/mandos/release : revision 237.7.801

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This file is part of Mandos.

18

#

143

if sys.version_info < (3, 2):

144

configparser.Configparser = configparser.SafeConfigParser

145

146

version = "1.8.11"

146

version = "1.8.14"

147

stored_state_file = "clients.pickle"

148

149

logger = logging.getLogger()

189

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

190

address="/dev/log"))

191

syslogger.setFormatter(logging.Formatter

192

('Mandos [%(process)d]: %(levelname)s:'

193

' %(message)s'))

192

("Mandos [%(process)d]: %(levelname)s:"

193

" %(message)s"))

194

logger.addHandler(syslogger)

195

196

if debug:

197

console = logging.StreamHandler()

198

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

199

' [%(process)d]:'

200

' %(levelname)s:'

201

' %(message)s'))

198

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

199

" [%(process)d]:"

200

" %(levelname)s:"

201

" %(message)s"))

202

logger.addHandler(console)

203

logger.setLevel(level)

204

224

except OSError as e:

225

if e.errno != errno.ENOENT:

226

raise

227

self.gnupgargs = ['--batch',

228

'--homedir', self.tempdir,

229

'--force-mdc',

230

'--quiet']

227

self.gnupgargs = ["--batch",

228

"--homedir", self.tempdir,

229

"--force-mdc",

230

"--quiet"]

231

# Only GPG version 1 has the --no-use-agent option.

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

233

self.gnupgargs.append("--no-use-agent")

272

dir=self.tempdir) as passfile:

273

passfile.write(passphrase)

274

passfile.flush()

275

proc = subprocess.Popen([self.gpg, '--symmetric',

276

'--passphrase-file',

275

proc = subprocess.Popen([self.gpg, "--symmetric",

276

"--passphrase-file",

277

passfile.name]

278

+ self.gnupgargs,

279

stdin=subprocess.PIPE,

290

dir=self.tempdir) as passfile:

291

passfile.write(passphrase)

292

passfile.flush()

293

proc = subprocess.Popen([self.gpg, '--decrypt',

294

'--passphrase-file',

293

proc = subprocess.Popen([self.gpg, "--decrypt",

294

"--passphrase-file",

295

passfile.name]

296

+ self.gnupgargs,

297

stdin=subprocess.PIPE,

350

Attributes:

351

interface: integer; avahi.IF_UNSPEC or an interface index.

352

Used to optionally bind to the specified interface.

353

name: string; Example: 'Mandos'

354

type: string; Example: '_mandos._tcp'.

353

name: string; Example: "Mandos"

354

type: string; Example: "_mandos._tcp".

355

See <https://www.iana.org/assignments/service-names-port-numbers>

356

port: integer; what port to announce

357

TXT: list of strings; TXT record for the service

435

avahi.DBUS_INTERFACE_ENTRY_GROUP)

436

self.entry_group_state_changed_match = (

437

self.group.connect_to_signal(

438

'StateChanged', self.entry_group_state_changed))

438

"StateChanged", self.entry_group_state_changed))

439

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

440

self.name, self.type)

441

self.group.AddService(

524

class AvahiServiceToSyslog(AvahiService):

525

def rename(self, *args, **kwargs):

526

"""Add the new name to the syslog messages"""

527

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

527

ret = super(AvahiServiceToSyslog, self).rename(*args,

528

**kwargs)

528

529

syslogger.setFormatter(logging.Formatter(

529

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

530

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

530

531

.format(self.name)))

531

532

return ret

532

533

562

563

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

563

564

565

# Types

565

class session_int(ctypes.Structure):

566

class _session_int(ctypes.Structure):

566

567

_fields_ = []

567

session_t = ctypes.POINTER(session_int)

568

session_t = ctypes.POINTER(_session_int)

568

569

570

class certificate_credentials_st(ctypes.Structure):

570

571

_fields_ = []

573

574

certificate_type_t = ctypes.c_int

574

575

576

class datum_t(ctypes.Structure):

576

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

577

('size', ctypes.c_uint)]

577

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

578

("size", ctypes.c_uint)]

578

579

class openpgp_crt_int(ctypes.Structure):

580

class _openpgp_crt_int(ctypes.Structure):

580

581

_fields_ = []

581

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

582

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

582

583

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

583

584

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

584

585

credentials_type_t = ctypes.c_int

593

594

# gnutls.strerror()

594

595

self.code = code

595

596

if message is None and code is not None:

596

message = gnutls.strerror(code)

597

message = gnutls.strerror(code).decode(

598

"utf-8", errors="replace")

597

599

return super(gnutls.Error, self).__init__(

598

600

message, *args)

599

601

600

602

class CertificateSecurityError(Error):

601

603

pass

602

604

605

class PointerTo:

606

def __init__(self, cls):

607

self.cls = cls

608

609

def from_param(self, obj):

610

if not isinstance(obj, self.cls):

611

raise TypeError("Not of type {}: {!r}"

612

.format(self.cls.__name__, obj))

613

return ctypes.byref(obj.from_param(obj))

614

615

class CastToVoidPointer:

616

def __init__(self, cls):

617

self.cls = cls

618

619

def from_param(self, obj):

620

if not isinstance(obj, self.cls):

621

raise TypeError("Not of type {}: {!r}"

622

.format(self.cls.__name__, obj))

623

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

624

625

class With_from_param:

626

@classmethod

627

def from_param(cls, obj):

628

return obj._as_parameter_

629

603

630

# Classes

604

class Credentials:

631

class Credentials(With_from_param):

605

632

def __init__(self):

606

self._c_object = gnutls.certificate_credentials_t()

607

gnutls.certificate_allocate_credentials(

608

ctypes.byref(self._c_object))

633

self._as_parameter_ = gnutls.certificate_credentials_t()

634

gnutls.certificate_allocate_credentials(self)

609

635

self.type = gnutls.CRD_CERTIFICATE

610

636

611

637

def __del__(self):

612

gnutls.certificate_free_credentials(self._c_object)

638

gnutls.certificate_free_credentials(self)

613

639

614

class ClientSession:

640

class ClientSession(With_from_param):

615

641

def __init__(self, socket, credentials=None):

616

self._c_object = gnutls.session_t()

642

self._as_parameter_ = gnutls.session_t()

617

643

gnutls_flags = gnutls.CLIENT

618

644

if gnutls.check_version(b"3.5.6"):

619

645

gnutls_flags |= gnutls.NO_TICKETS

620

646

if gnutls.has_rawpk:

621

647

gnutls_flags |= gnutls.ENABLE_RAWPK

622

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

648

gnutls.init(self, gnutls_flags)

623

649

del gnutls_flags

624

gnutls.set_default_priority(self._c_object)

625

gnutls.transport_set_ptr(self._c_object, socket.fileno())

626

gnutls.handshake_set_private_extensions(self._c_object,

627

True)

650

gnutls.set_default_priority(self)

651

gnutls.transport_set_ptr(self, socket.fileno())

652

gnutls.handshake_set_private_extensions(self, True)

628

653

self.socket = socket

629

654

if credentials is None:

630

655

credentials = gnutls.Credentials()

631

gnutls.credentials_set(self._c_object, credentials.type,

632

ctypes.cast(credentials._c_object,

633

ctypes.c_void_p))

656

gnutls.credentials_set(self, credentials.type,

657

credentials)

634

658

self.credentials = credentials

635

659

636

660

def __del__(self):

637

gnutls.deinit(self._c_object)

661

gnutls.deinit(self)

638

662

639

663

def handshake(self):

640

return gnutls.handshake(self._c_object)

664

return gnutls.handshake(self)

641

665

642

666

def send(self, data):

643

667

data = bytes(data)

644

668

data_len = len(data)

645

669

while data_len > 0:

646

data_len -= gnutls.record_send(self._c_object,

647

data[-data_len:],

670

data_len -= gnutls.record_send(self, data[-data_len:],

648

671

data_len)

649

672

650

673

def bye(self):

651

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

674

return gnutls.bye(self, gnutls.SHUT_RDWR)

652

675

653

676

# Error handling functions

654

677

def _error_code(result):

655

678

"""A function to raise exceptions on errors, suitable

656

for the 'restype' attribute on ctypes functions"""

657

if result >= 0:

679

for the "restype" attribute on ctypes functions"""

680

if result >= gnutls.E_SUCCESS:

658

681

return result

659

682

if result == gnutls.E_NO_CERTIFICATE_FOUND:

660

683

raise gnutls.CertificateSecurityError(code=result)

661

684

raise gnutls.Error(code=result)

662

685

663

def _retry_on_error(result, func, arguments):

686

def _retry_on_error(result, func, arguments,

687

_error_code=_error_code):

664

688

"""A function to retry on some errors, suitable

665

for the 'errcheck' attribute on ctypes functions"""

