To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1186
- compare with another revision
- download diff
- download tarball
- view history from revision 1186
- Committer: Teddy Hogeborn
- Date: 2019-11-03 19:17:57 UTC
- Revision ID: teddy@recompile.se-20191103191757-1hdpp0u5fxa8iumo
INSTALL: Add "-" argument to "su" invocations.
- files removed:
- debian/po/es.po
- files modified:
- .bzrignore
added
removed
mandos
1
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
39
40
except ImportError:
40
41
pass
41
42
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
43
try:
48
44
import SocketServer as socketserver
49
45
except ImportError:
50
46
import socketserver
51
47
import socket
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
import ConfigParser as configparser
56
53
except ImportError:
57
54
import configparser
55
import sys
58
56
import re
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import random
81
import shlex
80
import unittest
82
81
83
82
import dbus
84
83
import dbus.service
92
91
93
92
if sys.version_info.major == 2:
94
93
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
94
113
95
# Show warnings by default
114
96
if not sys.warnoptions:
140
122
# No value found
141
123
SO_BINDTODEVICE = None
142
124
125
if sys.version_info.major == 2:
126
str = unicode
127
143
128
if sys.version_info < (3, 2):
144
129
configparser.Configparser = configparser.SafeConfigParser
145
130
146
version = "1.8.16"
131
version = "1.8.9"
147
132
stored_state_file = "clients.pickle"
148
133
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
134
logger = logging.getLogger()
150
135
logging.captureWarnings(True) # Show warnings via the logging system
151
136
syslogger = None
152
137
189
174
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
175
address="/dev/log"))
191
176
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
177
('Mandos [%(process)d]: %(levelname)s:'
178
' %(message)s'))
179
logger.addHandler(syslogger)
195
180
196
181
if debug:
197
182
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
183
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
184
' [%(process)d]:'
185
' %(levelname)s:'
186
' %(message)s'))
187
logger.addHandler(console)
188
logger.setLevel(level)
204
189
205
190
206
191
class PGPError(Exception):
224
209
except OSError as e:
225
210
if e.errno != errno.ENOENT:
226
211
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
212
self.gnupgargs = ['--batch',
213
'--homedir', self.tempdir,
214
'--force-mdc',
215
'--quiet']
231
216
# Only GPG version 1 has the --no-use-agent option.
232
217
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
218
self.gnupgargs.append("--no-use-agent")
272
257
dir=self.tempdir) as passfile:
273
258
passfile.write(passphrase)
274
259
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
260
proc = subprocess.Popen([self.gpg, '--symmetric',
261
'--passphrase-file',
277
262
passfile.name]
278
263
+ self.gnupgargs,
279
264
stdin=subprocess.PIPE,
290
275
dir=self.tempdir) as passfile:
291
276
passfile.write(passphrase)
292
277
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
278
proc = subprocess.Popen([self.gpg, '--decrypt',
279
'--passphrase-file',
295
280
passfile.name]
296
281
+ self.gnupgargs,
297
282
stdin=subprocess.PIPE,
350
335
Attributes:
351
336
interface: integer; avahi.IF_UNSPEC or an interface index.
352
337
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
338
name: string; Example: 'Mandos'
339
type: string; Example: '_mandos._tcp'.
355
340
See <https://www.iana.org/assignments/service-names-port-numbers>
356
341
port: integer; what port to announce
357
342
TXT: list of strings; TXT record for the service
394
379
def rename(self, remove=True):
395
380
"""Derived from the Avahi example code"""
396
381
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
382
logger.critical("No suitable Zeroconf service name found"
383
" after %i retries, exiting.",
384
self.rename_count)
400
385
raise AvahiServiceError("Too many renames")
401
386
self.name = str(
402
387
self.server.GetAlternativeServiceName(self.name))
403
388
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
389
logger.info("Changing Zeroconf service name to %r ...",
390
self.name)
406
391
if remove:
407
392
self.remove()
408
393
try:
410
395
except dbus.exceptions.DBusException as error:
411
396
if (error.get_dbus_name()
412
397
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
398
logger.info("Local Zeroconf service name collision.")
414
399
return self.rename(remove=False)
415
400
else:
416
log.critical("D-Bus Exception", exc_info=error)
401
logger.critical("D-Bus Exception", exc_info=error)
417
402
self.cleanup()
418
403
os._exit(1)
419
404
435
420
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
421
self.entry_group_state_changed_match = (
437
422
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
423
'StateChanged', self.entry_group_state_changed))
424
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
425
self.name, self.type)
441
426
self.group.AddService(
442
427
self.interface,
443
428
self.protocol,
450
435
451
436
def entry_group_state_changed(self, state, error):
452
437
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
438
logger.debug("Avahi entry group state change: %i", state)
454
439
455
440
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
441
logger.debug("Zeroconf service established.")
457
442
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
443
logger.info("Zeroconf service name collision.")
459
444
self.rename()
460
445
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
446
logger.critical("Avahi: Error in group state changed %s",
447
str(error))
463
448
raise AvahiGroupError("State changed: {!s}".format(error))
464
449
465
450
def cleanup(self):
475
460
476
461
def server_state_changed(self, state, error=None):
477
462
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
463
logger.debug("Avahi server state change: %i", state)
479
464
bad_states = {
480
465
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
466
avahi.SERVER_REGISTERING: None,
485
470
if state in bad_states:
486
471
if bad_states[state] is not None:
487
472
if error is None:
488
log.error(bad_states[state])
473
logger.error(bad_states[state])
489
474
else:
490
log.error(bad_states[state] + ": %r", error)
475
logger.error(bad_states[state] + ": %r", error)
491
476
self.cleanup()
492
477
elif state == avahi.SERVER_RUNNING:
493
478
try:
495
480
except dbus.exceptions.DBusException as error:
496
481
if (error.get_dbus_name()
497
482
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
483
logger.info("Local Zeroconf service name"
484
" collision.")
499
485
return self.rename(remove=False)
500
486
else:
501
log.critical("D-Bus Exception", exc_info=error)
487
logger.critical("D-Bus Exception", exc_info=error)
502
488
self.cleanup()
503
489
os._exit(1)
504
490
else:
505
491
if error is None:
506
log.debug("Unknown state: %r", state)
492
logger.debug("Unknown state: %r", state)
507
493
else:
508
log.debug("Unknown state: %r: %r", state, error)
494
logger.debug("Unknown state: %r: %r", state, error)
509
495
510
496
def activate(self):
511
497
"""Derived from the Avahi example code"""
523
509
class AvahiServiceToSyslog(AvahiService):
524
510
def rename(self, *args, **kwargs):
525
511
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
512
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
528
513
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
514
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
515
.format(self.name)))
531
516
return ret
532
517
562
547
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
548
564
549
# Types
565
class _session_int(ctypes.Structure):
550
class session_int(ctypes.Structure):
566
551
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
552
session_t = ctypes.POINTER(session_int)
568
553
569
554
class certificate_credentials_st(ctypes.Structure):
570
555
_fields_ = []
573
558
certificate_type_t = ctypes.c_int
574
559
575
560
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
561
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
562
('size', ctypes.c_uint)]
578
563
579
class _openpgp_crt_int(ctypes.Structure):
564
class openpgp_crt_int(ctypes.Structure):
580
565
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
566
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
567
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
568
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
569
credentials_type_t = ctypes.c_int
593
578
# gnutls.strerror()
594
579
self.code = code
595
580
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
581
message = gnutls.strerror(code)
598
582
return super(gnutls.Error, self).__init__(
599
583
message, *args)
600
584
601
585
class CertificateSecurityError(Error):
602
586
pass
603
587
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
588
# Classes
630
class Credentials(With_from_param):
589
class Credentials:
631
590
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
591
self._c_object = gnutls.certificate_credentials_t()
592
gnutls.certificate_allocate_credentials(
593
ctypes.byref(self._c_object))
634
594
self.type = gnutls.CRD_CERTIFICATE
635
595
636
596
def __del__(self):
637
gnutls.certificate_free_credentials(self)
597
gnutls.certificate_free_credentials(self._c_object)
638
598
639
class ClientSession(With_from_param):
599
class ClientSession:
640
600
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
601
self._c_object = gnutls.session_t()
642
602
gnutls_flags = gnutls.CLIENT
643
603
if gnutls.check_version(b"3.5.6"):
644
604
gnutls_flags |= gnutls.NO_TICKETS
645
605
if gnutls.has_rawpk:
646
606
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
607
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
648
608
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
609
gnutls.set_default_priority(self._c_object)
610
gnutls.transport_set_ptr(self._c_object, socket.fileno())
611
gnutls.handshake_set_private_extensions(self._c_object,
612
True)
652
613
self.socket = socket
653
614
if credentials is None:
654
615
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
616
gnutls.credentials_set(self._c_object, credentials.type,
617
ctypes.cast(credentials._c_object,
618
ctypes.c_void_p))
657
619
self.credentials = credentials
658
620
659
621
def __del__(self):
660
gnutls.deinit(self)
622
gnutls.deinit(self._c_object)
661
623
662
624
def handshake(self):
663
return gnutls.handshake(self)
625
return gnutls.handshake(self._c_object)
664
626
665
627
def send(self, data):
666
628
data = bytes(data)
667
629
data_len = len(data)
668
630
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
631
data_len -= gnutls.record_send(self._c_object,
632
data[-data_len:],
670
633
data_len)
671
634
672
635
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
636
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
637
675
638
# Error handling functions
676
639
def _error_code(result):
677
640
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
641
for the 'restype' attribute on ctypes functions"""
642
if result >= 0:
680
643
return result
681
644
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
645
raise gnutls.CertificateSecurityError(code=result)
683
646
raise gnutls.Error(code=result)
684
647
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
648
def _retry_on_error(result, func, arguments):
687
649
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
650
for the 'errcheck' attribute on ctypes functions"""
651
while result < 0:
690
652
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
653
return _error_code(result)
692
654
result = func(*arguments)
697
659
698
660
# Functions
699
661
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
662
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
663
ctypes.POINTER(ctypes.c_char_p)]
702
664
priority_set_direct.restype = _error_code
703
665
704
666
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
667
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
668
init.restype = _error_code
707
669
708
670
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
671
set_default_priority.argtypes = [session_t]
710
672
set_default_priority.restype = _error_code
711
673
712
674
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
675
record_send.argtypes = [session_t, ctypes.c_void_p,
714
676
ctypes.c_size_t]
715
677
record_send.restype = ctypes.c_ssize_t
716
678
record_send.errcheck = _retry_on_error
718
680
certificate_allocate_credentials = (
719
681
_library.gnutls_certificate_allocate_credentials)
720
682
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
683
ctypes.POINTER(certificate_credentials_t)]
722
684
certificate_allocate_credentials.restype = _error_code
723
685
724
686
certificate_free_credentials = (
725
687
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
688
certificate_free_credentials.argtypes = [
689
certificate_credentials_t]
727
690
certificate_free_credentials.restype = None
728
691
729
692
handshake_set_private_extensions = (
730
693
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
694
handshake_set_private_extensions.argtypes = [session_t,
732
695
ctypes.c_int]
733
696
handshake_set_private_extensions.restype = None
734
697
735
698
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
699
credentials_set.argtypes = [session_t, credentials_type_t,
700
ctypes.c_void_p]
738
701
credentials_set.restype = _error_code
739
702
740
703
strerror = _library.gnutls_strerror
742
705
strerror.restype = ctypes.c_char_p
743
706
744
707
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
708
certificate_type_get.argtypes = [session_t]
746
709
certificate_type_get.restype = _error_code
747
710
748
711
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
712
certificate_get_peers.argtypes = [session_t,
750
713
ctypes.POINTER(ctypes.c_uint)]
751
714
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
715
759
722
global_set_log_function.restype = None
760
723
761
724
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
725
deinit.argtypes = [session_t]
763
726
deinit.restype = None
764
727
765
728
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
729
handshake.argtypes = [session_t]
730
handshake.restype = _error_code
768
731
handshake.errcheck = _retry_on_error
769
732
770
733
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
734
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
735
transport_set_ptr.restype = None
773
736
774
737
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
738
bye.argtypes = [session_t, close_request_t]
739
bye.restype = _error_code
777
740
bye.errcheck = _retry_on_error
778
741
779
742
check_version = _library.gnutls_check_version
796
759
797
760
x509_crt_fmt_t = ctypes.c_int
798
761
799
# All the function declarations below are from
800
# gnutls/abstract.h
762
# All the function declarations below are from gnutls/abstract.h
801
763
pubkey_init = _library.gnutls_pubkey_init
802
764
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
765
pubkey_init.restype = _error_code
817
779
pubkey_deinit.argtypes = [pubkey_t]
818
780
pubkey_deinit.restype = None
819
781
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
782
# All the function declarations below are from gnutls/openpgp.h
822
783
823
784
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
785
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
830
791
openpgp_crt_fmt_t]
831
792
openpgp_crt_import.restype = _error_code
832
793
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
794
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
795
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
796
ctypes.POINTER(ctypes.c_uint)]
840
797
openpgp_crt_verify_self.restype = _error_code
841
798
842
799
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
853
810
854
811
if check_version(b"3.6.4"):
855
812
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
813
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
857
814
certificate_type_get2.restype = _error_code
858
815
859
816
# Remove non-public functions
875
832
"""A representation of a client host served by this server.
876
833
877
834
Attributes:
878
approved: bool(); None if not yet approved/disapproved
835
approved: bool(); 'None' if not yet approved/disapproved
879
836
approval_delay: datetime.timedelta(); Time to wait for approval
880
837
approval_duration: datetime.timedelta(); Duration of one approval
881
838
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
839
to see if the client lives. 'None' if no process is
883
840
running.
884
841
checker_callback_tag: a GLib event source tag, or None
885
842
checker_command: string; External command which is run to check
1009
966
self.last_enabled = None
1010
967
self.expires = None
1011
968
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
969
logger.debug("Creating client %r", self.name)
970
logger.debug(" Key ID: %s", self.key_id)
971
logger.debug(" Fingerprint: %s", self.fingerprint)
1015
972
self.created = settings.get("created",
1016
973
datetime.datetime.utcnow())
1017
974
1045
1002
if getattr(self, "enabled", False):
1046
1003
# Already enabled
1047
1004
return
1005
self.expires = datetime.datetime.utcnow() + self.timeout
1048
1006
self.enabled = True
1049
1007
self.last_enabled = datetime.datetime.utcnow()
1050
1008
self.init_checker()
1055
1013
if not getattr(self, "enabled", False):
1056
1014
return False
1057
1015
if not quiet:
1058
log.info("Disabling client %s", self.name)
1016
logger.info("Disabling client %s", self.name)
1059
1017
if getattr(self, "disable_initiator_tag", None) is not None:
1060
1018
GLib.source_remove(self.disable_initiator_tag)
1061
1019
self.disable_initiator_tag = None
1073
1031
def __del__(self):
1074
1032
self.disable()
1075
1033
1076
def init_checker(self, randomize_start=False):
1077
# Schedule a new checker to be started a randomly selected
1078
# time (a fraction of 'interval') from now. This spreads out
1079
# the startup of checkers over time when the server is
1080
# started.
1034
def init_checker(self):
1035
# Schedule a new checker to be started an 'interval' from now,
1036
# and every interval from then on.
1081
1037
if self.checker_initiator_tag is not None:
1082
1038
GLib.source_remove(self.checker_initiator_tag)
1083
interval_milliseconds = int(self.interval.total_seconds()
1084
* 1000)
1085
if randomize_start:
1086
delay_milliseconds = random.randrange(
1087
interval_milliseconds + 1)
1088
else:
1089
delay_milliseconds = interval_milliseconds
1090
1039
self.checker_initiator_tag = GLib.timeout_add(
1091
delay_milliseconds, self.start_checker, randomize_start)
1092
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1093
# A checker might take up to an 'interval' of time, so we can
1094
# expire at the soonest one interval after a checker was
1095
# started. Since the initial checker is delayed, the expire
1096
# time might have to be extended.
1097
now = datetime.datetime.utcnow()
1098
self.expires = now + delay + self.interval
1099
# Schedule a disable() at expire time
1040
int(self.interval.total_seconds() * 1000),
1041
self.start_checker)
1042
# Schedule a disable() when 'timeout' has passed
1100
1043
if self.disable_initiator_tag is not None:
1101
1044
GLib.source_remove(self.disable_initiator_tag)
1102
1045
self.disable_initiator_tag = GLib.timeout_add(
1103
int((self.expires - now).total_seconds() * 1000),
1104
self.disable)
1046
int(self.timeout.total_seconds() * 1000), self.disable)
1047
# Also start a new checker *right now*.
1048
self.start_checker()
1105
1049
1106
1050
def checker_callback(self, source, condition, connection,
1107
1051
command):
1118
1062
self.last_checker_status = returncode
1119
1063
self.last_checker_signal = None
1120
1064
if self.last_checker_status == 0:
1121
log.info("Checker for %(name)s succeeded", vars(self))
1065
logger.info("Checker for %(name)s succeeded",
1066
vars(self))
1122
1067
self.checked_ok()
1123
1068
else:
1124
log.info("Checker for %(name)s failed", vars(self))
1069
logger.info("Checker for %(name)s failed", vars(self))
1125
1070
else:
1126
1071
self.last_checker_status = -1
1127
1072
self.last_checker_signal = -returncode
1128
log.warning("Checker for %(name)s crashed?", vars(self))
1073
logger.warning("Checker for %(name)s crashed?",
1074
vars(self))
1129
1075
return False
1130
1076
1131
1077
def checked_ok(self):
1150
1096
def need_approval(self):
1151
1097
self.last_approval_request = datetime.datetime.utcnow()
1152
1098
1153
def start_checker(self, start_was_randomized=False):
1099
def start_checker(self):
1154
1100
"""Start a new checker subprocess if one is not running.
1155
1101
1156
1102
If a checker already exists, leave it running and do
1165
1111
# should be.
1166
1112
1167
1113
if self.checker is not None and not self.checker.is_alive():
1168
log.warning("Checker was not alive; joining")
1114
logger.warning("Checker was not alive; joining")
1169
1115
self.checker.join()
1170
1116
self.checker = None
1171
1117
# Start a new checker if needed
1172
1118
if self.checker is None:
1173
1119
# Escape attributes for the shell
1174
1120
escaped_attrs = {
1175
attr: shlex.quote(str(getattr(self, attr)))
1121
attr: re.escape(str(getattr(self, attr)))
1176
1122
for attr in self.runtime_expansions}
1177
1123
try:
1178
1124
command = self.checker_command % escaped_attrs
1179
1125
except TypeError as error:
1180
log.error('Could not format string "%s"',
1181
self.checker_command, exc_info=error)
1126
logger.error('Could not format string "%s"',
1127
self.checker_command,
1128
exc_info=error)
1182
1129
return True # Try again later
1183
1130
self.current_checker_command = command
1184
log.info("Starting checker %r for %s", command, self.name)
1131
logger.info("Starting checker %r for %s", command,
1132
self.name)
1185
1133
# We don't need to redirect stdout and stderr, since
1186
1134
# in normal mode, that is already done by daemon(),
1187
1135
# and in debug mode we don't want to. (Stdin is
1206
1154
GLib.IOChannel.unix_new(pipe[0].fileno()),
1207
1155
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1208
1156
self.checker_callback, pipe[0], command)
1209
if start_was_randomized:
1210
# We were started after a random delay; Schedule a new
1211
# checker to be started an 'interval' from now, and every
1212
# interval from then on.
1213
now = datetime.datetime.utcnow()
1214
self.checker_initiator_tag = GLib.timeout_add(
1215
int(self.interval.total_seconds() * 1000),
1216
self.start_checker)
1217
self.expires = max(self.expires, now + self.interval)
1218
# Don't start a new checker again after same random delay
1219
return False
1220
1157
# Re-run this periodically if run by GLib.timeout_add
1221
1158
return True
1222
1159
1227
1164
self.checker_callback_tag = None
1228
1165
if getattr(self, "checker", None) is None:
1229
1166
return
1230
log.debug("Stopping checker for %(name)s", vars(self))
1167
logger.debug("Stopping checker for %(name)s", vars(self))
1231
1168
self.checker.terminate()
1232
1169
self.checker = None
1233
1170
1260
1197
func._dbus_name = func.__name__
1261
1198
if func._dbus_name.endswith("_dbus_property"):
1262
1199
func._dbus_name = func._dbus_name[:-14]
1263
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1200
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1264
1201
return func
1265
1202
1266
1203
return decorator
1355
1292
1356
1293
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1357
1294
out_signature="s",
1358
path_keyword="object_path",
1359
connection_keyword="connection")
1295
path_keyword='object_path',
1296
connection_keyword='connection')
1360
1297
def Introspect(self, object_path, connection):
1361
1298
"""Overloading of standard D-Bus method.
1362
1299
1411
1348
document.unlink()
1412
1349
except (AttributeError, xml.dom.DOMException,
1413
1350
xml.parsers.expat.ExpatError) as error:
1414
log.error("Failed to override Introspection method",
1415
exc_info=error)
1351
logger.error("Failed to override Introspection method",
1352
exc_info=error)
1416
1353
return xmlstring
1417
1354
1418
1355
1476
1413
raise ValueError("Byte arrays not supported for non-"
1477
1414
"'ay' signature {!r}"
1478
1415
.format(prop._dbus_signature))
1479
value = dbus.ByteArray(bytes(value))
1416
value = dbus.ByteArray(b''.join(chr(byte)
1417
for byte in value))
1480
1418
prop(value)
1481
1419
1482
1420
@dbus.service.method(dbus.PROPERTIES_IFACE,
1515
1453
1516
1454
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1517
1455
out_signature="s",
1518
path_keyword="object_path",
1519
connection_keyword="connection")
1456
path_keyword='object_path',
1457
connection_keyword='connection')
1520
1458
def Introspect(self, object_path, connection):
1521
1459
"""Overloading of standard D-Bus method.
1522
1460
1578
1516
document.unlink()
1579
1517
except (AttributeError, xml.dom.DOMException,
1580
1518
xml.parsers.expat.ExpatError) as error:
1581
log.error("Failed to override Introspection method",
1582
exc_info=error)
1519
logger.error("Failed to override Introspection method",
1520
exc_info=error)
1583
1521
return xmlstring
1584
1522
1585
1523
1617
1555
1618
1556
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1619
1557
out_signature="s",
1620
path_keyword="object_path",
1621
connection_keyword="connection")
1558
path_keyword='object_path',
1559
connection_keyword='connection')
1622
1560
def Introspect(self, object_path, connection):
1623
1561
"""Overloading of standard D-Bus method.
1624
1562
1649
1587
document.unlink()
1650
1588
except (AttributeError, xml.dom.DOMException,
1651
1589
xml.parsers.expat.ExpatError) as error:
1652
log.error("Failed to override Introspection method",
1653
exc_info=error)
1590
logger.error("Failed to override Introspection method",
1591
exc_info=error)
1654
1592
return xmlstring
1655
1593
1656
1594
2290
2228
class ProxyClient:
2291
2229
def __init__(self, child_pipe, key_id, fpr, address):
2292
2230
self._pipe = child_pipe
2293
self._pipe.send(("init", key_id, fpr, address))
2231
self._pipe.send(('init', key_id, fpr, address))
2294
2232
if not self._pipe.recv():
2295
2233
raise KeyError(key_id or fpr)
2296
2234
2297
2235
def __getattribute__(self, name):
2298
if name == "_pipe":
2236
if name == '_pipe':
2299
2237
return super(ProxyClient, self).__getattribute__(name)
2300
self._pipe.send(("getattr", name))
2238
self._pipe.send(('getattr', name))
2301
2239
data = self._pipe.recv()
2302
if data[0] == "data":
2240
if data[0] == 'data':
2303
2241
return data[1]
2304
if data[0] == "function":
2242
if data[0] == 'function':
2305
2243
2306
2244
def func(*args, **kwargs):
2307
self._pipe.send(("funcall", name, args, kwargs))
2245
self._pipe.send(('funcall', name, args, kwargs))
2308
2246
return self._pipe.recv()[1]
2309
2247
2310
2248
return func
2311
2249
2312
2250
def __setattr__(self, name, value):
2313
if name == "_pipe":
2251
if name == '_pipe':
2314
2252
return super(ProxyClient, self).__setattr__(name, value)
2315
self._pipe.send(("setattr", name, value))
2253
self._pipe.send(('setattr', name, value))
2316
2254
2317
2255
2318
2256
class ClientHandler(socketserver.BaseRequestHandler, object):
2323
2261
2324
2262
def handle(self):
2325
2263
with contextlib.closing(self.server.child_pipe) as child_pipe:
2326
log.info("TCP connection from: %s",
2327
str(self.client_address))
2328
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2264
logger.info("TCP connection from: %s",
2265
str(self.client_address))
2266
logger.debug("Pipe FD: %d",
2267
self.server.child_pipe.fileno())
2329
2268
2330
2269
session = gnutls.ClientSession(self.request)
2331
2270
2332
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2271
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2333
2272
# "+AES-256-CBC", "+SHA1",
2334
2273
# "+COMP-NULL", "+CTYPE-OPENPGP",
2335
2274
# "+DHE-DSS"))
2337
2276
priority = self.server.gnutls_priority
2338
2277
if priority is None:
2339
2278
priority = "NORMAL"
2340
gnutls.priority_set_direct(session,
2341
priority.encode("utf-8"), None)
2279
gnutls.priority_set_direct(session._c_object,
2280
priority.encode("utf-8"),
2281
None)
2342
2282
2343
2283
# Start communication using the Mandos protocol
2344
2284
# Get protocol number
2345
2285
line = self.request.makefile().readline()
2346
log.debug("Protocol version: %r", line)
2286
logger.debug("Protocol version: %r", line)
2347
2287
try:
2348
2288
if int(line.strip().split()[0]) > 1:
2349
2289
raise RuntimeError(line)
2350
2290
except (ValueError, IndexError, RuntimeError) as error:
2351
log.error("Unknown protocol version: %s", error)
2291
logger.error("Unknown protocol version: %s", error)
2352
2292
return
2353
2293
2354
2294
# Start GnuTLS connection
2355
2295
try:
2356
2296
session.handshake()
2357
2297
except gnutls.Error as error:
2358
log.warning("Handshake failed: %s", error)
2298
logger.warning("Handshake failed: %s", error)
2359
2299
# Do not run session.bye() here: the session is not
2360
2300
# established. Just abandon the request.
2361
2301
return
2362
log.debug("Handshake succeeded")
2302
logger.debug("Handshake succeeded")
2363
2303
2364
2304
approval_required = False
2365
2305
try:
2369
2309
key_id = self.key_id(
2370
2310
self.peer_certificate(session))
2371
2311
except (TypeError, gnutls.Error) as error:
2372
log.warning("Bad certificate: %s", error)
2312
logger.warning("Bad certificate: %s", error)
2373
2313
return
2374
log.debug("Key ID: %s",
2375
key_id.decode("utf-8",
2376
errors="replace"))
2314
logger.debug("Key ID: %s", key_id)
2377
2315
2378
2316
else:
2379
2317
key_id = b""
2381
2319
fpr = self.fingerprint(
2382
2320
self.peer_certificate(session))
2383
2321
except (TypeError, gnutls.Error) as error:
2384
log.warning("Bad certificate: %s", error)
2322
logger.warning("Bad certificate: %s", error)
2385
2323
return
2386
log.debug("Fingerprint: %s", fpr)
2324
logger.debug("Fingerprint: %s", fpr)
2387
2325
2388
2326
try:
2389
2327
client = ProxyClient(child_pipe, key_id, fpr,
2398
2336
2399
2337
while True:
2400
2338
if not client.enabled:
2401
log.info("Client %s is disabled", client.name)
2339
logger.info("Client %s is disabled",
2340
client.name)
2402
2341
if self.server.use_dbus:
2403
2342
# Emit D-Bus signal
2404
2343
client.Rejected("Disabled")
2408
2347
# We are approved or approval is disabled
2409
2348
break
2410
2349
elif client.approved is None:
2411
log.info("Client %s needs approval",
2412
client.name)
2350
logger.info("Client %s needs approval",
2351
client.name)
2413
2352
if self.server.use_dbus:
2414
2353
# Emit D-Bus signal
2415
2354
client.NeedApproval(
2416
2355
client.approval_delay.total_seconds()
2417
2356
* 1000, client.approved_by_default)
2418
2357
else:
2419
log.warning("Client %s was not approved",
2420
client.name)
2358
logger.warning("Client %s was not approved",
2359
client.name)
2421
2360
if self.server.use_dbus:
2422
2361
# Emit D-Bus signal
2423
2362
client.Rejected("Denied")
2431
2370
time2 = datetime.datetime.now()
2432
2371
if (time2 - time) >= delay:
2433
2372
if not client.approved_by_default:
2434
log.warning("Client %s timed out while"
2435
" waiting for approval",
2436
client.name)
2373
logger.warning("Client %s timed out while"
2374
" waiting for approval",
2375
client.name)
2437
2376
if self.server.use_dbus:
2438
2377
# Emit D-Bus signal
2439
2378
client.Rejected("Approval timed out")
2446
2385
try:
2447
2386
session.send(client.secret)
2448
2387
except gnutls.Error as error:
2449
log.warning("gnutls send failed", exc_info=error)
2388
logger.warning("gnutls send failed",
2389
exc_info=error)
2450
2390
return
2451
2391
2452
log.info("Sending secret to %s", client.name)
2392
logger.info("Sending secret to %s", client.name)
2453
2393
# bump the timeout using extended_timeout
2454
2394
client.bump_timeout(client.extended_timeout)
2455
2395
if self.server.use_dbus:
2462
2402
try:
2463
2403
session.bye()
2464
2404
except gnutls.Error as error:
2465
log.warning("GnuTLS bye failed", exc_info=error)
2405
logger.warning("GnuTLS bye failed",
2406
exc_info=error)
2466
2407
2467
2408
@staticmethod
2468
2409
def peer_certificate(session):
2469
2410
"Return the peer's certificate as a bytestring"
2470
2411
try:
2471
cert_type = gnutls.certificate_type_get2(
2472
session, gnutls.CTYPE_PEERS)
2412
cert_type = gnutls.certificate_type_get2(session._c_object,
2413
gnutls.CTYPE_PEERS)
2473
2414
except AttributeError:
2474
cert_type = gnutls.certificate_type_get(session)
2415
cert_type = gnutls.certificate_type_get(session._c_object)
2475
2416
if gnutls.has_rawpk:
2476
2417
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2477
2418
else:
2478
2419
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2479
2420
# If not a valid certificate type...
2480
2421
if cert_type not in valid_cert_types:
2481
log.info("Cert type %r not in %r", cert_type,
2482
valid_cert_types)
2422
logger.info("Cert type %r not in %r", cert_type,
2423
valid_cert_types)
2483
2424
# ...return invalid data
2484
2425
return b""
2485
2426
list_size = ctypes.c_uint(1)
2486
2427
cert_list = (gnutls.certificate_get_peers
2487
(session, ctypes.byref(list_size)))
2428
(session._c_object, ctypes.byref(list_size)))
2488
2429
if not bool(cert_list) and list_size.value != 0:
2489
2430
raise gnutls.Error("error getting peer certificate")
2490
2431
if list_size.value == 0:
2512
2453
buf = ctypes.create_string_buffer(32)
2513
2454
buf_len = ctypes.c_size_t(len(buf))
2514
2455
# Get the key ID from the raw public key into the buffer
2515
gnutls.pubkey_get_key_id(
2516
pubkey,
2517
gnutls.KEYID_USE_SHA256,
2518
ctypes.cast(ctypes.byref(buf),
2519
ctypes.POINTER(ctypes.c_ubyte)),
2520
ctypes.byref(buf_len))
2456
gnutls.pubkey_get_key_id(pubkey,
2457
gnutls.KEYID_USE_SHA256,
2458
ctypes.cast(ctypes.byref(buf),
2459
ctypes.POINTER(ctypes.c_ubyte)),
2460
ctypes.byref(buf_len))
2521
2461
# Deinit the certificate
2522
2462
gnutls.pubkey_deinit(pubkey)
2523
2463
2604
2544
2605
2545
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2606
2546
socketserver.TCPServer):
2607
"""IPv6-capable TCP server. Accepts None as address and/or port
2547
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2608
2548
2609
2549
Attributes:
2610
2550
enabled: Boolean; whether this server is activated yet
2661
2601
if SO_BINDTODEVICE is None:
2662
2602
# Fall back to a hard-coded value which seems to be
2663
2603
# common enough.
2664
log.warning("SO_BINDTODEVICE not found, trying 25")
2604
logger.warning("SO_BINDTODEVICE not found, trying 25")
2665
2605
SO_BINDTODEVICE = 25
2666
2606
try:
2667
2607
self.socket.setsockopt(
2669
2609
(self.interface + "\0").encode("utf-8"))
2670
2610
except socket.error as error:
2671
2611
if error.errno == errno.EPERM:
2672
log.error("No permission to bind to interface %s",
2673
self.interface)
2612
logger.error("No permission to bind to"
2613
" interface %s", self.interface)
2674
2614
elif error.errno == errno.ENOPROTOOPT:
2675
log.error("SO_BINDTODEVICE not available; cannot"
2676
" bind to interface %s", self.interface)
2615
logger.error("SO_BINDTODEVICE not available;"
2616
" cannot bind to interface %s",
2617
self.interface)
2677
2618
elif error.errno == errno.ENODEV:
2678
log.error("Interface %s does not exist, cannot"
2679
" bind", self.interface)
2619
logger.error("Interface %s does not exist,"
2620
" cannot bind", self.interface)
2680
2621
else:
2681
2622
raise
2682
2623
# Only bind(2) the socket if we really need to.
2761
2702
request = parent_pipe.recv()
2762
2703
command = request[0]
2763
2704
2764
if command == "init":
2705
if command == 'init':
2765
2706
key_id = request[1].decode("ascii")
2766
2707
fpr = request[2].decode("ascii")
2767
2708
address = request[3]
2768
2709
2769
2710
for c in self.clients.values():
2770
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2771
"27AE41E4649B934CA495991B7852B855"):
2711
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2772
2712
continue
2773
2713
if key_id and c.key_id == key_id:
2774
2714
client = c
2777
2717
client = c
2778
2718
break
2779
2719
else:
2780
log.info("Client not found for key ID: %s, address:"
2781
" %s", key_id or fpr, address)
2720
logger.info("Client not found for key ID: %s, address"
2721
": %s", key_id or fpr, address)
2782
2722
if self.use_dbus:
2783
2723
# Emit D-Bus signal
2784
2724
mandos_dbus_service.ClientNotFound(key_id or fpr,
2797
2737
# remove the old hook in favor of the new above hook on
2798
2738
# same fileno
2799
2739
return False
2800
if command == "funcall":
2740
if command == 'funcall':
2801
2741
funcname = request[1]
2802
2742
args = request[2]
2803
2743
kwargs = request[3]
2804
2744
2805
parent_pipe.send(("data", getattr(client_object,
2745
parent_pipe.send(('data', getattr(client_object,
2806
2746
funcname)(*args,
2807
2747
**kwargs)))
2808
2748
2809
if command == "getattr":
2749
if command == 'getattr':
2810
2750
attrname = request[1]
2811
2751
if isinstance(client_object.__getattribute__(attrname),
2812
collections.abc.Callable):
2813
parent_pipe.send(("function", ))
2752
collections.Callable):
2753
parent_pipe.send(('function', ))
2814
2754
else:
2815
2755
parent_pipe.send((
2816
"data", client_object.__getattribute__(attrname)))
2756
'data', client_object.__getattribute__(attrname)))
2817
2757
2818
if command == "setattr":
2758
if command == 'setattr':
2819
2759
attrname = request[1]
2820
2760
value = request[2]
2821
2761
setattr(client_object, attrname, value)
2826
2766
def rfc3339_duration_to_delta(duration):
2827
2767
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2828
2768
2829
>>> timedelta = datetime.timedelta
2830
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2831
True
2832
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2833
True
2834
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2835
True
2836
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2837
True
2838
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2839
True
2840
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2841
True
2842
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2843
True
2844
>>> del timedelta
2769
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2770
True
2771
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2772
True
2773
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2774
True
2775
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2776
True
2777
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2778
True
2779
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2780
True
2781
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2782
True
2845
2783
"""
2846
2784
2847
2785
# Parsing an RFC 3339 duration with regular expressions is not
2927
2865
def string_to_delta(interval):
2928
2866
"""Parse a string and return a datetime.timedelta
2929
2867
2930
>>> string_to_delta("7d") == datetime.timedelta(7)
2931
True
2932
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2933
True
2934
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2935
True
2936
>>> string_to_delta("24h") == datetime.timedelta(1)
2937
True
2938
>>> string_to_delta("1w") == datetime.timedelta(7)
2939
True
2940
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2868
>>> string_to_delta('7d') == datetime.timedelta(7)
2869
True
2870
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2871
True
2872
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2873
True
2874
>>> string_to_delta('24h') == datetime.timedelta(1)
2875
True
2876
>>> string_to_delta('1w') == datetime.timedelta(7)
2877
True
2878
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2941
2879
True
2942
2880
"""
2943
2881
3147
3085
3148
3086
if server_settings["servicename"] != "Mandos":
3149
3087
syslogger.setFormatter(
3150
logging.Formatter("Mandos ({}) [%(process)d]:"
3151
" %(levelname)s: %(message)s".format(
3088
logging.Formatter('Mandos ({}) [%(process)d]:'
3089
' %(levelname)s: %(message)s'.format(
3152
3090
server_settings["servicename"])))
3153
3091
3154
3092
# Parse config file with clients
3178
3116
try:
3179
3117
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3180
3118
except IOError as e:
3181
log.error("Could not open file %r", pidfilename,
3182
exc_info=e)
3119
logger.error("Could not open file %r", pidfilename,
3120
exc_info=e)
3183
3121
3184
3122
for name, group in (("_mandos", "_mandos"),
3185
3123
("mandos", "mandos"),
3196
3134
try:
3197
3135
os.setgid(gid)
3198
3136
os.setuid(uid)
3199
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3137
if debug:
3138
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3139
gid))
3200
3140
except OSError as error:
3201
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3202
os.strerror(error.errno))
3141
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3142
.format(uid, gid, os.strerror(error.errno)))
3203
3143
if error.errno != errno.EPERM:
3204
3144
raise
3205
3145
3212
3152
3213
3153
@gnutls.log_func
3214
3154
def debug_gnutls(level, string):
3215
log.debug("GnuTLS: %s",
3216
string[:-1].decode("utf-8", errors="replace"))
3155
logger.debug("GnuTLS: %s", string[:-1])
3217
3156
3218
3157
gnutls.global_set_log_function(debug_gnutls)
3219
3158
3248
3187
"se.bsnet.fukt.Mandos", bus,
3249
3188
do_not_queue=True)
3250
3189
except dbus.exceptions.DBusException as e:
3251
log.error("Disabling D-Bus:", exc_info=e)
3190
logger.error("Disabling D-Bus:", exc_info=e)
3252
3191
use_dbus = False
3253
3192
server_settings["use_dbus"] = False
3254
3193
tcp_server.use_dbus = False
3339
3278
os.remove(stored_state_path)
3340
3279
except IOError as e:
3341
3280
if e.errno == errno.ENOENT:
3342
log.warning("Could not load persistent state:"
3343
" %s", os.strerror(e.errno))
3281
logger.warning("Could not load persistent state:"
3282
" {}".format(os.strerror(e.errno)))
3344
3283
else:
3345
log.critical("Could not load persistent state:",
3346
exc_info=e)
3284
logger.critical("Could not load persistent state:",
3285
exc_info=e)
3347
3286
raise
3348
3287
except EOFError as e:
3349
log.warning("Could not load persistent state: EOFError:",
3350
exc_info=e)
3288
logger.warning("Could not load persistent state: "
3289
"EOFError:",
3290
exc_info=e)
3351
3291
3352
3292
with PGPEngine() as pgp:
3353
3293
for client_name, client in clients_data.items():
3380
3320
if client["enabled"]:
3381
3321
if datetime.datetime.utcnow() >= client["expires"]:
3382
3322
if not client["last_checked_ok"]:
3383
log.warning("disabling client %s - Client"
3384
" never performed a successful"
3385
" checker", client_name)
3323
logger.warning(
3324
"disabling client {} - Client never "
3325
"performed a successful checker".format(
3326
client_name))
3386
3327
client["enabled"] = False
3387
3328
elif client["last_checker_status"] != 0:
3388
log.warning("disabling client %s - Client"
3389
" last checker failed with error"
3390
" code %s", client_name,
3391
client["last_checker_status"])
3329
logger.warning(
3330
"disabling client {} - Client last"
3331
" checker failed with error code"
3332
" {}".format(
3333
client_name,
3334
client["last_checker_status"]))
3392
3335
client["enabled"] = False
3393
3336
else:
3394
3337
client["expires"] = (
3395
3338
datetime.datetime.utcnow()
3396
3339
+ client["timeout"])
3397
log.debug("Last checker succeeded, keeping %s"
3398
" enabled", client_name)
3340
logger.debug("Last checker succeeded,"
3341
" keeping {} enabled".format(
3342
client_name))
3399
3343
try:
3400
3344
client["secret"] = pgp.decrypt(
3401
3345
client["encrypted_secret"],
3402
3346
client_settings[client_name]["secret"])
3403
3347
except PGPError:
3404
3348
# If decryption fails, we use secret from new settings
3405
log.debug("Failed to decrypt %s old secret",
3406
client_name)
3349
logger.debug("Failed to decrypt {} old secret".format(
3350
client_name))
3407
3351
client["secret"] = (client_settings[client_name]
3408
3352
["secret"])
3409
3353
3423
3367
server_settings=server_settings)
3424
3368
3425
3369
if not tcp_server.clients:
3426
log.warning("No clients defined")
3370
logger.warning("No clients defined")
3427
3371
3428
3372
if not foreground:
3429
3373
if pidfile is not None:
3432
3376
with pidfile:
3433
3377
print(pid, file=pidfile)
3434
3378
except IOError:
3435
log.error("Could not write to file %r with PID %d",
3436
pidfilename, pid)
3379
logger.error("Could not write to file %r with PID %d",
3380
pidfilename, pid)
3437
3381
del pidfile
3438
3382
del pidfilename
3439
3383
3589
3533
3590
3534
try:
3591
3535
with tempfile.NamedTemporaryFile(
3592
mode="wb",
3536
mode='wb',
3593
3537
suffix=".pickle",
3594
prefix="clients-",
3538
prefix='clients-',
3595
3539
dir=os.path.dirname(stored_state_path),
3596
3540
delete=False) as stored_state:
3597
3541
pickle.dump((clients, client_settings), stored_state,
3605
3549
except NameError:
3606
3550
pass
3607
3551
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3608
log.warning("Could not save persistent state: %s",
3609
os.strerror(e.errno))
3552
logger.warning("Could not save persistent state: {}"
3553
.format(os.strerror(e.errno)))
3610
3554
else:
3611
log.warning("Could not save persistent state:",
3612
exc_info=e)
3555
logger.warning("Could not save persistent state:",
3556
exc_info=e)
3613
3557
raise
3614
3558
3615
3559
# Delete all clients, and settings from config
3632
3576
mandos_dbus_service.client_added_signal(client)
3633
3577
# Need to initiate checking of clients
3634
3578
if client.enabled:
3635
client.init_checker(randomize_start=True)
3579
client.init_checker()
3636
3580
3637
3581
tcp_server.enable()
3638
3582
tcp_server.server_activate()
3641
3585
if zeroconf:
3642
3586
service.port = tcp_server.socket.getsockname()[1]
3643
3587
if use_ipv6:
3644
log.info("Now listening on address %r, port %d, flowinfo %d,"
3645
" scope_id %d", *tcp_server.socket.getsockname())
3588
logger.info("Now listening on address %r, port %d,"
3589
" flowinfo %d, scope_id %d",
3590
*tcp_server.socket.getsockname())
3646
3591
else: # IPv4
3647
log.info("Now listening on address %r, port %d",
3648
*tcp_server.socket.getsockname())
3592
logger.info("Now listening on address %r, port %d",
3593
*tcp_server.socket.getsockname())
3649
3594
3650
3595
# service.interface = tcp_server.socket.getsockname()[3]
3651
3596
3655
3600
try:
3656
3601
service.activate()
3657
3602
except dbus.exceptions.DBusException as error:
3658
log.critical("D-Bus Exception", exc_info=error)
3603
logger.critical("D-Bus Exception", exc_info=error)
3659
3604
cleanup()
3660
3605
sys.exit(1)
3661
3606
# End of Avahi example code
3666
3611
lambda *args, **kwargs: (tcp_server.handle_request
3667
3612
(*args[2:], **kwargs) or True))
3668
3613
3669
log.debug("Starting main loop")
3614
logger.debug("Starting main loop")
3670
3615
main_loop.run()
3671
3616
except AvahiError as error:
3672
log.critical("Avahi Error", exc_info=error)
3617
logger.critical("Avahi Error", exc_info=error)
3673
3618
cleanup()
3674
3619
sys.exit(1)
3675
3620
except KeyboardInterrupt:
3676
3621
if debug:
3677
3622
print("", file=sys.stderr)
3678
log.debug("Server received KeyboardInterrupt")
3679
log.debug("Server exiting")
3623
logger.debug("Server received KeyboardInterrupt")
3624
logger.debug("Server exiting")
3680
3625
# Must run before the D-Bus bus name gets deregistered
3681
3626
cleanup()
3682
3627
3683
3628
3684
def parse_test_args():
3685
# type: () -> argparse.Namespace
3629
def should_only_run_tests():
3686
3630
parser = argparse.ArgumentParser(add_help=False)
3687
parser.add_argument("--check", action="store_true")
3688
parser.add_argument("--prefix", )
3631
parser.add_argument("--check", action='store_true')
3689
3632
args, unknown_args = parser.parse_known_args()
3690
if args.check:
3691
# Remove test options from sys.argv
3633
run_tests = args.check
3634
if run_tests:
3635
# Remove --check argument from sys.argv
3692
3636
sys.argv[1:] = unknown_args
3693
return args
3637
return run_tests
3694
3638
3695
3639
# Add all tests from doctest strings
3696
3640
def load_tests(loader, tests, none):
3698
3642
tests.addTests(doctest.DocTestSuite())
3699
3643
return tests
3700
3644
3701
if __name__ == "__main__":
3702
options = parse_test_args()
3645
if __name__ == '__main__':
3703
3646
try:
3704
if options.check:
3705
extra_test_prefix = options.prefix
3706
if extra_test_prefix is not None:
3707
if not (unittest.main(argv=[""], exit=False)
3708
.result.wasSuccessful()):
3709
sys.exit(1)
3710
class ExtraTestLoader(unittest.TestLoader):
3711
testMethodPrefix = extra_test_prefix
3712
# Call using ./scriptname --test [--verbose]
3713
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3714
else:
3715
unittest.main(argv=[""])
3647
if should_only_run_tests():
3648
# Call using ./mandos --check [--verbose]
3649
unittest.main()
3716
3650
else:
3717
3651
main()
3718
3652
finally:
3719
3653
logging.shutdown()
3720
3721
# Local Variables:
3722
# run-tests:
3723
# (lambda (&optional extra)
3724
# (if (not (funcall run-tests-in-test-buffer default-directory
3725
# extra))
3726
# (funcall show-test-buffer-in-test-window)
3727
# (funcall remove-test-window)
3728
# (if extra (message "Extra tests run successfully!"))))
3729
# run-tests-in-test-buffer:
3730
# (lambda (dir &optional extra)
3731
# (with-current-buffer (get-buffer-create "*Test*")
3732
# (setq buffer-read-only nil
3733
# default-directory dir)
3734
# (erase-buffer)
3735
# (compilation-mode))
3736
# (let ((process-result
3737
# (let ((inhibit-read-only t))
3738
# (process-file-shell-command
3739
# (funcall get-command-line extra) nil "*Test*"))))
3740
# (and (numberp process-result)
3741
# (= process-result 0))))
3742
# get-command-line:
3743
# (lambda (&optional extra)
3744
# (let ((quoted-script
3745
# (shell-quote-argument (funcall get-script-name))))
3746
# (format
3747
# (concat "%s --check" (if extra " --prefix=atest" ""))
3748
# quoted-script)))
3749
# get-script-name:
3750
# (lambda ()
3751
# (if (fboundp 'file-local-name)
3752
# (file-local-name (buffer-file-name))
3753
# (or (file-remote-p (buffer-file-name) 'localname)
3754
# (buffer-file-name))))
3755
# remove-test-window:
3756
# (lambda ()
3757
# (let ((test-window (get-buffer-window "*Test*")))
3758
# (if test-window (delete-window test-window))))
3759
# show-test-buffer-in-test-window:
3760
# (lambda ()
3761
# (when (not (get-buffer-window-list "*Test*"))
3762
# (setq next-error-last-buffer (get-buffer "*Test*"))
3763
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3764
# (display-buffer-overriding-action
3765
# `((display-buffer-in-side-window) (side . ,side)
3766
# (window-height . fit-window-to-buffer)
3767
# (window-width . fit-window-to-buffer))))
3768
# (display-buffer "*Test*"))))
3769
# eval:
3770
# (progn
3771
# (let* ((run-extra-tests (lambda () (interactive)
3772
# (funcall run-tests t)))
3773
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3774
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3775
# (setq minor-mode-overriding-map-alist
3776
# (cons `(run-tests . ,outer-keymap)
3777
# minor-mode-overriding-map-alist)))
3778
# (add-hook 'after-save-hook run-tests 90 t))
3779
# End:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0