name to the syslog messages"""

539

ret = super(AvahiServiceToSyslog, self).rename(*args,

540

**kwargs)

527

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

541

528

syslogger.setFormatter(logging.Formatter(

542

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

529

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

543

530

.format(self.name)))

544

531

return ret

545

532

575

562

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

576

563

577

564

# Types

578

class _session_int(ctypes.Structure):

565

class session_int(ctypes.Structure):

579

566

_fields_ = []

580

session_t = ctypes.POINTER(_session_int)

567

session_t = ctypes.POINTER(session_int)

581

568

582

569

class certificate_credentials_st(ctypes.Structure):

583

570

_fields_ = []

586

573

certificate_type_t = ctypes.c_int

587

574

588

575

class datum_t(ctypes.Structure):

589

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

590

("size", ctypes.c_uint)]

576

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

577

('size', ctypes.c_uint)]

591

578

592

class _openpgp_crt_int(ctypes.Structure):

579

class openpgp_crt_int(ctypes.Structure):

593

580

_fields_ = []

594

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

581

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

595

582

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

596

583

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

597

584

credentials_type_t = ctypes.c_int

606

593

# gnutls.strerror()

607

594

self.code = code

608

595

if message is None and code is not None:

609

message = gnutls.strerror(code).decode(

610

"utf-8", errors="replace")

596

message = gnutls.strerror(code)

611

597

return super(gnutls.Error, self).__init__(

612

598

message, *args)

613

599

614

600

class CertificateSecurityError(Error):

615

601

pass

616

602

617

class PointerTo:

618

def __init__(self, cls):

619

self.cls = cls

620

621

def from_param(self, obj):

622

if not isinstance(obj, self.cls):

623

raise TypeError("Not of type {}: {!r}"

624

.format(self.cls.__name__, obj))

625

return ctypes.byref(obj.from_param(obj))

626

627

class CastToVoidPointer:

628

def __init__(self, cls):

629

self.cls = cls

630

631

def from_param(self, obj):

632

if not isinstance(obj, self.cls):

633

raise TypeError("Not of type {}: {!r}"

634

.format(self.cls.__name__, obj))

635

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

636

637

class With_from_param:

638

@classmethod

639

def from_param(cls, obj):

640

return obj._as_parameter_

641

642

603

# Classes

643

class Credentials(With_from_param):

604

class Credentials:

644

605

def __init__(self):

645

self._as_parameter_ = gnutls.certificate_credentials_t()

646

gnutls.certificate_allocate_credentials(self)

606

self._c_object = gnutls.certificate_credentials_t()

607

gnutls.certificate_allocate_credentials(

608

ctypes.byref(self._c_object))

647

609

self.type = gnutls.CRD_CERTIFICATE

648

610

649

611

def __del__(self):

650

gnutls.certificate_free_credentials(self)

612

gnutls.certificate_free_credentials(self._c_object)

651

613

652

class ClientSession(With_from_param):

614

class ClientSession:

653

615

def __init__(self, socket, credentials=None):

654

self._as_parameter_ = gnutls.session_t()

616

self._c_object = gnutls.session_t()

655

617

gnutls_flags = gnutls.CLIENT

656

618

if gnutls.check_version(b"3.5.6"):

657

619

gnutls_flags |= gnutls.NO_TICKETS

658

620

if gnutls.has_rawpk:

659

621

gnutls_flags |= gnutls.ENABLE_RAWPK

660

gnutls.init(self, gnutls_flags)

622

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

661

623

del gnutls_flags

662

gnutls.set_default_priority(self)

663

gnutls.transport_set_ptr(self, socket.fileno())

664

gnutls.handshake_set_private_extensions(self, True)

624

gnutls.set_default_priority(self._c_object)

625

gnutls.transport_set_ptr(self._c_object, socket.fileno())

626

gnutls.handshake_set_private_extensions(self._c_object,

627

True)

665

628

self.socket = socket

666

629

if credentials is None:

667

630

credentials = gnutls.Credentials()

668

gnutls.credentials_set(self, credentials.type,

669

credentials)

631

gnutls.credentials_set(self._c_object, credentials.type,

632

ctypes.cast(credentials._c_object,

633

ctypes.c_void_p))

670

634

self.credentials = credentials

671

635

672

636

def __del__(self):

673

gnutls.deinit(self)

637

gnutls.deinit(self._c_object)

674

638

675

639

def handshake(self):

676

return gnutls.handshake(self)

640

return gnutls.handshake(self._c_object)

677

641

678

642

def send(self, data):

679

643

data = bytes(data)

680

644

data_len = len(data)

681

645

while data_len > 0:

682

data_len -= gnutls.record_send(self, data[-data_len:],

646

data_len -= gnutls.record_send(self._c_object,

647

data[-data_len:],

683

648

data_len)

684

649

685

650

def bye(self):

686

return gnutls.bye(self, gnutls.SHUT_RDWR)

651

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

687

652

688

653

# Error handling functions

689

654

def _error_code(result):

690

655

"""A function to raise exceptions on errors, suitable

691

for the "restype" attribute on ctypes functions"""

692

if result >= gnutls.E_SUCCESS:

656

for the 'restype' attribute on ctypes functions"""

657

if result >= 0:

693

658

return result

694

659

if result == gnutls.E_NO_CERTIFICATE_FOUND:

695

660

raise gnutls.CertificateSecurityError(code=result)

696

661

raise gnutls.Error(code=result)

697

662

698

def _retry_on_error(result, func, arguments,

699

_error_code=_error_code):

663

def _retry_on_error(result, func, arguments):

700

664

"""A function to retry on some errors, suitable

701

for the "errcheck" attribute on ctypes functions"""

702

while result < gnutls.E_SUCCESS:

665

for the 'errcheck' attribute on ctypes functions"""

666

while result < 0:

703

667

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

704

668

return _error_code(result)

705

669

result = func(*arguments)

710

674

711

675

# Functions

712

676

priority_set_direct = _library.gnutls_priority_set_direct

713

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

677

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

714

678

ctypes.POINTER(ctypes.c_char_p)]

715

679

priority_set_direct.restype = _error_code

716

680

717

681

init = _library.gnutls_init

718

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

682

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

719

683

init.restype = _error_code

720

684

721

685

set_default_priority = _library.gnutls_set_default_priority

722

set_default_priority.argtypes = [ClientSession]

