To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1218
- compare with another revision
- download diff
- download tarball
- view history from revision 1218
- Committer: teddy at recompile
- Date: 2020-07-04 11:58:52 UTC
- Revision ID: teddy@recompile.se-20200704115852-oquhnmng3zom4ldl
Update copyright year
* DBUS-API: Update copyright year to 2020
* debian/copyright: - '' -
* dracut-module/ask-password-mandos.service: - '' -
* dracut-module/password-agent.c: - '' -
* mandos: - '' -
* mandos-ctl: - '' -
* plugin-runner.c: - '' -
* plugins.d/mandos-client.c: - '' -
* plugins.d/plymouth.c: - '' -
* mandos-to-cryptroot-unlock: Update copyright year to 2019.
* DBUS-API: Update copyright year to 2020
* debian/copyright: - '' -
* dracut-module/ask-password-mandos.service: - '' -
* dracut-module/password-agent.c: - '' -
* mandos: - '' -
* mandos-ctl: - '' -
* plugin-runner.c: - '' -
* plugins.d/mandos-client.c: - '' -
* plugins.d/plymouth.c: - '' -
* mandos-to-cryptroot-unlock: Update copyright year to 2019.
- files removed:
- debian/mandos.maintscript
- files modified:
- Makefile
added
removed
mandos
1
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
14
# Copyright © 2008-2020 Teddy Hogeborn
15
# Copyright © 2008-2020 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
39
40
except ImportError:
40
41
pass
41
42
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
43
try:
48
44
import SocketServer as socketserver
49
45
except ImportError:
50
46
import socketserver
51
47
import socket
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
import ConfigParser as configparser
56
53
except ImportError:
57
54
import configparser
55
import sys
58
56
import re
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import unittest
80
81
import random
81
82
import shlex
82
83
93
94
if sys.version_info.major == 2:
94
95
__metaclass__ = type
95
96
str = unicode
96
input = raw_input
97
97
98
98
# Add collections.abc.Callable if it does not exist
99
99
try:
143
143
if sys.version_info < (3, 2):
144
144
configparser.Configparser = configparser.SafeConfigParser
145
145
146
version = "1.8.16"
146
version = "1.8.11"
147
147
stored_state_file = "clients.pickle"
148
148
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
149
logger = logging.getLogger()
150
150
logging.captureWarnings(True) # Show warnings via the logging system
151
151
syslogger = None
152
152
189
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
190
address="/dev/log"))
191
191
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
192
('Mandos [%(process)d]: %(levelname)s:'
193
' %(message)s'))
194
logger.addHandler(syslogger)
195
195
196
196
if debug:
197
197
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
198
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
199
' [%(process)d]:'
200
' %(levelname)s:'
201
' %(message)s'))
202
logger.addHandler(console)
203
logger.setLevel(level)
204
204
205
205
206
206
class PGPError(Exception):
224
224
except OSError as e:
225
225
if e.errno != errno.ENOENT:
226
226
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
227
self.gnupgargs = ['--batch',
228
'--homedir', self.tempdir,
229
'--force-mdc',
230
'--quiet']
231
231
# Only GPG version 1 has the --no-use-agent option.
232
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
233
self.gnupgargs.append("--no-use-agent")
272
272
dir=self.tempdir) as passfile:
273
273
passfile.write(passphrase)
274
274
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
275
proc = subprocess.Popen([self.gpg, '--symmetric',
276
'--passphrase-file',
277
277
passfile.name]
278
278
+ self.gnupgargs,
279
279
stdin=subprocess.PIPE,
290
290
dir=self.tempdir) as passfile:
291
291
passfile.write(passphrase)
292
292
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
293
proc = subprocess.Popen([self.gpg, '--decrypt',
294
'--passphrase-file',
295
295
passfile.name]
296
296
+ self.gnupgargs,
297
297
stdin=subprocess.PIPE,
350
350
Attributes:
351
351
interface: integer; avahi.IF_UNSPEC or an interface index.
352
352
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
353
name: string; Example: 'Mandos'
354
type: string; Example: '_mandos._tcp'.
355
355
See <https://www.iana.org/assignments/service-names-port-numbers>
356
356
port: integer; what port to announce
357
357
TXT: list of strings; TXT record for the service
394
394
def rename(self, remove=True):
395
395
"""Derived from the Avahi example code"""
396
396
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
397
logger.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
400
400
raise AvahiServiceError("Too many renames")
401
401
self.name = str(
402
402
self.server.GetAlternativeServiceName(self.name))
403
403
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
404
logger.info("Changing Zeroconf service name to %r ...",
405
self.name)
406
406
if remove:
407
407
self.remove()
408
408
try:
410
410
except dbus.exceptions.DBusException as error:
411
411
if (error.get_dbus_name()
412
412
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
413
logger.info("Local Zeroconf service name collision.")
414
414
return self.rename(remove=False)
415
415
else:
416
log.critical("D-Bus Exception", exc_info=error)
416
logger.critical("D-Bus Exception", exc_info=error)
417
417
self.cleanup()
418
418
os._exit(1)
419
419
435
435
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
436
self.entry_group_state_changed_match = (
437
437
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
438
'StateChanged', self.entry_group_state_changed))
439
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
441
441
self.group.AddService(
442
442
self.interface,
443
443
self.protocol,
450
450
451
451
def entry_group_state_changed(self, state, error):
452
452
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
453
logger.debug("Avahi entry group state change: %i", state)
454
454
455
455
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
456
logger.debug("Zeroconf service established.")
457
457
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
458
logger.info("Zeroconf service name collision.")
459
459
self.rename()
460
460
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
461
logger.critical("Avahi: Error in group state changed %s",
462
str(error))
463
463
raise AvahiGroupError("State changed: {!s}".format(error))
464
464
465
465
def cleanup(self):
475
475
476
476
def server_state_changed(self, state, error=None):
477
477
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
478
logger.debug("Avahi server state change: %i", state)
479
479
bad_states = {
480
480
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
481
avahi.SERVER_REGISTERING: None,
485
485
if state in bad_states:
486
486
if bad_states[state] is not None:
487
487
if error is None:
488
log.error(bad_states[state])
488
logger.error(bad_states[state])
489
489
else:
490
log.error(bad_states[state] + ": %r", error)
490
logger.error(bad_states[state] + ": %r", error)
491
491
self.cleanup()
492
492
elif state == avahi.SERVER_RUNNING:
493
493
try:
495
495
except dbus.exceptions.DBusException as error:
496
496
if (error.get_dbus_name()
497
497
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
498
logger.info("Local Zeroconf service name"
499
" collision.")
