To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1215
- compare with another revision
- download diff
- download tarball
- view history from revision 1215
- Committer: teddy at recompile
- Date: 2020-07-04 08:59:37 UTC
- Revision ID: teddy@recompile.se-20200704085937-r495zb32nfng9lnt
In initramfs-tools boots, only use setsid when available
* initramfs-tools-script: If available, use setsid to start
mandos-to-cryptroot-unlock.
* initramfs-tools-script: If available, use setsid to start
mandos-to-cryptroot-unlock.
- files removed:
- debian/mandos.maintscript
- files modified:
- DBUS-API
added
removed
mandos
1
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
39
40
except ImportError:
40
41
pass
41
42
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
43
try:
48
44
import SocketServer as socketserver
49
45
except ImportError:
50
46
import socketserver
51
47
import socket
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
import ConfigParser as configparser
56
53
except ImportError:
57
54
import configparser
55
import sys
58
56
import re
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import unittest
80
81
import random
81
82
import shlex
82
83
93
94
if sys.version_info.major == 2:
94
95
__metaclass__ = type
95
96
str = unicode
96
input = raw_input
97
97
98
98
# Add collections.abc.Callable if it does not exist
99
99
try:
143
143
if sys.version_info < (3, 2):
144
144
configparser.Configparser = configparser.SafeConfigParser
145
145
146
version = "1.8.16"
146
version = "1.8.11"
147
147
stored_state_file = "clients.pickle"
148
148
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
149
logger = logging.getLogger()
150
150
logging.captureWarnings(True) # Show warnings via the logging system
151
151
syslogger = None
152
152
189
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
190
address="/dev/log"))
191
191
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
192
('Mandos [%(process)d]: %(levelname)s:'
193
' %(message)s'))
194
logger.addHandler(syslogger)
195
195
196
196
if debug:
197
197
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
198
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
199
' [%(process)d]:'
200
' %(levelname)s:'
201
' %(message)s'))
202
logger.addHandler(console)
203
logger.setLevel(level)
204
204
205
205
206
206
class PGPError(Exception):
224
224
except OSError as e:
225
225
if e.errno != errno.ENOENT:
226
226
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
227
self.gnupgargs = ['--batch',
228
'--homedir', self.tempdir,
229
'--force-mdc',
230
'--quiet']
231
231
# Only GPG version 1 has the --no-use-agent option.
232
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
233
self.gnupgargs.append("--no-use-agent")
272
272
dir=self.tempdir) as passfile:
273
273
passfile.write(passphrase)
274
274
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
275
proc = subprocess.Popen([self.gpg, '--symmetric',
276
'--passphrase-file',
277
277
passfile.name]
278
278
+ self.gnupgargs,
279
279
stdin=subprocess.PIPE,
290
290
dir=self.tempdir) as passfile:
291
291
passfile.write(passphrase)
292
292
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
293
proc = subprocess.Popen([self.gpg, '--decrypt',
294
'--passphrase-file',
295
295
passfile.name]
296
296
+ self.gnupgargs,
297
297
stdin=subprocess.PIPE,
350
350
Attributes:
351
351
interface: integer; avahi.IF_UNSPEC or an interface index.
352
352
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
353
name: string; Example: 'Mandos'
354
type: string; Example: '_mandos._tcp'.
355
355
See <https://www.iana.org/assignments/service-names-port-numbers>
356
356
port: integer; what port to announce
357
357
TXT: list of strings; TXT record for the service
394
394
def rename(self, remove=True):
395
395
"""Derived from the Avahi example code"""
396
396
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
397
logger.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
400
400
raise AvahiServiceError("Too many renames")
401
401
self.name = str(
402
402
self.server.GetAlternativeServiceName(self.name))
403
403
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
404
logger.info("Changing Zeroconf service name to %r ...",
405
self.name)
406
406
if remove:
407
407
self.remove()
408
408
try:
410
410
except dbus.exceptions.DBusException as error:
411
411
if (error.get_dbus_name()
412
412
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
413
logger.info("Local Zeroconf service name collision.")
414
414
return self.rename(remove=False)
415
415
else:
416
log.critical("D-Bus Exception", exc_info=error)
416
logger.critical("D-Bus Exception", exc_info=error)
417
417
self.cleanup()
418
418
os._exit(1)
419
419
435
435
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
436
self.entry_group_state_changed_match = (
437
437
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
438
'StateChanged', self.entry_group_state_changed))
439
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
441
441
self.group.AddService(
442
442
self.interface,
443
443
self.protocol,
450
450
451
451
def entry_group_state_changed(self, state, error):
452
452
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
453
logger.debug("Avahi entry group state change: %i", state)
454
454
455
455
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
456
logger.debug("Zeroconf service established.")
457
457
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
458
logger.info("Zeroconf service name collision.")
459
459
self.rename()
460
460
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
461
logger.critical("Avahi: Error in group state changed %s",
462
str(error))
463
463
raise AvahiGroupError("State changed: {!s}".format(error))
464
464
465
465
def cleanup(self):
475
475
476
476
def server_state_changed(self, state, error=None):
477
477
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
478
logger.debug("Avahi server state change: %i", state)
479
479
bad_states = {
480
480
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
481
avahi.SERVER_REGISTERING: None,
485
485
if state in bad_states:
486
486
if bad_states[state] is not None:
487
487
if error is None:
488
log.error(bad_states[state])
488
logger.error(bad_states[state])
489
489
else:
490
log.error(bad_states[state] + ": %r", error)
490
logger.error(bad_states[state] + ": %r", error)
491
491
self.cleanup()
492
492
elif state == avahi.SERVER_RUNNING:
493
493
try:
495
495
except dbus.exceptions.DBusException as error:
496
496
if (error.get_dbus_name()
497
497
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
498
logger.info("Local Zeroconf service name"
499
" collision.")
