To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1133
- compare with another revision
- download diff
- download tarball
- view history from revision 1133
- Committer: Teddy Hogeborn
- Date: 2019-07-30 18:15:41 UTC
- Revision ID: teddy@recompile.se-20190730181541-wzzydg1u0jck1oio
Update Debian package standard-version to "4.4.0"
* debian/control (Standards-Version): Update to "4.4.0".
* debian/control (Standards-Version): Update to "4.4.0".
- files removed:
- debian/po/de.po
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
39
40
except ImportError:
40
41
pass
41
42
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
43
try:
48
44
import SocketServer as socketserver
49
45
except ImportError:
50
46
import socketserver
51
47
import socket
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
import ConfigParser as configparser
56
53
except ImportError:
57
54
import configparser
55
import sys
58
56
import re
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import random
81
import shlex
82
80
83
81
import dbus
84
82
import dbus.service
85
import gi
86
83
from gi.repository import GLib
87
84
from dbus.mainloop.glib import DBusGMainLoop
88
85
import ctypes
90
87
import xml.dom.minidom
91
88
import inspect
92
89
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
90
# Try to find the value of SO_BINDTODEVICE:
119
91
try:
120
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
140
112
# No value found
141
113
SO_BINDTODEVICE = None
142
114
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
115
if sys.version_info.major == 2:
116
str = unicode
145
117
146
version = "1.8.15"
118
version = "1.8.4"
147
119
stored_state_file = "clients.pickle"
148
120
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
150
logging.captureWarnings(True) # Show warnings via the logging system
121
logger = logging.getLogger()
151
122
syslogger = None
152
123
153
124
try:
189
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
161
address="/dev/log"))
191
162
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
163
('Mandos [%(process)d]: %(levelname)s:'
164
' %(message)s'))
165
logger.addHandler(syslogger)
195
166
196
167
if debug:
197
168
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
169
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
170
' [%(process)d]:'
171
' %(levelname)s:'
172
' %(message)s'))
173
logger.addHandler(console)
174
logger.setLevel(level)
204
175
205
176
206
177
class PGPError(Exception):
208
179
pass
209
180
210
181
211
class PGPEngine:
182
class PGPEngine(object):
212
183
"""A simple class for OpenPGP symmetric encryption & decryption"""
213
184
214
185
def __init__(self):
218
189
output = subprocess.check_output(["gpgconf"])
219
190
for line in output.splitlines():
220
191
name, text, path = line.split(b":")
221
if name == b"gpg":
192
if name == "gpg":
222
193
self.gpg = path
223
194
break
224
195
except OSError as e:
225
196
if e.errno != errno.ENOENT:
226
197
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
198
self.gnupgargs = ['--batch',
199
'--homedir', self.tempdir,
200
'--force-mdc',
201
'--quiet']
231
202
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
203
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
233
204
self.gnupgargs.append("--no-use-agent")
234
205
235
206
def __enter__(self):
272
243
dir=self.tempdir) as passfile:
273
244
passfile.write(passphrase)
274
245
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
246
proc = subprocess.Popen([self.gpg, '--symmetric',
247
'--passphrase-file',
277
248
passfile.name]
278
249
+ self.gnupgargs,
279
250
stdin=subprocess.PIPE,
290
261
dir=self.tempdir) as passfile:
291
262
passfile.write(passphrase)
292
263
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
264
proc = subprocess.Popen([self.gpg, '--decrypt',
265
'--passphrase-file',
295
266
passfile.name]
296
267
+ self.gnupgargs,
297
268
stdin=subprocess.PIPE,
304
275
305
276
306
277
# Pretend that we have an Avahi module
307
class avahi:
278
class avahi(object):
308
279
"""This isn't so much a class as it is a module-like namespace."""
309
280
IF_UNSPEC = -1 # avahi-common/address.h
310
281
PROTO_UNSPEC = -1 # avahi-common/address.h
344
315
pass
345
316
346
317
347
class AvahiService:
318
class AvahiService(object):
348
319
"""An Avahi (Zeroconf) service.
349
320
350
321
Attributes:
351
322
interface: integer; avahi.IF_UNSPEC or an interface index.
352
323
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
324
name: string; Example: 'Mandos'
325
type: string; Example: '_mandos._tcp'.
355
326
See <https://www.iana.org/assignments/service-names-port-numbers>
356
327
port: integer; what port to announce
357
328
TXT: list of strings; TXT record for the service
394
365
def rename(self, remove=True):
395
366
"""Derived from the Avahi example code"""
396
367
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
368
logger.critical("No suitable Zeroconf service name found"
369
" after %i retries, exiting.",
370
self.rename_count)
400
371
raise AvahiServiceError("Too many renames")
401
372
self.name = str(
402
373
self.server.GetAlternativeServiceName(self.name))
403
374
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
375
logger.info("Changing Zeroconf service name to %r ...",
376
self.name)
406
377
if remove:
407
378
self.remove()
408
379
try:
410
381
except dbus.exceptions.DBusException as error:
411
382
if (error.get_dbus_name()
412
383
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
384
logger.info("Local Zeroconf service name collision.")
414
385
return self.rename(remove=False)
415
386
else:
416
log.critical("D-Bus Exception", exc_info=error)
387
logger.critical("D-Bus Exception", exc_info=error)
417
388
self.cleanup()
418
389
os._exit(1)
419
390
435
406
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
407
self.entry_group_state_changed_match = (
437
408
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
409
'StateChanged', self.entry_group_state_changed))
410
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
411
self.name, self.type)
441
412
self.group.AddService(
442
413
self.interface,
443
414
self.protocol,
450
421
451
422
def entry_group_state_changed(self, state, error):
452
423
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
424
logger.debug("Avahi entry group state change: %i", state)
454
425
455
426
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
427
logger.debug("Zeroconf service established.")
457
428
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
429
logger.info("Zeroconf service name collision.")
459
430
self.rename()
460
431
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
432
logger.critical("Avahi: Error in group state changed %s",
433
str(error))
463
434
raise AvahiGroupError("State changed: {!s}".format(error))
464
435
465
436
def cleanup(self):
475
446
476
447
def server_state_changed(self, state, error=None):
477
448
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
449
logger.debug("Avahi server state change: %i", state)
479
450
bad_states = {
480
451
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
452
avahi.SERVER_REGISTERING: None,
485
456
if state in bad_states:
486
457
if bad_states[state] is not None:
487
458
if error is None:
488
log.error(bad_states[state])
459
logger.error(bad_states[state])
489
460
else:
490
log.error(bad_states[state] + ": %r", error)
461
logger.error(bad_states[state] + ": %r", error)
491
462
self.cleanup()
492
463
elif state == avahi.SERVER_RUNNING:
493
464
try:
495
466
except dbus.exceptions.DBusException as error:
496
467
if (error.get_dbus_name()
497
468
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
469
logger.info("Local Zeroconf service name"
470
" collision.")
499
471
return self.rename(remove=False)
500
472
else:
501
log.critical("D-Bus Exception", exc_info=error)
473
logger.critical("D-Bus Exception", exc_info=error)
502
474
self.cleanup()
503
475
os._exit(1)
504
476
else:
505
477
if error is None:
506
log.debug("Unknown state: %r", state)
478
logger.debug("Unknown state: %r", state)
507
479
else:
508
log.debug("Unknown state: %r: %r", state, error)
480
logger.debug("Unknown state: %r: %r", state, error)
509
481
510
482
def activate(self):
511
483
"""Derived from the Avahi example code"""
523
495
class AvahiServiceToSyslog(AvahiService):
524
496
def rename(self, *args, **kwargs):
525
497
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
498
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
528
499
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
501
.format(self.name)))
531
502
return ret
532
503
533
504
534
505
# Pretend that we have a GnuTLS module
535
class gnutls:
506
class gnutls(object):
536
507
"""This isn't so much a class as it is a module-like namespace."""
537
508
538
509
library = ctypes.util.find_library("gnutls")
562
533
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
534
564
535
# Types
565
class _session_int(ctypes.Structure):
536
class session_int(ctypes.Structure):
566
537
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
538
session_t = ctypes.POINTER(session_int)
568
539
569
540
class certificate_credentials_st(ctypes.Structure):
570
541
_fields_ = []
573
544
certificate_type_t = ctypes.c_int
574
545
575
546
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
547
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
548
('size', ctypes.c_uint)]
578
549
579
class _openpgp_crt_int(ctypes.Structure):
550
class openpgp_crt_int(ctypes.Structure):
580
551
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
552
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
553
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
554
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
555
credentials_type_t = ctypes.c_int
593
564
# gnutls.strerror()
594
565
self.code = code
595
566
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
567
message = gnutls.strerror(code)
598
568
return super(gnutls.Error, self).__init__(
599
569
message, *args)
600
570
601
571
class CertificateSecurityError(Error):
602
572
pass
603
573
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
574
# Classes
630
class Credentials(With_from_param):
575
class Credentials(object):
631
576
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
577
self._c_object = gnutls.certificate_credentials_t()
578
gnutls.certificate_allocate_credentials(
579
ctypes.byref(self._c_object))
634
580
self.type = gnutls.CRD_CERTIFICATE
635
581
636
582
def __del__(self):
637
gnutls.certificate_free_credentials(self)
583
gnutls.certificate_free_credentials(self._c_object)
638
584
639
class ClientSession(With_from_param):
585
class ClientSession(object):
640
586
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
587
self._c_object = gnutls.session_t()
642
588
gnutls_flags = gnutls.CLIENT
643
589
if gnutls.check_version(b"3.5.6"):
644
590
gnutls_flags |= gnutls.NO_TICKETS
645
591
if gnutls.has_rawpk:
646
592
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
593
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
648
594
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
595
gnutls.set_default_priority(self._c_object)
596
gnutls.transport_set_ptr(self._c_object, socket.fileno())
597
gnutls.handshake_set_private_extensions(self._c_object,
598
True)
652
599
self.socket = socket
653
600
if credentials is None:
654
601
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
602
gnutls.credentials_set(self._c_object, credentials.type,
603
ctypes.cast(credentials._c_object,
604
ctypes.c_void_p))
657
605
self.credentials = credentials
658
606
659
607
def __del__(self):
660
gnutls.deinit(self)
608
gnutls.deinit(self._c_object)
661
609
662
610
def handshake(self):
663
return gnutls.handshake(self)
611
return gnutls.handshake(self._c_object)
664
612
665
613
def send(self, data):
666
614
data = bytes(data)
667
615
data_len = len(data)
668
616
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
617
data_len -= gnutls.record_send(self._c_object,
618
data[-data_len:],
670
619
data_len)
671
620
672
621
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
622
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
623
675
624
# Error handling functions
676
625
def _error_code(result):
677
626
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
627
for the 'restype' attribute on ctypes functions"""
628
if result >= 0:
680
629
return result
681
630
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
631
raise gnutls.CertificateSecurityError(code=result)
683
632
raise gnutls.Error(code=result)
684
633
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
634
def _retry_on_error(result, func, arguments):
687
635
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
636
for the 'errcheck' attribute on ctypes functions"""
637
while result < 0:
690
638
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
639
return _error_code(result)
692
640
result = func(*arguments)
697
645
698
646
# Functions
699
647
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
648
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
649
ctypes.POINTER(ctypes.c_char_p)]
702
650
priority_set_direct.restype = _error_code
703
651
704
652
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
653
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
654
init.restype = _error_code
707
655
708
656
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
657
set_default_priority.argtypes = [session_t]
710
658
set_default_priority.restype = _error_code
711
659
712
660
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
661
record_send.argtypes = [session_t, ctypes.c_void_p,
714
662
ctypes.c_size_t]
715
663
record_send.restype = ctypes.c_ssize_t
716
664
record_send.errcheck = _retry_on_error
718
666
certificate_allocate_credentials = (
719
667
_library.gnutls_certificate_allocate_credentials)
720
668
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
669
ctypes.POINTER(certificate_credentials_t)]
722
670
certificate_allocate_credentials.restype = _error_code
723
671
724
672
certificate_free_credentials = (
725
673
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
674
certificate_free_credentials.argtypes = [
675
certificate_credentials_t]
727
676
certificate_free_credentials.restype = None
728
677
729
678
handshake_set_private_extensions = (
730
679
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
680
handshake_set_private_extensions.argtypes = [session_t,
732
681
ctypes.c_int]
733
682
handshake_set_private_extensions.restype = None
734
683
735
684
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
685
credentials_set.argtypes = [session_t, credentials_type_t,
686
ctypes.c_void_p]
738
687
credentials_set.restype = _error_code
739
688
740
689
strerror = _library.gnutls_strerror
742
691
strerror.restype = ctypes.c_char_p
743
692
744
693
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
694
certificate_type_get.argtypes = [session_t]
746
695
certificate_type_get.restype = _error_code
747
696
748
697
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
698
certificate_get_peers.argtypes = [session_t,
750
699
ctypes.POINTER(ctypes.c_uint)]
751
700
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
701
759
708
global_set_log_function.restype = None
760
709
761
710
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
711
deinit.argtypes = [session_t]
763
712
deinit.restype = None
764
713
765
714
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
715
handshake.argtypes = [session_t]
716
handshake.restype = _error_code
768
717
handshake.errcheck = _retry_on_error
769
718
770
719
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
720
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
721
transport_set_ptr.restype = None
773
722
774
723
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
724
bye.argtypes = [session_t, close_request_t]
725
bye.restype = _error_code
777
726
bye.errcheck = _retry_on_error
778
727
779
728
check_version = _library.gnutls_check_version
796
745
797
746
x509_crt_fmt_t = ctypes.c_int
798
747
799
# All the function declarations below are from
800
# gnutls/abstract.h
748
# All the function declarations below are from gnutls/abstract.h
801
749
pubkey_init = _library.gnutls_pubkey_init
802
750
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
751
pubkey_init.restype = _error_code
817
765
pubkey_deinit.argtypes = [pubkey_t]
818
766
pubkey_deinit.restype = None
819
767
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
768
# All the function declarations below are from gnutls/openpgp.h
822
769
823
770
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
771
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
830
777
openpgp_crt_fmt_t]
831
778
openpgp_crt_import.restype = _error_code
832
779
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
780
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
781
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
782
ctypes.POINTER(ctypes.c_uint)]
840
783
openpgp_crt_verify_self.restype = _error_code
841
784
842
785
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
853
796
854
797
if check_version(b"3.6.4"):
855
798
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
799
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
857
800
certificate_type_get2.restype = _error_code
858
801
859
802
# Remove non-public functions
871
814
connection.close()
872
815
873
816
874
class Client:
817
class Client(object):
875
818
"""A representation of a client host served by this server.
