To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1218
- compare with another revision
- download diff
- download tarball
- view history from revision 1218
- Committer: teddy at recompile
- Date: 2020-07-04 11:58:52 UTC
- Revision ID: teddy@recompile.se-20200704115852-oquhnmng3zom4ldl
Update copyright year
* DBUS-API: Update copyright year to 2020
* debian/copyright: - '' -
* dracut-module/ask-password-mandos.service: - '' -
* dracut-module/password-agent.c: - '' -
* mandos: - '' -
* mandos-ctl: - '' -
* plugin-runner.c: - '' -
* plugins.d/mandos-client.c: - '' -
* plugins.d/plymouth.c: - '' -
* mandos-to-cryptroot-unlock: Update copyright year to 2019.
* DBUS-API: Update copyright year to 2020
* debian/copyright: - '' -
* dracut-module/ask-password-mandos.service: - '' -
* dracut-module/password-agent.c: - '' -
* mandos: - '' -
* mandos-ctl: - '' -
* plugin-runner.c: - '' -
* plugins.d/mandos-client.c: - '' -
* plugins.d/plymouth.c: - '' -
* mandos-to-cryptroot-unlock: Update copyright year to 2019.
- files removed:
- debian/po/es.po
- files modified:
- Makefile
added
removed
mandos
1
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
14
# Copyright © 2008-2020 Teddy Hogeborn
15
# Copyright © 2008-2020 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
39
40
except ImportError:
40
41
pass
41
42
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
43
try:
48
44
import SocketServer as socketserver
49
45
except ImportError:
50
46
import socketserver
51
47
import socket
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
import ConfigParser as configparser
56
53
except ImportError:
57
54
import configparser
55
import sys
58
56
import re
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import unittest
80
81
import random
81
82
import shlex
82
83
93
94
if sys.version_info.major == 2:
94
95
__metaclass__ = type
95
96
str = unicode
96
input = raw_input
97
97
98
98
# Add collections.abc.Callable if it does not exist
99
99
try:
143
143
if sys.version_info < (3, 2):
144
144
configparser.Configparser = configparser.SafeConfigParser
145
145
146
version = "1.8.15"
146
version = "1.8.11"
147
147
stored_state_file = "clients.pickle"
148
148
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
149
logger = logging.getLogger()
150
150
logging.captureWarnings(True) # Show warnings via the logging system
151
151
syslogger = None
152
152
189
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
190
address="/dev/log"))
191
191
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
192
('Mandos [%(process)d]: %(levelname)s:'
193
' %(message)s'))
194
logger.addHandler(syslogger)
195
195
196
196
if debug:
197
197
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
198
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
199
' [%(process)d]:'
200
' %(levelname)s:'
201
' %(message)s'))
202
logger.addHandler(console)
203
logger.setLevel(level)
204
204
205
205
206
206
class PGPError(Exception):
224
224
except OSError as e:
225
225
if e.errno != errno.ENOENT:
226
226
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
227
self.gnupgargs = ['--batch',
228
'--homedir', self.tempdir,
229
'--force-mdc',
230
'--quiet']
231
231
# Only GPG version 1 has the --no-use-agent option.
232
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
233
self.gnupgargs.append("--no-use-agent")
272
272
dir=self.tempdir) as passfile:
273
273
passfile.write(passphrase)
274
274
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
275
proc = subprocess.Popen([self.gpg, '--symmetric',
276
'--passphrase-file',
277
277
passfile.name]
278
278
+ self.gnupgargs,
279
279
stdin=subprocess.PIPE,
290
290
dir=self.tempdir) as passfile:
291
291
passfile.write(passphrase)
292
292
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
293
proc = subprocess.Popen([self.gpg, '--decrypt',
294
'--passphrase-file',
295
295
passfile.name]
296
296
+ self.gnupgargs,
297
297
stdin=subprocess.PIPE,
350
350
Attributes:
351
351
interface: integer; avahi.IF_UNSPEC or an interface index.
352
352
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
353
name: string; Example: 'Mandos'
354
type: string; Example: '_mandos._tcp'.
355
355
See <https://www.iana.org/assignments/service-names-port-numbers>
356
356
port: integer; what port to announce
357
357
TXT: list of strings; TXT record for the service
394
394
def rename(self, remove=True):
395
395
"""Derived from the Avahi example code"""
396
396
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
397
logger.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
400
400
raise AvahiServiceError("Too many renames")
401
401
self.name = str(
402
402
self.server.GetAlternativeServiceName(self.name))
403
403
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
404
logger.info("Changing Zeroconf service name to %r ...",
405
self.name)
406
406
if remove:
407
407
self.remove()
408
408
try:
410
410
except dbus.exceptions.DBusException as error:
411
411
if (error.get_dbus_name()
412
412
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
413
logger.info("Local Zeroconf service name collision.")
414
414
return self.rename(remove=False)
415
415
else:
416
log.critical("D-Bus Exception", exc_info=error)
416
logger.critical("D-Bus Exception", exc_info=error)
417
417
self.cleanup()
418
418
os._exit(1)
419
419
435
435
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
436
self.entry_group_state_changed_match = (
437
437
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
438
'StateChanged', self.entry_group_state_changed))
439
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
441
441
self.group.AddService(
442
442
self.interface,
443
443
self.protocol,
450
450
451
451
def entry_group_state_changed(self, state, error):
452
452
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
453
logger.debug("Avahi entry group state change: %i", state)
454
454
455
455
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
456
logger.debug("Zeroconf service established.")
457
457
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
458
logger.info("Zeroconf service name collision.")
459
459
self.rename()
460
460
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
461
logger.critical("Avahi: Error in group state changed %s",
462
str(error))
463
463
raise AvahiGroupError("State changed: {!s}".format(error))
464
464
465
465
def cleanup(self):
475
475
476
476
def server_state_changed(self, state, error=None):
477
477
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
478
logger.debug("Avahi server state change: %i", state)
479
479
bad_states = {
480
480
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
481
avahi.SERVER_REGISTERING: None,
485
485
if state in bad_states:
486
486
if bad_states[state] is not None:
487
487
if error is None:
488
log.error(bad_states[state])
488
logger.error(bad_states[state])
489
489
else:
490
log.error(bad_states[state] + ": %r", error)
490
logger.error(bad_states[state] + ": %r", error)
491
491
self.cleanup()
492
492
elif state == avahi.SERVER_RUNNING:
493
493
try:
495
495
except dbus.exceptions.DBusException as error:
496
496
if (error.get_dbus_name()
497
497
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
498
logger.info("Local Zeroconf service name"
499
" collision.")
499
500
return self.rename(remove=False)
500
501
else:
501
log.critical("D-Bus Exception", exc_info=error)
502
logger.critical("D-Bus Exception", exc_info=error)
502
503
self.cleanup()
503
504
os._exit(1)
504
505
else:
505
506
if error is None:
506
log.debug("Unknown state: %r", state)
507
logger.debug("Unknown state: %r", state)
507
508
else:
508
log.debug("Unknown state: %r: %r", state, error)
509
logger.debug("Unknown state: %r: %r", state, error)
509
510
510
511
def activate(self):
511
512
"""Derived from the Avahi example code"""
523
524
class AvahiServiceToSyslog(AvahiService):
524
525
def rename(self, *args, **kwargs):
525
526
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
527
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
528
528
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
529
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
530
.format(self.name)))
531
531
return ret
532
532
562
562
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
563
564
564
# Types
565
class _session_int(ctypes.Structure):
565
class session_int(ctypes.Structure):
566
566
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
567
session_t = ctypes.POINTER(session_int)
568
568
569
569
class certificate_credentials_st(ctypes.Structure):
570
570
_fields_ = []
573
573
certificate_type_t = ctypes.c_int
574
574
575
575
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
576
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
577
('size', ctypes.c_uint)]
578
578
579
class _openpgp_crt_int(ctypes.Structure):
579
class openpgp_crt_int(ctypes.Structure):
580
580
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
581
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
582
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
583
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
584
credentials_type_t = ctypes.c_int
593
593
# gnutls.strerror()
594
594
self.code = code
595
595
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
596
message = gnutls.strerror(code)
598
597
return super(gnutls.Error, self).__init__(
599
598
message, *args)
600
599
601
600
class CertificateSecurityError(Error):
602
601
pass
603
602
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
603
# Classes
630
class Credentials(With_from_param):
604
class Credentials:
631
605
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
606
self._c_object = gnutls.certificate_credentials_t()
607
gnutls.certificate_allocate_credentials(
608
ctypes.byref(self._c_object))
634
609
self.type = gnutls.CRD_CERTIFICATE
635
610
636
611
def __del__(self):
637
gnutls.certificate_free_credentials(self)
612
gnutls.certificate_free_credentials(self._c_object)
638
613
639
class ClientSession(With_from_param):
614
class ClientSession:
640
615
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
616
self._c_object = gnutls.session_t()
642
617
gnutls_flags = gnutls.CLIENT
643
618
if gnutls.check_version(b"3.5.6"):
644
619
gnutls_flags |= gnutls.NO_TICKETS
645
620
if gnutls.has_rawpk:
646
621
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
622
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
648
623
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
624
gnutls.set_default_priority(self._c_object)
625
gnutls.transport_set_ptr(self._c_object, socket.fileno())
626
gnutls.handshake_set_private_extensions(self._c_object,
627
True)
652
628
self.socket = socket
653
629
if credentials is None:
654
630
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
631
gnutls.credentials_set(self._c_object, credentials.type,
632
ctypes.cast(credentials._c_object,
633
ctypes.c_void_p))
657
634
self.credentials = credentials
658
635
659
636
def __del__(self):
660
gnutls.deinit(self)
637
gnutls.deinit(self._c_object)
661
638
662
639
def handshake(self):
663
return gnutls.handshake(self)
640
return gnutls.handshake(self._c_object)
664
641
665
642
def send(self, data):
666
643
data = bytes(data)
667
644
data_len = len(data)
668
645
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
646
data_len -= gnutls.record_send(self._c_object,
647
data[-data_len:],
670
648
data_len)
671
649
672
650
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
651
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
652
675
653
# Error handling functions
676
654
def _error_code(result):
677
655
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
656
for the 'restype' attribute on ctypes functions"""
657
if result >= 0:
680
658
return result
681
659
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
660
raise gnutls.CertificateSecurityError(code=result)
683
661
raise gnutls.Error(code=result)
684
662
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
663
def _retry_on_error(result, func, arguments):
687
664
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
665
for the 'errcheck' attribute on ctypes functions"""
666
while result < 0:
690
667
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
668
return _error_code(result)
692
669
result = func(*arguments)
697
674
698
675
# Functions
699
676
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
677
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
678
ctypes.POINTER(ctypes.c_char_p)]
702
679
priority_set_direct.restype = _error_code
703
680
704
681
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
682
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
683
init.restype = _error_code
707
684
708
685
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
686
set_default_priority.argtypes = [session_t]
710
687
set_default_priority.restype = _error_code
711
688
712
689
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
690
record_send.argtypes = [session_t, ctypes.c_void_p,
714
691
ctypes.c_size_t]
715
692
record_send.restype = ctypes.c_ssize_t
716
693
record_send.errcheck = _retry_on_error
718
695
certificate_allocate_credentials = (
719
696
_library.gnutls_certificate_allocate_credentials)
720
697
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
698
ctypes.POINTER(certificate_credentials_t)]
722
699
certificate_allocate_credentials.restype = _error_code
723
700
724
701
certificate_free_credentials = (
725
702
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
