/mandos/trunk : revision 1201

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

Committer: teddy at recompile
Date: 2020-02-05 21:39:28 UTC
Revision ID: teddy@recompile.se-20200205213928-vpvt0fwfg47ikv6f

Allow users to alter ask-password-mandos.service

If a user uses dracut with systemd and wishes to modify the options
passed to password-agent(8mandos) or mandos-client(8mandos), they
should be able to do so by simply creating a file
/etc/systemd/system/ask-password-mandos.service.d/override.conf,
containing, for instance:

[Service]
Environment=MANDOS_CLIENT_OPTIONS=--debug

Adding PASSWORD_AGENT_OPTIONS should also be possible (but should not
normally be needed).

* dracut-module/ask-password-mandos.service ([Service]/ExecStart): Add
  $PASSWORD_AGENT_OPTIONS before "--" and "$MANDOS_CLIENT_OPTIONS" to
  end of line.
* dracut-module/module-setup.sh (install): Install all files named
  /etc/systemd/system/ask-password-mandos.service.d/*.conf if any
  exists.  Also add --dh-params before $MANDOS_CLIENT_OPTIONS instead
  of at end of line.

Show diffs side-by-side

added added

removed removed

mandos

# "AvahiService" class, and some lines in "main".

# Everything else is

# This file is part of Mandos.

import codecs

import unittest

import random

import shlex

import dbus

import dbus.service

__metaclass__ = type

str = unicode

# Add collections.abc.Callable if it does not exist

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Show warnings by default

114

if not sys.warnoptions:

115

import warnings

143

127

if sys.version_info < (3, 2):

144

128

configparser.Configparser = configparser.SafeConfigParser

145

129

146

version = "1.8.12"

130

version = "1.8.9"

147

131

stored_state_file = "clients.pickle"

148

132

149

133

logger = logging.getLogger()

524

508

class AvahiServiceToSyslog(AvahiService):

525

509

def rename(self, *args, **kwargs):

526

510

"""Add the new name to the syslog messages"""

527

ret = super(AvahiServiceToSyslog, self).rename(*args,

528

**kwargs)

511

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

529

512

syslogger.setFormatter(logging.Formatter(

530

513

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

531

514

.format(self.name)))

775

758

776

759

x509_crt_fmt_t = ctypes.c_int

777

760

778

# All the function declarations below are from

779

# gnutls/abstract.h

761

# All the function declarations below are from gnutls/abstract.h

780

762

pubkey_init = _library.gnutls_pubkey_init

781

763

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

782

764

pubkey_init.restype = _error_code

796

778

pubkey_deinit.argtypes = [pubkey_t]

797

779

pubkey_deinit.restype = None

798

780

else:

799

# All the function declarations below are from

800

# gnutls/openpgp.h

781

# All the function declarations below are from gnutls/openpgp.h

801

782

802

783

openpgp_crt_init = _library.gnutls_openpgp_crt_init

803

784

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

809

790

openpgp_crt_fmt_t]

810

791

openpgp_crt_import.restype = _error_code

811

792

812

openpgp_crt_verify_self = \

813

_library.gnutls_openpgp_crt_verify_self

814

openpgp_crt_verify_self.argtypes = [

815

openpgp_crt_t,

816

ctypes.c_uint,

817

ctypes.POINTER(ctypes.c_uint),

818

]

793

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

794

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

795

ctypes.POINTER(ctypes.c_uint)]

819

796

openpgp_crt_verify_self.restype = _error_code

820

797

821

798

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

1141

1118

if self.checker is None:

1142

1119

# Escape attributes for the shell

1143

1120

escaped_attrs = {

1144

attr: shlex.quote(str(getattr(self, attr)))

1121

attr: re.escape(str(getattr(self, attr)))

1145

1122

for attr in self.runtime_expansions}

1146

1123

try:

1147

1124

command = self.checker_command % escaped_attrs

2475

2452

buf = ctypes.create_string_buffer(32)

2476

2453

buf_len = ctypes.c_size_t(len(buf))

2477

2454

# Get the key ID from the raw public key into the buffer

2478

gnutls.pubkey_get_key_id(

2479

pubkey,

2480

gnutls.KEYID_USE_SHA256,

2481

ctypes.cast(ctypes.byref(buf),

2482

ctypes.POINTER(ctypes.c_ubyte)),

2483

ctypes.byref(buf_len))

2455

gnutls.pubkey_get_key_id(pubkey,

2456

gnutls.KEYID_USE_SHA256,

2457

ctypes.cast(ctypes.byref(buf),

2458

ctypes.POINTER(ctypes.c_ubyte)),

2459

ctypes.byref(buf_len))

2484

2460

# Deinit the certificate

2485

2461

gnutls.pubkey_deinit(pubkey)

2486

2462

2731

2707

address = request[3]

2732

2708

2733

2709

for c in self.clients.values():

2734

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2735

"27AE41E4649B934CA495991B7852B855"):

2710

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2736

2711

continue

2737

2712

if key_id and c.key_id == key_id:

2738

2713

client = c

2773

2748

if command == 'getattr':

2774

2749

attrname = request[1]

2775

2750

if isinstance(client_object.__getattribute__(attrname),

2776

collections.abc.Callable):

2751

collections.Callable):

2777

2752

parent_pipe.send(('function', ))

2778

2753

else:

2779

2754

parent_pipe.send((

2790

2765

def rfc3339_duration_to_delta(duration):

2791

2766

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2792

2767

2793

>>> timedelta = datetime.timedelta

2794

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2795

True

2796

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2797

True

2798

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2799

True

2800

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2801

True

2802

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2803

True

2804

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2805

True

2806

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2807

True

2808

>>> del timedelta

2768

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2769

True

2770

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2771

True

2772

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2773

True

2774

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2775

True

2776

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2777

True

2778

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2779

True

2780

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2781

True

2809

2782

"""

2810

2783

2811

2784

# Parsing an RFC 3339 duration with regular expressions is not

Older »