686

set_default_priority.argtypes = [session_t]

723

687

set_default_priority.restype = _error_code

724

688

725

689

record_send = _library.gnutls_record_send

726

record_send.argtypes = [ClientSession, ctypes.c_void_p,

690

record_send.argtypes = [session_t, ctypes.c_void_p,

727

691

ctypes.c_size_t]

728

692

record_send.restype = ctypes.c_ssize_t

729

693

record_send.errcheck = _retry_on_error

731

695

certificate_allocate_credentials = (

732

696

_library.gnutls_certificate_allocate_credentials)

733

697

certificate_allocate_credentials.argtypes = [

734

PointerTo(Credentials)]

698

ctypes.POINTER(certificate_credentials_t)]

735

699

certificate_allocate_credentials.restype = _error_code

736

700

737

701

certificate_free_credentials = (

738

702

_library.gnutls_certificate_free_credentials)

739

certificate_free_credentials.argtypes = [Credentials]

703

certificate_free_credentials.argtypes = [

704

certificate_credentials_t]

740

705

certificate_free_credentials.restype = None

741

706

742

707

handshake_set_private_extensions = (

743

708

_library.gnutls_handshake_set_private_extensions)

744

handshake_set_private_extensions.argtypes = [ClientSession,

709

handshake_set_private_extensions.argtypes = [session_t,

745

710

ctypes.c_int]

746

711

handshake_set_private_extensions.restype = None

747

712

748

713

credentials_set = _library.gnutls_credentials_set

749

credentials_set.argtypes = [ClientSession, credentials_type_t,

750

CastToVoidPointer(Credentials)]

714

credentials_set.argtypes = [session_t, credentials_type_t,

715

ctypes.c_void_p]

751

716

credentials_set.restype = _error_code

752

717

753

718

strerror = _library.gnutls_strerror

755

720

strerror.restype = ctypes.c_char_p

756

721

757

722

certificate_type_get = _library.gnutls_certificate_type_get

758

certificate_type_get.argtypes = [ClientSession]

723

certificate_type_get.argtypes = [session_t]

759

724

certificate_type_get.restype = _error_code

760

725

761

726

certificate_get_peers = _library.gnutls_certificate_get_peers

762

certificate_get_peers.argtypes = [ClientSession,

727

certificate_get_peers.argtypes = [session_t,

763

728

ctypes.POINTER(ctypes.c_uint)]

764

729

certificate_get_peers.restype = ctypes.POINTER(datum_t)

765

730

772

737

global_set_log_function.restype = None

773

738

774

739

deinit = _library.gnutls_deinit

775

deinit.argtypes = [ClientSession]

740

deinit.argtypes = [session_t]

776

741

deinit.restype = None

777

742

778

743

handshake = _library.gnutls_handshake

779

handshake.argtypes = [ClientSession]

780

handshake.restype = ctypes.c_int

744

handshake.argtypes = [session_t]

745

handshake.restype = _error_code

781

746

handshake.errcheck = _retry_on_error

782

747

783

748

transport_set_ptr = _library.gnutls_transport_set_ptr

784

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

749

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

785

750

transport_set_ptr.restype = None

786

751

787

752

bye = _library.gnutls_bye

788

bye.argtypes = [ClientSession, close_request_t]

789

bye.restype = ctypes.c_int

753

bye.argtypes = [session_t, close_request_t]

754

bye.restype = _error_code

790

755

bye.errcheck = _retry_on_error

791

756

792

757

check_version = _library.gnutls_check_version

809

774

810

775

x509_crt_fmt_t = ctypes.c_int

811

776

812

# All the function declarations below are from

813

# gnutls/abstract.h

777

# All the function declarations below are from gnutls/abstract.h

814

778

pubkey_init = _library.gnutls_pubkey_init

815

779

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

816

780

pubkey_init.restype = _error_code

830

794

pubkey_deinit.argtypes = [pubkey_t]

831

795

pubkey_deinit.restype = None

832

796

else:

833

# All the function declarations below are from

834

# gnutls/openpgp.h

797

# All the function declarations below are from gnutls/openpgp.h

835

798

836

799

openpgp_crt_init = _library.gnutls_openpgp_crt_init

837

800

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

843

806

openpgp_crt_fmt_t]

844

807

openpgp_crt_import.restype = _error_code

845

808

846

openpgp_crt_verify_self = \

847

_library.gnutls_openpgp_crt_verify_self

848

openpgp_crt_verify_self.argtypes = [

849

openpgp_crt_t,

850

ctypes.c_uint,

851

ctypes.POINTER(ctypes.c_uint),

852

]

809

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

810

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

811

ctypes.POINTER(ctypes.c_uint)]

853

812

openpgp_crt_verify_self.restype = _error_code

854

813

855

814

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

866

825

867

826

if check_version(b"3.6.4"):

868

827

certificate_type_get2 = _library.gnutls_certificate_type_get2

869

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

828

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

870

829

certificate_type_get2.restype = _error_code

871

830

872

831

# Remove non-public functions

888

847

"""A representation of a client host served by this server.

889

848

890

849

Attributes:

891

approved: bool(); None if not yet approved/disapproved

850

approved: bool(); 'None' if not yet approved/disapproved

892

851

approval_delay: datetime.timedelta(); Time to wait for approval

893

852

approval_duration: datetime.timedelta(); Duration of one approval

894

853

checker: multiprocessing.Process(); a running checker process used

895

to see if the client lives. None if no process is

854

to see if the client lives. 'None' if no process is

896

855

running.