666

while result < 0:

689

for the "errcheck" attribute on ctypes functions"""

690

while result < gnutls.E_SUCCESS:

667

691

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

668

692

return _error_code(result)

669

693

result = func(*arguments)

674

698

675

699

# Functions

676

700

priority_set_direct = _library.gnutls_priority_set_direct

677

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

701

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

678

702

ctypes.POINTER(ctypes.c_char_p)]

679

703

priority_set_direct.restype = _error_code

680

704

681

705

init = _library.gnutls_init

682

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

706

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

683

707

init.restype = _error_code

684

708

685

709

set_default_priority = _library.gnutls_set_default_priority

686

set_default_priority.argtypes = [session_t]

710

set_default_priority.argtypes = [ClientSession]

687

711

set_default_priority.restype = _error_code

688

712

689

713

record_send = _library.gnutls_record_send

690

record_send.argtypes = [session_t, ctypes.c_void_p,

714

record_send.argtypes = [ClientSession, ctypes.c_void_p,

691

715

ctypes.c_size_t]

692

716

record_send.restype = ctypes.c_ssize_t

693

717

record_send.errcheck = _retry_on_error

695

719

certificate_allocate_credentials = (

696

720

_library.gnutls_certificate_allocate_credentials)

697

721

certificate_allocate_credentials.argtypes = [

698

ctypes.POINTER(certificate_credentials_t)]

722

PointerTo(Credentials)]

699

723

certificate_allocate_credentials.restype = _error_code

700

724

701

725

certificate_free_credentials = (

702

726

_library.gnutls_certificate_free_credentials)

703

certificate_free_credentials.argtypes = [

704

certificate_credentials_t]

727

certificate_free_credentials.argtypes = [Credentials]

705

728

certificate_free_credentials.restype = None

706

729

707

730

handshake_set_private_extensions = (

708

731

_library.gnutls_handshake_set_private_extensions)

709

handshake_set_private_extensions.argtypes = [session_t,

732

handshake_set_private_extensions.argtypes = [ClientSession,

710

733

ctypes.c_int]

711

734

handshake_set_private_extensions.restype = None

712

735

713

736

credentials_set = _library.gnutls_credentials_set

714

credentials_set.argtypes = [session_t, credentials_type_t,

715

ctypes.c_void_p]

737

credentials_set.argtypes = [ClientSession, credentials_type_t,

738

CastToVoidPointer(Credentials)]

716

739

credentials_set.restype = _error_code

717

740

718

741

strerror = _library.gnutls_strerror

720

743

strerror.restype = ctypes.c_char_p

721

744

722

745

certificate_type_get = _library.gnutls_certificate_type_get

723

certificate_type_get.argtypes = [session_t]

746

certificate_type_get.argtypes = [ClientSession]

724

747

certificate_type_get.restype = _error_code

725

748

726

749

certificate_get_peers = _library.gnutls_certificate_get_peers

727

certificate_get_peers.argtypes = [session_t,

750

certificate_get_peers.argtypes = [ClientSession,

728

751

ctypes.POINTER(ctypes.c_uint)]

729

752

certificate_get_peers.restype = ctypes.POINTER(datum_t)

730

753

737

760

global_set_log_function.restype = None

738

761

739

762

deinit = _library.gnutls_deinit

740

deinit.argtypes = [session_t]

763

deinit.argtypes = [ClientSession]

741

764

deinit.restype = None

742

765

743

766

handshake = _library.gnutls_handshake

744

handshake.argtypes = [session_t]

745

handshake.restype = _error_code

767

handshake.argtypes = [ClientSession]

768

handshake.restype = ctypes.c_int

746

769

handshake.errcheck = _retry_on_error

747

770

748

771

transport_set_ptr = _library.gnutls_transport_set_ptr

749

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

772

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

750

773

transport_set_ptr.restype = None

751

774

752

775

bye = _library.gnutls_bye

753

bye.argtypes = [session_t, close_request_t]

754

bye.restype = _error_code

776

bye.argtypes = [ClientSession, close_request_t]

777

bye.restype = ctypes.c_int

755

778

bye.errcheck = _retry_on_error

756

779

757

780

check_version = _library.gnutls_check_version

774

797

775

798

x509_crt_fmt_t = ctypes.c_int

776

799

777

# All the function declarations below are from gnutls/abstract.h

800

# All the function declarations below are from

801

# gnutls/abstract.h

778

802

pubkey_init = _library.gnutls_pubkey_init

779

803

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

780

804

pubkey_init.restype = _error_code

794

818

pubkey_deinit.argtypes = [pubkey_t]

