To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1164
- compare with another revision
- download diff
- download tarball
- view history from revision 1164
- Committer: Teddy Hogeborn
- Date: 2019-08-23 22:54:03 UTC
- Revision ID: teddy@recompile.se-20190823225403-vs9qlglgmbt2sihx
Client Debian package: Remove redundant build dependency
Since "systemd" is now included in "Build-Depends", it should be
removed from "Build-Depends-Indep".
* debian/control (Build-Depends-Indep): Remove "systemd".
Since "systemd" is now included in "Build-Depends", it should be
removed from "Build-Depends-Indep".
* debian/control (Build-Depends-Indep): Remove "systemd".
- files removed:
- debian/po/es.po
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
39
40
except ImportError:
40
41
pass
41
42
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
43
try:
48
44
import SocketServer as socketserver
49
45
except ImportError:
50
46
import socketserver
51
47
import socket
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
import ConfigParser as configparser
56
53
except ImportError:
57
54
import configparser
55
import sys
58
56
import re
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import random
81
import shlex
82
80
83
81
import dbus
84
82
import dbus.service
92
90
93
91
if sys.version_info.major == 2:
94
92
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
93
118
94
# Try to find the value of SO_BINDTODEVICE:
119
95
try:
140
116
# No value found
141
117
SO_BINDTODEVICE = None
142
118
119
if sys.version_info.major == 2:
120
str = unicode
121
143
122
if sys.version_info < (3, 2):
144
123
configparser.Configparser = configparser.SafeConfigParser
145
124
146
version = "1.8.16"
125
version = "1.8.8"
147
126
stored_state_file = "clients.pickle"
148
127
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
150
logging.captureWarnings(True) # Show warnings via the logging system
128
logger = logging.getLogger()
151
129
syslogger = None
152
130
153
131
try:
189
167
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
168
address="/dev/log"))
191
169
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
170
('Mandos [%(process)d]: %(levelname)s:'
171
' %(message)s'))
172
logger.addHandler(syslogger)
195
173
196
174
if debug:
197
175
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
176
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
177
' [%(process)d]:'
178
' %(levelname)s:'
179
' %(message)s'))
180
logger.addHandler(console)
181
logger.setLevel(level)
204
182
205
183
206
184
class PGPError(Exception):
218
196
output = subprocess.check_output(["gpgconf"])
219
197
for line in output.splitlines():
220
198
name, text, path = line.split(b":")
221
if name == b"gpg":
199
if name == "gpg":
222
200
self.gpg = path
223
201
break
224
202
except OSError as e:
225
203
if e.errno != errno.ENOENT:
226
204
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
205
self.gnupgargs = ['--batch',
206
'--homedir', self.tempdir,
207
'--force-mdc',
208
'--quiet']
231
209
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
210
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
233
211
self.gnupgargs.append("--no-use-agent")
234
212
235
213
def __enter__(self):
272
250
dir=self.tempdir) as passfile:
273
251
passfile.write(passphrase)
274
252
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
253
proc = subprocess.Popen([self.gpg, '--symmetric',
254
'--passphrase-file',
277
255
passfile.name]
278
256
+ self.gnupgargs,
279
257
stdin=subprocess.PIPE,
290
268
dir=self.tempdir) as passfile:
291
269
passfile.write(passphrase)
292
270
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
271
proc = subprocess.Popen([self.gpg, '--decrypt',
272
'--passphrase-file',
295
273
passfile.name]
296
274
+ self.gnupgargs,
297
275
stdin=subprocess.PIPE,
350
328
Attributes:
351
329
interface: integer; avahi.IF_UNSPEC or an interface index.
352
330
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
331
name: string; Example: 'Mandos'
332
type: string; Example: '_mandos._tcp'.
355
333
See <https://www.iana.org/assignments/service-names-port-numbers>
356
334
port: integer; what port to announce
357
335
TXT: list of strings; TXT record for the service
394
372
def rename(self, remove=True):
395
373
"""Derived from the Avahi example code"""
396
374
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
375
logger.critical("No suitable Zeroconf service name found"
376
" after %i retries, exiting.",
377
self.rename_count)
400
378
raise AvahiServiceError("Too many renames")
401
379
self.name = str(
402
380
self.server.GetAlternativeServiceName(self.name))
403
381
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
382
logger.info("Changing Zeroconf service name to %r ...",
383
self.name)
406
384
if remove:
407
385
self.remove()
408
386
try:
410
388
except dbus.exceptions.DBusException as error:
411
389
if (error.get_dbus_name()
412
390
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
391
logger.info("Local Zeroconf service name collision.")
414
392
return self.rename(remove=False)
415
393
else:
416
log.critical("D-Bus Exception", exc_info=error)
394
logger.critical("D-Bus Exception", exc_info=error)
417
395
self.cleanup()
418
396
os._exit(1)
419
397
435
413
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
414
self.entry_group_state_changed_match = (
437
415
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
416
'StateChanged', self.entry_group_state_changed))
417
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
418
self.name, self.type)
441
419
self.group.AddService(
442
420
self.interface,
443
421
self.protocol,
450
428
451
429
def entry_group_state_changed(self, state, error):
452
430
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
431
logger.debug("Avahi entry group state change: %i", state)
454
432
455
433
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
434
logger.debug("Zeroconf service established.")
457
435
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
436
logger.info("Zeroconf service name collision.")
459
437
self.rename()
460
438
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
439
logger.critical("Avahi: Error in group state changed %s",
440
str(error))
463
441
raise AvahiGroupError("State changed: {!s}".format(error))
464
442
465
443
def cleanup(self):
475
453
476
454
def server_state_changed(self, state, error=None):
477
455
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
456
logger.debug("Avahi server state change: %i", state)
479
457
bad_states = {
480
458
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
459
avahi.SERVER_REGISTERING: None,
485
463
if state in bad_states:
486
464
if bad_states[state] is not None:
487
465
if error is None:
488
log.error(bad_states[state])
466
logger.error(bad_states[state])
489
467
else:
490
log.error(bad_states[state] + ": %r", error)
468
logger.error(bad_states[state] + ": %r", error)
491
469
self.cleanup()
492
470
elif state == avahi.SERVER_RUNNING:
493
471
try:
495
473
except dbus.exceptions.DBusException as error:
496
474
if (error.get_dbus_name()
497
475
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
476
logger.info("Local Zeroconf service name"
477
" collision.")
499
478
return self.rename(remove=False)
500
479
else:
501
log.critical("D-Bus Exception", exc_info=error)
480
logger.critical("D-Bus Exception", exc_info=error)
502
481
self.cleanup()
503
482
os._exit(1)
504
483
else:
505
484
if error is None:
506
log.debug("Unknown state: %r", state)
485
logger.debug("Unknown state: %r", state)
507
486
else:
508
log.debug("Unknown state: %r: %r", state, error)
487
logger.debug("Unknown state: %r: %r", state, error)
509
488
510
489
def activate(self):
511
490
"""Derived from the Avahi example code"""
523
502
class AvahiServiceToSyslog(AvahiService):
524
503
def rename(self, *args, **kwargs):
525
504
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
505
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
528
506
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
507
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
508
.format(self.name)))
531
509
return ret
532
510
562
540
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
541
564
542
# Types
565
class _session_int(ctypes.Structure):
543
class session_int(ctypes.Structure):
566
544
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
545
session_t = ctypes.POINTER(session_int)
568
546
569
547
class certificate_credentials_st(ctypes.Structure):
570
548
_fields_ = []
573
551
certificate_type_t = ctypes.c_int
574
552
575
553
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
554
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
555
('size', ctypes.c_uint)]
578
556
579
class _openpgp_crt_int(ctypes.Structure):
557
class openpgp_crt_int(ctypes.Structure):
580
558
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
559
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
560
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
561
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
562
credentials_type_t = ctypes.c_int
593
571
# gnutls.strerror()
594
572
self.code = code
595
573
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
574
message = gnutls.strerror(code)
598
575
return super(gnutls.Error, self).__init__(
599
576
message, *args)
600
577
601
578
class CertificateSecurityError(Error):
602
579
pass
603
580
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
581
# Classes
630
class Credentials(With_from_param):
582
class Credentials:
631
583
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
584
self._c_object = gnutls.certificate_credentials_t()
585
gnutls.certificate_allocate_credentials(
586
ctypes.byref(self._c_object))
634
587
self.type = gnutls.CRD_CERTIFICATE
635
588
636
589
def __del__(self):
637
gnutls.certificate_free_credentials(self)
590
gnutls.certificate_free_credentials(self._c_object)
638
591
639
class ClientSession(With_from_param):
592
class ClientSession:
640
593
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
594
self._c_object = gnutls.session_t()
642
595
gnutls_flags = gnutls.CLIENT
643
596
if gnutls.check_version(b"3.5.6"):
644
597
gnutls_flags |= gnutls.NO_TICKETS
645
598
if gnutls.has_rawpk:
646
599
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
600
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
648
601
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
602
gnutls.set_default_priority(self._c_object)
603
gnutls.transport_set_ptr(self._c_object, socket.fileno())
604
gnutls.handshake_set_private_extensions(self._c_object,
605
True)
652
606
self.socket = socket
653
607
if credentials is None:
654
608
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
609
gnutls.credentials_set(self._c_object, credentials.type,
610
ctypes.cast(credentials._c_object,
611
ctypes.c_void_p))
657
612
self.credentials = credentials
658
613
659
614
def __del__(self):
660
gnutls.deinit(self)
615
gnutls.deinit(self._c_object)
661
616
662
617
def handshake(self):
663
return gnutls.handshake(self)
618
return gnutls.handshake(self._c_object)
664
619
665
620
def send(self, data):
666
621
data = bytes(data)
667
622
data_len = len(data)
668
623
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
624
data_len -= gnutls.record_send(self._c_object,
625
data[-data_len:],
670
626
data_len)
671
627
672
628
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
629
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
630
675
631
# Error handling functions
676
632
def _error_code(result):
677
633
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
634
for the 'restype' attribute on ctypes functions"""
635
if result >= 0:
680
636
return result
681
637
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
638
raise gnutls.CertificateSecurityError(code=result)
683
639
raise gnutls.Error(code=result)
684
640
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
641
def _retry_on_error(result, func, arguments):
687
642
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
643
for the 'errcheck' attribute on ctypes functions"""
644
while result < 0:
690
645
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
646
return _error_code(result)
692
647
result = func(*arguments)
697
652
698
653
# Functions
699
654
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
655
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
656
ctypes.POINTER(ctypes.c_char_p)]
702
657
priority_set_direct.restype = _error_code
703
658
704
659
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
660
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
661
init.restype = _error_code
707
662
708
663
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
664
set_default_priority.argtypes = [session_t]
710
665
set_default_priority.restype = _error_code
711
666
712
667
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
668
record_send.argtypes = [session_t, ctypes.c_void_p,
714
669
ctypes.c_size_t]
715
670
record_send.restype = ctypes.c_ssize_t
716
671
record_send.errcheck = _retry_on_error
718
673
certificate_allocate_credentials = (
719
674
_library.gnutls_certificate_allocate_credentials)
720
675
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
676
ctypes.POINTER(certificate_credentials_t)]
722
677
certificate_allocate_credentials.restype = _error_code
723
678
724
679
certificate_free_credentials = (
725
680
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
681
certificate_free_credentials.argtypes = [
682
certificate_credentials_t]
727
683
certificate_free_credentials.restype = None
728
684
729
685
handshake_set_private_extensions = (
730
686
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
687
handshake_set_private_extensions.argtypes = [session_t,
732
688
ctypes.c_int]
733
689
handshake_set_private_extensions.restype = None
734
690
735
691
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
692
credentials_set.argtypes = [session_t, credentials_type_t,
693
ctypes.c_void_p]
738
694
credentials_set.restype = _error_code
739
695
740
696
strerror = _library.gnutls_strerror
742
698
strerror.restype = ctypes.c_char_p
743
699
744
700
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
701
certificate_type_get.argtypes = [session_t]
746
702
certificate_type_get.restype = _error_code
747
703
748
704
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
705
certificate_get_peers.argtypes = [session_t,
750
706
ctypes.POINTER(ctypes.c_uint)]
751
707
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
708
759
715
global_set_log_function.restype = None
760
716
761
717
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
718
deinit.argtypes = [session_t]
763
719
deinit.restype = None
764
720
765
721
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
722
handshake.argtypes = [session_t]
723
handshake.restype = _error_code
768
724
handshake.errcheck = _retry_on_error
769
725
770
726
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
727
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
728
transport_set_ptr.restype = None
773
729
774
730
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
731
bye.argtypes = [session_t, close_request_t]
732
bye.restype = _error_code
777
733
bye.errcheck = _retry_on_error
778
734
779
735
check_version = _library.gnutls_check_version
796
752
797
753
x509_crt_fmt_t = ctypes.c_int
798
754
799
# All the function declarations below are from
800
# gnutls/abstract.h
755
# All the function declarations below are from gnutls/abstract.h
801
756
pubkey_init = _library.gnutls_pubkey_init
802
757
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
758
pubkey_init.restype = _error_code
817
772
pubkey_deinit.argtypes = [pubkey_t]
818
773
pubkey_deinit.restype = None
819
774
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
775
# All the function declarations below are from gnutls/openpgp.h
822
776
823
777
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
778
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
830
784
openpgp_crt_fmt_t]
831
785
openpgp_crt_import.restype = _error_code
832
786
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
787
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
788
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
789
ctypes.POINTER(ctypes.c_uint)]
840
790
openpgp_crt_verify_self.restype = _error_code
841
791
842
792
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
853
803
854
804
if check_version(b"3.6.4"):
855
805
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
806
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
857
807
certificate_type_get2.restype = _error_code
858
808
859
809
# Remove non-public functions
875
825
"""A representation of a client host served by this server.
876
826
877
827
Attributes:
878
approved: bool(); None if not yet approved/disapproved
828
approved: bool(); 'None' if not yet approved/disapproved
879
829
approval_delay: datetime.timedelta(); Time to wait for approval
880
830
approval_duration: datetime.timedelta(); Duration of one approval
881
831
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
832
to see if the client lives. 'None' if no process is
883
833
running.
884
834
checker_callback_tag: a GLib event source tag, or None
885
835
checker_command: string; External command which is run to check
1009
959
self.last_enabled = None
1010
960
self.expires = None
1011
961
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
962
logger.debug("Creating client %r", self.name)
963
logger.debug(" Key ID: %s", self.key_id)
964
logger.debug(" Fingerprint: %s", self.fingerprint)
1015
965
self.created = settings.get("created",
1016
966
datetime.datetime.utcnow())
1017
967
1045
995
if getattr(self, "enabled", False):
1046
996
# Already enabled
1047
997
return
998
self.expires = datetime.datetime.utcnow() + self.timeout
1048
999
self.enabled = True
1049
1000
self.last_enabled = datetime.datetime.utcnow()
1050
1001
self.init_checker()
1055
1006
if not getattr(self, "enabled", False):
1056
1007
return False
1057
1008
if not quiet:
1058
log.info("Disabling client %s", self.name)
1009
logger.info("Disabling client %s", self.name)
1059
1010
if getattr(self, "disable_initiator_tag", None) is not None:
1060
1011
GLib.source_remove(self.disable_initiator_tag)
1061
1012
self.disable_initiator_tag = None
1073
1024
def __del__(self):
1074
1025
self.disable()
1075
1026
1076
def init_checker(self, randomize_start=False):
1077
# Schedule a new checker to be started a randomly selected
1078
# time (a fraction of 'interval') from now. This spreads out
1079
# the startup of checkers over time when the server is
1080
# started.
1027
def init_checker(self):
1028
# Schedule a new checker to be started an 'interval' from now,
1029
# and every interval from then on.
1081
1030
if self.checker_initiator_tag is not None:
1082
1031
GLib.source_remove(self.checker_initiator_tag)
1083
interval_milliseconds = int(self.interval.total_seconds()
1084
* 1000)
1085
if randomize_start:
1086
delay_milliseconds = random.randrange(
1087
interval_milliseconds + 1)
1088
else:
1089
delay_milliseconds = interval_milliseconds
1090
1032
self.checker_initiator_tag = GLib.timeout_add(
1091
delay_milliseconds, self.start_checker, randomize_start)
1092
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1093
# A checker might take up to an 'interval' of time, so we can
1094
# expire at the soonest one interval after a checker was
1095
# started. Since the initial checker is delayed, the expire
1096
# time might have to be extended.
1097
now = datetime.datetime.utcnow()
1098
self.expires = now + delay + self.interval
1099
# Schedule a disable() at expire time
1033
int(self.interval.total_seconds() * 1000),
1034
self.start_checker)
1035
# Schedule a disable() when 'timeout' has passed
1100
1036
if self.disable_initiator_tag is not None:
1101
1037
GLib.source_remove(self.disable_initiator_tag)
1102
1038
self.disable_initiator_tag = GLib.timeout_add(
1103
int((self.expires - now).total_seconds() * 1000),
1104
self.disable)
1039
int(self.timeout.total_seconds() * 1000), self.disable)
1040
# Also start a new checker *right now*.
1041
self.start_checker()
1105
1042
1106
1043
def checker_callback(self, source, condition, connection,
1107
1044
command):
1109
1046
# Read return code from connection (see call_pipe)
1110
1047
returncode = connection.recv()
1111
1048
connection.close()
1112
if self.checker is not None:
1113
self.checker.join()
1049
self.checker.join()
1114
1050
self.checker_callback_tag = None
1115
1051
self.checker = None
1116
1052
1118
1054
self.last_checker_status = returncode
1119
1055
self.last_checker_signal = None
1120
1056
if self.last_checker_status == 0:
1121
log.info("Checker for %(name)s succeeded", vars(self))
1057
logger.info("Checker for %(name)s succeeded",
1058
vars(self))
1122
1059
self.checked_ok()
1123
1060
else:
1124
log.info("Checker for %(name)s failed", vars(self))
1061
logger.info("Checker for %(name)s failed", vars(self))
1125
1062
else:
1126
1063
self.last_checker_status = -1
1127
1064
self.last_checker_signal = -returncode
1128
log.warning("Checker for %(name)s crashed?", vars(self))
1065
logger.warning("Checker for %(name)s crashed?",
1066
vars(self))
1129
1067
return False
1130
1068
1131
1069
def checked_ok(self):
1150
1088
def need_approval(self):
1151
1089
self.last_approval_request = datetime.datetime.utcnow()
1152
1090
1153
def start_checker(self, start_was_randomized=False):
1091
def start_checker(self):
1154
1092
"""Start a new checker subprocess if one is not running.
1155
1093
1156
1094
If a checker already exists, leave it running and do
1165
1103
# should be.
1166
1104
1167
1105
if self.checker is not None and not self.checker.is_alive():
1168
log.warning("Checker was not alive; joining")
1106
logger.warning("Checker was not alive; joining")
1169
1107
self.checker.join()
1170
1108
self.checker = None
1171
1109
# Start a new checker if needed
1172
1110
if self.checker is None:
1173
1111
# Escape attributes for the shell
1174
1112
escaped_attrs = {
1175
attr: shlex.quote(str(getattr(self, attr)))
1113
attr: re.escape(str(getattr(self, attr)))
1176
1114
for attr in self.runtime_expansions}
1177
1115
try:
1178
1116
command = self.checker_command % escaped_attrs
1179
1117
except TypeError as error:
1180
log.error('Could not format string "%s"',
1181
self.checker_command, exc_info=error)
1118
logger.error('Could not format string "%s"',
1119
self.checker_command,
1120
exc_info=error)
1182
1121
return True # Try again later
1183
1122
self.current_checker_command = command
1184
log.info("Starting checker %r for %s", command, self.name)
1123
logger.info("Starting checker %r for %s", command,
1124
self.name)
1185
1125
# We don't need to redirect stdout and stderr, since
1186
1126
# in normal mode, that is already done by daemon(),
1187
1127
# and in debug mode we don't want to. (Stdin is
1203
1143
kwargs=popen_args)
1204
1144
self.checker.start()
1205
1145
self.checker_callback_tag = GLib.io_add_watch(
1206
GLib.IOChannel.unix_new(pipe[0].fileno()),
1207
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1146
pipe[0].fileno(), GLib.IO_IN,
1208
1147
self.checker_callback, pipe[0], command)
1209
if start_was_randomized:
1210
# We were started after a random delay; Schedule a new
1211
# checker to be started an 'interval' from now, and every
1212
# interval from then on.
1213
now = datetime.datetime.utcnow()
1214
self.checker_initiator_tag = GLib.timeout_add(
1215
int(self.interval.total_seconds() * 1000),
1216
self.start_checker)
1217
self.expires = max(self.expires, now + self.interval)
1218
# Don't start a new checker again after same random delay
1219
return False
1220
1148
# Re-run this periodically if run by GLib.timeout_add
1221
1149
return True
1222
1150
1227
1155
self.checker_callback_tag = None
1228
1156
if getattr(self, "checker", None) is None:
1229
1157
return
1230
log.debug("Stopping checker for %(name)s", vars(self))
1158
logger.debug("Stopping checker for %(name)s", vars(self))
1231
1159
self.checker.terminate()
1232
1160
self.checker = None
1233
1161
1260
1188
func._dbus_name = func.__name__
1261
1189
if func._dbus_name.endswith("_dbus_property"):
1262
1190
func._dbus_name = func._dbus_name[:-14]
1263
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1191
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1264
1192
return func
1265
1193
1266
1194
return decorator
1355
1283
1356
1284
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1357
1285
out_signature="s",
1358
path_keyword="object_path",
1359
connection_keyword="connection")
1286
path_keyword='object_path',
1287
connection_keyword='connection')
1360
1288
def Introspect(self, object_path, connection):
1361
1289
"""Overloading of standard D-Bus method.
1362
1290
1411
1339
document.unlink()
1412
1340
except (AttributeError, xml.dom.DOMException,
1413
1341
xml.parsers.expat.ExpatError) as error:
1414
log.error("Failed to override Introspection method",
1415
exc_info=error)
1342
logger.error("Failed to override Introspection method",
1343
exc_info=error)
1416
1344
return xmlstring
1417
1345
1418
1346
1476
1404
raise ValueError("Byte arrays not supported for non-"
1477
1405
"'ay' signature {!r}"
1478
1406
.format(prop._dbus_signature))
1479
value = dbus.ByteArray(bytes(value))
1407
value = dbus.ByteArray(b''.join(chr(byte)
1408
for byte in value))
1480
1409
prop(value)
1481
1410
1482
1411
@dbus.service.method(dbus.PROPERTIES_IFACE,
1515
1444
1516
1445
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1517
1446
out_signature="s",
1518
path_keyword="object_path",
1519
connection_keyword="connection")
1447
path_keyword='object_path',
1448
connection_keyword='connection')
1520
1449
def Introspect(self, object_path, connection):
1521
1450
"""Overloading of standard D-Bus method.
1522
1451
1578
1507
document.unlink()
1579
1508
except (AttributeError, xml.dom.DOMException,
1580
1509
xml.parsers.expat.ExpatError) as error:
1581
log.error("Failed to override Introspection method",
1582
exc_info=error)
1510
logger.error("Failed to override Introspection method",
1511
exc_info=error)
1583
1512
return xmlstring
1584
1513
1585
1514
1617
1546
1618
1547
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1619
1548
out_signature="s",
1620
path_keyword="object_path",
1621
connection_keyword="connection")
1549
path_keyword='object_path',
1550
connection_keyword='connection')
1622
1551
def Introspect(self, object_path, connection):
1623
1552
"""Overloading of standard D-Bus method.
1624
1553
1649
1578
document.unlink()
1650
1579
except (AttributeError, xml.dom.DOMException,
1651
1580
xml.parsers.expat.ExpatError) as error:
1652
log.error("Failed to override Introspection method",
1653
exc_info=error)
1581
logger.error("Failed to override Introspection method",
1582
exc_info=error)
1654
1583
return xmlstring
1655
1584
1656
1585
2290
2219
class ProxyClient:
2291
2220
def __init__(self, child_pipe, key_id, fpr, address):
2292
2221
self._pipe = child_pipe
2293
self._pipe.send(("init", key_id, fpr, address))
2222
self._pipe.send(('init', key_id, fpr, address))
2294
2223
if not self._pipe.recv():
2295
2224
raise KeyError(key_id or fpr)
2296
2225
2297
2226
def __getattribute__(self, name):
2298
if name == "_pipe":
2227
if name == '_pipe':
2299
2228
return super(ProxyClient, self).__getattribute__(name)
2300
self._pipe.send(("getattr", name))
2229
self._pipe.send(('getattr', name))
2301
2230
data = self._pipe.recv()
2302
if data[0] == "data":
2231
if data[0] == 'data':
2303
2232
return data[1]
2304
if data[0] == "function":
2233
if data[0] == 'function':
2305
2234
2306
2235
def func(*args, **kwargs):
2307
self._pipe.send(("funcall", name, args, kwargs))
2236
self._pipe.send(('funcall', name, args, kwargs))
2308
2237
return self._pipe.recv()[1]
2309
2238
2310
2239
return func
2311
2240
2312
2241
def __setattr__(self, name, value):
2313
if name == "_pipe":
2242
if name == '_pipe':
2314
2243
return super(ProxyClient, self).__setattr__(name, value)
2315
self._pipe.send(("setattr", name, value))
2244
self._pipe.send(('setattr', name, value))
2316
2245
2317
2246
2318
2247
class ClientHandler(socketserver.BaseRequestHandler, object):
2323
2252
2324
2253
def handle(self):
2325
2254
with contextlib.closing(self.server.child_pipe) as child_pipe:
2326
log.info("TCP connection from: %s",
2327
str(self.client_address))
2328
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2255
logger.info("TCP connection from: %s",
2256
str(self.client_address))
2257
logger.debug("Pipe FD: %d",
2258
self.server.child_pipe.fileno())
2329
2259
2330
2260
session = gnutls.ClientSession(self.request)
2331
2261
2332
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2262
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2333
2263
# "+AES-256-CBC", "+SHA1",
2334
2264
# "+COMP-NULL", "+CTYPE-OPENPGP",
2335
2265
# "+DHE-DSS"))
2337
2267
priority = self.server.gnutls_priority
2338
2268
if priority is None:
2339
2269
priority = "NORMAL"
2340
gnutls.priority_set_direct(session,
2341
priority.encode("utf-8"), None)
2270
gnutls.priority_set_direct(session._c_object,
2271
priority.encode("utf-8"),
2272
None)
2342
2273
2343
2274
# Start communication using the Mandos protocol
2344
2275
# Get protocol number
2345
2276
line = self.request.makefile().readline()
2346
log.debug("Protocol version: %r", line)
2277
logger.debug("Protocol version: %r", line)
2347
2278
try:
2348
2279
if int(line.strip().split()[0]) > 1:
2349
2280
raise RuntimeError(line)
2350
2281
except (ValueError, IndexError, RuntimeError) as error:
2351
log.error("Unknown protocol version: %s", error)
2282
logger.error("Unknown protocol version: %s", error)
2352
2283
return
2353
2284
2354
2285
# Start GnuTLS connection
2355
2286
try:
2356
2287
session.handshake()
2357
2288
except gnutls.Error as error:
2358
log.warning("Handshake failed: %s", error)
2289
logger.warning("Handshake failed: %s", error)
2359
2290
# Do not run session.bye() here: the session is not
2360
2291
# established. Just abandon the request.
2361
2292
return
2362
log.debug("Handshake succeeded")
2293
logger.debug("Handshake succeeded")
2363
2294
2364
2295
approval_required = False
2365
2296
try:
2369
2300
key_id = self.key_id(
2370
2301
self.peer_certificate(session))
2371
2302
except (TypeError, gnutls.Error) as error:
2372
log.warning("Bad certificate: %s", error)
2303
logger.warning("Bad certificate: %s", error)
2373
2304
return
2374
log.debug("Key ID: %s",
2375
key_id.decode("utf-8",
2376
errors="replace"))
2305
logger.debug("Key ID: %s", key_id)
2377
2306
2378
2307
else:
2379
2308
key_id = b""
2381
2310
fpr = self.fingerprint(
2382
2311
self.peer_certificate(session))
2383
2312
except (TypeError, gnutls.Error) as error:
2384
log.warning("Bad certificate: %s", error)
2313
logger.warning("Bad certificate: %s", error)
2385
2314
return
2386
log.debug("Fingerprint: %s", fpr)
2315
logger.debug("Fingerprint: %s", fpr)
2387
2316
2388
2317
try:
2389
2318
client = ProxyClient(child_pipe, key_id, fpr,
2398
2327
2399
2328
while True:
2400
2329
if not client.enabled:
2401
log.info("Client %s is disabled", client.name)
2330
logger.info("Client %s is disabled",
2331
client.name)
2402
2332
if self.server.use_dbus:
2403
2333
# Emit D-Bus signal
2404
2334
client.Rejected("Disabled")
2408
2338
# We are approved or approval is disabled
2409
2339
break
2410
2340
elif client.approved is None:
2411
log.info("Client %s needs approval",
2412
client.name)
2341
logger.info("Client %s needs approval",
2342
client.name)
2413
2343
if self.server.use_dbus:
2414
2344
# Emit D-Bus signal
2415
2345
client.NeedApproval(
2416
2346
client.approval_delay.total_seconds()
2417
2347
* 1000, client.approved_by_default)
2418
2348
else:
2419
log.warning("Client %s was not approved",
2420
client.name)
2349
logger.warning("Client %s was not approved",
2350
client.name)
2421
2351
if self.server.use_dbus:
2422
2352
# Emit D-Bus signal
2423
2353
client.Rejected("Denied")
2431
2361
time2 = datetime.datetime.now()
2432
2362
if (time2 - time) >= delay:
2433
2363
if not client.approved_by_default:
2434
log.warning("Client %s timed out while"
2435
" waiting for approval",
2436
client.name)
2364
logger.warning("Client %s timed out while"
2365
" waiting for approval",
2366
client.name)
2437
2367
if self.server.use_dbus:
2438
2368
# Emit D-Bus signal
2439
2369
client.Rejected("Approval timed out")
2446
2376
try:
2447
2377
session.send(client.secret)
2448
2378
except gnutls.Error as error:
2449
log.warning("gnutls send failed", exc_info=error)
2379
logger.warning("gnutls send failed",
2380
exc_info=error)
2450
2381
return
2451
2382
2452
log.info("Sending secret to %s", client.name)
2383
logger.info("Sending secret to %s", client.name)
2453
2384
# bump the timeout using extended_timeout
2454
2385
client.bump_timeout(client.extended_timeout)
2455
2386
if self.server.use_dbus:
2462
2393
try:
2463
2394
session.bye()
2464
2395
except gnutls.Error as error:
2465
log.warning("GnuTLS bye failed", exc_info=error)
2396
logger.warning("GnuTLS bye failed",
2397
exc_info=error)
2466
2398
2467
2399
@staticmethod
2468
2400
def peer_certificate(session):
2469
2401
"Return the peer's certificate as a bytestring"
2470
2402
try:
2471
cert_type = gnutls.certificate_type_get2(
2472
session, gnutls.CTYPE_PEERS)
2403
cert_type = gnutls.certificate_type_get2(session._c_object,
2404
gnutls.CTYPE_PEERS)
2473
2405
except AttributeError:
2474
cert_type = gnutls.certificate_type_get(session)
2406
cert_type = gnutls.certificate_type_get(session._c_object)
2475
2407
if gnutls.has_rawpk:
2476
2408
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2477
2409
else:
2478
2410
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2479
2411
# If not a valid certificate type...
2480
2412
if cert_type not in valid_cert_types:
2481
log.info("Cert type %r not in %r", cert_type,
2482
valid_cert_types)
2413
logger.info("Cert type %r not in %r", cert_type,
2414
valid_cert_types)
2483
2415
# ...return invalid data
2484
2416
return b""
2485
2417
list_size = ctypes.c_uint(1)
2486
2418
cert_list = (gnutls.certificate_get_peers
2487
(session, ctypes.byref(list_size)))
2419
(session._c_object, ctypes.byref(list_size)))
2488
2420
if not bool(cert_list) and list_size.value != 0:
2489
2421
raise gnutls.Error("error getting peer certificate")
2490
2422
if list_size.value == 0:
2512
2444
buf = ctypes.create_string_buffer(32)
2513
2445
buf_len = ctypes.c_size_t(len(buf))
2514
2446
# Get the key ID from the raw public key into the buffer
2515
gnutls.pubkey_get_key_id(
2516
pubkey,
2517
gnutls.KEYID_USE_SHA256,
2518
ctypes.cast(ctypes.byref(buf),
2519
ctypes.POINTER(ctypes.c_ubyte)),
2520
ctypes.byref(buf_len))
2447
gnutls.pubkey_get_key_id(pubkey,
2448
gnutls.KEYID_USE_SHA256,
2449
ctypes.cast(ctypes.byref(buf),
2450
ctypes.POINTER(ctypes.c_ubyte)),
2451
ctypes.byref(buf_len))
2521
2452
# Deinit the certificate
2522
2453
gnutls.pubkey_deinit(pubkey)
2523
2454
2604
2535
2605
2536
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2606
2537
socketserver.TCPServer):
2607
"""IPv6-capable TCP server. Accepts None as address and/or port
2538
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2608
2539
2609
2540
Attributes:
2610
2541
enabled: Boolean; whether this server is activated yet
2661
2592
if SO_BINDTODEVICE is None:
2662
2593
# Fall back to a hard-coded value which seems to be
2663
2594
# common enough.
2664
log.warning("SO_BINDTODEVICE not found, trying 25")
2595
logger.warning("SO_BINDTODEVICE not found, trying 25")
2665
2596
SO_BINDTODEVICE = 25
2666
2597
try:
2667
2598
self.socket.setsockopt(
2669
2600
(self.interface + "\0").encode("utf-8"))
2670
2601
except socket.error as error:
2671
2602
if error.errno == errno.EPERM:
2672
log.error("No permission to bind to interface %s",
2673
self.interface)
2603
logger.error("No permission to bind to"
2604
" interface %s", self.interface)
2674
2605
elif error.errno == errno.ENOPROTOOPT:
2675
log.error("SO_BINDTODEVICE not available; cannot"
2676
" bind to interface %s", self.interface)
2606
logger.error("SO_BINDTODEVICE not available;"
2607
" cannot bind to interface %s",
2608
self.interface)
2677
2609
elif error.errno == errno.ENODEV:
2678
log.error("Interface %s does not exist, cannot"
2679
" bind", self.interface)
2610
logger.error("Interface %s does not exist,"
2611
" cannot bind", self.interface)
2680
2612
else:
2681
2613
raise
2682
2614
# Only bind(2) the socket if we really need to.
2741
2673
def add_pipe(self, parent_pipe, proc):
2742
2674
# Call "handle_ipc" for both data and EOF events
2743
2675
GLib.io_add_watch(
2744
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2745
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2676
parent_pipe.fileno(),
2677
GLib.IO_IN | GLib.IO_HUP,
2746
2678
functools.partial(self.handle_ipc,
2747
2679
parent_pipe=parent_pipe,
2748
2680
proc=proc))
2761
2693
request = parent_pipe.recv()
2762
2694
command = request[0]
2763
2695
2764
if command == "init":
2696
if command == 'init':
2765
2697
key_id = request[1].decode("ascii")
2766
2698
fpr = request[2].decode("ascii")
2767
2699
address = request[3]
2768
2700
2769
2701
for c in self.clients.values():
2770
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2771
"27AE41E4649B934CA495991B7852B855"):
2702
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2772
2703
continue
2773
2704
if key_id and c.key_id == key_id:
2774
2705
client = c
2777
2708
client = c
2778
2709
break
2779
2710
else:
2780
log.info("Client not found for key ID: %s, address:"
2781
" %s", key_id or fpr, address)
2711
logger.info("Client not found for key ID: %s, address"
2712
": %s", key_id or fpr, address)
2782
2713
if self.use_dbus:
2783
2714
# Emit D-Bus signal
2784
2715
mandos_dbus_service.ClientNotFound(key_id or fpr,
2787
2718
return False
2788
2719
2789
2720
GLib.io_add_watch(
2790
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2791
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2721
parent_pipe.fileno(),
2722
GLib.IO_IN | GLib.IO_HUP,
2792
2723
functools.partial(self.handle_ipc,
2793
2724
parent_pipe=parent_pipe,
2794
2725
proc=proc,
2797
2728
# remove the old hook in favor of the new above hook on
2798
2729
# same fileno
2799
2730
return False
2800
if command == "funcall":
2731
if command == 'funcall':
2801
2732
funcname = request[1]
2802
2733
args = request[2]
2803
2734
kwargs = request[3]
2804
2735
2805
parent_pipe.send(("data", getattr(client_object,
2736
parent_pipe.send(('data', getattr(client_object,
2806
2737
funcname)(*args,
2807
2738
**kwargs)))
2808
2739
2809
if command == "getattr":
2740
if command == 'getattr':
2810
2741
attrname = request[1]
2811
2742
if isinstance(client_object.__getattribute__(attrname),
2812
collections.abc.Callable):
2813
parent_pipe.send(("function", ))
2743
collections.Callable):
2744
parent_pipe.send(('function', ))
2814
2745
else:
2815
2746
parent_pipe.send((
2816
"data", client_object.__getattribute__(attrname)))
2747
'data', client_object.__getattribute__(attrname)))
2817
2748
2818
if command == "setattr":
2749
if command == 'setattr':
2819
2750
attrname = request[1]
2820
2751
value = request[2]
2821
2752
setattr(client_object, attrname, value)
2826
2757
def rfc3339_duration_to_delta(duration):
2827
2758
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2828
2759
2829
>>> timedelta = datetime.timedelta
2830
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2831
True
2832
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2833
True
2834
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2835
True
2836
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2837
True
2838
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2839
True
2840
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2841
True
2842
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2843
True
2844
>>> del timedelta
2760
>>> rfc3339_duration_to_delta("P7D")
2761
datetime.timedelta(7)
2762
>>> rfc3339_duration_to_delta("PT60S")
2763
datetime.timedelta(0, 60)
2764
>>> rfc3339_duration_to_delta("PT60M")
2765
datetime.timedelta(0, 3600)
2766
>>> rfc3339_duration_to_delta("PT24H")
2767
datetime.timedelta(1)
2768
>>> rfc3339_duration_to_delta("P1W")
2769
datetime.timedelta(7)
2770
>>> rfc3339_duration_to_delta("PT5M30S")
2771
datetime.timedelta(0, 330)
2772
>>> rfc3339_duration_to_delta("P1DT3M20S")
2773
datetime.timedelta(1, 200)
2845
2774
"""
2846
2775
2847
2776
# Parsing an RFC 3339 duration with regular expressions is not
2927
2856
def string_to_delta(interval):
2928
2857
"""Parse a string and return a datetime.timedelta
2929
2858
2930
>>> string_to_delta("7d") == datetime.timedelta(7)
2931
True
2932
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2933
True
2934
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2935
True
2936
>>> string_to_delta("24h") == datetime.timedelta(1)
2937
True
2938
>>> string_to_delta("1w") == datetime.timedelta(7)
2939
True
2940
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2941
True
2859
>>> string_to_delta('7d')
2860
datetime.timedelta(7)
2861
>>> string_to_delta('60s')
2862
datetime.timedelta(0, 60)
2863
>>> string_to_delta('60m')
2864
datetime.timedelta(0, 3600)
2865
>>> string_to_delta('24h')
2866
datetime.timedelta(1)
2867
>>> string_to_delta('1w')
2868
datetime.timedelta(7)
2869
>>> string_to_delta('5m 30s')
2870
datetime.timedelta(0, 330)
2942
2871
"""
2943
2872
2944
2873
try:
3046
2975
3047
2976
options = parser.parse_args()
3048
2977
2978
if options.check:
2979
import doctest
2980
fail_count, test_count = doctest.testmod()
2981
sys.exit(os.EX_OK if fail_count == 0 else 1)
2982
3049
2983
# Default values for config file for server-global settings
3050
2984
if gnutls.has_rawpk:
3051
2985
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3147
3081
3148
3082
if server_settings["servicename"] != "Mandos":
3149
3083
syslogger.setFormatter(
3150
logging.Formatter("Mandos ({}) [%(process)d]:"
3151
" %(levelname)s: %(message)s".format(
3084
logging.Formatter('Mandos ({}) [%(process)d]:'
3085
' %(levelname)s: %(message)s'.format(
3152
3086
server_settings["servicename"])))
3153
3087
3154
3088
# Parse config file with clients
3178
3112
try:
3179
3113
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3180
3114
except IOError as e:
3181
log.error("Could not open file %r", pidfilename,
3182
exc_info=e)
3115
logger.error("Could not open file %r", pidfilename,
3116
exc_info=e)
3183
3117
3184
3118
for name, group in (("_mandos", "_mandos"),
3185
3119
("mandos", "mandos"),
3196
3130
try:
3197
3131
os.setgid(gid)
3198
3132
os.setuid(uid)
3199
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3133
if debug:
3134
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3135
gid))
3200
3136
except OSError as error:
3201
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3202
os.strerror(error.errno))
3137
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3138
.format(uid, gid, os.strerror(error.errno)))
3203
3139
if error.errno != errno.EPERM:
3204
3140
raise
3205
3141
3212
3148
3213
3149
@gnutls.log_func
3214
3150
def debug_gnutls(level, string):
3215
log.debug("GnuTLS: %s",
3216
string[:-1].decode("utf-8", errors="replace"))
3151
logger.debug("GnuTLS: %s", string[:-1])
3217
3152
3218
3153
gnutls.global_set_log_function(debug_gnutls)
3219
3154
3248
3183
"se.bsnet.fukt.Mandos", bus,
3249
3184
do_not_queue=True)
3250
3185
except dbus.exceptions.DBusException as e:
3251
log.error("Disabling D-Bus:", exc_info=e)
3186
logger.error("Disabling D-Bus:", exc_info=e)
3252
3187
use_dbus = False
3253
3188
server_settings["use_dbus"] = False
3254
3189
tcp_server.use_dbus = False
3313
3248
if isinstance(s, bytes)
3314
3249
else s) for s in
3315
3250
value["client_structure"]]
3316
# .name, .host, and .checker_command
3317
for k in ("name", "host", "checker_command"):
3251
# .name & .host
3252
for k in ("name", "host"):
3318
3253
if isinstance(value[k], bytes):
3319
3254
value[k] = value[k].decode("utf-8")
3320
3255
if "key_id" not in value:
3330
3265
for key, value in
3331
3266
bytes_old_client_settings.items()}
3332
3267
del bytes_old_client_settings
3333
# .host and .checker_command
3268
# .host
3334
3269
for value in old_client_settings.values():
3335
for attribute in ("host", "checker_command"):
3336
if isinstance(value[attribute], bytes):
3337
value[attribute] = (value[attribute]
3338
.decode("utf-8"))
3270
if isinstance(value["host"], bytes):
3271
value["host"] = (value["host"]
3272
.decode("utf-8"))
3339
3273
os.remove(stored_state_path)
3340
3274
except IOError as e:
3341
3275
if e.errno == errno.ENOENT:
3342
log.warning("Could not load persistent state:"
3343
" %s", os.strerror(e.errno))
3276
logger.warning("Could not load persistent state:"
3277
" {}".format(os.strerror(e.errno)))
3344
3278
else:
3345
log.critical("Could not load persistent state:",
3346
exc_info=e)
3279
logger.critical("Could not load persistent state:",
3280
exc_info=e)
3347
3281
raise
3348
3282
except EOFError as e:
3349
log.warning("Could not load persistent state: EOFError:",
3350
exc_info=e)
3283
logger.warning("Could not load persistent state: "
3284
"EOFError:",
3285
exc_info=e)
3351
3286
3352
3287
with PGPEngine() as pgp:
3353
3288
for client_name, client in clients_data.items():
3380
3315
if client["enabled"]:
3381
3316
if datetime.datetime.utcnow() >= client["expires"]:
3382
3317
if not client["last_checked_ok"]:
3383
log.warning("disabling client %s - Client"
3384
" never performed a successful"
3385
" checker", client_name)
3318
logger.warning(
3319
"disabling client {} - Client never "
3320
"performed a successful checker".format(
3321
client_name))
3386
3322
client["enabled"] = False
3387
3323
elif client["last_checker_status"] != 0:
3388
log.warning("disabling client %s - Client"
3389
" last checker failed with error"
3390
" code %s", client_name,
3391
client["last_checker_status"])
3324
logger.warning(
3325
"disabling client {} - Client last"
3326
" checker failed with error code"
3327
" {}".format(
3328
client_name,
3329
client["last_checker_status"]))
3392
3330
client["enabled"] = False
3393
3331
else:
3394
3332
client["expires"] = (
3395
3333
datetime.datetime.utcnow()
3396
3334
+ client["timeout"])
3397
log.debug("Last checker succeeded, keeping %s"
3398
" enabled", client_name)
3335
logger.debug("Last checker succeeded,"
3336
" keeping {} enabled".format(
3337
client_name))
3399
3338
try:
3400
3339
client["secret"] = pgp.decrypt(
3401
3340
client["encrypted_secret"],
3402
3341
client_settings[client_name]["secret"])
3403
3342
except PGPError:
3404
3343
# If decryption fails, we use secret from new settings
3405
log.debug("Failed to decrypt %s old secret",
3406
client_name)
3344
logger.debug("Failed to decrypt {} old secret".format(
3345
client_name))
3407
3346
client["secret"] = (client_settings[client_name]
3408
3347
["secret"])
3409
3348
3423
3362
server_settings=server_settings)
3424
3363
3425
3364
if not tcp_server.clients:
3426
log.warning("No clients defined")
3365
logger.warning("No clients defined")
3427
3366
3428
3367
if not foreground:
3429
3368
if pidfile is not None:
3432
3371
with pidfile:
3433
3372
print(pid, file=pidfile)
3434
3373
except IOError:
3435
log.error("Could not write to file %r with PID %d",
3436
pidfilename, pid)
3374
logger.error("Could not write to file %r with PID %d",
3375
pidfilename, pid)
3437
3376
del pidfile
3438
3377
del pidfilename
3439
3378
3589
3528
3590
3529
try:
3591
3530
with tempfile.NamedTemporaryFile(
3592
mode="wb",
3531
mode='wb',
3593
3532
suffix=".pickle",
3594
prefix="clients-",
3533
prefix='clients-',
3595
3534
dir=os.path.dirname(stored_state_path),
3596
3535
delete=False) as stored_state:
3597
3536
pickle.dump((clients, client_settings), stored_state,
3605
3544
except NameError:
3606
3545
pass
3607
3546
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3608
log.warning("Could not save persistent state: %s",
3609
os.strerror(e.errno))
3547
logger.warning("Could not save persistent state: {}"
3548
.format(os.strerror(e.errno)))
3610
3549
else:
3611
log.warning("Could not save persistent state:",
3612
exc_info=e)
3550
logger.warning("Could not save persistent state:",
3551
exc_info=e)
3613
3552
raise
3614
3553
3615
3554
# Delete all clients, and settings from config
3632
3571
mandos_dbus_service.client_added_signal(client)
3633
3572
# Need to initiate checking of clients
3634
3573
if client.enabled:
3635
client.init_checker(randomize_start=True)
3574
client.init_checker()
3636
3575
3637
3576
tcp_server.enable()
3638
3577
tcp_server.server_activate()
3641
3580
if zeroconf:
3642
3581
service.port = tcp_server.socket.getsockname()[1]
3643
3582
if use_ipv6:
3644
log.info("Now listening on address %r, port %d, flowinfo %d,"
3645
" scope_id %d", *tcp_server.socket.getsockname())
3583
logger.info("Now listening on address %r, port %d,"
3584
" flowinfo %d, scope_id %d",
3585
*tcp_server.socket.getsockname())
3646
3586
else: # IPv4
3647
log.info("Now listening on address %r, port %d",
3648
*tcp_server.socket.getsockname())
3587
logger.info("Now listening on address %r, port %d",
3588
*tcp_server.socket.getsockname())
3649
3589
3650
3590
# service.interface = tcp_server.socket.getsockname()[3]
3651
3591
3655
3595
try:
3656
3596
service.activate()
3657
3597
except dbus.exceptions.DBusException as error:
3658
log.critical("D-Bus Exception", exc_info=error)
3598
logger.critical("D-Bus Exception", exc_info=error)
3659
3599
cleanup()
3660
3600
sys.exit(1)
3661
3601
# End of Avahi example code
3662
3602
3663
GLib.io_add_watch(
3664
GLib.IOChannel.unix_new(tcp_server.fileno()),
3665
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3666
lambda *args, **kwargs: (tcp_server.handle_request
3667
(*args[2:], **kwargs) or True))
3603
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3604
lambda *args, **kwargs:
3605
(tcp_server.handle_request
3606
(*args[2:], **kwargs) or True))
3668
3607
3669
log.debug("Starting main loop")
3608
logger.debug("Starting main loop")
3670
3609
main_loop.run()
3671
3610
except AvahiError as error:
3672
log.critical("Avahi Error", exc_info=error)
3611
logger.critical("Avahi Error", exc_info=error)
3673
3612
cleanup()
3674
3613
sys.exit(1)
3675
3614
except KeyboardInterrupt:
3676
3615
if debug:
3677
3616
print("", file=sys.stderr)
3678
log.debug("Server received KeyboardInterrupt")
3679
log.debug("Server exiting")
3617
logger.debug("Server received KeyboardInterrupt")
3618
logger.debug("Server exiting")
3680
3619
# Must run before the D-Bus bus name gets deregistered
3681
3620
cleanup()
3682
3621
3683
3684
def parse_test_args():
3685
# type: () -> argparse.Namespace
3686
parser = argparse.ArgumentParser(add_help=False)
3687
parser.add_argument("--check", action="store_true")
3688
parser.add_argument("--prefix", )
3689
args, unknown_args = parser.parse_known_args()
3690
if args.check:
3691
# Remove test options from sys.argv
3692
sys.argv[1:] = unknown_args
3693
return args
3694
3695
# Add all tests from doctest strings
3696
def load_tests(loader, tests, none):
3697
import doctest
3698
tests.addTests(doctest.DocTestSuite())
3699
return tests
3700
3701
if __name__ == "__main__":
3702
options = parse_test_args()
3703
try:
3704
if options.check:
3705
extra_test_prefix = options.prefix
3706
if extra_test_prefix is not None:
3707
if not (unittest.main(argv=[""], exit=False)
3708
.result.wasSuccessful()):
3709
sys.exit(1)
3710
class ExtraTestLoader(unittest.TestLoader):
3711
testMethodPrefix = extra_test_prefix
3712
# Call using ./scriptname --test [--verbose]
3713
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3714
else:
3715
unittest.main(argv=[""])
3716
else:
3717
main()
3718
finally:
3719
logging.shutdown()
3720
3721
# Local Variables:
3722
# run-tests:
3723
# (lambda (&optional extra)
3724
# (if (not (funcall run-tests-in-test-buffer default-directory
3725
# extra))
3726
# (funcall show-test-buffer-in-test-window)
3727
# (funcall remove-test-window)
3728
# (if extra (message "Extra tests run successfully!"))))
3729
# run-tests-in-test-buffer:
3730
# (lambda (dir &optional extra)
3731
# (with-current-buffer (get-buffer-create "*Test*")
3732
# (setq buffer-read-only nil
3733
# default-directory dir)
3734
# (erase-buffer)
3735
# (compilation-mode))
3736
# (let ((process-result
3737
# (let ((inhibit-read-only t))
3738
# (process-file-shell-command
3739
# (funcall get-command-line extra) nil "*Test*"))))
3740
# (and (numberp process-result)
3741
# (= process-result 0))))
3742
# get-command-line:
3743
# (lambda (&optional extra)
3744
# (let ((quoted-script
3745
# (shell-quote-argument (funcall get-script-name))))
3746
# (format
3747
# (concat "%s --check" (if extra " --prefix=atest" ""))
3748
# quoted-script)))
3749
# get-script-name:
3750
# (lambda ()
3751
# (if (fboundp 'file-local-name)
3752
# (file-local-name (buffer-file-name))
3753
# (or (file-remote-p (buffer-file-name) 'localname)
3754
# (buffer-file-name))))
3755
# remove-test-window:
3756
# (lambda ()
3757
# (let ((test-window (get-buffer-window "*Test*")))
3758
# (if test-window (delete-window test-window))))
3759
# show-test-buffer-in-test-window:
3760
# (lambda ()
3761
# (when (not (get-buffer-window-list "*Test*"))
3762
# (setq next-error-last-buffer (get-buffer "*Test*"))
3763
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3764
# (display-buffer-overriding-action
3765
# `((display-buffer-in-side-window) (side . ,side)
3766
# (window-height . fit-window-to-buffer)
3767
# (window-width . fit-window-to-buffer))))
3768
# (display-buffer "*Test*"))))
3769
# eval:
3770
# (progn
3771
# (let* ((run-extra-tests (lambda () (interactive)
3772
# (funcall run-tests t)))
3773
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3774
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3775
# (setq minor-mode-overriding-map-alist
3776
# (cons `(run-tests . ,outer-keymap)
3777
# minor-mode-overriding-map-alist)))
3778
# (add-hook 'after-save-hook run-tests 90 t))
3779
# End:
3622
3623
if __name__ == '__main__':
3624
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0