499
500
return self.rename(remove=False)
500
501
else:
501
log.critical("D-Bus Exception", exc_info=error)
502
logger.critical("D-Bus Exception", exc_info=error)
502
503
self.cleanup()
503
504
os._exit(1)
504
505
else:
505
506
if error is None:
506
log.debug("Unknown state: %r", state)
507
logger.debug("Unknown state: %r", state)
507
508
else:
508
log.debug("Unknown state: %r: %r", state, error)
509
logger.debug("Unknown state: %r: %r", state, error)
509
510
510
511
def activate(self):
511
512
"""Derived from the Avahi example code"""
523
524
class AvahiServiceToSyslog(AvahiService):
524
525
def rename(self, *args, **kwargs):
525
526
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
527
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
528
528
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
529
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
530
.format(self.name)))
531
531
return ret
532
532
562
562
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
563
564
564
# Types
565
class _session_int(ctypes.Structure):
565
class session_int(ctypes.Structure):
566
566
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
567
session_t = ctypes.POINTER(session_int)
568
568
569
569
class certificate_credentials_st(ctypes.Structure):
570
570
_fields_ = []
573
573
certificate_type_t = ctypes.c_int
574
574
575
575
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
576
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
577
('size', ctypes.c_uint)]
578
578
579
class _openpgp_crt_int(ctypes.Structure):
579
class openpgp_crt_int(ctypes.Structure):
580
580
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
581
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
582
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
583
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
584
credentials_type_t = ctypes.c_int
593
593
# gnutls.strerror()
594
594
self.code = code
595
595
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
596
message = gnutls.strerror(code)
598
597
return super(gnutls.Error, self).__init__(
599
598
message, *args)
600
599
601
600
class CertificateSecurityError(Error):
602
601
pass
603
602
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
603
# Classes
630
class Credentials(With_from_param):
604
class Credentials:
631
605
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
606
self._c_object = gnutls.certificate_credentials_t()
607
gnutls.certificate_allocate_credentials(
608
ctypes.byref(self._c_object))
634
609
self.type = gnutls.CRD_CERTIFICATE
635
610
636
611
def __del__(self):
637
gnutls.certificate_free_credentials(self)
612
gnutls.certificate_free_credentials(self._c_object)
638
613
639
class ClientSession(With_from_param):
614
class ClientSession:
640
615
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
616
self._c_object = gnutls.session_t()
642
617
gnutls_flags = gnutls.CLIENT
643
618
if gnutls.check_version(b"3.5.6"):
644
619
gnutls_flags |= gnutls.NO_TICKETS
645
620
if gnutls.has_rawpk:
646
621
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
622
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
648
623
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
624
gnutls.set_default_priority(self._c_object)
625
gnutls.transport_set_ptr(self._c_object, socket.fileno())
626
gnutls.handshake_set_private_extensions(self._c_object,
627
True)
652
628
self.socket = socket
653
629
if credentials is None:
654
630
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
631
gnutls.credentials_set(self._c_object, credentials.type,
632
ctypes.cast(credentials._c_object,
633
ctypes.c_void_p))
657
634
self.credentials = credentials
658
635
659
636
def __del__(self):
660
gnutls.deinit(self)
637
gnutls.deinit(self._c_object)
661
638
662
639
def handshake(self):
663
return gnutls.handshake(self)
640
return gnutls.handshake(self._c_object)
664
641
665
642
def send(self, data):
666
643
data = bytes(data)
667
644
data_len = len(data)
668
645
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
646
data_len -= gnutls.record_send(self._c_object,
647
data[-data_len:],
670
648
data_len)
671
649
672
650
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
651
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
652
675
653
# Error handling functions
676
654
def _error_code(result):
677
655
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
656
for the 'restype' attribute on ctypes functions"""
657
if result >= 0:
680
658
return result
681
659
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
660
raise gnutls.CertificateSecurityError(code=result)
683
661
raise gnutls.Error(code=result)
684
662
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
663
def _retry_on_error(result, func, arguments):
687
664
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
665
for the 'errcheck' attribute on ctypes functions"""
666
while result < 0:
690
667
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
668
return _error_code(result)
692
669
result = func(*arguments)
697
674
698
675
# Functions
699
676
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
677
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
678
ctypes.POINTER(ctypes.c_char_p)]
702
679
priority_set_direct.restype = _error_code
703
680
704
681
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
682
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
683
init.restype = _error_code
707
684
708
685
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
686
set_default_priority.argtypes = [session_t]
710
687
set_default_priority.restype = _error_code
711
688
712
689
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
690
record_send.argtypes = [session_t, ctypes.c_void_p,
714
691
ctypes.c_size_t]
715
692
record_send.restype = ctypes.c_ssize_t
716
693
record_send.errcheck = _retry_on_error
718
695
certificate_allocate_credentials = (
719
696
_library.gnutls_certificate_allocate_credentials)
720
697
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
698
ctypes.POINTER(certificate_credentials_t)]
722
699
certificate_allocate_credentials.restype = _error_code
723
700
724
701
certificate_free_credentials = (
725
702
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
703
certificate_free_credentials.argtypes = [
704
certificate_credentials_t]
727
705
certificate_free_credentials.restype = None
728
706
729
707
handshake_set_private_extensions = (
730
708
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
709
handshake_set_private_extensions.argtypes = [session_t,
732
710
ctypes.c_int]
733
711
handshake_set_private_extensions.restype = None
734
712
735
713
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
714
credentials_set.argtypes = [session_t, credentials_type_t,
715
ctypes.c_void_p]
738
716
credentials_set.restype = _error_code
739
717
740
718
strerror = _library.gnutls_strerror
742
720
strerror.restype = ctypes.c_char_p
743
721
744
722
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
723
certificate_type_get.argtypes = [session_t]
746
724
certificate_type_get.restype = _error_code
747
725
748
726
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
727
certificate_get_peers.argtypes = [session_t,
750
728
ctypes.POINTER(ctypes.c_uint)]
751
729
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
730
759
737
global_set_log_function.restype = None
760
738
761
739
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
740
deinit.argtypes = [session_t]
763
741
deinit.restype = None
764
742
765
743
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
744
handshake.argtypes = [session_t]
745
handshake.restype = _error_code
768
746
handshake.errcheck = _retry_on_error
769
747
770
748
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
749
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
750
transport_set_ptr.restype = None
773
751
774
752
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
753
bye.argtypes = [session_t, close_request_t]
754
bye.restype = _error_code
777
755
bye.errcheck = _retry_on_error
778
756
779
757
check_version = _library.gnutls_check_version
796
774
797
775
x509_crt_fmt_t = ctypes.c_int
798
776
799
# All the function declarations below are from
800
# gnutls/abstract.h
777
# All the function declarations below are from gnutls/abstract.h
801
778
pubkey_init = _library.gnutls_pubkey_init
802
779
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
780
pubkey_init.restype = _error_code
817
794
pubkey_deinit.argtypes = [pubkey_t]
818
795
pubkey_deinit.restype = None
819
796
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
797
# All the function declarations below are from gnutls/openpgp.h
822
798
823
799
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
800
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
830
806
openpgp_crt_fmt_t]
831
807
openpgp_crt_import.restype = _error_code
832
808
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
809
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
810
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
811
ctypes.POINTER(ctypes.c_uint)]
840
812
openpgp_crt_verify_self.restype = _error_code
841
813
842
814
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
853
825
854
826
if check_version(b"3.6.4"):
855
827
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
828
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
857
829
certificate_type_get2.restype = _error_code
858
830
859
831
# Remove non-public functions
875
847
"""A representation of a client host served by this server.
876
848
877
849
Attributes:
878
approved: bool(); None if not yet approved/disapproved
850
approved: bool(); 'None' if not yet approved/disapproved
879
851
approval_delay: datetime.timedelta(); Time to wait for approval
880
852
approval_duration: datetime.timedelta(); Duration of one approval
881
853
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
854
to see if the client lives. 'None' if no process is
883
855
running.
884
856
checker_callback_tag: a GLib event source tag, or None
885
857
checker_command: string; External command which is run to check
961
933
# key_id() and fingerprint() functions
962
934
client["key_id"] = (section.get("key_id", "").upper()
963
935
.replace(" ", ""))
964
client["fingerprint"] = (section.get("fingerprint",
965
"").upper()
936
client["fingerprint"] = (section["fingerprint"].upper()
966
937
.replace(" ", ""))
967
if not (client["key_id"] or client["fingerprint"]):
968
log.error("Skipping client %s without key_id or"
969
" fingerprint", client_name)
970
del settings[client_name]
971
continue
972
938
if "secret" in section:
973
939
client["secret"] = codecs.decode(section["secret"]
974
940
.encode("utf-8"),
1015
981
self.last_enabled = None
1016
982
self.expires = None
1017
983
1018
log.debug("Creating client %r", self.name)
1019
log.debug(" Key ID: %s", self.key_id)
1020
log.debug(" Fingerprint: %s", self.fingerprint)
984
logger.debug("Creating client %r", self.name)
985
logger.debug(" Key ID: %s", self.key_id)
986
logger.debug(" Fingerprint: %s", self.fingerprint)
1021
987
self.created = settings.get("created",
1022
988
datetime.datetime.utcnow())
1023
989
1051
1017
if getattr(self, "enabled", False):
1052
1018
# Already enabled
1053
1019
return
1020
self.expires = datetime.datetime.utcnow() + self.timeout
1054
1021
self.enabled = True
1055
1022
self.last_enabled = datetime.datetime.utcnow()
1056
1023
self.init_checker()
1061
1028
if not getattr(self, "enabled", False):
1062
1029
return False
1063
1030
if not quiet:
1064
log.info("Disabling client %s", self.name)
1031
logger.info("Disabling client %s", self.name)
1065
1032
if getattr(self, "disable_initiator_tag", None) is not None:
1066
1033
GLib.source_remove(self.disable_initiator_tag)
1067
1034
self.disable_initiator_tag = None
1079
1046
def __del__(self):
1080
1047
self.disable()
1081
1048
1082
def init_checker(self, randomize_start=False):
1083
# Schedule a new checker to be started a randomly selected
1084
# time (a fraction of 'interval') from now. This spreads out
1085
# the startup of checkers over time when the server is
1086
# started.
1049
def init_checker(self):
1050
# Schedule a new checker to be started an 'interval' from now,
1051
# and every interval from then on.
1087
1052
if self.checker_initiator_tag is not None:
1088
1053
GLib.source_remove(self.checker_initiator_tag)
1089
interval_milliseconds = int(self.interval.total_seconds()
1090
* 1000)
1091
if randomize_start:
1092
delay_milliseconds = random.randrange(
1093
interval_milliseconds + 1)
1094
else:
1095
delay_milliseconds = interval_milliseconds
1096
1054
self.checker_initiator_tag = GLib.timeout_add(
1097
delay_milliseconds, self.start_checker, randomize_start)
1098
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1099
# A checker might take up to an 'interval' of time, so we can
1100
# expire at the soonest one interval after a checker was
1101
# started. Since the initial checker is delayed, the expire
1102
# time might have to be extended.
1103
now = datetime.datetime.utcnow()
1104
self.expires = now + delay + self.interval
1105
# Schedule a disable() at expire time
1055
random.randrange(int(self.interval.total_seconds() * 1000
1056
+ 1)),
1057
self.start_checker)
1058
# Schedule a disable() when 'timeout' has passed
1106
1059
if self.disable_initiator_tag is not None:
1107
1060
GLib.source_remove(self.disable_initiator_tag)
1108
1061
self.disable_initiator_tag = GLib.timeout_add(
1109
int((self.expires - now).total_seconds() * 1000),
1110
self.disable)
1062
int(self.timeout.total_seconds() * 1000), self.disable)
1063
# Also start a new checker *right now*.
1064
self.start_checker()
1111
1065
1112
1066
def checker_callback(self, source, condition, connection,
1113
1067
command):
1124
1078
self.last_checker_status = returncode
1125
1079
self.last_checker_signal = None
1126
1080
if self.last_checker_status == 0:
1127
log.info("Checker for %(name)s succeeded", vars(self))
1081
logger.info("Checker for %(name)s succeeded",
1082
vars(self))
1128
1083
self.checked_ok()
1129
1084
else:
1130
log.info("Checker for %(name)s failed", vars(self))
1085
logger.info("Checker for %(name)s failed", vars(self))
1131
1086
else:
1132
1087
self.last_checker_status = -1
1133
1088
self.last_checker_signal = -returncode
1134
log.warning("Checker for %(name)s crashed?", vars(self))
1089
logger.warning("Checker for %(name)s crashed?",
1090
vars(self))
1135
1091
return False
1136
1092
1137
1093
def checked_ok(self):
1156
1112
def need_approval(self):
1157
1113
self.last_approval_request = datetime.datetime.utcnow()
1158
1114
1159
def start_checker(self, start_was_randomized=False):
1115
def start_checker(self):
1160
1116
"""Start a new checker subprocess if one is not running.