499
500
return self.rename(remove=False)
500
501
else:
501
log.critical("D-Bus Exception", exc_info=error)
502
logger.critical("D-Bus Exception", exc_info=error)
502
503
self.cleanup()
503
504
os._exit(1)
504
505
else:
505
506
if error is None:
506
log.debug("Unknown state: %r", state)
507
logger.debug("Unknown state: %r", state)
507
508
else:
508
log.debug("Unknown state: %r: %r", state, error)
509
logger.debug("Unknown state: %r: %r", state, error)
509
510
510
511
def activate(self):
511
512
"""Derived from the Avahi example code"""
523
524
class AvahiServiceToSyslog(AvahiService):
524
525
def rename(self, *args, **kwargs):
525
526
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
527
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
528
528
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
529
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
530
.format(self.name)))
531
531
return ret
532
532
562
562
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
563
564
564
# Types
565
class _session_int(ctypes.Structure):
565
class session_int(ctypes.Structure):
566
566
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
567
session_t = ctypes.POINTER(session_int)
568
568
569
569
class certificate_credentials_st(ctypes.Structure):
570
570
_fields_ = []
573
573
certificate_type_t = ctypes.c_int
574
574
575
575
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
576
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
577
('size', ctypes.c_uint)]
578
578
579
class _openpgp_crt_int(ctypes.Structure):
579
class openpgp_crt_int(ctypes.Structure):
580
580
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
581
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
582
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
583
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
584
credentials_type_t = ctypes.c_int
593
593
# gnutls.strerror()
594
594
self.code = code
595
595
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
596
message = gnutls.strerror(code)
598
597
return super(gnutls.Error, self).__init__(
599
598
message, *args)
600
599
601
600
class CertificateSecurityError(Error):
602
601
pass
603
602
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
603
# Classes
630
class Credentials(With_from_param):
604
class Credentials:
631
605
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
606
self._c_object = gnutls.certificate_credentials_t()
607
gnutls.certificate_allocate_credentials(
608
ctypes.byref(self._c_object))
634
609
self.type = gnutls.CRD_CERTIFICATE
635
610
636
611
def __del__(self):
637
gnutls.certificate_free_credentials(self)
612
gnutls.certificate_free_credentials(self._c_object)
638
613
639
class ClientSession(With_from_param):
614
class ClientSession:
640
615
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
616
self._c_object = gnutls.session_t()
642
617
gnutls_flags = gnutls.CLIENT
643
618
if gnutls.check_version(b"3.5.6"):
644
619
gnutls_flags |= gnutls.NO_TICKETS
645
620
if gnutls.has_rawpk:
646
621
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
622
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
648
623
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
624
gnutls.set_default_priority(self._c_object)
625
gnutls.transport_set_ptr(self._c_object, socket.fileno())
626
gnutls.handshake_set_private_extensions(self._c_object,
627
True)
652
628
self.socket = socket
653
629
if credentials is None:
654
630
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
631
gnutls.credentials_set(self._c_object, credentials.type,
632
ctypes.cast(credentials._c_object,
633
ctypes.c_void_p))
657
634
self.credentials = credentials
658
635
659
636
def __del__(self):
660
gnutls.deinit(self)
637
gnutls.deinit(self._c_object)
661
638
662
639
def handshake(self):
663
return gnutls.handshake(self)
640
return gnutls.handshake(self._c_object)
664
641
665
642
def send(self, data):
666
643
data = bytes(data)
667
644
data_len = len(data)
668
645
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
646
data_len -= gnutls.record_send(self._c_object,
647
data[-data_len:],
670
648
data_len)
671
649
672
650
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
651
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
652
675
653
# Error handling functions
676
654
def _error_code(result):
677
655
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
656
for the 'restype' attribute on ctypes functions"""
657
if result >= 0:
680
658
return result
681
659
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
660
raise gnutls.CertificateSecurityError(code=result)
683
661
raise gnutls.Error(code=result)
684
662
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
663
def _retry_on_error(result, func, arguments):
687
664
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
665
for the 'errcheck' attribute on ctypes functions"""
666
while result < 0:
690
667
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
668
return _error_code(result)
692
669
result = func(*arguments)
697
674
698
675
# Functions
699
676
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
677
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
678
ctypes.POINTER(ctypes.c_char_p)]
702
679
priority_set_direct.restype = _error_code
703
680
704
681
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
682
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
683
init.restype = _error_code
707
684
708
685
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
686
set_default_priority.argtypes = [session_t]
710
687
set_default_priority.restype = _error_code
711
688
712
689
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
690
record_send.argtypes = [session_t, ctypes.c_void_p,
714
691
ctypes.c_size_t]
715
692
record_send.restype = ctypes.c_ssize_t
716
693
record_send.errcheck = _retry_on_error
718
695
certificate_allocate_credentials = (
719
696
_library.gnutls_certificate_allocate_credentials)
720
697
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
698
ctypes.POINTER(certificate_credentials_t)]
722
699
certificate_allocate_credentials.restype = _error_code
723
700
724
701
certificate_free_credentials = (
725
702
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
703
certificate_free_credentials.argtypes = [
704
certificate_credentials_t]
727
705
certificate_free_credentials.restype = None
728
706
729
707
handshake_set_private_extensions = (
730
708
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
709
handshake_set_private_extensions.argtypes = [session_t,
732
710
ctypes.c_int]
733
711
handshake_set_private_extensions.restype = None
734
712
735
713
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
714
credentials_set.argtypes = [session_t, credentials_type_t,
715
ctypes.c_void_p]
738
716
credentials_set.restype = _error_code
739
717
740
718
strerror = _library.gnutls_strerror
742
720
strerror.restype = ctypes.c_char_p
743
721
744
722
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
723
certificate_type_get.argtypes = [session_t]
746
724
certificate_type_get.restype = _error_code
747
725
748
726
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
727
certificate_get_peers.argtypes = [session_t,
750
728
ctypes.POINTER(ctypes.c_uint)]
751
729
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
730
759
737
global_set_log_function.restype = None
760
738
761
739
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
740
deinit.argtypes = [session_t]
763
741
deinit.restype = None
764
742
765
743
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
744
handshake.argtypes = [session_t]
745
handshake.restype = _error_code
768
746
handshake.errcheck = _retry_on_error
769
747
770
748
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
749
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
750
transport_set_ptr.restype = None
773
751
774
752
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
753
bye.argtypes = [session_t, close_request_t]
754
bye.restype = _error_code
777
755
bye.errcheck = _retry_on_error
778
756
779
757
check_version = _library.gnutls_check_version
796
774
797
775
x509_crt_fmt_t = ctypes.c_int
798
776
799
# All the function declarations below are from
800
# gnutls/abstract.h
777
# All the function declarations below are from gnutls/abstract.h
801
778
pubkey_init = _library.gnutls_pubkey_init
802
779
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
780
pubkey_init.restype = _error_code
817
794
pubkey_deinit.argtypes = [pubkey_t]
818
795
pubkey_deinit.restype = None
819
796
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
797
# All the function declarations below are from gnutls/openpgp.h
822
798
823
799
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
800
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
830
806
openpgp_crt_fmt_t]
831
807
openpgp_crt_import.restype = _error_code
832
808
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
809
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
810
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
811
ctypes.POINTER(ctypes.c_uint)]
840
812
openpgp_crt_verify_self.restype = _error_code
841
813
842
814
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
853
825
854
826
if check_version(b"3.6.4"):
855
827
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
828
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
857
829
certificate_type_get2.restype = _error_code
858
830
859
831
# Remove non-public functions
875
847
"""A representation of a client host served by this server.