897

856

checker_callback_tag: a GLib event source tag, or None

898

857

checker_command: string; External command which is run to check

974

933

# key_id() and fingerprint() functions

975

934

client["key_id"] = (section.get("key_id", "").upper()

976

935

.replace(" ", ""))

977

client["fingerprint"] = (section.get("fingerprint",

978

"").upper()

936

client["fingerprint"] = (section["fingerprint"].upper()

979

937

.replace(" ", ""))

980

if not (client["key_id"] or client["fingerprint"]):

981

log.error("Skipping client %s without key_id or"

982

" fingerprint", client_name)

983

del settings[client_name]

984

continue

985

938

if "secret" in section:

986

939

client["secret"] = codecs.decode(section["secret"]

987

940

.encode("utf-8"),

1028

981

self.last_enabled = None

1029

982

self.expires = None

1030

983

1031

log.debug("Creating client %r", self.name)

1032

log.debug(" Key ID: %s", self.key_id)

1033

log.debug(" Fingerprint: %s", self.fingerprint)

984

logger.debug("Creating client %r", self.name)

985

logger.debug(" Key ID: %s", self.key_id)

986

logger.debug(" Fingerprint: %s", self.fingerprint)

1034

987

self.created = settings.get("created",

1035

988

datetime.datetime.utcnow())

1036

989

1064

1017

if getattr(self, "enabled", False):

1065

1018

# Already enabled

1066

1019

return

1020

self.expires = datetime.datetime.utcnow() + self.timeout

1067

1021

self.enabled = True

1068

1022

self.last_enabled = datetime.datetime.utcnow()

1069

1023

self.init_checker()

1074

1028

if not getattr(self, "enabled", False):

1075

1029

return False

1076

1030

if not quiet:

1077

log.info("Disabling client %s", self.name)

1031

logger.info("Disabling client %s", self.name)

1078

1032

if getattr(self, "disable_initiator_tag", None) is not None:

1079

1033

GLib.source_remove(self.disable_initiator_tag)

1080

1034

self.disable_initiator_tag = None

1092

1046

def __del__(self):

1093

1047

self.disable()

1094

1048

1095

def init_checker(self, randomize_start=False):

1096

# Schedule a new checker to be started a randomly selected

1097

# time (a fraction of 'interval') from now. This spreads out

1098

# the startup of checkers over time when the server is

1099

# started.

1049

def init_checker(self):

1050

# Schedule a new checker to be started an 'interval' from now,

1051

# and every interval from then on.

1100

1052

if self.checker_initiator_tag is not None:

1101

1053

GLib.source_remove(self.checker_initiator_tag)

1102

interval_milliseconds = int(self.interval.total_seconds()

1103

* 1000)

1104

if randomize_start:

1105

delay_milliseconds = random.randrange(

1106

interval_milliseconds + 1)

1107

else:

1108

delay_milliseconds = interval_milliseconds

1109

1054

self.checker_initiator_tag = GLib.timeout_add(

1110

delay_milliseconds, self.start_checker, randomize_start)

1111

delay = datetime.timedelta(0, 0, 0, delay_milliseconds)

1112

# A checker might take up to an 'interval' of time, so we can

1113

# expire at the soonest one interval after a checker was

1114

# started. Since the initial checker is delayed, the expire

1115

# time might have to be extended.

1116

now = datetime.datetime.utcnow()

1117

self.expires = now + delay + self.interval

1118

# Schedule a disable() at expire time

1055

random.randrange(int(self.interval.total_seconds() * 1000

1056

+ 1)),

1057

self.start_checker)

1058

# Schedule a disable() when 'timeout' has passed

1119

1059

if self.disable_initiator_tag is not None:

1120

1060

GLib.source_remove(self.disable_initiator_tag)

1121

1061

self.disable_initiator_tag = GLib.timeout_add(

1122

int((self.expires - now).total_seconds() * 1000),

1123

self.disable)

1062

int(self.timeout.total_seconds() * 1000), self.disable)

1063

# Also start a new checker *right now*.

1064

self.start_checker()

1124

1065

1125

1066

def checker_callback(self, source, condition, connection,

1126

1067

command):

1137

1078

self.last_checker_status = returncode

1138

1079

self.last_checker_signal = None

1139

1080

if self.last_checker_status == 0:

1140

log.info("Checker for %(name)s succeeded", vars(self))

1081

logger.info("Checker for %(name)s succeeded",

1082

vars(self))

1141

1083

self.checked_ok()

1142

1084

else:

1143

log.info("Checker for %(name)s failed", vars(self))

1085

logger.info("Checker for %(name)s failed", vars(self))

1144

1086

else:

1145

1087

self.last_checker_status = -1

1146

1088

self.last_checker_signal = -returncode

1147

log.warning("Checker for %(name)s crashed?", vars(self))

1089

logger.warning("Checker for %(name)s crashed?",

1090

vars(self))

1148

1091

return False

1149

1092

1150

1093

def checked_ok(self):

1169

1112

def need_approval(self):

1170

1113

self.last_approval_request = datetime.datetime.utcnow()

1171

1114

1172

def start_checker(self, start_was_randomized=False):

1115

def start_checker(self):

1173

1116

"""Start a new checker subprocess if one is not running.

1174

1117

1175

1118

If a checker already exists, leave it running and do

1184

1127

# should be.

1185

1128

1186

1129

if self.checker is not None and not self.checker.is_alive():

1187

log.warning("Checker was not alive; joining")

1130

logger.warning("Checker was not alive; joining")

1188

1131

self.checker.join()

1189

1132

self.checker = None

1190

1133

# Start a new checker if needed

1196

1139

try:

1197

1140

command = self.checker_command % escaped_attrs

1198

1141

except TypeError as error:

1199

log.error('Could not format string "%s"',

1200

self.checker_command, exc_info=error)

1142

logger.error('Could not format string "%s"',

1143

self.checker_command,

1144

exc_info=error)

1201

1145

return True # Try again later

1202

1146

self.current_checker_command = command

1203

log.info("Starting checker %r for %s", command, self.name)

1147

logger.info("Starting checker %r for %s", command,

1148

self.name)

1204

1149

# We don't need to redirect stdout and stderr, since

1205

1150

# in normal mode, that is already done by daemon(),

1206

1151

# and in debug mode we don't want to. (Stdin is

1225

1170

GLib.IOChannel.unix_new(pipe[0].fileno()),

1226

1171

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1227

1172

self.checker_callback, pipe[0], command)

1228

if start_was_randomized:

1229

# We were started after a random delay; Schedule a new

1230

# checker to be started an 'interval' from now, and every

1231

# interval from then on.

1232

now = datetime.datetime.utcnow()

1233

self.checker_initiator_tag = GLib.timeout_add(

1234

int(self.interval.total_seconds() * 1000),

1235

self.start_checker)

1236

self.expires = max(self.expires, now + self.interval)

1237

# Don't start a new checker again after same random delay

1238

return False

1239

1173

# Re-run this periodically if run by GLib.timeout_add

1240

1174

return True

1241

1175

1246

1180

self.checker_callback_tag = None

1247

1181

if getattr(self, "checker", None) is None:

1248

1182

return

1249

log.debug("Stopping checker for %(name)s", vars(self))

1183

logger.debug("Stopping checker for %(name)s", vars(self))

1250

1184

self.checker.terminate()

1251

1185

self.checker = None

1252

1186

1279

1213

func._dbus_name = func.__name__

1280

1214

if func._dbus_name.endswith("_dbus_property"):

1281

1215

func._dbus_name = func._dbus_name[:-14]

1282

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

1216

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1283

1217

return func

1284

1218

1285

1219

return decorator

1374

1308

1375

1309

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1376

1310

out_signature="s",

1377

path_keyword="object_path",

1378

connection_keyword="connection")

1311

path_keyword='object_path',

1312

connection_keyword='connection')

1379

1313

def Introspect(self, object_path, connection):

1380

1314

"""Overloading of standard D-Bus method.