703
certificate_free_credentials.argtypes = [
704
certificate_credentials_t]
727
705
certificate_free_credentials.restype = None
728
706
729
707
handshake_set_private_extensions = (
730
708
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
709
handshake_set_private_extensions.argtypes = [session_t,
732
710
ctypes.c_int]
733
711
handshake_set_private_extensions.restype = None
734
712
735
713
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
714
credentials_set.argtypes = [session_t, credentials_type_t,
715
ctypes.c_void_p]
738
716
credentials_set.restype = _error_code
739
717
740
718
strerror = _library.gnutls_strerror
742
720
strerror.restype = ctypes.c_char_p
743
721
744
722
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
723
certificate_type_get.argtypes = [session_t]
746
724
certificate_type_get.restype = _error_code
747
725
748
726
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
727
certificate_get_peers.argtypes = [session_t,
750
728
ctypes.POINTER(ctypes.c_uint)]
751
729
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
730
759
737
global_set_log_function.restype = None
760
738
761
739
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
740
deinit.argtypes = [session_t]
763
741
deinit.restype = None
764
742
765
743
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
744
handshake.argtypes = [session_t]
745
handshake.restype = _error_code
768
746
handshake.errcheck = _retry_on_error
769
747
770
748
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
749
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
750
transport_set_ptr.restype = None
773
751
774
752
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
753
bye.argtypes = [session_t, close_request_t]
754
bye.restype = _error_code
777
755
bye.errcheck = _retry_on_error
778
756
779
757
check_version = _library.gnutls_check_version
796
774
797
775
x509_crt_fmt_t = ctypes.c_int
798
776
799
# All the function declarations below are from
800
# gnutls/abstract.h
777
# All the function declarations below are from gnutls/abstract.h
801
778
pubkey_init = _library.gnutls_pubkey_init
802
779
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
780
pubkey_init.restype = _error_code
817
794
pubkey_deinit.argtypes = [pubkey_t]
818
795
pubkey_deinit.restype = None
819
796
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
797
# All the function declarations below are from gnutls/openpgp.h
822
798
823
799
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
800
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
830
806
openpgp_crt_fmt_t]
831
807
openpgp_crt_import.restype = _error_code
832
808
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
809
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
810
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
811
ctypes.POINTER(ctypes.c_uint)]
840
812
openpgp_crt_verify_self.restype = _error_code
841
813
842
814
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
853
825
854
826
if check_version(b"3.6.4"):
855
827
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
828
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
857
829
certificate_type_get2.restype = _error_code
858
830
859
831
# Remove non-public functions
875
847
"""A representation of a client host served by this server.
876
848
877
849
Attributes:
878
approved: bool(); None if not yet approved/disapproved
850
approved: bool(); 'None' if not yet approved/disapproved
879
851
approval_delay: datetime.timedelta(); Time to wait for approval
880
852
approval_duration: datetime.timedelta(); Duration of one approval
881
853
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
854
to see if the client lives. 'None' if no process is
883
855
running.
884
856
checker_callback_tag: a GLib event source tag, or None
885
857
checker_command: string; External command which is run to check
1009
981
self.last_enabled = None
1010
982
self.expires = None
1011
983
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
984
logger.debug("Creating client %r", self.name)
985
logger.debug(" Key ID: %s", self.key_id)
986
logger.debug(" Fingerprint: %s", self.fingerprint)
1015
987
self.created = settings.get("created",
1016
988
datetime.datetime.utcnow())
1017
989
1056
1028
if not getattr(self, "enabled", False):
1057
1029
return False
1058
1030
if not quiet:
1059
log.info("Disabling client %s", self.name)
1031
logger.info("Disabling client %s", self.name)
1060
1032
if getattr(self, "disable_initiator_tag", None) is not None:
1061
1033
GLib.source_remove(self.disable_initiator_tag)
1062
1034
self.disable_initiator_tag = None
1106
1078
self.last_checker_status = returncode
1107
1079
self.last_checker_signal = None
1108
1080
if self.last_checker_status == 0:
1109
log.info("Checker for %(name)s succeeded", vars(self))
1081
logger.info("Checker for %(name)s succeeded",
1082
vars(self))
1110
1083
self.checked_ok()
1111
1084
else:
1112
log.info("Checker for %(name)s failed", vars(self))
1085
logger.info("Checker for %(name)s failed", vars(self))
1113
1086
else:
1114
1087
self.last_checker_status = -1
1115
1088
self.last_checker_signal = -returncode
1116
log.warning("Checker for %(name)s crashed?", vars(self))
1089
logger.warning("Checker for %(name)s crashed?",
1090
vars(self))
1117
1091
return False
1118
1092
1119
1093
def checked_ok(self):
1153
1127
# should be.
1154
1128
1155
1129
if self.checker is not None and not self.checker.is_alive():
1156
log.warning("Checker was not alive; joining")
1130
logger.warning("Checker was not alive; joining")
1157
1131
self.checker.join()
1158
1132
self.checker = None
1159
1133
# Start a new checker if needed
1165
1139
try:
1166
1140
command = self.checker_command % escaped_attrs
1167
1141
except TypeError as error:
1168
log.error('Could not format string "%s"',
1169
self.checker_command, exc_info=error)
1142
logger.error('Could not format string "%s"',
1143
self.checker_command,
1144
exc_info=error)
1170
1145
return True # Try again later
1171
1146
self.current_checker_command = command
1172
log.info("Starting checker %r for %s", command, self.name)
1147
logger.info("Starting checker %r for %s", command,
1148
self.name)
1173
1149
# We don't need to redirect stdout and stderr, since
1174
1150
# in normal mode, that is already done by daemon(),
1175
1151
# and in debug mode we don't want to. (Stdin is
1204
1180
self.checker_callback_tag = None
1205
1181
if getattr(self, "checker", None) is None:
1206
1182
return
1207
log.debug("Stopping checker for %(name)s", vars(self))
1183
logger.debug("Stopping checker for %(name)s", vars(self))
1208
1184
self.checker.terminate()
1209
1185
self.checker = None
1210
1186
1237
1213
func._dbus_name = func.__name__
1238
1214
if func._dbus_name.endswith("_dbus_property"):
1239
1215
func._dbus_name = func._dbus_name[:-14]
1240
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1216
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1241
1217
return func
1242
1218
1243
1219
return decorator
1332
1308
1333
1309
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1334
1310
out_signature="s",
1335
path_keyword="object_path",
1336
connection_keyword="connection")
1311
path_keyword='object_path',
1312
connection_keyword='connection')
1337
1313
def Introspect(self, object_path, connection):
1338
1314
"""Overloading of standard D-Bus method.