876
848
877
849
Attributes:
878
approved: bool(); None if not yet approved/disapproved
850
approved: bool(); 'None' if not yet approved/disapproved
879
851
approval_delay: datetime.timedelta(); Time to wait for approval
880
852
approval_duration: datetime.timedelta(); Duration of one approval
881
853
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
854
to see if the client lives. 'None' if no process is
883
855
running.
884
856
checker_callback_tag: a GLib event source tag, or None
885
857
checker_command: string; External command which is run to check
1009
981
self.last_enabled = None
1010
982
self.expires = None
1011
983
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
984
logger.debug("Creating client %r", self.name)
985
logger.debug(" Key ID: %s", self.key_id)
986
logger.debug(" Fingerprint: %s", self.fingerprint)
1015
987
self.created = settings.get("created",
1016
988
datetime.datetime.utcnow())
1017
989
1045
1017
if getattr(self, "enabled", False):
1046
1018
# Already enabled
1047
1019
return
1020
self.expires = datetime.datetime.utcnow() + self.timeout
1048
1021
self.enabled = True
1049
1022
self.last_enabled = datetime.datetime.utcnow()
1050
1023
self.init_checker()
1055
1028
if not getattr(self, "enabled", False):
1056
1029
return False
1057
1030
if not quiet:
1058
log.info("Disabling client %s", self.name)
1031
logger.info("Disabling client %s", self.name)
1059
1032
if getattr(self, "disable_initiator_tag", None) is not None:
1060
1033
GLib.source_remove(self.disable_initiator_tag)
1061
1034
self.disable_initiator_tag = None
1073
1046
def __del__(self):
1074
1047
self.disable()
1075
1048
1076
def init_checker(self, randomize_start=False):
1077
# Schedule a new checker to be started a randomly selected
1078
# time (a fraction of 'interval') from now. This spreads out
1079
# the startup of checkers over time when the server is
1080
# started.
1049
def init_checker(self):
1050
# Schedule a new checker to be started an 'interval' from now,
1051
# and every interval from then on.
1081
1052
if self.checker_initiator_tag is not None:
1082
1053
GLib.source_remove(self.checker_initiator_tag)
1083
interval_milliseconds = int(self.interval.total_seconds()
1084
* 1000)
1085
if randomize_start:
1086
delay_milliseconds = random.randrange(
1087
interval_milliseconds + 1)
1088
else:
1089
delay_milliseconds = interval_milliseconds
1090
1054
self.checker_initiator_tag = GLib.timeout_add(
1091
delay_milliseconds, self.start_checker, randomize_start)
1092
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1093
# A checker might take up to an 'interval' of time, so we can
1094
# expire at the soonest one interval after a checker was
1095
# started. Since the initial checker is delayed, the expire
1096
# time might have to be extended.
1097
now = datetime.datetime.utcnow()
1098
self.expires = now + delay + self.interval
1099
# Schedule a disable() at expire time
1055
random.randrange(int(self.interval.total_seconds() * 1000
1056
+ 1)),
1057
self.start_checker)
1058
# Schedule a disable() when 'timeout' has passed
1100
1059
if self.disable_initiator_tag is not None:
1101
1060
GLib.source_remove(self.disable_initiator_tag)
1102
1061
self.disable_initiator_tag = GLib.timeout_add(
1103
int((self.expires - now).total_seconds() * 1000),
1104
self.disable)
1062
int(self.timeout.total_seconds() * 1000), self.disable)
1063
# Also start a new checker *right now*.
1064
self.start_checker()
1105
1065
1106
1066
def checker_callback(self, source, condition, connection,
1107
1067
command):
1118
1078
self.last_checker_status = returncode
1119
1079
self.last_checker_signal = None
1120
1080
if self.last_checker_status == 0:
1121
log.info("Checker for %(name)s succeeded", vars(self))
1081
logger.info("Checker for %(name)s succeeded",
1082
vars(self))
1122
1083
self.checked_ok()
1123
1084
else:
1124
log.info("Checker for %(name)s failed", vars(self))
1085
logger.info("Checker for %(name)s failed", vars(self))
1125
1086
else:
1126
1087
self.last_checker_status = -1
1127
1088
self.last_checker_signal = -returncode
1128
log.warning("Checker for %(name)s crashed?", vars(self))
1089
logger.warning("Checker for %(name)s crashed?",
1090
vars(self))
1129
1091
return False
1130
1092
1131
1093
def checked_ok(self):
1150
1112
def need_approval(self):
1151
1113
self.last_approval_request = datetime.datetime.utcnow()
1152
1114
1153
def start_checker(self, start_was_randomized=False):
1115
def start_checker(self):
1154
1116
"""Start a new checker subprocess if one is not running.
