To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1171
- compare with another revision
- download diff
- download tarball
- view history from revision 1171
- Committer: Teddy Hogeborn
- Date: 2019-08-30 21:46:16 UTC
- Revision ID: teddy@recompile.se-20190830214616-t1yhgfjz3bdggjd9
Use Python 3 by default
* INSTALL: Document Python 3 dependency.
* debian/control: Change both of "python (>= 2.7), python (<< 3)" to
"python (>= 3)" and change all python-* dependencies
to be python3-* instead.
* mandos: Change first line to use "python3" instead of "python".
* mandos-ctl: - '' -
* mandos-monitor: - '' -
* INSTALL: Document Python 3 dependency.
* debian/control: Change both of "python (>= 2.7), python (<< 3)" to
"python (>= 3)" and change all python-* dependencies
to be python3-* instead.
* mandos: Change first line to use "python3" instead of "python".
* mandos-ctl: - '' -
* mandos-monitor: - '' -
- files removed:
- debian/mandos.maintscript
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
1
#!/usr/bin/python3 -b
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
39
40
except ImportError:
40
41
pass
41
42
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
43
try:
48
44
import SocketServer as socketserver
49
45
except ImportError:
50
46
import socketserver
51
47
import socket
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
import ConfigParser as configparser
56
53
except ImportError:
57
54
import configparser
55
import sys
58
56
import re
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import random
81
import shlex
80
import unittest
82
81
83
82
import dbus
84
83
import dbus.service
92
91
93
92
if sys.version_info.major == 2:
94
93
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
94
113
95
# Show warnings by default
114
96
if not sys.warnoptions:
140
122
# No value found
141
123
SO_BINDTODEVICE = None
142
124
125
if sys.version_info.major == 2:
126
str = unicode
127
143
128
if sys.version_info < (3, 2):
144
129
configparser.Configparser = configparser.SafeConfigParser
145
130
146
version = "1.8.17"
131
version = "1.8.8"
147
132
stored_state_file = "clients.pickle"
148
133
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
134
logger = logging.getLogger()
150
135
logging.captureWarnings(True) # Show warnings via the logging system
151
136
syslogger = None
152
137
189
174
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
175
address="/dev/log"))
191
176
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
177
('Mandos [%(process)d]: %(levelname)s:'
178
' %(message)s'))
179
logger.addHandler(syslogger)
195
180
196
181
if debug:
197
182
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
183
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
184
' [%(process)d]:'
185
' %(levelname)s:'
186
' %(message)s'))
187
logger.addHandler(console)
188
logger.setLevel(level)
204
189
205
190
206
191
class PGPError(Exception):
218
203
output = subprocess.check_output(["gpgconf"])
219
204
for line in output.splitlines():
220
205
name, text, path = line.split(b":")
221
if name == b"gpg":
206
if name == "gpg":
222
207
self.gpg = path
223
208
break
224
209
except OSError as e:
225
210
if e.errno != errno.ENOENT:
226
211
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
212
self.gnupgargs = ['--batch',
213
'--homedir', self.tempdir,
214
'--force-mdc',
215
'--quiet']
231
216
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
217
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
233
218
self.gnupgargs.append("--no-use-agent")
234
219
235
220
def __enter__(self):
272
257
dir=self.tempdir) as passfile:
273
258
passfile.write(passphrase)
274
259
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
260
proc = subprocess.Popen([self.gpg, '--symmetric',
261
'--passphrase-file',
277
262
passfile.name]
278
263
+ self.gnupgargs,
279
264
stdin=subprocess.PIPE,
290
275
dir=self.tempdir) as passfile:
291
276
passfile.write(passphrase)
292
277
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
278
proc = subprocess.Popen([self.gpg, '--decrypt',
279
'--passphrase-file',
295
280
passfile.name]
296
281
+ self.gnupgargs,
297
282
stdin=subprocess.PIPE,
350
335
Attributes:
351
336
interface: integer; avahi.IF_UNSPEC or an interface index.
352
337
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
338
name: string; Example: 'Mandos'
339
type: string; Example: '_mandos._tcp'.
355
340
See <https://www.iana.org/assignments/service-names-port-numbers>
356
341
port: integer; what port to announce
357
342
TXT: list of strings; TXT record for the service
394
379
def rename(self, remove=True):
395
380
"""Derived from the Avahi example code"""
396
381
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
382
logger.critical("No suitable Zeroconf service name found"
383
" after %i retries, exiting.",
384
self.rename_count)
400
385
raise AvahiServiceError("Too many renames")
401
386
self.name = str(
402
387
self.server.GetAlternativeServiceName(self.name))
403
388
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
389
logger.info("Changing Zeroconf service name to %r ...",
390
self.name)
406
391
if remove:
407
392
self.remove()
408
393
try:
410
395
except dbus.exceptions.DBusException as error:
411
396
if (error.get_dbus_name()
412
397
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
398
logger.info("Local Zeroconf service name collision.")
414
399
return self.rename(remove=False)
415
400
else:
416
log.critical("D-Bus Exception", exc_info=error)
401
logger.critical("D-Bus Exception", exc_info=error)
417
402
self.cleanup()
418
403
os._exit(1)
419
404
435
420
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
421
self.entry_group_state_changed_match = (
437
422
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
423
'StateChanged', self.entry_group_state_changed))
424
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
425
self.name, self.type)
441
426
self.group.AddService(
442
427
self.interface,
443
428
self.protocol,
450
435
451
436
def entry_group_state_changed(self, state, error):
452
437
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
438
logger.debug("Avahi entry group state change: %i", state)
454
439
455
440
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
441
logger.debug("Zeroconf service established.")
457
442
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
443
logger.info("Zeroconf service name collision.")
459
444
self.rename()
460
445
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
446
logger.critical("Avahi: Error in group state changed %s",
447
str(error))
463
448
raise AvahiGroupError("State changed: {!s}".format(error))
464
449
465
450
def cleanup(self):
475
460
476
461
def server_state_changed(self, state, error=None):
477
462
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
463
logger.debug("Avahi server state change: %i", state)
479
464
bad_states = {
480
465
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
466
avahi.SERVER_REGISTERING: None,
485
470
if state in bad_states:
486
471
if bad_states[state] is not None:
487
472
if error is None:
488
log.error(bad_states[state])
473
logger.error(bad_states[state])
489
474
else:
490
log.error(bad_states[state] + ": %r", error)
475
logger.error(bad_states[state] + ": %r", error)
491
476
self.cleanup()
492
477
elif state == avahi.SERVER_RUNNING:
493
478
try:
495
480
except dbus.exceptions.DBusException as error:
496
481
if (error.get_dbus_name()
497
482
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
483
logger.info("Local Zeroconf service name"
484
" collision.")
499
485
return self.rename(remove=False)
500
486
else:
501
log.critical("D-Bus Exception", exc_info=error)
487
logger.critical("D-Bus Exception", exc_info=error)
502
488
self.cleanup()
503
489
os._exit(1)
504
490
else:
505
491
if error is None:
506
log.debug("Unknown state: %r", state)
492
logger.debug("Unknown state: %r", state)
507
493
else:
508
log.debug("Unknown state: %r: %r", state, error)
494
logger.debug("Unknown state: %r: %r", state, error)
509
495
510
496
def activate(self):
511
497
"""Derived from the Avahi example code"""
523
509
class AvahiServiceToSyslog(AvahiService):
524
510
def rename(self, *args, **kwargs):
525
511
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
512
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
528
513
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
514
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
515
.format(self.name)))
531
516
return ret
532
517
562
547
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
548
564
549
# Types
565
class _session_int(ctypes.Structure):
550
class session_int(ctypes.Structure):
566
551
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
552
session_t = ctypes.POINTER(session_int)
568
553
569
554
class certificate_credentials_st(ctypes.Structure):
570
555
_fields_ = []
573
558
certificate_type_t = ctypes.c_int
574
559
575
560
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
561
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
562
('size', ctypes.c_uint)]
578
563
579
class _openpgp_crt_int(ctypes.Structure):
564
class openpgp_crt_int(ctypes.Structure):
580
565
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
566
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
567
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
568
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
569
credentials_type_t = ctypes.c_int
593
578
# gnutls.strerror()
594
579
self.code = code
595
580
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
581
message = gnutls.strerror(code)
598
582
return super(gnutls.Error, self).__init__(
599
583
message, *args)
600
584
601
585
class CertificateSecurityError(Error):
602
586
pass
603
587
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
588
# Classes
630
class Credentials(With_from_param):
589
class Credentials:
631
590
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
591
self._c_object = gnutls.certificate_credentials_t()
592
gnutls.certificate_allocate_credentials(
593
ctypes.byref(self._c_object))
634
594
self.type = gnutls.CRD_CERTIFICATE
635
595
636
596
def __del__(self):
637
gnutls.certificate_free_credentials(self)
597
gnutls.certificate_free_credentials(self._c_object)
638
598
639
class ClientSession(With_from_param):
599
class ClientSession:
640
600
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
601
self._c_object = gnutls.session_t()
642
602
gnutls_flags = gnutls.CLIENT
643
603
if gnutls.check_version(b"3.5.6"):
644
604
gnutls_flags |= gnutls.NO_TICKETS
645
605
if gnutls.has_rawpk:
646
606
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
607
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
648
608
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
609
gnutls.set_default_priority(self._c_object)
610
gnutls.transport_set_ptr(self._c_object, socket.fileno())
611
gnutls.handshake_set_private_extensions(self._c_object,
612
True)
652
613
self.socket = socket
653
614
if credentials is None:
654
615
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
616
gnutls.credentials_set(self._c_object, credentials.type,
617
ctypes.cast(credentials._c_object,
618
ctypes.c_void_p))
657
619
self.credentials = credentials
658
620
659
621
def __del__(self):
660
gnutls.deinit(self)
622
gnutls.deinit(self._c_object)
661
623
662
624
def handshake(self):
663
return gnutls.handshake(self)
625
return gnutls.handshake(self._c_object)
664
626
665
627
def send(self, data):
666
628
data = bytes(data)
667
629
data_len = len(data)
668
630
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
631
data_len -= gnutls.record_send(self._c_object,
632
data[-data_len:],
670
633
data_len)
671
634
672
635
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
636
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
637
675
638
# Error handling functions
676
639
def _error_code(result):
677
640
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
641
for the 'restype' attribute on ctypes functions"""
642
if result >= 0:
680
643
return result
681
644
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
645
raise gnutls.CertificateSecurityError(code=result)
683
646
raise gnutls.Error(code=result)
684
647
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
648
def _retry_on_error(result, func, arguments):
687
649
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
650
for the 'errcheck' attribute on ctypes functions"""
651
while result < 0:
690
652
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
653
return _error_code(result)
692
654
result = func(*arguments)
697
659
698
660
# Functions
699
661
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
662
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
663
ctypes.POINTER(ctypes.c_char_p)]
702
664
priority_set_direct.restype = _error_code
703
665
704
666
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
667
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
668
init.restype = _error_code
707
669
708
670
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
671
set_default_priority.argtypes = [session_t]
710
672
set_default_priority.restype = _error_code
711
673
712
674
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
675
record_send.argtypes = [session_t, ctypes.c_void_p,
714
676
ctypes.c_size_t]
715
677
record_send.restype = ctypes.c_ssize_t
716
678
record_send.errcheck = _retry_on_error
718
680
certificate_allocate_credentials = (
719
681
_library.gnutls_certificate_allocate_credentials)
720
682
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
683
ctypes.POINTER(certificate_credentials_t)]
722
684
certificate_allocate_credentials.restype = _error_code
723
685
724
686
certificate_free_credentials = (
725
687
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
688
certificate_free_credentials.argtypes = [
689
certificate_credentials_t]
727
690
certificate_free_credentials.restype = None
728
691
729
692
handshake_set_private_extensions = (
730
693
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
694
handshake_set_private_extensions.argtypes = [session_t,
732
695
ctypes.c_int]
733
696
handshake_set_private_extensions.restype = None
734
697
735
698
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
699
credentials_set.argtypes = [session_t, credentials_type_t,
700
ctypes.c_void_p]
738
701
credentials_set.restype = _error_code
739
702
740
703
strerror = _library.gnutls_strerror
742
705
strerror.restype = ctypes.c_char_p
743
706
744
707
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
708
certificate_type_get.argtypes = [session_t]
746
709
certificate_type_get.restype = _error_code
747
710
748
711
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
712
certificate_get_peers.argtypes = [session_t,
750
713
ctypes.POINTER(ctypes.c_uint)]
751
714
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
715
759
722
global_set_log_function.restype = None
760
723
761
724
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
725
deinit.argtypes = [session_t]
763
726
deinit.restype = None
764
727
765
728
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
729
handshake.argtypes = [session_t]
730
handshake.restype = _error_code
768
731
handshake.errcheck = _retry_on_error
769
732
770
733
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
734
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
735
transport_set_ptr.restype = None
773
736
774
737
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
738
bye.argtypes = [session_t, close_request_t]
739
bye.restype = _error_code
777
740
bye.errcheck = _retry_on_error
778
741
779
742
check_version = _library.gnutls_check_version
796
759
797
760
x509_crt_fmt_t = ctypes.c_int
798
761
799
# All the function declarations below are from
800
# gnutls/abstract.h
762
# All the function declarations below are from gnutls/abstract.h
801
763
pubkey_init = _library.gnutls_pubkey_init
802
764
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
765
pubkey_init.restype = _error_code
817
779
pubkey_deinit.argtypes = [pubkey_t]
818
780
pubkey_deinit.restype = None
819
781
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
782
# All the function declarations below are from gnutls/openpgp.h
822
783
823
784
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
785
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
830
791
openpgp_crt_fmt_t]
831
792
openpgp_crt_import.restype = _error_code
832
793
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
794
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
795
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
796
ctypes.POINTER(ctypes.c_uint)]
840
797
openpgp_crt_verify_self.restype = _error_code
841
798
842
799
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
853
810
854
811
if check_version(b"3.6.4"):
855
812
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
813
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
857
814
certificate_type_get2.restype = _error_code
858
815
859
816
# Remove non-public functions
875
832
"""A representation of a client host served by this server.
876
833
877
834
Attributes:
878
approved: bool(); None if not yet approved/disapproved
835
approved: bool(); 'None' if not yet approved/disapproved
879
836
approval_delay: datetime.timedelta(); Time to wait for approval
880
837
approval_duration: datetime.timedelta(); Duration of one approval
881
838
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
839
to see if the client lives. 'None' if no process is
883
840
running.
884
841
checker_callback_tag: a GLib event source tag, or None
885
842
checker_command: string; External command which is run to check
961
918
# key_id() and fingerprint() functions
962
919
client["key_id"] = (section.get("key_id", "").upper()
963
920
.replace(" ", ""))
964
client["fingerprint"] = (section.get("fingerprint",
965
"").upper()
921
client["fingerprint"] = (section["fingerprint"].upper()
966
922
.replace(" ", ""))
967
if not (client["key_id"] or client["fingerprint"]):
968
log.error("Skipping client %s without key_id or"
969
" fingerprint", client_name)
970
del settings[client_name]
971
continue
972
923
if "secret" in section:
973
924
client["secret"] = codecs.decode(section["secret"]
974
925
.encode("utf-8"),
1015
966
self.last_enabled = None
1016
967
self.expires = None
1017
968
1018
log.debug("Creating client %r", self.name)
1019
log.debug(" Key ID: %s", self.key_id)
1020
log.debug(" Fingerprint: %s", self.fingerprint)
969
logger.debug("Creating client %r", self.name)
970
logger.debug(" Key ID: %s", self.key_id)
971
logger.debug(" Fingerprint: %s", self.fingerprint)
1021
972
self.created = settings.get("created",
1022
973
datetime.datetime.utcnow())
1023
974
1051
1002
if getattr(self, "enabled", False):
1052
1003
# Already enabled
1053
1004
return
1005
self.expires = datetime.datetime.utcnow() + self.timeout
1054
1006
self.enabled = True
1055
1007
self.last_enabled = datetime.datetime.utcnow()
1056
1008
self.init_checker()
1061
1013
if not getattr(self, "enabled", False):
1062
1014
return False
1063
1015
if not quiet:
1064
log.info("Disabling client %s", self.name)
1016
logger.info("Disabling client %s", self.name)
1065
1017
if getattr(self, "disable_initiator_tag", None) is not None:
1066
1018
GLib.source_remove(self.disable_initiator_tag)
1067
1019
self.disable_initiator_tag = None
1079
1031
def __del__(self):
1080
1032
self.disable()
1081
1033
1082
def init_checker(self, randomize_start=False):
1083
# Schedule a new checker to be started a randomly selected
1084
# time (a fraction of 'interval') from now. This spreads out
1085
# the startup of checkers over time when the server is
1086
# started.
1034
def init_checker(self):
1035
# Schedule a new checker to be started an 'interval' from now,
1036
# and every interval from then on.
1087
1037
if self.checker_initiator_tag is not None:
1088
1038
GLib.source_remove(self.checker_initiator_tag)
1089
interval_milliseconds = int(self.interval.total_seconds()
1090
* 1000)
1091
if randomize_start:
1092
delay_milliseconds = random.randrange(
1093
interval_milliseconds + 1)
1094
else:
1095
delay_milliseconds = interval_milliseconds
1096
1039
self.checker_initiator_tag = GLib.timeout_add(
1097
delay_milliseconds, self.start_checker, randomize_start)
1098
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1099
# A checker might take up to an 'interval' of time, so we can
1100
# expire at the soonest one interval after a checker was
1101
# started. Since the initial checker is delayed, the expire
1102
# time might have to be extended.
1103
now = datetime.datetime.utcnow()
1104
self.expires = now + delay + self.interval
1105
# Schedule a disable() at expire time
1040
int(self.interval.total_seconds() * 1000),
1041
self.start_checker)
1042
# Schedule a disable() when 'timeout' has passed
1106
1043
if self.disable_initiator_tag is not None:
1107
1044
GLib.source_remove(self.disable_initiator_tag)
1108
1045
self.disable_initiator_tag = GLib.timeout_add(
1109
int((self.expires - now).total_seconds() * 1000),
1110
self.disable)
1046
int(self.timeout.total_seconds() * 1000), self.disable)
1047
# Also start a new checker *right now*.
1048
self.start_checker()
1111
1049
1112
1050
def checker_callback(self, source, condition, connection,
1113
1051
command):
1115
1053
# Read return code from connection (see call_pipe)
1116
1054
returncode = connection.recv()
1117
1055
connection.close()
1118
if self.checker is not None:
1119
self.checker.join()
1056
self.checker.join()
1120
1057
self.checker_callback_tag = None
1121
1058
self.checker = None
1122
1059
1124
1061
self.last_checker_status = returncode
1125
1062
self.last_checker_signal = None
1126
1063
if self.last_checker_status == 0:
1127
log.info("Checker for %(name)s succeeded", vars(self))
1064
logger.info("Checker for %(name)s succeeded",
1065
vars(self))
1128
1066
self.checked_ok()
1129
1067
else:
1130
log.info("Checker for %(name)s failed", vars(self))
1068
logger.info("Checker for %(name)s failed", vars(self))
1131
1069
else:
1132
1070
self.last_checker_status = -1
1133
1071
self.last_checker_signal = -returncode
1134
log.warning("Checker for %(name)s crashed?", vars(self))
1072
logger.warning("Checker for %(name)s crashed?",
1073
vars(self))
1135
1074
return False
1136
1075
1137
1076
def checked_ok(self):
1156
1095
def need_approval(self):
1157
1096
self.last_approval_request = datetime.datetime.utcnow()
1158
1097
1159
def start_checker(self, start_was_randomized=False):
1098
def start_checker(self):
1160
1099
"""Start a new checker subprocess if one is not running.
1161
1100
1162
1101
If a checker already exists, leave it running and do
1171
1110
# should be.
1172
1111
1173
1112
if self.checker is not None and not self.checker.is_alive():
1174
log.warning("Checker was not alive; joining")
1113
logger.warning("Checker was not alive; joining")
1175
1114
self.checker.join()
1176
1115
self.checker = None
1177
1116
# Start a new checker if needed
1178
1117
if self.checker is None:
1179
1118
# Escape attributes for the shell
1180
1119
escaped_attrs = {
1181
attr: shlex.quote(str(getattr(self, attr)))
1120
attr: re.escape(str(getattr(self, attr)))
1182
1121
for attr in self.runtime_expansions}
1183
1122
try:
1184
1123
command = self.checker_command % escaped_attrs
1185
1124
except TypeError as error:
1186
log.error('Could not format string "%s"',
1187
self.checker_command, exc_info=error)
1125
logger.error('Could not format string "%s"',
1126
self.checker_command,
1127
exc_info=error)
1188
1128
return True # Try again later
1189
1129
self.current_checker_command = command
1190
log.info("Starting checker %r for %s", command, self.name)
1130
logger.info("Starting checker %r for %s", command,
1131
self.name)
1191
1132
# We don't need to redirect stdout and stderr, since
1192
1133
# in normal mode, that is already done by daemon(),
1193
1134
# and in debug mode we don't want to. (Stdin is
1212
1153
GLib.IOChannel.unix_new(pipe[0].fileno()),
1213
1154
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1214
1155
self.checker_callback, pipe[0], command)
1215
if start_was_randomized:
1216
# We were started after a random delay; Schedule a new
1217
# checker to be started an 'interval' from now, and every
1218
# interval from then on.
1219
now = datetime.datetime.utcnow()
1220
self.checker_initiator_tag = GLib.timeout_add(
1221
int(self.interval.total_seconds() * 1000),
1222
self.start_checker)
1223
self.expires = max(self.expires, now + self.interval)
1224
# Don't start a new checker again after same random delay
1225
return False
1226
1156
# Re-run this periodically if run by GLib.timeout_add
1227
1157
return True
1228
1158
1233
1163
self.checker_callback_tag = None
1234
1164
if getattr(self, "checker", None) is None:
1235
1165
return
1236
log.debug("Stopping checker for %(name)s", vars(self))
1166
logger.debug("Stopping checker for %(name)s", vars(self))
1237
1167
self.checker.terminate()
1238
1168
self.checker = None
1239
1169
1266
1196
func._dbus_name = func.__name__
1267
1197
if func._dbus_name.endswith("_dbus_property"):
1268
1198
func._dbus_name = func._dbus_name[:-14]
1269
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1199
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1270
1200
return func
1271
1201
1272
1202
return decorator
1361
1291
1362
1292
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1363
1293
out_signature="s",
1364
path_keyword="object_path",
1365
connection_keyword="connection")
1294
path_keyword='object_path',
1295
connection_keyword='connection')
1366
1296
def Introspect(self, object_path, connection):
1367
1297
"""Overloading of standard D-Bus method.
1368
1298
1417
1347
document.unlink()
1418
1348
except (AttributeError, xml.dom.DOMException,
1419
1349
xml.parsers.expat.ExpatError) as error:
1420
log.error("Failed to override Introspection method",
1421
exc_info=error)
1350
logger.error("Failed to override Introspection method",
1351
exc_info=error)
1422
1352
return xmlstring
1423
1353
1424
1354
1482
1412
raise ValueError("Byte arrays not supported for non-"
1483
1413
"'ay' signature {!r}"
1484
1414
.format(prop._dbus_signature))
1485
value = dbus.ByteArray(bytes(value))
1415
value = dbus.ByteArray(b''.join(chr(byte)
1416
for byte in value))
1486
1417
prop(value)
1487
1418
1488
1419
@dbus.service.method(dbus.PROPERTIES_IFACE,
1521
1452
1522
1453
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1523
1454
out_signature="s",
1524
path_keyword="object_path",
1525
connection_keyword="connection")
1455
path_keyword='object_path',
1456
connection_keyword='connection')
1526
1457
def Introspect(self, object_path, connection):
1527
1458
"""Overloading of standard D-Bus method.
1528
1459
1584
1515
document.unlink()
1585
1516
except (AttributeError, xml.dom.DOMException,
1586
1517
xml.parsers.expat.ExpatError) as error:
1587
log.error("Failed to override Introspection method",
1588
exc_info=error)
1518
logger.error("Failed to override Introspection method",
1519
exc_info=error)
1589
1520
return xmlstring
1590
1521
1591
1522
1623
1554
1624
1555
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1625
1556
out_signature="s",
1626
path_keyword="object_path",
1627
connection_keyword="connection")
1557
path_keyword='object_path',
1558
connection_keyword='connection')
1628
1559
def Introspect(self, object_path, connection):
1629
1560
"""Overloading of standard D-Bus method.
1630
1561
1655
1586
document.unlink()
1656
1587
except (AttributeError, xml.dom.DOMException,
1657
1588
xml.parsers.expat.ExpatError) as error:
1658
log.error("Failed to override Introspection method",
1659
exc_info=error)
1589
logger.error("Failed to override Introspection method",
1590
exc_info=error)
1660
1591
return xmlstring
1661
1592
1662
1593
2296
2227
class ProxyClient:
2297
2228
def __init__(self, child_pipe, key_id, fpr, address):
2298
2229
self._pipe = child_pipe
2299
self._pipe.send(("init", key_id, fpr, address))
2230
self._pipe.send(('init', key_id, fpr, address))
2300
2231
if not self._pipe.recv():
2301
2232
raise KeyError(key_id or fpr)
2302
2233
2303
2234
def __getattribute__(self, name):
2304
if name == "_pipe":
2235
if name == '_pipe':
2305
2236
return super(ProxyClient, self).__getattribute__(name)
2306
self._pipe.send(("getattr", name))
2237
self._pipe.send(('getattr', name))
2307
2238
data = self._pipe.recv()
2308
if data[0] == "data":
2239
if data[0] == 'data':
2309
2240
return data[1]
2310
if data[0] == "function":
2241
if data[0] == 'function':
2311
2242
2312
2243
def func(*args, **kwargs):
2313
self._pipe.send(("funcall", name, args, kwargs))
2244
self._pipe.send(('funcall', name, args, kwargs))
2314
2245
return self._pipe.recv()[1]
2315
2246
2316
2247
return func
2317
2248
2318
2249
def __setattr__(self, name, value):
2319
if name == "_pipe":
2250
if name == '_pipe':
2320
2251
return super(ProxyClient, self).__setattr__(name, value)
2321
self._pipe.send(("setattr", name, value))
2252
self._pipe.send(('setattr', name, value))
2322
2253
2323
2254
2324
2255
class ClientHandler(socketserver.BaseRequestHandler, object):
2329
2260
2330
2261
def handle(self):
2331
2262
with contextlib.closing(self.server.child_pipe) as child_pipe:
2332
log.info("TCP connection from: %s",
2333
str(self.client_address))
2334
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2263
logger.info("TCP connection from: %s",
2264
str(self.client_address))
2265
logger.debug("Pipe FD: %d",
2266
self.server.child_pipe.fileno())
2335
2267
2336
2268
session = gnutls.ClientSession(self.request)
2337
2269
2338
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2270
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2339
2271
# "+AES-256-CBC", "+SHA1",
2340
2272
# "+COMP-NULL", "+CTYPE-OPENPGP",
2341
2273
# "+DHE-DSS"))
2343
2275
priority = self.server.gnutls_priority
2344
2276
if priority is None:
2345
2277
priority = "NORMAL"
2346
gnutls.priority_set_direct(session,
2347
priority.encode("utf-8"), None)
2278
gnutls.priority_set_direct(session._c_object,
2279
priority.encode("utf-8"),
2280
None)
2348
2281
2349
2282
# Start communication using the Mandos protocol
2350
2283
# Get protocol number
2351
2284
line = self.request.makefile().readline()
2352
log.debug("Protocol version: %r", line)
2285
logger.debug("Protocol version: %r", line)
2353
2286
try:
2354
2287
if int(line.strip().split()[0]) > 1:
2355
2288
raise RuntimeError(line)
2356
2289
except (ValueError, IndexError, RuntimeError) as error:
2357
log.error("Unknown protocol version: %s", error)
2290
logger.error("Unknown protocol version: %s", error)
2358
2291
return
2359
2292
2360
2293
# Start GnuTLS connection
2361
2294
try:
2362
2295
session.handshake()
2363
2296
except gnutls.Error as error:
2364
log.warning("Handshake failed: %s", error)
2297
logger.warning("Handshake failed: %s", error)
2365
2298
# Do not run session.bye() here: the session is not
2366
2299
# established. Just abandon the request.
2367
2300
return
2368
log.debug("Handshake succeeded")
2301
logger.debug("Handshake succeeded")
2369
2302
2370
2303
approval_required = False
2371
2304
try:
2375
2308
key_id = self.key_id(
2376
2309
self.peer_certificate(session))
2377
2310
except (TypeError, gnutls.Error) as error:
2378
log.warning("Bad certificate: %s", error)
2311
logger.warning("Bad certificate: %s", error)
2379
2312
return
2380
log.debug("Key ID: %s",
2381
key_id.decode("utf-8",
2382
errors="replace"))
2313
logger.debug("Key ID: %s", key_id)
2383
2314
2384
2315
else:
2385
2316
key_id = b""
2387
2318
fpr = self.fingerprint(
2388
2319
self.peer_certificate(session))
2389
2320
except (TypeError, gnutls.Error) as error:
2390
log.warning("Bad certificate: %s", error)
2321
logger.warning("Bad certificate: %s", error)
2391
2322
return
2392
log.debug("Fingerprint: %s", fpr)
2323
logger.debug("Fingerprint: %s", fpr)
2393
2324
2394
2325
try:
2395
2326
client = ProxyClient(child_pipe, key_id, fpr,
2404
2335
2405
2336
while True:
2406
2337
if not client.enabled:
2407
log.info("Client %s is disabled", client.name)
2338
logger.info("Client %s is disabled",
2339
client.name)
2408
2340
if self.server.use_dbus:
2409
2341
# Emit D-Bus signal
2410
2342
client.Rejected("Disabled")
2414
2346
# We are approved or approval is disabled
2415
2347
break
2416
2348
elif client.approved is None:
2417
log.info("Client %s needs approval",
2418
client.name)
2349
logger.info("Client %s needs approval",
2350
client.name)
2419
2351
if self.server.use_dbus:
2420
2352
# Emit D-Bus signal
2421
2353
client.NeedApproval(
2422
2354
client.approval_delay.total_seconds()
2423
2355
* 1000, client.approved_by_default)
2424
2356
else:
2425
log.warning("Client %s was not approved",
2426
client.name)
2357
logger.warning("Client %s was not approved",
2358
client.name)
2427
2359
if self.server.use_dbus:
2428
2360
# Emit D-Bus signal
2429
2361
client.Rejected("Denied")
2437
2369
time2 = datetime.datetime.now()
2438
2370
if (time2 - time) >= delay:
2439
2371
if not client.approved_by_default:
2440
log.warning("Client %s timed out while"
2441
" waiting for approval",
2442
client.name)
2372
logger.warning("Client %s timed out while"
2373
" waiting for approval",
2374
client.name)
2443
2375
if self.server.use_dbus:
2444
2376
# Emit D-Bus signal
2445
2377
client.Rejected("Approval timed out")
2452
2384
try:
2453
2385
session.send(client.secret)
2454
2386
except gnutls.Error as error:
2455
log.warning("gnutls send failed", exc_info=error)
2387
logger.warning("gnutls send failed",
2388
exc_info=error)
2456
2389
return
2457
2390
2458
log.info("Sending secret to %s", client.name)
2391
logger.info("Sending secret to %s", client.name)
2459
2392
# bump the timeout using extended_timeout
2460
2393
client.bump_timeout(client.extended_timeout)
2461
2394
if self.server.use_dbus:
2468
2401
try:
2469
2402
session.bye()
2470
2403
except gnutls.Error as error:
2471
log.warning("GnuTLS bye failed", exc_info=error)
2404
logger.warning("GnuTLS bye failed",
2405
exc_info=error)
2472
2406
2473
2407
@staticmethod
2474
2408
def peer_certificate(session):
2475
2409
"Return the peer's certificate as a bytestring"
2476
2410
try:
2477
cert_type = gnutls.certificate_type_get2(
2478
session, gnutls.CTYPE_PEERS)
2411
cert_type = gnutls.certificate_type_get2(session._c_object,
2412
gnutls.CTYPE_PEERS)
2479
2413
except AttributeError:
2480
cert_type = gnutls.certificate_type_get(session)
2414
cert_type = gnutls.certificate_type_get(session._c_object)
2481
2415
if gnutls.has_rawpk:
2482
2416
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2483
2417
else:
2484
2418
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2485
2419
# If not a valid certificate type...
2486
2420
if cert_type not in valid_cert_types:
2487
log.info("Cert type %r not in %r", cert_type,
2488
valid_cert_types)
2421
logger.info("Cert type %r not in %r", cert_type,
2422
valid_cert_types)
2489
2423
# ...return invalid data
2490
2424
return b""
2491
2425
list_size = ctypes.c_uint(1)
2492
2426
cert_list = (gnutls.certificate_get_peers
2493
(session, ctypes.byref(list_size)))
2427
(session._c_object, ctypes.byref(list_size)))
2494
2428
if not bool(cert_list) and list_size.value != 0:
2495
2429
raise gnutls.Error("error getting peer certificate")
2496
2430
if list_size.value == 0:
2518
2452
buf = ctypes.create_string_buffer(32)
2519
2453
buf_len = ctypes.c_size_t(len(buf))
2520
2454
# Get the key ID from the raw public key into the buffer
2521
gnutls.pubkey_get_key_id(
2522
pubkey,
2523
gnutls.KEYID_USE_SHA256,
2524
ctypes.cast(ctypes.byref(buf),
2525
ctypes.POINTER(ctypes.c_ubyte)),
2526
ctypes.byref(buf_len))
2455
gnutls.pubkey_get_key_id(pubkey,
2456
gnutls.KEYID_USE_SHA256,
2457
ctypes.cast(ctypes.byref(buf),
2458
ctypes.POINTER(ctypes.c_ubyte)),
2459
ctypes.byref(buf_len))
2527
2460
# Deinit the certificate
2528
2461
gnutls.pubkey_deinit(pubkey)
2529
2462
2610
2543
2611
2544
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2612
2545
socketserver.TCPServer):
2613
"""IPv6-capable TCP server. Accepts None as address and/or port
2546
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2614
2547
2615
2548
Attributes:
2616
2549
enabled: Boolean; whether this server is activated yet
2667
2600
if SO_BINDTODEVICE is None:
2668
2601
# Fall back to a hard-coded value which seems to be
2669
2602
# common enough.
2670
log.warning("SO_BINDTODEVICE not found, trying 25")
2603
logger.warning("SO_BINDTODEVICE not found, trying 25")
2671
2604
SO_BINDTODEVICE = 25
2672
2605
try:
2673
2606
self.socket.setsockopt(
2675
2608
(self.interface + "\0").encode("utf-8"))
2676
2609
except socket.error as error:
2677
2610
if error.errno == errno.EPERM:
2678
log.error("No permission to bind to interface %s",
2679
self.interface)
2611
logger.error("No permission to bind to"
2612
" interface %s", self.interface)
2680
2613
elif error.errno == errno.ENOPROTOOPT:
2681
log.error("SO_BINDTODEVICE not available; cannot"
2682
" bind to interface %s", self.interface)
2614
logger.error("SO_BINDTODEVICE not available;"
2615
" cannot bind to interface %s",
2616
self.interface)
2683
2617
elif error.errno == errno.ENODEV:
2684
log.error("Interface %s does not exist, cannot"
2685
" bind", self.interface)
2618
logger.error("Interface %s does not exist,"
2619
" cannot bind", self.interface)
2686
2620
else:
2687
2621
raise
2688
2622
# Only bind(2) the socket if we really need to.
2767
2701
request = parent_pipe.recv()
2768
2702
command = request[0]
2769
2703
2770
if command == "init":
2704
if command == 'init':
2771
2705
key_id = request[1].decode("ascii")
2772
2706
fpr = request[2].decode("ascii")
2773
2707
address = request[3]
2774
2708
2775
2709
for c in self.clients.values():
2776
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2777
"27AE41E4649B934CA495991B7852B855"):
2710
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2778
2711
continue
2779
2712
if key_id and c.key_id == key_id:
2780
2713
client = c
2783
2716
client = c
2784
2717
break
2785
2718
else:
2786
log.info("Client not found for key ID: %s, address:"
2787
" %s", key_id or fpr, address)
2719
logger.info("Client not found for key ID: %s, address"
2720
": %s", key_id or fpr, address)
2788
2721
if self.use_dbus:
2789
2722
# Emit D-Bus signal
2790
2723
mandos_dbus_service.ClientNotFound(key_id or fpr,
2803
2736
# remove the old hook in favor of the new above hook on
2804
2737
# same fileno
2805
2738
return False
2806
if command == "funcall":
2739
if command == 'funcall':
2807
2740
funcname = request[1]
2808
2741
args = request[2]
2809
2742
kwargs = request[3]
2810
2743
2811
parent_pipe.send(("data", getattr(client_object,
2744
parent_pipe.send(('data', getattr(client_object,
2812
2745
funcname)(*args,
2813
2746
**kwargs)))
2814
2747
2815
if command == "getattr":
2748
if command == 'getattr':
2816
2749
attrname = request[1]
2817
2750
if isinstance(client_object.__getattribute__(attrname),
2818
collections.abc.Callable):
2819
parent_pipe.send(("function", ))
2751
collections.Callable):
2752
parent_pipe.send(('function', ))
2820
2753
else:
2821
2754
parent_pipe.send((
2822
"data", client_object.__getattribute__(attrname)))
2755
'data', client_object.__getattribute__(attrname)))
2823
2756
2824
if command == "setattr":
2757
if command == 'setattr':
2825
2758
attrname = request[1]
2826
2759
value = request[2]
2827
2760
setattr(client_object, attrname, value)
2832
2765
def rfc3339_duration_to_delta(duration):
2833
2766
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2834
2767
2835
>>> timedelta = datetime.timedelta
2836
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2837
True
2838
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2839
True
2840
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2841
True
2842
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2843
True
2844
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2845
True
2846
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2847
True
2848
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2849
True
2850
>>> del timedelta
2768
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2769
True
2770
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2771
True
2772
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2773
True
2774
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2775
True
2776
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2777
True
2778
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2779
True
2780
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2781
True
2851
2782
"""
2852
2783
2853
2784
# Parsing an RFC 3339 duration with regular expressions is not
2933
2864
def string_to_delta(interval):
2934
2865
"""Parse a string and return a datetime.timedelta
2935
2866
2936
>>> string_to_delta("7d") == datetime.timedelta(7)
2937
True
2938
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2939
True
2940
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2941
True
2942
>>> string_to_delta("24h") == datetime.timedelta(1)
2943
True
2944
>>> string_to_delta("1w") == datetime.timedelta(7)
2945
True
2946
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2867
>>> string_to_delta('7d') == datetime.timedelta(7)
2868
True
2869
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2870
True
2871
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2872
True
2873
>>> string_to_delta('24h') == datetime.timedelta(1)
2874
True
2875
>>> string_to_delta('1w') == datetime.timedelta(7)
2876
True
2877
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2947
2878
True
2948
2879
"""
2949
2880
3153
3084
3154
3085
if server_settings["servicename"] != "Mandos":
3155
3086
syslogger.setFormatter(
3156
logging.Formatter("Mandos ({}) [%(process)d]:"
3157
" %(levelname)s: %(message)s".format(
3087
logging.Formatter('Mandos ({}) [%(process)d]:'
3088
' %(levelname)s: %(message)s'.format(
3158
3089
server_settings["servicename"])))
3159
3090
3160
3091
# Parse config file with clients
3184
3115
try:
3185
3116
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3186
3117
except IOError as e:
3187
log.error("Could not open file %r", pidfilename,
3188
exc_info=e)
3118
logger.error("Could not open file %r", pidfilename,
3119
exc_info=e)
3189
3120
3190
3121
for name, group in (("_mandos", "_mandos"),
3191
3122
("mandos", "mandos"),
3202
3133
try:
3203
3134
os.setgid(gid)
3204
3135
os.setuid(uid)
3205
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3136
if debug:
3137
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3138
gid))
3206
3139
except OSError as error:
3207
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3208
os.strerror(error.errno))
3140
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3141
.format(uid, gid, os.strerror(error.errno)))
3209
3142
if error.errno != errno.EPERM:
3210
3143
raise
3211
3144
3218
3151
3219
3152
@gnutls.log_func
3220
3153
def debug_gnutls(level, string):
3221
log.debug("GnuTLS: %s",
3222
string[:-1].decode("utf-8", errors="replace"))
3154
logger.debug("GnuTLS: %s", string[:-1])
3223
3155
3224
3156
gnutls.global_set_log_function(debug_gnutls)
3225
3157
3254
3186
"se.bsnet.fukt.Mandos", bus,
3255
3187
do_not_queue=True)
3256
3188
except dbus.exceptions.DBusException as e:
3257
log.error("Disabling D-Bus:", exc_info=e)
3189
logger.error("Disabling D-Bus:", exc_info=e)
3258
3190
use_dbus = False
3259
3191
server_settings["use_dbus"] = False
3260
3192
tcp_server.use_dbus = False
3319
3251
if isinstance(s, bytes)
3320
3252
else s) for s in
3321
3253
value["client_structure"]]
3322
# .name, .host, and .checker_command
3323
for k in ("name", "host", "checker_command"):
3254
# .name & .host
3255
for k in ("name", "host"):
3324
3256
if isinstance(value[k], bytes):
3325
3257
value[k] = value[k].decode("utf-8")
3326
3258
if "key_id" not in value:
3336
3268
for key, value in
3337
3269
bytes_old_client_settings.items()}
3338
3270
del bytes_old_client_settings
3339
# .host and .checker_command
3271
# .host
3340
3272
for value in old_client_settings.values():
3341
for attribute in ("host", "checker_command"):
3342
if isinstance(value[attribute], bytes):
3343
value[attribute] = (value[attribute]
3344
.decode("utf-8"))
3273
if isinstance(value["host"], bytes):
3274
value["host"] = (value["host"]
3275
.decode("utf-8"))
3345
3276
os.remove(stored_state_path)
3346
3277
except IOError as e:
3347
3278
if e.errno == errno.ENOENT:
3348
log.warning("Could not load persistent state:"
3349
" %s", os.strerror(e.errno))
3279
logger.warning("Could not load persistent state:"
3280
" {}".format(os.strerror(e.errno)))
3350
3281
else:
3351
log.critical("Could not load persistent state:",
3352
exc_info=e)
3282
logger.critical("Could not load persistent state:",
3283
exc_info=e)
3353
3284
raise
3354
3285
except EOFError as e:
3355
log.warning("Could not load persistent state: EOFError:",
3356
exc_info=e)
3286
logger.warning("Could not load persistent state: "
3287
"EOFError:",
3288
exc_info=e)
3357
3289
3358
3290
with PGPEngine() as pgp:
3359
3291
for client_name, client in clients_data.items():
3386
3318
if client["enabled"]:
3387
3319
if datetime.datetime.utcnow() >= client["expires"]:
3388
3320
if not client["last_checked_ok"]:
3389
log.warning("disabling client %s - Client"
3390
" never performed a successful"
3391
" checker", client_name)
3321
logger.warning(
3322
"disabling client {} - Client never "
3323
"performed a successful checker".format(
3324
client_name))
3392
3325
client["enabled"] = False
3393
3326
elif client["last_checker_status"] != 0:
3394
log.warning("disabling client %s - Client"
3395
" last checker failed with error"
3396
" code %s", client_name,
3397
client["last_checker_status"])
3327
logger.warning(
3328
"disabling client {} - Client last"
3329
" checker failed with error code"
3330
" {}".format(
3331
client_name,
3332
client["last_checker_status"]))
3398
3333
client["enabled"] = False
3399
3334
else:
3400
3335
client["expires"] = (
3401
3336
datetime.datetime.utcnow()
3402
3337
+ client["timeout"])
3403
log.debug("Last checker succeeded, keeping %s"
3404
" enabled", client_name)
3338
logger.debug("Last checker succeeded,"
3339
" keeping {} enabled".format(
3340
client_name))
3405
3341
try:
3406
3342
client["secret"] = pgp.decrypt(
3407
3343
client["encrypted_secret"],
3408
3344
client_settings[client_name]["secret"])
3409
3345
except PGPError:
3410
3346
# If decryption fails, we use secret from new settings
3411
log.debug("Failed to decrypt %s old secret",
3412
client_name)
3347
logger.debug("Failed to decrypt {} old secret".format(
3348
client_name))
3413
3349
client["secret"] = (client_settings[client_name]
3414
3350
["secret"])
3415
3351
3429
3365
server_settings=server_settings)
3430
3366
3431
3367
if not tcp_server.clients:
3432
log.warning("No clients defined")
3368
logger.warning("No clients defined")
3433
3369
3434
3370
if not foreground:
3435
3371
if pidfile is not None:
3438
3374
with pidfile:
3439
3375
print(pid, file=pidfile)
3440
3376
except IOError:
3441
log.error("Could not write to file %r with PID %d",
3442
pidfilename, pid)
3377
logger.error("Could not write to file %r with PID %d",
3378
pidfilename, pid)
3443
3379
del pidfile
3444
3380
del pidfilename
3445
3381
3595
3531
3596
3532
try:
3597
3533
with tempfile.NamedTemporaryFile(
3598
mode="wb",
3534
mode='wb',
3599
3535
suffix=".pickle",
3600
prefix="clients-",
3536
prefix='clients-',
3601
3537
dir=os.path.dirname(stored_state_path),
3602
3538
delete=False) as stored_state:
3603
3539
pickle.dump((clients, client_settings), stored_state,
3611
3547
except NameError:
3612
3548
pass
3613
3549
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3614
log.warning("Could not save persistent state: %s",
3615
os.strerror(e.errno))
3550
logger.warning("Could not save persistent state: {}"
3551
.format(os.strerror(e.errno)))
3616
3552
else:
3617
log.warning("Could not save persistent state:",
3618
exc_info=e)
3553
logger.warning("Could not save persistent state:",
3554
exc_info=e)
3619
3555
raise
3620
3556
3621
3557
# Delete all clients, and settings from config
3638
3574
mandos_dbus_service.client_added_signal(client)
3639
3575
# Need to initiate checking of clients
3640
3576
if client.enabled:
3641
client.init_checker(randomize_start=True)
3577
client.init_checker()
3642
3578
3643
3579
tcp_server.enable()
3644
3580
tcp_server.server_activate()
3647
3583
if zeroconf:
3648
3584
service.port = tcp_server.socket.getsockname()[1]
3649
3585
if use_ipv6:
3650
log.info("Now listening on address %r, port %d, flowinfo %d,"
3651
" scope_id %d", *tcp_server.socket.getsockname())
3586
logger.info("Now listening on address %r, port %d,"
3587
" flowinfo %d, scope_id %d",
3588
*tcp_server.socket.getsockname())
3652
3589
else: # IPv4
3653
log.info("Now listening on address %r, port %d",
3654
*tcp_server.socket.getsockname())
3590
logger.info("Now listening on address %r, port %d",
3591
*tcp_server.socket.getsockname())
3655
3592
3656
3593
# service.interface = tcp_server.socket.getsockname()[3]
3657
3594
3661
3598
try:
3662
3599
service.activate()
3663
3600
except dbus.exceptions.DBusException as error:
3664
log.critical("D-Bus Exception", exc_info=error)
3601
logger.critical("D-Bus Exception", exc_info=error)
3665
3602
cleanup()
3666
3603
sys.exit(1)
3667
3604
# End of Avahi example code
3672
3609
lambda *args, **kwargs: (tcp_server.handle_request
3673
3610
(*args[2:], **kwargs) or True))
3674
3611
3675
log.debug("Starting main loop")
3612
logger.debug("Starting main loop")
3676
3613
main_loop.run()
3677
3614
except AvahiError as error:
3678
log.critical("Avahi Error", exc_info=error)
3615
logger.critical("Avahi Error", exc_info=error)
3679
3616
cleanup()
3680
3617
sys.exit(1)
3681
3618
except KeyboardInterrupt:
3682
3619
if debug:
3683
3620
print("", file=sys.stderr)
3684
log.debug("Server received KeyboardInterrupt")
3685
log.debug("Server exiting")
3621
logger.debug("Server received KeyboardInterrupt")
3622
logger.debug("Server exiting")
3686
3623
# Must run before the D-Bus bus name gets deregistered
3687
3624
cleanup()
3688
3625
3689
3626
3690
def parse_test_args():
3691
# type: () -> argparse.Namespace
3627
def should_only_run_tests():
3692
3628
parser = argparse.ArgumentParser(add_help=False)
3693
parser.add_argument("--check", action="store_true")
3694
parser.add_argument("--prefix", )
3629
parser.add_argument("--check", action='store_true')
3695
3630
args, unknown_args = parser.parse_known_args()
3696
if args.check:
3697
# Remove test options from sys.argv
3631
run_tests = args.check
3632
if run_tests:
3633
# Remove --check argument from sys.argv
3698
3634
sys.argv[1:] = unknown_args
3699
return args
3635
return run_tests
3700
3636
3701
3637
# Add all tests from doctest strings
3702
3638
def load_tests(loader, tests, none):
3704
3640
tests.addTests(doctest.DocTestSuite())
3705
3641
return tests
3706
3642
3707
if __name__ == "__main__":
3708
options = parse_test_args()
3643
if __name__ == '__main__':
3709
3644
try:
3710
if options.check:
3711
extra_test_prefix = options.prefix
3712
if extra_test_prefix is not None:
3713
if not (unittest.main(argv=[""], exit=False)
3714
.result.wasSuccessful()):
3715
sys.exit(1)
3716
class ExtraTestLoader(unittest.TestLoader):
3717
testMethodPrefix = extra_test_prefix
3718
# Call using ./scriptname --test [--verbose]
3719
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3720
else:
3721
unittest.main(argv=[""])
3645
if should_only_run_tests():
3646
# Call using ./mandos --check [--verbose]
3647
unittest.main()
3722
3648
else:
3723
3649
main()
3724
3650
finally:
3725
3651
logging.shutdown()
3726
3727
# Local Variables:
3728
# run-tests:
3729
# (lambda (&optional extra)
3730
# (if (not (funcall run-tests-in-test-buffer default-directory
3731
# extra))
3732
# (funcall show-test-buffer-in-test-window)
3733
# (funcall remove-test-window)
3734
# (if extra (message "Extra tests run successfully!"))))
3735
# run-tests-in-test-buffer:
3736
# (lambda (dir &optional extra)
3737
# (with-current-buffer (get-buffer-create "*Test*")
3738
# (setq buffer-read-only nil
3739
# default-directory dir)
3740
# (erase-buffer)
3741
# (compilation-mode))
3742
# (let ((process-result
3743
# (let ((inhibit-read-only t))
3744
# (process-file-shell-command
3745
# (funcall get-command-line extra) nil "*Test*"))))
3746
# (and (numberp process-result)
3747
# (= process-result 0))))
3748
# get-command-line:
3749
# (lambda (&optional extra)
3750
# (let ((quoted-script
3751
# (shell-quote-argument (funcall get-script-name))))
3752
# (format
3753
# (concat "%s --check" (if extra " --prefix=atest" ""))
3754
# quoted-script)))
3755
# get-script-name:
3756
# (lambda ()
3757
# (if (fboundp 'file-local-name)
3758
# (file-local-name (buffer-file-name))
3759
# (or (file-remote-p (buffer-file-name) 'localname)
3760
# (buffer-file-name))))
3761
# remove-test-window:
3762
# (lambda ()
3763
# (let ((test-window (get-buffer-window "*Test*")))
3764
# (if test-window (delete-window test-window))))
3765
# show-test-buffer-in-test-window:
3766
# (lambda ()
3767
# (when (not (get-buffer-window-list "*Test*"))
3768
# (setq next-error-last-buffer (get-buffer "*Test*"))
3769
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3770
# (display-buffer-overriding-action
3771
# `((display-buffer-in-side-window) (side . ,side)
3772
# (window-height . fit-window-to-buffer)
3773
# (window-width . fit-window-to-buffer))))
3774
# (display-buffer "*Test*"))))
3775
# eval:
3776
# (progn
3777
# (let* ((run-extra-tests (lambda () (interactive)
3778
# (funcall run-tests t)))
3779
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3780
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3781
# (setq minor-mode-overriding-map-alist
3782
# (cons `(run-tests . ,outer-keymap)
3783
# minor-mode-overriding-map-alist)))
3784
# (add-hook 'after-save-hook run-tests 90 t))
3785
# End:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0