1381

1315

1430

1364

document.unlink()

1431

1365

except (AttributeError, xml.dom.DOMException,

1432

1366

xml.parsers.expat.ExpatError) as error:

1433

log.error("Failed to override Introspection method",

1434

exc_info=error)

1367

logger.error("Failed to override Introspection method",

1368

exc_info=error)

1435

1369

return xmlstring

1436

1370

1437

1371

1534

1468

1535

1469

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1536

1470

out_signature="s",

1537

path_keyword="object_path",

1538

connection_keyword="connection")

1471

path_keyword='object_path',

1472

connection_keyword='connection')

1539

1473

def Introspect(self, object_path, connection):

1540

1474

"""Overloading of standard D-Bus method.

1541

1475

1597

1531

document.unlink()

1598

1532

except (AttributeError, xml.dom.DOMException,

1599

1533

xml.parsers.expat.ExpatError) as error:

1600

log.error("Failed to override Introspection method",

1601

exc_info=error)

1534

logger.error("Failed to override Introspection method",

1535

exc_info=error)

1602

1536

return xmlstring

1603

1537

1604

1538

1636

1570

1637

1571

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1638

1572

out_signature="s",

1639

path_keyword="object_path",

1640

connection_keyword="connection")

1573

path_keyword='object_path',

1574

connection_keyword='connection')

1641

1575

def Introspect(self, object_path, connection):

1642

1576

"""Overloading of standard D-Bus method.

1643

1577

1668

1602

document.unlink()

1669

1603

except (AttributeError, xml.dom.DOMException,

1670

1604

xml.parsers.expat.ExpatError) as error:

1671

log.error("Failed to override Introspection method",

1672

exc_info=error)

1605

logger.error("Failed to override Introspection method",

1606

exc_info=error)

1673

1607

return xmlstring

1674

1608

1675

1609

2309

2243

class ProxyClient:

2310

2244

def __init__(self, child_pipe, key_id, fpr, address):

2311

2245

self._pipe = child_pipe

2312

self._pipe.send(("init", key_id, fpr, address))

2246

self._pipe.send(('init', key_id, fpr, address))

2313

2247

if not self._pipe.recv():

2314

2248

raise KeyError(key_id or fpr)

2315

2249

2316

2250

def __getattribute__(self, name):

2317

if name == "_pipe":

2251

if name == '_pipe':

2318

2252

return super(ProxyClient, self).__getattribute__(name)

2319

self._pipe.send(("getattr", name))

2253

self._pipe.send(('getattr', name))

2320

2254

data = self._pipe.recv()

2321

if data[0] == "data":

2255

if data[0] == 'data':

2322

2256

return data[1]

2323

if data[0] == "function":

2257

if data[0] == 'function':

2324

2258

2325

2259

def func(*args, **kwargs):

2326

self._pipe.send(("funcall", name, args, kwargs))

2260

self._pipe.send(('funcall', name, args, kwargs))

2327

2261

return self._pipe.recv()[1]

2328

2262

2329

2263

return func

2330

2264

2331

2265

def __setattr__(self, name, value):

2332

if name == "_pipe":

2266

if name == '_pipe':

2333

2267

return super(ProxyClient, self).__setattr__(name, value)

2334

self._pipe.send(("setattr", name, value))

2268

self._pipe.send(('setattr', name, value))

2335

2269

2336

2270

2337

2271

class ClientHandler(socketserver.BaseRequestHandler, object):

2342

2276

2343

2277

def handle(self):

2344

2278

with contextlib.closing(self.server.child_pipe) as child_pipe:

2345

log.info("TCP connection from: %s",

2346

str(self.client_address))

2347

log.debug("Pipe FD: %d", self.server.child_pipe.fileno())

2279

logger.info("TCP connection from: %s",

2280

str(self.client_address))

2281

logger.debug("Pipe FD: %d",

2282

self.server.child_pipe.fileno())

2348

2283

2349

2284

session = gnutls.ClientSession(self.request)

2350

2285

2351

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2286

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2352

2287

# "+AES-256-CBC", "+SHA1",

2353

2288

# "+COMP-NULL", "+CTYPE-OPENPGP",

2354

2289

# "+DHE-DSS"))

2356

2291

priority = self.server.gnutls_priority

2357

2292

if priority is None:

2358

2293

priority = "NORMAL"

2359

gnutls.priority_set_direct(session,

2360

priority.encode("utf-8"), None)

2294

gnutls.priority_set_direct(session._c_object,

2295

priority.encode("utf-8"),

2296

None)

2361

2297

2362

2298

# Start communication using the Mandos protocol

2363

2299

# Get protocol number

2364

2300

line = self.request.makefile().readline()

2365

log.debug("Protocol version: %r", line)

2301

logger.debug("Protocol version: %r", line)

2366

2302

try:

2367

2303

if int(line.strip().split()[0]) > 1:

2368

2304

raise RuntimeError(line)

2369

2305

except (ValueError, IndexError, RuntimeError) as error:

2370

log.error("Unknown protocol version: %s", error)

2306

logger.error("Unknown protocol version: %s", error)

2371

2307

return

2372

2308

2373

2309

# Start GnuTLS connection

2374

2310

try:

2375

2311

session.handshake()

2376

2312

except gnutls.Error as error:

2377

log.warning("Handshake failed: %s", error)

2313

logger.warning("Handshake failed: %s", error)

2378

2314

# Do not run session.bye() here: the session is not

2379

2315

# established. Just abandon the request.

2380

2316

return

2381

log.debug("Handshake succeeded")

2317

logger.debug("Handshake succeeded")

2382

2318

2383

2319

approval_required = False

2384

2320

try:

2388

2324

key_id = self.key_id(

2389

2325

self.peer_certificate(session))

2390

2326

except (TypeError, gnutls.Error) as error:

2391

log.warning("Bad certificate: %s", error)

2327

logger.warning("Bad certificate: %s", error)

2392

2328

return

2393

log.debug("Key ID: %s",

2394

key_id.decode("utf-8",

2395

errors="replace"))

2329

logger.debug("Key ID: %s", key_id)

2396

2330

2397

2331

else:

2398

2332

key_id = b""

2400

2334

fpr = self.fingerprint(

2401

2335

self.peer_certificate(session))

2402

2336

except (TypeError, gnutls.Error) as error:

2403

log.warning("Bad certificate: %s", error)

2337

logger.warning("Bad certificate: %s", error)

2404

2338

return

2405

log.debug("Fingerprint: %s", fpr)

2339

logger.debug("Fingerprint: %s", fpr)

2406

2340

2407

2341

try:

2408

2342

client = ProxyClient(child_pipe, key_id, fpr,

2417

2351

2418

2352

while True:

2419

2353

if not client.enabled:

2420

log.info("Client %s is disabled", client.name)

2354

logger.info("Client %s is disabled",

2355

client.name)

2421

2356

if self.server.use_dbus:

2422

2357

# Emit D-Bus signal

2423

2358

client.Rejected("Disabled")

2427

2362

# We are approved or approval is disabled

2428

2363

break

2429

2364

elif client.approved is None:

2430

log.info("Client %s needs approval",

2431

client.name)

2365

logger.info("Client %s needs approval",

2366

client.name)

2432

2367

if self.server.use_dbus:

2433

2368

# Emit D-Bus signal

2434

2369

client.NeedApproval(

2435

2370

client.approval_delay.total_seconds()

2436

2371

* 1000, client.approved_by_default)

2437

2372

else:

2438

log.warning("Client %s was not approved",

2439

client.name)

2373

logger.warning("Client %s was not approved",

2374

client.name)

2440

2375

if self.server.use_dbus:

2441

2376

# Emit D-Bus signal

2442

2377

client.Rejected("Denied")

2450

2385

time2 = datetime.datetime.now()

2451

2386

if (time2 - time) >= delay:

2452

2387

if not client.approved_by_default:

2453

log.warning("Client %s timed out while"

2454

" waiting for approval",

2455

client.name)

2388

logger.warning("Client %s timed out while"

2389

" waiting for approval",

2390

client.name)

2456

2391

if self.server.use_dbus:

2457

2392

# Emit D-Bus signal

2458

2393

client.Rejected("Approval timed out")

2465

2400

try:

2466

2401

session.send(client.secret)

2467

2402

except gnutls.Error as error:

2468

log.warning("gnutls send failed", exc_info=error)

2403

logger.warning("gnutls send failed",

2404

exc_info=error)

2469

2405

return

2470

2406

2471

log.info("Sending secret to %s", client.name)

2407

logger.info("Sending secret to %s", client.name)

2472

2408

# bump the timeout using extended_timeout

2473

2409

client.bump_timeout(client.extended_timeout)

2474

2410

if self.server.use_dbus:

2481

2417

try:

2482

2418

session.bye()

2483

2419

except gnutls.Error as error:

2484

log.warning("GnuTLS bye failed", exc_info=error)

2420

logger.warning("GnuTLS bye failed",

2421

exc_info=error)

2485

2422

2486

2423

@staticmethod

2487

2424

def peer_certificate(session):

2488

2425

"Return the peer's certificate as a bytestring"

2489

2426

try:

2490

cert_type = gnutls.certificate_type_get2(

2491

session, gnutls.CTYPE_PEERS)

2427

cert_type = gnutls.certificate_type_get2(session._c_object,

2428

gnutls.CTYPE_PEERS)

2492

2429

except AttributeError:

2493

cert_type = gnutls.certificate_type_get(session)

2430

cert_type = gnutls.certificate_type_get(session._c_object)

2494

2431

if gnutls.has_rawpk:

2495

2432

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2496

2433

else:

2497

2434

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2498

2435

# If not a valid certificate type...

2499

2436

if cert_type not in valid_cert_types:

2500

log.info("Cert type %r not in %r", cert_type,

2501

valid_cert_types)

2437

logger.info("Cert type %r not in %r", cert_type,

2438

valid_cert_types)

2502

2439

# ...return invalid data

2503

2440

return b""

2504

2441

list_size = ctypes.c_uint(1)

2505

2442

cert_list = (gnutls.certificate_get_peers

2506

(session, ctypes.byref(list_size)))

2443

(session._c_object, ctypes.byref(list_size)))

2507

2444

if not bool(cert_list) and list_size.value != 0:

2508

2445

raise gnutls.Error("error getting peer certificate")

2509

2446

if list_size.value == 0:

2531

2468

buf = ctypes.create_string_buffer(32)

2532

2469

buf_len = ctypes.c_size_t(len(buf))

2533

2470

# Get the key ID from the raw public key into the buffer

2534

gnutls.pubkey_get_key_id(

2535

pubkey,

2536

gnutls.KEYID_USE_SHA256,

2537

ctypes.cast(ctypes.byref(buf),

2538

ctypes.POINTER(ctypes.c_ubyte)),

2539

ctypes.byref(buf_len))

2471

gnutls.pubkey_get_key_id(pubkey,

2472

gnutls.KEYID_USE_SHA256,

2473

ctypes.cast(ctypes.byref(buf),

2474

ctypes.POINTER(ctypes.c_ubyte)),

2475

ctypes.byref(buf_len))

2540

2476

# Deinit the certificate

2541

2477

gnutls.pubkey_deinit(pubkey)

2542

2478

2623

2559

2624

2560

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2625

2561

socketserver.TCPServer):

2626

"""IPv6-capable TCP server. Accepts None as address and/or port

2562

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2627

2563

2628

2564

Attributes:

2629

2565

enabled: Boolean; whether this server is activated yet

2680

2616

if SO_BINDTODEVICE is None:

2681

2617

# Fall back to a hard-coded value which seems to be

2682

2618

# common enough.

2683

log.warning("SO_BINDTODEVICE not found, trying 25")

2619

logger.warning("SO_BINDTODEVICE not found, trying 25")

2684

2620

SO_BINDTODEVICE = 25

2685

2621

try:

2686

2622

self.socket.setsockopt(

2688

2624

(self.interface + "\0").encode("utf-8"))

2689

2625

except socket.error as error:

2690

2626

if error.errno == errno.EPERM:

2691

log.error("No permission to bind to interface %s",

2692

self.interface)

2627

logger.error("No permission to bind to"

2628

" interface %s", self.interface)

2693

2629

elif error.errno == errno.ENOPROTOOPT:

2694

log.error("SO_BINDTODEVICE not available; cannot"

2695

" bind to interface %s", self.interface)

2630

logger.error("SO_BINDTODEVICE not available;"

2631

" cannot bind to interface %s",

2632

self.interface)

2696

2633

elif error.errno == errno.ENODEV:

2697

log.error("Interface %s does not exist, cannot"

2698

" bind", self.interface)

2634

logger.error("Interface %s does not exist,"

2635

" cannot bind", self.interface)

2699

2636

else:

2700

2637

raise

2701

2638

# Only bind(2) the socket if we really need to.

2780

2717

request = parent_pipe.recv()

2781

2718

command = request[0]

2782

2719

2783

if command == "init":

2720

if command == 'init':

2784

2721

key_id = request[1].decode("ascii")

2785

2722

fpr = request[2].decode("ascii")

2786

2723

address = request[3]

2787

2724

2788

2725

for c in self.clients.values():

2789

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2790

"27AE41E4649B934CA495991B7852B855"):

2726

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2791

2727

continue

2792

2728

if key_id and c.key_id == key_id:

2793

2729

client = c

2796

2732

client = c

2797

2733

break

2798

2734

else:

2799

log.info("Client not found for key ID: %s, address:"

2800

" %s", key_id or fpr, address)

2735

logger.info("Client not found for key ID: %s, address"

2736

": %s", key_id or fpr, address)

2801

2737

if self.use_dbus:

2802

2738

# Emit D-Bus signal

2803

2739

mandos_dbus_service.ClientNotFound(key_id or fpr,

2816

2752

# remove the old hook in favor of the new above hook on

2817

2753

# same fileno

2818

2754

return False

2819

if command == "funcall":

2755

if command == 'funcall':

2820

2756

funcname = request[1]

2821

2757

args = request[2]

2822

2758

kwargs = request[3]

2823

2759

2824

parent_pipe.send(("data", getattr(client_object,

2760

parent_pipe.send(('data', getattr(client_object,

2825

2761

funcname)(*args,

2826

2762

**kwargs)))

2827

2763

2828

if command == "getattr":

2764

if command == 'getattr':

2829

2765

attrname = request[1]

2830

2766

if isinstance(client_object.__getattribute__(attrname),

2831

2767

collections.abc.Callable):

2832

parent_pipe.send(("function", ))

2768

parent_pipe.send(('function', ))

2833

2769

else:

2834

2770

parent_pipe.send((

2835

"data", client_object.__getattribute__(attrname)))

2771

'data', client_object.__getattribute__(attrname)))

2836

2772

2837

if command == "setattr":

2773

if command == 'setattr':

2838

2774

attrname = request[1]

2839

2775

value = request[2]

2840

2776

setattr(client_object, attrname, value)

2845

2781

def rfc3339_duration_to_delta(duration):

2846

2782

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2847

2783

2848

>>> timedelta = datetime.timedelta

2849

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2850

True

2851

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2852

True

2853

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2854

True

2855

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2856

True

2857

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2858

True

2859

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2860

True

2861

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2862

True

2863

>>> del timedelta

2784

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2785

True

2786

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2787

True

2788

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2789

True

2790

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2791

True

2792

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2793

True

2794

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2795

True

2796

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2797

True

2864

2798

"""

2865

2799

2866

2800

# Parsing an RFC 3339 duration with regular expressions is not

2946

2880

def string_to_delta(interval):

2947

2881

"""Parse a string and return a datetime.timedelta

2948

2882

2949

>>> string_to_delta("7d") == datetime.timedelta(7)

2950

True

2951

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2952

True

2953

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2954

True

2955

>>> string_to_delta("24h") == datetime.timedelta(1)

2956

True

2957

>>> string_to_delta("1w") == datetime.timedelta(7)

2958

True

2959

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2883

>>> string_to_delta('7d') == datetime.timedelta(7)

2884

True

2885

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2886

True

2887

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2888

True

2889

>>> string_to_delta('24h') == datetime.timedelta(1)

2890

True

2891

>>> string_to_delta('1w') == datetime.timedelta(7)

2892

True

2893

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2960

2894

True

2961

2895

"""

2962

2896

3109

3043

# Later, stdin will, and stdout and stderr might, be dup'ed

3110

3044

# over with an opened os.devnull. But we don't want this to

3111

3045

# happen with a supplied network socket.

3112

while 0 <= server_settings["socket"] <= 2:

3046

if 0 <= server_settings["socket"] <= 2:

3113

3047

server_settings["socket"] = os.dup(server_settings

3114

3048

["socket"])

3115

os.set_inheritable(server_settings["socket"], False)

3116

3049

del server_config

3117

3050

3118

3051

# Override the settings from the config file with command line

3167

3100

3168

3101

if server_settings["servicename"] != "Mandos":

3169

3102

syslogger.setFormatter(

3170

logging.Formatter("Mandos ({}) [%(process)d]:"

3171

" %(levelname)s: %(message)s".format(

3103

logging.Formatter('Mandos ({}) [%(process)d]:'

3104

' %(levelname)s: %(message)s'.format(

3172

3105

server_settings["servicename"])))

3173

3106

3174

3107

# Parse config file with clients

3198

3131

try:

3199

3132

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

3200

3133

except IOError as e:

3201

log.error("Could not open file %r", pidfilename,

3202

exc_info=e)

3134

logger.error("Could not open file %r", pidfilename,

3135

exc_info=e)

3203

3136

3204

3137

for name, group in (("_mandos", "_mandos"),

3205

3138

("mandos", "mandos"),

3216

3149

try:

