/mandos/trunk : revision 1201

1

#!/usr/bin/python3 -bI

2

# -*- coding: utf-8; lexical-binding: t -*-

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This file is part of Mandos.

18

#

31

#

32

# Contact the authors at <mandos@recompile.se>.

33

#

34

35

from __future__ import (division, absolute_import, print_function,

35

36

unicode_literals)

36

37

39

40

except ImportError:

40

41

pass

41

42

import sys

43

import unittest

44

import argparse

45

import logging

46

import os

47

43

try:

48

44

import SocketServer as socketserver

49

45

except ImportError:

50

46

import socketserver

51

47

import socket

48

import argparse

52

49

import datetime

53

50

import errno

54

51

try:

55

52

import ConfigParser as configparser

56

53

except ImportError:

57

54

import configparser

55

import sys

58

56

import re

57

import os

59

58

import signal

60

59

import subprocess

61

60

import atexit

62

61

import stat

62

import logging

63

import logging.handlers

64

import pwd

65

import contextlib

77

import itertools

78

import collections

79

import codecs

80

import unittest

80

81

import random

81

import shlex

82

83

import dbus

84

import dbus.service

93

if sys.version_info.major == 2:

94

__metaclass__ = type

95

str = unicode

96

input = raw_input

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Add os.set_inheritable if it does not exist

114

try:

115

os.set_inheritable

116

except AttributeError:

117

def set_inheritable(fd, inheritable):

118

flags = fcntl.fcntl(fd, fcntl.F_GETFD)

119

if inheritable and ((flags & fcntl.FD_CLOEXEC) != 0):

120

fcntl.fcntl(fd, fcntl.F_SETFL, flags & ~fcntl.FD_CLOEXEC)

121

elif (not inheritable) and ((flags & fcntl.FD_CLOEXEC) == 0):

122

fcntl.fcntl(fd, fcntl.F_SETFL, flags | fcntl.FD_CLOEXEC)

123

os.set_inheritable = set_inheritable

124

del set_inheritable

125

96

126

97

# Show warnings by default

127

98

if not sys.warnoptions:

156

127

if sys.version_info < (3, 2):

157

128

configparser.Configparser = configparser.SafeConfigParser

158

129

159

version = "1.8.18"

130

version = "1.8.9"

160

131

stored_state_file = "clients.pickle"

161

132

162

log = logging.getLogger(os.path.basename(sys.argv[0]))

133

logger = logging.getLogger()

163

134

logging.captureWarnings(True) # Show warnings via the logging system

164

135

syslogger = None

165

136

202

173

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

203

174

address="/dev/log"))

204

175

syslogger.setFormatter(logging.Formatter

205

("Mandos [%(process)d]: %(levelname)s:"

206

" %(message)s"))

207

log.addHandler(syslogger)

176

('Mandos [%(process)d]: %(levelname)s:'

177

' %(message)s'))

178

logger.addHandler(syslogger)

208

179

209

180

if debug:

210

181

console = logging.StreamHandler()

211

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

212

" [%(process)d]:"

213

" %(levelname)s:"

214

" %(message)s"))

215

log.addHandler(console)

216

log.setLevel(level)

182

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

183

' [%(process)d]:'

184

' %(levelname)s:'

185

' %(message)s'))

186

logger.addHandler(console)

187

logger.setLevel(level)

217

188

218

189

219

190

class PGPError(Exception):

237

208

except OSError as e:

238

209

if e.errno != errno.ENOENT:

239

210

raise

240

self.gnupgargs = ["--batch",

241

"--homedir", self.tempdir,

242

"--force-mdc",

243

"--quiet"]

211

self.gnupgargs = ['--batch',

212

'--homedir', self.tempdir,

213

'--force-mdc',

214

'--quiet']

244

215

# Only GPG version 1 has the --no-use-agent option.

245

216

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

246

217

self.gnupgargs.append("--no-use-agent")

285

256

dir=self.tempdir) as passfile:

286

257

passfile.write(passphrase)

287

258

passfile.flush()

288

proc = subprocess.Popen([self.gpg, "--symmetric",

289

"--passphrase-file",

259

proc = subprocess.Popen([self.gpg, '--symmetric',

260

'--passphrase-file',

290

261

passfile.name]

291

262

+ self.gnupgargs,

292

263

stdin=subprocess.PIPE,

303

274

dir=self.tempdir) as passfile:

304

275

passfile.write(passphrase)

305

276

passfile.flush()

306

proc = subprocess.Popen([self.gpg, "--decrypt",

307

"--passphrase-file",

277

proc = subprocess.Popen([self.gpg, '--decrypt',

278

'--passphrase-file',

308

279

passfile.name]

309

280

+ self.gnupgargs,

310

281

stdin=subprocess.PIPE,

363

334

Attributes:

364

335

interface: integer; avahi.IF_UNSPEC or an interface index.

365

336

Used to optionally bind to the specified interface.

366

name: string; Example: "Mandos"

367

type: string; Example: "_mandos._tcp".

337

name: string; Example: 'Mandos'

338

type: string; Example: '_mandos._tcp'.

368

339

See <https://www.iana.org/assignments/service-names-port-numbers>

369

340

port: integer; what port to announce

370

341

TXT: list of strings; TXT record for the service

407

378

def rename(self, remove=True):

408

379

"""Derived from the Avahi example code"""

409

380

if self.rename_count >= self.max_renames:

410

log.critical("No suitable Zeroconf service name found"

411

" after %i retries, exiting.",

412

self.rename_count)

381

logger.critical("No suitable Zeroconf service name found"

382

" after %i retries, exiting.",

383

self.rename_count)

413

384

raise AvahiServiceError("Too many renames")

414

385

self.name = str(

415

386

self.server.GetAlternativeServiceName(self.name))

416

387

self.rename_count += 1

417

log.info("Changing Zeroconf service name to %r ...",

418

self.name)

388

logger.info("Changing Zeroconf service name to %r ...",

389

self.name)

419

390

if remove:

420

391

self.remove()

421

392

try:

423

394

except dbus.exceptions.DBusException as error:

424

395

if (error.get_dbus_name()

425

396

== "org.freedesktop.Avahi.CollisionError"):

426

log.info("Local Zeroconf service name collision.")

397

logger.info("Local Zeroconf service name collision.")

427

398

return self.rename(remove=False)

428

399

else:

429

log.critical("D-Bus Exception", exc_info=error)

400

logger.critical("D-Bus Exception", exc_info=error)

430

401

self.cleanup()

431

402

os._exit(1)

432

403

448

419

avahi.DBUS_INTERFACE_ENTRY_GROUP)

449

420

self.entry_group_state_changed_match = (

450

421

self.group.connect_to_signal(

451

"StateChanged", self.entry_group_state_changed))

452

log.debug("Adding Zeroconf service '%s' of type '%s' ...",

453

self.name, self.type)

422

'StateChanged', self.entry_group_state_changed))

423

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

424

self.name, self.type)

454

425

self.group.AddService(

455

426

self.interface,

456

427

self.protocol,

463

434

464

435

def entry_group_state_changed(self, state, error):

465

436

"""Derived from the Avahi example code"""

466

log.debug("Avahi entry group state change: %i", state)

437

logger.debug("Avahi entry group state change: %i", state)

467

438

468

439

if state == avahi.ENTRY_GROUP_ESTABLISHED:

469

log.debug("Zeroconf service established.")

440

logger.debug("Zeroconf service established.")

470

441

elif state == avahi.ENTRY_GROUP_COLLISION:

471

log.info("Zeroconf service name collision.")

442

logger.info("Zeroconf service name collision.")

472

443

self.rename()

473

444

elif state == avahi.ENTRY_GROUP_FAILURE:

474

log.critical("Avahi: Error in group state changed %s",

475

str(error))

445

logger.critical("Avahi: Error in group state changed %s",

446

str(error))

476

447

raise AvahiGroupError("State changed: {!s}".format(error))

477

448

478

449

def cleanup(self):

488

459

489

460

def server_state_changed(self, state, error=None):

490

461

"""Derived from the Avahi example code"""

491

log.debug("Avahi server state change: %i", state)

462

logger.debug("Avahi server state change: %i", state)

492

463

bad_states = {

493

464

avahi.SERVER_INVALID: "Zeroconf server invalid",

494

465

avahi.SERVER_REGISTERING: None,

498

469

if state in bad_states:

499

470

if bad_states[state] is not None:

500

471

if error is None:

501

log.error(bad_states[state])

472

logger.error(bad_states[state])

502

473

else:

503

log.error(bad_states[state] + ": %r", error)

474

logger.error(bad_states[state] + ": %r", error)

504

475

self.cleanup()

505

476

elif state == avahi.SERVER_RUNNING:

506

477

try:

508

479

except dbus.exceptions.DBusException as error:

509

480

if (error.get_dbus_name()

510

481

== "org.freedesktop.Avahi.CollisionError"):

511

log.info("Local Zeroconf service name collision.")

482

logger.info("Local Zeroconf service name"

483

" collision.")

512

484

return self.rename(remove=False)

513

485

else:

514

log.critical("D-Bus Exception", exc_info=error)

486

logger.critical("D-Bus Exception", exc_info=error)

515

487

self.cleanup()

516

488

os._exit(1)

517

489

else:

518

490

if error is None:

519

log.debug("Unknown state: %r", state)

491

logger.debug("Unknown state: %r", state)

520

492

else:

521

log.debug("Unknown state: %r: %r", state, error)

493

logger.debug("Unknown state: %r: %r", state, error)

522

494

523

495

def activate(self):

524

496

"""Derived from the Avahi example code"""

536

508

class AvahiServiceToSyslog(AvahiService):

537

509

def rename(self, *args, **kwargs):

538

510

"""Add the new name to the syslog messages"""

539

ret = super(AvahiServiceToSyslog, self).rename(*args,

540

**kwargs)

511

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

541

512

syslogger.setFormatter(logging.Formatter(

542

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

513

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

543

514

.format(self.name)))

544

515

return ret

545

516

575

546

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

576

547

577

548

# Types

578

class _session_int(ctypes.Structure):

549

class session_int(ctypes.Structure):

579

550

_fields_ = []

580

session_t = ctypes.POINTER(_session_int)

551

session_t = ctypes.POINTER(session_int)

581

552

582

553

class certificate_credentials_st(ctypes.Structure):

583

554

_fields_ = []

586

557

certificate_type_t = ctypes.c_int

587

558

588

559

class datum_t(ctypes.Structure):

589

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

590

("size", ctypes.c_uint)]

560

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

561

('size', ctypes.c_uint)]

591

562

592

class _openpgp_crt_int(ctypes.Structure):

563

class openpgp_crt_int(ctypes.Structure):

593

564

_fields_ = []

594

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

565

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

595

566

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

596

567

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

597

568

credentials_type_t = ctypes.c_int

606

577

# gnutls.strerror()

607

578

self.code = code

608

579

if message is None and code is not None:

609

message = gnutls.strerror(code).decode(

610

"utf-8", errors="replace")

580

message = gnutls.strerror(code)

611

581

return super(gnutls.Error, self).__init__(

612

582

message, *args)

613

583

614

584

class CertificateSecurityError(Error):

615

585

pass

616

586

617

class PointerTo:

618

def __init__(self, cls):

619

self.cls = cls

620

621

def from_param(self, obj):

622

if not isinstance(obj, self.cls):

623

raise TypeError("Not of type {}: {!r}"

624

.format(self.cls.__name__, obj))

625

return ctypes.byref(obj.from_param(obj))

626

627

class CastToVoidPointer:

628

def __init__(self, cls):

629

self.cls = cls

630

631

def from_param(self, obj):

632

if not isinstance(obj, self.cls):

633

raise TypeError("Not of type {}: {!r}"

634

.format(self.cls.__name__, obj))

635

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

636

637

class With_from_param:

638

@classmethod

639

def from_param(cls, obj):

640

return obj._as_parameter_

641

642

587

# Classes

643

class Credentials(With_from_param):

588

class Credentials:

644

589

def __init__(self):

645

self._as_parameter_ = gnutls.certificate_credentials_t()

646

gnutls.certificate_allocate_credentials(self)

590

self._c_object = gnutls.certificate_credentials_t()

591

gnutls.certificate_allocate_credentials(

592

ctypes.byref(self._c_object))

647

593

self.type = gnutls.CRD_CERTIFICATE

648

594

649

595

def __del__(self):

650

gnutls.certificate_free_credentials(self)

596

gnutls.certificate_free_credentials(self._c_object)

651

597

652

class ClientSession(With_from_param):

598

class ClientSession:

653

599

def __init__(self, socket, credentials=None):

654

self._as_parameter_ = gnutls.session_t()

600

self._c_object = gnutls.session_t()

655

601

gnutls_flags = gnutls.CLIENT

656

602

if gnutls.check_version(b"3.5.6"):

657

603

gnutls_flags |= gnutls.NO_TICKETS

658

604

if gnutls.has_rawpk:

659

605

gnutls_flags |= gnutls.ENABLE_RAWPK

660

gnutls.init(self, gnutls_flags)

606

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

661

607

del gnutls_flags

662

gnutls.set_default_priority(self)

663

gnutls.transport_set_ptr(self, socket.fileno())

664

gnutls.handshake_set_private_extensions(self, True)

608

gnutls.set_default_priority(self._c_object)

609

gnutls.transport_set_ptr(self._c_object, socket.fileno())

610

gnutls.handshake_set_private_extensions(self._c_object,

611

True)

665

612

self.socket = socket

666

613

if credentials is None:

667

614

credentials = gnutls.Credentials()

668

gnutls.credentials_set(self, credentials.type,

669

credentials)

615

gnutls.credentials_set(self._c_object, credentials.type,

616

ctypes.cast(credentials._c_object,

617

ctypes.c_void_p))

670

618

self.credentials = credentials

671

619

672

620

def __del__(self):

673

gnutls.deinit(self)

621

gnutls.deinit(self._c_object)

674

622

675

623

def handshake(self):

676

return gnutls.handshake(self)

624

return gnutls.handshake(self._c_object)

677

625

678

626

def send(self, data):

679

627

data = bytes(data)

680

628

data_len = len(data)

681

629

while data_len > 0:

682

data_len -= gnutls.record_send(self, data[-data_len:],

630

data_len -= gnutls.record_send(self._c_object,

631

data[-data_len:],

683

632

data_len)

684

633

685

634

def bye(self):

686

return gnutls.bye(self, gnutls.SHUT_RDWR)

635

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

687

636

688

637

# Error handling functions

689

638

def _error_code(result):

690

639

"""A function to raise exceptions on errors, suitable

691

for the "restype" attribute on ctypes functions"""

692

if result >= gnutls.E_SUCCESS:

640

for the 'restype' attribute on ctypes functions"""

641

if result >= 0:

693

642

return result

694

643

if result == gnutls.E_NO_CERTIFICATE_FOUND:

695

644

raise gnutls.CertificateSecurityError(code=result)

696

645

raise gnutls.Error(code=result)

697

646

698

def _retry_on_error(result, func, arguments,

699

_error_code=_error_code):

647

def _retry_on_error(result, func, arguments):

700

648

"""A function to retry on some errors, suitable

701

for the "errcheck" attribute on ctypes functions"""

702

while result < gnutls.E_SUCCESS:

649

for the 'errcheck' attribute on ctypes functions"""

650

while result < 0:

703

651

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

704

652

return _error_code(result)

705

653

result = func(*arguments)

710

658

711

659

# Functions

712

660

priority_set_direct = _library.gnutls_priority_set_direct

713

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

661

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

714

662

ctypes.POINTER(ctypes.c_char_p)]

715

663

priority_set_direct.restype = _error_code

716

664

717

665

init = _library.gnutls_init

718

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

666

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

719

667

init.restype = _error_code

720

668

721

669

set_default_priority = _library.gnutls_set_default_priority

722

set_default_priority.argtypes = [ClientSession]

670

set_default_priority.argtypes = [session_t]

723

671

set_default_priority.restype = _error_code

724

672

725

673

record_send = _library.gnutls_record_send

726

record_send.argtypes = [ClientSession, ctypes.c_void_p,

674

record_send.argtypes = [session_t, ctypes.c_void_p,

727

675

ctypes.c_size_t]

728

676

record_send.restype = ctypes.c_ssize_t

729

677

record_send.errcheck = _retry_on_error

731

679

certificate_allocate_credentials = (

732

680

_library.gnutls_certificate_allocate_credentials)

733

681

certificate_allocate_credentials.argtypes = [

734

PointerTo(Credentials)]

682

ctypes.POINTER(certificate_credentials_t)]

735

683

certificate_allocate_credentials.restype = _error_code

736

684

737

685

certificate_free_credentials = (

738

686

_library.gnutls_certificate_free_credentials)

739

certificate_free_credentials.argtypes = [Credentials]

687

certificate_free_credentials.argtypes = [

688

certificate_credentials_t]

740

689

certificate_free_credentials.restype = None

741

690

742

691

handshake_set_private_extensions = (

743

692

_library.gnutls_handshake_set_private_extensions)

744

handshake_set_private_extensions.argtypes = [ClientSession,

693

handshake_set_private_extensions.argtypes = [session_t,

745

694

ctypes.c_int]

746

695

handshake_set_private_extensions.restype = None

747

696

748

697

credentials_set = _library.gnutls_credentials_set

749

credentials_set.argtypes = [ClientSession, credentials_type_t,

750

CastToVoidPointer(Credentials)]

698

credentials_set.argtypes = [session_t, credentials_type_t,

699

ctypes.c_void_p]

751

700

credentials_set.restype = _error_code

752

701

753

702

strerror = _library.gnutls_strerror

755

704

strerror.restype = ctypes.c_char_p

756

705

757

706

certificate_type_get = _library.gnutls_certificate_type_get

758

certificate_type_get.argtypes = [ClientSession]

707

certificate_type_get.argtypes = [session_t]

759

708

certificate_type_get.restype = _error_code

760

709

761

710

certificate_get_peers = _library.gnutls_certificate_get_peers

762

certificate_get_peers.argtypes = [ClientSession,

711

certificate_get_peers.argtypes = [session_t,

763

712

ctypes.POINTER(ctypes.c_uint)]

764

713

certificate_get_peers.restype = ctypes.POINTER(datum_t)

765

714

772

721

global_set_log_function.restype = None

773

722

774

723

deinit = _library.gnutls_deinit

775

deinit.argtypes = [ClientSession]

724

deinit.argtypes = [session_t]

776

725

deinit.restype = None

777

726

778

727

handshake = _library.gnutls_handshake

779

handshake.argtypes = [ClientSession]

780

handshake.restype = ctypes.c_int

728

handshake.argtypes = [session_t]

729

handshake.restype = _error_code

781

730

handshake.errcheck = _retry_on_error

782

731

783

732

transport_set_ptr = _library.gnutls_transport_set_ptr

784

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

733

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

785

734

transport_set_ptr.restype = None

786

735

787

736

bye = _library.gnutls_bye

788

bye.argtypes = [ClientSession, close_request_t]

789

bye.restype = ctypes.c_int

737

bye.argtypes = [session_t, close_request_t]

738

bye.restype = _error_code

790

739

bye.errcheck = _retry_on_error

791

740

792

741

check_version = _library.gnutls_check_version

809

758

810

759

x509_crt_fmt_t = ctypes.c_int

811

760

812

# All the function declarations below are from

813

# gnutls/abstract.h

761

# All the function declarations below are from gnutls/abstract.h

814

762

pubkey_init = _library.gnutls_pubkey_init

815

763

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

816

764

pubkey_init.restype = _error_code

830

778

pubkey_deinit.argtypes = [pubkey_t]

831

779

pubkey_deinit.restype = None

832

780

else:

833

# All the function declarations below are from

834

# gnutls/openpgp.h

781

# All the function declarations below are from gnutls/openpgp.h

835

782

836

783

openpgp_crt_init = _library.gnutls_openpgp_crt_init

837

784

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

843

790

openpgp_crt_fmt_t]

844

791

openpgp_crt_import.restype = _error_code

845

792

846

openpgp_crt_verify_self = \

847

_library.gnutls_openpgp_crt_verify_self

848

openpgp_crt_verify_self.argtypes = [

849

openpgp_crt_t,

850

ctypes.c_uint,

851

ctypes.POINTER(ctypes.c_uint),

852

]

793

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

794

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

795

ctypes.POINTER(ctypes.c_uint)]

853

796

openpgp_crt_verify_self.restype = _error_code

854

797

855

798

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

866

809

867

810

if check_version(b"3.6.4"):

868

811

certificate_type_get2 = _library.gnutls_certificate_type_get2

869

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

812

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

870

813

certificate_type_get2.restype = _error_code

871

814

872

815

# Remove non-public functions

888

831

"""A representation of a client host served by this server.

889

832

890

833

Attributes:

891

approved: bool(); None if not yet approved/disapproved

834

approved: bool(); 'None' if not yet approved/disapproved

892

835

approval_delay: datetime.timedelta(); Time to wait for approval

893

836

approval_duration: datetime.timedelta(); Duration of one approval

894

837

checker: multiprocessing.Process(); a running checker process used

895

to see if the client lives. None if no process is

838

to see if the client lives. 'None' if no process is

896

839

running.

897

840

checker_callback_tag: a GLib event source tag, or None

898

841

checker_command: string; External command which is run to check

974

917

# key_id() and fingerprint() functions

975

918

client["key_id"] = (section.get("key_id", "").upper()

976

919

.replace(" ", ""))

977

client["fingerprint"] = (section.get("fingerprint",

978

"").upper()

920

client["fingerprint"] = (section["fingerprint"].upper()

979

921

.replace(" ", ""))

980

if not (client["key_id"] or client["fingerprint"]):

981

log.error("Skipping client %s without key_id or"

982

" fingerprint", client_name)

983

del settings[client_name]

984

continue

985

922

if "secret" in section:

986

923

client["secret"] = codecs.decode(section["secret"]

987

924

.encode("utf-8"),

1028

965

self.last_enabled = None

1029

966

self.expires = None

1030

967

1031

log.debug("Creating client %r", self.name)

1032

log.debug(" Key ID: %s", self.key_id)

1033

log.debug(" Fingerprint: %s", self.fingerprint)

968

logger.debug("Creating client %r", self.name)

969

logger.debug(" Key ID: %s", self.key_id)

970

logger.debug(" Fingerprint: %s", self.fingerprint)

1034

971

self.created = settings.get("created",

1035

972

datetime.datetime.utcnow())

1036

973

1064

1001

if getattr(self, "enabled", False):

1065

1002

# Already enabled

1066

1003

return

1004

self.expires = datetime.datetime.utcnow() + self.timeout

1067

1005

self.enabled = True

1068

1006

self.last_enabled = datetime.datetime.utcnow()

1069

1007

self.init_checker()

1074

1012

if not getattr(self, "enabled", False):

1075

1013

return False

1076

1014

if not quiet:

1077

log.info("Disabling client %s", self.name)

1015

logger.info("Disabling client %s", self.name)

1078

1016

if getattr(self, "disable_initiator_tag", None) is not None:

1079

1017

GLib.source_remove(self.disable_initiator_tag)

1080

1018

self.disable_initiator_tag = None

1092

1030

def __del__(self):

1093

1031

self.disable()

1094

1032

1095

def init_checker(self, randomize_start=False):

1096

# Schedule a new checker to be started a randomly selected

1097

# time (a fraction of 'interval') from now. This spreads out

1098

# the startup of checkers over time when the server is

1099

# started.

1033

def init_checker(self):

1034

# Schedule a new checker to be started an 'interval' from now,

1035

# and every interval from then on.

1100

1036

if self.checker_initiator_tag is not None:

1101

1037

GLib.source_remove(self.checker_initiator_tag)

1102

interval_milliseconds = int(self.interval.total_seconds()

1103

* 1000)

1104

if randomize_start:

1105

delay_milliseconds = random.randrange(

1106

interval_milliseconds + 1)

1107

else:

1108

delay_milliseconds = interval_milliseconds

1109

1038

self.checker_initiator_tag = GLib.timeout_add(

1110

delay_milliseconds, self.start_checker, randomize_start)

1111

delay = datetime.timedelta(0, 0, 0, delay_milliseconds)

1112

# A checker might take up to an 'interval' of time, so we can

1113

# expire at the soonest one interval after a checker was

1114

# started. Since the initial checker is delayed, the expire

1115

# time might have to be extended.

1116

now = datetime.datetime.utcnow()

1117

self.expires = now + delay + self.interval

1118

# Schedule a disable() at expire time

1039

random.randrange(int(self.interval.total_seconds() * 1000

1040

+ 1)),

1041

self.start_checker)

1042

# Schedule a disable() when 'timeout' has passed

1119

1043

if self.disable_initiator_tag is not None:

1120

1044

GLib.source_remove(self.disable_initiator_tag)

1121

1045

self.disable_initiator_tag = GLib.timeout_add(

1122

int((self.expires - now).total_seconds() * 1000),

1123

self.disable)

1046

int(self.timeout.total_seconds() * 1000), self.disable)

1047

# Also start a new checker *right now*.

1048

self.start_checker()

1124

1049

1125

1050

def checker_callback(self, source, condition, connection,

1126

1051

command):

1137

1062

self.last_checker_status = returncode

1138

1063

self.last_checker_signal = None

1139

1064

if self.last_checker_status == 0:

1140

log.info("Checker for %(name)s succeeded", vars(self))

1065

logger.info("Checker for %(name)s succeeded",

1066

vars(self))

1141

1067

self.checked_ok()

1142

1068

else:

1143

log.info("Checker for %(name)s failed", vars(self))

1069

logger.info("Checker for %(name)s failed", vars(self))

1144

1070

else:

1145

1071

self.last_checker_status = -1

1146

1072

self.last_checker_signal = -returncode

1147

log.warning("Checker for %(name)s crashed?", vars(self))

1073

logger.warning("Checker for %(name)s crashed?",

1074

vars(self))

1148

1075

return False

1149

1076

1150

1077

def checked_ok(self):

1169

1096

def need_approval(self):

1170

1097

self.last_approval_request = datetime.datetime.utcnow()

1171

1098

1172

def start_checker(self, start_was_randomized=False):

1099

def start_checker(self):

1173

1100

"""Start a new checker subprocess if one is not running.

1174

1101

1175

1102

If a checker already exists, leave it running and do

1184

1111

# should be.

1185

1112

1186

1113

if self.checker is not None and not self.checker.is_alive():

1187

log.warning("Checker was not alive; joining")

1114

logger.warning("Checker was not alive; joining")

1188

1115

self.checker.join()

1189

1116

self.checker = None

1190

1117

# Start a new checker if needed

1191

1118

if self.checker is None:

1192

1119

# Escape attributes for the shell

1193

1120

escaped_attrs = {

1194

attr: shlex.quote(str(getattr(self, attr)))

1121

attr: re.escape(str(getattr(self, attr)))

1195

1122

for attr in self.runtime_expansions}

1196

1123

try:

1197

1124

command = self.checker_command % escaped_attrs

1198

1125

except TypeError as error:

1199

log.error('Could not format string "%s"',

1200

self.checker_command, exc_info=error)

1126

logger.error('Could not format string "%s"',

1127

self.checker_command,

1128

exc_info=error)

1201

1129

return True # Try again later

1202

1130

self.current_checker_command = command

1203

log.info("Starting checker %r for %s", command, self.name)

1131

logger.info("Starting checker %r for %s", command,

1132

self.name)

1204

1133

# We don't need to redirect stdout and stderr, since

1205

1134

# in normal mode, that is already done by daemon(),

1206

1135

# and in debug mode we don't want to. (Stdin is

1225

1154

GLib.IOChannel.unix_new(pipe[0].fileno()),

1226

1155

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1227

1156

self.checker_callback, pipe[0], command)

1228

if start_was_randomized:

1229

# We were started after a random delay; Schedule a new

1230

# checker to be started an 'interval' from now, and every

1231

# interval from then on.

1232

now = datetime.datetime.utcnow()

1233

self.checker_initiator_tag = GLib.timeout_add(

1234

int(self.interval.total_seconds() * 1000),

1235

self.start_checker)

1236

self.expires = max(self.expires, now + self.interval)

1237

# Don't start a new checker again after same random delay

1238

return False

1239

1157

# Re-run this periodically if run by GLib.timeout_add

1240

1158

return True

1241

1159

1246

1164

self.checker_callback_tag = None

1247

1165

if getattr(self, "checker", None) is None:

1248

1166

return

1249

log.debug("Stopping checker for %(name)s", vars(self))

1167

logger.debug("Stopping checker for %(name)s", vars(self))

1250

1168

self.checker.terminate()

1251

1169

self.checker = None

1252

1170

1279

1197

func._dbus_name = func.__name__

1280

1198

if func._dbus_name.endswith("_dbus_property"):

1281

1199

func._dbus_name = func._dbus_name[:-14]

1282

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

1200

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1283

1201

return func

1284

1202

1285

1203

return decorator

1374

1292

1375

1293

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1376

1294

out_signature="s",

1377

path_keyword="object_path",

1378

connection_keyword="connection")

1295

path_keyword='object_path',

1296

connection_keyword='connection')

1379

1297

def Introspect(self, object_path, connection):

1380

1298

"""Overloading of standard D-Bus method.

1381

1299

1430

1348

document.unlink()

1431

1349

except (AttributeError, xml.dom.DOMException,

1432

1350

xml.parsers.expat.ExpatError) as error:

1433

log.error("Failed to override Introspection method",

1434

exc_info=error)

1351

logger.error("Failed to override Introspection method",

1352

exc_info=error)

1435

1353

return xmlstring

1436

1354

1437

1355

1534

1452

1535

1453

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1536

1454

out_signature="s",

1537

path_keyword="object_path",

1538

connection_keyword="connection")

1455

path_keyword='object_path',

1456

connection_keyword='connection')

1539

1457

def Introspect(self, object_path, connection):

1540

1458

"""Overloading of standard D-Bus method.

1541

1459

1597

1515

document.unlink()

1598

1516

except (AttributeError, xml.dom.DOMException,

1599

1517

xml.parsers.expat.ExpatError) as error:

1600

log.error("Failed to override Introspection method",

1601

exc_info=error)

1518

logger.error("Failed to override Introspection method",

1519

exc_info=error)

1602

1520

return xmlstring

1603

1521

1604

1522

1636

1554

1637

1555

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1638

1556

out_signature="s",

1639

path_keyword="object_path",

1640

connection_keyword="connection")

1557

path_keyword='object_path',

1558

connection_keyword='connection')

1641

1559

def Introspect(self, object_path, connection):

1642

1560

"""Overloading of standard D-Bus method.

1643

1561

1668

1586

document.unlink()

1669

1587

except (AttributeError, xml.dom.DOMException,

1670

1588

xml.parsers.expat.ExpatError) as error:

1671

log.error("Failed to override Introspection method",

1672

exc_info=error)

1589

logger.error("Failed to override Introspection method",

1590

exc_info=error)

1673

1591

return xmlstring

1674

1592

1675

1593

2309

2227

class ProxyClient:

2310

2228

def __init__(self, child_pipe, key_id, fpr, address):

2311

2229

self._pipe = child_pipe

2312

self._pipe.send(("init", key_id, fpr, address))

2230

self._pipe.send(('init', key_id, fpr, address))

2313

2231

if not self._pipe.recv():

2314

2232

raise KeyError(key_id or fpr)

2315

2233

2316

2234

def __getattribute__(self, name):

2317

if name == "_pipe":

2235

if name == '_pipe':

2318

2236

return super(ProxyClient, self).__getattribute__(name)

2319

self._pipe.send(("getattr", name))

2237

self._pipe.send(('getattr', name))

2320

2238

data = self._pipe.recv()

2321

if data[0] == "data":

2239

if data[0] == 'data':

2322

2240

return data[1]

2323

if data[0] == "function":

2241

if data[0] == 'function':

2324

2242

2325

2243

def func(*args, **kwargs):

2326

self._pipe.send(("funcall", name, args, kwargs))

2244

self._pipe.send(('funcall', name, args, kwargs))

2327

2245

return self._pipe.recv()[1]

2328

2246

2329

2247

return func

2330

2248

2331

2249

def __setattr__(self, name, value):

2332

if name == "_pipe":

2250

if name == '_pipe':

2333

2251

return super(ProxyClient, self).__setattr__(name, value)

2334

self._pipe.send(("setattr", name, value))

2252

self._pipe.send(('setattr', name, value))

2335

2253

2336

2254

2337

2255

class ClientHandler(socketserver.BaseRequestHandler, object):

2342

2260

2343

2261

def handle(self):

2344

2262

with contextlib.closing(self.server.child_pipe) as child_pipe:

2345

log.info("TCP connection from: %s",

2346

str(self.client_address))

2347

log.debug("Pipe FD: %d", self.server.child_pipe.fileno())

2263

logger.info("TCP connection from: %s",

2264

str(self.client_address))

2265

logger.debug("Pipe FD: %d",

2266

self.server.child_pipe.fileno())

2348

2267

2349

2268

session = gnutls.ClientSession(self.request)

2350

2269

2351

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2270

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2352

2271

# "+AES-256-CBC", "+SHA1",

2353

2272

# "+COMP-NULL", "+CTYPE-OPENPGP",

2354

2273

# "+DHE-DSS"))

2356

2275

priority = self.server.gnutls_priority

2357

2276

if priority is None:

2358

2277

priority = "NORMAL"

2359

gnutls.priority_set_direct(session,

2360

priority.encode("utf-8"), None)

2278

gnutls.priority_set_direct(session._c_object,

2279

priority.encode("utf-8"),

2280

None)

2361

2281

2362

2282

# Start communication using the Mandos protocol

2363

2283

# Get protocol number

2364

2284

line = self.request.makefile().readline()

2365

log.debug("Protocol version: %r", line)

2285

logger.debug("Protocol version: %r", line)

2366

2286

try:

2367

2287

if int(line.strip().split()[0]) > 1:

2368

2288

raise RuntimeError(line)

2369

2289

except (ValueError, IndexError, RuntimeError) as error:

2370

log.error("Unknown protocol version: %s", error)

2290

logger.error("Unknown protocol version: %s", error)

2371

2291

return

2372

2292

2373

2293

# Start GnuTLS connection

2374

2294

try:

2375

2295

session.handshake()

2376

2296

except gnutls.Error as error:

2377

log.warning("Handshake failed: %s", error)

2297

logger.warning("Handshake failed: %s", error)

2378

2298

# Do not run session.bye() here: the session is not

2379

2299

# established. Just abandon the request.

2380

2300

return

2381

log.debug("Handshake succeeded")

2301

logger.debug("Handshake succeeded")

2382

2302

2383

2303

approval_required = False

2384

2304

try:

2388

2308

key_id = self.key_id(

2389

2309

self.peer_certificate(session))

2390

2310

except (TypeError, gnutls.Error) as error:

2391

log.warning("Bad certificate: %s", error)

2311

logger.warning("Bad certificate: %s", error)

2392

2312

return

2393

log.debug("Key ID: %s",

2394

key_id.decode("utf-8",

2395

errors="replace"))

2313

logger.debug("Key ID: %s", key_id)

2396

2314

2397

2315

else:

2398

2316

key_id = b""

2400

2318

fpr = self.fingerprint(

2401

2319

self.peer_certificate(session))

2402

2320

except (TypeError, gnutls.Error) as error:

2403

log.warning("Bad certificate: %s", error)

2321

logger.warning("Bad certificate: %s", error)

2404

2322

return

2405

log.debug("Fingerprint: %s", fpr)

2323

logger.debug("Fingerprint: %s", fpr)

2406

2324

2407

2325

try:

2408

2326

client = ProxyClient(child_pipe, key_id, fpr,

2417

2335

2418

2336

while True:

2419

2337

if not client.enabled:

2420

log.info("Client %s is disabled", client.name)

2338

logger.info("Client %s is disabled",

2339

client.name)

2421

2340

if self.server.use_dbus:

2422

2341

# Emit D-Bus signal

2423

2342

client.Rejected("Disabled")

2427

2346

# We are approved or approval is disabled

2428

2347

break

2429

2348

elif client.approved is None:

2430

log.info("Client %s needs approval",

2431

client.name)

2349

logger.info("Client %s needs approval",

2350

client.name)

2432

2351

if self.server.use_dbus:

2433

2352

# Emit D-Bus signal

2434

2353

client.NeedApproval(

2435

2354

client.approval_delay.total_seconds()

2436

2355

* 1000, client.approved_by_default)

2437

2356

else:

2438

log.warning("Client %s was not approved",

2439

client.name)

2357

logger.warning("Client %s was not approved",

2358

client.name)

2440

2359

if self.server.use_dbus:

2441

2360

# Emit D-Bus signal

2442

2361

client.Rejected("Denied")

2450

2369

time2 = datetime.datetime.now()

2451

2370

if (time2 - time) >= delay:

2452

2371

if not client.approved_by_default:

2453

log.warning("Client %s timed out while"

2454

" waiting for approval",

2455

client.name)

2372

logger.warning("Client %s timed out while"

2373

" waiting for approval",

2374

client.name)

2456

2375

if self.server.use_dbus:

2457

2376

# Emit D-Bus signal

2458

2377

client.Rejected("Approval timed out")

2465

2384

try:

2466

2385

session.send(client.secret)

2467

2386

except gnutls.Error as error:

2468

log.warning("gnutls send failed", exc_info=error)

2387

logger.warning("gnutls send failed",

2388

exc_info=error)

2469

2389

return

2470

2390

2471

log.info("Sending secret to %s", client.name)

2391

logger.info("Sending secret to %s", client.name)

2472

2392

# bump the timeout using extended_timeout

2473

2393

client.bump_timeout(client.extended_timeout)

2474

2394

if self.server.use_dbus:

2481

2401

try:

2482

2402

session.bye()

2483

2403

except gnutls.Error as error:

2484

log.warning("GnuTLS bye failed", exc_info=error)

2404

logger.warning("GnuTLS bye failed",

2405

exc_info=error)

2485

2406

2486

2407

@staticmethod

2487

2408

def peer_certificate(session):

2488

2409

"Return the peer's certificate as a bytestring"

2489

2410

try:

2490

cert_type = gnutls.certificate_type_get2(

2491

session, gnutls.CTYPE_PEERS)

2411

cert_type = gnutls.certificate_type_get2(session._c_object,

2412

gnutls.CTYPE_PEERS)

2492

2413

except AttributeError:

2493

cert_type = gnutls.certificate_type_get(session)

2414

cert_type = gnutls.certificate_type_get(session._c_object)

2494

2415

if gnutls.has_rawpk:

2495

2416

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2496

2417

else:

2497

2418

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2498

2419

# If not a valid certificate type...

2499

2420

if cert_type not in valid_cert_types:

2500

log.info("Cert type %r not in %r", cert_type,

2501

valid_cert_types)

2421

logger.info("Cert type %r not in %r", cert_type,

2422

valid_cert_types)

2502

2423

# ...return invalid data

2503

2424

return b""

2504

2425

list_size = ctypes.c_uint(1)

2505

2426

cert_list = (gnutls.certificate_get_peers

2506

(session, ctypes.byref(list_size)))

2427

(session._c_object, ctypes.byref(list_size)))

2507

2428

if not bool(cert_list) and list_size.value != 0:

2508

2429

raise gnutls.Error("error getting peer certificate")

2509

2430

if list_size.value == 0:

2531

2452

buf = ctypes.create_string_buffer(32)

2532

2453

buf_len = ctypes.c_size_t(len(buf))

2533

2454

# Get the key ID from the raw public key into the buffer

2534

gnutls.pubkey_get_key_id(

2535

pubkey,

2536

gnutls.KEYID_USE_SHA256,

2537

ctypes.cast(ctypes.byref(buf),

2538

ctypes.POINTER(ctypes.c_ubyte)),

2539

ctypes.byref(buf_len))

2455

gnutls.pubkey_get_key_id(pubkey,

2456

gnutls.KEYID_USE_SHA256,

2457

ctypes.cast(ctypes.byref(buf),

2458

ctypes.POINTER(ctypes.c_ubyte)),

2459

ctypes.byref(buf_len))

2540

2460

# Deinit the certificate

2541

2461

gnutls.pubkey_deinit(pubkey)

2542

2462

2623

2543

2624

2544

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2625

2545

socketserver.TCPServer):

2626

"""IPv6-capable TCP server. Accepts None as address and/or port

2546

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2627

2547

2628

2548

Attributes:

2629

2549

enabled: Boolean; whether this server is activated yet

2680

2600

if SO_BINDTODEVICE is None:

2681

2601

# Fall back to a hard-coded value which seems to be

2682

2602

# common enough.

2683

log.warning("SO_BINDTODEVICE not found, trying 25")

2603

logger.warning("SO_BINDTODEVICE not found, trying 25")

2684

2604

SO_BINDTODEVICE = 25

2685

2605

try:

2686

2606

self.socket.setsockopt(

2688

2608

(self.interface + "\0").encode("utf-8"))

2689

2609

except socket.error as error:

2690

2610

if error.errno == errno.EPERM:

2691

log.error("No permission to bind to interface %s",

2692

self.interface)

2611

logger.error("No permission to bind to"

2612

" interface %s", self.interface)

2693

2613

elif error.errno == errno.ENOPROTOOPT:

2694

log.error("SO_BINDTODEVICE not available; cannot"

2695

" bind to interface %s", self.interface)

2614

logger.error("SO_BINDTODEVICE not available;"

2615

" cannot bind to interface %s",

2616

self.interface)

2696

2617

elif error.errno == errno.ENODEV:

2697

log.error("Interface %s does not exist, cannot"

2698

" bind", self.interface)

2618

logger.error("Interface %s does not exist,"

2619

" cannot bind", self.interface)

2699

2620

else:

2700

2621

raise

2701

2622

# Only bind(2) the socket if we really need to.

2780

2701

request = parent_pipe.recv()

2781

2702

command = request[0]

2782

2703

2783

if command == "init":

2704

if command == 'init':

2784

2705

key_id = request[1].decode("ascii")

2785

2706

fpr = request[2].decode("ascii")

2786

2707

address = request[3]

2787

2708

2788

2709

for c in self.clients.values():

2789

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2790

"27AE41E4649B934CA495991B7852B855"):

2710

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2791

2711

continue

2792

2712

if key_id and c.key_id == key_id:

2793

2713

client = c

2796

2716

client = c

2797

2717

break

2798

2718

else:

2799

log.info("Client not found for key ID: %s, address:"

2800

" %s", key_id or fpr, address)

2719

logger.info("Client not found for key ID: %s, address"

2720

": %s", key_id or fpr, address)

2801

2721

if self.use_dbus:

2802

2722

# Emit D-Bus signal

2803

2723

mandos_dbus_service.ClientNotFound(key_id or fpr,

2816

2736

# remove the old hook in favor of the new above hook on

2817

2737

# same fileno

2818

2738

return False

2819

if command == "funcall":

2739

if command == 'funcall':

2820

2740

funcname = request[1]

2821

2741

args = request[2]

2822

2742

kwargs = request[3]

2823

2743

2824

parent_pipe.send(("data", getattr(client_object,

2744

parent_pipe.send(('data', getattr(client_object,

2825

2745

funcname)(*args,

2826

2746

**kwargs)))

2827

2747

2828

if command == "getattr":

2748

if command == 'getattr':

2829

2749

attrname = request[1]

2830

2750

if isinstance(client_object.__getattribute__(attrname),

2831

collections.abc.Callable):

2832

parent_pipe.send(("function", ))

2751

collections.Callable):

2752

parent_pipe.send(('function', ))

2833

2753

else:

2834

2754

parent_pipe.send((

2835

"data", client_object.__getattribute__(attrname)))

2755

'data', client_object.__getattribute__(attrname)))

2836

2756

2837

if command == "setattr":

2757

if command == 'setattr':

2838

2758

attrname = request[1]

2839

2759

value = request[2]

2840

2760

setattr(client_object, attrname, value)

2845

2765

def rfc3339_duration_to_delta(duration):

2846

2766

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2847

2767

2848

>>> timedelta = datetime.timedelta

2849

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2850

True

2851

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2852

True

2853

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2854

True

2855

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2856

True

2857

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2858

True

2859

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2860

True

2861

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2862

True

2863

>>> del timedelta

2768

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2769

True

2770

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2771

True

2772

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2773

True

2774

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2775

True

2776

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2777

True

2778

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2779

True

2780

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2781

True

2864

2782

"""

2865

2783

2866

2784

# Parsing an RFC 3339 duration with regular expressions is not

2946

2864

def string_to_delta(interval):

2947

2865

"""Parse a string and return a datetime.timedelta

2948

2866

2949

>>> string_to_delta("7d") == datetime.timedelta(7)

2950

True

2951

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2952

True

2953

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2954

True

2955

>>> string_to_delta("24h") == datetime.timedelta(1)

2956

True

2957

>>> string_to_delta("1w") == datetime.timedelta(7)

2958

True

2959

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2867

>>> string_to_delta('7d') == datetime.timedelta(7)

2868

True

2869

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2870

True

2871

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2872

True

2873

>>> string_to_delta('24h') == datetime.timedelta(1)

2874

True

2875

>>> string_to_delta('1w') == datetime.timedelta(7)

2876

True

2877

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2960

2878

True

2961

2879

"""

2962

2880

3109

3027

# Later, stdin will, and stdout and stderr might, be dup'ed

3110

3028

# over with an opened os.devnull. But we don't want this to

3111

3029

# happen with a supplied network socket.

3112

while 0 <= server_settings["socket"] <= 2:

3030

if 0 <= server_settings["socket"] <= 2:

3113

3031

server_settings["socket"] = os.dup(server_settings

3114

3032

["socket"])

3115

os.set_inheritable(server_settings["socket"], False)

3116

3033

del server_config

3117

3034

3118

3035

# Override the settings from the config file with command line

3167

3084

3168

3085

if server_settings["servicename"] != "Mandos":

3169

3086

syslogger.setFormatter(

3170

logging.Formatter("Mandos ({}) [%(process)d]:"

3171

" %(levelname)s: %(message)s".format(

3087

logging.Formatter('Mandos ({}) [%(process)d]:'

3088

' %(levelname)s: %(message)s'.format(

3172

3089

server_settings["servicename"])))

3173

3090

3174

3091

# Parse config file with clients

3198

3115

try:

3199

3116

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

3200

3117

except IOError as e:

3201

log.error("Could not open file %r", pidfilename,

3202

exc_info=e)

3118

logger.error("Could not open file %r", pidfilename,

3119

exc_info=e)

3203

3120

3204

3121

for name, group in (("_mandos", "_mandos"),

3205

3122

("mandos", "mandos"),

3216

3133

try:

3217

3134

os.setgid(gid)

3218

3135

os.setuid(uid)

3219

log.debug("Did setuid/setgid to %s:%s", uid, gid)

3136

if debug:

3137

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3138

gid))

3220

3139

except OSError as error:

3221

log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,

3222

os.strerror(error.errno))

3140

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3141

.format(uid, gid, os.strerror(error.errno)))

3223

3142

if error.errno != errno.EPERM:

3224

3143

raise

3225

3144

3232

3151

3233

3152

@gnutls.log_func

3234

3153

def debug_gnutls(level, string):

3235

log.debug("GnuTLS: %s",

3236

string[:-1].decode("utf-8", errors="replace"))

3154

logger.debug("GnuTLS: %s", string[:-1])

3237

3155

3238

3156

gnutls.global_set_log_function(debug_gnutls)

3239

3157

3257

3175

# From the Avahi example code

3258

3176

DBusGMainLoop(set_as_default=True)

3259

3177

main_loop = GLib.MainLoop()

3260

if use_dbus or zeroconf:

3261

bus = dbus.SystemBus()

3178

bus = dbus.SystemBus()

3262

3179

# End of Avahi example code

3263

3180

if use_dbus:

3264

3181

try:

3269

3186

"se.bsnet.fukt.Mandos", bus,

3270

3187

do_not_queue=True)

3271

3188

except dbus.exceptions.DBusException as e:

3272

log.error("Disabling D-Bus:", exc_info=e)

3189

logger.error("Disabling D-Bus:", exc_info=e)

3273

3190

use_dbus = False

3274

3191

server_settings["use_dbus"] = False

3275

3192

tcp_server.use_dbus = False

3360

3277

os.remove(stored_state_path)

3361

3278

except IOError as e:

3362

3279

if e.errno == errno.ENOENT:

3363

log.warning("Could not load persistent state:"

3364

" %s", os.strerror(e.errno))

3280

logger.warning("Could not load persistent state:"

3281

" {}".format(os.strerror(e.errno)))

3365

3282

else:

3366

log.critical("Could not load persistent state:",

3367

exc_info=e)

3283

logger.critical("Could not load persistent state:",

3284

exc_info=e)

3368

3285

raise

3369

3286

except EOFError as e:

3370

log.warning("Could not load persistent state: EOFError:",

3371

exc_info=e)

3287

logger.warning("Could not load persistent state: "

3288

"EOFError:",

3289

exc_info=e)

3372

3290

3373

3291

with PGPEngine() as pgp:

3374

3292

for client_name, client in clients_data.items():

3401

3319

if client["enabled"]:

3402

3320

if datetime.datetime.utcnow() >= client["expires"]:

3403

3321

if not client["last_checked_ok"]:

3404

log.warning("disabling client %s - Client"

3405

" never performed a successful"

3406

" checker", client_name)

3322

logger.warning(

3323

"disabling client {} - Client never "

3324

"performed a successful checker".format(

3325

client_name))

3407

3326

client["enabled"] = False

3408

3327

elif client["last_checker_status"] != 0:

3409

log.warning("disabling client %s - Client"

3410

" last checker failed with error"

3411

" code %s", client_name,

3412

client["last_checker_status"])

3328

logger.warning(

3329

"disabling client {} - Client last"

3330

" checker failed with error code"

3331

" {}".format(

3332

client_name,

3333

client["last_checker_status"]))

3413

3334

client["enabled"] = False

3414

3335

else:

3415

3336

client["expires"] = (

3416

3337

datetime.datetime.utcnow()

3417

3338

+ client["timeout"])

3418

log.debug("Last checker succeeded, keeping %s"

3419

" enabled", client_name)

3339

logger.debug("Last checker succeeded,"

3340

" keeping {} enabled".format(

3341

client_name))

3420

3342

try:

3421

3343

client["secret"] = pgp.decrypt(

3422

3344

client["encrypted_secret"],

3423

3345

client_settings[client_name]["secret"])

3424

3346

except PGPError:

3425

3347

# If decryption fails, we use secret from new settings

3426

log.debug("Failed to decrypt %s old secret",

3427

client_name)

3348

logger.debug("Failed to decrypt {} old secret".format(

3349

client_name))

3428

3350

client["secret"] = (client_settings[client_name]

3429

3351

["secret"])

3430

3352

3444

3366

server_settings=server_settings)

3445

3367

3446

3368

if not tcp_server.clients:

3447

log.warning("No clients defined")

3369

logger.warning("No clients defined")

3448

3370

3449

3371

if not foreground:

3450

3372

if pidfile is not None:

3453

3375

with pidfile:

3454

3376

print(pid, file=pidfile)

3455

3377

except IOError:

3456

log.error("Could not write to file %r with PID %d",

3457

pidfilename, pid)

3378

logger.error("Could not write to file %r with PID %d",

3379

pidfilename, pid)

3458

3380

del pidfile

3459

3381

del pidfilename

3460

3382

3610

3532

3611

3533

try:

3612

3534

with tempfile.NamedTemporaryFile(

3613

mode="wb",

3535

mode='wb',

3614

3536

suffix=".pickle",

3615

prefix="clients-",

3537

prefix='clients-',

3616

3538

dir=os.path.dirname(stored_state_path),

3617

3539

delete=False) as stored_state:

3618

3540

pickle.dump((clients, client_settings), stored_state,

3626

3548

except NameError:

3627

3549

pass

3628

3550

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3629

log.warning("Could not save persistent state: %s",

3630

os.strerror(e.errno))

3551

logger.warning("Could not save persistent state: {}"

3552

.format(os.strerror(e.errno)))

3631

3553

else:

3632

log.warning("Could not save persistent state:",

3633

exc_info=e)

3554

logger.warning("Could not save persistent state:",

3555

exc_info=e)

3634

3556

raise

3635

3557

3636

3558

# Delete all clients, and settings from config

3653

3575

mandos_dbus_service.client_added_signal(client)

3654

3576

# Need to initiate checking of clients

3655

3577

if client.enabled:

3656

client.init_checker(randomize_start=True)

3578

client.init_checker()

3657

3579

3658

3580

tcp_server.enable()

3659

3581

tcp_server.server_activate()

3662

3584

if zeroconf:

3663

3585

service.port = tcp_server.socket.getsockname()[1]

3664

3586

if use_ipv6:

3665

log.info("Now listening on address %r, port %d, flowinfo %d,"

3666

" scope_id %d", *tcp_server.socket.getsockname())

3587

logger.info("Now listening on address %r, port %d,"

3588

" flowinfo %d, scope_id %d",

3589

*tcp_server.socket.getsockname())

3667

3590

else: # IPv4

3668

log.info("Now listening on address %r, port %d",

3669

*tcp_server.socket.getsockname())

3591

logger.info("Now listening on address %r, port %d",

3592

*tcp_server.socket.getsockname())

3670

3593

3671

3594

# service.interface = tcp_server.socket.getsockname()[3]

3672

3595

3676

3599

try:

3677

3600

service.activate()

3678

3601

except dbus.exceptions.DBusException as error:

3679

log.critical("D-Bus Exception", exc_info=error)

3602

logger.critical("D-Bus Exception", exc_info=error)

3680

3603

cleanup()

3681

3604

sys.exit(1)

3682

3605

# End of Avahi example code

3687

3610

lambda *args, **kwargs: (tcp_server.handle_request

3688

3611

(*args[2:], **kwargs) or True))

3689

3612

3690

log.debug("Starting main loop")

3613

logger.debug("Starting main loop")

3691

3614

main_loop.run()

3692

3615

except AvahiError as error:

3693

log.critical("Avahi Error", exc_info=error)

3616

logger.critical("Avahi Error", exc_info=error)

3694

3617

cleanup()

3695

3618

sys.exit(1)

3696

3619

except KeyboardInterrupt:

3697

3620

if debug:

3698

3621

print("", file=sys.stderr)

3699

log.debug("Server received KeyboardInterrupt")

3700

log.debug("Server exiting")

3622

logger.debug("Server received KeyboardInterrupt")

3623

logger.debug("Server exiting")

3701

3624

# Must run before the D-Bus bus name gets deregistered

3702

3625

cleanup()

3703

3626

3704

3627

3705

def parse_test_args():

3706

# type: () -> argparse.Namespace

3628

def should_only_run_tests():

3707

3629

parser = argparse.ArgumentParser(add_help=False)

3708

parser.add_argument("--check", action="store_true")

3709

parser.add_argument("--prefix", )

3630

parser.add_argument("--check", action='store_true')

3710

3631

args, unknown_args = parser.parse_known_args()

3711

if args.check:

3712

# Remove test options from sys.argv

3632

run_tests = args.check

3633

if run_tests:

3634

# Remove --check argument from sys.argv

3713

3635

sys.argv[1:] = unknown_args

3714

return args

3636

return run_tests

3715

3637

3716

3638

# Add all tests from doctest strings

3717

3639

def load_tests(loader, tests, none):

3719

3641

tests.addTests(doctest.DocTestSuite())

3720

3642

return tests

3721

3643

3722

if __name__ == "__main__":

3723

options = parse_test_args()

3644

if __name__ == '__main__':

3724

3645

try:

3725

if options.check:

3726

extra_test_prefix = options.prefix

3727

if extra_test_prefix is not None:

3728

if not (unittest.main(argv=[""], exit=False)

3729

.result.wasSuccessful()):

3730

sys.exit(1)

3731

class ExtraTestLoader(unittest.TestLoader):

3732

testMethodPrefix = extra_test_prefix

3733

# Call using ./scriptname --test [--verbose]

3734

unittest.main(argv=[""], testLoader=ExtraTestLoader())

3735

else:

3736

unittest.main(argv=[""])

3646

if should_only_run_tests():

3647

# Call using ./mandos --check [--verbose]

3648

unittest.main()

3737

3649

else:

3738

3650

main()

3739

3651

finally:

3740

3652

logging.shutdown()

3741

3742

# Local Variables:

3743

# run-tests:

3744

# (lambda (&optional extra)

3745

# (if (not (funcall run-tests-in-test-buffer default-directory

3746

# extra))

3747

# (funcall show-test-buffer-in-test-window)

3748

# (funcall remove-test-window)

3749

# (if extra (message "Extra tests run successfully!"))))

3750

# run-tests-in-test-buffer:

3751

# (lambda (dir &optional extra)

3752

# (with-current-buffer (get-buffer-create "*Test*")

3753

# (setq buffer-read-only nil

3754

# default-directory dir)

3755

# (erase-buffer)

3756

# (compilation-mode))

3757

# (let ((process-result

3758

# (let ((inhibit-read-only t))

3759

# (process-file-shell-command

3760

# (funcall get-command-line extra) nil "*Test*"))))

3761

# (and (numberp process-result)

3762

# (= process-result 0))))

3763

# get-command-line:

3764

# (lambda (&optional extra)

3765

# (let ((quoted-script

3766

# (shell-quote-argument (funcall get-script-name))))

3767

# (format

3768

# (concat "%s --check" (if extra " --prefix=atest" ""))

3769

# quoted-script)))

3770

# get-script-name:

3771

# (lambda ()

3772

# (if (fboundp 'file-local-name)

3773

# (file-local-name (buffer-file-name))

3774

# (or (file-remote-p (buffer-file-name) 'localname)

3775

# (buffer-file-name))))

3776

# remove-test-window:

3777

# (lambda ()

3778

# (let ((test-window (get-buffer-window "*Test*")))

3779

# (if test-window (delete-window test-window))))

3780

# show-test-buffer-in-test-window:

3781

# (lambda ()

3782

# (when (not (get-buffer-window-list "*Test*"))

3783

# (setq next-error-last-buffer (get-buffer "*Test*"))

3784

# (let* ((side (if (>= (window-width) 146) 'right 'bottom))

3785

# (display-buffer-overriding-action

3786

# `((display-buffer-in-side-window) (side . ,side)

3787

# (window-height . fit-window-to-buffer)

3788

# (window-width . fit-window-to-buffer))))

3789

# (display-buffer "*Test*"))))

3790

# eval:

3791

# (progn

3792

# (let* ((run-extra-tests (lambda () (interactive)

3793

# (funcall run-tests t)))

3794

# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t

3795

# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c

3796

# (setq minor-mode-overriding-map-alist

3797

# (cons `(run-tests . ,outer-keymap)

3798

# minor-mode-overriding-map-alist)))

3799

# (add-hook 'after-save-hook run-tests 90 t))

3800

# End: