/mandos/trunk : revision 1160

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

77

import itertools

78

import collections

79

import codecs

80

import unittest

81

import random

82

import shlex

83

80

84

81

import dbus

85

82

import dbus.service

93

90

94

91

if sys.version_info.major == 2:

95

92

__metaclass__ = type

96

str = unicode

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Show warnings by default

114

if not sys.warnoptions:

115

import warnings

116

warnings.simplefilter("default")

117

93

118

94

# Try to find the value of SO_BINDTODEVICE:

119

95

try:

140

116

# No value found

141

117

SO_BINDTODEVICE = None

142

118

119

if sys.version_info.major == 2:

120

str = unicode

121

143

122

if sys.version_info < (3, 2):

144

123

configparser.Configparser = configparser.SafeConfigParser

145

124

146

version = "1.8.9"

125

version = "1.8.7"

147

126

stored_state_file = "clients.pickle"

148

127

149

128

logger = logging.getLogger()

150

logging.captureWarnings(True) # Show warnings via the logging system

151

129

syslogger = None

152

130

153

131

try:

218

196

output = subprocess.check_output(["gpgconf"])

219

197

for line in output.splitlines():

220

198

name, text, path = line.split(b":")

221

if name == b"gpg":

199

if name == "gpg":

222

200

self.gpg = path

223

201

break

224

202

except OSError as e:

229

207

'--force-mdc',

230

208

'--quiet']

231

209

# Only GPG version 1 has the --no-use-agent option.

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

210

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

233

211

self.gnupgargs.append("--no-use-agent")

234

212

235

213

def __enter__(self):

1052

1030

if self.checker_initiator_tag is not None:

1053

1031

GLib.source_remove(self.checker_initiator_tag)

1054

1032

self.checker_initiator_tag = GLib.timeout_add(

1055

random.randrange(int(self.interval.total_seconds() * 1000

1056

+ 1)),

1033

int(self.interval.total_seconds() * 1000),

1057

1034

self.start_checker)

1058

1035

# Schedule a disable() when 'timeout' has passed

1059

1036

if self.disable_initiator_tag is not None:

1069

1046

# Read return code from connection (see call_pipe)

1070

1047

returncode = connection.recv()

1071

1048

connection.close()

1072

if self.checker is not None:

1073

self.checker.join()

1049

self.checker.join()

1074

1050

self.checker_callback_tag = None

1075

1051

self.checker = None

1076

1052

1134

1110

if self.checker is None:

1135

1111

# Escape attributes for the shell

1136

1112

escaped_attrs = {

1137

attr: shlex.quote(str(getattr(self, attr)))

1113

attr: re.escape(str(getattr(self, attr)))

1138

1114

for attr in self.runtime_expansions}

1139

1115

try:

1140

1116

command = self.checker_command % escaped_attrs

1167

1143

kwargs=popen_args)

1168

1144

self.checker.start()

1169

1145

self.checker_callback_tag = GLib.io_add_watch(

1170

GLib.IOChannel.unix_new(pipe[0].fileno()),

1171

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1146

pipe[0].fileno(), GLib.IO_IN,

1172

1147

self.checker_callback, pipe[0], command)

1173

1148

# Re-run this periodically if run by GLib.timeout_add

1174

1149

return True

1429

1404

raise ValueError("Byte arrays not supported for non-"

1430

1405

"'ay' signature {!r}"

1431

1406

.format(prop._dbus_signature))

1432

value = dbus.ByteArray(bytes(value))

1407

value = dbus.ByteArray(b''.join(chr(byte)

1408

for byte in value))

1433

1409

prop(value)

1434

1410

1435

1411

@dbus.service.method(dbus.PROPERTIES_IFACE,

2697

2673

def add_pipe(self, parent_pipe, proc):

2698

2674

# Call "handle_ipc" for both data and EOF events

2699

2675

GLib.io_add_watch(

2700

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2701

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2676

parent_pipe.fileno(),

2677

GLib.IO_IN | GLib.IO_HUP,

2702

2678

functools.partial(self.handle_ipc,

2703

2679

parent_pipe=parent_pipe,

2704

2680

proc=proc))

2742

2718

return False

2743

2719

2744

2720

GLib.io_add_watch(

2745

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2746

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2721

parent_pipe.fileno(),

2722

GLib.IO_IN | GLib.IO_HUP,

2747

2723

functools.partial(self.handle_ipc,

2748

2724

parent_pipe=parent_pipe,

2749

2725

proc=proc,

2764

2740

if command == 'getattr':

2765

2741

attrname = request[1]

2766

2742

if isinstance(client_object.__getattribute__(attrname),

2767

collections.abc.Callable):

2743

collections.Callable):

2768

2744

parent_pipe.send(('function', ))

2769

2745

else:

2770

2746

parent_pipe.send((

2781

2757

def rfc3339_duration_to_delta(duration):

2782

2758

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2783

2759

2784

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2785

True

2786

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2787

True

2788

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2789

True

2790

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2791

True

2792

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2793

True

2794

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2795

True

2796

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2797

True

2760

>>> rfc3339_duration_to_delta("P7D")

2761

datetime.timedelta(7)

2762

>>> rfc3339_duration_to_delta("PT60S")

2763

datetime.timedelta(0, 60)

2764

>>> rfc3339_duration_to_delta("PT60M")

2765

datetime.timedelta(0, 3600)

2766

>>> rfc3339_duration_to_delta("PT24H")

2767

datetime.timedelta(1)

2768

>>> rfc3339_duration_to_delta("P1W")

2769

datetime.timedelta(7)

2770

>>> rfc3339_duration_to_delta("PT5M30S")

2771

datetime.timedelta(0, 330)

2772

>>> rfc3339_duration_to_delta("P1DT3M20S")

2773

datetime.timedelta(1, 200)

2798

2774

"""

2799

2775

2800

2776

# Parsing an RFC 3339 duration with regular expressions is not

2880

2856

def string_to_delta(interval):

2881

2857

"""Parse a string and return a datetime.timedelta

2882

2858

2883

>>> string_to_delta('7d') == datetime.timedelta(7)

2884

True

2885

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2886

True

2887

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2888

True

2889

>>> string_to_delta('24h') == datetime.timedelta(1)

2890

True

2891

>>> string_to_delta('1w') == datetime.timedelta(7)

2892

True

2893

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2894

True

2859

>>> string_to_delta('7d')

2860

datetime.timedelta(7)

2861

>>> string_to_delta('60s')

2862

datetime.timedelta(0, 60)

2863

>>> string_to_delta('60m')

2864

datetime.timedelta(0, 3600)

2865

>>> string_to_delta('24h')

2866

datetime.timedelta(1)

2867

>>> string_to_delta('1w')

2868

datetime.timedelta(7)

2869

>>> string_to_delta('5m 30s')

2870

datetime.timedelta(0, 330)

2895

2871

"""

2896

2872

2897

2873

try:

2999

2975

3000

2976

options = parser.parse_args()

3001

2977

2978

if options.check:

2979

import doctest

2980

fail_count, test_count = doctest.testmod()

2981

sys.exit(os.EX_OK if fail_count == 0 else 1)

2982

3002

2983

# Default values for config file for server-global settings

3003

2984

if gnutls.has_rawpk:

3004

2985

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3267

3248

if isinstance(s, bytes)

3268

3249

else s) for s in

3269

3250

value["client_structure"]]

3270

# .name, .host, and .checker_command

3271

for k in ("name", "host", "checker_command"):

3251

# .name & .host

3252

for k in ("name", "host"):

3272

3253

if isinstance(value[k], bytes):

3273

3254

value[k] = value[k].decode("utf-8")

3274

3255

if "key_id" not in value:

3284

3265

for key, value in

3285

3266

bytes_old_client_settings.items()}

3286

3267

del bytes_old_client_settings

3287

# .host and .checker_command

3268

# .host

3288

3269

for value in old_client_settings.values():

3289

for attribute in ("host", "checker_command"):

3290

if isinstance(value[attribute], bytes):

3291

value[attribute] = (value[attribute]

3292

.decode("utf-8"))

3270

if isinstance(value["host"], bytes):

3271

value["host"] = (value["host"]

3272

.decode("utf-8"))

3293

3273

os.remove(stored_state_path)

3294

3274

except IOError as e:

3295

3275

if e.errno == errno.ENOENT:

3620

3600

sys.exit(1)

3621

3601

# End of Avahi example code

3622

3602

3623

GLib.io_add_watch(

3624

GLib.IOChannel.unix_new(tcp_server.fileno()),

3625

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3626

lambda *args, **kwargs: (tcp_server.handle_request

3627

(*args[2:], **kwargs) or True))

3603

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3604

lambda *args, **kwargs:

3605

(tcp_server.handle_request

3606

(*args[2:], **kwargs) or True))

3628

3607

3629

3608

logger.debug("Starting main loop")

3630

3609

main_loop.run()

3640

3619

# Must run before the D-Bus bus name gets deregistered

3641

3620

cleanup()

3642

3621

3643

3644

def should_only_run_tests():

3645

parser = argparse.ArgumentParser(add_help=False)

3646

parser.add_argument("--check", action='store_true')

3647

args, unknown_args = parser.parse_known_args()

3648

run_tests = args.check

3649

if run_tests:

3650

# Remove --check argument from sys.argv

3651

sys.argv[1:] = unknown_args

3652

return run_tests

3653

3654

# Add all tests from doctest strings

3655

def load_tests(loader, tests, none):

3656

import doctest

3657

tests.addTests(doctest.DocTestSuite())

3658

return tests

3659

3622

3660

3623

if __name__ == '__main__':

3661

try:

3662

if should_only_run_tests():

3663

# Call using ./mandos --check [--verbose]

3664

unittest.main()

3665

else:

3666

main()

3667

finally:

3668

logging.shutdown()

3624

main()