1161
1117
1162
1118
If a checker already exists, leave it running and do
1171
1127
# should be.
1172
1128
1173
1129
if self.checker is not None and not self.checker.is_alive():
1174
log.warning("Checker was not alive; joining")
1130
logger.warning("Checker was not alive; joining")
1175
1131
self.checker.join()
1176
1132
self.checker = None
1177
1133
# Start a new checker if needed
1183
1139
try:
1184
1140
command = self.checker_command % escaped_attrs
1185
1141
except TypeError as error:
1186
log.error('Could not format string "%s"',
1187
self.checker_command, exc_info=error)
1142
logger.error('Could not format string "%s"',
1143
self.checker_command,
1144
exc_info=error)
1188
1145
return True # Try again later
1189
1146
self.current_checker_command = command
1190
log.info("Starting checker %r for %s", command, self.name)
1147
logger.info("Starting checker %r for %s", command,
1148
self.name)
1191
1149
# We don't need to redirect stdout and stderr, since
1192
1150
# in normal mode, that is already done by daemon(),
1193
1151
# and in debug mode we don't want to. (Stdin is
1212
1170
GLib.IOChannel.unix_new(pipe[0].fileno()),
1213
1171
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1214
1172
self.checker_callback, pipe[0], command)
1215
if start_was_randomized:
1216
# We were started after a random delay; Schedule a new
1217
# checker to be started an 'interval' from now, and every
1218
# interval from then on.
1219
now = datetime.datetime.utcnow()
1220
self.checker_initiator_tag = GLib.timeout_add(
1221
int(self.interval.total_seconds() * 1000),
1222
self.start_checker)
1223
self.expires = max(self.expires, now + self.interval)
1224
# Don't start a new checker again after same random delay
1225
return False
1226
1173
# Re-run this periodically if run by GLib.timeout_add
1227
1174
return True
1228
1175
1233
1180
self.checker_callback_tag = None
1234
1181
if getattr(self, "checker", None) is None:
1235
1182
return
1236
log.debug("Stopping checker for %(name)s", vars(self))
1183
logger.debug("Stopping checker for %(name)s", vars(self))
1237
1184
self.checker.terminate()
1238
1185
self.checker = None
1239
1186
1266
1213
func._dbus_name = func.__name__
1267
1214
if func._dbus_name.endswith("_dbus_property"):
1268
1215
func._dbus_name = func._dbus_name[:-14]
1269
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1216
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1270
1217
return func
1271
1218
1272
1219
return decorator
1361
1308
1362
1309
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1363
1310
out_signature="s",
1364
path_keyword="object_path",
1365
connection_keyword="connection")
1311
path_keyword='object_path',
1312
connection_keyword='connection')
1366
1313
def Introspect(self, object_path, connection):
1367
1314
"""Overloading of standard D-Bus method.
1368
1315
1417
1364
document.unlink()
1418
1365
except (AttributeError, xml.dom.DOMException,
1419
1366
xml.parsers.expat.ExpatError) as error:
1420
log.error("Failed to override Introspection method",
1421
exc_info=error)
1367
logger.error("Failed to override Introspection method",
1368
exc_info=error)
1422
1369
return xmlstring
1423
1370
1424
1371
1521
1468
1522
1469
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1523
1470
out_signature="s",
1524
path_keyword="object_path",
1525
connection_keyword="connection")
1471
path_keyword='object_path',
1472
connection_keyword='connection')
1526
1473
def Introspect(self, object_path, connection):
1527
1474
"""Overloading of standard D-Bus method.
1528
1475
1584
1531
document.unlink()
1585
1532
except (AttributeError, xml.dom.DOMException,
1586
1533
xml.parsers.expat.ExpatError) as error:
1587
log.error("Failed to override Introspection method",
1588
exc_info=error)
1534
logger.error("Failed to override Introspection method",
1535
exc_info=error)
1589
1536
return xmlstring
1590
1537
1591
1538
1623
1570
1624
1571
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1625
1572
out_signature="s",
1626
path_keyword="object_path",
1627
connection_keyword="connection")
1573
path_keyword='object_path',
1574
connection_keyword='connection')
1628
1575
def Introspect(self, object_path, connection):
1629
1576
"""Overloading of standard D-Bus method.
1630
1577
1655
1602
document.unlink()
1656
1603
except (AttributeError, xml.dom.DOMException,
1657
1604
xml.parsers.expat.ExpatError) as error:
1658
log.error("Failed to override Introspection method",
1659
exc_info=error)
1605
logger.error("Failed to override Introspection method",
1606
exc_info=error)
1660
1607
return xmlstring
1661
1608
1662
1609
2296
2243
class ProxyClient:
2297
2244
def __init__(self, child_pipe, key_id, fpr, address):
2298
2245
self._pipe = child_pipe
2299
self._pipe.send(("init", key_id, fpr, address))
2246
self._pipe.send(('init', key_id, fpr, address))
2300
2247
if not self._pipe.recv():
2301
2248
raise KeyError(key_id or fpr)
2302
2249
2303
2250
def __getattribute__(self, name):
2304
if name == "_pipe":
2251
if name == '_pipe':
2305
2252
return super(ProxyClient, self).__getattribute__(name)
2306
self._pipe.send(("getattr", name))
2253
self._pipe.send(('getattr', name))
2307
2254
data = self._pipe.recv()
2308
if data[0] == "data":
2255
if data[0] == 'data':
2309
2256
return data[1]
2310
if data[0] == "function":
2257
if data[0] == 'function':
2311
2258
2312
2259
def func(*args, **kwargs):
2313
self._pipe.send(("funcall", name, args, kwargs))
2260
self._pipe.send(('funcall', name, args, kwargs))
2314
2261
return self._pipe.recv()[1]
2315
2262
2316
2263
return func
2317
2264
2318
2265
def __setattr__(self, name, value):
2319
if name == "_pipe":
2266
if name == '_pipe':
2320
2267
return super(ProxyClient, self).__setattr__(name, value)
2321
self._pipe.send(("setattr", name, value))
2268
self._pipe.send(('setattr', name, value))
2322
2269
2323
2270
2324
2271
class ClientHandler(socketserver.BaseRequestHandler, object):
2329
2276
2330
2277
def handle(self):
2331
2278
with contextlib.closing(self.server.child_pipe) as child_pipe:
2332
log.info("TCP connection from: %s",
2333
str(self.client_address))
2334
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2279
logger.info("TCP connection from: %s",
2280
str(self.client_address))
2281
logger.debug("Pipe FD: %d",
2282
self.server.child_pipe.fileno())
2335
2283
2336
2284
session = gnutls.ClientSession(self.request)
2337
2285
2338
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2286
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2339
2287
# "+AES-256-CBC", "+SHA1",
2340
2288
# "+COMP-NULL", "+CTYPE-OPENPGP",
2341
2289
# "+DHE-DSS"))
2343
2291
priority = self.server.gnutls_priority
2344
2292
if priority is None:
2345
2293
priority = "NORMAL"
2346
gnutls.priority_set_direct(session,
2347
priority.encode("utf-8"), None)
2294
gnutls.priority_set_direct(session._c_object,
2295
priority.encode("utf-8"),
2296
None)
2348
2297
2349
2298
# Start communication using the Mandos protocol
2350
2299
# Get protocol number
2351
2300
line = self.request.makefile().readline()
2352
log.debug("Protocol version: %r", line)
2301
logger.debug("Protocol version: %r", line)
2353
2302
try:
2354
2303
if int(line.strip().split()[0]) > 1:
2355
2304
raise RuntimeError(line)
2356
2305
except (ValueError, IndexError, RuntimeError) as error:
2357
log.error("Unknown protocol version: %s", error)
2306
logger.error("Unknown protocol version: %s", error)
2358
2307
return
2359
2308
2360
2309
# Start GnuTLS connection
2361
2310
try:
2362
2311
session.handshake()
2363
2312
except gnutls.Error as error:
2364
log.warning("Handshake failed: %s", error)
2313
logger.warning("Handshake failed: %s", error)
2365
2314
# Do not run session.bye() here: the session is not
2366
2315
# established. Just abandon the request.
2367
2316
return
2368
log.debug("Handshake succeeded")
2317
logger.debug("Handshake succeeded")
2369
2318
2370
2319
approval_required = False
2371
2320
try:
2375
2324
key_id = self.key_id(
2376
2325
self.peer_certificate(session))
2377
2326
except (TypeError, gnutls.Error) as error:
2378
log.warning("Bad certificate: %s", error)
2327
logger.warning("Bad certificate: %s", error)
2379
2328
return
2380
log.debug("Key ID: %s",
2381
key_id.decode("utf-8",
2382
errors="replace"))
2329
logger.debug("Key ID: %s", key_id)
2383
2330
2384
2331
else:
2385
2332
key_id = b""
2387
2334
fpr = self.fingerprint(
2388
2335
self.peer_certificate(session))
2389
2336
except (TypeError, gnutls.Error) as error:
2390
log.warning("Bad certificate: %s", error)
2337
logger.warning("Bad certificate: %s", error)
2391
2338
return
2392
log.debug("Fingerprint: %s", fpr)
2339
logger.debug("Fingerprint: %s", fpr)
2393
2340
2394
2341
try:
2395
2342
client = ProxyClient(child_pipe, key_id, fpr,
2404
2351
2405
2352
while True:
2406
2353
if not client.enabled:
2407
log.info("Client %s is disabled", client.name)
2354
logger.info("Client %s is disabled",
2355
client.name)
2408
2356
if self.server.use_dbus:
2409
2357
# Emit D-Bus signal
2410
2358
client.Rejected("Disabled")
2414
2362
# We are approved or approval is disabled
2415
2363
break
2416
2364
elif client.approved is None:
2417
log.info("Client %s needs approval",
2418
client.name)
2365
logger.info("Client %s needs approval",
2366
client.name)
2419
2367
if self.server.use_dbus:
2420
2368
# Emit D-Bus signal
2421
2369
client.NeedApproval(
2422
2370
client.approval_delay.total_seconds()
2423
2371
* 1000, client.approved_by_default)
2424
2372
else:
2425
log.warning("Client %s was not approved",
2426
client.name)
2373
logger.warning("Client %s was not approved",
2374
client.name)
2427
2375
if self.server.use_dbus:
2428
2376
# Emit D-Bus signal
2429
2377
client.Rejected("Denied")
2437
2385
time2 = datetime.datetime.now()
2438
2386
if (time2 - time) >= delay:
2439
2387
if not client.approved_by_default:
2440
log.warning("Client %s timed out while"
2441
" waiting for approval",
2442
client.name)
2388
logger.warning("Client %s timed out while"
2389
" waiting for approval",
2390
client.name)
2443
2391
if self.server.use_dbus:
2444
2392
# Emit D-Bus signal
2445
2393
client.Rejected("Approval timed out")
2452
2400
try:
2453
2401
session.send(client.secret)
2454
2402
except gnutls.Error as error:
2455
log.warning("gnutls send failed", exc_info=error)
2403
logger.warning("gnutls send failed",
2404
exc_info=error)
2456
2405
return
2457
2406
2458
log.info("Sending secret to %s", client.name)
2407
logger.info("Sending secret to %s", client.name)
2459
2408
# bump the timeout using extended_timeout
2460
2409
client.bump_timeout(client.extended_timeout)
2461
2410
if self.server.use_dbus:
2468
2417
try:
2469
2418
session.bye()
2470
2419
except gnutls.Error as error:
2471
log.warning("GnuTLS bye failed", exc_info=error)
2420
logger.warning("GnuTLS bye failed",
2421
exc_info=error)
2472
2422
2473
2423
@staticmethod
2474
2424
def peer_certificate(session):
2475
2425
"Return the peer's certificate as a bytestring"
2476
2426
try:
2477
cert_type = gnutls.certificate_type_get2(
2478
session, gnutls.CTYPE_PEERS)
2427
cert_type = gnutls.certificate_type_get2(session._c_object,
2428
gnutls.CTYPE_PEERS)
2479
2429
except AttributeError:
2480
cert_type = gnutls.certificate_type_get(session)
2430
cert_type = gnutls.certificate_type_get(session._c_object)
2481
2431
if gnutls.has_rawpk:
2482
2432
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2483
2433
else:
2484
2434
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2485
2435
# If not a valid certificate type...
2486
2436
if cert_type not in valid_cert_types:
2487
log.info("Cert type %r not in %r", cert_type,
2488
valid_cert_types)
2437
logger.info("Cert type %r not in %r", cert_type,
2438
valid_cert_types)
2489
2439
# ...return invalid data
2490
2440
return b""
2491
2441
list_size = ctypes.c_uint(1)
2492
2442
cert_list = (gnutls.certificate_get_peers
2493
(session, ctypes.byref(list_size)))
2443
(session._c_object, ctypes.byref(list_size)))
2494
2444
if not bool(cert_list) and list_size.value != 0:
2495
2445
raise gnutls.Error("error getting peer certificate")
2496
2446
if list_size.value == 0:
2518
2468
buf = ctypes.create_string_buffer(32)
2519
2469
buf_len = ctypes.c_size_t(len(buf))
2520
2470
# Get the key ID from the raw public key into the buffer
2521
gnutls.pubkey_get_key_id(
2522
pubkey,
2523
gnutls.KEYID_USE_SHA256,
2524
ctypes.cast(ctypes.byref(buf),
2525
ctypes.POINTER(ctypes.c_ubyte)),
2526
ctypes.byref(buf_len))
2471
gnutls.pubkey_get_key_id(pubkey,
2472
gnutls.KEYID_USE_SHA256,
2473
ctypes.cast(ctypes.byref(buf),
2474
ctypes.POINTER(ctypes.c_ubyte)),
2475
ctypes.byref(buf_len))
2527
2476
# Deinit the certificate
2528
2477
gnutls.pubkey_deinit(pubkey)
2529
2478
2610
2559
2611
2560
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2612
2561
socketserver.TCPServer):
2613
"""IPv6-capable TCP server. Accepts None as address and/or port
2562
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2614
2563
2615
2564
Attributes:
2616
2565
enabled: Boolean; whether this server is activated yet
2667
2616
if SO_BINDTODEVICE is None:
2668
2617
# Fall back to a hard-coded value which seems to be
2669
2618
# common enough.
2670
log.warning("SO_BINDTODEVICE not found, trying 25")
2619
logger.warning("SO_BINDTODEVICE not found, trying 25")
2671
2620
SO_BINDTODEVICE = 25
2672
2621
try:
2673
2622
self.socket.setsockopt(
2675
2624
(self.interface + "\0").encode("utf-8"))
2676
2625
except socket.error as error:
2677
2626
if error.errno == errno.EPERM:
2678
log.error("No permission to bind to interface %s",
2679
self.interface)
2627
logger.error("No permission to bind to"
2628
" interface %s", self.interface)
2680
2629
elif error.errno == errno.ENOPROTOOPT:
2681
log.error("SO_BINDTODEVICE not available; cannot"
2682
" bind to interface %s", self.interface)
2630
logger.error("SO_BINDTODEVICE not available;"
2631
" cannot bind to interface %s",
2632
self.interface)
2683
2633
elif error.errno == errno.ENODEV:
2684
log.error("Interface %s does not exist, cannot"
2685
" bind", self.interface)
2634
logger.error("Interface %s does not exist,"
2635
" cannot bind", self.interface)
2686
2636
else:
2687
2637
raise
2688
2638
# Only bind(2) the socket if we really need to.
2767
2717
request = parent_pipe.recv()
2768
2718
command = request[0]
2769
2719
2770
if command == "init":
2720
if command == 'init':
2771
2721
key_id = request[1].decode("ascii")
2772
2722
fpr = request[2].decode("ascii")
2773
2723
address = request[3]
2774
2724
2775
2725
for c in self.clients.values():
2776
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2777
"27AE41E4649B934CA495991B7852B855"):
2726
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2778
2727
continue
2779
2728
if key_id and c.key_id == key_id:
2780
2729
client = c
2783
2732
client = c
2784
2733
break
2785
2734
else:
2786
log.info("Client not found for key ID: %s, address:"
2787
" %s", key_id or fpr, address)
2735
logger.info("Client not found for key ID: %s, address"
2736
": %s", key_id or fpr, address)
2788
2737
if self.use_dbus:
2789
2738
# Emit D-Bus signal
2790
2739
mandos_dbus_service.ClientNotFound(key_id or fpr,
2803
2752
# remove the old hook in favor of the new above hook on
2804
2753
# same fileno
2805
2754
return False
2806
if command == "funcall":
2755
if command == 'funcall':
2807
2756
funcname = request[1]
2808
2757
args = request[2]
2809
2758
kwargs = request[3]
2810
2759
2811
parent_pipe.send(("data", getattr(client_object,
2760
parent_pipe.send(('data', getattr(client_object,
2812
2761
funcname)(*args,
2813
2762
**kwargs)))
2814
2763
2815
if command == "getattr":
2764
if command == 'getattr':
2816
2765
attrname = request[1]
2817
2766
if isinstance(client_object.__getattribute__(attrname),
2818
2767
collections.abc.Callable):
2819
parent_pipe.send(("function", ))
2768
parent_pipe.send(('function', ))
2820
2769
else:
2821
2770
parent_pipe.send((
2822
"data", client_object.__getattribute__(attrname)))
2771
'data', client_object.__getattribute__(attrname)))
2823
2772
2824
if command == "setattr":
2773
if command == 'setattr':
2825
2774
attrname = request[1]
2826
2775
value = request[2]
2827
2776
setattr(client_object, attrname, value)
2832
2781
def rfc3339_duration_to_delta(duration):
2833
2782
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2834
2783
2835
>>> timedelta = datetime.timedelta
2836
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2837
True
2838
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2839
True
2840
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2841
True
2842
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2843
True
2844
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2845
True
2846
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2847
True
2848
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2849
True
2850
>>> del timedelta
2784
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2785
True
2786
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2787
True
2788
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2789
True
2790
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2791
True
2792
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2793
True
2794
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2795
True
2796
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2797
True
2851
2798
"""
2852
2799
2853
2800
# Parsing an RFC 3339 duration with regular expressions is not
2933
2880
def string_to_delta(interval):
2934
2881
"""Parse a string and return a datetime.timedelta
2935
2882
2936
>>> string_to_delta("7d") == datetime.timedelta(7)
2937
True
2938
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2939
True
2940
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2941
True
2942
>>> string_to_delta("24h") == datetime.timedelta(1)
2943
True
2944
>>> string_to_delta("1w") == datetime.timedelta(7)
2945
True
2946
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2883
>>> string_to_delta('7d') == datetime.timedelta(7)
2884
True
2885
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2886
True
2887
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2888
True
2889
>>> string_to_delta('24h') == datetime.timedelta(1)
2890
True
2891
>>> string_to_delta('1w') == datetime.timedelta(7)
2892
True
2893
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2947
2894
True
2948
2895
"""
2949
2896
3153
3100
3154
3101
if server_settings["servicename"] != "Mandos":
3155
3102
syslogger.setFormatter(
3156
logging.Formatter("Mandos ({}) [%(process)d]:"
3157
" %(levelname)s: %(message)s".format(
3103
logging.Formatter('Mandos ({}) [%(process)d]:'
3104
' %(levelname)s: %(message)s'.format(
3158
3105
server_settings["servicename"])))
3159
3106
3160
3107
# Parse config file with clients
3184
3131
try:
3185
3132
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3186
3133
except IOError as e:
3187
log.error("Could not open file %r", pidfilename,
3188
exc_info=e)
3134
logger.error("Could not open file %r", pidfilename,
3135
exc_info=e)
3189
3136
3190
3137
for name, group in (("_mandos", "_mandos"),
3191
3138
("mandos", "mandos"),
3202
3149
try:
3203
3150
os.setgid(gid)
3204
3151
os.setuid(uid)
3205
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3152
if debug:
3153
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3154
gid))
3206
3155
except OSError as error:
3207
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3208
os.strerror(error.errno))
3156
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3157
.format(uid, gid, os.strerror(error.errno)))
3209
3158
if error.errno != errno.EPERM:
3210
3159
raise
3211
3160
3218
3167
3219
3168
@gnutls.log_func
3220
3169
def debug_gnutls(level, string):
3221
log.debug("GnuTLS: %s",
3222
string[:-1].decode("utf-8", errors="replace"))
3170
logger.debug("GnuTLS: %s", string[:-1])
3223
3171
3224
3172
gnutls.global_set_log_function(debug_gnutls)
3225
3173
3254
3202
"se.bsnet.fukt.Mandos", bus,
3255
3203
do_not_queue=True)
3256
3204
except dbus.exceptions.DBusException as e:
3257
log.error("Disabling D-Bus:", exc_info=e)
3205
logger.error("Disabling D-Bus:", exc_info=e)
3258
3206
use_dbus = False
3259
3207
server_settings["use_dbus"] = False
3260
3208
tcp_server.use_dbus = False
3345
3293
os.remove(stored_state_path)
3346
3294
except IOError as e:
3347
3295
if e.errno == errno.ENOENT:
3348
log.warning("Could not load persistent state:"
3349
" %s", os.strerror(e.errno))
3296
logger.warning("Could not load persistent state:"
3297
" {}".format(os.strerror(e.errno)))
3350
3298
else:
3351
log.critical("Could not load persistent state:",
3352
exc_info=e)
3299
logger.critical("Could not load persistent state:",
3300
exc_info=e)
3353
3301
raise
3354
3302
except EOFError as e:
3355
log.warning("Could not load persistent state: EOFError:",
3356
exc_info=e)
3303
logger.warning("Could not load persistent state: "
3304
"EOFError:",
3305
exc_info=e)
3357
3306
3358
3307
with PGPEngine() as pgp:
3359
3308
for client_name, client in clients_data.items():
3386
3335
if client["enabled"]:
3387
3336
if datetime.datetime.utcnow() >= client["expires"]:
3388
3337
if not client["last_checked_ok"]:
3389
log.warning("disabling client %s - Client"
3390
" never performed a successful"
3391
" checker", client_name)
3338
logger.warning(
3339
"disabling client {} - Client never "
3340
"performed a successful checker".format(
3341
client_name))
3392
3342
client["enabled"] = False
3393
3343
elif client["last_checker_status"] != 0:
3394
log.warning("disabling client %s - Client"
3395
" last checker failed with error"
3396
" code %s", client_name,
3397
client["last_checker_status"])
3344
logger.warning(
3345
"disabling client {} - Client last"
3346
" checker failed with error code"
3347
" {}".format(
3348
client_name,
3349
client["last_checker_status"]))
3398
3350
client["enabled"] = False
3399
3351
else:
3400
3352
client["expires"] = (
3401
3353
datetime.datetime.utcnow()
3402
3354
+ client["timeout"])
3403
log.debug("Last checker succeeded, keeping %s"
3404
" enabled", client_name)
3355
logger.debug("Last checker succeeded,"
3356
" keeping {} enabled".format(
3357
client_name))
3405
3358
try:
3406
3359
client["secret"] = pgp.decrypt(
3407
3360
client["encrypted_secret"],
3408
3361
client_settings[client_name]["secret"])
3409
3362
except PGPError:
3410
3363
# If decryption fails, we use secret from new settings
3411
log.debug("Failed to decrypt %s old secret",
3412
client_name)
3364
logger.debug("Failed to decrypt {} old secret".format(
3365
client_name))
3413
3366
client["secret"] = (client_settings[client_name]
3414
3367
["secret"])
3415
3368
3429
3382
server_settings=server_settings)
3430
3383
3431
3384
if not tcp_server.clients:
3432
log.warning("No clients defined")
3385
logger.warning("No clients defined")
3433
3386
3434
3387
if not foreground:
3435
3388
if pidfile is not None:
3438
3391
with pidfile:
3439
3392
print(pid, file=pidfile)
3440
3393
except IOError:
3441
log.error("Could not write to file %r with PID %d",
3442
pidfilename, pid)
3394
logger.error("Could not write to file %r with PID %d",
3395
pidfilename, pid)
3443
3396
del pidfile
3444
3397
del pidfilename
3445
3398
3595
3548
3596
3549
try:
3597
3550
with tempfile.NamedTemporaryFile(
3598
mode="wb",
3551
mode='wb',
3599
3552
suffix=".pickle",
3600
prefix="clients-",
3553
prefix='clients-',
3601
3554
dir=os.path.dirname(stored_state_path),
3602
3555
delete=False) as stored_state:
3603
3556
pickle.dump((clients, client_settings), stored_state,
3611
3564
except NameError:
3612
3565
pass
3613
3566
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3614
log.warning("Could not save persistent state: %s",
3615
os.strerror(e.errno))
3567
logger.warning("Could not save persistent state: {}"
3568
.format(os.strerror(e.errno)))
3616
3569
else:
3617
log.warning("Could not save persistent state:",
3618
exc_info=e)
3570
logger.warning("Could not save persistent state:",
3571
exc_info=e)
3619
3572
raise
3620
3573
3621
3574
# Delete all clients, and settings from config
3638
3591
mandos_dbus_service.client_added_signal(client)
3639
3592
# Need to initiate checking of clients
3640
3593
if client.enabled:
3641
client.init_checker(randomize_start=True)
3594
client.init_checker()
3642
3595
3643
3596
tcp_server.enable()
3644
3597
tcp_server.server_activate()
3647
3600
if zeroconf:
3648
3601
service.port = tcp_server.socket.getsockname()[1]
3649
3602
if use_ipv6:
3650
log.info("Now listening on address %r, port %d, flowinfo %d,"
3651
" scope_id %d", *tcp_server.socket.getsockname())
3603
logger.info("Now listening on address %r, port %d,"
3604
" flowinfo %d, scope_id %d",
3605
*tcp_server.socket.getsockname())
3652
3606
else: # IPv4
3653
log.info("Now listening on address %r, port %d",
3654
*tcp_server.socket.getsockname())
3607
logger.info("Now listening on address %r, port %d",
3608
*tcp_server.socket.getsockname())
3655
3609
3656
3610
# service.interface = tcp_server.socket.getsockname()[3]
3657
3611
3661
3615
try:
3662
3616
service.activate()
3663
3617
except dbus.exceptions.DBusException as error:
3664
log.critical("D-Bus Exception", exc_info=error)
3618
logger.critical("D-Bus Exception", exc_info=error)
3665
3619
cleanup()
3666
3620
sys.exit(1)
3667
3621
# End of Avahi example code
3672
3626
lambda *args, **kwargs: (tcp_server.handle_request
3673
3627
(*args[2:], **kwargs) or True))
3674
3628
3675
log.debug("Starting main loop")
3629
logger.debug("Starting main loop")
3676
3630
main_loop.run()
3677
3631
except AvahiError as error:
3678
log.critical("Avahi Error", exc_info=error)
3632
logger.critical("Avahi Error", exc_info=error)
3679
3633
cleanup()
3680
3634
sys.exit(1)
3681
3635
except KeyboardInterrupt:
3682
3636
if debug:
3683
3637
print("", file=sys.stderr)
3684
log.debug("Server received KeyboardInterrupt")
3685
log.debug("Server exiting")
3638
logger.debug("Server received KeyboardInterrupt")
3639
logger.debug("Server exiting")
3686
3640
# Must run before the D-Bus bus name gets deregistered
3687
3641
cleanup()
3688
3642
3689
3643
3690
def parse_test_args():
3691
# type: () -> argparse.Namespace
3644
def should_only_run_tests():
3692
3645
parser = argparse.ArgumentParser(add_help=False)
3693
parser.add_argument("--check", action="store_true")
3694
parser.add_argument("--prefix", )
3646
parser.add_argument("--check", action='store_true')
3695
3647
args, unknown_args = parser.parse_known_args()
3696
if args.check:
3697
# Remove test options from sys.argv
3648
run_tests = args.check
3649
if run_tests:
3650
# Remove --check argument from sys.argv
3698
3651
sys.argv[1:] = unknown_args
3699
return args
3652
return run_tests
3700
3653
3701
3654
# Add all tests from doctest strings
3702
3655
def load_tests(loader, tests, none):
3704
3657
tests.addTests(doctest.DocTestSuite())
3705
3658
return tests
3706
3659
3707
if __name__ == "__main__":
3708
options = parse_test_args()
3660
if __name__ == '__main__':
3709
3661
try:
3710
if options.check:
3711
extra_test_prefix = options.prefix
3712
if extra_test_prefix is not None:
3713
if not (unittest.main(argv=[""], exit=False)
3714
.result.wasSuccessful()):
3715
sys.exit(1)
3716
class ExtraTestLoader(unittest.TestLoader):
3717
testMethodPrefix = extra_test_prefix
3718
# Call using ./scriptname --test [--verbose]
3719
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3720
else:
3721
unittest.main(argv=[""])
3662
if should_only_run_tests():
3663
# Call using ./mandos --check [--verbose]
3664
unittest.main()
3722
3665
else:
3723
3666
main()
3724
3667
finally:
3725
3668
logging.shutdown()
3726
3727
# Local Variables:
3728
# run-tests:
3729
# (lambda (&optional extra)
3730
# (if (not (funcall run-tests-in-test-buffer default-directory
3731
# extra))
3732
# (funcall show-test-buffer-in-test-window)
3733
# (funcall remove-test-window)
3734
# (if extra (message "Extra tests run successfully!"))))
3735
# run-tests-in-test-buffer:
3736
# (lambda (dir &optional extra)
3737
# (with-current-buffer (get-buffer-create "*Test*")
3738
# (setq buffer-read-only nil
3739
# default-directory dir)
3740
# (erase-buffer)
3741
# (compilation-mode))
3742
# (let ((process-result
3743
# (let ((inhibit-read-only t))
3744
# (process-file-shell-command
3745
# (funcall get-command-line extra) nil "*Test*"))))
3746
# (and (numberp process-result)
3747
# (= process-result 0))))
3748
# get-command-line:
3749
# (lambda (&optional extra)
3750
# (let ((quoted-script
3751
# (shell-quote-argument (funcall get-script-name))))
3752
# (format
3753
# (concat "%s --check" (if extra " --prefix=atest" ""))
3754
# quoted-script)))
3755
# get-script-name:
3756
# (lambda ()
3757
# (if (fboundp 'file-local-name)
3758
# (file-local-name (buffer-file-name))
3759
# (or (file-remote-p (buffer-file-name) 'localname)
3760
# (buffer-file-name))))
3761
# remove-test-window:
3762
# (lambda ()
3763
# (let ((test-window (get-buffer-window "*Test*")))
3764
# (if test-window (delete-window test-window))))
3765
# show-test-buffer-in-test-window:
3766
# (lambda ()
3767
# (when (not (get-buffer-window-list "*Test*"))
3768
# (setq next-error-last-buffer (get-buffer "*Test*"))
3769
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3770
# (display-buffer-overriding-action
3771
# `((display-buffer-in-side-window) (side . ,side)
3772
# (window-height . fit-window-to-buffer)
3773
# (window-width . fit-window-to-buffer))))
3774
# (display-buffer "*Test*"))))
3775
# eval:
3776
# (progn
3777
# (let* ((run-extra-tests (lambda () (interactive)
3778
# (funcall run-tests t)))
3779
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3780
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3781
# (setq minor-mode-overriding-map-alist
3782
# (cons `(run-tests . ,outer-keymap)
3783
# minor-mode-overriding-map-alist)))
3784
# (add-hook 'after-save-hook run-tests 90 t))
3785
# End:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0