1155
1117
1156
1118
If a checker already exists, leave it running and do
1165
1127
# should be.
1166
1128
1167
1129
if self.checker is not None and not self.checker.is_alive():
1168
log.warning("Checker was not alive; joining")
1130
logger.warning("Checker was not alive; joining")
1169
1131
self.checker.join()
1170
1132
self.checker = None
1171
1133
# Start a new checker if needed
1177
1139
try:
1178
1140
command = self.checker_command % escaped_attrs
1179
1141
except TypeError as error:
1180
log.error('Could not format string "%s"',
1181
self.checker_command, exc_info=error)
1142
logger.error('Could not format string "%s"',
1143
self.checker_command,
1144
exc_info=error)
1182
1145
return True # Try again later
1183
1146
self.current_checker_command = command
1184
log.info("Starting checker %r for %s", command, self.name)
1147
logger.info("Starting checker %r for %s", command,
1148
self.name)
1185
1149
# We don't need to redirect stdout and stderr, since
1186
1150
# in normal mode, that is already done by daemon(),
1187
1151
# and in debug mode we don't want to. (Stdin is
1206
1170
GLib.IOChannel.unix_new(pipe[0].fileno()),
1207
1171
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1208
1172
self.checker_callback, pipe[0], command)
1209
if start_was_randomized:
1210
# We were started after a random delay; Schedule a new
1211
# checker to be started an 'interval' from now, and every
1212
# interval from then on.
1213
now = datetime.datetime.utcnow()
1214
self.checker_initiator_tag = GLib.timeout_add(
1215
int(self.interval.total_seconds() * 1000),
1216
self.start_checker)
1217
self.expires = max(self.expires, now + self.interval)
1218
# Don't start a new checker again after same random delay
1219
return False
1220
1173
# Re-run this periodically if run by GLib.timeout_add
1221
1174
return True
1222
1175
1227
1180
self.checker_callback_tag = None
1228
1181
if getattr(self, "checker", None) is None:
1229
1182
return
1230
log.debug("Stopping checker for %(name)s", vars(self))
1183
logger.debug("Stopping checker for %(name)s", vars(self))
1231
1184
self.checker.terminate()
1232
1185
self.checker = None
1233
1186
1260
1213
func._dbus_name = func.__name__
1261
1214
if func._dbus_name.endswith("_dbus_property"):
1262
1215
func._dbus_name = func._dbus_name[:-14]
1263
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1216
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1264
1217
return func
1265
1218
1266
1219
return decorator
1355
1308
1356
1309
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1357
1310
out_signature="s",
1358
path_keyword="object_path",
1359
connection_keyword="connection")
1311
path_keyword='object_path',
1312
connection_keyword='connection')
1360
1313
def Introspect(self, object_path, connection):
1361
1314
"""Overloading of standard D-Bus method.
1362
1315
1411
1364
document.unlink()
1412
1365
except (AttributeError, xml.dom.DOMException,
1413
1366
xml.parsers.expat.ExpatError) as error:
1414
log.error("Failed to override Introspection method",
1415
exc_info=error)
1367
logger.error("Failed to override Introspection method",
1368
exc_info=error)
1416
1369
return xmlstring
1417
1370
1418
1371
1515
1468
1516
1469
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1517
1470
out_signature="s",
1518
path_keyword="object_path",
1519
connection_keyword="connection")
1471
path_keyword='object_path',
1472
connection_keyword='connection')
1520
1473
def Introspect(self, object_path, connection):
1521
1474
"""Overloading of standard D-Bus method.
1522
1475
1578
1531
document.unlink()
1579
1532
except (AttributeError, xml.dom.DOMException,
1580
1533
xml.parsers.expat.ExpatError) as error:
1581
log.error("Failed to override Introspection method",
1582
exc_info=error)
1534
logger.error("Failed to override Introspection method",
1535
exc_info=error)
1583
1536
return xmlstring
1584
1537
1585
1538
1617
1570
1618
1571
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1619
1572
out_signature="s",
1620
path_keyword="object_path",
1621
connection_keyword="connection")
1573
path_keyword='object_path',
1574
connection_keyword='connection')
1622
1575
def Introspect(self, object_path, connection):
1623
1576
"""Overloading of standard D-Bus method.
1624
1577
1649
1602
document.unlink()
1650
1603
except (AttributeError, xml.dom.DOMException,
1651
1604
xml.parsers.expat.ExpatError) as error:
1652
log.error("Failed to override Introspection method",
1653
exc_info=error)
1605
logger.error("Failed to override Introspection method",
1606
exc_info=error)
1654
1607
return xmlstring
1655
1608
1656
1609
2290
2243
class ProxyClient:
2291
2244
def __init__(self, child_pipe, key_id, fpr, address):
2292
2245
self._pipe = child_pipe
2293
self._pipe.send(("init", key_id, fpr, address))
2246
self._pipe.send(('init', key_id, fpr, address))
2294
2247
if not self._pipe.recv():
2295
2248
raise KeyError(key_id or fpr)
2296
2249
2297
2250
def __getattribute__(self, name):
2298
if name == "_pipe":
2251
if name == '_pipe':
2299
2252
return super(ProxyClient, self).__getattribute__(name)
2300
self._pipe.send(("getattr", name))
2253
self._pipe.send(('getattr', name))
2301
2254
data = self._pipe.recv()
2302
if data[0] == "data":
2255
if data[0] == 'data':
2303
2256
return data[1]
2304
if data[0] == "function":
2257
if data[0] == 'function':
2305
2258
2306
2259
def func(*args, **kwargs):
2307
self._pipe.send(("funcall", name, args, kwargs))
2260
self._pipe.send(('funcall', name, args, kwargs))
2308
2261
return self._pipe.recv()[1]
2309
2262
2310
2263
return func
2311
2264
2312
2265
def __setattr__(self, name, value):
2313
if name == "_pipe":
2266
if name == '_pipe':
2314
2267
return super(ProxyClient, self).__setattr__(name, value)
2315
self._pipe.send(("setattr", name, value))
2268
self._pipe.send(('setattr', name, value))
2316
2269
2317
2270
2318
2271
class ClientHandler(socketserver.BaseRequestHandler, object):
2323
2276
2324
2277
def handle(self):
2325
2278
with contextlib.closing(self.server.child_pipe) as child_pipe:
2326
log.info("TCP connection from: %s",
2327
str(self.client_address))
2328
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2279
logger.info("TCP connection from: %s",
2280
str(self.client_address))
2281
logger.debug("Pipe FD: %d",
2282
self.server.child_pipe.fileno())
2329
2283
2330
2284
session = gnutls.ClientSession(self.request)
2331
2285
2332
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2286
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2333
2287
# "+AES-256-CBC", "+SHA1",
2334
2288
# "+COMP-NULL", "+CTYPE-OPENPGP",
2335
2289
# "+DHE-DSS"))
2337
2291
priority = self.server.gnutls_priority
2338
2292
if priority is None:
2339
2293
priority = "NORMAL"
2340
gnutls.priority_set_direct(session,
2341
priority.encode("utf-8"), None)
2294
gnutls.priority_set_direct(session._c_object,
2295
priority.encode("utf-8"),
2296
None)
2342
2297
2343
2298
# Start communication using the Mandos protocol
2344
2299
# Get protocol number
2345
2300
line = self.request.makefile().readline()
2346
log.debug("Protocol version: %r", line)
2301
logger.debug("Protocol version: %r", line)
2347
2302
try:
2348
2303
if int(line.strip().split()[0]) > 1:
2349
2304
raise RuntimeError(line)
2350
2305
except (ValueError, IndexError, RuntimeError) as error:
2351
log.error("Unknown protocol version: %s", error)
2306
logger.error("Unknown protocol version: %s", error)
2352
2307
return
2353
2308
2354
2309
# Start GnuTLS connection
2355
2310
try:
2356
2311
session.handshake()
2357
2312
except gnutls.Error as error:
2358
log.warning("Handshake failed: %s", error)
2313
logger.warning("Handshake failed: %s", error)
2359
2314
# Do not run session.bye() here: the session is not
2360
2315
# established. Just abandon the request.
2361
2316
return
2362
log.debug("Handshake succeeded")
2317
logger.debug("Handshake succeeded")
2363
2318
2364
2319
approval_required = False
2365
2320
try:
2369
2324
key_id = self.key_id(
2370
2325
self.peer_certificate(session))
2371
2326
except (TypeError, gnutls.Error) as error:
2372
log.warning("Bad certificate: %s", error)
2327
logger.warning("Bad certificate: %s", error)
2373
2328
return
2374
log.debug("Key ID: %s",
2375
key_id.decode("utf-8",
2376
errors="replace"))
2329
logger.debug("Key ID: %s", key_id)
2377
2330
2378
2331
else:
2379
2332
key_id = b""
2381
2334
fpr = self.fingerprint(
2382
2335
self.peer_certificate(session))
2383
2336
except (TypeError, gnutls.Error) as error:
2384
log.warning("Bad certificate: %s", error)
2337
logger.warning("Bad certificate: %s", error)
2385
2338
return
2386
log.debug("Fingerprint: %s", fpr)
2339
logger.debug("Fingerprint: %s", fpr)
2387
2340
2388
2341
try:
2389
2342
client = ProxyClient(child_pipe, key_id, fpr,
2398
2351
2399
2352
while True:
2400
2353
if not client.enabled:
2401
log.info("Client %s is disabled", client.name)
2354
logger.info("Client %s is disabled",
2355
client.name)
2402
2356
if self.server.use_dbus:
2403
2357
# Emit D-Bus signal
2404
2358
client.Rejected("Disabled")
2408
2362
# We are approved or approval is disabled
2409
2363
break
2410
2364
elif client.approved is None:
2411
log.info("Client %s needs approval",
2412
client.name)
2365
logger.info("Client %s needs approval",
2366
client.name)
2413
2367
if self.server.use_dbus:
2414
2368
# Emit D-Bus signal
2415
2369
client.NeedApproval(
2416
2370
client.approval_delay.total_seconds()
2417
2371
* 1000, client.approved_by_default)
2418
2372
else:
2419
log.warning("Client %s was not approved",
2420
client.name)
2373
logger.warning("Client %s was not approved",
2374
client.name)
2421
2375
if self.server.use_dbus:
2422
2376
# Emit D-Bus signal
2423
2377
client.Rejected("Denied")
2431
2385
time2 = datetime.datetime.now()
2432
2386
if (time2 - time) >= delay:
2433
2387
if not client.approved_by_default:
2434
log.warning("Client %s timed out while"
2435
" waiting for approval",
2436
client.name)
2388
logger.warning("Client %s timed out while"
2389
" waiting for approval",
2390
client.name)
2437
2391
if self.server.use_dbus:
2438
2392
# Emit D-Bus signal
2439
2393
client.Rejected("Approval timed out")
2446
2400
try:
2447
2401
session.send(client.secret)
2448
2402
except gnutls.Error as error:
2449
log.warning("gnutls send failed", exc_info=error)
2403
logger.warning("gnutls send failed",
2404
exc_info=error)
2450
2405
return
2451
2406
2452
log.info("Sending secret to %s", client.name)
2407
logger.info("Sending secret to %s", client.name)
2453
2408
# bump the timeout using extended_timeout
2454
2409
client.bump_timeout(client.extended_timeout)
2455
2410
if self.server.use_dbus:
2462
2417
try:
2463
2418
session.bye()
2464
2419
except gnutls.Error as error:
2465
log.warning("GnuTLS bye failed", exc_info=error)
2420
logger.warning("GnuTLS bye failed",
2421
exc_info=error)
2466
2422
2467
2423
@staticmethod
2468
2424
def peer_certificate(session):
2469
2425
"Return the peer's certificate as a bytestring"
2470
2426
try:
2471
cert_type = gnutls.certificate_type_get2(
2472
session, gnutls.CTYPE_PEERS)
2427
cert_type = gnutls.certificate_type_get2(session._c_object,
2428
gnutls.CTYPE_PEERS)
2473
2429
except AttributeError:
2474
cert_type = gnutls.certificate_type_get(session)
2430
cert_type = gnutls.certificate_type_get(session._c_object)
2475
2431
if gnutls.has_rawpk:
2476
2432
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2477
2433
else:
2478
2434
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2479
2435
# If not a valid certificate type...
2480
2436
if cert_type not in valid_cert_types:
2481
log.info("Cert type %r not in %r", cert_type,
2482
valid_cert_types)
2437
logger.info("Cert type %r not in %r", cert_type,
2438
valid_cert_types)
2483
2439
# ...return invalid data
2484
2440
return b""
2485
2441
list_size = ctypes.c_uint(1)
2486
2442
cert_list = (gnutls.certificate_get_peers
2487
(session, ctypes.byref(list_size)))
2443
(session._c_object, ctypes.byref(list_size)))
2488
2444
if not bool(cert_list) and list_size.value != 0:
2489
2445
raise gnutls.Error("error getting peer certificate")
2490
2446
if list_size.value == 0:
2512
2468
buf = ctypes.create_string_buffer(32)
2513
2469
buf_len = ctypes.c_size_t(len(buf))
2514
2470
# Get the key ID from the raw public key into the buffer
2515
gnutls.pubkey_get_key_id(
2516
pubkey,
2517
gnutls.KEYID_USE_SHA256,
2518
ctypes.cast(ctypes.byref(buf),
2519
ctypes.POINTER(ctypes.c_ubyte)),
2520
ctypes.byref(buf_len))
2471
gnutls.pubkey_get_key_id(pubkey,
2472
gnutls.KEYID_USE_SHA256,
2473
ctypes.cast(ctypes.byref(buf),
2474
ctypes.POINTER(ctypes.c_ubyte)),
2475
ctypes.byref(buf_len))
2521
2476
# Deinit the certificate
2522
2477
gnutls.pubkey_deinit(pubkey)
2523
2478
2604
2559
2605
2560
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2606
2561
socketserver.TCPServer):
2607
"""IPv6-capable TCP server. Accepts None as address and/or port
2562
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2608
2563
2609
2564
Attributes:
2610
2565
enabled: Boolean; whether this server is activated yet
2661
2616
if SO_BINDTODEVICE is None:
2662
2617
# Fall back to a hard-coded value which seems to be
2663
2618
# common enough.
2664
log.warning("SO_BINDTODEVICE not found, trying 25")
2619
logger.warning("SO_BINDTODEVICE not found, trying 25")
2665
2620
SO_BINDTODEVICE = 25
2666
2621
try:
2667
2622
self.socket.setsockopt(
2669
2624
(self.interface + "\0").encode("utf-8"))
2670
2625
except socket.error as error:
2671
2626
if error.errno == errno.EPERM:
2672
log.error("No permission to bind to interface %s",
2673
self.interface)
2627
logger.error("No permission to bind to"
2628
" interface %s", self.interface)
2674
2629
elif error.errno == errno.ENOPROTOOPT:
2675
log.error("SO_BINDTODEVICE not available; cannot"
2676
" bind to interface %s", self.interface)
2630
logger.error("SO_BINDTODEVICE not available;"
2631
" cannot bind to interface %s",
2632
self.interface)
2677
2633
elif error.errno == errno.ENODEV:
2678
log.error("Interface %s does not exist, cannot"
2679
" bind", self.interface)
2634
logger.error("Interface %s does not exist,"
2635
" cannot bind", self.interface)
2680
2636
else:
2681
2637
raise
2682
2638
# Only bind(2) the socket if we really need to.
2761
2717
request = parent_pipe.recv()
2762
2718
command = request[0]
2763
2719
2764
if command == "init":
2720
if command == 'init':
2765
2721
key_id = request[1].decode("ascii")
2766
2722
fpr = request[2].decode("ascii")
2767
2723
address = request[3]
2768
2724
2769
2725
for c in self.clients.values():
2770
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2771
"27AE41E4649B934CA495991B7852B855"):
2726
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2772
2727
continue
2773
2728
if key_id and c.key_id == key_id:
2774
2729
client = c
2777
2732
client = c
2778
2733
break
2779
2734
else:
2780
log.info("Client not found for key ID: %s, address:"
2781
" %s", key_id or fpr, address)
2735
logger.info("Client not found for key ID: %s, address"
2736
": %s", key_id or fpr, address)
2782
2737
if self.use_dbus:
2783
2738
# Emit D-Bus signal
2784
2739
mandos_dbus_service.ClientNotFound(key_id or fpr,
2797
2752
# remove the old hook in favor of the new above hook on
2798
2753
# same fileno
2799
2754
return False
2800
if command == "funcall":
2755
if command == 'funcall':
2801
2756
funcname = request[1]
2802
2757
args = request[2]
2803
2758
kwargs = request[3]
2804
2759
2805
parent_pipe.send(("data", getattr(client_object,
2760
parent_pipe.send(('data', getattr(client_object,
2806
2761
funcname)(*args,
2807
2762
**kwargs)))
2808
2763
2809
if command == "getattr":
2764
if command == 'getattr':
2810
2765
attrname = request[1]
2811
2766
if isinstance(client_object.__getattribute__(attrname),
2812
2767
collections.abc.Callable):
2813
parent_pipe.send(("function", ))
2768
parent_pipe.send(('function', ))
2814
2769
else:
2815
2770
parent_pipe.send((
2816
"data", client_object.__getattribute__(attrname)))
2771
'data', client_object.__getattribute__(attrname)))
2817
2772
2818
if command == "setattr":
2773
if command == 'setattr':
2819
2774
attrname = request[1]
2820
2775
value = request[2]
2821
2776
setattr(client_object, attrname, value)
2826
2781
def rfc3339_duration_to_delta(duration):
2827
2782
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2828
2783
2829
>>> timedelta = datetime.timedelta
2830
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2831
True
2832
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2833
True
2834
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2835
True
2836
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2837
True
2838
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2839
True
2840
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2841
True
2842
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2843
True
2844
>>> del timedelta
2784
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2785
True
2786
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2787
True
2788
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2789
True
2790
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2791
True
2792
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2793
True
2794
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2795
True
2796
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2797
True
2845
2798
"""
2846
2799
2847
2800
# Parsing an RFC 3339 duration with regular expressions is not
2927
2880
def string_to_delta(interval):
2928
2881
"""Parse a string and return a datetime.timedelta
2929
2882
2930
>>> string_to_delta("7d") == datetime.timedelta(7)
2931
True
2932
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2933
True
2934
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2935
True
2936
>>> string_to_delta("24h") == datetime.timedelta(1)
2937
True
2938
>>> string_to_delta("1w") == datetime.timedelta(7)
2939
True
2940
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2883
>>> string_to_delta('7d') == datetime.timedelta(7)
2884
True
2885
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2886
True
2887
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2888
True
2889
>>> string_to_delta('24h') == datetime.timedelta(1)
2890
True
2891
>>> string_to_delta('1w') == datetime.timedelta(7)
2892
True
2893
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2941
2894
True
2942
2895
"""
2943
2896
3147
3100
3148
3101
if server_settings["servicename"] != "Mandos":
3149
3102
syslogger.setFormatter(
3150
logging.Formatter("Mandos ({}) [%(process)d]:"
3151
" %(levelname)s: %(message)s".format(
3103
logging.Formatter('Mandos ({}) [%(process)d]:'
3104
' %(levelname)s: %(message)s'.format(
3152
3105
server_settings["servicename"])))
3153
3106
3154
3107
# Parse config file with clients
3178
3131
try:
3179
3132
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3180
3133
except IOError as e:
3181
log.error("Could not open file %r", pidfilename,
3182
exc_info=e)
3134
logger.error("Could not open file %r", pidfilename,
3135
exc_info=e)
3183
3136
3184
3137
for name, group in (("_mandos", "_mandos"),
3185
3138
("mandos", "mandos"),
3196
3149
try:
3197
3150
os.setgid(gid)
3198
3151
os.setuid(uid)
3199
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3152
if debug:
3153
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3154
gid))
3200
3155
except OSError as error:
3201
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3202
os.strerror(error.errno))
3156
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3157
.format(uid, gid, os.strerror(error.errno)))
3203
3158
if error.errno != errno.EPERM:
3204
3159
raise
3205
3160
3212
3167
3213
3168
@gnutls.log_func
3214
3169
def debug_gnutls(level, string):
3215
log.debug("GnuTLS: %s",
3216
string[:-1].decode("utf-8", errors="replace"))
3170
logger.debug("GnuTLS: %s", string[:-1])
3217
3171
3218
3172
gnutls.global_set_log_function(debug_gnutls)
3219
3173
3248
3202
"se.bsnet.fukt.Mandos", bus,
3249
3203
do_not_queue=True)
3250
3204
except dbus.exceptions.DBusException as e:
3251
log.error("Disabling D-Bus:", exc_info=e)
3205
logger.error("Disabling D-Bus:", exc_info=e)
3252
3206
use_dbus = False
3253
3207
server_settings["use_dbus"] = False
3254
3208
tcp_server.use_dbus = False
3339
3293
os.remove(stored_state_path)
3340
3294
except IOError as e:
3341
3295
if e.errno == errno.ENOENT:
3342
log.warning("Could not load persistent state:"
3343
" %s", os.strerror(e.errno))
3296
logger.warning("Could not load persistent state:"
3297
" {}".format(os.strerror(e.errno)))
3344
3298
else:
3345
log.critical("Could not load persistent state:",
3346
exc_info=e)
3299
logger.critical("Could not load persistent state:",
3300
exc_info=e)
3347
3301
raise
3348
3302
except EOFError as e:
3349
log.warning("Could not load persistent state: EOFError:",
3350
exc_info=e)
3303
logger.warning("Could not load persistent state: "
3304
"EOFError:",
3305
exc_info=e)
3351
3306
3352
3307
with PGPEngine() as pgp:
3353
3308
for client_name, client in clients_data.items():
3380
3335
if client["enabled"]:
3381
3336
if datetime.datetime.utcnow() >= client["expires"]:
3382
3337
if not client["last_checked_ok"]:
3383
log.warning("disabling client %s - Client"
3384
" never performed a successful"
3385
" checker", client_name)
3338
logger.warning(
3339
"disabling client {} - Client never "
3340
"performed a successful checker".format(
3341
client_name))
3386
3342
client["enabled"] = False
3387
3343
elif client["last_checker_status"] != 0:
3388
log.warning("disabling client %s - Client"
3389
" last checker failed with error"
3390
" code %s", client_name,
3391
client["last_checker_status"])
3344
logger.warning(
3345
"disabling client {} - Client last"
3346
" checker failed with error code"
3347
" {}".format(
3348
client_name,
3349
client["last_checker_status"]))
3392
3350
client["enabled"] = False
3393
3351
else:
3394
3352
client["expires"] = (
3395
3353
datetime.datetime.utcnow()
3396
3354
+ client["timeout"])
3397
log.debug("Last checker succeeded, keeping %s"
3398
" enabled", client_name)
3355
logger.debug("Last checker succeeded,"
3356
" keeping {} enabled".format(
3357
client_name))
3399
3358
try:
3400
3359
client["secret"] = pgp.decrypt(
3401
3360
client["encrypted_secret"],
3402
3361
client_settings[client_name]["secret"])
3403
3362
except PGPError:
3404
3363
# If decryption fails, we use secret from new settings
3405
log.debug("Failed to decrypt %s old secret",
3406
client_name)
3364
logger.debug("Failed to decrypt {} old secret".format(
3365
client_name))
3407
3366
client["secret"] = (client_settings[client_name]
3408
3367
["secret"])
3409
3368
3423
3382
server_settings=server_settings)
3424
3383
3425
3384
if not tcp_server.clients:
3426
log.warning("No clients defined")
3385
logger.warning("No clients defined")
3427
3386
3428
3387
if not foreground:
3429
3388
if pidfile is not None:
3432
3391
with pidfile:
3433
3392
print(pid, file=pidfile)
3434
3393
except IOError:
3435
log.error("Could not write to file %r with PID %d",
3436
pidfilename, pid)
3394
logger.error("Could not write to file %r with PID %d",
3395
pidfilename, pid)
3437
3396
del pidfile
3438
3397
del pidfilename
3439
3398
3589
3548
3590
3549
try:
3591
3550
with tempfile.NamedTemporaryFile(
3592
mode="wb",
3551
mode='wb',
3593
3552
suffix=".pickle",
3594
prefix="clients-",
3553
prefix='clients-',
3595
3554
dir=os.path.dirname(stored_state_path),
3596
3555
delete=False) as stored_state:
3597
3556
pickle.dump((clients, client_settings), stored_state,
3605
3564
except NameError:
3606
3565
pass
3607
3566
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3608
log.warning("Could not save persistent state: %s",
3609
os.strerror(e.errno))
3567
logger.warning("Could not save persistent state: {}"
3568
.format(os.strerror(e.errno)))
3610
3569
else:
3611
log.warning("Could not save persistent state:",
3612
exc_info=e)
3570
logger.warning("Could not save persistent state:",
3571
exc_info=e)
3613
3572
raise
3614
3573
3615
3574
# Delete all clients, and settings from config
3632
3591
mandos_dbus_service.client_added_signal(client)
3633
3592
# Need to initiate checking of clients
3634
3593
if client.enabled:
3635
client.init_checker(randomize_start=True)
3594
client.init_checker()
3636
3595
3637
3596
tcp_server.enable()
3638
3597
tcp_server.server_activate()
3641
3600
if zeroconf:
3642
3601
service.port = tcp_server.socket.getsockname()[1]
3643
3602
if use_ipv6:
3644
log.info("Now listening on address %r, port %d, flowinfo %d,"
3645
" scope_id %d", *tcp_server.socket.getsockname())
3603
logger.info("Now listening on address %r, port %d,"
3604
" flowinfo %d, scope_id %d",
3605
*tcp_server.socket.getsockname())
3646
3606
else: # IPv4
3647
log.info("Now listening on address %r, port %d",
3648
*tcp_server.socket.getsockname())
3607
logger.info("Now listening on address %r, port %d",
3608
*tcp_server.socket.getsockname())
3649
3609
3650
3610
# service.interface = tcp_server.socket.getsockname()[3]
3651
3611
3655
3615
try:
3656
3616
service.activate()
3657
3617
except dbus.exceptions.DBusException as error:
3658
log.critical("D-Bus Exception", exc_info=error)
3618
logger.critical("D-Bus Exception", exc_info=error)
3659
3619
cleanup()
3660
3620
sys.exit(1)
3661
3621
# End of Avahi example code
3666
3626
lambda *args, **kwargs: (tcp_server.handle_request
3667
3627
(*args[2:], **kwargs) or True))
3668
3628
3669
log.debug("Starting main loop")
3629
logger.debug("Starting main loop")
3670
3630
main_loop.run()
3671
3631
except AvahiError as error:
3672
log.critical("Avahi Error", exc_info=error)
3632
logger.critical("Avahi Error", exc_info=error)
3673
3633
cleanup()
3674
3634
sys.exit(1)
3675
3635
except KeyboardInterrupt:
3676
3636
if debug:
3677
3637
print("", file=sys.stderr)
3678
log.debug("Server received KeyboardInterrupt")
3679
log.debug("Server exiting")
3638
logger.debug("Server received KeyboardInterrupt")
3639
logger.debug("Server exiting")
3680
3640
# Must run before the D-Bus bus name gets deregistered
3681
3641
cleanup()
3682
3642
3683
3643
3684
def parse_test_args():
3685
# type: () -> argparse.Namespace
3644
def should_only_run_tests():
3686
3645
parser = argparse.ArgumentParser(add_help=False)
3687
parser.add_argument("--check", action="store_true")
3688
parser.add_argument("--prefix", )
3646
parser.add_argument("--check", action='store_true')
3689
3647
args, unknown_args = parser.parse_known_args()
3690
if args.check:
3691
# Remove test options from sys.argv
3648
run_tests = args.check
3649
if run_tests:
3650
# Remove --check argument from sys.argv
3692
3651
sys.argv[1:] = unknown_args
3693
return args
3652
return run_tests
3694
3653
3695
3654
# Add all tests from doctest strings
3696
3655
def load_tests(loader, tests, none):
3698
3657
tests.addTests(doctest.DocTestSuite())
3699
3658
return tests
3700
3659
3701
if __name__ == "__main__":
3702
options = parse_test_args()
3660
if __name__ == '__main__':
3703
3661
try:
3704
if options.check:
3705
extra_test_prefix = options.prefix
3706
if extra_test_prefix is not None:
3707
if not (unittest.main(argv=[""], exit=False)
3708
.result.wasSuccessful()):
3709
sys.exit(1)
3710
class ExtraTestLoader(unittest.TestLoader):
3711
testMethodPrefix = extra_test_prefix
3712
# Call using ./scriptname --test [--verbose]
3713
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3714
else:
3715
unittest.main(argv=[""])
3662
if should_only_run_tests():
3663
# Call using ./mandos --check [--verbose]
3664
unittest.main()
3716
3665
else:
3717
3666
main()
3718
3667
finally:
3719
3668
logging.shutdown()
3720
3721
# Local Variables:
3722
# run-tests:
3723
# (lambda (&optional extra)
3724
# (if (not (funcall run-tests-in-test-buffer default-directory
3725
# extra))
3726
# (funcall show-test-buffer-in-test-window)
3727
# (funcall remove-test-window)
3728
# (if extra (message "Extra tests run successfully!"))))
3729
# run-tests-in-test-buffer:
3730
# (lambda (dir &optional extra)
3731
# (with-current-buffer (get-buffer-create "*Test*")
3732
# (setq buffer-read-only nil
3733
# default-directory dir)
3734
# (erase-buffer)
3735
# (compilation-mode))
3736
# (let ((process-result
3737
# (let ((inhibit-read-only t))
3738
# (process-file-shell-command
3739
# (funcall get-command-line extra) nil "*Test*"))))
3740
# (and (numberp process-result)
3741
# (= process-result 0))))
3742
# get-command-line:
3743
# (lambda (&optional extra)
3744
# (let ((quoted-script
3745
# (shell-quote-argument (funcall get-script-name))))
3746
# (format
3747
# (concat "%s --check" (if extra " --prefix=atest" ""))
3748
# quoted-script)))
3749
# get-script-name:
3750
# (lambda ()
3751
# (if (fboundp 'file-local-name)
3752
# (file-local-name (buffer-file-name))
3753
# (or (file-remote-p (buffer-file-name) 'localname)
3754
# (buffer-file-name))))
3755
# remove-test-window:
3756
# (lambda ()
3757
# (let ((test-window (get-buffer-window "*Test*")))
3758
# (if test-window (delete-window test-window))))
3759
# show-test-buffer-in-test-window:
3760
# (lambda ()
3761
# (when (not (get-buffer-window-list "*Test*"))
3762
# (setq next-error-last-buffer (get-buffer "*Test*"))
3763
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3764
# (display-buffer-overriding-action
3765
# `((display-buffer-in-side-window) (side . ,side)
3766
# (window-height . fit-window-to-buffer)
3767
# (window-width . fit-window-to-buffer))))
3768
# (display-buffer "*Test*"))))
3769
# eval:
3770
# (progn
3771
# (let* ((run-extra-tests (lambda () (interactive)
3772
# (funcall run-tests t)))
3773
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3774
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3775
# (setq minor-mode-overriding-map-alist
3776
# (cons `(run-tests . ,outer-keymap)
3777
# minor-mode-overriding-map-alist)))
3778
# (add-hook 'after-save-hook run-tests 90 t))
3779
# End:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0