1339
1315
1388
1364
document.unlink()
1389
1365
except (AttributeError, xml.dom.DOMException,
1390
1366
xml.parsers.expat.ExpatError) as error:
1391
log.error("Failed to override Introspection method",
1392
exc_info=error)
1367
logger.error("Failed to override Introspection method",
1368
exc_info=error)
1393
1369
return xmlstring
1394
1370
1395
1371
1492
1468
1493
1469
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1494
1470
out_signature="s",
1495
path_keyword="object_path",
1496
connection_keyword="connection")
1471
path_keyword='object_path',
1472
connection_keyword='connection')
1497
1473
def Introspect(self, object_path, connection):
1498
1474
"""Overloading of standard D-Bus method.
1499
1475
1555
1531
document.unlink()
1556
1532
except (AttributeError, xml.dom.DOMException,
1557
1533
xml.parsers.expat.ExpatError) as error:
1558
log.error("Failed to override Introspection method",
1559
exc_info=error)
1534
logger.error("Failed to override Introspection method",
1535
exc_info=error)
1560
1536
return xmlstring
1561
1537
1562
1538
1594
1570
1595
1571
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1596
1572
out_signature="s",
1597
path_keyword="object_path",
1598
connection_keyword="connection")
1573
path_keyword='object_path',
1574
connection_keyword='connection')
1599
1575
def Introspect(self, object_path, connection):
1600
1576
"""Overloading of standard D-Bus method.
1601
1577
1626
1602
document.unlink()
1627
1603
except (AttributeError, xml.dom.DOMException,
1628
1604
xml.parsers.expat.ExpatError) as error:
1629
log.error("Failed to override Introspection method",
1630
exc_info=error)
1605
logger.error("Failed to override Introspection method",
1606
exc_info=error)
1631
1607
return xmlstring
1632
1608
1633
1609
2267
2243
class ProxyClient:
2268
2244
def __init__(self, child_pipe, key_id, fpr, address):
2269
2245
self._pipe = child_pipe
2270
self._pipe.send(("init", key_id, fpr, address))
2246
self._pipe.send(('init', key_id, fpr, address))
2271
2247
if not self._pipe.recv():
2272
2248
raise KeyError(key_id or fpr)
2273
2249
2274
2250
def __getattribute__(self, name):
2275
if name == "_pipe":
2251
if name == '_pipe':
2276
2252
return super(ProxyClient, self).__getattribute__(name)
2277
self._pipe.send(("getattr", name))
2253
self._pipe.send(('getattr', name))
2278
2254
data = self._pipe.recv()
2279
if data[0] == "data":
2255
if data[0] == 'data':
2280
2256
return data[1]
2281
if data[0] == "function":
2257
if data[0] == 'function':
2282
2258
2283
2259
def func(*args, **kwargs):
2284
self._pipe.send(("funcall", name, args, kwargs))
2260
self._pipe.send(('funcall', name, args, kwargs))
2285
2261
return self._pipe.recv()[1]
2286
2262
2287
2263
return func
2288
2264
2289
2265
def __setattr__(self, name, value):
2290
if name == "_pipe":
2266
if name == '_pipe':
2291
2267
return super(ProxyClient, self).__setattr__(name, value)
2292
self._pipe.send(("setattr", name, value))
2268
self._pipe.send(('setattr', name, value))
2293
2269
2294
2270
2295
2271
class ClientHandler(socketserver.BaseRequestHandler, object):
2300
2276
2301
2277
def handle(self):
2302
2278
with contextlib.closing(self.server.child_pipe) as child_pipe:
2303
log.info("TCP connection from: %s",
2304
str(self.client_address))
2305
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2279
logger.info("TCP connection from: %s",
2280
str(self.client_address))
2281
logger.debug("Pipe FD: %d",
2282
self.server.child_pipe.fileno())
2306
2283
2307
2284
session = gnutls.ClientSession(self.request)
2308
2285
2309
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2286
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2310
2287
# "+AES-256-CBC", "+SHA1",
2311
2288
# "+COMP-NULL", "+CTYPE-OPENPGP",
2312
2289
# "+DHE-DSS"))
2314
2291
priority = self.server.gnutls_priority
2315
2292
if priority is None:
2316
2293
priority = "NORMAL"
2317
gnutls.priority_set_direct(session,
2318
priority.encode("utf-8"), None)
2294
gnutls.priority_set_direct(session._c_object,
2295
priority.encode("utf-8"),
2296
None)
2319
2297
2320
2298
# Start communication using the Mandos protocol
2321
2299
# Get protocol number
2322
2300
line = self.request.makefile().readline()
2323
log.debug("Protocol version: %r", line)
2301
logger.debug("Protocol version: %r", line)
2324
2302
try:
2325
2303
if int(line.strip().split()[0]) > 1:
2326
2304
raise RuntimeError(line)
2327
2305
except (ValueError, IndexError, RuntimeError) as error:
2328
log.error("Unknown protocol version: %s", error)
2306
logger.error("Unknown protocol version: %s", error)
2329
2307
return
2330
2308
2331
2309
# Start GnuTLS connection
2332
2310
try:
2333
2311
session.handshake()
2334
2312
except gnutls.Error as error:
2335
log.warning("Handshake failed: %s", error)
2313
logger.warning("Handshake failed: %s", error)
2336
2314
# Do not run session.bye() here: the session is not
2337
2315
# established. Just abandon the request.
2338
2316
return
2339
log.debug("Handshake succeeded")
2317
logger.debug("Handshake succeeded")
2340
2318
2341
2319
approval_required = False
2342
2320
try:
2346
2324
key_id = self.key_id(
2347
2325
self.peer_certificate(session))
2348
2326
except (TypeError, gnutls.Error) as error:
2349
log.warning("Bad certificate: %s", error)
2327
logger.warning("Bad certificate: %s", error)
2350
2328
return
2351
log.debug("Key ID: %s",
2352
key_id.decode("utf-8",
2353
errors="replace"))
2329
logger.debug("Key ID: %s", key_id)
2354
2330
2355
2331
else:
2356
2332
key_id = b""
2358
2334
fpr = self.fingerprint(
2359
2335
self.peer_certificate(session))
2360
2336
except (TypeError, gnutls.Error) as error:
2361
log.warning("Bad certificate: %s", error)
2337
logger.warning("Bad certificate: %s", error)
2362
2338
return
2363
log.debug("Fingerprint: %s", fpr)
2339
logger.debug("Fingerprint: %s", fpr)
2364
2340
2365
2341
try:
2366
2342
client = ProxyClient(child_pipe, key_id, fpr,
2375
2351
2376
2352
while True:
2377
2353
if not client.enabled:
2378
log.info("Client %s is disabled", client.name)
2354
logger.info("Client %s is disabled",
2355
client.name)
2379
2356
if self.server.use_dbus:
2380
2357
# Emit D-Bus signal
2381
2358
client.Rejected("Disabled")
2385
2362
# We are approved or approval is disabled
2386
2363
break
2387
2364
elif client.approved is None:
2388
log.info("Client %s needs approval",
2389
client.name)
2365
logger.info("Client %s needs approval",
2366
client.name)
2390
2367
if self.server.use_dbus:
2391
2368
# Emit D-Bus signal
2392
2369
client.NeedApproval(
2393
2370
client.approval_delay.total_seconds()
2394
2371
* 1000, client.approved_by_default)
2395
2372
else:
2396
log.warning("Client %s was not approved",
2397
client.name)
2373
logger.warning("Client %s was not approved",
2374
client.name)
2398
2375
if self.server.use_dbus:
2399
2376
# Emit D-Bus signal
2400
2377
client.Rejected("Denied")
2408
2385
time2 = datetime.datetime.now()
2409
2386
if (time2 - time) >= delay:
2410
2387
if not client.approved_by_default:
2411
log.warning("Client %s timed out while"
2412
" waiting for approval",
2413
client.name)
2388
logger.warning("Client %s timed out while"
2389
" waiting for approval",
2390
client.name)
2414
2391
if self.server.use_dbus:
2415
2392
# Emit D-Bus signal
2416
2393
client.Rejected("Approval timed out")
2423
2400
try:
2424
2401
session.send(client.secret)
2425
2402
except gnutls.Error as error:
2426
log.warning("gnutls send failed", exc_info=error)
2403
logger.warning("gnutls send failed",
2404
exc_info=error)
2427
2405
return
2428
2406
2429
log.info("Sending secret to %s", client.name)
2407
logger.info("Sending secret to %s", client.name)
2430
2408
# bump the timeout using extended_timeout
2431
2409
client.bump_timeout(client.extended_timeout)
2432
2410
if self.server.use_dbus:
2439
2417
try:
2440
2418
session.bye()
2441
2419
except gnutls.Error as error:
2442
log.warning("GnuTLS bye failed", exc_info=error)
2420
logger.warning("GnuTLS bye failed",
2421
exc_info=error)
2443
2422
2444
2423
@staticmethod
2445
2424
def peer_certificate(session):
2446
2425
"Return the peer's certificate as a bytestring"
2447
2426
try:
2448
cert_type = gnutls.certificate_type_get2(
2449
session, gnutls.CTYPE_PEERS)
2427
cert_type = gnutls.certificate_type_get2(session._c_object,
2428
gnutls.CTYPE_PEERS)
2450
2429
except AttributeError:
2451
cert_type = gnutls.certificate_type_get(session)
2430
cert_type = gnutls.certificate_type_get(session._c_object)
2452
2431
if gnutls.has_rawpk:
2453
2432
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2454
2433
else:
2455
2434
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2456
2435
# If not a valid certificate type...
2457
2436
if cert_type not in valid_cert_types:
2458
log.info("Cert type %r not in %r", cert_type,
2459
valid_cert_types)
2437
logger.info("Cert type %r not in %r", cert_type,
2438
valid_cert_types)
2460
2439
# ...return invalid data
2461
2440
return b""
2462
2441
list_size = ctypes.c_uint(1)
2463
2442
cert_list = (gnutls.certificate_get_peers
2464
(session, ctypes.byref(list_size)))
2443
(session._c_object, ctypes.byref(list_size)))
2465
2444
if not bool(cert_list) and list_size.value != 0:
2466
2445
raise gnutls.Error("error getting peer certificate")
2467
2446
if list_size.value == 0:
2489
2468
buf = ctypes.create_string_buffer(32)
2490
2469
buf_len = ctypes.c_size_t(len(buf))
2491
2470
# Get the key ID from the raw public key into the buffer
2492
gnutls.pubkey_get_key_id(
2493
pubkey,
2494
gnutls.KEYID_USE_SHA256,
2495
ctypes.cast(ctypes.byref(buf),
2496
ctypes.POINTER(ctypes.c_ubyte)),
2497
ctypes.byref(buf_len))
2471
gnutls.pubkey_get_key_id(pubkey,
2472
gnutls.KEYID_USE_SHA256,
2473
ctypes.cast(ctypes.byref(buf),
2474
ctypes.POINTER(ctypes.c_ubyte)),
2475
ctypes.byref(buf_len))
2498
2476
# Deinit the certificate
2499
2477
gnutls.pubkey_deinit(pubkey)
2500
2478
2581
2559
2582
2560
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2583
2561
socketserver.TCPServer):
2584
"""IPv6-capable TCP server. Accepts None as address and/or port
2562
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2585
2563
2586
2564
Attributes:
2587
2565
enabled: Boolean; whether this server is activated yet
2638
2616
if SO_BINDTODEVICE is None:
2639
2617
# Fall back to a hard-coded value which seems to be
2640
2618
# common enough.
2641
log.warning("SO_BINDTODEVICE not found, trying 25")
2619
logger.warning("SO_BINDTODEVICE not found, trying 25")
2642
2620
SO_BINDTODEVICE = 25
2643
2621
try:
2644
2622
self.socket.setsockopt(
2646
2624
(self.interface + "\0").encode("utf-8"))
2647
2625
except socket.error as error:
2648
2626
if error.errno == errno.EPERM:
2649
log.error("No permission to bind to interface %s",
2650
self.interface)
2627
logger.error("No permission to bind to"
2628
" interface %s", self.interface)
2651
2629
elif error.errno == errno.ENOPROTOOPT:
2652
log.error("SO_BINDTODEVICE not available; cannot"
2653
" bind to interface %s", self.interface)
2630
logger.error("SO_BINDTODEVICE not available;"
2631
" cannot bind to interface %s",
2632
self.interface)
2654
2633
elif error.errno == errno.ENODEV:
2655
log.error("Interface %s does not exist, cannot"
2656
" bind", self.interface)
2634
logger.error("Interface %s does not exist,"
2635
" cannot bind", self.interface)
2657
2636
else:
2658
2637
raise
2659
2638
# Only bind(2) the socket if we really need to.
2738
2717
request = parent_pipe.recv()
2739
2718
command = request[0]
2740
2719
2741
if command == "init":
2720
if command == 'init':
2742
2721
key_id = request[1].decode("ascii")
2743
2722
fpr = request[2].decode("ascii")
2744
2723
address = request[3]
2745
2724
2746
2725
for c in self.clients.values():
2747
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2748
"27AE41E4649B934CA495991B7852B855"):
2726
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2749
2727
continue
2750
2728
if key_id and c.key_id == key_id:
2751
2729
client = c
2754
2732
client = c
2755
2733
break
2756
2734
else:
2757
log.info("Client not found for key ID: %s, address:"
2758
" %s", key_id or fpr, address)
2735
logger.info("Client not found for key ID: %s, address"
2736
": %s", key_id or fpr, address)
2759
2737
if self.use_dbus:
2760
2738
# Emit D-Bus signal
2761
2739
mandos_dbus_service.ClientNotFound(key_id or fpr,
2774
2752
# remove the old hook in favor of the new above hook on
2775
2753
# same fileno
2776
2754
return False
2777
if command == "funcall":
2755
if command == 'funcall':
2778
2756
funcname = request[1]
2779
2757
args = request[2]
2780
2758
kwargs = request[3]
2781
2759
2782
parent_pipe.send(("data", getattr(client_object,
2760
parent_pipe.send(('data', getattr(client_object,
2783
2761
funcname)(*args,
2784
2762
**kwargs)))
2785
2763
2786
if command == "getattr":
2764
if command == 'getattr':
2787
2765
attrname = request[1]
2788
2766
if isinstance(client_object.__getattribute__(attrname),
2789
2767
collections.abc.Callable):
2790
parent_pipe.send(("function", ))
2768
parent_pipe.send(('function', ))
2791
2769
else:
2792
2770
parent_pipe.send((
2793
"data", client_object.__getattribute__(attrname)))
2771
'data', client_object.__getattribute__(attrname)))
2794
2772
2795
if command == "setattr":
2773
if command == 'setattr':
2796
2774
attrname = request[1]
2797
2775
value = request[2]
2798
2776
setattr(client_object, attrname, value)
2803
2781
def rfc3339_duration_to_delta(duration):
2804
2782
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2805
2783
2806
>>> timedelta = datetime.timedelta
2807
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2808
True
2809
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2810
True
2811
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2812
True
2813
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2814
True
2815
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2816
True
2817
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2818
True
2819
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2820
True
2821
>>> del timedelta
2784
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2785
True
2786
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2787
True
2788
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2789
True
2790
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2791
True
2792
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2793
True
2794
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2795
True
2796
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2797
True
2822
2798
"""
2823
2799
2824
2800
# Parsing an RFC 3339 duration with regular expressions is not
2904
2880
def string_to_delta(interval):
2905
2881
"""Parse a string and return a datetime.timedelta
2906
2882
2907
>>> string_to_delta("7d") == datetime.timedelta(7)
2908
True
2909
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2910
True
2911
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2912
True
2913
>>> string_to_delta("24h") == datetime.timedelta(1)
2914
True
2915
>>> string_to_delta("1w") == datetime.timedelta(7)
2916
True
2917
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2883
>>> string_to_delta('7d') == datetime.timedelta(7)
2884
True
2885
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2886
True
2887
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2888
True
2889
>>> string_to_delta('24h') == datetime.timedelta(1)
2890
True
2891
>>> string_to_delta('1w') == datetime.timedelta(7)
2892
True
2893
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2918
2894
True
2919
2895
"""
2920
2896
3124
3100
3125
3101
if server_settings["servicename"] != "Mandos":
3126
3102
syslogger.setFormatter(
3127
logging.Formatter("Mandos ({}) [%(process)d]:"
3128
" %(levelname)s: %(message)s".format(
3103
logging.Formatter('Mandos ({}) [%(process)d]:'
3104
' %(levelname)s: %(message)s'.format(
3129
3105
server_settings["servicename"])))
3130
3106
3131
3107
# Parse config file with clients
3155
3131
try:
3156
3132
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3157
3133
except IOError as e:
3158
log.error("Could not open file %r", pidfilename,
3159
exc_info=e)
3134
logger.error("Could not open file %r", pidfilename,
3135
exc_info=e)
3160
3136
3161
3137
for name, group in (("_mandos", "_mandos"),
3162
3138
("mandos", "mandos"),
3173
3149
try:
3174
3150
os.setgid(gid)
3175
3151
os.setuid(uid)
3176
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3152
if debug:
3153
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3154
gid))
3177
3155
except OSError as error:
3178
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3179
os.strerror(error.errno))
3156
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3157
.format(uid, gid, os.strerror(error.errno)))
3180
3158
if error.errno != errno.EPERM:
3181
3159
raise
3182
3160
3189
3167
3190
3168
@gnutls.log_func
3191
3169
def debug_gnutls(level, string):
3192
log.debug("GnuTLS: %s",
3193
string[:-1].decode("utf-8", errors="replace"))
3170
logger.debug("GnuTLS: %s", string[:-1])
3194
3171
3195
3172
gnutls.global_set_log_function(debug_gnutls)
3196
3173
3225
3202
"se.bsnet.fukt.Mandos", bus,
3226
3203
do_not_queue=True)
3227
3204
except dbus.exceptions.DBusException as e:
3228
log.error("Disabling D-Bus:", exc_info=e)
3205
logger.error("Disabling D-Bus:", exc_info=e)
3229
3206
use_dbus = False
3230
3207
server_settings["use_dbus"] = False
3231
3208
tcp_server.use_dbus = False
3316
3293
os.remove(stored_state_path)
3317
3294
except IOError as e:
3318
3295
if e.errno == errno.ENOENT:
3319
log.warning("Could not load persistent state:"
3320
" %s", os.strerror(e.errno))
3296
logger.warning("Could not load persistent state:"
3297
" {}".format(os.strerror(e.errno)))
3321
3298
else:
3322
log.critical("Could not load persistent state:",
3323
exc_info=e)
3299
logger.critical("Could not load persistent state:",
3300
exc_info=e)
3324
3301
raise
3325
3302
except EOFError as e:
3326
log.warning("Could not load persistent state: EOFError:",
3327
exc_info=e)
3303
logger.warning("Could not load persistent state: "
3304
"EOFError:",
3305
exc_info=e)
3328
3306
3329
3307
with PGPEngine() as pgp:
3330
3308
for client_name, client in clients_data.items():
3357
3335
if client["enabled"]:
3358
3336
if datetime.datetime.utcnow() >= client["expires"]:
3359
3337
if not client["last_checked_ok"]:
3360
log.warning("disabling client %s - Client"
3361
" never performed a successful"
3362
" checker", client_name)
3338
logger.warning(
3339
"disabling client {} - Client never "
3340
"performed a successful checker".format(
3341
client_name))
3363
3342
client["enabled"] = False
3364
3343
elif client["last_checker_status"] != 0:
3365
log.warning("disabling client %s - Client"
3366
" last checker failed with error"
3367
" code %s", client_name,
3368
client["last_checker_status"])
3344
logger.warning(
3345
"disabling client {} - Client last"
3346
" checker failed with error code"
3347
" {}".format(
3348
client_name,
3349
client["last_checker_status"]))
3369
3350
client["enabled"] = False
3370
3351
else:
3371
3352
client["expires"] = (
3372
3353
datetime.datetime.utcnow()
3373
3354
+ client["timeout"])
3374
log.debug("Last checker succeeded, keeping %s"
3375
" enabled", client_name)
3355
logger.debug("Last checker succeeded,"
3356
" keeping {} enabled".format(
3357
client_name))
3376
3358
try:
3377
3359
client["secret"] = pgp.decrypt(
3378
3360
client["encrypted_secret"],
3379
3361
client_settings[client_name]["secret"])
3380
3362
except PGPError:
3381
3363
# If decryption fails, we use secret from new settings
3382
log.debug("Failed to decrypt %s old secret",
3383
client_name)
3364
logger.debug("Failed to decrypt {} old secret".format(
3365
client_name))
3384
3366
client["secret"] = (client_settings[client_name]
3385
3367
["secret"])
3386
3368
3400
3382
server_settings=server_settings)
3401
3383
3402
3384
if not tcp_server.clients:
3403
log.warning("No clients defined")
3385
logger.warning("No clients defined")
3404
3386
3405
3387
if not foreground:
3406
3388
if pidfile is not None:
3409
3391
with pidfile:
3410
3392
print(pid, file=pidfile)
3411
3393
except IOError:
3412
log.error("Could not write to file %r with PID %d",
3413
pidfilename, pid)
3394
logger.error("Could not write to file %r with PID %d",
3395
pidfilename, pid)
3414
3396
del pidfile
3415
3397
del pidfilename
3416
3398
3566
3548
3567
3549
try:
3568
3550
with tempfile.NamedTemporaryFile(
3569
mode="wb",
3551
mode='wb',
3570
3552
suffix=".pickle",
3571
prefix="clients-",
3553
prefix='clients-',
3572
3554
dir=os.path.dirname(stored_state_path),
3573
3555
delete=False) as stored_state:
3574
3556
pickle.dump((clients, client_settings), stored_state,
3582
3564
except NameError:
3583
3565
pass
3584
3566
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3585
log.warning("Could not save persistent state: %s",
3586
os.strerror(e.errno))
3567
logger.warning("Could not save persistent state: {}"
3568
.format(os.strerror(e.errno)))
3587
3569
else:
3588
log.warning("Could not save persistent state:",
3589
exc_info=e)
3570
logger.warning("Could not save persistent state:",
3571
exc_info=e)
3590
3572
raise
3591
3573
3592
3574
# Delete all clients, and settings from config
3618
3600
if zeroconf:
3619
3601
service.port = tcp_server.socket.getsockname()[1]