795

819

pubkey_deinit.restype = None

796

820

else:

797

# All the function declarations below are from gnutls/openpgp.h

821

# All the function declarations below are from

822

# gnutls/openpgp.h

798

823

799

824

openpgp_crt_init = _library.gnutls_openpgp_crt_init

800

825

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

806

831

openpgp_crt_fmt_t]

807

832

openpgp_crt_import.restype = _error_code

808

833

809

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

810

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

811

ctypes.POINTER(ctypes.c_uint)]

834

openpgp_crt_verify_self = \

835

_library.gnutls_openpgp_crt_verify_self

836

openpgp_crt_verify_self.argtypes = [

837

openpgp_crt_t,

838

ctypes.c_uint,

839

ctypes.POINTER(ctypes.c_uint),

840

]

812

841

openpgp_crt_verify_self.restype = _error_code

813

842

814

843

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

825

854

826

855

if check_version(b"3.6.4"):

827

856

certificate_type_get2 = _library.gnutls_certificate_type_get2

828

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

857

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

829

858

certificate_type_get2.restype = _error_code

830

859

831

860

# Remove non-public functions

847

876

"""A representation of a client host served by this server.

848

877

849

878

Attributes:

850

approved: bool(); 'None' if not yet approved/disapproved

879

approved: bool(); None if not yet approved/disapproved

851

880

approval_delay: datetime.timedelta(); Time to wait for approval

852

881

approval_duration: datetime.timedelta(); Duration of one approval

853

882

checker: multiprocessing.Process(); a running checker process used

854

to see if the client lives. 'None' if no process is

883

to see if the client lives. None if no process is

855

884

running.

856

885

checker_callback_tag: a GLib event source tag, or None

857

886

checker_command: string; External command which is run to check

1213

1242

func._dbus_name = func.__name__

1214

1243

if func._dbus_name.endswith("_dbus_property"):

1215

1244

func._dbus_name = func._dbus_name[:-14]

1216

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1245

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

1217

1246

return func

1218

1247

1219

1248

return decorator

1308

1337

1309

1338

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1310

1339

out_signature="s",

1311

path_keyword='object_path',

1312

connection_keyword='connection')

1340

path_keyword="object_path",

1341

connection_keyword="connection")

1313

1342

def Introspect(self, object_path, connection):

1314

1343

"""Overloading of standard D-Bus method.

1315

1344

1468

1497

1469

1498

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1470

1499

out_signature="s",

1471

path_keyword='object_path',

1472

connection_keyword='connection')

1500

path_keyword="object_path",

1501

connection_keyword="connection")

1473

1502

def Introspect(self, object_path, connection):

1474

1503

"""Overloading of standard D-Bus method.

1475

1504

1570

1599

1571

1600

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1572

1601

out_signature="s",

1573

path_keyword='object_path',

1574

connection_keyword='connection')

1602

path_keyword="object_path",

1603

connection_keyword="connection")

1575

1604

def Introspect(self, object_path, connection):

1576

1605

"""Overloading of standard D-Bus method.

1577

1606

2243

2272

class ProxyClient:

2244

2273

def __init__(self, child_pipe, key_id, fpr, address):

2245

2274

self._pipe = child_pipe

2246

self._pipe.send(('init', key_id, fpr, address))

2275

self._pipe.send(("init", key_id, fpr, address))

2247

2276

if not self._pipe.recv():

2248

2277

raise KeyError(key_id or fpr)

2249

2278

2250

2279

def __getattribute__(self, name):

2251

if name == '_pipe':

2280

if name == "_pipe":

2252

2281

return super(ProxyClient, self).__getattribute__(name)

2253

self._pipe.send(('getattr', name))

2282

self._pipe.send(("getattr", name))

2254

2283

data = self._pipe.recv()

2255

if data[0] == 'data':

2284

if data[0] == "data":

2256

2285

return data[1]

2257

if data[0] == 'function':

2286

if data[0] == "function":

2258

2287

2259

2288

def func(*args, **kwargs):

2260

self._pipe.send(('funcall', name, args, kwargs))

2289

self._pipe.send(("funcall", name, args, kwargs))

2261

2290

return self._pipe.recv()[1]

2262

2291

2263

2292

return func

2264

2293

2265

2294

def __setattr__(self, name, value):

2266

if name == '_pipe':

2295

if name == "_pipe":

2267

2296

return super(ProxyClient, self).__setattr__(name, value)

2268

self._pipe.send(('setattr', name, value))

2297

self._pipe.send(("setattr", name, value))

2269

2298

2270

2299

2271

2300

class ClientHandler(socketserver.BaseRequestHandler, object):

2283

2312

2284

2313

session = gnutls.ClientSession(self.request)

2285

2314

2286

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2315

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2287

2316

# "+AES-256-CBC", "+SHA1",

2288

2317

# "+COMP-NULL", "+CTYPE-OPENPGP",

2289

2318

# "+DHE-DSS"))

2291

2320

priority = self.server.gnutls_priority

2292

2321

if priority is None:

2293

2322

priority = "NORMAL"

2294

gnutls.priority_set_direct(session._c_object,

2295

priority.encode("utf-8"),

2296

None)

2323

gnutls.priority_set_direct(session,

2324

priority.encode("utf-8"), None)

2297

2325

2298

2326

# Start communication using the Mandos protocol

2299

2327

# Get protocol number

2326

2354

except (TypeError, gnutls.Error) as error:

2327

2355

logger.warning("Bad certificate: %s", error)

2328

2356

return

2329

logger.debug("Key ID: %s", key_id)

2357

logger.debug("Key ID: %s",

2358

key_id.decode("utf-8",

2359

errors="replace"))

2330

2360

2331

2361

else:

2332

2362

key_id = b""

2424

2454

def peer_certificate(session):

2425

2455

"Return the peer's certificate as a bytestring"

2426

2456

try:

2427

cert_type = gnutls.certificate_type_get2(session._c_object,

2428

gnutls.CTYPE_PEERS)

2457

cert_type = gnutls.certificate_type_get2(

2458

session, gnutls.CTYPE_PEERS)

2429

2459

except AttributeError:

2430

cert_type = gnutls.certificate_type_get(session._c_object)

2460

cert_type = gnutls.certificate_type_get(session)

2431

2461

if gnutls.has_rawpk:

2432

2462

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2433

2463

else:

2440

2470

return b""

2441

2471

list_size = ctypes.c_uint(1)

2442

2472

cert_list = (gnutls.certificate_get_peers

2443

(session._c_object, ctypes.byref(list_size)))

2473

(session, ctypes.byref(list_size)))

2444

2474

if not bool(cert_list) and list_size.value != 0:

2445

2475

raise gnutls.Error("error getting peer certificate")

2446

2476

if list_size.value == 0:

2468

2498

buf = ctypes.create_string_buffer(32)

2469

2499

buf_len = ctypes.c_size_t(len(buf))

2470

2500

# Get the key ID from the raw public key into the buffer

2471

gnutls.pubkey_get_key_id(pubkey,

2472

gnutls.KEYID_USE_SHA256,

2473

ctypes.cast(ctypes.byref(buf),

2474

ctypes.POINTER(ctypes.c_ubyte)),

2475

ctypes.byref(buf_len))

2501

gnutls.pubkey_get_key_id(

2502

pubkey,

2503

gnutls.KEYID_USE_SHA256,

2504

ctypes.cast(ctypes.byref(buf),

2505

ctypes.POINTER(ctypes.c_ubyte)),

2506

ctypes.byref(buf_len))

2476

2507

# Deinit the certificate

2477

2508

gnutls.pubkey_deinit(pubkey)

2478

2509

2559

2590

2560

2591

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2561

2592

socketserver.TCPServer):

2562

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2593

"""IPv6-capable TCP server. Accepts None as address and/or port

2563

2594

2564

2595

Attributes:

2565

2596

enabled: Boolean; whether this server is activated yet

2717

2748

request = parent_pipe.recv()

2718

2749

command = request[0]

2719

2750

2720

if command == 'init':

2751

if command == "init":

2721

2752

key_id = request[1].decode("ascii")

2722

2753

fpr = request[2].decode("ascii")

2723

2754

address = request[3]

2724

2755

2725

2756

for c in self.clients.values():

2726

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2757

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2758

"27AE41E4649B934CA495991B7852B855"):

2727

2759

continue

2728

2760

if key_id and c.key_id == key_id:

2729

2761

client = c

2752

2784

# remove the old hook in favor of the new above hook on

2753

2785

# same fileno

2754

2786

return False

2755

if command == 'funcall':

