To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 302
- compare with another revision
- download diff
- download tarball
- view history from revision 302
- Committer: Teddy Hogeborn
- Date: 2012-06-17 22:26:40 UTC
- mfrom: (301.1.1 release)
- Revision ID: teddy@recompile.se-20120617222640-49scfn0husnrr5bi
Tags: version-1.6.0-1
* Makefile (version): Changed to "1.6.0".
* NEWS (Version 1.6.0): New entry.
* debian/changelog (1.6.0-1): - '' -
* NEWS (Version 1.6.0): New entry.
* debian/changelog (1.6.0-1): - '' -
added
removed
mandos
68
68
import binascii
69
69
import tempfile
70
70
import itertools
71
import collections
72
71
73
72
import dbus
74
73
import dbus.service
79
78
import ctypes.util
80
79
import xml.dom.minidom
81
80
import inspect
81
import GnuPGInterface
82
82
83
83
try:
84
84
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
139
139
class PGPEngine(object):
140
140
"""A simple class for OpenPGP symmetric encryption & decryption"""
141
141
def __init__(self):
142
self.gnupg = GnuPGInterface.GnuPG()
142
143
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
143
self.gnupgargs = ['--batch',
144
'--home', self.tempdir,
145
'--force-mdc',
146
'--quiet',
147
'--no-use-agent']
144
self.gnupg = GnuPGInterface.GnuPG()
145
self.gnupg.options.meta_interactive = False
146
self.gnupg.options.homedir = self.tempdir
147
self.gnupg.options.extra_args.extend(['--force-mdc',
148
'--quiet',
149
'--no-use-agent'])
148
150
149
151
def __enter__(self):
150
152
return self
175
177
return b"mandos" + binascii.hexlify(password)
176
178
177
179
def encrypt(self, data, password):
178
passphrase = self.password_encode(password)
179
with tempfile.NamedTemporaryFile(dir=self.tempdir
180
) as passfile:
181
passfile.write(passphrase)
182
passfile.flush()
183
proc = subprocess.Popen(['gpg', '--symmetric',
184
'--passphrase-file',
185
passfile.name]
186
+ self.gnupgargs,
187
stdin = subprocess.PIPE,
188
stdout = subprocess.PIPE,
189
stderr = subprocess.PIPE)
190
ciphertext, err = proc.communicate(input = data)
191
if proc.returncode != 0:
192
raise PGPError(err)
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
182
try:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
187
f.write(data)
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
190
proc.wait()
191
except IOError as e:
192
raise PGPError(e)
193
self.gnupg.passphrase = None
193
194
return ciphertext
194
195
195
196
def decrypt(self, data, password):
196
passphrase = self.password_encode(password)
197
with tempfile.NamedTemporaryFile(dir = self.tempdir
198
) as passfile:
199
passfile.write(passphrase)
200
passfile.flush()
201
proc = subprocess.Popen(['gpg', '--decrypt',
202
'--passphrase-file',
203
passfile.name]
204
+ self.gnupgargs,
205
stdin = subprocess.PIPE,
206
stdout = subprocess.PIPE,
207
stderr = subprocess.PIPE)
208
decrypted_plaintext, err = proc.communicate(input
209
= data)
210
if proc.returncode != 0:
211
raise PGPError(err)
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
199
try:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
204
f.write(data)
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
207
proc.wait()
208
except IOError as e:
209
raise PGPError(e)
210
self.gnupg.passphrase = None
212
211
return decrypted_plaintext
213
212
214
213
234
233
Used to optionally bind to the specified interface.
235
234
name: string; Example: 'Mandos'
236
235
type: string; Example: '_mandos._tcp'.
237
See <https://www.iana.org/assignments/service-names-port-numbers>
236
See <http://www.dns-sd.org/ServiceTypes.html>
238
237
port: integer; what port to announce
239
238
TXT: list of strings; TXT record for the service
240
239
domain: string; Domain to publish on, default to .local if empty.
447
446
"fingerprint", "host", "interval",
448
447
"last_approval_request", "last_checked_ok",
449
448
"last_enabled", "name", "timeout")
450
client_defaults = { "timeout": "PT5M",
451
"extended_timeout": "PT15M",
452
"interval": "PT2M",
449
client_defaults = { "timeout": "5m",
450
"extended_timeout": "15m",
451
"interval": "2m",
453
452
"checker": "fping -q -- %%(host)s",
454
453
"host": "",
455
"approval_delay": "PT0S",
456
"approval_duration": "PT1S",
454
"approval_delay": "0s",
455
"approval_duration": "1s",
457
456
"approved_by_default": "True",
458
457
"enabled": "True",
459
458
}
717
716
except OSError as error:
718
717
logger.error("Failed to start subprocess",
719
718
exc_info=error)
720
return True
721
719
self.checker_callback_tag = (gobject.child_watch_add
722
720
(self.checker.pid,
723
721
self.checker_callback,
724
722
data=command))
725
723
# The checker may have completed before the gobject
726
724
# watch was added. Check for this.
727
try:
728
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
729
except OSError as error:
730
if error.errno == errno.ECHILD:
731
# This should never happen
732
logger.error("Child process vanished",
733
exc_info=error)
734
return True
735
raise
725
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
736
726
if pid:
737
727
gobject.source_remove(self.checker_callback_tag)
738
728
self.checker_callback(pid, status, command)
1078
1068
interface_names.add(alt_interface)
1079
1069
# Is this a D-Bus signal?
1080
1070
if getattr(attribute, "_dbus_is_signal", False):
1081
# Extract the original non-method undecorated
1082
# function by black magic
1071
# Extract the original non-method function by
1072
# black magic
1083
1073
nonmethod_func = (dict(
1084
1074
zip(attribute.func_code.co_freevars,
1085
1075
attribute.__closure__))["func"]
2100
2090
return True
2101
2091
2102
2092
2103
def rfc3339_duration_to_delta(duration):
2104
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2105
2106
>>> rfc3339_duration_to_delta("P7D")
2107
datetime.timedelta(7)
2108
>>> rfc3339_duration_to_delta("PT60S")
2109
datetime.timedelta(0, 60)
2110
>>> rfc3339_duration_to_delta("PT60M")
2111
datetime.timedelta(0, 3600)
2112
>>> rfc3339_duration_to_delta("PT24H")
2113
datetime.timedelta(1)
2114
>>> rfc3339_duration_to_delta("P1W")
2115
datetime.timedelta(7)
2116
>>> rfc3339_duration_to_delta("PT5M30S")
2117
datetime.timedelta(0, 330)
2118
>>> rfc3339_duration_to_delta("P1DT3M20S")
2119
datetime.timedelta(1, 200)
2120
"""
2121
2122
# Parsing an RFC 3339 duration with regular expressions is not
2123
# possible - there would have to be multiple places for the same
2124
# values, like seconds. The current code, while more esoteric, is
2125
# cleaner without depending on a parsing library. If Python had a
2126
# built-in library for parsing we would use it, but we'd like to
2127
# avoid excessive use of external libraries.
2128
2129
# New type for defining tokens, syntax, and semantics all-in-one
2130
Token = collections.namedtuple("Token",
2131
("regexp", # To match token; if
2132
# "value" is not None,
2133
# must have a "group"
2134
# containing digits
2135
"value", # datetime.timedelta or
2136
# None
2137
"followers")) # Tokens valid after
2138
# this token
2139
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2140
# the "duration" ABNF definition in RFC 3339, Appendix A.
2141
token_end = Token(re.compile(r"$"), None, frozenset())
2142
token_second = Token(re.compile(r"(\d+)S"),
2143
datetime.timedelta(seconds=1),
2144
frozenset((token_end,)))
2145
token_minute = Token(re.compile(r"(\d+)M"),
2146
datetime.timedelta(minutes=1),
2147
frozenset((token_second, token_end)))
2148
token_hour = Token(re.compile(r"(\d+)H"),
2149
datetime.timedelta(hours=1),
2150
frozenset((token_minute, token_end)))
2151
token_time = Token(re.compile(r"T"),
2152
None,
2153
frozenset((token_hour, token_minute,
2154
token_second)))
2155
token_day = Token(re.compile(r"(\d+)D"),
2156
datetime.timedelta(days=1),
2157
frozenset((token_time, token_end)))
2158
token_month = Token(re.compile(r"(\d+)M"),
2159
datetime.timedelta(weeks=4),
2160
frozenset((token_day, token_end)))
2161
token_year = Token(re.compile(r"(\d+)Y"),
2162
datetime.timedelta(weeks=52),
2163
frozenset((token_month, token_end)))
2164
token_week = Token(re.compile(r"(\d+)W"),
2165
datetime.timedelta(weeks=1),
2166
frozenset((token_end,)))
2167
token_duration = Token(re.compile(r"P"), None,
2168
frozenset((token_year, token_month,
2169
token_day, token_time,
2170
token_week))),
2171
# Define starting values
2172
value = datetime.timedelta() # Value so far
2173
found_token = None
2174
followers = frozenset(token_duration,) # Following valid tokens
2175
s = duration # String left to parse
2176
# Loop until end token is found
2177
while found_token is not token_end:
2178
# Search for any currently valid tokens
2179
for token in followers:
2180
match = token.regexp.match(s)
2181
if match is not None:
2182
# Token found
2183
if token.value is not None:
2184
# Value found, parse digits
2185
factor = int(match.group(1), 10)
2186
# Add to value so far
2187
value += factor * token.value
2188
# Strip token from string
2189
s = token.regexp.sub("", s, 1)
2190
# Go to found token
2191
found_token = token
2192
# Set valid next tokens
2193
followers = found_token.followers
2194
break
2195
else:
2196
# No currently valid tokens were found
2197
raise ValueError("Invalid RFC 3339 duration")
2198
# End token found
2199
return value
2200
2201
2202
2093
def string_to_delta(interval):
2203
2094
"""Parse a string and return a datetime.timedelta
2204
2095
2215
2106
>>> string_to_delta('5m 30s')
2216
2107
datetime.timedelta(0, 330)
2217
2108
"""
2218
2219
try:
2220
return rfc3339_duration_to_delta(interval)
2221
except ValueError:
2222
pass
2223
2224
2109
timevalue = datetime.timedelta(0)
2225
2110
for s in interval.split():
2226
2111
try:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0