3217

3150

os.setgid(gid)

3218

3151

os.setuid(uid)

3219

log.debug("Did setuid/setgid to %s:%s", uid, gid)

3152

if debug:

3153

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3154

gid))

3220

3155

except OSError as error:

3221

log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,

3222

os.strerror(error.errno))

3156

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3157

.format(uid, gid, os.strerror(error.errno)))

3223

3158

if error.errno != errno.EPERM:

3224

3159

raise

3225

3160

3232

3167

3233

3168

@gnutls.log_func

3234

3169

def debug_gnutls(level, string):

3235

log.debug("GnuTLS: %s",

3236

string[:-1].decode("utf-8", errors="replace"))

3170

logger.debug("GnuTLS: %s", string[:-1])

3237

3171

3238

3172

gnutls.global_set_log_function(debug_gnutls)

3239

3173

3257

3191

# From the Avahi example code

3258

3192

DBusGMainLoop(set_as_default=True)

3259

3193

main_loop = GLib.MainLoop()

3260

if use_dbus or zeroconf:

3261

bus = dbus.SystemBus()

3194

bus = dbus.SystemBus()

3262

3195

# End of Avahi example code

3263

3196

if use_dbus:

3264

3197

try:

3269

3202

"se.bsnet.fukt.Mandos", bus,

3270

3203

do_not_queue=True)

3271

3204

except dbus.exceptions.DBusException as e:

3272

log.error("Disabling D-Bus:", exc_info=e)

3205

logger.error("Disabling D-Bus:", exc_info=e)

3273

3206

use_dbus = False

3274

3207

server_settings["use_dbus"] = False

3275

3208

tcp_server.use_dbus = False

3360

3293

os.remove(stored_state_path)

3361

3294

except IOError as e:

3362

3295

if e.errno == errno.ENOENT:

3363

log.warning("Could not load persistent state:"

3364

" %s", os.strerror(e.errno))

3296

logger.warning("Could not load persistent state:"

3297

" {}".format(os.strerror(e.errno)))

3365

3298

else:

3366

log.critical("Could not load persistent state:",

3367

exc_info=e)

3299

logger.critical("Could not load persistent state:",

3300

exc_info=e)

3368

3301

raise

3369

3302

except EOFError as e:

3370

log.warning("Could not load persistent state: EOFError:",

3371

exc_info=e)

3303

logger.warning("Could not load persistent state: "

3304

"EOFError:",

3305

exc_info=e)

3372

3306

3373

3307

with PGPEngine() as pgp:

3374

3308

for client_name, client in clients_data.items():

3401

3335

if client["enabled"]:

3402

3336

if datetime.datetime.utcnow() >= client["expires"]:

3403

3337

if not client["last_checked_ok"]:

3404

log.warning("disabling client %s - Client"

3405

" never performed a successful"

3406

" checker", client_name)

3338

logger.warning(

3339

"disabling client {} - Client never "

3340

"performed a successful checker".format(

3341

client_name))

3407

3342

client["enabled"] = False

3408

3343

elif client["last_checker_status"] != 0:

3409

log.warning("disabling client %s - Client"

3410

" last checker failed with error"

3411

" code %s", client_name,

3412

client["last_checker_status"])

3344

logger.warning(

3345

"disabling client {} - Client last"

3346

" checker failed with error code"

3347

" {}".format(

3348

client_name,

3349

client["last_checker_status"]))

3413

3350

client["enabled"] = False

3414

3351

else:

3415

3352

client["expires"] = (

3416

3353

datetime.datetime.utcnow()

3417

3354

+ client["timeout"])

3418

log.debug("Last checker succeeded, keeping %s"

3419

" enabled", client_name)

3355

logger.debug("Last checker succeeded,"

3356

" keeping {} enabled".format(

3357

client_name))

3420

3358

try:

3421

3359

client["secret"] = pgp.decrypt(

3422

3360

client["encrypted_secret"],

3423

3361

client_settings[client_name]["secret"])

3424

3362

except PGPError:

3425

3363

# If decryption fails, we use secret from new settings

3426

log.debug("Failed to decrypt %s old secret",

3427

client_name)

3364

logger.debug("Failed to decrypt {} old secret".format(

3365

client_name))

3428

3366

client["secret"] = (client_settings[client_name]

3429

3367

["secret"])

3430

3368

3444

3382

server_settings=server_settings)

3445

3383

3446

3384

if not tcp_server.clients:

3447

log.warning("No clients defined")

3385

logger.warning("No clients defined")

3448

3386

3449

3387

if not foreground:

3450

3388

if pidfile is not None:

3453

3391

with pidfile:

3454

3392

print(pid, file=pidfile)

3455

3393

except IOError:

3456

log.error("Could not write to file %r with PID %d",

3457

pidfilename, pid)

3394

logger.error("Could not write to file %r with PID %d",

3395

pidfilename, pid)

3458

3396

del pidfile

3459

3397

del pidfilename

3460

3398

3610

3548

3611

3549

try:

3612

3550

with tempfile.NamedTemporaryFile(

3613

mode="wb",

3551

mode='wb',

3614

3552

suffix=".pickle",

3615

prefix="clients-",

3553

prefix='clients-',

3616

3554

dir=os.path.dirname(stored_state_path),

3617

3555

delete=False) as stored_state:

3618

3556

pickle.dump((clients, client_settings), stored_state,

3626

3564

except NameError:

3627

3565

pass

3628

3566

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3629

log.warning("Could not save persistent state: %s",

3630

os.strerror(e.errno))

3567

logger.warning("Could not save persistent state: {}"

3568

.format(os.strerror(e.errno)))

3631

3569

else:

3632

log.warning("Could not save persistent state:",

3633

exc_info=e)

3570

logger.warning("Could not save persistent state:",

3571

exc_info=e)

3634

3572

raise

3635

3573

3636

3574

# Delete all clients, and settings from config

3653

3591

mandos_dbus_service.client_added_signal(client)

3654

3592

# Need to initiate checking of clients

3655

3593

if client.enabled:

3656

client.init_checker(randomize_start=True)

3594

client.init_checker()

3657

3595

3658

3596

tcp_server.enable()

3659

3597

tcp_server.server_activate()

3662

3600

if zeroconf:

3663

3601

service.port = tcp_server.socket.getsockname()[1]

3664

3602

if use_ipv6:

3665

log.info("Now listening on address %r, port %d, flowinfo %d,"

3666

" scope_id %d", *tcp_server.socket.getsockname())

3603

logger.info("Now listening on address %r, port %d,"

3604

" flowinfo %d, scope_id %d",

3605

*tcp_server.socket.getsockname())

3667

3606

else: # IPv4

3668

log.info("Now listening on address %r, port %d",

3669

*tcp_server.socket.getsockname())

3607

logger.info("Now listening on address %r, port %d",

3608

*tcp_server.socket.getsockname())

3670

3609

3671

3610

# service.interface = tcp_server.socket.getsockname()[3]

3672

3611

3676

3615

try:

3677

3616

service.activate()

3678

3617

except dbus.exceptions.DBusException as error:

3679

log.critical("D-Bus Exception", exc_info=error)

3618

logger.critical("D-Bus Exception", exc_info=error)

3680

3619

cleanup()

3681

3620

sys.exit(1)

3682

3621

# End of Avahi example code

3687

3626

lambda *args, **kwargs: (tcp_server.handle_request

3688

3627

(*args[2:], **kwargs) or True))

3689

3628

3690

log.debug("Starting main loop")

3629

logger.debug("Starting main loop")

3691

3630

main_loop.run()

3692

3631

except AvahiError as error:

3693

log.critical("Avahi Error", exc_info=error)

3632

logger.critical("Avahi Error", exc_info=error)

3694

3633

cleanup()

3695

3634

sys.exit(1)

3696

3635

except KeyboardInterrupt:

3697

3636

if debug:

3698

3637

print("", file=sys.stderr)

3699

log.debug("Server received KeyboardInterrupt")

3700

log.debug("Server exiting")

3638

logger.debug("Server received KeyboardInterrupt")

3639

logger.debug("Server exiting")

3701

3640

# Must run before the D-Bus bus name gets deregistered

3702

3641

cleanup()

3703

3642

3704

3643

3705

def parse_test_args():

3706

# type: () -> argparse.Namespace

3644

def should_only_run_tests():

3707

3645

parser = argparse.ArgumentParser(add_help=False)

3708

parser.add_argument("--check", action="store_true")

3709

parser.add_argument("--prefix", )

3646

parser.add_argument("--check", action='store_true')

3710

3647

args, unknown_args = parser.parse_known_args()

3711

if args.check:

3712

# Remove test options from sys.argv

3648

run_tests = args.check

3649

if run_tests:

3650

# Remove --check argument from sys.argv

3713

3651

sys.argv[1:] = unknown_args

3714

return args

3652

return run_tests

3715

3653

3716

3654

# Add all tests from doctest strings

3717

3655

def load_tests(loader, tests, none):

3719

3657

tests.addTests(doctest.DocTestSuite())

3720

3658

return tests

3721

3659

3722

if __name__ == "__main__":

3723

options = parse_test_args()

3660

if __name__ == '__main__':

3724

3661

try:

3725

if options.check:

3726

extra_test_prefix = options.prefix

3727

if extra_test_prefix is not None:

3728

if not (unittest.main(argv=[""], exit=False)

3729

.result.wasSuccessful()):

3730

sys.exit(1)

3731

class ExtraTestLoader(unittest.TestLoader):

3732

testMethodPrefix = extra_test_prefix

3733

# Call using ./scriptname --test [--verbose]

3734

unittest.main(argv=[""], testLoader=ExtraTestLoader())

3735

else:

3736

unittest.main(argv=[""])

3662

if should_only_run_tests():

3663

# Call using ./mandos --check [--verbose]

3664

unittest.main()

3737

3665

else:

3738

3666

main()

3739

3667

finally:

3740

3668

logging.shutdown()

3741

3742

# Local Variables:

3743

# run-tests:

3744

# (lambda (&optional extra)

3745

# (if (not (funcall run-tests-in-test-buffer default-directory

3746

# extra))

3747

# (funcall show-test-buffer-in-test-window)

3748

# (funcall remove-test-window)

3749

# (if extra (message "Extra tests run successfully!"))))

3750

# run-tests-in-test-buffer:

3751

# (lambda (dir &optional extra)

3752

# (with-current-buffer (get-buffer-create "*Test*")

3753

# (setq buffer-read-only nil

3754

# default-directory dir)

3755

# (erase-buffer)

3756

# (compilation-mode))

3757

# (let ((process-result

3758

# (let ((inhibit-read-only t))

3759

# (process-file-shell-command

3760

# (funcall get-command-line extra) nil "*Test*"))))

3761

# (and (numberp process-result)

3762

# (= process-result 0))))

3763

# get-command-line:

3764

# (lambda (&optional extra)

3765

# (let ((quoted-script

3766

# (shell-quote-argument (funcall get-script-name))))

3767

# (format

3768

# (concat "%s --check" (if extra " --prefix=atest" ""))

3769

# quoted-script)))

3770

# get-script-name:

3771

# (lambda ()

3772

# (if (fboundp 'file-local-name)

3773

# (file-local-name (buffer-file-name))

3774

# (or (file-remote-p (buffer-file-name) 'localname)

3775

# (buffer-file-name))))

3776

# remove-test-window:

3777

# (lambda ()

3778

# (let ((test-window (get-buffer-window "*Test*")))

3779

# (if test-window (delete-window test-window))))

3780

# show-test-buffer-in-test-window:

3781

# (lambda ()

3782

# (when (not (get-buffer-window-list "*Test*"))

3783

# (setq next-error-last-buffer (get-buffer "*Test*"))

3784

# (let* ((side (if (>= (window-width) 146) 'right 'bottom))

3785

# (display-buffer-overriding-action

3786

# `((display-buffer-in-side-window) (side . ,side)

3787

# (window-height . fit-window-to-buffer)

3788

# (window-width . fit-window-to-buffer))))

3789

# (display-buffer "*Test*"))))

3790

# eval:

3791

# (progn

3792

# (let* ((run-extra-tests (lambda () (interactive)

3793

# (funcall run-tests t)))

3794

# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t

3795

# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c

3796

# (setq minor-mode-overriding-map-alist

3797

# (cons `(run-tests . ,outer-keymap)

3798

# minor-mode-overriding-map-alist)))

3799

# (add-hook 'after-save-hook run-tests 90 t))

3800

# End: