/mandos/release : revision 394

1

#!/usr/bin/python3 -bI

2

# -*- coding: utf-8; lexical-binding: t -*-

1

#!/usr/bin/python3 -b

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This file is part of Mandos.

18

#

31

#

32

# Contact the authors at <mandos@recompile.se>.

33

#

34

35

from __future__ import (division, absolute_import, print_function,

35

36

unicode_literals)

36

37

39

40

except ImportError:

40

41

pass

41

42

import sys

43

import unittest

44

import argparse

45

import logging

46

import os

47

43

try:

48

44

import SocketServer as socketserver

49

45

except ImportError:

50

46

import socketserver

51

47

import socket

48

import argparse

52

49

import datetime

53

50

import errno

54

51

try:

55

52

import ConfigParser as configparser

56

53

except ImportError:

57

54

import configparser

55

import sys

58

56

import re

57

import os

59

58

import signal

60

59

import subprocess

61

60

import atexit

62

61

import stat

62

import logging

63

import logging.handlers

64

import pwd

65

import contextlib

77

import itertools

78

import collections

79

import codecs

80

import random

81

import shlex

80

import unittest

82

81

83

82

import dbus

84

83

import dbus.service

92

91

93

92

if sys.version_info.major == 2:

94

93

__metaclass__ = type

95

str = unicode

96

input = raw_input

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Add os.set_inheritable if it does not exist

114

try:

115

os.set_inheritable

116

except AttributeError:

117

def set_inheritable(fd, inheritable):

118

flags = fcntl.fcntl(fd, fcntl.F_GETFD)

119

if inheritable and ((flags & fcntl.FD_CLOEXEC) != 0):

120

fcntl.fcntl(fd, fcntl.F_SETFL, flags & ~fcntl.FD_CLOEXEC)

121

elif (not inheritable) and ((flags & fcntl.FD_CLOEXEC) == 0):

122

fcntl.fcntl(fd, fcntl.F_SETFL, flags | fcntl.FD_CLOEXEC)

123

os.set_inheritable = set_inheritable

124

del set_inheritable

125

94

126

95

# Show warnings by default

127

96

if not sys.warnoptions:

153

122

# No value found

154

123

SO_BINDTODEVICE = None

155

124

125

if sys.version_info.major == 2:

126

str = unicode

127

156

128

if sys.version_info < (3, 2):

157

129

configparser.Configparser = configparser.SafeConfigParser

158

130

159

version = "1.8.18"

131

version = "1.8.9"

160

132

stored_state_file = "clients.pickle"

161

133

162

log = logging.getLogger(os.path.basename(sys.argv[0]))

134

logger = logging.getLogger()

163

135

logging.captureWarnings(True) # Show warnings via the logging system

164

136

syslogger = None

165

137

202

174

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

203

175

address="/dev/log"))

204

176

syslogger.setFormatter(logging.Formatter

205

("Mandos [%(process)d]: %(levelname)s:"

206

" %(message)s"))

207

log.addHandler(syslogger)

177

('Mandos [%(process)d]: %(levelname)s:'

178

' %(message)s'))

179

logger.addHandler(syslogger)

208

180

209

181

if debug:

210

182

console = logging.StreamHandler()

211

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

212

" [%(process)d]:"

213

" %(levelname)s:"

214

" %(message)s"))

215

log.addHandler(console)

216

log.setLevel(level)

183

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

184

' [%(process)d]:'

185

' %(levelname)s:'

186

' %(message)s'))

187

logger.addHandler(console)

188

logger.setLevel(level)

217

189

218

190

219

191

class PGPError(Exception):

237

209

except OSError as e:

238

210

if e.errno != errno.ENOENT:

239

211

raise

240

self.gnupgargs = ["--batch",

241

"--homedir", self.tempdir,

242

"--force-mdc",

243

"--quiet"]

212

self.gnupgargs = ['--batch',

213

'--homedir', self.tempdir,

214

'--force-mdc',

215

'--quiet']

244

216

# Only GPG version 1 has the --no-use-agent option.

245

217

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

246

218

self.gnupgargs.append("--no-use-agent")

285

257

dir=self.tempdir) as passfile:

286

258

passfile.write(passphrase)

287

259

passfile.flush()

288

proc = subprocess.Popen([self.gpg, "--symmetric",

289

"--passphrase-file",

260

proc = subprocess.Popen([self.gpg, '--symmetric',

261

'--passphrase-file',

290

262

passfile.name]

291

263

+ self.gnupgargs,

292

264

stdin=subprocess.PIPE,

303

275

dir=self.tempdir) as passfile:

304

276

passfile.write(passphrase)

305

277

passfile.flush()

306

proc = subprocess.Popen([self.gpg, "--decrypt",

307

"--passphrase-file",

278

proc = subprocess.Popen([self.gpg, '--decrypt',

279

'--passphrase-file',

308

280

passfile.name]

309

281

+ self.gnupgargs,

310

282

stdin=subprocess.PIPE,

363

335

Attributes:

364

336

interface: integer; avahi.IF_UNSPEC or an interface index.

365

337

Used to optionally bind to the specified interface.

366

name: string; Example: "Mandos"

367

type: string; Example: "_mandos._tcp".

338

name: string; Example: 'Mandos'

339

type: string; Example: '_mandos._tcp'.

368

340

See <https://www.iana.org/assignments/service-names-port-numbers>

369

341

port: integer; what port to announce

370

342

TXT: list of strings; TXT record for the service

407

379

def rename(self, remove=True):

408

380

"""Derived from the Avahi example code"""

409

381

if self.rename_count >= self.max_renames:

410

log.critical("No suitable Zeroconf service name found"

411

" after %i retries, exiting.",

412

self.rename_count)

382

logger.critical("No suitable Zeroconf service name found"

383

" after %i retries, exiting.",

384

self.rename_count)

413

385

raise AvahiServiceError("Too many renames")

414

386

self.name = str(

415

387

self.server.GetAlternativeServiceName(self.name))

416

388

self.rename_count += 1

417

log.info("Changing Zeroconf service name to %r ...",

418

self.name)

389

logger.info("Changing Zeroconf service name to %r ...",

390

self.name)

419

391

if remove:

420

392

self.remove()

421

393

try:

423

395

except dbus.exceptions.DBusException as error:

424

396

if (error.get_dbus_name()

425

397

== "org.freedesktop.Avahi.CollisionError"):

426

log.info("Local Zeroconf service name collision.")

398

logger.info("Local Zeroconf service name collision.")

427

399

return self.rename(remove=False)

428

400

else:

429

log.critical("D-Bus Exception", exc_info=error)

401

logger.critical("D-Bus Exception", exc_info=error)

430

402

self.cleanup()

431

403

os._exit(1)

432

404

448

420

avahi.DBUS_INTERFACE_ENTRY_GROUP)

449

421

self.entry_group_state_changed_match = (

450

422

self.group.connect_to_signal(

451

"StateChanged", self.entry_group_state_changed))

452

log.debug("Adding Zeroconf service '%s' of type '%s' ...",

453

self.name, self.type)

423

'StateChanged', self.entry_group_state_changed))

424

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

425

self.name, self.type)

454

426

self.group.AddService(

455

427

self.interface,

456

428

self.protocol,

463

435

464

436

def entry_group_state_changed(self, state, error):

465

437

"""Derived from the Avahi example code"""

466

log.debug("Avahi entry group state change: %i", state)

438

logger.debug("Avahi entry group state change: %i", state)

467

439

468

440

if state == avahi.ENTRY_GROUP_ESTABLISHED:

469

log.debug("Zeroconf service established.")

441

logger.debug("Zeroconf service established.")

470

442

elif state == avahi.ENTRY_GROUP_COLLISION:

471

log.info("Zeroconf service name collision.")

443

logger.info("Zeroconf service name collision.")

472

444

self.rename()

473

445

elif state == avahi.ENTRY_GROUP_FAILURE:

474

log.critical("Avahi: Error in group state changed %s",

475

str(error))

446

logger.critical("Avahi: Error in group state changed %s",

447

str(error))

476

448

raise AvahiGroupError("State changed: {!s}".format(error))

477

449

478

450

def cleanup(self):

488

460

489

461

def server_state_changed(self, state, error=None):

490

462

"""Derived from the Avahi example code"""

491

log.debug("Avahi server state change: %i", state)

463

logger.debug("Avahi server state change: %i", state)

492

464

bad_states = {

493

465

avahi.SERVER_INVALID: "Zeroconf server invalid",

494

466

avahi.SERVER_REGISTERING: None,

498

470

if state in bad_states:

499

471

if bad_states[state] is not None:

500

472

if error is None:

501

log.error(bad_states[state])

473

logger.error(bad_states[state])

502

474

else:

503

log.error(bad_states[state] + ": %r", error)

475

logger.error(bad_states[state] + ": %r", error)

504

476

self.cleanup()

505

477

elif state == avahi.SERVER_RUNNING:

506

478

try:

508

480

except dbus.exceptions.DBusException as error:

509

481

if (error.get_dbus_name()

510

482

== "org.freedesktop.Avahi.CollisionError"):

511

log.info("Local Zeroconf service name collision.")

483

logger.info("Local Zeroconf service name"

484

" collision.")

512

485

return self.rename(remove=False)

513

486

else:

514

log.critical("D-Bus Exception", exc_info=error)

487

logger.critical("D-Bus Exception", exc_info=error)

515

488

self.cleanup()

516

489

os._exit(1)

517

490

else:

518

491

if error is None:

519

log.debug("Unknown state: %r", state)

492

logger.debug("Unknown state: %r", state)

520

493

else:

521

log.debug("Unknown state: %r: %r", state, error)

494

logger.debug("Unknown state: %r: %r", state, error)

522

495

523

496

def activate(self):

524

497

"""Derived from the Avahi example code"""

536

509

class AvahiServiceToSyslog(AvahiService):

537

510

def rename(self, *args, **kwargs):

538

511

"""Add the new name to the syslog messages"""

539

ret = super(AvahiServiceToSyslog, self).rename(*args,

540

**kwargs)

512

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

541

513

syslogger.setFormatter(logging.Formatter(

542

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

514

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

543

515

.format(self.name)))

544

516

return ret

545

517

575

547

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

576

548

577

549

# Types

578

class _session_int(ctypes.Structure):

550

class session_int(ctypes.Structure):

579

551

_fields_ = []

580

session_t = ctypes.POINTER(_session_int)

552

session_t = ctypes.POINTER(session_int)

581

553

582

554

class certificate_credentials_st(ctypes.Structure):

583

555

_fields_ = []

586

558

certificate_type_t = ctypes.c_int

587

559

588

560

class datum_t(ctypes.Structure):

589

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

590

("size", ctypes.c_uint)]

561

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

562

('size', ctypes.c_uint)]

591

563

592

class _openpgp_crt_int(ctypes.Structure):

564

class openpgp_crt_int(ctypes.Structure):

593

565

_fields_ = []

594

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

566

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

595

567

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

596

568

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

597

569

credentials_type_t = ctypes.c_int

606

578

# gnutls.strerror()

607

579

self.code = code

608

580

if message is None and code is not None:

609

message = gnutls.strerror(code).decode(

610

"utf-8", errors="replace")

581

message = gnutls.strerror(code)

611

582

return super(gnutls.Error, self).__init__(

612

583

message, *args)

613

584

614

585

class CertificateSecurityError(Error):

615

586

pass

616

587

617

class PointerTo:

618

def __init__(self, cls):

619

self.cls = cls

620

621

def from_param(self, obj):

622

if not isinstance(obj, self.cls):

623

raise TypeError("Not of type {}: {!r}"

624

.format(self.cls.__name__, obj))

625

return ctypes.byref(obj.from_param(obj))

626

627

class CastToVoidPointer:

628

def __init__(self, cls):

629

self.cls = cls

630

631

def from_param(self, obj):

632

if not isinstance(obj, self.cls):

633

raise TypeError("Not of type {}: {!r}"

634

.format(self.cls.__name__, obj))

635

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

636

637

class With_from_param:

638

@classmethod

639

def from_param(cls, obj):

640

return obj._as_parameter_

641

642

588

# Classes

643

class Credentials(With_from_param):

589

class Credentials:

644

590

def __init__(self):

645

self._as_parameter_ = gnutls.certificate_credentials_t()

646

gnutls.certificate_allocate_credentials(self)

591

self._c_object = gnutls.certificate_credentials_t()

592

gnutls.certificate_allocate_credentials(

593

ctypes.byref(self._c_object))

647

594

self.type = gnutls.CRD_CERTIFICATE

648

595

649

596

def __del__(self):

650

gnutls.certificate_free_credentials(self)

597

gnutls.certificate_free_credentials(self._c_object)

651

598

652

class ClientSession(With_from_param):

599

class ClientSession:

653

600

def __init__(self, socket, credentials=None):

654

self._as_parameter_ = gnutls.session_t()

601

self._c_object = gnutls.session_t()

655

602

gnutls_flags = gnutls.CLIENT

656

603

if gnutls.check_version(b"3.5.6"):

657

604

gnutls_flags |= gnutls.NO_TICKETS

658

605

if gnutls.has_rawpk:

659

606

gnutls_flags |= gnutls.ENABLE_RAWPK

660

gnutls.init(self, gnutls_flags)

607

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

661

608

del gnutls_flags

662

gnutls.set_default_priority(self)

663

gnutls.transport_set_ptr(self, socket.fileno())

664

gnutls.handshake_set_private_extensions(self, True)

609

gnutls.set_default_priority(self._c_object)

610

gnutls.transport_set_ptr(self._c_object, socket.fileno())

611

gnutls.handshake_set_private_extensions(self._c_object,

612

True)

665

613

self.socket = socket

666

614

if credentials is None:

667

615

credentials = gnutls.Credentials()

668

gnutls.credentials_set(self, credentials.type,

669

credentials)

616

gnutls.credentials_set(self._c_object, credentials.type,

617

ctypes.cast(credentials._c_object,

618

ctypes.c_void_p))

670

619

self.credentials = credentials

671

620

672

621

def __del__(self):

673

gnutls.deinit(self)

622

gnutls.deinit(self._c_object)

674

623

675

624

def handshake(self):

676

return gnutls.handshake(self)

625

return gnutls.handshake(self._c_object)

677

626

678

627

def send(self, data):

679

628

data = bytes(data)

680

629

data_len = len(data)

681

630

while data_len > 0:

682

data_len -= gnutls.record_send(self, data[-data_len:],

631

data_len -= gnutls.record_send(self._c_object,

632

data[-data_len:],

683

633

data_len)

684

634

685

635

def bye(self):

686

return gnutls.bye(self, gnutls.SHUT_RDWR)

636

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

687

637

688

638

# Error handling functions

689

639

def _error_code(result):

690

640

"""A function to raise exceptions on errors, suitable

691

for the "restype" attribute on ctypes functions"""

692

if result >= gnutls.E_SUCCESS:

641

for the 'restype' attribute on ctypes functions"""

642

if result >= 0:

693

643

return result

694

644

if result == gnutls.E_NO_CERTIFICATE_FOUND:

695

645

raise gnutls.CertificateSecurityError(code=result)

696

646

raise gnutls.Error(code=result)

697

647

698

def _retry_on_error(result, func, arguments,

699

_error_code=_error_code):

648

def _retry_on_error(result, func, arguments):

700

649

"""A function to retry on some errors, suitable

701

for the "errcheck" attribute on ctypes functions"""

702

while result < gnutls.E_SUCCESS:

650

for the 'errcheck' attribute on ctypes functions"""

651

while result < 0:

703

652

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

704

653

return _error_code(result)

705

654

result = func(*arguments)

710

659

711

660

# Functions

712

661

priority_set_direct = _library.gnutls_priority_set_direct

713

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

662

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

714

663

ctypes.POINTER(ctypes.c_char_p)]

715

664

priority_set_direct.restype = _error_code

716

665

717

666

init = _library.gnutls_init

718

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

667

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

719

668

init.restype = _error_code

720

669

721

670

set_default_priority = _library.gnutls_set_default_priority

722

set_default_priority.argtypes = [ClientSession]

671

set_default_priority.argtypes = [session_t]

723

672

set_default_priority.restype = _error_code

724

673

725

674

record_send = _library.gnutls_record_send

726

record_send.argtypes = [ClientSession, ctypes.c_void_p,

675

record_send.argtypes = [session_t, ctypes.c_void_p,

727

676

ctypes.c_size_t]

728

677

record_send.restype = ctypes.c_ssize_t

729

678

record_send.errcheck = _retry_on_error

731

680

certificate_allocate_credentials = (

732

681

_library.gnutls_certificate_allocate_credentials)

733

682

certificate_allocate_credentials.argtypes = [

734

PointerTo(Credentials)]

683

ctypes.POINTER(certificate_credentials_t)]

735

684

certificate_allocate_credentials.restype = _error_code

736

685

737

686

certificate_free_credentials = (

738

687

_library.gnutls_certificate_free_credentials)

739

certificate_free_credentials.argtypes = [Credentials]

688

certificate_free_credentials.argtypes = [

689

certificate_credentials_t]

740

690

certificate_free_credentials.restype = None

741

691

742

692

handshake_set_private_extensions = (

743

693

_library.gnutls_handshake_set_private_extensions)

744

handshake_set_private_extensions.argtypes = [ClientSession,

694

handshake_set_private_extensions.argtypes = [session_t,

745

695

ctypes.c_int]

746

696

handshake_set_private_extensions.restype = None

747

697

748

698

credentials_set = _library.gnutls_credentials_set

749

credentials_set.argtypes = [ClientSession, credentials_type_t,

750

CastToVoidPointer(Credentials)]

699

credentials_set.argtypes = [session_t, credentials_type_t,

700

ctypes.c_void_p]

751

701

credentials_set.restype = _error_code

752

702

753

703

strerror = _library.gnutls_strerror

755

705

strerror.restype = ctypes.c_char_p

756

706

757

707

certificate_type_get = _library.gnutls_certificate_type_get

758

certificate_type_get.argtypes = [ClientSession]

708

certificate_type_get.argtypes = [session_t]

759

709

certificate_type_get.restype = _error_code

760

710

761

711

certificate_get_peers = _library.gnutls_certificate_get_peers

762

certificate_get_peers.argtypes = [ClientSession,

712

certificate_get_peers.argtypes = [session_t,

763

713

ctypes.POINTER(ctypes.c_uint)]

764

714

certificate_get_peers.restype = ctypes.POINTER(datum_t)

765

715

772

722

global_set_log_function.restype = None

773

723

774

724

deinit = _library.gnutls_deinit

775

deinit.argtypes = [ClientSession]

725

deinit.argtypes = [session_t]

776

726

deinit.restype = None

777

727

778

728

handshake = _library.gnutls_handshake

779

handshake.argtypes = [ClientSession]

780

handshake.restype = ctypes.c_int

729

handshake.argtypes = [session_t]

730

handshake.restype = _error_code

781

731

handshake.errcheck = _retry_on_error

782

732

783

733

transport_set_ptr = _library.gnutls_transport_set_ptr

784

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

734

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

785

735

transport_set_ptr.restype = None

786

736

787

737

bye = _library.gnutls_bye

788

bye.argtypes = [ClientSession, close_request_t]

789

bye.restype = ctypes.c_int

738

bye.argtypes = [session_t, close_request_t]

739

bye.restype = _error_code

790

740

bye.errcheck = _retry_on_error

791

741

792

742

check_version = _library.gnutls_check_version

809

759

810

760

x509_crt_fmt_t = ctypes.c_int

811

761

812

# All the function declarations below are from

813

# gnutls/abstract.h

762

# All the function declarations below are from gnutls/abstract.h

814

763

pubkey_init = _library.gnutls_pubkey_init

815

764

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

816

765

pubkey_init.restype = _error_code

830

779

pubkey_deinit.argtypes = [pubkey_t]

831

780

pubkey_deinit.restype = None

832

781

else:

833

# All the function declarations below are from

834

# gnutls/openpgp.h

782

# All the function declarations below are from gnutls/openpgp.h

835

783

836

784

openpgp_crt_init = _library.gnutls_openpgp_crt_init

837

785

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

843

791

openpgp_crt_fmt_t]

844

792

openpgp_crt_import.restype = _error_code

845

793

846

openpgp_crt_verify_self = \

847

_library.gnutls_openpgp_crt_verify_self

848

openpgp_crt_verify_self.argtypes = [

849

openpgp_crt_t,

850

ctypes.c_uint,

851

ctypes.POINTER(ctypes.c_uint),

852

]

794

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

795

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

796

ctypes.POINTER(ctypes.c_uint)]

853

797

openpgp_crt_verify_self.restype = _error_code

854

798

855

799

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

866

810

867

811

if check_version(b"3.6.4"):

868

812

certificate_type_get2 = _library.gnutls_certificate_type_get2

869

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

813

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

870

814

certificate_type_get2.restype = _error_code

871

815

872

816

# Remove non-public functions

888

832

"""A representation of a client host served by this server.

889

833

890

834

Attributes:

891

approved: bool(); None if not yet approved/disapproved

835

approved: bool(); 'None' if not yet approved/disapproved

892

836

approval_delay: datetime.timedelta(); Time to wait for approval

893

837

approval_duration: datetime.timedelta(); Duration of one approval

894

838

checker: multiprocessing.Process(); a running checker process used

895

to see if the client lives. None if no process is

839

to see if the client lives. 'None' if no process is

896

840

running.

897

841

checker_callback_tag: a GLib event source tag, or None

898

842

checker_command: string; External command which is run to check

974

918

# key_id() and fingerprint() functions

975

919

client["key_id"] = (section.get("key_id", "").upper()

976

920

.replace(" ", ""))

977

client["fingerprint"] = (section.get("fingerprint",

978

"").upper()

921

client["fingerprint"] = (section["fingerprint"].upper()

979

922

.replace(" ", ""))

980

if not (client["key_id"] or client["fingerprint"]):

981

log.error("Skipping client %s without key_id or"

982

" fingerprint", client_name)

983

del settings[client_name]

984

continue

985

923

if "secret" in section:

986

924

client["secret"] = codecs.decode(section["secret"]

987

925

.encode("utf-8"),

1028

966

self.last_enabled = None

1029

967

self.expires = None

1030

968

1031

log.debug("Creating client %r", self.name)

1032

log.debug(" Key ID: %s", self.key_id)

1033

log.debug(" Fingerprint: %s", self.fingerprint)

969

logger.debug("Creating client %r", self.name)

970

logger.debug(" Key ID: %s", self.key_id)

971

logger.debug(" Fingerprint: %s", self.fingerprint)

1034

972

self.created = settings.get("created",

1035

973

datetime.datetime.utcnow())

1036

974

1064

1002

if getattr(self, "enabled", False):

1065

1003

# Already enabled

1066

1004

return

1005

self.expires = datetime.datetime.utcnow() + self.timeout

1067

1006

self.enabled = True

1068

1007

self.last_enabled = datetime.datetime.utcnow()

1069

1008

self.init_checker()

1074

1013

if not getattr(self, "enabled", False):

1075

1014

return False

1076

1015

if not quiet:

1077

log.info("Disabling client %s", self.name)

1016

logger.info("Disabling client %s", self.name)

1078

1017

if getattr(self, "disable_initiator_tag", None) is not None:

1079

1018

GLib.source_remove(self.disable_initiator_tag)

1080

1019

self.disable_initiator_tag = None

1092

1031

def __del__(self):

1093

1032

self.disable()

1094

1033

1095

def init_checker(self, randomize_start=False):

1096

# Schedule a new checker to be started a randomly selected

1097

# time (a fraction of 'interval') from now. This spreads out

1098

# the startup of checkers over time when the server is

1099

# started.

1034

def init_checker(self):

1035

# Schedule a new checker to be started an 'interval' from now,

1036

# and every interval from then on.

1100

1037

if self.checker_initiator_tag is not None:

1101

1038

GLib.source_remove(self.checker_initiator_tag)

1102

interval_milliseconds = int(self.interval.total_seconds()

1103

* 1000)

1104

if randomize_start:

1105

delay_milliseconds = random.randrange(

1106

interval_milliseconds + 1)

1107

else:

1108

delay_milliseconds = interval_milliseconds

1109

1039

self.checker_initiator_tag = GLib.timeout_add(

1110

delay_milliseconds, self.start_checker, randomize_start)

1111

delay = datetime.timedelta(0, 0, 0, delay_milliseconds)

1112

# A checker might take up to an 'interval' of time, so we can

1113

# expire at the soonest one interval after a checker was

1114

# started. Since the initial checker is delayed, the expire

1115

# time might have to be extended.

1116

now = datetime.datetime.utcnow()

1117

self.expires = now + delay + self.interval

1118

# Schedule a disable() at expire time

1040

int(self.interval.total_seconds() * 1000),

1041

self.start_checker)

1042

# Schedule a disable() when 'timeout' has passed

1119

1043

if self.disable_initiator_tag is not None:

1120

1044

GLib.source_remove(self.disable_initiator_tag)

1121

1045

self.disable_initiator_tag = GLib.timeout_add(

1122

int((self.expires - now).total_seconds() * 1000),

1123

self.disable)

1046

int(self.timeout.total_seconds() * 1000), self.disable)

1047

# Also start a new checker *right now*.

1048

self.start_checker()

1124

1049

1125

1050

def checker_callback(self, source, condition, connection,

1126

1051

command):

1137

1062

self.last_checker_status = returncode

1138

1063

self.last_checker_signal = None

1139

1064

if self.last_checker_status == 0:

1140

log.info("Checker for %(name)s succeeded", vars(self))

1065

logger.info("Checker for %(name)s succeeded",

1066

vars(self))

1141

1067

self.checked_ok()

1142

1068

else:

1143

log.info("Checker for %(name)s failed", vars(self))

1069

logger.info("Checker for %(name)s failed", vars(self))

1144

1070

else:

1145

1071

self.last_checker_status = -1

1146

1072

self.last_checker_signal = -returncode

1147

log.warning("Checker for %(name)s crashed?", vars(self))

1073

logger.warning("Checker for %(name)s crashed?",

1074

vars(self))

1148

1075

return False

1149

1076

1150

1077

def checked_ok(self):

1169

1096

def need_approval(self):

1170

1097

self.last_approval_request = datetime.datetime.utcnow()

1171

1098

1172

def start_checker(self, start_was_randomized=False):

1099

def start_checker(self):

1173

1100

"""Start a new checker subprocess if one is not running.

1174

1101

1175

1102

If a checker already exists, leave it running and do

1184

1111

# should be.

1185

1112

1186

1113

if self.checker is not None and not self.checker.is_alive():

1187

log.warning("Checker was not alive; joining")

1114

logger.warning("Checker was not alive; joining")

1188

1115

self.checker.join()

1189

1116

self.checker = None

1190

1117

# Start a new checker if needed

1191

1118

if self.checker is None:

1192

1119

# Escape attributes for the shell

1193

1120

escaped_attrs = {

1194

attr: shlex.quote(str(getattr(self, attr)))

1121

attr: re.escape(str(getattr(self, attr)))

1195

1122

for attr in self.runtime_expansions}

1196

1123

try:

1197

1124

command = self.checker_command % escaped_attrs

1198

1125

except TypeError as error:

1199

log.error('Could not format string "%s"',

1200

self.checker_command, exc_info=error)

1126

logger.error('Could not format string "%s"',

1127

self.checker_command,

1128

exc_info=error)

1201

1129

return True # Try again later

1202

1130

self.current_checker_command = command

1203

log.info("Starting checker %r for %s", command, self.name)

1131

logger.info("Starting checker %r for %s", command,

1132

self.name)

1204

1133

# We don't need to redirect stdout and stderr, since

1205

1134

# in normal mode, that is already done by daemon(),

1206

1135

# and in debug mode we don't want to. (Stdin is

1225

1154

GLib.IOChannel.unix_new(pipe[0].fileno()),

1226

1155

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1227

1156

self.checker_callback, pipe[0], command)

1228

if start_was_randomized:

1229

# We were started after a random delay; Schedule a new

1230

# checker to be started an 'interval' from now, and every

1231

# interval from then on.

1232

now = datetime.datetime.utcnow()

1233

self.checker_initiator_tag = GLib.timeout_add(

1234

int(self.interval.total_seconds() * 1000),

1235

self.start_checker)

1236

self.expires = max(self.expires, now + self.interval)

1237

# Don't start a new checker again after same random delay

1238

return False

1239

1157

# Re-run this periodically if run by GLib.timeout_add

1240

1158

return True

1241

1159

1246

1164

self.checker_callback_tag = None

1247

1165

if getattr(self, "checker", None) is None:

1248

1166

return

1249

log.debug("Stopping checker for %(name)s", vars(self))

1167

logger.debug("Stopping checker for %(name)s", vars(self))

1250

1168

self.checker.terminate()

1251

1169

self.checker = None

1252

1170

1279

1197

func._dbus_name = func.__name__

1280

1198

if func._dbus_name.endswith("_dbus_property"):

1281

1199

func._dbus_name = func._dbus_name[:-14]

1282

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

1200

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1283

1201

return func

1284

1202

1285

1203

return decorator

1374

1292

1375

1293

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1376

1294

out_signature="s",

1377

path_keyword="object_path",

1378

connection_keyword="connection")

1295

path_keyword='object_path',

1296

connection_keyword='connection')

1379

1297

def Introspect(self, object_path, connection):

1380

1298

"""Overloading of standard D-Bus method.

1381

1299

1430

1348

document.unlink()

1431

1349

except (AttributeError, xml.dom.DOMException,

1432

1350

xml.parsers.expat.ExpatError) as error:

1433

log.error("Failed to override Introspection method",

1434

exc_info=error)

1351

logger.error("Failed to override Introspection method",

1352

exc_info=error)

1435

1353

return xmlstring

1436

1354

1437

1355

1495

1413

raise ValueError("Byte arrays not supported for non-"

1496

1414

"'ay' signature {!r}"

1497

1415

.format(prop._dbus_signature))

1498

value = dbus.ByteArray(bytes(value))

1416

value = dbus.ByteArray(b''.join(chr(byte)

1417

for byte in value))

1499

1418

prop(value)

1500

1419

1501

1420

@dbus.service.method(dbus.PROPERTIES_IFACE,

1534

1453

1535

1454

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1536

1455

out_signature="s",

1537

path_keyword="object_path",

1538

connection_keyword="connection")

1456

path_keyword='object_path',

1457

connection_keyword='connection')

1539

1458

def Introspect(self, object_path, connection):

1540

1459

"""Overloading of standard D-Bus method.

1541

1460

1597

1516

document.unlink()

1598

1517

except (AttributeError, xml.dom.DOMException,

1599

1518

xml.parsers.expat.ExpatError) as error:

1600

log.error("Failed to override Introspection method",

1601

exc_info=error)

1519

logger.error("Failed to override Introspection method",

1520

exc_info=error)

1602

1521

return xmlstring

1603

1522

1604

1523

1636

1555

1637

1556

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1638

1557

out_signature="s",

1639

path_keyword="object_path",

1640

connection_keyword="connection")

1558

path_keyword='object_path',

1559

connection_keyword='connection')

1641

1560

def Introspect(self, object_path, connection):

1642

1561

"""Overloading of standard D-Bus method.

1643

1562

1668

1587

document.unlink()

1669

1588

except (AttributeError, xml.dom.DOMException,

1670

1589

xml.parsers.expat.ExpatError) as error:

1671

log.error("Failed to override Introspection method",

1672

exc_info=error)

1590

logger.error("Failed to override Introspection method",

1591

exc_info=error)

1673

1592

return xmlstring

1674

1593

1675

1594

2309

2228

class ProxyClient:

2310

2229

def __init__(self, child_pipe, key_id, fpr, address):

2311

2230

self._pipe = child_pipe

2312

self._pipe.send(("init", key_id, fpr, address))

2231

self._pipe.send(('init', key_id, fpr, address))

2313

2232

if not self._pipe.recv():

2314

2233

raise KeyError(key_id or fpr)

2315

2234

2316

2235

def __getattribute__(self, name):

2317

if name == "_pipe":

2236

if name == '_pipe':

2318

2237

return super(ProxyClient, self).__getattribute__(name)

2319

self._pipe.send(("getattr", name))

2238

self._pipe.send(('getattr', name))

2320

2239

data = self._pipe.recv()

2321

if data[0] == "data":

2240

if data[0] == 'data':

2322

2241

return data[1]

2323

if data[0] == "function":

2242

if data[0] == 'function':

2324

2243

2325

2244

def func(*args, **kwargs):

2326

self._pipe.send(("funcall", name, args, kwargs))

2245

self._pipe.send(('funcall', name, args, kwargs))

2327

2246

return self._pipe.recv()[1]

2328

2247

2329

2248

return func

2330

2249

2331

2250

def __setattr__(self, name, value):

2332

if name == "_pipe":

2251

if name == '_pipe':

2333

2252

return super(ProxyClient, self).__setattr__(name, value)

2334

self._pipe.send(("setattr", name, value))

2253

self._pipe.send(('setattr', name, value))

2335

2254

2336

2255

2337

2256

class ClientHandler(socketserver.BaseRequestHandler, object):

2342

2261

2343

2262

def handle(self):

2344

2263

with contextlib.closing(self.server.child_pipe) as child_pipe:

2345

log.info("TCP connection from: %s",

2346

str(self.client_address))

2347

log.debug("Pipe FD: %d", self.server.child_pipe.fileno())

2264

logger.info("TCP connection from: %s",

2265

str(self.client_address))

2266

logger.debug("Pipe FD: %d",

2267

self.server.child_pipe.fileno())

2348

2268

2349

2269

session = gnutls.ClientSession(self.request)

2350

2270

2351

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2271

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2352

2272

# "+AES-256-CBC", "+SHA1",

2353

2273

# "+COMP-NULL", "+CTYPE-OPENPGP",

2354

2274

# "+DHE-DSS"))

2356

2276

priority = self.server.gnutls_priority

2357

2277

if priority is None:

2358

2278

priority = "NORMAL"

2359

gnutls.priority_set_direct(session,

2360

priority.encode("utf-8"), None)

2279

gnutls.priority_set_direct(session._c_object,

2280

priority.encode("utf-8"),

2281

None)

2361

2282

2362

2283

# Start communication using the Mandos protocol

2363

2284

# Get protocol number

2364

2285

line = self.request.makefile().readline()

2365

log.debug("Protocol version: %r", line)

2286

logger.debug("Protocol version: %r", line)

2366

2287

try:

2367

2288

if int(line.strip().split()[0]) > 1:

2368

2289

raise RuntimeError(line)

2369

2290

except (ValueError, IndexError, RuntimeError) as error:

2370

log.error("Unknown protocol version: %s", error)

2291

logger.error("Unknown protocol version: %s", error)

2371

2292

return

2372

2293

2373

2294

# Start GnuTLS connection

2374

2295

try:

2375

2296

session.handshake()

2376

2297

except gnutls.Error as error:

2377

log.warning("Handshake failed: %s", error)

2298

logger.warning("Handshake failed: %s", error)

2378

2299

# Do not run session.bye() here: the session is not

2379

2300

# established. Just abandon the request.

2380

2301

return

2381

log.debug("Handshake succeeded")

2302

logger.debug("Handshake succeeded")

2382

2303

2383

2304

approval_required = False

2384

2305

try:

2388

2309

key_id = self.key_id(

2389

2310

self.peer_certificate(session))

2390

2311

except (TypeError, gnutls.Error) as error:

2391

log.warning("Bad certificate: %s", error)

2312

logger.warning("Bad certificate: %s", error)

2392

2313

return

2393

log.debug("Key ID: %s",

2394

key_id.decode("utf-8",

2395

errors="replace"))

2314

logger.debug("Key ID: %s", key_id)

2396

2315

2397

2316

else:

2398

2317

key_id = b""

2400

2319

fpr = self.fingerprint(

2401

2320

self.peer_certificate(session))

2402

2321

except (TypeError, gnutls.Error) as error:

2403

log.warning("Bad certificate: %s", error)

2322

logger.warning("Bad certificate: %s", error)

2404

2323

return

2405

log.debug("Fingerprint: %s", fpr)

2324

logger.debug("Fingerprint: %s", fpr)

2406

2325

2407

2326

try:

2408

2327

client = ProxyClient(child_pipe, key_id, fpr,

2417

2336

2418

2337

while True:

2419

2338

if not client.enabled:

2420

log.info("Client %s is disabled", client.name)

2339

logger.info("Client %s is disabled",

2340

client.name)

2421

2341

if self.server.use_dbus:

2422

2342

# Emit D-Bus signal

2423

2343

client.Rejected("Disabled")

2427

2347

# We are approved or approval is disabled

2428

2348

break

2429

2349

elif client.approved is None:

2430

log.info("Client %s needs approval",

2431

client.name)

2350

logger.info("Client %s needs approval",

2351

client.name)

2432

2352

if self.server.use_dbus:

2433

2353

# Emit D-Bus signal

2434

2354

client.NeedApproval(

2435

2355

client.approval_delay.total_seconds()

2436

2356

* 1000, client.approved_by_default)

2437

2357

else:

2438

log.warning("Client %s was not approved",

2439

client.name)

2358

logger.warning("Client %s was not approved",

2359

client.name)

2440

2360

if self.server.use_dbus:

2441

2361

# Emit D-Bus signal

2442

2362

client.Rejected("Denied")

2450

2370

time2 = datetime.datetime.now()

2451

2371

if (time2 - time) >= delay:

2452

2372

if not client.approved_by_default:

2453

log.warning("Client %s timed out while"

2454

" waiting for approval",

2455

client.name)

2373

logger.warning("Client %s timed out while"

2374

" waiting for approval",

2375

client.name)

2456

2376

if self.server.use_dbus:

2457

2377

# Emit D-Bus signal

2458

2378

client.Rejected("Approval timed out")

2465

2385

try:

2466

2386

session.send(client.secret)

2467

2387

except gnutls.Error as error:

2468

log.warning("gnutls send failed", exc_info=error)

2388

logger.warning("gnutls send failed",

2389

exc_info=error)

2469

2390

return

2470

2391

2471

log.info("Sending secret to %s", client.name)

2392

logger.info("Sending secret to %s", client.name)

2472

2393

# bump the timeout using extended_timeout

2473

2394

client.bump_timeout(client.extended_timeout)

2474

2395

if self.server.use_dbus:

2481

2402

try:

2482

2403

session.bye()

2483

2404

except gnutls.Error as error:

2484

log.warning("GnuTLS bye failed", exc_info=error)

2405

logger.warning("GnuTLS bye failed",

2406

exc_info=error)

2485

2407

2486

2408

@staticmethod

2487

2409

def peer_certificate(session):

2488

2410

"Return the peer's certificate as a bytestring"

2489

2411

try:

2490

cert_type = gnutls.certificate_type_get2(

2491

session, gnutls.CTYPE_PEERS)

2412

cert_type = gnutls.certificate_type_get2(session._c_object,

2413

gnutls.CTYPE_PEERS)

2492

2414

except AttributeError:

2493

cert_type = gnutls.certificate_type_get(session)

2415

cert_type = gnutls.certificate_type_get(session._c_object)

2494

2416

if gnutls.has_rawpk:

2495

2417

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2496

2418

else:

2497

2419

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2498

2420

# If not a valid certificate type...

2499

2421

if cert_type not in valid_cert_types:

2500

log.info("Cert type %r not in %r", cert_type,

2501

valid_cert_types)

2422

logger.info("Cert type %r not in %r", cert_type,

2423

valid_cert_types)

2502

2424

# ...return invalid data

2503

2425

return b""

2504

2426

list_size = ctypes.c_uint(1)

2505

2427

cert_list = (gnutls.certificate_get_peers

2506

(session, ctypes.byref(list_size)))

2428

(session._c_object, ctypes.byref(list_size)))

2507

2429

if not bool(cert_list) and list_size.value != 0:

2508

2430

raise gnutls.Error("error getting peer certificate")

2509

2431

if list_size.value == 0:

2531

2453

buf = ctypes.create_string_buffer(32)

2532

2454

buf_len = ctypes.c_size_t(len(buf))

2533

2455

# Get the key ID from the raw public key into the buffer

2534

gnutls.pubkey_get_key_id(

2535

pubkey,

2536

gnutls.KEYID_USE_SHA256,

2537

ctypes.cast(ctypes.byref(buf),

2538

ctypes.POINTER(ctypes.c_ubyte)),

2539

ctypes.byref(buf_len))

2456

gnutls.pubkey_get_key_id(pubkey,

2457

gnutls.KEYID_USE_SHA256,

2458

ctypes.cast(ctypes.byref(buf),

2459

ctypes.POINTER(ctypes.c_ubyte)),

2460

ctypes.byref(buf_len))

2540

2461

# Deinit the certificate

2541

2462

gnutls.pubkey_deinit(pubkey)

2542

2463

2623

2544

2624

2545

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2625

2546

socketserver.TCPServer):

2626

"""IPv6-capable TCP server. Accepts None as address and/or port

2547

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2627

2548

2628

2549

Attributes:

2629

2550

enabled: Boolean; whether this server is activated yet

2680

2601

if SO_BINDTODEVICE is None:

2681

2602

# Fall back to a hard-coded value which seems to be

2682

2603

# common enough.

2683

log.warning("SO_BINDTODEVICE not found, trying 25")

2604

logger.warning("SO_BINDTODEVICE not found, trying 25")

2684

2605

SO_BINDTODEVICE = 25

2685

2606

try:

2686

2607

self.socket.setsockopt(

2688

2609

(self.interface + "\0").encode("utf-8"))

2689

2610

except socket.error as error:

2690

2611

if error.errno == errno.EPERM:

2691

log.error("No permission to bind to interface %s",

2692

self.interface)

2612

logger.error("No permission to bind to"

2613

" interface %s", self.interface)

2693

2614

elif error.errno == errno.ENOPROTOOPT:

2694

log.error("SO_BINDTODEVICE not available; cannot"

2695

" bind to interface %s", self.interface)

2615

logger.error("SO_BINDTODEVICE not available;"

2616

" cannot bind to interface %s",

2617

self.interface)

2696

2618

elif error.errno == errno.ENODEV:

2697

log.error("Interface %s does not exist, cannot"

2698

" bind", self.interface)

2619

logger.error("Interface %s does not exist,"

2620

" cannot bind", self.interface)

2699

2621

else:

2700

2622

raise

2701

2623

# Only bind(2) the socket if we really need to.

2780

2702

request = parent_pipe.recv()

2781

2703

command = request[0]

2782

2704

2783

if command == "init":

2705

if command == 'init':

2784

2706

key_id = request[1].decode("ascii")

2785

2707

fpr = request[2].decode("ascii")

2786

2708

address = request[3]

2787

2709

2788

2710

for c in self.clients.values():

2789

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2790

"27AE41E4649B934CA495991B7852B855"):

2711

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2791

2712

continue

2792

2713

if key_id and c.key_id == key_id:

2793

2714

client = c

2796

2717

client = c

2797

2718

break

2798

2719

else:

2799

log.info("Client not found for key ID: %s, address:"

2800

" %s", key_id or fpr, address)

2720

logger.info("Client not found for key ID: %s, address"

2721

": %s", key_id or fpr, address)

2801

2722

if self.use_dbus:

2802

2723

# Emit D-Bus signal

2803

2724

mandos_dbus_service.ClientNotFound(key_id or fpr,

2816

2737

# remove the old hook in favor of the new above hook on

2817

2738

# same fileno

2818

2739

return False

2819

if command == "funcall":

2740

if command == 'funcall':

2820

2741

funcname = request[1]

2821

2742

args = request[2]

2822

2743

kwargs = request[3]

2823

2744

2824

parent_pipe.send(("data", getattr(client_object,

2745

parent_pipe.send(('data', getattr(client_object,

2825

2746

funcname)(*args,

2826

2747

**kwargs)))

2827

2748

2828

if command == "getattr":

2749

if command == 'getattr':

2829

2750

attrname = request[1]

2830

2751

if isinstance(client_object.__getattribute__(attrname),

2831

collections.abc.Callable):

2832

parent_pipe.send(("function", ))

2752

collections.Callable):

2753

parent_pipe.send(('function', ))

2833

2754

else:

2834

2755

parent_pipe.send((

2835

"data", client_object.__getattribute__(attrname)))

2756

'data', client_object.__getattribute__(attrname)))

2836

2757

2837

if command == "setattr":

2758

if command == 'setattr':

2838

2759

attrname = request[1]

2839

2760

value = request[2]

2840

2761

setattr(client_object, attrname, value)

2845

2766

def rfc3339_duration_to_delta(duration):

2846

2767

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2847

2768

2848

>>> timedelta = datetime.timedelta

2849

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2850

True

2851

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2852

True

2853

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2854

True

2855

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2856

True

2857

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2858

True

2859

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2860

True

2861

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2862

True

2863

>>> del timedelta

2769

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2770

True

2771

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2772

True

2773

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2774

True

2775

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2776

True

2777

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2778

True

2779

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2780

True

2781

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2782

True

2864

2783

"""

2865

2784

2866

2785

# Parsing an RFC 3339 duration with regular expressions is not

2946

2865

def string_to_delta(interval):

2947

2866

"""Parse a string and return a datetime.timedelta

2948

2867

2949

>>> string_to_delta("7d") == datetime.timedelta(7)

2950

True

2951

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2952

True

2953

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2954

True

2955

>>> string_to_delta("24h") == datetime.timedelta(1)

2956

True

2957

>>> string_to_delta("1w") == datetime.timedelta(7)

2958

True

2959

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2868

>>> string_to_delta('7d') == datetime.timedelta(7)

2869

True

2870

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2871

True

2872

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2873

True

2874

>>> string_to_delta('24h') == datetime.timedelta(1)

2875

True

2876

>>> string_to_delta('1w') == datetime.timedelta(7)

2877

True

2878

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2960

2879

True

2961

2880

"""

2962

2881

3109

3028

# Later, stdin will, and stdout and stderr might, be dup'ed

3110

3029

# over with an opened os.devnull. But we don't want this to

3111

3030

# happen with a supplied network socket.

3112

while 0 <= server_settings["socket"] <= 2:

3031

if 0 <= server_settings["socket"] <= 2:

3113

3032

server_settings["socket"] = os.dup(server_settings

3114

3033

["socket"])

3115

os.set_inheritable(server_settings["socket"], False)

3116

3034

del server_config

3117

3035

3118

3036

# Override the settings from the config file with command line

3167

3085

3168

3086

if server_settings["servicename"] != "Mandos":

3169

3087

syslogger.setFormatter(

3170

logging.Formatter("Mandos ({}) [%(process)d]:"

3171

" %(levelname)s: %(message)s".format(

3088

logging.Formatter('Mandos ({}) [%(process)d]:'

3089

' %(levelname)s: %(message)s'.format(

3172

3090

server_settings["servicename"])))

3173

3091

3174

3092

# Parse config file with clients

3198

3116

try:

3199

3117

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

3200

3118

except IOError as e:

3201

log.error("Could not open file %r", pidfilename,

3202

exc_info=e)

3119

logger.error("Could not open file %r", pidfilename,

3120

exc_info=e)

3203

3121

3204

3122

for name, group in (("_mandos", "_mandos"),

3205

3123

("mandos", "mandos"),

3216

3134

try:

3217

3135

os.setgid(gid)

3218

3136

os.setuid(uid)

3219

log.debug("Did setuid/setgid to %s:%s", uid, gid)

3137

if debug:

3138

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3139

gid))

3220

3140

except OSError as error:

3221

log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,

3222

os.strerror(error.errno))

3141

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3142

.format(uid, gid, os.strerror(error.errno)))

3223

3143

if error.errno != errno.EPERM:

3224

3144

raise

3225

3145

3232

3152

3233

3153

@gnutls.log_func

3234

3154

def debug_gnutls(level, string):

3235

log.debug("GnuTLS: %s",

3236

string[:-1].decode("utf-8", errors="replace"))

3155

logger.debug("GnuTLS: %s", string[:-1])

3237

3156

3238

3157

gnutls.global_set_log_function(debug_gnutls)

3239

3158

3257

3176

# From the Avahi example code

3258

3177

DBusGMainLoop(set_as_default=True)

3259

3178

main_loop = GLib.MainLoop()

3260

if use_dbus or zeroconf:

3261

bus = dbus.SystemBus()

3179

bus = dbus.SystemBus()

3262

3180

# End of Avahi example code

3263

3181

if use_dbus:

3264

3182

try:

3269

3187

"se.bsnet.fukt.Mandos", bus,

3270

3188

do_not_queue=True)

3271

3189

except dbus.exceptions.DBusException as e:

3272

log.error("Disabling D-Bus:", exc_info=e)

3190

logger.error("Disabling D-Bus:", exc_info=e)

3273

3191

use_dbus = False

3274

3192

server_settings["use_dbus"] = False

3275

3193

tcp_server.use_dbus = False

3360

3278

os.remove(stored_state_path)

3361

3279

except IOError as e:

3362

3280

if e.errno == errno.ENOENT:

3363

log.warning("Could not load persistent state:"

3364

" %s", os.strerror(e.errno))

3281

logger.warning("Could not load persistent state:"

3282

" {}".format(os.strerror(e.errno)))

3365

3283

else:

3366

log.critical("Could not load persistent state:",

3367

exc_info=e)

3284

logger.critical("Could not load persistent state:",

3285

exc_info=e)

3368

3286

raise

3369

3287

except EOFError as e:

3370

log.warning("Could not load persistent state: EOFError:",

3371

exc_info=e)

3288

logger.warning("Could not load persistent state: "

3289

"EOFError:",

3290

exc_info=e)

3372

3291

3373

3292

with PGPEngine() as pgp:

3374

3293

for client_name, client in clients_data.items():

3401

3320

if client["enabled"]:

3402

3321

if datetime.datetime.utcnow() >= client["expires"]:

3403

3322

if not client["last_checked_ok"]:

3404

log.warning("disabling client %s - Client"

3405

" never performed a successful"

3406

" checker", client_name)

3323

logger.warning(

3324

"disabling client {} - Client never "

3325

"performed a successful checker".format(

3326

client_name))

3407

3327

client["enabled"] = False

3408

3328

elif client["last_checker_status"] != 0:

3409

log.warning("disabling client %s - Client"

3410

" last checker failed with error"

3411

" code %s", client_name,

3412

client["last_checker_status"])

3329

logger.warning(

3330

"disabling client {} - Client last"

3331

" checker failed with error code"

3332

" {}".format(

3333

client_name,

3334

client["last_checker_status"]))

3413

3335

client["enabled"] = False

3414

3336

else:

3415

3337

client["expires"] = (

3416

3338

datetime.datetime.utcnow()

3417

3339

+ client["timeout"])

3418

log.debug("Last checker succeeded, keeping %s"

3419

" enabled", client_name)

3340

logger.debug("Last checker succeeded,"

3341

" keeping {} enabled".format(

3342

client_name))

3420

3343

try:

3421

3344

client["secret"] = pgp.decrypt(

3422

3345

client["encrypted_secret"],

3423

3346

client_settings[client_name]["secret"])

3424

3347

except PGPError:

3425

3348

# If decryption fails, we use secret from new settings

3426

log.debug("Failed to decrypt %s old secret",

3427

client_name)

3349

logger.debug("Failed to decrypt {} old secret".format(

3350

client_name))

3428

3351

client["secret"] = (client_settings[client_name]

3429

3352

["secret"])

3430

3353

3444

3367

server_settings=server_settings)

3445

3368

3446

3369

if not tcp_server.clients:

3447

log.warning("No clients defined")

3370

logger.warning("No clients defined")

3448

3371

3449

3372

if not foreground:

3450

3373

if pidfile is not None:

3453

3376

with pidfile:

3454

3377

print(pid, file=pidfile)

3455

3378

except IOError:

3456

log.error("Could not write to file %r with PID %d",

3457

pidfilename, pid)

3379

logger.error("Could not write to file %r with PID %d",

3380

pidfilename, pid)

3458

3381

del pidfile

3459

3382

del pidfilename

3460

3383

3610

3533

3611

3534

try:

3612

3535

with tempfile.NamedTemporaryFile(

3613

mode="wb",

3536

mode='wb',

3614

3537

suffix=".pickle",

3615

prefix="clients-",

3538

prefix='clients-',

3616

3539

dir=os.path.dirname(stored_state_path),

3617

3540

delete=False) as stored_state:

3618

3541

pickle.dump((clients, client_settings), stored_state,

3626

3549

except NameError:

3627

3550

pass

3628

3551

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3629

log.warning("Could not save persistent state: %s",

3630

os.strerror(e.errno))

3552

logger.warning("Could not save persistent state: {}"

3553

.format(os.strerror(e.errno)))

3631

3554

else:

3632

log.warning("Could not save persistent state:",

3633

exc_info=e)

3555

logger.warning("Could not save persistent state:",

3556

exc_info=e)

3634

3557

raise

3635

3558

3636

3559

# Delete all clients, and settings from config

3653

3576

mandos_dbus_service.client_added_signal(client)

3654

3577

# Need to initiate checking of clients

3655

3578

if client.enabled:

3656

client.init_checker(randomize_start=True)

3579

client.init_checker()

3657

3580

3658

3581

tcp_server.enable()

3659

3582

tcp_server.server_activate()

3662

3585

if zeroconf:

3663

3586

service.port = tcp_server.socket.getsockname()[1]

3664

3587

if use_ipv6:

3665

log.info("Now listening on address %r, port %d, flowinfo %d,"

3666

" scope_id %d", *tcp_server.socket.getsockname())

3588

logger.info("Now listening on address %r, port %d,"

3589

" flowinfo %d, scope_id %d",

3590

*tcp_server.socket.getsockname())

3667

3591

else: # IPv4

3668

log.info("Now listening on address %r, port %d",

3669

*tcp_server.socket.getsockname())

3592

logger.info("Now listening on address %r, port %d",

3593

*tcp_server.socket.getsockname())

3670

3594

3671

3595

# service.interface = tcp_server.socket.getsockname()[3]

3672

3596

3676

3600

try:

3677

3601

service.activate()

3678

3602

except dbus.exceptions.DBusException as error:

3679

log.critical("D-Bus Exception", exc_info=error)

3603

logger.critical("D-Bus Exception", exc_info=error)

3680

3604

cleanup()

3681

3605

sys.exit(1)

3682

3606

# End of Avahi example code

3687

3611

lambda *args, **kwargs: (tcp_server.handle_request

3688

3612

(*args[2:], **kwargs) or True))

3689

3613

3690

log.debug("Starting main loop")

3614

logger.debug("Starting main loop")

3691

3615

main_loop.run()

3692

3616

except AvahiError as error:

3693

log.critical("Avahi Error", exc_info=error)

3617

logger.critical("Avahi Error", exc_info=error)

3694

3618

cleanup()

3695

3619

sys.exit(1)

3696

3620

except KeyboardInterrupt:

3697

3621

if debug:

3698

3622

print("", file=sys.stderr)

3699

log.debug("Server received KeyboardInterrupt")

3700

log.debug("Server exiting")

3623

logger.debug("Server received KeyboardInterrupt")

3624

logger.debug("Server exiting")

3701

3625

# Must run before the D-Bus bus name gets deregistered

3702

3626

cleanup()

3703

3627

3704

3628

3705

def parse_test_args():

3706

# type: () -> argparse.Namespace

3629

def should_only_run_tests():

3707

3630

parser = argparse.ArgumentParser(add_help=False)

3708

parser.add_argument("--check", action="store_true")

3709

parser.add_argument("--prefix", )

3631

parser.add_argument("--check", action='store_true')

3710

3632

args, unknown_args = parser.parse_known_args()

3711

if args.check:

3712

# Remove test options from sys.argv

3633

run_tests = args.check

3634

if run_tests:

3635

# Remove --check argument from sys.argv

3713

3636

sys.argv[1:] = unknown_args

3714

return args

3637

return run_tests

3715

3638

3716

3639

# Add all tests from doctest strings

3717

3640

def load_tests(loader, tests, none):

3719

3642

tests.addTests(doctest.DocTestSuite())

3720

3643

return tests

3721

3644

3722

if __name__ == "__main__":

3723

options = parse_test_args()

3645

if __name__ == '__main__':

3724

3646

try:

3725

if options.check:

3726

extra_test_prefix = options.prefix

3727

if extra_test_prefix is not None:

3728

if not (unittest.main(argv=[""], exit=False)

3729

.result.wasSuccessful()):

3730

sys.exit(1)

3731

class ExtraTestLoader(unittest.TestLoader):

3732

testMethodPrefix = extra_test_prefix

3733

# Call using ./scriptname --test [--verbose]

3734

unittest.main(argv=[""], testLoader=ExtraTestLoader())

3735

else:

3736

unittest.main(argv=[""])

3647

if should_only_run_tests():

3648

# Call using ./mandos --check [--verbose]

3649

unittest.main()

3737

3650

else:

3738

3651

main()

3739

3652

finally:

3740

3653

logging.shutdown()

3741

3742

# Local Variables:

3743

# run-tests:

3744

# (lambda (&optional extra)

3745

# (if (not (funcall run-tests-in-test-buffer default-directory

3746

# extra))

3747

# (funcall show-test-buffer-in-test-window)

3748

# (funcall remove-test-window)

3749

# (if extra (message "Extra tests run successfully!"))))

3750

# run-tests-in-test-buffer:

3751

# (lambda (dir &optional extra)

3752

# (with-current-buffer (get-buffer-create "*Test*")

3753

# (setq buffer-read-only nil

3754

# default-directory dir)

3755

# (erase-buffer)

3756

# (compilation-mode))

3757

# (let ((process-result

3758

# (let ((inhibit-read-only t))

3759

# (process-file-shell-command

3760

# (funcall get-command-line extra) nil "*Test*"))))

3761

# (and (numberp process-result)

3762

# (= process-result 0))))

3763

# get-command-line:

3764

# (lambda (&optional extra)

3765

# (let ((quoted-script

3766

# (shell-quote-argument (funcall get-script-name))))

3767

# (format

3768

# (concat "%s --check" (if extra " --prefix=atest" ""))

3769

# quoted-script)))

3770

# get-script-name:

3771

# (lambda ()

3772

# (if (fboundp 'file-local-name)

3773

# (file-local-name (buffer-file-name))

3774

# (or (file-remote-p (buffer-file-name) 'localname)

3775

# (buffer-file-name))))

3776

# remove-test-window:

3777

# (lambda ()

3778

# (let ((test-window (get-buffer-window "*Test*")))

3779

# (if test-window (delete-window test-window))))

3780

# show-test-buffer-in-test-window:

3781

# (lambda ()

3782

# (when (not (get-buffer-window-list "*Test*"))

3783

# (setq next-error-last-buffer (get-buffer "*Test*"))

3784

# (let* ((side (if (>= (window-width) 146) 'right 'bottom))

3785

# (display-buffer-overriding-action

3786

# `((display-buffer-in-side-window) (side . ,side)

3787

# (window-height . fit-window-to-buffer)

3788

# (window-width . fit-window-to-buffer))))

3789

# (display-buffer "*Test*"))))

3790

# eval:

3791

# (progn

3792

# (let* ((run-extra-tests (lambda () (interactive)

3793

# (funcall run-tests t)))

3794

# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t

3795

# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c

3796

# (setq minor-mode-overriding-map-alist

3797

# (cons `(run-tests . ,outer-keymap)

3798

# minor-mode-overriding-map-alist)))

3799

# (add-hook 'after-save-hook run-tests 90 t))

3800

# End: