/mandos/trunk : revision 1203

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

Committer: teddy at recompile
Date: 2020-02-07 20:53:34 UTC
Revision ID: teddy@recompile.se-20200207205334-dp41p8c8vw0ytik5

Allow users to more easily alter mandos.service

The sysvinit script uses /etc/default/mandos as an environment file,
and supports adding additional server options to a DAEMON_ARGS
environment variable.  This should be supported by the systemd
service, too.

* mandos.service ([Service]/EnvironmentFile): New; set to
  "/etc/default/mandos ".
  ([Service]/ExecStart): Append "$DAEMON_ARGS".

Show diffs side-by-side

added added

removed removed

mandos

# "AvahiService" class, and some lines in "main".

# Everything else is

# This file is part of Mandos.

import codecs

import unittest

import random

import shlex

import dbus

import dbus.service

104

103

collections.abc = abc

105

104

del abc

106

105

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

106

# Show warnings by default

114

107

if not sys.warnoptions:

115

108

import warnings

143

136

if sys.version_info < (3, 2):

144

137

configparser.Configparser = configparser.SafeConfigParser

145

138

146

version = "1.8.14"

139

version = "1.8.9"

147

140

stored_state_file = "clients.pickle"

148

141

149

142

logger = logging.getLogger()

524

517

class AvahiServiceToSyslog(AvahiService):

525

518

def rename(self, *args, **kwargs):

526

519

"""Add the new name to the syslog messages"""

527

ret = super(AvahiServiceToSyslog, self).rename(*args,

528

**kwargs)

520

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

529

521

syslogger.setFormatter(logging.Formatter(

530

522

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

531

523

.format(self.name)))

661

653

raise gnutls.CertificateSecurityError(code=result)

662

654

raise gnutls.Error(code=result)

663

655

664

def _retry_on_error(result, func, arguments,

665

_error_code=_error_code):

656

def _retry_on_error(result, func, arguments):

666

657

"""A function to retry on some errors, suitable

667

658

for the 'errcheck' attribute on ctypes functions"""

668

659

while result < 0:

776

767

777

768

x509_crt_fmt_t = ctypes.c_int

778

769

779

# All the function declarations below are from

780

# gnutls/abstract.h

770

# All the function declarations below are from gnutls/abstract.h

781

771

pubkey_init = _library.gnutls_pubkey_init

782

772

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

783

773

pubkey_init.restype = _error_code

797

787

pubkey_deinit.argtypes = [pubkey_t]

798

788

pubkey_deinit.restype = None

799

789

else:

800

# All the function declarations below are from

801

# gnutls/openpgp.h

790

# All the function declarations below are from gnutls/openpgp.h

802

791

803

792

openpgp_crt_init = _library.gnutls_openpgp_crt_init

804

793

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

810

799

openpgp_crt_fmt_t]

811

800

openpgp_crt_import.restype = _error_code

812

801

813

openpgp_crt_verify_self = \

814

_library.gnutls_openpgp_crt_verify_self

815

openpgp_crt_verify_self.argtypes = [

816

openpgp_crt_t,

817

ctypes.c_uint,

818

ctypes.POINTER(ctypes.c_uint),

819

]

802

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

803

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

804

ctypes.POINTER(ctypes.c_uint)]

820

805

openpgp_crt_verify_self.restype = _error_code

821

806

822

807

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

1142

1127

if self.checker is None:

1143

1128

# Escape attributes for the shell

1144

1129

escaped_attrs = {

1145

attr: shlex.quote(str(getattr(self, attr)))

1130

attr: re.escape(str(getattr(self, attr)))

1146

1131

for attr in self.runtime_expansions}

1147

1132

try:

1148

1133

command = self.checker_command % escaped_attrs

2476

2461

buf = ctypes.create_string_buffer(32)

2477

2462

buf_len = ctypes.c_size_t(len(buf))

2478

2463

# Get the key ID from the raw public key into the buffer

2479

gnutls.pubkey_get_key_id(

2480

pubkey,

2481

gnutls.KEYID_USE_SHA256,

2482

ctypes.cast(ctypes.byref(buf),

2483

ctypes.POINTER(ctypes.c_ubyte)),

2484

ctypes.byref(buf_len))

2464

gnutls.pubkey_get_key_id(pubkey,

2465

gnutls.KEYID_USE_SHA256,

2466

ctypes.cast(ctypes.byref(buf),

2467

ctypes.POINTER(ctypes.c_ubyte)),

2468

ctypes.byref(buf_len))

2485

2469

# Deinit the certificate

2486

2470

gnutls.pubkey_deinit(pubkey)

2487

2471

2732

2716

address = request[3]

2733

2717

2734

2718

for c in self.clients.values():

2735

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2736

"27AE41E4649B934CA495991B7852B855"):

2719

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2737

2720

continue

2738

2721

if key_id and c.key_id == key_id:

2739

2722

client = c

2791

2774

def rfc3339_duration_to_delta(duration):

2792

2775

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2793

2776

2794

>>> timedelta = datetime.timedelta

2795

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2796

True

2797

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2798

True

2799

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2800

True

2801

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2802

True

2803

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2804

True

2805

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2806

True

2807

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2808

True

2809

>>> del timedelta

2777

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2778

True

2779

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2780

True

2781

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2782

True

2783

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2784

True

2785

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2786

True

2787

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2788

True

2789

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2790

True

2810

2791

"""

2811

2792

2812

2793

# Parsing an RFC 3339 duration with regular expressions is not

Older »