To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1202
- compare with another revision
- download diff
- download tarball
- view history from revision 1202
- Committer: Teddy Hogeborn
- Date: 2020-02-06 15:56:51 UTC
- Revision ID: teddy@recompile.se-20200206155651-kx7r39zj8hpv8udl
Use collections.abc.Callable instead of collections.Callable
In Python 3.7, collections.Callable (among others) was moved to
collections.abc.Callable, and its old location deprecated.
* mandos: Create "collections.abc.Callable" if it does not exist, and
only use the new name.
In Python 3.7, collections.Callable (among others) was moved to
collections.abc.Callable, and its old location deprecated.
* mandos: Create "collections.abc.Callable" if it does not exist, and
only use the new name.
- files removed:
- debian/po/es.po
- files modified:
- DBUS-API
added
removed
mandos
1
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
39
40
except ImportError:
40
41
pass
41
42
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
43
try:
48
44
import SocketServer as socketserver
49
45
except ImportError:
50
46
import socketserver
51
47
import socket
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
import ConfigParser as configparser
56
53
except ImportError:
57
54
import configparser
55
import sys
58
56
import re
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import unittest
80
81
import random
81
import shlex
82
82
83
83
import dbus
84
84
import dbus.service
93
93
if sys.version_info.major == 2:
94
94
__metaclass__ = type
95
95
str = unicode
96
input = raw_input
97
96
98
97
# Add collections.abc.Callable if it does not exist
99
98
try:
104
103
collections.abc = abc
105
104
del abc
106
105
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
106
# Show warnings by default
114
107
if not sys.warnoptions:
115
108
import warnings
143
136
if sys.version_info < (3, 2):
144
137
configparser.Configparser = configparser.SafeConfigParser
145
138
146
version = "1.8.16"
139
version = "1.8.9"
147
140
stored_state_file = "clients.pickle"
148
141
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
142
logger = logging.getLogger()
150
143
logging.captureWarnings(True) # Show warnings via the logging system
151
144
syslogger = None
152
145
189
182
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
183
address="/dev/log"))
191
184
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
185
('Mandos [%(process)d]: %(levelname)s:'
186
' %(message)s'))
187
logger.addHandler(syslogger)
195
188
196
189
if debug:
197
190
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
191
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
192
' [%(process)d]:'
193
' %(levelname)s:'
194
' %(message)s'))
195
logger.addHandler(console)
196
logger.setLevel(level)
204
197
205
198
206
199
class PGPError(Exception):
224
217
except OSError as e:
225
218
if e.errno != errno.ENOENT:
226
219
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
220
self.gnupgargs = ['--batch',
221
'--homedir', self.tempdir,
222
'--force-mdc',
223
'--quiet']
231
224
# Only GPG version 1 has the --no-use-agent option.
232
225
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
226
self.gnupgargs.append("--no-use-agent")
272
265
dir=self.tempdir) as passfile:
273
266
passfile.write(passphrase)
274
267
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
268
proc = subprocess.Popen([self.gpg, '--symmetric',
269
'--passphrase-file',
277
270
passfile.name]
278
271
+ self.gnupgargs,
279
272
stdin=subprocess.PIPE,
290
283
dir=self.tempdir) as passfile:
291
284
passfile.write(passphrase)
292
285
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
286
proc = subprocess.Popen([self.gpg, '--decrypt',
287
'--passphrase-file',
295
288
passfile.name]
296
289
+ self.gnupgargs,
297
290
stdin=subprocess.PIPE,
350
343
Attributes:
351
344
interface: integer; avahi.IF_UNSPEC or an interface index.
352
345
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
346
name: string; Example: 'Mandos'
347
type: string; Example: '_mandos._tcp'.
355
348
See <https://www.iana.org/assignments/service-names-port-numbers>
356
349
port: integer; what port to announce
357
350
TXT: list of strings; TXT record for the service
394
387
def rename(self, remove=True):
395
388
"""Derived from the Avahi example code"""
396
389
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
390
logger.critical("No suitable Zeroconf service name found"
391
" after %i retries, exiting.",
392
self.rename_count)
400
393
raise AvahiServiceError("Too many renames")
401
394
self.name = str(
402
395
self.server.GetAlternativeServiceName(self.name))
403
396
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
397
logger.info("Changing Zeroconf service name to %r ...",
398
self.name)
406
399
if remove:
407
400
self.remove()
408
401
try:
410
403
except dbus.exceptions.DBusException as error:
411
404
if (error.get_dbus_name()
412
405
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
406
logger.info("Local Zeroconf service name collision.")
414
407
return self.rename(remove=False)
415
408
else:
416
log.critical("D-Bus Exception", exc_info=error)
409
logger.critical("D-Bus Exception", exc_info=error)
417
410
self.cleanup()
418
411
os._exit(1)
419
412
435
428
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
429
self.entry_group_state_changed_match = (
437
430
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
431
'StateChanged', self.entry_group_state_changed))
432
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
433
self.name, self.type)
441
434
self.group.AddService(
442
435
self.interface,
443
436
self.protocol,
450
443
451
444
def entry_group_state_changed(self, state, error):
452
445
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
446
logger.debug("Avahi entry group state change: %i", state)
454
447
455
448
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
449
logger.debug("Zeroconf service established.")
457
450
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
451
logger.info("Zeroconf service name collision.")
459
452
self.rename()
460
453
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
454
logger.critical("Avahi: Error in group state changed %s",
455
str(error))
463
456
raise AvahiGroupError("State changed: {!s}".format(error))
464
457
465
458
def cleanup(self):
475
468
476
469
def server_state_changed(self, state, error=None):
477
470
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
471
logger.debug("Avahi server state change: %i", state)
479
472
bad_states = {
480
473
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
474
avahi.SERVER_REGISTERING: None,
485
478
if state in bad_states:
486
479
if bad_states[state] is not None:
487
480
if error is None:
488
log.error(bad_states[state])
481
logger.error(bad_states[state])
489
482
else:
490
log.error(bad_states[state] + ": %r", error)
483
logger.error(bad_states[state] + ": %r", error)
491
484
self.cleanup()
492
485
elif state == avahi.SERVER_RUNNING:
493
486
try:
495
488
except dbus.exceptions.DBusException as error:
496
489
if (error.get_dbus_name()
497
490
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
491
logger.info("Local Zeroconf service name"
492
" collision.")
499
493
return self.rename(remove=False)
500
494
else:
501
log.critical("D-Bus Exception", exc_info=error)
495
logger.critical("D-Bus Exception", exc_info=error)
502
496
self.cleanup()
503
497
os._exit(1)
504
498
else:
505
499
if error is None:
506
log.debug("Unknown state: %r", state)
500
logger.debug("Unknown state: %r", state)
507
501
else:
508
log.debug("Unknown state: %r: %r", state, error)
502
logger.debug("Unknown state: %r: %r", state, error)
509
503
510
504
def activate(self):
511
505
"""Derived from the Avahi example code"""
523
517
class AvahiServiceToSyslog(AvahiService):
524
518
def rename(self, *args, **kwargs):
525
519
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
520
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
528
521
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
522
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
523
.format(self.name)))
531
524
return ret
532
525
562
555
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
556
564
557
# Types
565
class _session_int(ctypes.Structure):
558
class session_int(ctypes.Structure):
566
559
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
560
session_t = ctypes.POINTER(session_int)
568
561
569
562
class certificate_credentials_st(ctypes.Structure):
570
563
_fields_ = []
573
566
certificate_type_t = ctypes.c_int
574
567
575
568
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
569
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
570
('size', ctypes.c_uint)]
578
571
579
class _openpgp_crt_int(ctypes.Structure):
572
class openpgp_crt_int(ctypes.Structure):
580
573
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
574
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
575
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
576
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
577
credentials_type_t = ctypes.c_int
593
586
# gnutls.strerror()
594
587
self.code = code
595
588
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
589
message = gnutls.strerror(code)
598
590
return super(gnutls.Error, self).__init__(
599
591
message, *args)
600
592
601
593
class CertificateSecurityError(Error):
602
594
pass
603
595
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
596
# Classes
630
class Credentials(With_from_param):
597
class Credentials:
631
598
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
599
self._c_object = gnutls.certificate_credentials_t()
600
gnutls.certificate_allocate_credentials(
601
ctypes.byref(self._c_object))
634
602
self.type = gnutls.CRD_CERTIFICATE
635
603
636
604
def __del__(self):
637
gnutls.certificate_free_credentials(self)
605
gnutls.certificate_free_credentials(self._c_object)
638
606
639
class ClientSession(With_from_param):
607
class ClientSession:
640
608
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
609
self._c_object = gnutls.session_t()
642
610
gnutls_flags = gnutls.CLIENT
643
611
if gnutls.check_version(b"3.5.6"):
644
612
gnutls_flags |= gnutls.NO_TICKETS
645
613
if gnutls.has_rawpk:
646
614
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
615
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
648
616
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
617
gnutls.set_default_priority(self._c_object)
618
gnutls.transport_set_ptr(self._c_object, socket.fileno())
619
gnutls.handshake_set_private_extensions(self._c_object,
620
True)
652
621
self.socket = socket
653
622
if credentials is None:
654
623
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
624
gnutls.credentials_set(self._c_object, credentials.type,
625
ctypes.cast(credentials._c_object,
626
ctypes.c_void_p))
657
627
self.credentials = credentials
658
628
659
629
def __del__(self):
660
gnutls.deinit(self)
630
gnutls.deinit(self._c_object)
661
631
662
632
def handshake(self):
663
return gnutls.handshake(self)
633
return gnutls.handshake(self._c_object)
664
634
665
635
def send(self, data):
666
636
data = bytes(data)
667
637
data_len = len(data)
668
638
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
639
data_len -= gnutls.record_send(self._c_object,
640
data[-data_len:],
670
641
data_len)
671
642
672
643
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
644
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
645
675
646
# Error handling functions
676
647
def _error_code(result):
677
648
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
649
for the 'restype' attribute on ctypes functions"""
650
if result >= 0:
680
651
return result
681
652
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
653
raise gnutls.CertificateSecurityError(code=result)
683
654
raise gnutls.Error(code=result)
684
655
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
656
def _retry_on_error(result, func, arguments):
687
657
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
658
for the 'errcheck' attribute on ctypes functions"""
659
while result < 0:
690
660
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
661
return _error_code(result)
692
662
result = func(*arguments)
697
667
698
668
# Functions
699
669
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
670
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
671
ctypes.POINTER(ctypes.c_char_p)]
702
672
priority_set_direct.restype = _error_code
703
673
704
674
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
675
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
676
init.restype = _error_code
707
677
708
678
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
679
set_default_priority.argtypes = [session_t]
710
680
set_default_priority.restype = _error_code
711
681
712
682
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
683
record_send.argtypes = [session_t, ctypes.c_void_p,
714
684
ctypes.c_size_t]
715
685
record_send.restype = ctypes.c_ssize_t
716
686
record_send.errcheck = _retry_on_error
718
688
certificate_allocate_credentials = (
719
689
_library.gnutls_certificate_allocate_credentials)
720
690
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
691
ctypes.POINTER(certificate_credentials_t)]
722
692
certificate_allocate_credentials.restype = _error_code
723
693
724
694
certificate_free_credentials = (
725
695
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
696
certificate_free_credentials.argtypes = [
697
certificate_credentials_t]
727
698
certificate_free_credentials.restype = None
728
699
729
700
handshake_set_private_extensions = (
730
701
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
702
handshake_set_private_extensions.argtypes = [session_t,
732
703
ctypes.c_int]
733
704
handshake_set_private_extensions.restype = None
734
705
735
706
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
707
credentials_set.argtypes = [session_t, credentials_type_t,
708
ctypes.c_void_p]
738
709
credentials_set.restype = _error_code
739
710
740
711
strerror = _library.gnutls_strerror
742
713
strerror.restype = ctypes.c_char_p
743
714
744
715
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
716
certificate_type_get.argtypes = [session_t]
746
717
certificate_type_get.restype = _error_code
747
718
748
719
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
720
certificate_get_peers.argtypes = [session_t,
750
721
ctypes.POINTER(ctypes.c_uint)]
751
722
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
723
759
730
global_set_log_function.restype = None
760
731
761
732
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
733
deinit.argtypes = [session_t]
763
734
deinit.restype = None
764
735
765
736
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
737
handshake.argtypes = [session_t]
738
handshake.restype = _error_code
768
739
handshake.errcheck = _retry_on_error
769
740
770
741
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
742
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
743
transport_set_ptr.restype = None
773
744
774
745
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
746
bye.argtypes = [session_t, close_request_t]
747
bye.restype = _error_code
777
748
bye.errcheck = _retry_on_error
778
749
779
750
check_version = _library.gnutls_check_version
796
767
797
768
x509_crt_fmt_t = ctypes.c_int
798
769
799
# All the function declarations below are from
800
# gnutls/abstract.h
770
# All the function declarations below are from gnutls/abstract.h
801
771
pubkey_init = _library.gnutls_pubkey_init
802
772
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
773
pubkey_init.restype = _error_code
817
787
pubkey_deinit.argtypes = [pubkey_t]
818
788
pubkey_deinit.restype = None
819
789
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
790
# All the function declarations below are from gnutls/openpgp.h
822
791
823
792
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
793
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
830
799
openpgp_crt_fmt_t]
831
800
openpgp_crt_import.restype = _error_code
832
801
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
802
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
803
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
804
ctypes.POINTER(ctypes.c_uint)]
840
805
openpgp_crt_verify_self.restype = _error_code
841
806
842
807
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
853
818
854
819
if check_version(b"3.6.4"):
855
820
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
821
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
857
822
certificate_type_get2.restype = _error_code
858
823
859
824
# Remove non-public functions
875
840
"""A representation of a client host served by this server.
876
841
877
842
Attributes:
878
approved: bool(); None if not yet approved/disapproved
843
approved: bool(); 'None' if not yet approved/disapproved
879
844
approval_delay: datetime.timedelta(); Time to wait for approval
880
845
approval_duration: datetime.timedelta(); Duration of one approval
881
846
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
847
to see if the client lives. 'None' if no process is
883
848
running.
884
849
checker_callback_tag: a GLib event source tag, or None
885
850
checker_command: string; External command which is run to check
1009
974
self.last_enabled = None
1010
975
self.expires = None
1011
976
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
977
logger.debug("Creating client %r", self.name)
978
logger.debug(" Key ID: %s", self.key_id)
979
logger.debug(" Fingerprint: %s", self.fingerprint)
1015
980
self.created = settings.get("created",
1016
981
datetime.datetime.utcnow())
1017
982
1045
1010
if getattr(self, "enabled", False):
1046
1011
# Already enabled
1047
1012
return
1013
self.expires = datetime.datetime.utcnow() + self.timeout
1048
1014
self.enabled = True
1049
1015
self.last_enabled = datetime.datetime.utcnow()
1050
1016
self.init_checker()
1055
1021
if not getattr(self, "enabled", False):
1056
1022
return False
1057
1023
if not quiet:
1058
log.info("Disabling client %s", self.name)
1024
logger.info("Disabling client %s", self.name)
1059
1025
if getattr(self, "disable_initiator_tag", None) is not None:
1060
1026
GLib.source_remove(self.disable_initiator_tag)
1061
1027
self.disable_initiator_tag = None
1073
1039
def __del__(self):
1074
1040
self.disable()
1075
1041
1076
def init_checker(self, randomize_start=False):
1077
# Schedule a new checker to be started a randomly selected
1078
# time (a fraction of 'interval') from now. This spreads out
1079
# the startup of checkers over time when the server is
1080
# started.
1042
def init_checker(self):
1043
# Schedule a new checker to be started an 'interval' from now,
1044
# and every interval from then on.
1081
1045
if self.checker_initiator_tag is not None:
1082
1046
GLib.source_remove(self.checker_initiator_tag)
1083
interval_milliseconds = int(self.interval.total_seconds()
1084
* 1000)
1085
if randomize_start:
1086
delay_milliseconds = random.randrange(
1087
interval_milliseconds + 1)
1088
else:
1089
delay_milliseconds = interval_milliseconds
1090
1047
self.checker_initiator_tag = GLib.timeout_add(
1091
delay_milliseconds, self.start_checker, randomize_start)
1092
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1093
# A checker might take up to an 'interval' of time, so we can
1094
# expire at the soonest one interval after a checker was
1095
# started. Since the initial checker is delayed, the expire
1096
# time might have to be extended.
1097
now = datetime.datetime.utcnow()
1098
self.expires = now + delay + self.interval
1099
# Schedule a disable() at expire time
1048
random.randrange(int(self.interval.total_seconds() * 1000
1049
+ 1)),
1050
self.start_checker)
1051
# Schedule a disable() when 'timeout' has passed
1100
1052
if self.disable_initiator_tag is not None:
1101
1053
GLib.source_remove(self.disable_initiator_tag)
1102
1054
self.disable_initiator_tag = GLib.timeout_add(
1103
int((self.expires - now).total_seconds() * 1000),
1104
self.disable)
1055
int(self.timeout.total_seconds() * 1000), self.disable)
1056
# Also start a new checker *right now*.
1057
self.start_checker()
1105
1058
1106
1059
def checker_callback(self, source, condition, connection,
1107
1060
command):
1118
1071
self.last_checker_status = returncode
1119
1072
self.last_checker_signal = None
1120
1073
if self.last_checker_status == 0:
1121
log.info("Checker for %(name)s succeeded", vars(self))
1074
logger.info("Checker for %(name)s succeeded",
1075
vars(self))
1122
1076
self.checked_ok()
1123
1077
else:
1124
log.info("Checker for %(name)s failed", vars(self))
1078
logger.info("Checker for %(name)s failed", vars(self))
1125
1079
else:
1126
1080
self.last_checker_status = -1
1127
1081
self.last_checker_signal = -returncode
1128
log.warning("Checker for %(name)s crashed?", vars(self))
1082
logger.warning("Checker for %(name)s crashed?",
1083
vars(self))
1129
1084
return False
1130
1085
1131
1086
def checked_ok(self):
1150
1105
def need_approval(self):
1151
1106
self.last_approval_request = datetime.datetime.utcnow()
1152
1107
1153
def start_checker(self, start_was_randomized=False):
1108
def start_checker(self):
1154
1109
"""Start a new checker subprocess if one is not running.
1155
1110
1156
1111
If a checker already exists, leave it running and do
1165
1120
# should be.
1166
1121
1167
1122
if self.checker is not None and not self.checker.is_alive():
1168
log.warning("Checker was not alive; joining")
1123
logger.warning("Checker was not alive; joining")
1169
1124
self.checker.join()
1170
1125
self.checker = None
1171
1126
# Start a new checker if needed
1172
1127
if self.checker is None:
1173
1128
# Escape attributes for the shell
1174
1129
escaped_attrs = {
1175
attr: shlex.quote(str(getattr(self, attr)))
1130
attr: re.escape(str(getattr(self, attr)))
1176
1131
for attr in self.runtime_expansions}
1177
1132
try:
1178
1133
command = self.checker_command % escaped_attrs
1179
1134
except TypeError as error:
1180
log.error('Could not format string "%s"',
1181
self.checker_command, exc_info=error)
1135
logger.error('Could not format string "%s"',
1136
self.checker_command,
1137
exc_info=error)
1182
1138
return True # Try again later
1183
1139
self.current_checker_command = command
1184
log.info("Starting checker %r for %s", command, self.name)
1140
logger.info("Starting checker %r for %s", command,
1141
self.name)
1185
1142
# We don't need to redirect stdout and stderr, since
1186
1143
# in normal mode, that is already done by daemon(),
1187
1144
# and in debug mode we don't want to. (Stdin is
1206
1163
GLib.IOChannel.unix_new(pipe[0].fileno()),
1207
1164
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1208
1165
self.checker_callback, pipe[0], command)
1209
if start_was_randomized:
1210
# We were started after a random delay; Schedule a new
1211
# checker to be started an 'interval' from now, and every
1212
# interval from then on.
1213
now = datetime.datetime.utcnow()
1214
self.checker_initiator_tag = GLib.timeout_add(
1215
int(self.interval.total_seconds() * 1000),
1216
self.start_checker)
1217
self.expires = max(self.expires, now + self.interval)
1218
# Don't start a new checker again after same random delay
1219
return False
1220
1166
# Re-run this periodically if run by GLib.timeout_add
1221
1167
return True
1222
1168
1227
1173
self.checker_callback_tag = None
1228
1174
if getattr(self, "checker", None) is None:
1229
1175
return
1230
log.debug("Stopping checker for %(name)s", vars(self))
1176
logger.debug("Stopping checker for %(name)s", vars(self))
1231
1177
self.checker.terminate()
1232
1178
self.checker = None
1233
1179
1260
1206
func._dbus_name = func.__name__
1261
1207
if func._dbus_name.endswith("_dbus_property"):
1262
1208
func._dbus_name = func._dbus_name[:-14]
1263
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1209
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1264
1210
return func
1265
1211
1266
1212
return decorator
1355
1301
1356
1302
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1357
1303
out_signature="s",
1358
path_keyword="object_path",
1359
connection_keyword="connection")
1304
path_keyword='object_path',
1305
connection_keyword='connection')
1360
1306
def Introspect(self, object_path, connection):
1361
1307
"""Overloading of standard D-Bus method.
1362
1308
1411
1357
document.unlink()
1412
1358
except (AttributeError, xml.dom.DOMException,
1413
1359
xml.parsers.expat.ExpatError) as error:
1414
log.error("Failed to override Introspection method",
1415
exc_info=error)
1360
logger.error("Failed to override Introspection method",
1361
exc_info=error)
1416
1362
return xmlstring
1417
1363
1418
1364
1515
1461
1516
1462
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1517
1463
out_signature="s",
1518
path_keyword="object_path",
1519
connection_keyword="connection")
1464
path_keyword='object_path',
1465
connection_keyword='connection')
1520
1466
def Introspect(self, object_path, connection):
1521
1467
"""Overloading of standard D-Bus method.
1522
1468
1578
1524
document.unlink()
1579
1525
except (AttributeError, xml.dom.DOMException,
1580
1526
xml.parsers.expat.ExpatError) as error:
1581
log.error("Failed to override Introspection method",
1582
exc_info=error)
1527
logger.error("Failed to override Introspection method",
1528
exc_info=error)
1583
1529
return xmlstring
1584
1530
1585
1531
1617
1563
1618
1564
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1619
1565
out_signature="s",
1620
path_keyword="object_path",
1621
connection_keyword="connection")
1566
path_keyword='object_path',
1567
connection_keyword='connection')
1622
1568
def Introspect(self, object_path, connection):
1623
1569
"""Overloading of standard D-Bus method.
1624
1570
1649
1595
document.unlink()
1650
1596
except (AttributeError, xml.dom.DOMException,
1651
1597
xml.parsers.expat.ExpatError) as error:
1652
log.error("Failed to override Introspection method",
1653
exc_info=error)
1598
logger.error("Failed to override Introspection method",
1599
exc_info=error)
1654
1600
return xmlstring
1655
1601
1656
1602
2290
2236
class ProxyClient:
2291
2237
def __init__(self, child_pipe, key_id, fpr, address):
2292
2238
self._pipe = child_pipe
2293
self._pipe.send(("init", key_id, fpr, address))
2239
self._pipe.send(('init', key_id, fpr, address))
2294
2240
if not self._pipe.recv():
2295
2241
raise KeyError(key_id or fpr)
2296
2242
2297
2243
def __getattribute__(self, name):
2298
if name == "_pipe":
2244
if name == '_pipe':
2299
2245
return super(ProxyClient, self).__getattribute__(name)
2300
self._pipe.send(("getattr", name))
2246
self._pipe.send(('getattr', name))
2301
2247
data = self._pipe.recv()
2302
if data[0] == "data":
2248
if data[0] == 'data':
2303
2249
return data[1]
2304
if data[0] == "function":
2250
if data[0] == 'function':
2305
2251
2306
2252
def func(*args, **kwargs):
2307
self._pipe.send(("funcall", name, args, kwargs))
2253
self._pipe.send(('funcall', name, args, kwargs))
2308
2254
return self._pipe.recv()[1]
2309
2255
2310
2256
return func
2311
2257
2312
2258
def __setattr__(self, name, value):
2313
if name == "_pipe":
2259
if name == '_pipe':
2314
2260
return super(ProxyClient, self).__setattr__(name, value)
2315
self._pipe.send(("setattr", name, value))
2261
self._pipe.send(('setattr', name, value))
2316
2262
2317
2263
2318
2264
class ClientHandler(socketserver.BaseRequestHandler, object):
2323
2269
2324
2270
def handle(self):
2325
2271
with contextlib.closing(self.server.child_pipe) as child_pipe:
2326
log.info("TCP connection from: %s",
2327
str(self.client_address))
2328
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2272
logger.info("TCP connection from: %s",
2273
str(self.client_address))
2274
logger.debug("Pipe FD: %d",
2275
self.server.child_pipe.fileno())
2329
2276
2330
2277
session = gnutls.ClientSession(self.request)
2331
2278
2332
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2279
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2333
2280
# "+AES-256-CBC", "+SHA1",
2334
2281
# "+COMP-NULL", "+CTYPE-OPENPGP",
2335
2282
# "+DHE-DSS"))
2337
2284
priority = self.server.gnutls_priority
2338
2285
if priority is None:
2339
2286
priority = "NORMAL"
2340
gnutls.priority_set_direct(session,
2341
priority.encode("utf-8"), None)
2287
gnutls.priority_set_direct(session._c_object,
2288
priority.encode("utf-8"),
2289
None)
2342
2290
2343
2291
# Start communication using the Mandos protocol
2344
2292
# Get protocol number
2345
2293
line = self.request.makefile().readline()
2346
log.debug("Protocol version: %r", line)
2294
logger.debug("Protocol version: %r", line)
2347
2295
try:
2348
2296
if int(line.strip().split()[0]) > 1:
2349
2297
raise RuntimeError(line)
2350
2298
except (ValueError, IndexError, RuntimeError) as error:
2351
log.error("Unknown protocol version: %s", error)
2299
logger.error("Unknown protocol version: %s", error)
2352
2300
return
2353
2301
2354
2302
# Start GnuTLS connection
2355
2303
try:
2356
2304
session.handshake()
2357
2305
except gnutls.Error as error:
2358
log.warning("Handshake failed: %s", error)
2306
logger.warning("Handshake failed: %s", error)
2359
2307
# Do not run session.bye() here: the session is not
2360
2308
# established. Just abandon the request.
2361
2309
return
2362
log.debug("Handshake succeeded")
2310
logger.debug("Handshake succeeded")
2363
2311
2364
2312
approval_required = False
2365
2313
try:
2369
2317
key_id = self.key_id(
2370
2318
self.peer_certificate(session))
2371
2319
except (TypeError, gnutls.Error) as error:
2372
log.warning("Bad certificate: %s", error)
2320
logger.warning("Bad certificate: %s", error)
2373
2321
return
2374
log.debug("Key ID: %s",
2375
key_id.decode("utf-8",
2376
errors="replace"))
2322
logger.debug("Key ID: %s", key_id)
2377
2323
2378
2324
else:
2379
2325
key_id = b""
2381
2327
fpr = self.fingerprint(
2382
2328
self.peer_certificate(session))
2383
2329
except (TypeError, gnutls.Error) as error:
2384
log.warning("Bad certificate: %s", error)
2330
logger.warning("Bad certificate: %s", error)
2385
2331
return
2386
log.debug("Fingerprint: %s", fpr)
2332
logger.debug("Fingerprint: %s", fpr)
2387
2333
2388
2334
try:
2389
2335
client = ProxyClient(child_pipe, key_id, fpr,
2398
2344
2399
2345
while True:
2400
2346
if not client.enabled:
2401
log.info("Client %s is disabled", client.name)
2347
logger.info("Client %s is disabled",
2348
client.name)
2402
2349
if self.server.use_dbus:
2403
2350
# Emit D-Bus signal
2404
2351
client.Rejected("Disabled")
2408
2355
# We are approved or approval is disabled
2409
2356
break
2410
2357
elif client.approved is None:
2411
log.info("Client %s needs approval",
2412
client.name)
2358
logger.info("Client %s needs approval",
2359
client.name)
2413
2360
if self.server.use_dbus:
2414
2361
# Emit D-Bus signal
2415
2362
client.NeedApproval(
2416
2363
client.approval_delay.total_seconds()
2417
2364
* 1000, client.approved_by_default)
2418
2365
else:
2419
log.warning("Client %s was not approved",
2420
client.name)
2366
logger.warning("Client %s was not approved",
2367
client.name)
2421
2368
if self.server.use_dbus:
2422
2369
# Emit D-Bus signal
2423
2370
client.Rejected("Denied")
2431
2378
time2 = datetime.datetime.now()
2432
2379
if (time2 - time) >= delay:
2433
2380
if not client.approved_by_default:
2434
log.warning("Client %s timed out while"
2435
" waiting for approval",
2436
client.name)
2381
logger.warning("Client %s timed out while"
2382
" waiting for approval",
2383
client.name)
2437
2384
if self.server.use_dbus:
2438
2385
# Emit D-Bus signal
2439
2386
client.Rejected("Approval timed out")
2446
2393
try:
2447
2394
session.send(client.secret)
2448
2395
except gnutls.Error as error:
2449
log.warning("gnutls send failed", exc_info=error)
2396
logger.warning("gnutls send failed",
2397
exc_info=error)
2450
2398
return
2451
2399
2452
log.info("Sending secret to %s", client.name)
2400
logger.info("Sending secret to %s", client.name)
2453
2401
# bump the timeout using extended_timeout
2454
2402
client.bump_timeout(client.extended_timeout)
2455
2403
if self.server.use_dbus:
2462
2410
try:
2463
2411
session.bye()
2464
2412
except gnutls.Error as error:
2465
log.warning("GnuTLS bye failed", exc_info=error)
2413
logger.warning("GnuTLS bye failed",
2414
exc_info=error)
2466
2415
2467
2416
@staticmethod
2468
2417
def peer_certificate(session):
2469
2418
"Return the peer's certificate as a bytestring"
2470
2419
try:
2471
cert_type = gnutls.certificate_type_get2(
2472
session, gnutls.CTYPE_PEERS)
2420
cert_type = gnutls.certificate_type_get2(session._c_object,
2421
gnutls.CTYPE_PEERS)
2473
2422
except AttributeError:
2474
cert_type = gnutls.certificate_type_get(session)
2423
cert_type = gnutls.certificate_type_get(session._c_object)
2475
2424
if gnutls.has_rawpk:
2476
2425
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2477
2426
else:
2478
2427
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2479
2428
# If not a valid certificate type...
2480
2429
if cert_type not in valid_cert_types:
2481
log.info("Cert type %r not in %r", cert_type,
2482
valid_cert_types)
2430
logger.info("Cert type %r not in %r", cert_type,
2431
valid_cert_types)
2483
2432
# ...return invalid data
2484
2433
return b""
2485
2434
list_size = ctypes.c_uint(1)
2486
2435
cert_list = (gnutls.certificate_get_peers
2487
(session, ctypes.byref(list_size)))
2436
(session._c_object, ctypes.byref(list_size)))
2488
2437
if not bool(cert_list) and list_size.value != 0:
2489
2438
raise gnutls.Error("error getting peer certificate")
2490
2439
if list_size.value == 0:
2512
2461
buf = ctypes.create_string_buffer(32)
2513
2462
buf_len = ctypes.c_size_t(len(buf))
2514
2463
# Get the key ID from the raw public key into the buffer
2515
gnutls.pubkey_get_key_id(
2516
pubkey,
2517
gnutls.KEYID_USE_SHA256,
2518
ctypes.cast(ctypes.byref(buf),
2519
ctypes.POINTER(ctypes.c_ubyte)),
2520
ctypes.byref(buf_len))
2464
gnutls.pubkey_get_key_id(pubkey,
2465
gnutls.KEYID_USE_SHA256,
2466
ctypes.cast(ctypes.byref(buf),
2467
ctypes.POINTER(ctypes.c_ubyte)),
2468
ctypes.byref(buf_len))
2521
2469
# Deinit the certificate
2522
2470
gnutls.pubkey_deinit(pubkey)
2523
2471
2604
2552
2605
2553
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2606
2554
socketserver.TCPServer):
2607
"""IPv6-capable TCP server. Accepts None as address and/or port
2555
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2608
2556
2609
2557
Attributes:
2610
2558
enabled: Boolean; whether this server is activated yet
2661
2609
if SO_BINDTODEVICE is None:
2662
2610
# Fall back to a hard-coded value which seems to be
2663
2611
# common enough.
2664
log.warning("SO_BINDTODEVICE not found, trying 25")
2612
logger.warning("SO_BINDTODEVICE not found, trying 25")
2665
2613
SO_BINDTODEVICE = 25
2666
2614
try:
2667
2615
self.socket.setsockopt(
2669
2617
(self.interface + "\0").encode("utf-8"))
2670
2618
except socket.error as error:
2671
2619
if error.errno == errno.EPERM:
2672
log.error("No permission to bind to interface %s",
2673
self.interface)
2620
logger.error("No permission to bind to"
2621
" interface %s", self.interface)
2674
2622
elif error.errno == errno.ENOPROTOOPT:
2675
log.error("SO_BINDTODEVICE not available; cannot"
2676
" bind to interface %s", self.interface)
2623
logger.error("SO_BINDTODEVICE not available;"
2624
" cannot bind to interface %s",
2625
self.interface)
2677
2626
elif error.errno == errno.ENODEV:
2678
log.error("Interface %s does not exist, cannot"
2679
" bind", self.interface)
2627
logger.error("Interface %s does not exist,"
2628
" cannot bind", self.interface)
2680
2629
else:
2681
2630
raise
2682
2631
# Only bind(2) the socket if we really need to.
2761
2710
request = parent_pipe.recv()
2762
2711
command = request[0]
2763
2712
2764
if command == "init":
2713
if command == 'init':
2765
2714
key_id = request[1].decode("ascii")
2766
2715
fpr = request[2].decode("ascii")
2767
2716
address = request[3]
2768
2717
2769
2718
for c in self.clients.values():
2770
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2771
"27AE41E4649B934CA495991B7852B855"):
2719
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2772
2720
continue
2773
2721
if key_id and c.key_id == key_id:
2774
2722
client = c
2777
2725
client = c
2778
2726
break
2779
2727
else:
2780
log.info("Client not found for key ID: %s, address:"
2781
" %s", key_id or fpr, address)
2728
logger.info("Client not found for key ID: %s, address"
2729
": %s", key_id or fpr, address)
2782
2730
if self.use_dbus:
2783
2731
# Emit D-Bus signal
2784
2732
mandos_dbus_service.ClientNotFound(key_id or fpr,
2797
2745
# remove the old hook in favor of the new above hook on
2798
2746
# same fileno
2799
2747
return False
2800
if command == "funcall":
2748
if command == 'funcall':
2801
2749
funcname = request[1]
2802
2750
args = request[2]
2803
2751
kwargs = request[3]
2804
2752
2805
parent_pipe.send(("data", getattr(client_object,
2753
parent_pipe.send(('data', getattr(client_object,
2806
2754
funcname)(*args,
2807
2755
**kwargs)))
2808
2756
2809
if command == "getattr":
2757
if command == 'getattr':
2810
2758
attrname = request[1]
2811
2759
if isinstance(client_object.__getattribute__(attrname),
2812
2760
collections.abc.Callable):
2813
parent_pipe.send(("function", ))
2761
parent_pipe.send(('function', ))
2814
2762
else:
2815
2763
parent_pipe.send((
2816
"data", client_object.__getattribute__(attrname)))
2764
'data', client_object.__getattribute__(attrname)))
2817
2765
2818
if command == "setattr":
2766
if command == 'setattr':
2819
2767
attrname = request[1]
2820
2768
value = request[2]
2821
2769
setattr(client_object, attrname, value)
2826
2774
def rfc3339_duration_to_delta(duration):
2827
2775
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2828
2776
2829
>>> timedelta = datetime.timedelta
2830
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2831
True
2832
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2833
True
2834
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2835
True
2836
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2837
True
2838
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2839
True
2840
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2841
True
2842
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2843
True
2844
>>> del timedelta
2777
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2778
True
2779
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2780
True
2781
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2782
True
2783
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2784
True
2785
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2786
True
2787
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2788
True
2789
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2790
True
2845
2791
"""
2846
2792
2847
2793
# Parsing an RFC 3339 duration with regular expressions is not
2927
2873
def string_to_delta(interval):
2928
2874
"""Parse a string and return a datetime.timedelta
2929
2875
2930
>>> string_to_delta("7d") == datetime.timedelta(7)
2931
True
2932
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2933
True
2934
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2935
True
2936
>>> string_to_delta("24h") == datetime.timedelta(1)
2937
True
2938
>>> string_to_delta("1w") == datetime.timedelta(7)
2939
True
2940
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2876
>>> string_to_delta('7d') == datetime.timedelta(7)
2877
True
2878
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2879
True
2880
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2881
True
2882
>>> string_to_delta('24h') == datetime.timedelta(1)
2883
True
2884
>>> string_to_delta('1w') == datetime.timedelta(7)
2885
True
2886
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2941
2887
True
2942
2888
"""
2943
2889
3147
3093
3148
3094
if server_settings["servicename"] != "Mandos":
3149
3095
syslogger.setFormatter(
3150
logging.Formatter("Mandos ({}) [%(process)d]:"
3151
" %(levelname)s: %(message)s".format(
3096
logging.Formatter('Mandos ({}) [%(process)d]:'
3097
' %(levelname)s: %(message)s'.format(
3152
3098
server_settings["servicename"])))
3153
3099
3154
3100
# Parse config file with clients
3178
3124
try:
3179
3125
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3180
3126
except IOError as e:
3181
log.error("Could not open file %r", pidfilename,
3182
exc_info=e)
3127
logger.error("Could not open file %r", pidfilename,
3128
exc_info=e)
3183
3129
3184
3130
for name, group in (("_mandos", "_mandos"),
3185
3131
("mandos", "mandos"),
3196
3142
try:
3197
3143
os.setgid(gid)
3198
3144
os.setuid(uid)
3199
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3145
if debug:
3146
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3147
gid))
3200
3148
except OSError as error:
3201
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3202
os.strerror(error.errno))
3149
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3150
.format(uid, gid, os.strerror(error.errno)))
3203
3151
if error.errno != errno.EPERM:
3204
3152
raise
3205
3153
3212
3160
3213
3161
@gnutls.log_func
3214
3162
def debug_gnutls(level, string):
3215
log.debug("GnuTLS: %s",
3216
string[:-1].decode("utf-8", errors="replace"))
3163
logger.debug("GnuTLS: %s", string[:-1])
3217
3164
3218
3165
gnutls.global_set_log_function(debug_gnutls)
3219
3166
3248
3195
"se.bsnet.fukt.Mandos", bus,
3249
3196
do_not_queue=True)
3250
3197
except dbus.exceptions.DBusException as e:
3251
log.error("Disabling D-Bus:", exc_info=e)
3198
logger.error("Disabling D-Bus:", exc_info=e)
3252
3199
use_dbus = False
3253
3200
server_settings["use_dbus"] = False
3254
3201
tcp_server.use_dbus = False
3339
3286
os.remove(stored_state_path)
3340
3287
except IOError as e:
3341
3288
if e.errno == errno.ENOENT:
3342
log.warning("Could not load persistent state:"
3343
" %s", os.strerror(e.errno))
3289
logger.warning("Could not load persistent state:"
3290
" {}".format(os.strerror(e.errno)))
3344
3291
else:
3345
log.critical("Could not load persistent state:",
3346
exc_info=e)
3292
logger.critical("Could not load persistent state:",
3293
exc_info=e)
3347
3294
raise
3348
3295
except EOFError as e:
3349
log.warning("Could not load persistent state: EOFError:",
3350
exc_info=e)
3296
logger.warning("Could not load persistent state: "
3297
"EOFError:",
3298
exc_info=e)
3351
3299
3352
3300
with PGPEngine() as pgp:
3353
3301
for client_name, client in clients_data.items():
3380
3328
if client["enabled"]:
3381
3329
if datetime.datetime.utcnow() >= client["expires"]:
3382
3330
if not client["last_checked_ok"]:
3383
log.warning("disabling client %s - Client"
3384
" never performed a successful"
3385
" checker", client_name)
3331
logger.warning(
3332
"disabling client {} - Client never "
3333
"performed a successful checker".format(
3334
client_name))
3386
3335
client["enabled"] = False
3387
3336
elif client["last_checker_status"] != 0:
3388
log.warning("disabling client %s - Client"
3389
" last checker failed with error"
3390
" code %s", client_name,
3391
client["last_checker_status"])
3337
logger.warning(
3338
"disabling client {} - Client last"
3339
" checker failed with error code"
3340
" {}".format(
3341
client_name,
3342
client["last_checker_status"]))
3392
3343
client["enabled"] = False
3393
3344
else:
3394
3345
client["expires"] = (
3395
3346
datetime.datetime.utcnow()
3396
3347
+ client["timeout"])
3397
log.debug("Last checker succeeded, keeping %s"
3398
" enabled", client_name)
3348
logger.debug("Last checker succeeded,"
3349
" keeping {} enabled".format(
3350
client_name))
3399
3351
try:
3400
3352
client["secret"] = pgp.decrypt(
3401
3353
client["encrypted_secret"],
3402
3354
client_settings[client_name]["secret"])
3403
3355
except PGPError:
3404
3356
# If decryption fails, we use secret from new settings
3405
log.debug("Failed to decrypt %s old secret",
3406
client_name)
3357
logger.debug("Failed to decrypt {} old secret".format(
3358
client_name))
3407
3359
client["secret"] = (client_settings[client_name]
3408
3360
["secret"])
3409
3361
3423
3375
server_settings=server_settings)
3424
3376
3425
3377
if not tcp_server.clients:
3426
log.warning("No clients defined")
3378
logger.warning("No clients defined")
3427
3379
3428
3380
if not foreground:
3429
3381
if pidfile is not None:
3432
3384
with pidfile:
3433
3385
print(pid, file=pidfile)
3434
3386
except IOError:
3435
log.error("Could not write to file %r with PID %d",
3436
pidfilename, pid)
3387
logger.error("Could not write to file %r with PID %d",
3388
pidfilename, pid)
3437
3389
del pidfile
3438
3390
del pidfilename
3439
3391
3589
3541
3590
3542
try:
3591
3543
with tempfile.NamedTemporaryFile(
3592
mode="wb",
3544
mode='wb',
3593
3545
suffix=".pickle",
3594
prefix="clients-",
3546
prefix='clients-',
3595
3547
dir=os.path.dirname(stored_state_path),
3596
3548
delete=False) as stored_state:
3597
3549
pickle.dump((clients, client_settings), stored_state,
3605
3557
except NameError:
3606
3558
pass
3607
3559
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3608
log.warning("Could not save persistent state: %s",
3609
os.strerror(e.errno))
3560
logger.warning("Could not save persistent state: {}"
3561
.format(os.strerror(e.errno)))
3610
3562
else:
3611
log.warning("Could not save persistent state:",
3612
exc_info=e)
3563
logger.warning("Could not save persistent state:",
3564
exc_info=e)
3613
3565
raise
3614
3566
3615
3567
# Delete all clients, and settings from config
3632
3584
mandos_dbus_service.client_added_signal(client)
3633
3585
# Need to initiate checking of clients
3634
3586
if client.enabled:
3635
client.init_checker(randomize_start=True)
3587
client.init_checker()
3636
3588
3637
3589
tcp_server.enable()
3638
3590
tcp_server.server_activate()
3641
3593
if zeroconf:
3642
3594
service.port = tcp_server.socket.getsockname()[1]
3643
3595
if use_ipv6:
3644
log.info("Now listening on address %r, port %d, flowinfo %d,"
3645
" scope_id %d", *tcp_server.socket.getsockname())
3596
logger.info("Now listening on address %r, port %d,"
3597
" flowinfo %d, scope_id %d",
3598
*tcp_server.socket.getsockname())
3646
3599
else: # IPv4
3647
log.info("Now listening on address %r, port %d",
3648
*tcp_server.socket.getsockname())
3600
logger.info("Now listening on address %r, port %d",
3601
*tcp_server.socket.getsockname())
3649
3602
3650
3603
# service.interface = tcp_server.socket.getsockname()[3]
3651
3604
3655
3608
try:
3656
3609
service.activate()
3657
3610
except dbus.exceptions.DBusException as error:
3658
log.critical("D-Bus Exception", exc_info=error)
3611
logger.critical("D-Bus Exception", exc_info=error)
3659
3612
cleanup()
3660
3613
sys.exit(1)
3661
3614
# End of Avahi example code
3666
3619
lambda *args, **kwargs: (tcp_server.handle_request
3667
3620
(*args[2:], **kwargs) or True))
3668
3621
3669
log.debug("Starting main loop")
3622
logger.debug("Starting main loop")
3670
3623
main_loop.run()
3671
3624
except AvahiError as error:
3672
log.critical("Avahi Error", exc_info=error)
3625
logger.critical("Avahi Error", exc_info=error)
3673
3626
cleanup()
3674
3627
sys.exit(1)
3675
3628
except KeyboardInterrupt:
3676
3629
if debug:
3677
3630
print("", file=sys.stderr)
3678
log.debug("Server received KeyboardInterrupt")
3679
log.debug("Server exiting")
3631
logger.debug("Server received KeyboardInterrupt")
3632
logger.debug("Server exiting")
3680
3633
# Must run before the D-Bus bus name gets deregistered
3681
3634
cleanup()
3682
3635
3683
3636
3684
def parse_test_args():
3685
# type: () -> argparse.Namespace
3637
def should_only_run_tests():
3686
3638
parser = argparse.ArgumentParser(add_help=False)
3687
parser.add_argument("--check", action="store_true")
3688
parser.add_argument("--prefix", )
3639
parser.add_argument("--check", action='store_true')
3689
3640
args, unknown_args = parser.parse_known_args()
3690
if args.check:
3691
# Remove test options from sys.argv
3641
run_tests = args.check
3642
if run_tests:
3643
# Remove --check argument from sys.argv
3692
3644
sys.argv[1:] = unknown_args
3693
return args
3645
return run_tests
3694
3646
3695
3647
# Add all tests from doctest strings
3696
3648
def load_tests(loader, tests, none):
3698
3650
tests.addTests(doctest.DocTestSuite())
3699
3651
return tests
3700
3652
3701
if __name__ == "__main__":
3702
options = parse_test_args()
3653
if __name__ == '__main__':
3703
3654
try:
3704
if options.check:
3705
extra_test_prefix = options.prefix
3706
if extra_test_prefix is not None:
3707
if not (unittest.main(argv=[""], exit=False)
3708
.result.wasSuccessful()):
3709
sys.exit(1)
3710
class ExtraTestLoader(unittest.TestLoader):
3711
testMethodPrefix = extra_test_prefix
3712
# Call using ./scriptname --test [--verbose]
3713
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3714
else:
3715
unittest.main(argv=[""])
3655
if should_only_run_tests():
3656
# Call using ./mandos --check [--verbose]
3657
unittest.main()
3716
3658
else:
3717
3659
main()
3718
3660
finally:
3719
3661
logging.shutdown()
3720
3721
# Local Variables:
3722
# run-tests:
3723
# (lambda (&optional extra)
3724
# (if (not (funcall run-tests-in-test-buffer default-directory
3725
# extra))
3726
# (funcall show-test-buffer-in-test-window)
3727
# (funcall remove-test-window)
3728
# (if extra (message "Extra tests run successfully!"))))
3729
# run-tests-in-test-buffer:
3730
# (lambda (dir &optional extra)
3731
# (with-current-buffer (get-buffer-create "*Test*")
3732
# (setq buffer-read-only nil
3733
# default-directory dir)
3734
# (erase-buffer)
3735
# (compilation-mode))
3736
# (let ((process-result
3737
# (let ((inhibit-read-only t))
3738
# (process-file-shell-command
3739
# (funcall get-command-line extra) nil "*Test*"))))
3740
# (and (numberp process-result)
3741
# (= process-result 0))))
3742
# get-command-line:
3743
# (lambda (&optional extra)
3744
# (let ((quoted-script
3745
# (shell-quote-argument (funcall get-script-name))))
3746
# (format
3747
# (concat "%s --check" (if extra " --prefix=atest" ""))
3748
# quoted-script)))
3749
# get-script-name:
3750
# (lambda ()
3751
# (if (fboundp 'file-local-name)
3752
# (file-local-name (buffer-file-name))
3753
# (or (file-remote-p (buffer-file-name) 'localname)
3754
# (buffer-file-name))))
3755
# remove-test-window:
3756
# (lambda ()
3757
# (let ((test-window (get-buffer-window "*Test*")))
3758
# (if test-window (delete-window test-window))))
3759
# show-test-buffer-in-test-window:
3760
# (lambda ()
3761
# (when (not (get-buffer-window-list "*Test*"))
3762
# (setq next-error-last-buffer (get-buffer "*Test*"))
3763
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3764
# (display-buffer-overriding-action
3765
# `((display-buffer-in-side-window) (side . ,side)
3766
# (window-height . fit-window-to-buffer)
3767
# (window-width . fit-window-to-buffer))))
3768
# (display-buffer "*Test*"))))
3769
# eval:
3770
# (progn
3771
# (let* ((run-extra-tests (lambda () (interactive)
3772
# (funcall run-tests t)))
3773
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3774
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3775
# (setq minor-mode-overriding-map-alist
3776
# (cons `(run-tests . ,outer-keymap)
3777
# minor-mode-overriding-map-alist)))
3778
# (add-hook 'after-save-hook run-tests 90 t))
3779
# End:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0