876
819
877
820
Attributes:
878
approved: bool(); None if not yet approved/disapproved
821
approved: bool(); 'None' if not yet approved/disapproved
879
822
approval_delay: datetime.timedelta(); Time to wait for approval
880
823
approval_duration: datetime.timedelta(); Duration of one approval
881
824
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
825
to see if the client lives. 'None' if no process is
883
826
running.
884
827
checker_callback_tag: a GLib event source tag, or None
885
828
checker_command: string; External command which is run to check
1009
952
self.last_enabled = None
1010
953
self.expires = None
1011
954
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
955
logger.debug("Creating client %r", self.name)
956
logger.debug(" Key ID: %s", self.key_id)
957
logger.debug(" Fingerprint: %s", self.fingerprint)
1015
958
self.created = settings.get("created",
1016
959
datetime.datetime.utcnow())
1017
960
1056
999
if not getattr(self, "enabled", False):
1057
1000
return False
1058
1001
if not quiet:
1059
log.info("Disabling client %s", self.name)
1002
logger.info("Disabling client %s", self.name)
1060
1003
if getattr(self, "disable_initiator_tag", None) is not None:
1061
1004
GLib.source_remove(self.disable_initiator_tag)
1062
1005
self.disable_initiator_tag = None
1080
1023
if self.checker_initiator_tag is not None:
1081
1024
GLib.source_remove(self.checker_initiator_tag)
1082
1025
self.checker_initiator_tag = GLib.timeout_add(
1083
random.randrange(int(self.interval.total_seconds() * 1000
1084
+ 1)),
1026
int(self.interval.total_seconds() * 1000),
1085
1027
self.start_checker)
1086
1028
# Schedule a disable() when 'timeout' has passed
1087
1029
if self.disable_initiator_tag is not None:
1097
1039
# Read return code from connection (see call_pipe)
1098
1040
returncode = connection.recv()
1099
1041
connection.close()
1100
if self.checker is not None:
1101
self.checker.join()
1042
self.checker.join()
1102
1043
self.checker_callback_tag = None
1103
1044
self.checker = None
1104
1045
1106
1047
self.last_checker_status = returncode
1107
1048
self.last_checker_signal = None
1108
1049
if self.last_checker_status == 0:
1109
log.info("Checker for %(name)s succeeded", vars(self))
1050
logger.info("Checker for %(name)s succeeded",
1051
vars(self))
1110
1052
self.checked_ok()
1111
1053
else:
1112
log.info("Checker for %(name)s failed", vars(self))
1054
logger.info("Checker for %(name)s failed", vars(self))
1113
1055
else:
1114
1056
self.last_checker_status = -1
1115
1057
self.last_checker_signal = -returncode
1116
log.warning("Checker for %(name)s crashed?", vars(self))
1058
logger.warning("Checker for %(name)s crashed?",
1059
vars(self))
1117
1060
return False
1118
1061
1119
1062
def checked_ok(self):
1153
1096
# should be.
1154
1097
1155
1098
if self.checker is not None and not self.checker.is_alive():
1156
log.warning("Checker was not alive; joining")
1099
logger.warning("Checker was not alive; joining")
1157
1100
self.checker.join()
1158
1101
self.checker = None
1159
1102
# Start a new checker if needed
1160
1103
if self.checker is None:
1161
1104
# Escape attributes for the shell
1162
1105
escaped_attrs = {
1163
attr: shlex.quote(str(getattr(self, attr)))
1106
attr: re.escape(str(getattr(self, attr)))
1164
1107
for attr in self.runtime_expansions}
1165
1108
try:
1166
1109
command = self.checker_command % escaped_attrs
1167
1110
except TypeError as error:
1168
log.error('Could not format string "%s"',
1169
self.checker_command, exc_info=error)
1111
logger.error('Could not format string "%s"',
1112
self.checker_command,
1113
exc_info=error)
1170
1114
return True # Try again later
1171
1115
self.current_checker_command = command
1172
log.info("Starting checker %r for %s", command, self.name)
1116
logger.info("Starting checker %r for %s", command,
1117
self.name)
1173
1118
# We don't need to redirect stdout and stderr, since
1174
1119
# in normal mode, that is already done by daemon(),
1175
1120
# and in debug mode we don't want to. (Stdin is
1191
1136
kwargs=popen_args)
1192
1137
self.checker.start()
1193
1138
self.checker_callback_tag = GLib.io_add_watch(
1194
GLib.IOChannel.unix_new(pipe[0].fileno()),
1195
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1139
pipe[0].fileno(), GLib.IO_IN,
1196
1140
self.checker_callback, pipe[0], command)
1197
1141
# Re-run this periodically if run by GLib.timeout_add
1198
1142
return True
1204
1148
self.checker_callback_tag = None
1205
1149
if getattr(self, "checker", None) is None:
1206
1150
return
1207
log.debug("Stopping checker for %(name)s", vars(self))
1151
logger.debug("Stopping checker for %(name)s", vars(self))
1208
1152
self.checker.terminate()
1209
1153
self.checker = None
1210
1154
1237
1181
func._dbus_name = func.__name__
1238
1182
if func._dbus_name.endswith("_dbus_property"):
1239
1183
func._dbus_name = func._dbus_name[:-14]
1240
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1184
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1241
1185
return func
1242
1186
1243
1187
return decorator
1332
1276
1333
1277
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1334
1278
out_signature="s",
1335
path_keyword="object_path",
1336
connection_keyword="connection")
1279
path_keyword='object_path',
1280
connection_keyword='connection')
1337
1281
def Introspect(self, object_path, connection):
1338
1282
"""Overloading of standard D-Bus method.