3620
3602
if use_ipv6:
3621
log.info("Now listening on address %r, port %d, flowinfo %d,"
3622
" scope_id %d", *tcp_server.socket.getsockname())
3603
logger.info("Now listening on address %r, port %d,"
3604
" flowinfo %d, scope_id %d",
3605
*tcp_server.socket.getsockname())
3623
3606
else: # IPv4
3624
log.info("Now listening on address %r, port %d",
3625
*tcp_server.socket.getsockname())
3607
logger.info("Now listening on address %r, port %d",
3608
*tcp_server.socket.getsockname())
3626
3609
3627
3610
# service.interface = tcp_server.socket.getsockname()[3]
3628
3611
3632
3615
try:
3633
3616
service.activate()
3634
3617
except dbus.exceptions.DBusException as error:
3635
log.critical("D-Bus Exception", exc_info=error)
3618
logger.critical("D-Bus Exception", exc_info=error)
3636
3619
cleanup()
3637
3620
sys.exit(1)
3638
3621
# End of Avahi example code
3643
3626
lambda *args, **kwargs: (tcp_server.handle_request
3644
3627
(*args[2:], **kwargs) or True))
3645
3628
3646
log.debug("Starting main loop")
3629
logger.debug("Starting main loop")
3647
3630
main_loop.run()
3648
3631
except AvahiError as error:
3649
log.critical("Avahi Error", exc_info=error)
3632
logger.critical("Avahi Error", exc_info=error)
3650
3633
cleanup()
3651
3634
sys.exit(1)
3652
3635
except KeyboardInterrupt:
3653
3636
if debug:
3654
3637
print("", file=sys.stderr)
3655
log.debug("Server received KeyboardInterrupt")
3656
log.debug("Server exiting")
3638
logger.debug("Server received KeyboardInterrupt")
3639
logger.debug("Server exiting")
3657
3640
# Must run before the D-Bus bus name gets deregistered
3658
3641
cleanup()
3659
3642
3660
3643
3661
def parse_test_args():
3662
# type: () -> argparse.Namespace
3644
def should_only_run_tests():
3663
3645
parser = argparse.ArgumentParser(add_help=False)
3664
parser.add_argument("--check", action="store_true")
3665
parser.add_argument("--prefix", )
3646
parser.add_argument("--check", action='store_true')
3666
3647
args, unknown_args = parser.parse_known_args()
3667
if args.check:
3668
# Remove test options from sys.argv
3648
run_tests = args.check
3649
if run_tests:
3650
# Remove --check argument from sys.argv
3669
3651
sys.argv[1:] = unknown_args
3670
return args
3652
return run_tests
3671
3653
3672
3654
# Add all tests from doctest strings
3673
3655
def load_tests(loader, tests, none):
3675
3657
tests.addTests(doctest.DocTestSuite())
3676
3658
return tests
3677
3659
3678
if __name__ == "__main__":
3679
options = parse_test_args()
3660
if __name__ == '__main__':
3680
3661
try:
3681
if options.check:
3682
extra_test_prefix = options.prefix
3683
if extra_test_prefix is not None:
3684
if not (unittest.main(argv=[""], exit=False)
3685
.result.wasSuccessful()):
3686
sys.exit(1)
3687
class ExtraTestLoader(unittest.TestLoader):
3688
testMethodPrefix = extra_test_prefix
3689
# Call using ./scriptname --test [--verbose]
3690
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3691
else:
3692
unittest.main(argv=[""])
3662
if should_only_run_tests():
3663
# Call using ./mandos --check [--verbose]
3664
unittest.main()
3693
3665
else:
3694
3666
main()
3695
3667
finally:
3696
3668
logging.shutdown()
3697
3698
# Local Variables:
3699
# run-tests:
3700
# (lambda (&optional extra)
3701
# (if (not (funcall run-tests-in-test-buffer default-directory
3702
# extra))
3703
# (funcall show-test-buffer-in-test-window)
3704
# (funcall remove-test-window)
3705
# (if extra (message "Extra tests run successfully!"))))
3706
# run-tests-in-test-buffer:
3707
# (lambda (dir &optional extra)
3708
# (with-current-buffer (get-buffer-create "*Test*")
3709
# (setq buffer-read-only nil
3710
# default-directory dir)
3711
# (erase-buffer)
3712
# (compilation-mode))
3713
# (let ((process-result
3714
# (let ((inhibit-read-only t))
3715
# (process-file-shell-command
3716
# (funcall get-command-line extra) nil "*Test*"))))
3717
# (and (numberp process-result)
3718
# (= process-result 0))))
3719
# get-command-line:
3720
# (lambda (&optional extra)
3721
# (let ((quoted-script
3722
# (shell-quote-argument (funcall get-script-name))))
3723
# (format
3724
# (concat "%s --check" (if extra " --prefix=atest" ""))
3725
# quoted-script)))
3726
# get-script-name:
3727
# (lambda ()
3728
# (if (fboundp 'file-local-name)
3729
# (file-local-name (buffer-file-name))
3730
# (or (file-remote-p (buffer-file-name) 'localname)
3731
# (buffer-file-name))))
3732
# remove-test-window:
3733
# (lambda ()
3734
# (let ((test-window (get-buffer-window "*Test*")))
3735
# (if test-window (delete-window test-window))))
3736
# show-test-buffer-in-test-window:
3737
# (lambda ()
3738
# (when (not (get-buffer-window-list "*Test*"))
3739
# (setq next-error-last-buffer (get-buffer "*Test*"))
3740
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3741
# (display-buffer-overriding-action
3742
# `((display-buffer-in-side-window) (side . ,side)
3743
# (window-height . fit-window-to-buffer)
3744
# (window-width . fit-window-to-buffer))))
3745
# (display-buffer "*Test*"))))
3746
# eval:
3747
# (progn
3748
# (let* ((run-extra-tests (lambda () (interactive)
3749
# (funcall run-tests t)))
3750
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3751
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3752
# (setq minor-mode-overriding-map-alist
3753
# (cons `(run-tests . ,outer-keymap)
3754
# minor-mode-overriding-map-alist)))
3755
# (add-hook 'after-save-hook run-tests 90 t))
3756
# End:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0