/mandos/release : revision 399

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

77

import itertools

78

import collections

79

import codecs

80

import unittest

81

import random

82

import shlex

80

83

81

84

import dbus

82

85

import dbus.service

90

93

91

94

if sys.version_info.major == 2:

92

95

__metaclass__ = type

96

str = unicode

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Show warnings by default

114

if not sys.warnoptions:

115

import warnings

116

warnings.simplefilter("default")

93

117

94

118

# Try to find the value of SO_BINDTODEVICE:

95

119

try:

116

140

# No value found

117

141

SO_BINDTODEVICE = None

118

142

119

if sys.version_info.major == 2:

120

str = unicode

121

122

143

if sys.version_info < (3, 2):

123

144

configparser.Configparser = configparser.SafeConfigParser

124

145

125

version = "1.8.7"

146

version = "1.8.11"

126

147

stored_state_file = "clients.pickle"

127

148

128

149

logger = logging.getLogger()

150

logging.captureWarnings(True) # Show warnings via the logging system

129

151

syslogger = None

130

152

131

153

try:

196

218

output = subprocess.check_output(["gpgconf"])

197

219

for line in output.splitlines():

198

220

name, text, path = line.split(b":")

199

if name == "gpg":

221

if name == b"gpg":

200

222

self.gpg = path

201

223

break

202

224

except OSError as e:

207

229

'--force-mdc',

208

230

'--quiet']

209

231

# Only GPG version 1 has the --no-use-agent option.

210

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

211

233

self.gnupgargs.append("--no-use-agent")

212

234

213

235

def __enter__(self):

1030

1052

if self.checker_initiator_tag is not None:

1031

1053

GLib.source_remove(self.checker_initiator_tag)

1032

1054

self.checker_initiator_tag = GLib.timeout_add(

1033

int(self.interval.total_seconds() * 1000),

1055

random.randrange(int(self.interval.total_seconds() * 1000

1056

+ 1)),

1034

1057

self.start_checker)

1035

1058

# Schedule a disable() when 'timeout' has passed

1036

1059

if self.disable_initiator_tag is not None:

1046

1069

# Read return code from connection (see call_pipe)

1047

1070

returncode = connection.recv()

1048

1071

connection.close()

1049

self.checker.join()

1072

if self.checker is not None:

1073

self.checker.join()

1050

1074

self.checker_callback_tag = None

1051

1075

self.checker = None

1052

1076

1110

1134

if self.checker is None:

1111

1135

# Escape attributes for the shell

1112

1136

escaped_attrs = {

1113

attr: re.escape(str(getattr(self, attr)))

1137

attr: shlex.quote(str(getattr(self, attr)))

1114

1138

for attr in self.runtime_expansions}

1115

1139

try:

1116

1140

command = self.checker_command % escaped_attrs

1143

1167

kwargs=popen_args)

1144

1168

self.checker.start()

1145

1169

self.checker_callback_tag = GLib.io_add_watch(

1146

pipe[0].fileno(), GLib.IO_IN,

1170

GLib.IOChannel.unix_new(pipe[0].fileno()),

1171

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1147

1172

self.checker_callback, pipe[0], command)

1148

1173

# Re-run this periodically if run by GLib.timeout_add

1149

1174

return True

1404

1429

raise ValueError("Byte arrays not supported for non-"

1405

1430

"'ay' signature {!r}"

1406

1431

.format(prop._dbus_signature))

1407

value = dbus.ByteArray(b''.join(chr(byte)

1408

for byte in value))

1432

value = dbus.ByteArray(bytes(value))

1409

1433

prop(value)

1410

1434

1411

1435

@dbus.service.method(dbus.PROPERTIES_IFACE,

2673

2697

def add_pipe(self, parent_pipe, proc):

2674

2698

# Call "handle_ipc" for both data and EOF events

2675

2699

GLib.io_add_watch(

2676

parent_pipe.fileno(),

2677

GLib.IO_IN | GLib.IO_HUP,

2700

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2701

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2678

2702

functools.partial(self.handle_ipc,

2679

2703

parent_pipe=parent_pipe,

2680

2704

proc=proc))

2718

2742

return False

2719

2743

2720

2744

GLib.io_add_watch(

2721

parent_pipe.fileno(),

2722

GLib.IO_IN | GLib.IO_HUP,

2745

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2746

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2723

2747

functools.partial(self.handle_ipc,

2724

2748

parent_pipe=parent_pipe,

2725

2749

proc=proc,

2740

2764

if command == 'getattr':

2741

2765

attrname = request[1]

2742

2766

if isinstance(client_object.__getattribute__(attrname),

2743

collections.Callable):

2767

collections.abc.Callable):

2744

2768

parent_pipe.send(('function', ))

2745

2769

else:

2746

2770

parent_pipe.send((

2757

2781

def rfc3339_duration_to_delta(duration):

2758

2782

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2759

2783

2760

>>> rfc3339_duration_to_delta("P7D")

2761

datetime.timedelta(7)

2762

>>> rfc3339_duration_to_delta("PT60S")

2763

datetime.timedelta(0, 60)

2764

>>> rfc3339_duration_to_delta("PT60M")

2765

datetime.timedelta(0, 3600)

2766

>>> rfc3339_duration_to_delta("PT24H")

2767

datetime.timedelta(1)

2768

>>> rfc3339_duration_to_delta("P1W")

2769

datetime.timedelta(7)

2770

>>> rfc3339_duration_to_delta("PT5M30S")

2771

datetime.timedelta(0, 330)

2772

>>> rfc3339_duration_to_delta("P1DT3M20S")

2773

datetime.timedelta(1, 200)

2784

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2785

True

2786

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2787

True

2788

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2789

True

2790

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2791

True

2792

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2793

True

2794

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2795

True

2796

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2797

True

2774

2798

"""

2775

2799

2776

2800

# Parsing an RFC 3339 duration with regular expressions is not

2856

2880

def string_to_delta(interval):

2857

2881

"""Parse a string and return a datetime.timedelta

2858

2882

2859

>>> string_to_delta('7d')

2860

datetime.timedelta(7)

2861

>>> string_to_delta('60s')

2862

datetime.timedelta(0, 60)

2863

>>> string_to_delta('60m')

2864

datetime.timedelta(0, 3600)

2865

>>> string_to_delta('24h')

2866

datetime.timedelta(1)

2867

>>> string_to_delta('1w')

2868

datetime.timedelta(7)

2869

>>> string_to_delta('5m 30s')

2870

datetime.timedelta(0, 330)

2883

>>> string_to_delta('7d') == datetime.timedelta(7)

2884

True

2885

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2886

True

2887

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2888

True

2889

>>> string_to_delta('24h') == datetime.timedelta(1)

2890

True

2891

>>> string_to_delta('1w') == datetime.timedelta(7)

2892

True

2893

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2894

True

2871

2895

"""

2872

2896

2873

2897

try:

2975

2999

2976

3000

options = parser.parse_args()

2977

3001

2978

if options.check:

2979

import doctest

2980

fail_count, test_count = doctest.testmod()

2981

sys.exit(os.EX_OK if fail_count == 0 else 1)

2982

2983

3002

# Default values for config file for server-global settings

2984

3003

if gnutls.has_rawpk:

2985

3004

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3248

3267

if isinstance(s, bytes)

3249

3268

else s) for s in

3250

3269

value["client_structure"]]

3251

# .name & .host

3252

for k in ("name", "host"):

3270

# .name, .host, and .checker_command

3271

for k in ("name", "host", "checker_command"):

3253

3272

if isinstance(value[k], bytes):

3254

3273

value[k] = value[k].decode("utf-8")

3255

3274

if "key_id" not in value:

3265

3284

for key, value in

3266

3285

bytes_old_client_settings.items()}

3267

3286

del bytes_old_client_settings

3268

# .host

3287

# .host and .checker_command

3269

3288

for value in old_client_settings.values():

3270

if isinstance(value["host"], bytes):

3271

value["host"] = (value["host"]

3272

.decode("utf-8"))

3289

for attribute in ("host", "checker_command"):

3290

if isinstance(value[attribute], bytes):

3291

value[attribute] = (value[attribute]

3292

.decode("utf-8"))

3273

3293

os.remove(stored_state_path)

3274

3294

except IOError as e:

3275

3295

if e.errno == errno.ENOENT:

3600

3620

sys.exit(1)

3601

3621

# End of Avahi example code

3602

3622

3603

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3604

lambda *args, **kwargs:

3605

(tcp_server.handle_request

3606

(*args[2:], **kwargs) or True))

3623

GLib.io_add_watch(

3624

GLib.IOChannel.unix_new(tcp_server.fileno()),

3625

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3626

lambda *args, **kwargs: (tcp_server.handle_request

3627

(*args[2:], **kwargs) or True))

3607

3628

3608

3629

logger.debug("Starting main loop")

3609

3630

main_loop.run()

3619

3640

# Must run before the D-Bus bus name gets deregistered

3620

3641

cleanup()

3621

3642

3643

3644

def should_only_run_tests():

3645

parser = argparse.ArgumentParser(add_help=False)

3646

parser.add_argument("--check", action='store_true')

3647

args, unknown_args = parser.parse_known_args()

3648

run_tests = args.check

3649

if run_tests:

3650

# Remove --check argument from sys.argv

3651

sys.argv[1:] = unknown_args

3652

return run_tests

3653

3654

# Add all tests from doctest strings

3655

def load_tests(loader, tests, none):

3656

import doctest

3657

tests.addTests(doctest.DocTestSuite())

3658

return tests

3622

3659

3623

3660

if __name__ == '__main__':

3624

main()

3661

try:

3662

if should_only_run_tests():

3663

# Call using ./mandos --check [--verbose]

3664

unittest.main()

3665

else:

3666

main()

3667

finally:

3668

logging.shutdown()