To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 353
- compare with another revision
- download diff
- download tarball
- view history from revision 353
- Committer: Teddy Hogeborn
- Date: 2016-10-05 20:13:01 UTC
- Revision ID: teddy@recompile.se-20161005201301-3ibock2agjb2ppe6
Tags: version-1.7.12-1
* Makefile (version): Change to 1.7.12.
* NEWS (Version 1.7.12): Add new entry.
* debian/changelog (1.7.12-1): - '' -
* NEWS (Version 1.7.12): Add new entry.
* debian/changelog (1.7.12-1): - '' -
- files added:
- initramfs-tools-hook-conf
- files removed:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
31
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
32
#
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
39
39
except ImportError:
40
40
pass
41
41
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
42
try:
48
43
import SocketServer as socketserver
49
44
except ImportError:
50
45
import socketserver
51
46
import socket
47
import argparse
52
48
import datetime
53
49
import errno
54
50
try:
55
51
import ConfigParser as configparser
56
52
except ImportError:
57
53
import configparser
54
import sys
58
55
import re
56
import os
59
57
import signal
60
58
import subprocess
61
59
import atexit
62
60
import stat
61
import logging
63
62
import logging.handlers
64
63
import pwd
65
64
import contextlib
77
76
import itertools
78
77
import collections
79
78
import codecs
80
import random
81
import shlex
82
79
83
80
import dbus
84
81
import dbus.service
85
import gi
86
82
from gi.repository import GLib
87
83
from dbus.mainloop.glib import DBusGMainLoop
88
84
import ctypes
90
86
import xml.dom.minidom
91
87
import inspect
92
88
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
89
# Try to find the value of SO_BINDTODEVICE:
119
90
try:
120
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
140
111
# No value found
141
112
SO_BINDTODEVICE = None
142
113
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
114
if sys.version_info.major == 2:
115
str = unicode
145
116
146
version = "1.8.16"
117
version = "1.7.12"
147
118
stored_state_file = "clients.pickle"
148
119
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
150
logging.captureWarnings(True) # Show warnings via the logging system
120
logger = logging.getLogger()
151
121
syslogger = None
152
122
153
123
try:
189
159
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
160
address="/dev/log"))
191
161
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
162
('Mandos [%(process)d]: %(levelname)s:'
163
' %(message)s'))
164
logger.addHandler(syslogger)
195
165
196
166
if debug:
197
167
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
168
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
169
' [%(process)d]:'
170
' %(levelname)s:'
171
' %(message)s'))
172
logger.addHandler(console)
173
logger.setLevel(level)
204
174
205
175
206
176
class PGPError(Exception):
208
178
pass
209
179
210
180
211
class PGPEngine:
181
class PGPEngine(object):
212
182
"""A simple class for OpenPGP symmetric encryption & decryption"""
213
183
214
184
def __init__(self):
218
188
output = subprocess.check_output(["gpgconf"])
219
189
for line in output.splitlines():
220
190
name, text, path = line.split(b":")
221
if name == b"gpg":
191
if name == "gpg":
222
192
self.gpg = path
223
193
break
224
194
except OSError as e:
225
195
if e.errno != errno.ENOENT:
226
196
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
197
self.gnupgargs = ['--batch',
198
'--homedir', self.tempdir,
199
'--force-mdc',
200
'--quiet']
231
201
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
233
203
self.gnupgargs.append("--no-use-agent")
234
204
235
205
def __enter__(self):
272
242
dir=self.tempdir) as passfile:
273
243
passfile.write(passphrase)
274
244
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
245
proc = subprocess.Popen([self.gpg, '--symmetric',
246
'--passphrase-file',
277
247
passfile.name]
278
248
+ self.gnupgargs,
279
249
stdin=subprocess.PIPE,
290
260
dir=self.tempdir) as passfile:
291
261
passfile.write(passphrase)
292
262
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
263
proc = subprocess.Popen([self.gpg, '--decrypt',
264
'--passphrase-file',
295
265
passfile.name]
296
266
+ self.gnupgargs,
297
267
stdin=subprocess.PIPE,
304
274
305
275
306
276
# Pretend that we have an Avahi module
307
class avahi:
308
"""This isn't so much a class as it is a module-like namespace."""
277
class Avahi(object):
278
"""This isn't so much a class as it is a module-like namespace.
279
It is instantiated once, and simulates having an Avahi module."""
309
280
IF_UNSPEC = -1 # avahi-common/address.h
310
281
PROTO_UNSPEC = -1 # avahi-common/address.h
311
282
PROTO_INET = 0 # avahi-common/address.h
315
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
287
DBUS_PATH_SERVER = "/"
317
288
318
@staticmethod
319
def string_array_to_txt_array(t):
289
def string_array_to_txt_array(self, t):
320
290
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
291
for s in t), signature="ay")
322
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
327
297
SERVER_RUNNING = 2 # avahi-common/defs.h
328
298
SERVER_COLLISION = 3 # avahi-common/defs.h
329
299
SERVER_FAILURE = 4 # avahi-common/defs.h
300
avahi = Avahi()
330
301
331
302
332
303
class AvahiError(Exception):
344
315
pass
345
316
346
317
347
class AvahiService:
318
class AvahiService(object):
348
319
"""An Avahi (Zeroconf) service.
349
320
350
321
Attributes:
351
322
interface: integer; avahi.IF_UNSPEC or an interface index.
352
323
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
324
name: string; Example: 'Mandos'
325
type: string; Example: '_mandos._tcp'.
355
326
See <https://www.iana.org/assignments/service-names-port-numbers>
356
327
port: integer; what port to announce
357
328
TXT: list of strings; TXT record for the service
394
365
def rename(self, remove=True):
395
366
"""Derived from the Avahi example code"""
396
367
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
368
logger.critical("No suitable Zeroconf service name found"
369
" after %i retries, exiting.",
370
self.rename_count)
400
371
raise AvahiServiceError("Too many renames")
401
372
self.name = str(
402
373
self.server.GetAlternativeServiceName(self.name))
403
374
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
375
logger.info("Changing Zeroconf service name to %r ...",
376
self.name)
406
377
if remove:
407
378
self.remove()
408
379
try:
410
381
except dbus.exceptions.DBusException as error:
411
382
if (error.get_dbus_name()
412
383
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
384
logger.info("Local Zeroconf service name collision.")
414
385
return self.rename(remove=False)
415
386
else:
416
log.critical("D-Bus Exception", exc_info=error)
387
logger.critical("D-Bus Exception", exc_info=error)
417
388
self.cleanup()
418
389
os._exit(1)
419
390
435
406
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
407
self.entry_group_state_changed_match = (
437
408
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
409
'StateChanged', self.entry_group_state_changed))
410
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
411
self.name, self.type)
441
412
self.group.AddService(
442
413
self.interface,
443
414
self.protocol,
450
421
451
422
def entry_group_state_changed(self, state, error):
452
423
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
424
logger.debug("Avahi entry group state change: %i", state)
454
425
455
426
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
427
logger.debug("Zeroconf service established.")
457
428
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
429
logger.info("Zeroconf service name collision.")
459
430
self.rename()
460
431
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
432
logger.critical("Avahi: Error in group state changed %s",
433
str(error))
463
434
raise AvahiGroupError("State changed: {!s}".format(error))
464
435
465
436
def cleanup(self):
475
446
476
447
def server_state_changed(self, state, error=None):
477
448
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
449
logger.debug("Avahi server state change: %i", state)
479
450
bad_states = {
480
451
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
452
avahi.SERVER_REGISTERING: None,
485
456
if state in bad_states:
486
457
if bad_states[state] is not None:
487
458
if error is None:
488
log.error(bad_states[state])
459
logger.error(bad_states[state])
489
460
else:
490
log.error(bad_states[state] + ": %r", error)
461
logger.error(bad_states[state] + ": %r", error)
491
462
self.cleanup()
492
463
elif state == avahi.SERVER_RUNNING:
493
464
try:
495
466
except dbus.exceptions.DBusException as error:
496
467
if (error.get_dbus_name()
497
468
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
469
logger.info("Local Zeroconf service name"
470
" collision.")
499
471
return self.rename(remove=False)
500
472
else:
501
log.critical("D-Bus Exception", exc_info=error)
473
logger.critical("D-Bus Exception", exc_info=error)
502
474
self.cleanup()
503
475
os._exit(1)
504
476
else:
505
477
if error is None:
506
log.debug("Unknown state: %r", state)
478
logger.debug("Unknown state: %r", state)
507
479
else:
508
log.debug("Unknown state: %r: %r", state, error)
480
logger.debug("Unknown state: %r: %r", state, error)
509
481
510
482
def activate(self):
511
483
"""Derived from the Avahi example code"""
523
495
class AvahiServiceToSyslog(AvahiService):
524
496
def rename(self, *args, **kwargs):
525
497
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
498
ret = AvahiService.rename(self, *args, **kwargs)
528
499
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
501
.format(self.name)))
531
502
return ret
532
503
533
504
534
505
# Pretend that we have a GnuTLS module
535
class gnutls:
536
"""This isn't so much a class as it is a module-like namespace."""
506
class GnuTLS(object):
507
"""This isn't so much a class as it is a module-like namespace.
508
It is instantiated once, and simulates having a GnuTLS module."""
537
509
538
510
library = ctypes.util.find_library("gnutls")
539
511
if library is None:
540
512
library = ctypes.util.find_library("gnutls-deb0")
541
513
_library = ctypes.cdll.LoadLibrary(library)
542
514
del library
515
_need_version = b"3.3.0"
516
517
def __init__(self):
518
# Need to use class name "GnuTLS" here, since this method is
519
# called before the assignment to the "gnutls" global variable
520
# happens.
521
if GnuTLS.check_version(self._need_version) is None:
522
raise GnuTLS.Error("Needs GnuTLS {} or later"
523
.format(self._need_version))
543
524
544
525
# Unless otherwise indicated, the constants and types below are
545
526
# all from the gnutls/gnutls.h C header file.
549
530
E_INTERRUPTED = -52
550
531
E_AGAIN = -28
551
532
CRT_OPENPGP = 2
552
CRT_RAWPK = 3
553
533
CLIENT = 2
554
534
SHUT_RDWR = 0
555
535
CRD_CERTIFICATE = 1
556
536
E_NO_CERTIFICATE_FOUND = -49
557
X509_FMT_DER = 0
558
NO_TICKETS = 1<<10
559
ENABLE_RAWPK = 1<<18
560
CTYPE_PEERS = 3
561
KEYID_USE_SHA256 = 1 # gnutls/x509.h
562
537
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
538
564
539
# Types
565
class _session_int(ctypes.Structure):
540
class session_int(ctypes.Structure):
566
541
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
542
session_t = ctypes.POINTER(session_int)
568
543
569
544
class certificate_credentials_st(ctypes.Structure):
570
545
_fields_ = []
573
548
certificate_type_t = ctypes.c_int
574
549
575
550
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
551
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
552
('size', ctypes.c_uint)]
578
553
579
class _openpgp_crt_int(ctypes.Structure):
554
class openpgp_crt_int(ctypes.Structure):
580
555
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
556
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
557
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
558
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
559
credentials_type_t = ctypes.c_int
587
562
588
563
# Exceptions
589
564
class Error(Exception):
565
# We need to use the class name "GnuTLS" here, since this
566
# exception might be raised from within GnuTLS.__init__,
567
# which is called before the assignment to the "gnutls"
568
# global variable has happened.
590
569
def __init__(self, message=None, code=None, args=()):
591
570
# Default usage is by a message string, but if a return
592
571
# code is passed, convert it to a string with
593
572
# gnutls.strerror()
594
573
self.code = code
595
574
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
598
return super(gnutls.Error, self).__init__(
575
message = GnuTLS.strerror(code)
576
return super(GnuTLS.Error, self).__init__(
599
577
message, *args)
600
578
601
579
class CertificateSecurityError(Error):
602
580
pass
603
581
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
582
# Classes
630
class Credentials(With_from_param):
583
class Credentials(object):
631
584
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
585
self._c_object = gnutls.certificate_credentials_t()
586
gnutls.certificate_allocate_credentials(
587
ctypes.byref(self._c_object))
634
588
self.type = gnutls.CRD_CERTIFICATE
635
589
636
590
def __del__(self):
637
gnutls.certificate_free_credentials(self)
591
gnutls.certificate_free_credentials(self._c_object)
638
592
639
class ClientSession(With_from_param):
593
class ClientSession(object):
640
594
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
642
gnutls_flags = gnutls.CLIENT
643
if gnutls.check_version(b"3.5.6"):
644
gnutls_flags |= gnutls.NO_TICKETS
645
if gnutls.has_rawpk:
646
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
648
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
595
self._c_object = gnutls.session_t()
596
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
597
gnutls.set_default_priority(self._c_object)
598
gnutls.transport_set_ptr(self._c_object, socket.fileno())
599
gnutls.handshake_set_private_extensions(self._c_object,
600
True)
652
601
self.socket = socket
653
602
if credentials is None:
654
603
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
604
gnutls.credentials_set(self._c_object, credentials.type,
605
ctypes.cast(credentials._c_object,
606
ctypes.c_void_p))
657
607
self.credentials = credentials
658
608
659
609
def __del__(self):
660
gnutls.deinit(self)
610
gnutls.deinit(self._c_object)
661
611
662
612
def handshake(self):
663
return gnutls.handshake(self)
613
return gnutls.handshake(self._c_object)
664
614
665
615
def send(self, data):
666
616
data = bytes(data)
667
617
data_len = len(data)
668
618
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
619
data_len -= gnutls.record_send(self._c_object,
620
data[-data_len:],
670
621
data_len)
671
622
672
623
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
624
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
625
675
626
# Error handling functions
676
627
def _error_code(result):
677
628
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
629
for the 'restype' attribute on ctypes functions"""
630
if result >= 0:
680
631
return result
681
632
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
633
raise gnutls.CertificateSecurityError(code=result)
683
634
raise gnutls.Error(code=result)
684
635
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
636
def _retry_on_error(result, func, arguments):
687
637
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
638
for the 'errcheck' attribute on ctypes functions"""
639
while result < 0:
690
640
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
641
return _error_code(result)
692
642
result = func(*arguments)
697
647
698
648
# Functions
699
649
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
650
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
651
ctypes.POINTER(ctypes.c_char_p)]
702
652
priority_set_direct.restype = _error_code
703
653
704
654
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
655
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
656
init.restype = _error_code
707
657
708
658
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
659
set_default_priority.argtypes = [session_t]
710
660
set_default_priority.restype = _error_code
711
661
712
662
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
663
record_send.argtypes = [session_t, ctypes.c_void_p,
714
664
ctypes.c_size_t]
715
665
record_send.restype = ctypes.c_ssize_t
716
666
record_send.errcheck = _retry_on_error
718
668
certificate_allocate_credentials = (
719
669
_library.gnutls_certificate_allocate_credentials)
720
670
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
671
ctypes.POINTER(certificate_credentials_t)]
722
672
certificate_allocate_credentials.restype = _error_code
723
673
724
674
certificate_free_credentials = (
725
675
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
676
certificate_free_credentials.argtypes = [
677
certificate_credentials_t]
727
678
certificate_free_credentials.restype = None
728
679
729
680
handshake_set_private_extensions = (
730
681
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
682
handshake_set_private_extensions.argtypes = [session_t,
732
683
ctypes.c_int]
733
684
handshake_set_private_extensions.restype = None
734
685
735
686
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
687
credentials_set.argtypes = [session_t, credentials_type_t,
688
ctypes.c_void_p]
738
689
credentials_set.restype = _error_code
739
690
740
691
strerror = _library.gnutls_strerror
742
693
strerror.restype = ctypes.c_char_p
743
694
744
695
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
696
certificate_type_get.argtypes = [session_t]
746
697
certificate_type_get.restype = _error_code
747
698
748
699
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
700
certificate_get_peers.argtypes = [session_t,
750
701
ctypes.POINTER(ctypes.c_uint)]
751
702
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
703
759
710
global_set_log_function.restype = None
760
711
761
712
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
713
deinit.argtypes = [session_t]
763
714
deinit.restype = None
764
715
765
716
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
717
handshake.argtypes = [session_t]
718
handshake.restype = _error_code
768
719
handshake.errcheck = _retry_on_error
769
720
770
721
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
722
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
723
transport_set_ptr.restype = None
773
724
774
725
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
726
bye.argtypes = [session_t, close_request_t]
727
bye.restype = _error_code
777
728
bye.errcheck = _retry_on_error
778
729
779
730
check_version = _library.gnutls_check_version
780
731
check_version.argtypes = [ctypes.c_char_p]
781
732
check_version.restype = ctypes.c_char_p
782
733
783
_need_version = b"3.3.0"
784
if check_version(_need_version) is None:
785
raise self.Error("Needs GnuTLS {} or later"
786
.format(_need_version))
787
788
_tls_rawpk_version = b"3.6.6"
789
has_rawpk = bool(check_version(_tls_rawpk_version))
790
791
if has_rawpk:
792
# Types
793
class pubkey_st(ctypes.Structure):
794
_fields = []
795
pubkey_t = ctypes.POINTER(pubkey_st)
796
797
x509_crt_fmt_t = ctypes.c_int
798
799
# All the function declarations below are from
800
# gnutls/abstract.h
801
pubkey_init = _library.gnutls_pubkey_init
802
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
pubkey_init.restype = _error_code
804
805
pubkey_import = _library.gnutls_pubkey_import
806
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
807
x509_crt_fmt_t]
808
pubkey_import.restype = _error_code
809
810
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
811
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
812
ctypes.POINTER(ctypes.c_ubyte),
813
ctypes.POINTER(ctypes.c_size_t)]
814
pubkey_get_key_id.restype = _error_code
815
816
pubkey_deinit = _library.gnutls_pubkey_deinit
817
pubkey_deinit.argtypes = [pubkey_t]
818
pubkey_deinit.restype = None
819
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
822
823
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
825
openpgp_crt_init.restype = _error_code
826
827
openpgp_crt_import = _library.gnutls_openpgp_crt_import
828
openpgp_crt_import.argtypes = [openpgp_crt_t,
829
ctypes.POINTER(datum_t),
830
openpgp_crt_fmt_t]
831
openpgp_crt_import.restype = _error_code
832
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
840
openpgp_crt_verify_self.restype = _error_code
841
842
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
843
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
844
openpgp_crt_deinit.restype = None
845
846
openpgp_crt_get_fingerprint = (
847
_library.gnutls_openpgp_crt_get_fingerprint)
848
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
849
ctypes.c_void_p,
850
ctypes.POINTER(
851
ctypes.c_size_t)]
852
openpgp_crt_get_fingerprint.restype = _error_code
853
854
if check_version(b"3.6.4"):
855
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
857
certificate_type_get2.restype = _error_code
734
# All the function declarations below are from gnutls/openpgp.h
735
736
openpgp_crt_init = _library.gnutls_openpgp_crt_init
737
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
738
openpgp_crt_init.restype = _error_code
739
740
openpgp_crt_import = _library.gnutls_openpgp_crt_import
741
openpgp_crt_import.argtypes = [openpgp_crt_t,
742
ctypes.POINTER(datum_t),
743
openpgp_crt_fmt_t]
744
openpgp_crt_import.restype = _error_code
745
746
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
747
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
748
ctypes.POINTER(ctypes.c_uint)]
749
openpgp_crt_verify_self.restype = _error_code
750
751
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
752
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
753
openpgp_crt_deinit.restype = None
754
755
openpgp_crt_get_fingerprint = (
756
_library.gnutls_openpgp_crt_get_fingerprint)
757
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
758
ctypes.c_void_p,
759
ctypes.POINTER(
760
ctypes.c_size_t)]
761
openpgp_crt_get_fingerprint.restype = _error_code
858
762
859
763
# Remove non-public functions
860
764
del _error_code, _retry_on_error
765
# Create the global "gnutls" object, simulating a module
766
gnutls = GnuTLS()
861
767
862
768
863
769
def call_pipe(connection, # : multiprocessing.Connection
871
777
connection.close()
872
778
873
779
874
class Client:
780
class Client(object):
875
781
"""A representation of a client host served by this server.
876
782
877
783
Attributes:
878
approved: bool(); None if not yet approved/disapproved
784
approved: bool(); 'None' if not yet approved/disapproved
879
785
approval_delay: datetime.timedelta(); Time to wait for approval
880
786
approval_duration: datetime.timedelta(); Duration of one approval
881
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
883
running.
787
checker: subprocess.Popen(); a running checker process used
788
to see if the client lives.
789
'None' if no process is running.
884
790
checker_callback_tag: a GLib event source tag, or None
885
791
checker_command: string; External command which is run to check
886
792
if client lives. %() expansions are done at
894
800
disable_initiator_tag: a GLib event source tag, or None
895
801
enabled: bool()
896
802
fingerprint: string (40 or 32 hexadecimal digits); used to
897
uniquely identify an OpenPGP client
898
key_id: string (64 hexadecimal digits); used to uniquely identify
899
a client using raw public keys
803
uniquely identify the client
900
804
host: string; available for use by the checker command
901
805
interval: datetime.timedelta(); How often to start a new checker
902
806
last_approval_request: datetime.datetime(); (UTC) or None
920
824
"""
921
825
922
826
runtime_expansions = ("approval_delay", "approval_duration",
923
"created", "enabled", "expires", "key_id",
827
"created", "enabled", "expires",
924
828
"fingerprint", "host", "interval",
925
829
"last_approval_request", "last_checked_ok",
926
830
"last_enabled", "name", "timeout")
956
860
client["enabled"] = config.getboolean(client_name,
957
861
"enabled")
958
862
959
# Uppercase and remove spaces from key_id and fingerprint
960
# for later comparison purposes with return value from the
961
# key_id() and fingerprint() functions
962
client["key_id"] = (section.get("key_id", "").upper()
963
.replace(" ", ""))
863
# Uppercase and remove spaces from fingerprint for later
864
# comparison purposes with return value from the
865
# fingerprint() function
964
866
client["fingerprint"] = (section["fingerprint"].upper()
965
867
.replace(" ", ""))
966
868
if "secret" in section:
1009
911
self.last_enabled = None
1010
912
self.expires = None
1011
913
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
914
logger.debug("Creating client %r", self.name)
915
logger.debug(" Fingerprint: %s", self.fingerprint)
1015
916
self.created = settings.get("created",
1016
917
datetime.datetime.utcnow())
1017
918
1045
946
if getattr(self, "enabled", False):
1046
947
# Already enabled
1047
948
return
949
self.expires = datetime.datetime.utcnow() + self.timeout
1048
950
self.enabled = True
1049
951
self.last_enabled = datetime.datetime.utcnow()
1050
952
self.init_checker()
1055
957
if not getattr(self, "enabled", False):
1056
958
return False
1057
959
if not quiet:
1058
log.info("Disabling client %s", self.name)
960
logger.info("Disabling client %s", self.name)
1059
961
if getattr(self, "disable_initiator_tag", None) is not None:
1060
962
GLib.source_remove(self.disable_initiator_tag)
1061
963
self.disable_initiator_tag = None
1073
975
def __del__(self):
1074
976
self.disable()
1075
977
1076
def init_checker(self, randomize_start=False):
1077
# Schedule a new checker to be started a randomly selected
1078
# time (a fraction of 'interval') from now. This spreads out
1079
# the startup of checkers over time when the server is
1080
# started.
978
def init_checker(self):
979
# Schedule a new checker to be started an 'interval' from now,
980
# and every interval from then on.
1081
981
if self.checker_initiator_tag is not None:
1082
982
GLib.source_remove(self.checker_initiator_tag)
1083
interval_milliseconds = int(self.interval.total_seconds()
1084
* 1000)
1085
if randomize_start:
1086
delay_milliseconds = random.randrange(
1087
interval_milliseconds + 1)
1088
else:
1089
delay_milliseconds = interval_milliseconds
1090
983
self.checker_initiator_tag = GLib.timeout_add(
1091
delay_milliseconds, self.start_checker, randomize_start)
1092
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1093
# A checker might take up to an 'interval' of time, so we can
1094
# expire at the soonest one interval after a checker was
1095
# started. Since the initial checker is delayed, the expire
1096
# time might have to be extended.
1097
now = datetime.datetime.utcnow()
1098
self.expires = now + delay + self.interval
1099
# Schedule a disable() at expire time
984
int(self.interval.total_seconds() * 1000),
985
self.start_checker)
986
# Schedule a disable() when 'timeout' has passed
1100
987
if self.disable_initiator_tag is not None:
1101
988
GLib.source_remove(self.disable_initiator_tag)
1102
989
self.disable_initiator_tag = GLib.timeout_add(
1103
int((self.expires - now).total_seconds() * 1000),
1104
self.disable)
990
int(self.timeout.total_seconds() * 1000), self.disable)
991
# Also start a new checker *right now*.
992
self.start_checker()
1105
993
1106
994
def checker_callback(self, source, condition, connection,
1107
995
command):
1108
996
"""The checker has completed, so take appropriate actions."""
997
self.checker_callback_tag = None
998
self.checker = None
1109
999
# Read return code from connection (see call_pipe)
1110
1000
returncode = connection.recv()
1111
1001
connection.close()
1112
if self.checker is not None:
1113
self.checker.join()
1114
self.checker_callback_tag = None
1115
self.checker = None
1116
1002
1117
1003
if returncode >= 0:
1118
1004
self.last_checker_status = returncode
1119
1005
self.last_checker_signal = None
1120
1006
if self.last_checker_status == 0:
1121
log.info("Checker for %(name)s succeeded", vars(self))
1007
logger.info("Checker for %(name)s succeeded",
1008
vars(self))
1122
1009
self.checked_ok()
1123
1010
else:
1124
log.info("Checker for %(name)s failed", vars(self))
1011
logger.info("Checker for %(name)s failed", vars(self))
1125
1012
else:
1126
1013
self.last_checker_status = -1
1127
1014
self.last_checker_signal = -returncode
1128
log.warning("Checker for %(name)s crashed?", vars(self))
1015
logger.warning("Checker for %(name)s crashed?",
1016
vars(self))
1129
1017
return False
1130
1018
1131
1019
def checked_ok(self):
1150
1038
def need_approval(self):
1151
1039
self.last_approval_request = datetime.datetime.utcnow()
1152
1040
1153
def start_checker(self, start_was_randomized=False):
1041
def start_checker(self):
1154
1042
"""Start a new checker subprocess if one is not running.
1155
1043
1156
1044
If a checker already exists, leave it running and do
1165
1053
# should be.
1166
1054
1167
1055
if self.checker is not None and not self.checker.is_alive():
1168
log.warning("Checker was not alive; joining")
1056
logger.warning("Checker was not alive; joining")
1169
1057
self.checker.join()
1170
1058
self.checker = None
1171
1059
# Start a new checker if needed
1172
1060
if self.checker is None:
1173
1061
# Escape attributes for the shell
1174
1062
escaped_attrs = {
1175
attr: shlex.quote(str(getattr(self, attr)))
1063
attr: re.escape(str(getattr(self, attr)))
1176
1064
for attr in self.runtime_expansions}
1177
1065
try:
1178
1066
command = self.checker_command % escaped_attrs
1179
1067
except TypeError as error:
1180
log.error('Could not format string "%s"',
1181
self.checker_command, exc_info=error)
1068
logger.error('Could not format string "%s"',
1069
self.checker_command,
1070
exc_info=error)
1182
1071
return True # Try again later
1183
1072
self.current_checker_command = command
1184
log.info("Starting checker %r for %s", command, self.name)
1073
logger.info("Starting checker %r for %s", command,
1074
self.name)
1185
1075
# We don't need to redirect stdout and stderr, since
1186
1076
# in normal mode, that is already done by daemon(),
1187
1077
# and in debug mode we don't want to. (Stdin is
1203
1093
kwargs=popen_args)
1204
1094
self.checker.start()
1205
1095
self.checker_callback_tag = GLib.io_add_watch(
1206
GLib.IOChannel.unix_new(pipe[0].fileno()),
1207
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1096
pipe[0].fileno(), GLib.IO_IN,
1208
1097
self.checker_callback, pipe[0], command)
1209
if start_was_randomized:
1210
# We were started after a random delay; Schedule a new
1211
# checker to be started an 'interval' from now, and every
1212
# interval from then on.
1213
now = datetime.datetime.utcnow()
1214
self.checker_initiator_tag = GLib.timeout_add(
1215
int(self.interval.total_seconds() * 1000),
1216
self.start_checker)
1217
self.expires = max(self.expires, now + self.interval)
1218
# Don't start a new checker again after same random delay
1219
return False
1220
1098
# Re-run this periodically if run by GLib.timeout_add
1221
1099
return True
1222
1100
1227
1105
self.checker_callback_tag = None
1228
1106
if getattr(self, "checker", None) is None:
1229
1107
return
1230
log.debug("Stopping checker for %(name)s", vars(self))
1108
logger.debug("Stopping checker for %(name)s", vars(self))
1231
1109
self.checker.terminate()
1232
1110
self.checker = None
1233
1111
1260
1138
func._dbus_name = func.__name__
1261
1139
if func._dbus_name.endswith("_dbus_property"):
1262
1140
func._dbus_name = func._dbus_name[:-14]
1263
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1141
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1264
1142
return func
1265
1143
1266
1144
return decorator
1355
1233
1356
1234
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1357
1235
out_signature="s",
1358
path_keyword="object_path",
1359
connection_keyword="connection")
1236
path_keyword='object_path',
1237
connection_keyword='connection')
1360
1238
def Introspect(self, object_path, connection):
1361
1239
"""Overloading of standard D-Bus method.
1362
1240
1411
1289
document.unlink()
1412
1290
except (AttributeError, xml.dom.DOMException,
1413
1291
xml.parsers.expat.ExpatError) as error:
1414
log.error("Failed to override Introspection method",
1415
exc_info=error)
1292
logger.error("Failed to override Introspection method",
1293
exc_info=error)
1416
1294
return xmlstring
1417
1295
1418
1296
1476
1354
raise ValueError("Byte arrays not supported for non-"
1477
1355
"'ay' signature {!r}"
1478
1356
.format(prop._dbus_signature))
1479
value = dbus.ByteArray(bytes(value))
1357
value = dbus.ByteArray(b''.join(chr(byte)
1358
for byte in value))
1480
1359
prop(value)
1481
1360
1482
1361
@dbus.service.method(dbus.PROPERTIES_IFACE,
1515
1394
1516
1395
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1517
1396
out_signature="s",
1518
path_keyword="object_path",
1519
connection_keyword="connection")
1397
path_keyword='object_path',
1398
connection_keyword='connection')
1520
1399
def Introspect(self, object_path, connection):
1521
1400
"""Overloading of standard D-Bus method.
1522
1401
1578
1457
document.unlink()
1579
1458
except (AttributeError, xml.dom.DOMException,
1580
1459
xml.parsers.expat.ExpatError) as error:
1581
log.error("Failed to override Introspection method",
1582
exc_info=error)
1460
logger.error("Failed to override Introspection method",
1461
exc_info=error)
1583
1462
return xmlstring
1584
1463
1585
1586
1464
try:
1587
1465
dbus.OBJECT_MANAGER_IFACE
1588
1466
except AttributeError:
1617
1495
1618
1496
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1619
1497
out_signature="s",
1620
path_keyword="object_path",
1621
connection_keyword="connection")
1498
path_keyword='object_path',
1499
connection_keyword='connection')
1622
1500
def Introspect(self, object_path, connection):
1623
1501
"""Overloading of standard D-Bus method.
1624
1502
1649
1527
document.unlink()
1650
1528
except (AttributeError, xml.dom.DOMException,
1651
1529
xml.parsers.expat.ExpatError) as error:
1652
log.error("Failed to override Introspection method",
1653
exc_info=error)
1530
logger.error("Failed to override Introspection method",
1531
exc_info=error)
1654
1532
return xmlstring
1655
1533
1656
1534
2120
1998
def Name_dbus_property(self):
2121
1999
return dbus.String(self.name)
2122
2000
2123
# KeyID - property
2124
@dbus_annotations(
2125
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2126
@dbus_service_property(_interface, signature="s", access="read")
2127
def KeyID_dbus_property(self):
2128
return dbus.String(self.key_id)
2129
2130
2001
# Fingerprint - property
2131
2002
@dbus_annotations(
2132
2003
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2287
2158
del _interface
2288
2159
2289
2160
2290
class ProxyClient:
2291
def __init__(self, child_pipe, key_id, fpr, address):
2161
class ProxyClient(object):
2162
def __init__(self, child_pipe, fpr, address):
2292
2163
self._pipe = child_pipe
2293
self._pipe.send(("init", key_id, fpr, address))
2164
self._pipe.send(('init', fpr, address))
2294
2165
if not self._pipe.recv():
2295
raise KeyError(key_id or fpr)
2166
raise KeyError(fpr)
2296
2167
2297
2168
def __getattribute__(self, name):
2298
if name == "_pipe":
2169
if name == '_pipe':
2299
2170
return super(ProxyClient, self).__getattribute__(name)
2300
self._pipe.send(("getattr", name))
2171
self._pipe.send(('getattr', name))
2301
2172
data = self._pipe.recv()
2302
if data[0] == "data":
2173
if data[0] == 'data':
2303
2174
return data[1]
2304
if data[0] == "function":
2175
if data[0] == 'function':
2305
2176
2306
2177
def func(*args, **kwargs):
2307
self._pipe.send(("funcall", name, args, kwargs))
2178
self._pipe.send(('funcall', name, args, kwargs))
2308
2179
return self._pipe.recv()[1]
2309
2180
2310
2181
return func
2311
2182
2312
2183
def __setattr__(self, name, value):
2313
if name == "_pipe":
2184
if name == '_pipe':
2314
2185
return super(ProxyClient, self).__setattr__(name, value)
2315
self._pipe.send(("setattr", name, value))
2186
self._pipe.send(('setattr', name, value))
2316
2187
2317
2188
2318
2189
class ClientHandler(socketserver.BaseRequestHandler, object):
2323
2194
2324
2195
def handle(self):
2325
2196
with contextlib.closing(self.server.child_pipe) as child_pipe:
2326
log.info("TCP connection from: %s",
2327
str(self.client_address))
2328
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2197
logger.info("TCP connection from: %s",
2198
str(self.client_address))
2199
logger.debug("Pipe FD: %d",
2200
self.server.child_pipe.fileno())
2329
2201
2330
2202
session = gnutls.ClientSession(self.request)
2331
2203
2332
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2204
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2333
2205
# "+AES-256-CBC", "+SHA1",
2334
2206
# "+COMP-NULL", "+CTYPE-OPENPGP",
2335
2207
# "+DHE-DSS"))
2337
2209
priority = self.server.gnutls_priority
2338
2210
if priority is None:
2339
2211
priority = "NORMAL"
2340
gnutls.priority_set_direct(session,
2341
priority.encode("utf-8"), None)
2212
gnutls.priority_set_direct(session._c_object,
2213
priority.encode("utf-8"),
2214
None)
2342
2215
2343
2216
# Start communication using the Mandos protocol
2344
2217
# Get protocol number
2345
2218
line = self.request.makefile().readline()
2346
log.debug("Protocol version: %r", line)
2219
logger.debug("Protocol version: %r", line)
2347
2220
try:
2348
2221
if int(line.strip().split()[0]) > 1:
2349
2222
raise RuntimeError(line)
2350
2223
except (ValueError, IndexError, RuntimeError) as error:
2351
log.error("Unknown protocol version: %s", error)
2224
logger.error("Unknown protocol version: %s", error)
2352
2225
return
2353
2226
2354
2227
# Start GnuTLS connection
2355
2228
try:
2356
2229
session.handshake()
2357
2230
except gnutls.Error as error:
2358
log.warning("Handshake failed: %s", error)
2231
logger.warning("Handshake failed: %s", error)
2359
2232
# Do not run session.bye() here: the session is not
2360
2233
# established. Just abandon the request.
2361
2234
return
2362
log.debug("Handshake succeeded")
2235
logger.debug("Handshake succeeded")
2363
2236
2364
2237
approval_required = False
2365
2238
try:
2366
if gnutls.has_rawpk:
2367
fpr = b""
2368
try:
2369
key_id = self.key_id(
2370
self.peer_certificate(session))
2371
except (TypeError, gnutls.Error) as error:
2372
log.warning("Bad certificate: %s", error)
2373
return
2374
log.debug("Key ID: %s",
2375
key_id.decode("utf-8",
2376
errors="replace"))
2377
2378
else:
2379
key_id = b""
2380
try:
2381
fpr = self.fingerprint(
2382
self.peer_certificate(session))
2383
except (TypeError, gnutls.Error) as error:
2384
log.warning("Bad certificate: %s", error)
2385
return
2386
log.debug("Fingerprint: %s", fpr)
2387
2388
try:
2389
client = ProxyClient(child_pipe, key_id, fpr,
2239
try:
2240
fpr = self.fingerprint(
2241
self.peer_certificate(session))
2242
except (TypeError, gnutls.Error) as error:
2243
logger.warning("Bad certificate: %s", error)
2244
return
2245
logger.debug("Fingerprint: %s", fpr)
2246
2247
try:
2248
client = ProxyClient(child_pipe, fpr,
2390
2249
self.client_address)
2391
2250
except KeyError:
2392
2251
return
2398
2257
2399
2258
while True:
2400
2259
if not client.enabled:
2401
log.info("Client %s is disabled", client.name)
2260
logger.info("Client %s is disabled",
2261
client.name)
2402
2262
if self.server.use_dbus:
2403
2263
# Emit D-Bus signal
2404
2264
client.Rejected("Disabled")
2408
2268
# We are approved or approval is disabled
2409
2269
break
2410
2270
elif client.approved is None:
2411
log.info("Client %s needs approval",
2412
client.name)
2271
logger.info("Client %s needs approval",
2272
client.name)
2413
2273
if self.server.use_dbus:
2414
2274
# Emit D-Bus signal
2415
2275
client.NeedApproval(
2416
2276
client.approval_delay.total_seconds()
2417
2277
* 1000, client.approved_by_default)
2418
2278
else:
2419
log.warning("Client %s was not approved",
2420
client.name)
2279
logger.warning("Client %s was not approved",
2280
client.name)
2421
2281
if self.server.use_dbus:
2422
2282
# Emit D-Bus signal
2423
2283
client.Rejected("Denied")
2431
2291
time2 = datetime.datetime.now()
2432
2292
if (time2 - time) >= delay:
2433
2293
if not client.approved_by_default:
2434
log.warning("Client %s timed out while"
2435
" waiting for approval",
2436
client.name)
2294
logger.warning("Client %s timed out while"
2295
" waiting for approval",
2296
client.name)
2437
2297
if self.server.use_dbus:
2438
2298
# Emit D-Bus signal
2439
2299
client.Rejected("Approval timed out")
2446
2306
try:
2447
2307
session.send(client.secret)
2448
2308
except gnutls.Error as error:
2449
log.warning("gnutls send failed", exc_info=error)
2309
logger.warning("gnutls send failed",
2310
exc_info=error)
2450
2311
return
2451
2312
2452
log.info("Sending secret to %s", client.name)
2313
logger.info("Sending secret to %s", client.name)
2453
2314
# bump the timeout using extended_timeout
2454
2315
client.bump_timeout(client.extended_timeout)
2455
2316
if self.server.use_dbus:
2462
2323
try:
2463
2324
session.bye()
2464
2325
except gnutls.Error as error:
2465
log.warning("GnuTLS bye failed", exc_info=error)
2326
logger.warning("GnuTLS bye failed",
2327
exc_info=error)
2466
2328
2467
2329
@staticmethod
2468
2330
def peer_certificate(session):
2469
"Return the peer's certificate as a bytestring"
2470
try:
2471
cert_type = gnutls.certificate_type_get2(
2472
session, gnutls.CTYPE_PEERS)
2473
except AttributeError:
2474
cert_type = gnutls.certificate_type_get(session)
2475
if gnutls.has_rawpk:
2476
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2477
else:
2478
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2479
# If not a valid certificate type...
2480
if cert_type not in valid_cert_types:
2481
log.info("Cert type %r not in %r", cert_type,
2482
valid_cert_types)
2331
"Return the peer's OpenPGP certificate as a bytestring"
2332
# If not an OpenPGP certificate...
2333
if (gnutls.certificate_type_get(session._c_object)
2334
!= gnutls.CRT_OPENPGP):
2483
2335
# ...return invalid data
2484
2336
return b""
2485
2337
list_size = ctypes.c_uint(1)
2486
2338
cert_list = (gnutls.certificate_get_peers
2487
(session, ctypes.byref(list_size)))
2339
(session._c_object, ctypes.byref(list_size)))
2488
2340
if not bool(cert_list) and list_size.value != 0:
2489
2341
raise gnutls.Error("error getting peer certificate")
2490
2342
if list_size.value == 0:
2493
2345
return ctypes.string_at(cert.data, cert.size)
2494
2346
2495
2347
@staticmethod
2496
def key_id(certificate):
2497
"Convert a certificate bytestring to a hexdigit key ID"
2498
# New GnuTLS "datum" with the public key
2499
datum = gnutls.datum_t(
2500
ctypes.cast(ctypes.c_char_p(certificate),
2501
ctypes.POINTER(ctypes.c_ubyte)),
2502
ctypes.c_uint(len(certificate)))
2503
# XXX all these need to be created in the gnutls "module"
2504
# New empty GnuTLS certificate
2505
pubkey = gnutls.pubkey_t()
2506
gnutls.pubkey_init(ctypes.byref(pubkey))
2507
# Import the raw public key into the certificate
2508
gnutls.pubkey_import(pubkey,
2509
ctypes.byref(datum),
2510
gnutls.X509_FMT_DER)
2511
# New buffer for the key ID
2512
buf = ctypes.create_string_buffer(32)
2513
buf_len = ctypes.c_size_t(len(buf))
2514
# Get the key ID from the raw public key into the buffer
2515
gnutls.pubkey_get_key_id(
2516
pubkey,
2517
gnutls.KEYID_USE_SHA256,
2518
ctypes.cast(ctypes.byref(buf),
2519
ctypes.POINTER(ctypes.c_ubyte)),
2520
ctypes.byref(buf_len))
2521
# Deinit the certificate
2522
gnutls.pubkey_deinit(pubkey)
2523
2524
# Convert the buffer to a Python bytestring
2525
key_id = ctypes.string_at(buf, buf_len.value)
2526
# Convert the bytestring to hexadecimal notation
2527
hex_key_id = binascii.hexlify(key_id).upper()
2528
return hex_key_id
2529
2530
@staticmethod
2531
2348
def fingerprint(openpgp):
2532
2349
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2533
2350
# New GnuTLS "datum" with the OpenPGP public key
2547
2364
ctypes.byref(crtverify))
2548
2365
if crtverify.value != 0:
2549
2366
gnutls.openpgp_crt_deinit(crt)
2550
raise gnutls.CertificateSecurityError(code
2551
=crtverify.value)
2367
raise gnutls.CertificateSecurityError("Verify failed")
2552
2368
# New buffer for the fingerprint
2553
2369
buf = ctypes.create_string_buffer(20)
2554
2370
buf_len = ctypes.c_size_t()
2564
2380
return hex_fpr
2565
2381
2566
2382
2567
class MultiprocessingMixIn:
2383
class MultiprocessingMixIn(object):
2568
2384
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2569
2385
2570
2386
def sub_process_main(self, request, address):
2582
2398
return proc
2583
2399
2584
2400
2585
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2401
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2586
2402
""" adds a pipe to the MixIn """
2587
2403
2588
2404
def process_request(self, request, client_address):
2603
2419
2604
2420
2605
2421
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2606
socketserver.TCPServer):
2607
"""IPv6-capable TCP server. Accepts None as address and/or port
2422
socketserver.TCPServer, object):
2423
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2608
2424
2609
2425
Attributes:
2610
2426
enabled: Boolean; whether this server is activated yet
2661
2477
if SO_BINDTODEVICE is None:
2662
2478
# Fall back to a hard-coded value which seems to be
2663
2479
# common enough.
2664
log.warning("SO_BINDTODEVICE not found, trying 25")
2480
logger.warning("SO_BINDTODEVICE not found, trying 25")
2665
2481
SO_BINDTODEVICE = 25
2666
2482
try:
2667
2483
self.socket.setsockopt(
2669
2485
(self.interface + "\0").encode("utf-8"))
2670
2486
except socket.error as error:
2671
2487
if error.errno == errno.EPERM:
2672
log.error("No permission to bind to interface %s",
2673
self.interface)
2488
logger.error("No permission to bind to"
2489
" interface %s", self.interface)
2674
2490
elif error.errno == errno.ENOPROTOOPT:
2675
log.error("SO_BINDTODEVICE not available; cannot"
2676
" bind to interface %s", self.interface)
2491
logger.error("SO_BINDTODEVICE not available;"
2492
" cannot bind to interface %s",
2493
self.interface)
2677
2494
elif error.errno == errno.ENODEV:
2678
log.error("Interface %s does not exist, cannot"
2679
" bind", self.interface)
2495
logger.error("Interface %s does not exist,"
2496
" cannot bind", self.interface)
2680
2497
else:
2681
2498
raise
2682
2499
# Only bind(2) the socket if we really need to.
2683
2500
if self.server_address[0] or self.server_address[1]:
2684
if self.server_address[1]:
2685
self.allow_reuse_address = True
2686
2501
if not self.server_address[0]:
2687
2502
if self.address_family == socket.AF_INET6:
2688
2503
any_address = "::" # in6addr_any
2741
2556
def add_pipe(self, parent_pipe, proc):
2742
2557
# Call "handle_ipc" for both data and EOF events
2743
2558
GLib.io_add_watch(
2744
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2745
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2559
parent_pipe.fileno(),
2560
GLib.IO_IN | GLib.IO_HUP,
2746
2561
functools.partial(self.handle_ipc,
2747
2562
parent_pipe=parent_pipe,
2748
2563
proc=proc))
2761
2576
request = parent_pipe.recv()
2762
2577
command = request[0]
2763
2578
2764
if command == "init":
2765
key_id = request[1].decode("ascii")
2766
fpr = request[2].decode("ascii")
2767
address = request[3]
2579
if command == 'init':
2580
fpr = request[1]
2581
address = request[2]
2768
2582
2769
2583
for c in self.clients.values():
2770
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2771
"27AE41E4649B934CA495991B7852B855"):
2772
continue
2773
if key_id and c.key_id == key_id:
2774
client = c
2775
break
2776
if fpr and c.fingerprint == fpr:
2584
if c.fingerprint == fpr:
2777
2585
client = c
2778
2586
break
2779
2587
else:
2780
log.info("Client not found for key ID: %s, address:"
2781
" %s", key_id or fpr, address)
2588
logger.info("Client not found for fingerprint: %s, ad"
2589
"dress: %s", fpr, address)
2782
2590
if self.use_dbus:
2783
2591
# Emit D-Bus signal
2784
mandos_dbus_service.ClientNotFound(key_id or fpr,
2592
mandos_dbus_service.ClientNotFound(fpr,
2785
2593
address[0])
2786
2594
parent_pipe.send(False)
2787
2595
return False
2788
2596
2789
2597
GLib.io_add_watch(
2790
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2791
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2598
parent_pipe.fileno(),
2599
GLib.IO_IN | GLib.IO_HUP,
2792
2600
functools.partial(self.handle_ipc,
2793
2601
parent_pipe=parent_pipe,
2794
2602
proc=proc,
2797
2605
# remove the old hook in favor of the new above hook on
2798
2606
# same fileno
2799
2607
return False
2800
if command == "funcall":
2608
if command == 'funcall':
2801
2609
funcname = request[1]
2802
2610
args = request[2]
2803
2611
kwargs = request[3]
2804
2612
2805
parent_pipe.send(("data", getattr(client_object,
2613
parent_pipe.send(('data', getattr(client_object,
2806
2614
funcname)(*args,
2807
2615
**kwargs)))
2808
2616
2809
if command == "getattr":
2617
if command == 'getattr':
2810
2618
attrname = request[1]
2811
2619
if isinstance(client_object.__getattribute__(attrname),
2812
collections.abc.Callable):
2813
parent_pipe.send(("function", ))
2620
collections.Callable):
2621
parent_pipe.send(('function', ))
2814
2622
else:
2815
2623
parent_pipe.send((
2816
"data", client_object.__getattribute__(attrname)))
2624
'data', client_object.__getattribute__(attrname)))
2817
2625
2818
if command == "setattr":
2626
if command == 'setattr':
2819
2627
attrname = request[1]
2820
2628
value = request[2]
2821
2629
setattr(client_object, attrname, value)
2826
2634
def rfc3339_duration_to_delta(duration):
2827
2635
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2828
2636
2829
>>> timedelta = datetime.timedelta
2830
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2831
True
2832
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2833
True
2834
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2835
True
2836
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2837
True
2838
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2839
True
2840
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2841
True
2842
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2843
True
2844
>>> del timedelta
2637
>>> rfc3339_duration_to_delta("P7D")
2638
datetime.timedelta(7)
2639
>>> rfc3339_duration_to_delta("PT60S")
2640
datetime.timedelta(0, 60)
2641
>>> rfc3339_duration_to_delta("PT60M")
2642
datetime.timedelta(0, 3600)
2643
>>> rfc3339_duration_to_delta("PT24H")
2644
datetime.timedelta(1)
2645
>>> rfc3339_duration_to_delta("P1W")
2646
datetime.timedelta(7)
2647
>>> rfc3339_duration_to_delta("PT5M30S")
2648
datetime.timedelta(0, 330)
2649
>>> rfc3339_duration_to_delta("P1DT3M20S")
2650
datetime.timedelta(1, 200)
2845
2651
"""
2846
2652
2847
2653
# Parsing an RFC 3339 duration with regular expressions is not
2927
2733
def string_to_delta(interval):
2928
2734
"""Parse a string and return a datetime.timedelta
2929
2735
2930
>>> string_to_delta("7d") == datetime.timedelta(7)
2931
True
2932
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2933
True
2934
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2935
True
2936
>>> string_to_delta("24h") == datetime.timedelta(1)
2937
True
2938
>>> string_to_delta("1w") == datetime.timedelta(7)
2939
True
2940
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2941
True
2736
>>> string_to_delta('7d')
2737
datetime.timedelta(7)
2738
>>> string_to_delta('60s')
2739
datetime.timedelta(0, 60)
2740
>>> string_to_delta('60m')
2741
datetime.timedelta(0, 3600)
2742
>>> string_to_delta('24h')
2743
datetime.timedelta(1)
2744
>>> string_to_delta('1w')
2745
datetime.timedelta(7)
2746
>>> string_to_delta('5m 30s')
2747
datetime.timedelta(0, 330)
2942
2748
"""
2943
2749
2944
2750
try:
3046
2852
3047
2853
options = parser.parse_args()
3048
2854
2855
if options.check:
2856
import doctest
2857
fail_count, test_count = doctest.testmod()
2858
sys.exit(os.EX_OK if fail_count == 0 else 1)
2859
3049
2860
# Default values for config file for server-global settings
3050
if gnutls.has_rawpk:
3051
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3052
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3053
else:
3054
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3055
":+SIGN-DSA-SHA256")
3056
2861
server_defaults = {"interface": "",
3057
2862
"address": "",
3058
2863
"port": "",
3059
2864
"debug": "False",
3060
"priority": priority,
2865
"priority":
2866
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2867
":+SIGN-DSA-SHA256",
3061
2868
"servicename": "Mandos",
3062
2869
"use_dbus": "True",
3063
2870
"use_ipv6": "True",
3068
2875
"foreground": "False",
3069
2876
"zeroconf": "True",
3070
2877
}
3071
del priority
3072
2878
3073
2879
# Parse config file for server-global settings
3074
server_config = configparser.ConfigParser(server_defaults)
2880
server_config = configparser.SafeConfigParser(server_defaults)
3075
2881
del server_defaults
3076
2882
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3077
# Convert the ConfigParser object to a dict
2883
# Convert the SafeConfigParser object to a dict
3078
2884
server_settings = server_config.defaults()
3079
2885
# Use the appropriate methods on the non-string config options
3080
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3081
"foreground", "zeroconf"):
2886
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3082
2887
server_settings[option] = server_config.getboolean("DEFAULT",
3083
2888
option)
3084
2889
if server_settings["port"]:
3147
2952
3148
2953
if server_settings["servicename"] != "Mandos":
3149
2954
syslogger.setFormatter(
3150
logging.Formatter("Mandos ({}) [%(process)d]:"
3151
" %(levelname)s: %(message)s".format(
2955
logging.Formatter('Mandos ({}) [%(process)d]:'
2956
' %(levelname)s: %(message)s'.format(
3152
2957
server_settings["servicename"])))
3153
2958
3154
2959
# Parse config file with clients
3155
client_config = configparser.ConfigParser(Client.client_defaults)
2960
client_config = configparser.SafeConfigParser(Client
2961
.client_defaults)
3156
2962
client_config.read(os.path.join(server_settings["configdir"],
3157
2963
"clients.conf"))
3158
2964
3178
2984
try:
3179
2985
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3180
2986
except IOError as e:
3181
log.error("Could not open file %r", pidfilename,
3182
exc_info=e)
2987
logger.error("Could not open file %r", pidfilename,
2988
exc_info=e)
3183
2989
3184
2990
for name, group in (("_mandos", "_mandos"),
3185
2991
("mandos", "mandos"),
3196
3002
try:
3197
3003
os.setgid(gid)
3198
3004
os.setuid(uid)
3199
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3005
if debug:
3006
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3007
gid))
3200
3008
except OSError as error:
3201
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3202
os.strerror(error.errno))
3009
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3010
.format(uid, gid, os.strerror(error.errno)))
3203
3011
if error.errno != errno.EPERM:
3204
3012
raise
3205
3013
3212
3020
3213
3021
@gnutls.log_func
3214
3022
def debug_gnutls(level, string):
3215
log.debug("GnuTLS: %s",
3216
string[:-1].decode("utf-8", errors="replace"))
3023
logger.debug("GnuTLS: %s", string[:-1])
3217
3024
3218
3025
gnutls.global_set_log_function(debug_gnutls)
3219
3026
3228
3035
# Close all input and output, do double fork, etc.
3229
3036
daemon()
3230
3037
3231
if gi.version_info < (3, 10, 2):
3232
# multiprocessing will use threads, so before we use GLib we
3233
# need to inform GLib that threads will be used.
3234
GLib.threads_init()
3038
# multiprocessing will use threads, so before we use GLib we need
3039
# to inform GLib that threads will be used.
3040
GLib.threads_init()
3235
3041
3236
3042
global main_loop
3237
3043
# From the Avahi example code
3248
3054
"se.bsnet.fukt.Mandos", bus,
3249
3055
do_not_queue=True)
3250
3056
except dbus.exceptions.DBusException as e:
3251
log.error("Disabling D-Bus:", exc_info=e)
3057
logger.error("Disabling D-Bus:", exc_info=e)
3252
3058
use_dbus = False
3253
3059
server_settings["use_dbus"] = False
3254
3060
tcp_server.use_dbus = False
3313
3119
if isinstance(s, bytes)
3314
3120
else s) for s in
3315
3121
value["client_structure"]]
3316
# .name, .host, and .checker_command
3317
for k in ("name", "host", "checker_command"):
3122
# .name & .host
3123
for k in ("name", "host"):
3318
3124
if isinstance(value[k], bytes):
3319
3125
value[k] = value[k].decode("utf-8")
3320
if "key_id" not in value:
3321
value["key_id"] = ""
3322
elif "fingerprint" not in value:
3323
value["fingerprint"] = ""
3324
3126
# old_client_settings
3325
3127
# .keys()
3326
3128
old_client_settings = {
3330
3132
for key, value in
3331
3133
bytes_old_client_settings.items()}
3332
3134
del bytes_old_client_settings
3333
# .host and .checker_command
3135
# .host
3334
3136
for value in old_client_settings.values():
3335
for attribute in ("host", "checker_command"):
3336
if isinstance(value[attribute], bytes):
3337
value[attribute] = (value[attribute]
3338
.decode("utf-8"))
3137
if isinstance(value["host"], bytes):
3138
value["host"] = (value["host"]
3139
.decode("utf-8"))
3339
3140
os.remove(stored_state_path)
3340
3141
except IOError as e:
3341
3142
if e.errno == errno.ENOENT:
3342
log.warning("Could not load persistent state:"
3343
" %s", os.strerror(e.errno))
3143
logger.warning("Could not load persistent state:"
3144
" {}".format(os.strerror(e.errno)))
3344
3145
else:
3345
log.critical("Could not load persistent state:",
3346
exc_info=e)
3146
logger.critical("Could not load persistent state:",
3147
exc_info=e)
3347
3148
raise
3348
3149
except EOFError as e:
3349
log.warning("Could not load persistent state: EOFError:",
3350
exc_info=e)
3150
logger.warning("Could not load persistent state: "
3151
"EOFError:",
3152
exc_info=e)
3351
3153
3352
3154
with PGPEngine() as pgp:
3353
3155
for client_name, client in clients_data.items():
3380
3182
if client["enabled"]:
3381
3183
if datetime.datetime.utcnow() >= client["expires"]:
3382
3184
if not client["last_checked_ok"]:
3383
log.warning("disabling client %s - Client"
3384
" never performed a successful"
3385
" checker", client_name)
3185
logger.warning(
3186
"disabling client {} - Client never "
3187
"performed a successful checker".format(
3188
client_name))
3386
3189
client["enabled"] = False
3387
3190
elif client["last_checker_status"] != 0:
3388
log.warning("disabling client %s - Client"
3389
" last checker failed with error"
3390
" code %s", client_name,
3391
client["last_checker_status"])
3191
logger.warning(
3192
"disabling client {} - Client last"
3193
" checker failed with error code"
3194
" {}".format(
3195
client_name,
3196
client["last_checker_status"]))
3392
3197
client["enabled"] = False
3393
3198
else:
3394
3199
client["expires"] = (
3395
3200
datetime.datetime.utcnow()
3396
3201
+ client["timeout"])
3397
log.debug("Last checker succeeded, keeping %s"
3398
" enabled", client_name)
3202
logger.debug("Last checker succeeded,"
3203
" keeping {} enabled".format(
3204
client_name))
3399
3205
try:
3400
3206
client["secret"] = pgp.decrypt(
3401
3207
client["encrypted_secret"],
3402
3208
client_settings[client_name]["secret"])
3403
3209
except PGPError:
3404
3210
# If decryption fails, we use secret from new settings
3405
log.debug("Failed to decrypt %s old secret",
3406
client_name)
3211
logger.debug("Failed to decrypt {} old secret".format(
3212
client_name))
3407
3213
client["secret"] = (client_settings[client_name]
3408
3214
["secret"])
3409
3215
3423
3229
server_settings=server_settings)
3424
3230
3425
3231
if not tcp_server.clients:
3426
log.warning("No clients defined")
3232
logger.warning("No clients defined")
3427
3233
3428
3234
if not foreground:
3429
3235
if pidfile is not None:
3432
3238
with pidfile:
3433
3239
print(pid, file=pidfile)
3434
3240
except IOError:
3435
log.error("Could not write to file %r with PID %d",
3436
pidfilename, pid)
3241
logger.error("Could not write to file %r with PID %d",
3242
pidfilename, pid)
3437
3243
del pidfile
3438
3244
del pidfilename
3439
3245
3459
3265
pass
3460
3266
3461
3267
@dbus.service.signal(_interface, signature="ss")
3462
def ClientNotFound(self, key_id, address):
3268
def ClientNotFound(self, fingerprint, address):
3463
3269
"D-Bus signal"
3464
3270
pass
3465
3271
3589
3395
3590
3396
try:
3591
3397
with tempfile.NamedTemporaryFile(
3592
mode="wb",
3398
mode='wb',
3593
3399
suffix=".pickle",
3594
prefix="clients-",
3400
prefix='clients-',
3595
3401
dir=os.path.dirname(stored_state_path),
3596
3402
delete=False) as stored_state:
3597
3403
pickle.dump((clients, client_settings), stored_state,
3605
3411
except NameError:
3606
3412
pass
3607
3413
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3608
log.warning("Could not save persistent state: %s",
3609
os.strerror(e.errno))
3414
logger.warning("Could not save persistent state: {}"
3415
.format(os.strerror(e.errno)))
3610
3416
else:
3611
log.warning("Could not save persistent state:",
3612
exc_info=e)
3417
logger.warning("Could not save persistent state:",
3418
exc_info=e)
3613
3419
raise
3614
3420
3615
3421
# Delete all clients, and settings from config
3632
3438
mandos_dbus_service.client_added_signal(client)
3633
3439
# Need to initiate checking of clients
3634
3440
if client.enabled:
3635
client.init_checker(randomize_start=True)
3441
client.init_checker()
3636
3442
3637
3443
tcp_server.enable()
3638
3444
tcp_server.server_activate()
3641
3447
if zeroconf:
3642
3448
service.port = tcp_server.socket.getsockname()[1]
3643
3449
if use_ipv6:
3644
log.info("Now listening on address %r, port %d, flowinfo %d,"
3645
" scope_id %d", *tcp_server.socket.getsockname())
3450
logger.info("Now listening on address %r, port %d,"
3451
" flowinfo %d, scope_id %d",
3452
*tcp_server.socket.getsockname())
3646
3453
else: # IPv4
3647
log.info("Now listening on address %r, port %d",
3648
*tcp_server.socket.getsockname())
3454
logger.info("Now listening on address %r, port %d",
3455
*tcp_server.socket.getsockname())
3649
3456
3650
3457
# service.interface = tcp_server.socket.getsockname()[3]
3651
3458
3655
3462
try:
3656
3463
service.activate()
3657
3464
except dbus.exceptions.DBusException as error:
3658
log.critical("D-Bus Exception", exc_info=error)
3465
logger.critical("D-Bus Exception", exc_info=error)
3659
3466
cleanup()
3660
3467
sys.exit(1)
3661
3468
# End of Avahi example code
3662
3469
3663
GLib.io_add_watch(
3664
GLib.IOChannel.unix_new(tcp_server.fileno()),
3665
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3666
lambda *args, **kwargs: (tcp_server.handle_request
3667
(*args[2:], **kwargs) or True))
3470
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3471
lambda *args, **kwargs:
3472
(tcp_server.handle_request
3473
(*args[2:], **kwargs) or True))
3668
3474
3669
log.debug("Starting main loop")
3475
logger.debug("Starting main loop")
3670
3476
main_loop.run()
3671
3477
except AvahiError as error:
3672
log.critical("Avahi Error", exc_info=error)
3478
logger.critical("Avahi Error", exc_info=error)
3673
3479
cleanup()
3674
3480
sys.exit(1)
3675
3481
except KeyboardInterrupt:
3676
3482
if debug:
3677
3483
print("", file=sys.stderr)
3678
log.debug("Server received KeyboardInterrupt")
3679
log.debug("Server exiting")
3484
logger.debug("Server received KeyboardInterrupt")
3485
logger.debug("Server exiting")
3680
3486
# Must run before the D-Bus bus name gets deregistered
3681
3487
cleanup()
3682
3488
3683
3684
def parse_test_args():
3685
# type: () -> argparse.Namespace
3686
parser = argparse.ArgumentParser(add_help=False)
3687
parser.add_argument("--check", action="store_true")
3688
parser.add_argument("--prefix", )
3689
args, unknown_args = parser.parse_known_args()
3690
if args.check:
3691
# Remove test options from sys.argv
3692
sys.argv[1:] = unknown_args
3693
return args
3694
3695
# Add all tests from doctest strings
3696
def load_tests(loader, tests, none):
3697
import doctest
3698
tests.addTests(doctest.DocTestSuite())
3699
return tests
3700
3701
if __name__ == "__main__":
3702
options = parse_test_args()
3703
try:
3704
if options.check:
3705
extra_test_prefix = options.prefix
3706
if extra_test_prefix is not None:
3707
if not (unittest.main(argv=[""], exit=False)
3708
.result.wasSuccessful()):
3709
sys.exit(1)
3710
class ExtraTestLoader(unittest.TestLoader):
3711
testMethodPrefix = extra_test_prefix
3712
# Call using ./scriptname --test [--verbose]
3713
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3714
else:
3715
unittest.main(argv=[""])
3716
else:
3717
main()
3718
finally:
3719
logging.shutdown()
3720
3721
# Local Variables:
3722
# run-tests:
3723
# (lambda (&optional extra)
3724
# (if (not (funcall run-tests-in-test-buffer default-directory
3725
# extra))
3726
# (funcall show-test-buffer-in-test-window)
3727
# (funcall remove-test-window)
3728
# (if extra (message "Extra tests run successfully!"))))
3729
# run-tests-in-test-buffer:
3730
# (lambda (dir &optional extra)
3731
# (with-current-buffer (get-buffer-create "*Test*")
3732
# (setq buffer-read-only nil
3733
# default-directory dir)
3734
# (erase-buffer)
3735
# (compilation-mode))
3736
# (let ((process-result
3737
# (let ((inhibit-read-only t))
3738
# (process-file-shell-command
3739
# (funcall get-command-line extra) nil "*Test*"))))
3740
# (and (numberp process-result)
3741
# (= process-result 0))))
3742
# get-command-line:
3743
# (lambda (&optional extra)
3744
# (let ((quoted-script
3745
# (shell-quote-argument (funcall get-script-name))))
3746
# (format
3747
# (concat "%s --check" (if extra " --prefix=atest" ""))
3748
# quoted-script)))
3749
# get-script-name:
3750
# (lambda ()
3751
# (if (fboundp 'file-local-name)
3752
# (file-local-name (buffer-file-name))
3753
# (or (file-remote-p (buffer-file-name) 'localname)
3754
# (buffer-file-name))))
3755
# remove-test-window:
3756
# (lambda ()
3757
# (let ((test-window (get-buffer-window "*Test*")))
3758
# (if test-window (delete-window test-window))))
3759
# show-test-buffer-in-test-window:
3760
# (lambda ()
3761
# (when (not (get-buffer-window-list "*Test*"))
3762
# (setq next-error-last-buffer (get-buffer "*Test*"))
3763
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3764
# (display-buffer-overriding-action
3765
# `((display-buffer-in-side-window) (side . ,side)
3766
# (window-height . fit-window-to-buffer)
3767
# (window-width . fit-window-to-buffer))))
3768
# (display-buffer "*Test*"))))
3769
# eval:
3770
# (progn
3771
# (let* ((run-extra-tests (lambda () (interactive)
3772
# (funcall run-tests t)))
3773
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3774
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3775
# (setq minor-mode-overriding-map-alist
3776
# (cons `(run-tests . ,outer-keymap)
3777
# minor-mode-overriding-map-alist)))
3778
# (add-hook 'after-save-hook run-tests 90 t))
3779
# End:
3489
3490
if __name__ == '__main__':
3491
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0