1339
1283
1388
1332
document.unlink()
1389
1333
except (AttributeError, xml.dom.DOMException,
1390
1334
xml.parsers.expat.ExpatError) as error:
1391
log.error("Failed to override Introspection method",
1392
exc_info=error)
1335
logger.error("Failed to override Introspection method",
1336
exc_info=error)
1393
1337
return xmlstring
1394
1338
1395
1339
1453
1397
raise ValueError("Byte arrays not supported for non-"
1454
1398
"'ay' signature {!r}"
1455
1399
.format(prop._dbus_signature))
1456
value = dbus.ByteArray(bytes(value))
1400
value = dbus.ByteArray(b''.join(chr(byte)
1401
for byte in value))
1457
1402
prop(value)
1458
1403
1459
1404
@dbus.service.method(dbus.PROPERTIES_IFACE,
1492
1437
1493
1438
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1494
1439
out_signature="s",
1495
path_keyword="object_path",
1496
connection_keyword="connection")
1440
path_keyword='object_path',
1441
connection_keyword='connection')
1497
1442
def Introspect(self, object_path, connection):
1498
1443
"""Overloading of standard D-Bus method.
1499
1444
1555
1500
document.unlink()
1556
1501
except (AttributeError, xml.dom.DOMException,
1557
1502
xml.parsers.expat.ExpatError) as error:
1558
log.error("Failed to override Introspection method",
1559
exc_info=error)
1503
logger.error("Failed to override Introspection method",
1504
exc_info=error)
1560
1505
return xmlstring
1561
1506
1562
1507
1594
1539
1595
1540
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1596
1541
out_signature="s",
1597
path_keyword="object_path",
1598
connection_keyword="connection")
1542
path_keyword='object_path',
1543
connection_keyword='connection')
1599
1544
def Introspect(self, object_path, connection):
1600
1545
"""Overloading of standard D-Bus method.
1601
1546
1626
1571
document.unlink()
1627
1572
except (AttributeError, xml.dom.DOMException,
1628
1573
xml.parsers.expat.ExpatError) as error:
1629
log.error("Failed to override Introspection method",
1630
exc_info=error)
1574
logger.error("Failed to override Introspection method",
1575
exc_info=error)
1631
1576
return xmlstring
1632
1577
1633
1578
2264
2209
del _interface
2265
2210
2266
2211
2267
class ProxyClient:
2212
class ProxyClient(object):
2268
2213
def __init__(self, child_pipe, key_id, fpr, address):
2269
2214
self._pipe = child_pipe
2270
self._pipe.send(("init", key_id, fpr, address))
2215
self._pipe.send(('init', key_id, fpr, address))
2271
2216
if not self._pipe.recv():
2272
2217
raise KeyError(key_id or fpr)
2273
2218
2274
2219
def __getattribute__(self, name):
2275
if name == "_pipe":
2220
if name == '_pipe':
2276
2221
return super(ProxyClient, self).__getattribute__(name)
2277
self._pipe.send(("getattr", name))
2222
self._pipe.send(('getattr', name))
2278
2223
data = self._pipe.recv()
2279
if data[0] == "data":
2224
if data[0] == 'data':
2280
2225
return data[1]
2281
if data[0] == "function":
2226
if data[0] == 'function':
2282
2227
2283
2228
def func(*args, **kwargs):
2284
self._pipe.send(("funcall", name, args, kwargs))
2229
self._pipe.send(('funcall', name, args, kwargs))
2285
2230
return self._pipe.recv()[1]
2286
2231
2287
2232
return func
2288
2233
2289
2234
def __setattr__(self, name, value):
2290
if name == "_pipe":
2235
if name == '_pipe':
2291
2236
return super(ProxyClient, self).__setattr__(name, value)
2292
self._pipe.send(("setattr", name, value))
2237
self._pipe.send(('setattr', name, value))
2293
2238
2294
2239
2295
2240
class ClientHandler(socketserver.BaseRequestHandler, object):
2300
2245
2301
2246
def handle(self):
2302
2247
with contextlib.closing(self.server.child_pipe) as child_pipe:
2303
log.info("TCP connection from: %s",
2304
str(self.client_address))
2305
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2248
logger.info("TCP connection from: %s",
2249
str(self.client_address))
2250
logger.debug("Pipe FD: %d",
2251
self.server.child_pipe.fileno())
2306
2252
2307
2253
session = gnutls.ClientSession(self.request)
2308
2254
2309
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2255
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2310
2256
# "+AES-256-CBC", "+SHA1",
2311
2257
# "+COMP-NULL", "+CTYPE-OPENPGP",
2312
2258
# "+DHE-DSS"))
2314
2260
priority = self.server.gnutls_priority
2315
2261
if priority is None:
2316
2262
priority = "NORMAL"
2317
gnutls.priority_set_direct(session,
2318
priority.encode("utf-8"), None)
2263
gnutls.priority_set_direct(session._c_object,
2264
priority.encode("utf-8"),
2265
None)
2319
2266
2320
2267
# Start communication using the Mandos protocol
2321
2268
# Get protocol number
2322
2269
line = self.request.makefile().readline()
2323
log.debug("Protocol version: %r", line)
2270
logger.debug("Protocol version: %r", line)
2324
2271
try:
2325
2272
if int(line.strip().split()[0]) > 1:
2326
2273
raise RuntimeError(line)
2327
2274
except (ValueError, IndexError, RuntimeError) as error:
2328
log.error("Unknown protocol version: %s", error)
2275
logger.error("Unknown protocol version: %s", error)
2329
2276
return
2330
2277
2331
2278
# Start GnuTLS connection
2332
2279
try:
2333
2280
session.handshake()
2334
2281
except gnutls.Error as error:
2335
log.warning("Handshake failed: %s", error)
2282
logger.warning("Handshake failed: %s", error)
2336
2283
# Do not run session.bye() here: the session is not
2337
2284
# established. Just abandon the request.
2338
2285
return
2339
log.debug("Handshake succeeded")
2286
logger.debug("Handshake succeeded")
2340
2287
2341
2288
approval_required = False
2342
2289
try:
2346
2293
key_id = self.key_id(
2347
2294
self.peer_certificate(session))
2348
2295
except (TypeError, gnutls.Error) as error:
2349
log.warning("Bad certificate: %s", error)
2296
logger.warning("Bad certificate: %s", error)
2350
2297
return
2351
log.debug("Key ID: %s",
2352
key_id.decode("utf-8",
2353
errors="replace"))
2298
logger.debug("Key ID: %s", key_id)
2354
2299
2355
2300
else:
2356
2301
key_id = b""
2358
2303
fpr = self.fingerprint(
2359
2304
self.peer_certificate(session))
2360
2305
except (TypeError, gnutls.Error) as error:
2361
log.warning("Bad certificate: %s", error)
2306
logger.warning("Bad certificate: %s", error)
2362
2307
return
2363
log.debug("Fingerprint: %s", fpr)
2308
logger.debug("Fingerprint: %s", fpr)
2364
2309
2365
2310
try:
2366
2311
client = ProxyClient(child_pipe, key_id, fpr,
2375
2320
2376
2321
while True:
2377
2322
if not client.enabled:
2378
log.info("Client %s is disabled", client.name)
2323
logger.info("Client %s is disabled",
2324
client.name)
2379
2325
if self.server.use_dbus:
2380
2326
# Emit D-Bus signal
2381
2327
client.Rejected("Disabled")
2385
2331
# We are approved or approval is disabled
2386
2332
break
2387
2333
elif client.approved is None:
2388
log.info("Client %s needs approval",
2389
client.name)
2334
logger.info("Client %s needs approval",
2335
client.name)
2390
2336
if self.server.use_dbus:
2391
2337
# Emit D-Bus signal
2392
2338
client.NeedApproval(
2393
2339
client.approval_delay.total_seconds()
2394
2340
* 1000, client.approved_by_default)
2395
2341
else:
2396
log.warning("Client %s was not approved",
2397
client.name)
2342
logger.warning("Client %s was not approved",
2343
client.name)
2398
2344
if self.server.use_dbus:
2399
2345
# Emit D-Bus signal
2400
2346
client.Rejected("Denied")
2408
2354
time2 = datetime.datetime.now()
2409
2355
if (time2 - time) >= delay:
2410
2356
if not client.approved_by_default:
2411
log.warning("Client %s timed out while"
2412
" waiting for approval",
2413
client.name)
2357
logger.warning("Client %s timed out while"
2358
" waiting for approval",
2359
client.name)
2414
2360
if self.server.use_dbus:
2415
2361
# Emit D-Bus signal
2416
2362
client.Rejected("Approval timed out")
2423
2369
try:
2424
2370
session.send(client.secret)
2425
2371
except gnutls.Error as error:
2426
log.warning("gnutls send failed", exc_info=error)
2372
logger.warning("gnutls send failed",
2373
exc_info=error)
2427
2374
return
2428
2375
2429
log.info("Sending secret to %s", client.name)
2376
logger.info("Sending secret to %s", client.name)
2430
2377
# bump the timeout using extended_timeout
2431
2378
client.bump_timeout(client.extended_timeout)
2432
2379
if self.server.use_dbus:
2439
2386
try:
2440
2387
session.bye()
2441
2388
except gnutls.Error as error:
2442
log.warning("GnuTLS bye failed", exc_info=error)
2389
logger.warning("GnuTLS bye failed",
2390
exc_info=error)
2443
2391
2444
2392
@staticmethod
2445
2393
def peer_certificate(session):
2446
2394
"Return the peer's certificate as a bytestring"
2447
2395
try:
2448
cert_type = gnutls.certificate_type_get2(
2449
session, gnutls.CTYPE_PEERS)
2396
cert_type = gnutls.certificate_type_get2(session._c_object,
2397
gnutls.CTYPE_PEERS)
2450
2398
except AttributeError:
2451
cert_type = gnutls.certificate_type_get(session)
2399
cert_type = gnutls.certificate_type_get(session._c_object)
2452
2400
if gnutls.has_rawpk:
2453
2401
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2454
2402
else:
2455
2403
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2456
2404
# If not a valid certificate type...
2457
2405
if cert_type not in valid_cert_types:
2458
log.info("Cert type %r not in %r", cert_type,
2459
valid_cert_types)
2406
logger.info("Cert type %r not in %r", cert_type,
2407
valid_cert_types)
2460
2408
# ...return invalid data
2461
2409
return b""
2462
2410
list_size = ctypes.c_uint(1)
2463
2411
cert_list = (gnutls.certificate_get_peers
2464
(session, ctypes.byref(list_size)))
2412
(session._c_object, ctypes.byref(list_size)))
2465
2413
if not bool(cert_list) and list_size.value != 0:
2466
2414
raise gnutls.Error("error getting peer certificate")
2467
2415
if list_size.value == 0:
2489
2437
buf = ctypes.create_string_buffer(32)
2490
2438
buf_len = ctypes.c_size_t(len(buf))
2491
2439
# Get the key ID from the raw public key into the buffer
2492
gnutls.pubkey_get_key_id(
2493
pubkey,
2494
gnutls.KEYID_USE_SHA256,
2495
ctypes.cast(ctypes.byref(buf),
2496
ctypes.POINTER(ctypes.c_ubyte)),
2497
ctypes.byref(buf_len))
2440
gnutls.pubkey_get_key_id(pubkey,
2441
gnutls.KEYID_USE_SHA256,
2442
ctypes.cast(ctypes.byref(buf),
2443
ctypes.POINTER(ctypes.c_ubyte)),
2444
ctypes.byref(buf_len))
2498
2445
# Deinit the certificate
2499
2446
gnutls.pubkey_deinit(pubkey)
2500
2447
2541
2488
return hex_fpr
2542
2489
2543
2490
2544
class MultiprocessingMixIn:
2491
class MultiprocessingMixIn(object):
2545
2492
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2546
2493
2547
2494
def sub_process_main(self, request, address):
2559
2506
return proc
2560
2507
2561
2508
2562
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2509
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2563
2510
""" adds a pipe to the MixIn """
2564
2511
2565
2512
def process_request(self, request, client_address):
2580
2527
2581
2528
2582
2529
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2583
socketserver.TCPServer):
2584
"""IPv6-capable TCP server. Accepts None as address and/or port
2530
socketserver.TCPServer, object):
2531
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2585
2532
2586
2533
Attributes:
2587
2534
enabled: Boolean; whether this server is activated yet
2638
2585
if SO_BINDTODEVICE is None:
2639
2586
# Fall back to a hard-coded value which seems to be
2640
2587
# common enough.
2641
log.warning("SO_BINDTODEVICE not found, trying 25")
2588
logger.warning("SO_BINDTODEVICE not found, trying 25")
2642
2589
SO_BINDTODEVICE = 25
2643
2590
try:
2644
2591
self.socket.setsockopt(
2646
2593
(self.interface + "\0").encode("utf-8"))
2647
2594
except socket.error as error:
2648
2595
if error.errno == errno.EPERM:
2649
log.error("No permission to bind to interface %s",
2650
self.interface)
2596
logger.error("No permission to bind to"
2597
" interface %s", self.interface)
2651
2598
elif error.errno == errno.ENOPROTOOPT:
2652
log.error("SO_BINDTODEVICE not available; cannot"
2653
" bind to interface %s", self.interface)
2599
logger.error("SO_BINDTODEVICE not available;"
2600
" cannot bind to interface %s",
2601
self.interface)
2654
2602
elif error.errno == errno.ENODEV:
2655
log.error("Interface %s does not exist, cannot"
2656
" bind", self.interface)
2603
logger.error("Interface %s does not exist,"
2604
" cannot bind", self.interface)
2657
2605
else:
2658
2606
raise
2659
2607
# Only bind(2) the socket if we really need to.
2718
2666
def add_pipe(self, parent_pipe, proc):
2719
2667
# Call "handle_ipc" for both data and EOF events
2720
2668
GLib.io_add_watch(
2721
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2722
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2669
parent_pipe.fileno(),
2670
GLib.IO_IN | GLib.IO_HUP,
2723
2671
functools.partial(self.handle_ipc,
2724
2672
parent_pipe=parent_pipe,
2725
2673
proc=proc))
2738
2686
request = parent_pipe.recv()
2739
2687
command = request[0]
2740
2688
2741
if command == "init":
2689
if command == 'init':
2742
2690
key_id = request[1].decode("ascii")
2743
2691
fpr = request[2].decode("ascii")
2744
2692
address = request[3]
2745
2693
2746
2694
for c in self.clients.values():
2747
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2748
"27AE41E4649B934CA495991B7852B855"):
2695
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2749
2696
continue
2750
2697
if key_id and c.key_id == key_id:
2751
2698
client = c
2754
2701
client = c
2755
2702
break
2756
2703
else:
2757
log.info("Client not found for key ID: %s, address:"
2758
" %s", key_id or fpr, address)
2704
logger.info("Client not found for key ID: %s, address"
2705
": %s", key_id or fpr, address)
2759
2706
if self.use_dbus:
2760
2707
# Emit D-Bus signal
2761
2708
mandos_dbus_service.ClientNotFound(key_id or fpr,
2764
2711
return False
2765
2712
2766
2713
GLib.io_add_watch(
2767
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2768
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2714
parent_pipe.fileno(),
2715
GLib.IO_IN | GLib.IO_HUP,
2769
2716
functools.partial(self.handle_ipc,
2770
2717
parent_pipe=parent_pipe,
2771
2718
proc=proc,
2774
2721
# remove the old hook in favor of the new above hook on
2775
2722
# same fileno
2776
2723
return False
2777
if command == "funcall":
2724
if command == 'funcall':
2778
2725
funcname = request[1]
2779
2726
args = request[2]
2780
2727
kwargs = request[3]
2781
2728
2782
parent_pipe.send(("data", getattr(client_object,
2729
parent_pipe.send(('data', getattr(client_object,
2783
2730
funcname)(*args,
2784
2731
**kwargs)))
2785
2732
2786
if command == "getattr":
2733
if command == 'getattr':
2787
2734
attrname = request[1]
2788
2735
if isinstance(client_object.__getattribute__(attrname),
2789
collections.abc.Callable):
2790
parent_pipe.send(("function", ))
2736
collections.Callable):
2737
parent_pipe.send(('function', ))
2791
2738
else:
2792
2739
parent_pipe.send((
2793
"data", client_object.__getattribute__(attrname)))
2740
'data', client_object.__getattribute__(attrname)))
2794
2741
2795
if command == "setattr":
2742
if command == 'setattr':
2796
2743
attrname = request[1]
2797
2744
value = request[2]
2798
2745
setattr(client_object, attrname, value)
2803
2750
def rfc3339_duration_to_delta(duration):
2804
2751
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2805
2752
2806
>>> timedelta = datetime.timedelta
2807
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2808
True
2809
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2810
True
2811
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2812
True
2813
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2814
True
2815
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2816
True
2817
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2818
True
2819
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2820
True
2821
>>> del timedelta
2753
>>> rfc3339_duration_to_delta("P7D")
2754
datetime.timedelta(7)
2755
>>> rfc3339_duration_to_delta("PT60S")
2756
datetime.timedelta(0, 60)
2757
>>> rfc3339_duration_to_delta("PT60M")
2758
datetime.timedelta(0, 3600)
2759
>>> rfc3339_duration_to_delta("PT24H")
2760
datetime.timedelta(1)
2761
>>> rfc3339_duration_to_delta("P1W")
2762
datetime.timedelta(7)
2763
>>> rfc3339_duration_to_delta("PT5M30S")
2764
datetime.timedelta(0, 330)
2765
>>> rfc3339_duration_to_delta("P1DT3M20S")
2766
datetime.timedelta(1, 200)
2822
2767
"""
2823
2768
2824
2769
# Parsing an RFC 3339 duration with regular expressions is not
2904
2849
def string_to_delta(interval):
2905
2850
"""Parse a string and return a datetime.timedelta
2906
2851
2907
>>> string_to_delta("7d") == datetime.timedelta(7)
2908
True
2909
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2910
True
2911
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2912
True
2913
>>> string_to_delta("24h") == datetime.timedelta(1)
2914
True
2915
>>> string_to_delta("1w") == datetime.timedelta(7)
2916
True
2917
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2918
True
2852
>>> string_to_delta('7d')
2853
datetime.timedelta(7)
2854
>>> string_to_delta('60s')
2855
datetime.timedelta(0, 60)
2856
>>> string_to_delta('60m')
2857
datetime.timedelta(0, 3600)
2858
>>> string_to_delta('24h')
2859
datetime.timedelta(1)
2860
>>> string_to_delta('1w')
2861
datetime.timedelta(7)
2862
>>> string_to_delta('5m 30s')
2863
datetime.timedelta(0, 330)
2919
2864
"""
2920
2865
2921
2866
try:
3023
2968
3024
2969
options = parser.parse_args()
3025
2970
2971
if options.check:
2972
import doctest
2973
fail_count, test_count = doctest.testmod()
2974
sys.exit(os.EX_OK if fail_count == 0 else 1)
2975
3026
2976
# Default values for config file for server-global settings
3027
2977
if gnutls.has_rawpk:
3028
2978
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3048
2998
del priority
3049
2999
3050
3000
# Parse config file for server-global settings
3051
server_config = configparser.ConfigParser(server_defaults)
3001
server_config = configparser.SafeConfigParser(server_defaults)
3052
3002
del server_defaults
3053
3003
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3054
# Convert the ConfigParser object to a dict
3004
# Convert the SafeConfigParser object to a dict
3055
3005
server_settings = server_config.defaults()
3056
3006
# Use the appropriate methods on the non-string config options
3057
3007
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3124
3074
3125
3075
if server_settings["servicename"] != "Mandos":
3126
3076
syslogger.setFormatter(
3127
logging.Formatter("Mandos ({}) [%(process)d]:"
3128
" %(levelname)s: %(message)s".format(
3077
logging.Formatter('Mandos ({}) [%(process)d]:'
3078
' %(levelname)s: %(message)s'.format(
3129
3079
server_settings["servicename"])))
3130
3080
3131
3081
# Parse config file with clients
3132
client_config = configparser.ConfigParser(Client.client_defaults)
3082
client_config = configparser.SafeConfigParser(Client
3083
.client_defaults)
3133
3084
client_config.read(os.path.join(server_settings["configdir"],
3134
3085
"clients.conf"))
3135
3086
3155
3106
try:
3156
3107
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3157
3108
except IOError as e:
3158
log.error("Could not open file %r", pidfilename,
3159
exc_info=e)
3109
logger.error("Could not open file %r", pidfilename,
3110
exc_info=e)
3160
3111
3161
3112
for name, group in (("_mandos", "_mandos"),
3162
3113
("mandos", "mandos"),
3173
3124
try:
3174
3125
os.setgid(gid)
3175
3126
os.setuid(uid)
3176
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3127
if debug:
3128
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3129
gid))
3177
3130
except OSError as error:
3178
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3179
os.strerror(error.errno))
3131
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3132
.format(uid, gid, os.strerror(error.errno)))
3180
3133
if error.errno != errno.EPERM:
3181
3134
raise
3182
3135
3189
3142
3190
3143
@gnutls.log_func
3191
3144
def debug_gnutls(level, string):
3192
log.debug("GnuTLS: %s",
3193
string[:-1].decode("utf-8", errors="replace"))
3145
logger.debug("GnuTLS: %s", string[:-1])
3194
3146
3195
3147
gnutls.global_set_log_function(debug_gnutls)