2787

if command == "funcall":

2756

2788

funcname = request[1]

2757

2789

args = request[2]

2758

2790

kwargs = request[3]

2759

2791

2760

parent_pipe.send(('data', getattr(client_object,

2792

parent_pipe.send(("data", getattr(client_object,

2761

2793

funcname)(*args,

2762

2794

**kwargs)))

2763

2795

2764

if command == 'getattr':

2796

if command == "getattr":

2765

2797

attrname = request[1]

2766

2798

if isinstance(client_object.__getattribute__(attrname),

2767

2799

collections.abc.Callable):

2768

parent_pipe.send(('function', ))

2800

parent_pipe.send(("function", ))

2769

2801

else:

2770

2802

parent_pipe.send((

2771

'data', client_object.__getattribute__(attrname)))

2803

"data", client_object.__getattribute__(attrname)))

2772

2804

2773

if command == 'setattr':

2805

if command == "setattr":

2774

2806

attrname = request[1]

2775

2807

value = request[2]

2776

2808

setattr(client_object, attrname, value)

2781

2813

def rfc3339_duration_to_delta(duration):

2782

2814

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2783

2815

2784

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2785

True

2786

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2787

True

2788

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2789

True

2790

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2791

True

2792

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2793

True

2794

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2795

True

2796

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2797

True

2816

>>> timedelta = datetime.timedelta

2817

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2818

True

2819

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2820

True

2821

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2822

True

2823

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2824

True

2825

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2826

True

2827

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2828

True

2829

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2830

True

2831

>>> del timedelta

2798

2832

"""

2799

2833

2800

2834

# Parsing an RFC 3339 duration with regular expressions is not

2880

2914

def string_to_delta(interval):

2881

2915

"""Parse a string and return a datetime.timedelta

2882

2916

2883

>>> string_to_delta('7d') == datetime.timedelta(7)

2884

True

2885

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2886

True

2887

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2888

True

2889

>>> string_to_delta('24h') == datetime.timedelta(1)

2890

True

2891

>>> string_to_delta('1w') == datetime.timedelta(7)

2892

True

2893

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2917

>>> string_to_delta("7d") == datetime.timedelta(7)

2918

True

2919

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2920

True

2921

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2922

True

2923

>>> string_to_delta("24h") == datetime.timedelta(1)

2924

True

2925

>>> string_to_delta("1w") == datetime.timedelta(7)

2926

True

2927

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2894

2928

True

2895

2929

"""

2896

2930

3100

3134

3101

3135

if server_settings["servicename"] != "Mandos":

3102

3136

syslogger.setFormatter(

3103

logging.Formatter('Mandos ({}) [%(process)d]:'

3104

' %(levelname)s: %(message)s'.format(

3137

logging.Formatter("Mandos ({}) [%(process)d]:"

3138

" %(levelname)s: %(message)s".format(

3105

3139

server_settings["servicename"])))

3106

3140

3107

3141

# Parse config file with clients

3167

3201

3168

3202

@gnutls.log_func

3169

3203

def debug_gnutls(level, string):

3170

logger.debug("GnuTLS: %s", string[:-1])

3204

logger.debug("GnuTLS: %s",

3205

string[:-1].decode("utf-8",

3206

errors="replace"))

3171

3207

3172

3208

gnutls.global_set_log_function(debug_gnutls)

3173

3209

3548

3584

3549

3585

try:

3550

3586

with tempfile.NamedTemporaryFile(

3551

mode='wb',

3587

mode="wb",

3552

3588

suffix=".pickle",

3553

prefix='clients-',

3589

prefix="clients-",

3554

3590

dir=os.path.dirname(stored_state_path),

3555

3591

delete=False) as stored_state:

3556

3592

pickle.dump((clients, client_settings), stored_state,

3643

3679

3644

3680

def should_only_run_tests():

3645

3681

parser = argparse.ArgumentParser(add_help=False)

3646

parser.add_argument("--check", action='store_true')

3682

parser.add_argument("--check", action="store_true")

3647

3683

args, unknown_args = parser.parse_known_args()

3648

3684

run_tests = args.check

3649

3685

if run_tests:

3657

3693

tests.addTests(doctest.DocTestSuite())

3658

3694

return tests

3659

3695

3660

if __name__ == '__main__':

3696

if __name__ == "__main__":

3661

3697

try:

3662

3698

if should_only_run_tests():

3663

3699

# Call using ./mandos --check [--verbose]