/mandos/trunk : revision 1203

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

Committer: teddy at recompile
Date: 2020-02-07 20:53:34 UTC
Revision ID: teddy@recompile.se-20200207205334-dp41p8c8vw0ytik5

Allow users to more easily alter mandos.service

The sysvinit script uses /etc/default/mandos as an environment file,
and supports adding additional server options to a DAEMON_ARGS
environment variable.  This should be supported by the systemd
service, too.

* mandos.service ([Service]/EnvironmentFile): New; set to
  "/etc/default/mandos ".
  ([Service]/ExecStart): Append "$DAEMON_ARGS".

Show diffs side-by-side

added added

removed removed

mandos

#!/usr/bin/python

# -*- mode: python; coding: utf-8 -*-

#!/usr/bin/python3 -bI

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

# Mandos server - give out binary blobs to connecting clients.

import itertools

import collections

import codecs

import unittest

import random

import dbus

import dbus.service

if sys.version_info.major == 2:

__metaclass__ = type

str = unicode

# Add collections.abc.Callable if it does not exist

try:

collections.abc.Callable

100

except AttributeError:

101

class abc:

102

Callable = collections.Callable

103

collections.abc = abc

104

del abc

105

106

# Show warnings by default

107

if not sys.warnoptions:

108

import warnings

109

warnings.simplefilter("default")

110

111

# Try to find the value of SO_BINDTODEVICE:

112

try:

116

133

# No value found

117

134

SO_BINDTODEVICE = None

118

135

119

if sys.version_info.major == 2:

120

str = unicode

121

122

136

if sys.version_info < (3, 2):

123

137

configparser.Configparser = configparser.SafeConfigParser

124

138

125

version = "1.8.7"

139

version = "1.8.9"

126

140

stored_state_file = "clients.pickle"

127

141

128

142

logger = logging.getLogger()

143

logging.captureWarnings(True) # Show warnings via the logging system

129

144

syslogger = None

130

145

131

146

try:

196

211

output = subprocess.check_output(["gpgconf"])

197

212

for line in output.splitlines():

198

213

name, text, path = line.split(b":")

199

if name == "gpg":

214

if name == b"gpg":

200

215

self.gpg = path

201

216

break

202

217

except OSError as e:

207

222

'--force-mdc',

208

223

'--quiet']

209

224

# Only GPG version 1 has the --no-use-agent option.

210

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

225

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

211

226

self.gnupgargs.append("--no-use-agent")

212

227

213

228

def __enter__(self):

1030

1045

if self.checker_initiator_tag is not None:

1031

1046

GLib.source_remove(self.checker_initiator_tag)

1032

1047

self.checker_initiator_tag = GLib.timeout_add(

1033

int(self.interval.total_seconds() * 1000),

1048

random.randrange(int(self.interval.total_seconds() * 1000

1049

+ 1)),

1034

1050

self.start_checker)

1035

1051

# Schedule a disable() when 'timeout' has passed

1036

1052

if self.disable_initiator_tag is not None:

1046

1062

# Read return code from connection (see call_pipe)

1047

1063

returncode = connection.recv()

1048

1064

connection.close()

1049

self.checker.join()

1065

if self.checker is not None:

1066

self.checker.join()

1050

1067

self.checker_callback_tag = None

1051

1068

self.checker = None

1052

1069

1143

1160

kwargs=popen_args)

1144

1161

self.checker.start()

1145

1162

self.checker_callback_tag = GLib.io_add_watch(

1146

pipe[0].fileno(), GLib.IO_IN,

1163

GLib.IOChannel.unix_new(pipe[0].fileno()),

1164

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1147

1165

self.checker_callback, pipe[0], command)

1148

1166

# Re-run this periodically if run by GLib.timeout_add

1149

1167

return True

1404

1422

raise ValueError("Byte arrays not supported for non-"

1405

1423

"'ay' signature {!r}"

1406

1424

.format(prop._dbus_signature))

1407

value = dbus.ByteArray(b''.join(chr(byte)

1408

for byte in value))

1425

value = dbus.ByteArray(bytes(value))

1409

1426

prop(value)

1410

1427

1411

1428

@dbus.service.method(dbus.PROPERTIES_IFACE,

2673

2690

def add_pipe(self, parent_pipe, proc):

2674

2691

# Call "handle_ipc" for both data and EOF events

2675

2692

GLib.io_add_watch(

2676

parent_pipe.fileno(),

2677

GLib.IO_IN | GLib.IO_HUP,

2693

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2694

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2678

2695

functools.partial(self.handle_ipc,

2679

2696

parent_pipe=parent_pipe,

2680

2697

proc=proc))

2718

2735

return False

2719

2736

2720

2737

GLib.io_add_watch(

2721

parent_pipe.fileno(),

2722

GLib.IO_IN | GLib.IO_HUP,

2738

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2739

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2723

2740

functools.partial(self.handle_ipc,

2724

2741

parent_pipe=parent_pipe,

2725

2742

proc=proc,

2740

2757

if command == 'getattr':

2741

2758

attrname = request[1]

2742

2759

if isinstance(client_object.__getattribute__(attrname),

2743

collections.Callable):

2760

collections.abc.Callable):

2744

2761

parent_pipe.send(('function', ))

2745

2762

else:

2746

2763

parent_pipe.send((

2757

2774

def rfc3339_duration_to_delta(duration):

2758

2775

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2759

2776

2760

>>> rfc3339_duration_to_delta("P7D")

2761

datetime.timedelta(7)

2762

>>> rfc3339_duration_to_delta("PT60S")

2763

datetime.timedelta(0, 60)

2764

>>> rfc3339_duration_to_delta("PT60M")

2765

datetime.timedelta(0, 3600)

2766

>>> rfc3339_duration_to_delta("PT24H")

2767

datetime.timedelta(1)

2768

>>> rfc3339_duration_to_delta("P1W")

2769

datetime.timedelta(7)

2770

>>> rfc3339_duration_to_delta("PT5M30S")

2771

datetime.timedelta(0, 330)

2772

>>> rfc3339_duration_to_delta("P1DT3M20S")

2773

datetime.timedelta(1, 200)

2777

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2778

True

2779

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2780

True

2781

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2782

True

2783

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2784

True

2785

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2786

True

2787

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2788

True

2789

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2790

True

2774

2791

"""

2775

2792

2776

2793

# Parsing an RFC 3339 duration with regular expressions is not

2856

2873

def string_to_delta(interval):

2857

2874

"""Parse a string and return a datetime.timedelta

2858

2875

2859

>>> string_to_delta('7d')

2860

datetime.timedelta(7)

2861

>>> string_to_delta('60s')

2862

datetime.timedelta(0, 60)

2863

>>> string_to_delta('60m')

2864

datetime.timedelta(0, 3600)

2865

>>> string_to_delta('24h')

2866

datetime.timedelta(1)

2867

>>> string_to_delta('1w')

2868

datetime.timedelta(7)

2869

>>> string_to_delta('5m 30s')

2870

datetime.timedelta(0, 330)

2876

>>> string_to_delta('7d') == datetime.timedelta(7)

2877

True

2878

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2879

True

2880

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2881

True

2882

>>> string_to_delta('24h') == datetime.timedelta(1)

2883

True

2884

>>> string_to_delta('1w') == datetime.timedelta(7)

2885

True

2886

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2887

True

2871

2888

"""

2872

2889

2873

2890

try:

2975

2992

2976

2993

options = parser.parse_args()

2977

2994

2978

if options.check:

2979

import doctest

2980

fail_count, test_count = doctest.testmod()

2981

sys.exit(os.EX_OK if fail_count == 0 else 1)

2982

2983

2995

# Default values for config file for server-global settings

2984

2996

if gnutls.has_rawpk:

2985

2997

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3248

3260

if isinstance(s, bytes)

3249

3261

else s) for s in

3250

3262

value["client_structure"]]

3251

# .name & .host

3252

for k in ("name", "host"):

3263

# .name, .host, and .checker_command

3264

for k in ("name", "host", "checker_command"):

3253

3265

if isinstance(value[k], bytes):

3254

3266

value[k] = value[k].decode("utf-8")

3255

3267

if "key_id" not in value:

3265

3277

for key, value in

3266

3278

bytes_old_client_settings.items()}

3267

3279

del bytes_old_client_settings

3268

# .host

3280

# .host and .checker_command

3269

3281

for value in old_client_settings.values():

3270

if isinstance(value["host"], bytes):

3271

value["host"] = (value["host"]

3272

.decode("utf-8"))

3282

for attribute in ("host", "checker_command"):

3283

if isinstance(value[attribute], bytes):

3284

value[attribute] = (value[attribute]

3285

.decode("utf-8"))

3273

3286

os.remove(stored_state_path)

3274

3287

except IOError as e:

3275

3288

if e.errno == errno.ENOENT:

3600

3613

sys.exit(1)

3601

3614

# End of Avahi example code

3602

3615

3603

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3604

lambda *args, **kwargs:

3605

(tcp_server.handle_request

3606

(*args[2:], **kwargs) or True))

3616

GLib.io_add_watch(

3617

GLib.IOChannel.unix_new(tcp_server.fileno()),

3618

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3619

lambda *args, **kwargs: (tcp_server.handle_request

3620

(*args[2:], **kwargs) or True))

3607

3621

3608

3622

logger.debug("Starting main loop")

3609

3623

main_loop.run()

3619

3633

# Must run before the D-Bus bus name gets deregistered

3620

3634

cleanup()

3621

3635

3636

3637

def should_only_run_tests():

3638

parser = argparse.ArgumentParser(add_help=False)

3639

parser.add_argument("--check", action='store_true')

3640

args, unknown_args = parser.parse_known_args()

3641

run_tests = args.check

3642

if run_tests:

3643

# Remove --check argument from sys.argv

3644

sys.argv[1:] = unknown_args

3645

return run_tests

3646

3647

# Add all tests from doctest strings

3648

def load_tests(loader, tests, none):

3649

import doctest

3650

tests.addTests(doctest.DocTestSuite())

3651

return tests

3622

3652

3623

3653

if __name__ == '__main__':

3624

main()

3654

try:

3655

if should_only_run_tests():

3656

# Call using ./mandos --check [--verbose]

3657

unittest.main()

3658

else:

3659

main()

3660

finally:

3661

logging.shutdown()

Older »