3196
3148
3205
3157
# Close all input and output, do double fork, etc.
3206
3158
daemon()
3207
3159
3208
if gi.version_info < (3, 10, 2):
3209
# multiprocessing will use threads, so before we use GLib we
3210
# need to inform GLib that threads will be used.
3211
GLib.threads_init()
3160
# multiprocessing will use threads, so before we use GLib we need
3161
# to inform GLib that threads will be used.
3162
GLib.threads_init()
3212
3163
3213
3164
global main_loop
3214
3165
# From the Avahi example code
3225
3176
"se.bsnet.fukt.Mandos", bus,
3226
3177
do_not_queue=True)
3227
3178
except dbus.exceptions.DBusException as e:
3228
log.error("Disabling D-Bus:", exc_info=e)
3179
logger.error("Disabling D-Bus:", exc_info=e)
3229
3180
use_dbus = False
3230
3181
server_settings["use_dbus"] = False
3231
3182
tcp_server.use_dbus = False
3290
3241
if isinstance(s, bytes)
3291
3242
else s) for s in
3292
3243
value["client_structure"]]
3293
# .name, .host, and .checker_command
3294
for k in ("name", "host", "checker_command"):
3244
# .name & .host
3245
for k in ("name", "host"):
3295
3246
if isinstance(value[k], bytes):
3296
3247
value[k] = value[k].decode("utf-8")
3297
3248
if "key_id" not in value:
3307
3258
for key, value in
3308
3259
bytes_old_client_settings.items()}
3309
3260
del bytes_old_client_settings
3310
# .host and .checker_command
3261
# .host
3311
3262
for value in old_client_settings.values():
3312
for attribute in ("host", "checker_command"):
3313
if isinstance(value[attribute], bytes):
3314
value[attribute] = (value[attribute]
3315
.decode("utf-8"))
3263
if isinstance(value["host"], bytes):
3264
value["host"] = (value["host"]
3265
.decode("utf-8"))
3316
3266
os.remove(stored_state_path)
3317
3267
except IOError as e:
3318
3268
if e.errno == errno.ENOENT:
3319
log.warning("Could not load persistent state:"
3320
" %s", os.strerror(e.errno))
3269
logger.warning("Could not load persistent state:"
3270
" {}".format(os.strerror(e.errno)))
3321
3271
else:
3322
log.critical("Could not load persistent state:",
3323
exc_info=e)
3272
logger.critical("Could not load persistent state:",
3273
exc_info=e)
3324
3274
raise
3325
3275
except EOFError as e:
3326
log.warning("Could not load persistent state: EOFError:",
3327
exc_info=e)
3276
logger.warning("Could not load persistent state: "
3277
"EOFError:",
3278
exc_info=e)
3328
3279
3329
3280
with PGPEngine() as pgp:
3330
3281
for client_name, client in clients_data.items():
3357
3308
if client["enabled"]:
3358
3309
if datetime.datetime.utcnow() >= client["expires"]:
3359
3310
if not client["last_checked_ok"]:
3360
log.warning("disabling client %s - Client"
3361
" never performed a successful"
3362
" checker", client_name)
3311
logger.warning(
3312
"disabling client {} - Client never "
3313
"performed a successful checker".format(
3314
client_name))
3363
3315
client["enabled"] = False
3364
3316
elif client["last_checker_status"] != 0:
3365
log.warning("disabling client %s - Client"
3366
" last checker failed with error"
3367
" code %s", client_name,
3368
client["last_checker_status"])
3317
logger.warning(
3318
"disabling client {} - Client last"
3319
" checker failed with error code"
3320
" {}".format(
3321
client_name,
3322
client["last_checker_status"]))
3369
3323
client["enabled"] = False
3370
3324
else:
3371
3325
client["expires"] = (
3372
3326
datetime.datetime.utcnow()
3373
3327
+ client["timeout"])
3374
log.debug("Last checker succeeded, keeping %s"
3375
" enabled", client_name)
3328
logger.debug("Last checker succeeded,"
3329
" keeping {} enabled".format(
3330
client_name))
3376
3331
try:
3377
3332
client["secret"] = pgp.decrypt(
3378
3333
client["encrypted_secret"],
3379
3334
client_settings[client_name]["secret"])
3380
3335
except PGPError:
3381
3336
# If decryption fails, we use secret from new settings
3382
log.debug("Failed to decrypt %s old secret",
3383
client_name)
3337
logger.debug("Failed to decrypt {} old secret".format(
3338
client_name))
3384
3339
client["secret"] = (client_settings[client_name]
3385
3340
["secret"])
3386
3341
3400
3355
server_settings=server_settings)
3401
3356
3402
3357
if not tcp_server.clients:
3403
log.warning("No clients defined")
3358
logger.warning("No clients defined")
3404
3359
3405
3360
if not foreground:
3406
3361
if pidfile is not None:
3409
3364
with pidfile:
3410
3365
print(pid, file=pidfile)
3411
3366
except IOError:
3412
log.error("Could not write to file %r with PID %d",
3413
pidfilename, pid)
3367
logger.error("Could not write to file %r with PID %d",
3368
pidfilename, pid)
3414
3369
del pidfile
3415
3370
del pidfilename
3416
3371
3566
3521
3567
3522
try:
3568
3523
with tempfile.NamedTemporaryFile(
3569
mode="wb",
3524
mode='wb',
3570
3525
suffix=".pickle",
3571
prefix="clients-",
3526
prefix='clients-',
3572
3527
dir=os.path.dirname(stored_state_path),
3573
3528
delete=False) as stored_state:
3574
3529
pickle.dump((clients, client_settings), stored_state,
3582
3537
except NameError:
3583
3538
pass
3584
3539
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3585
log.warning("Could not save persistent state: %s",
3586
os.strerror(e.errno))
3540
logger.warning("Could not save persistent state: {}"
3541
.format(os.strerror(e.errno)))
3587
3542
else:
3588
log.warning("Could not save persistent state:",
3589
exc_info=e)
3543
logger.warning("Could not save persistent state:",
3544
exc_info=e)
3590
3545
raise
3591
3546
3592
3547
# Delete all clients, and settings from config
3618
3573
if zeroconf:
3619
3574
service.port = tcp_server.socket.getsockname()[1]
3620
3575
if use_ipv6:
3621
log.info("Now listening on address %r, port %d, flowinfo %d,"
3622
" scope_id %d", *tcp_server.socket.getsockname())
3576
logger.info("Now listening on address %r, port %d,"
3577
" flowinfo %d, scope_id %d",
3578
*tcp_server.socket.getsockname())
3623
3579
else: # IPv4
3624
log.info("Now listening on address %r, port %d",
3625
*tcp_server.socket.getsockname())
3580
logger.info("Now listening on address %r, port %d",
3581
*tcp_server.socket.getsockname())
3626
3582
3627
3583
# service.interface = tcp_server.socket.getsockname()[3]
3628
3584
3632
3588
try:
3633
3589
service.activate()
3634
3590
except dbus.exceptions.DBusException as error:
3635
log.critical("D-Bus Exception", exc_info=error)
3591
logger.critical("D-Bus Exception", exc_info=error)
3636
3592
cleanup()
3637
3593
sys.exit(1)
3638
3594
# End of Avahi example code
3639
3595
3640
GLib.io_add_watch(
3641
GLib.IOChannel.unix_new(tcp_server.fileno()),
3642
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3643
lambda *args, **kwargs: (tcp_server.handle_request
3644
(*args[2:], **kwargs) or True))
3596
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3597
lambda *args, **kwargs:
3598
(tcp_server.handle_request
3599
(*args[2:], **kwargs) or True))
3645
3600
3646
log.debug("Starting main loop")
3601
logger.debug("Starting main loop")
3647
3602
main_loop.run()
3648
3603
except AvahiError as error:
3649
log.critical("Avahi Error", exc_info=error)
3604
logger.critical("Avahi Error", exc_info=error)
3650
3605
cleanup()
3651
3606
sys.exit(1)
3652
3607
except KeyboardInterrupt:
3653
3608
if debug:
3654
3609
print("", file=sys.stderr)
3655
log.debug("Server received KeyboardInterrupt")
3656
log.debug("Server exiting")
3610
logger.debug("Server received KeyboardInterrupt")
3611
logger.debug("Server exiting")
3657
3612
# Must run before the D-Bus bus name gets deregistered
3658
3613
cleanup()
3659
3614
3660
3661
def parse_test_args():
3662
# type: () -> argparse.Namespace
3663
parser = argparse.ArgumentParser(add_help=False)
3664
parser.add_argument("--check", action="store_true")
3665
parser.add_argument("--prefix", )
3666
args, unknown_args = parser.parse_known_args()
3667
if args.check:
3668
# Remove test options from sys.argv
3669
sys.argv[1:] = unknown_args
3670
return args
3671
3672
# Add all tests from doctest strings
3673
def load_tests(loader, tests, none):
3674
import doctest
3675
tests.addTests(doctest.DocTestSuite())
3676
return tests
3677
3678
if __name__ == "__main__":
3679
options = parse_test_args()
3680
try:
3681
if options.check:
3682
extra_test_prefix = options.prefix
3683
if extra_test_prefix is not None:
3684
if not (unittest.main(argv=[""], exit=False)
3685
.result.wasSuccessful()):
3686
sys.exit(1)
3687
class ExtraTestLoader(unittest.TestLoader):
3688
testMethodPrefix = extra_test_prefix
3689
# Call using ./scriptname --test [--verbose]
3690
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3691
else:
3692
unittest.main(argv=[""])
3693
else:
3694
main()
3695
finally:
3696
logging.shutdown()
3697
3698
# Local Variables:
3699
# run-tests:
3700
# (lambda (&optional extra)
3701
# (if (not (funcall run-tests-in-test-buffer default-directory
3702
# extra))
3703
# (funcall show-test-buffer-in-test-window)
3704
# (funcall remove-test-window)
3705
# (if extra (message "Extra tests run successfully!"))))
3706
# run-tests-in-test-buffer:
3707
# (lambda (dir &optional extra)
3708
# (with-current-buffer (get-buffer-create "*Test*")
3709
# (setq buffer-read-only nil
3710
# default-directory dir)
3711
# (erase-buffer)
3712
# (compilation-mode))
3713
# (let ((process-result
3714
# (let ((inhibit-read-only t))
3715
# (process-file-shell-command
3716
# (funcall get-command-line extra) nil "*Test*"))))
3717
# (and (numberp process-result)
3718
# (= process-result 0))))
3719
# get-command-line:
3720
# (lambda (&optional extra)
3721
# (let ((quoted-script
3722
# (shell-quote-argument (funcall get-script-name))))
3723
# (format
3724
# (concat "%s --check" (if extra " --prefix=atest" ""))
3725
# quoted-script)))
3726
# get-script-name:
3727
# (lambda ()
3728
# (if (fboundp 'file-local-name)
3729
# (file-local-name (buffer-file-name))
3730
# (or (file-remote-p (buffer-file-name) 'localname)
3731
# (buffer-file-name))))
3732
# remove-test-window:
3733
# (lambda ()
3734
# (let ((test-window (get-buffer-window "*Test*")))
3735
# (if test-window (delete-window test-window))))
3736
# show-test-buffer-in-test-window:
3737
# (lambda ()
3738
# (when (not (get-buffer-window-list "*Test*"))
3739
# (setq next-error-last-buffer (get-buffer "*Test*"))
3740
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3741
# (display-buffer-overriding-action
3742
# `((display-buffer-in-side-window) (side . ,side)
3743
# (window-height . fit-window-to-buffer)
3744
# (window-width . fit-window-to-buffer))))
3745
# (display-buffer "*Test*"))))
3746
# eval:
3747
# (progn
3748
# (let* ((run-extra-tests (lambda () (interactive)
3749
# (funcall run-tests t)))
3750
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3751
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3752
# (setq minor-mode-overriding-map-alist
3753
# (cons `(run-tests . ,outer-keymap)
3754
# minor-mode-overriding-map-alist)))
3755
# (add-hook 'after-save-hook run-tests 90 t))
3756
# End:
3615
3616
if __name__ == '__main__':
3617
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0