/mandos/trunk : revision 1250

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This file is part of Mandos.

18

#

78

import collections

79

import codecs

80

import unittest

81

import random

82

import shlex

81

83

82

84

import dbus

83

85

import dbus.service

93

95

__metaclass__ = type

94

96

str = unicode

95

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

96

113

# Show warnings by default

97

114

if not sys.warnoptions:

98

115

import warnings

126

143

if sys.version_info < (3, 2):

127

144

configparser.Configparser = configparser.SafeConfigParser

128

145

129

version = "1.8.9"

146

version = "1.8.14"

130

147

stored_state_file = "clients.pickle"

131

148

132

149

logger = logging.getLogger()

172

189

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

173

190

address="/dev/log"))

174

191

syslogger.setFormatter(logging.Formatter

175

('Mandos [%(process)d]: %(levelname)s:'

176

' %(message)s'))

192

("Mandos [%(process)d]: %(levelname)s:"

193

" %(message)s"))

177

194

logger.addHandler(syslogger)

178

195

179

196

if debug:

180

197

console = logging.StreamHandler()

181

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

182

' [%(process)d]:'

183

' %(levelname)s:'

184

' %(message)s'))

198

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

199

" [%(process)d]:"

200

" %(levelname)s:"

201

" %(message)s"))

185

202

logger.addHandler(console)

186

203

logger.setLevel(level)

187

204

207

224

except OSError as e:

208

225

if e.errno != errno.ENOENT:

209

226

raise

210

self.gnupgargs = ['--batch',

211

'--homedir', self.tempdir,

212

'--force-mdc',

213

'--quiet']

227

self.gnupgargs = ["--batch",

228

"--homedir", self.tempdir,

229

"--force-mdc",

230

"--quiet"]

214

231

# Only GPG version 1 has the --no-use-agent option.

215

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

216

233

self.gnupgargs.append("--no-use-agent")

255

272

dir=self.tempdir) as passfile:

256

273

passfile.write(passphrase)

257

274

passfile.flush()

258

proc = subprocess.Popen([self.gpg, '--symmetric',

259

'--passphrase-file',

275

proc = subprocess.Popen([self.gpg, "--symmetric",

276

"--passphrase-file",

260

277

passfile.name]

261

278

+ self.gnupgargs,

262

279

stdin=subprocess.PIPE,

273

290

dir=self.tempdir) as passfile:

274

291

passfile.write(passphrase)

275

292

passfile.flush()

276

proc = subprocess.Popen([self.gpg, '--decrypt',

277

'--passphrase-file',

293

proc = subprocess.Popen([self.gpg, "--decrypt",

294

"--passphrase-file",

278

295

passfile.name]

279

296

+ self.gnupgargs,

280

297

stdin=subprocess.PIPE,

333

350

Attributes:

334

351

interface: integer; avahi.IF_UNSPEC or an interface index.

335

352

Used to optionally bind to the specified interface.

336

name: string; Example: 'Mandos'

337

type: string; Example: '_mandos._tcp'.

353

name: string; Example: "Mandos"

354

type: string; Example: "_mandos._tcp".

338

355

See <https://www.iana.org/assignments/service-names-port-numbers>

339

356

port: integer; what port to announce

340

357

TXT: list of strings; TXT record for the service

418

435

avahi.DBUS_INTERFACE_ENTRY_GROUP)

419

436

self.entry_group_state_changed_match = (

420

437

self.group.connect_to_signal(

421

'StateChanged', self.entry_group_state_changed))

438

"StateChanged", self.entry_group_state_changed))

422

439

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

423

440

self.name, self.type)

424

441

self.group.AddService(

507

524

class AvahiServiceToSyslog(AvahiService):

508

525

def rename(self, *args, **kwargs):

509

526

"""Add the new name to the syslog messages"""

510

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

527

ret = super(AvahiServiceToSyslog, self).rename(*args,

528

**kwargs)

511

529

syslogger.setFormatter(logging.Formatter(

512

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

530

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

513

531

.format(self.name)))

514

532

return ret

515

533

545

563

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

546

564

547

565

# Types

548

class session_int(ctypes.Structure):

566

class _session_int(ctypes.Structure):

549

567

_fields_ = []

550

session_t = ctypes.POINTER(session_int)

568

session_t = ctypes.POINTER(_session_int)

551

569

552

570

class certificate_credentials_st(ctypes.Structure):

553

571

_fields_ = []

556

574

certificate_type_t = ctypes.c_int

557

575

558

576

class datum_t(ctypes.Structure):

559

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

560

('size', ctypes.c_uint)]

577

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

578

("size", ctypes.c_uint)]

561

579

562

class openpgp_crt_int(ctypes.Structure):

580

class _openpgp_crt_int(ctypes.Structure):

563

581

_fields_ = []

564

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

582

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

565

583

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

566

584

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

567

585

credentials_type_t = ctypes.c_int

576

594

# gnutls.strerror()

577

595

self.code = code

578

596

if message is None and code is not None:

579

message = gnutls.strerror(code)

597

message = gnutls.strerror(code).decode(

598

"utf-8", errors="replace")

580

599

return super(gnutls.Error, self).__init__(

581

600

message, *args)

582

601

583

602

class CertificateSecurityError(Error):

584

603

pass

585

604

605

class PointerTo:

606

def __init__(self, cls):

607

self.cls = cls

608

609

def from_param(self, obj):

610

if not isinstance(obj, self.cls):

611

raise TypeError("Not of type {}: {!r}"

612

.format(self.cls.__name__, obj))

613

return ctypes.byref(obj.from_param(obj))

614

615

class CastToVoidPointer:

616

def __init__(self, cls):

617

self.cls = cls

618

619

def from_param(self, obj):

620

if not isinstance(obj, self.cls):

621

raise TypeError("Not of type {}: {!r}"

622

.format(self.cls.__name__, obj))

623

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

624

625

class With_from_param:

626

@classmethod

627

def from_param(cls, obj):

628

return obj._as_parameter_

629

586

630

# Classes

587

class Credentials:

631

class Credentials(With_from_param):

588

632

def __init__(self):

589

self._c_object = gnutls.certificate_credentials_t()

590

gnutls.certificate_allocate_credentials(

591

ctypes.byref(self._c_object))

633

self._as_parameter_ = gnutls.certificate_credentials_t()

634

gnutls.certificate_allocate_credentials(self)

592

635

self.type = gnutls.CRD_CERTIFICATE

593

636

594

637

def __del__(self):

595

gnutls.certificate_free_credentials(self._c_object)

638

gnutls.certificate_free_credentials(self)

596

639

597

class ClientSession:

640

class ClientSession(With_from_param):

598

641

def __init__(self, socket, credentials=None):

599

self._c_object = gnutls.session_t()

642

self._as_parameter_ = gnutls.session_t()

600

643

gnutls_flags = gnutls.CLIENT

601

644

if gnutls.check_version(b"3.5.6"):

602

645

gnutls_flags |= gnutls.NO_TICKETS

603

646

if gnutls.has_rawpk:

604

647

gnutls_flags |= gnutls.ENABLE_RAWPK

605

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

648

gnutls.init(self, gnutls_flags)

606

649

del gnutls_flags

607

gnutls.set_default_priority(self._c_object)

608

gnutls.transport_set_ptr(self._c_object, socket.fileno())

609

gnutls.handshake_set_private_extensions(self._c_object,

610

True)

650

gnutls.set_default_priority(self)

651

gnutls.transport_set_ptr(self, socket.fileno())

652

gnutls.handshake_set_private_extensions(self, True)

611

653

self.socket = socket

612

654

if credentials is None:

613

655

credentials = gnutls.Credentials()

614

gnutls.credentials_set(self._c_object, credentials.type,

615

ctypes.cast(credentials._c_object,

616

ctypes.c_void_p))

656

gnutls.credentials_set(self, credentials.type,

657

credentials)

617

658

self.credentials = credentials

618

659

619

660

def __del__(self):

620

gnutls.deinit(self._c_object)

661

gnutls.deinit(self)

621

662

622

663

def handshake(self):

623

return gnutls.handshake(self._c_object)

664

return gnutls.handshake(self)

624

665

625

666

def send(self, data):

626

667

data = bytes(data)

627

668

data_len = len(data)

628

669

while data_len > 0:

629

data_len -= gnutls.record_send(self._c_object,

630

data[-data_len:],

670

data_len -= gnutls.record_send(self, data[-data_len:],

631

671

data_len)

632

672

633

673

def bye(self):

634

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

674

return gnutls.bye(self, gnutls.SHUT_RDWR)

635

675

636

676

# Error handling functions

637

677

def _error_code(result):

638

678

"""A function to raise exceptions on errors, suitable

639

for the 'restype' attribute on ctypes functions"""

640

if result >= 0:

679

for the "restype" attribute on ctypes functions"""

680

if result >= gnutls.E_SUCCESS:

641

681

return result

642

682

if result == gnutls.E_NO_CERTIFICATE_FOUND:

643

683

raise gnutls.CertificateSecurityError(code=result)

644

684

raise gnutls.Error(code=result)

645

685

646

def _retry_on_error(result, func, arguments):

686

def _retry_on_error(result, func, arguments,

687

_error_code=_error_code):

647

688

"""A function to retry on some errors, suitable

648

for the 'errcheck' attribute on ctypes functions"""

649

while result < 0:

689

for the "errcheck" attribute on ctypes functions"""

690

while result < gnutls.E_SUCCESS:

650

691

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

651

692

return _error_code(result)

652

693

result = func(*arguments)

657

698

658

699

# Functions

659

700

priority_set_direct = _library.gnutls_priority_set_direct

660

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

701

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

661

702

ctypes.POINTER(ctypes.c_char_p)]

662

703

priority_set_direct.restype = _error_code

663

704

664

705

init = _library.gnutls_init

665

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

706

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

666

707

init.restype = _error_code

667

708

668

709

set_default_priority = _library.gnutls_set_default_priority

669

set_default_priority.argtypes = [session_t]

710

set_default_priority.argtypes = [ClientSession]

670

711

set_default_priority.restype = _error_code

671

712

672

713

record_send = _library.gnutls_record_send

673

record_send.argtypes = [session_t, ctypes.c_void_p,

714

record_send.argtypes = [ClientSession, ctypes.c_void_p,

674

715

ctypes.c_size_t]

675

716

record_send.restype = ctypes.c_ssize_t

676

717

record_send.errcheck = _retry_on_error

678

719

certificate_allocate_credentials = (

679

720

_library.gnutls_certificate_allocate_credentials)

680

721

certificate_allocate_credentials.argtypes = [

681

ctypes.POINTER(certificate_credentials_t)]

722

PointerTo(Credentials)]

682

723

certificate_allocate_credentials.restype = _error_code

683

724

684

725

certificate_free_credentials = (

685

726

_library.gnutls_certificate_free_credentials)

686

certificate_free_credentials.argtypes = [

687

certificate_credentials_t]

727

certificate_free_credentials.argtypes = [Credentials]

688

728

certificate_free_credentials.restype = None

689

729

690

730

handshake_set_private_extensions = (

691

731

_library.gnutls_handshake_set_private_extensions)

692

handshake_set_private_extensions.argtypes = [session_t,

732

handshake_set_private_extensions.argtypes = [ClientSession,

693

733

ctypes.c_int]

694

734

handshake_set_private_extensions.restype = None

695

735

696

736

credentials_set = _library.gnutls_credentials_set

697

credentials_set.argtypes = [session_t, credentials_type_t,

698

ctypes.c_void_p]

737

credentials_set.argtypes = [ClientSession, credentials_type_t,

738

CastToVoidPointer(Credentials)]

699

739

credentials_set.restype = _error_code

700

740

701

741

strerror = _library.gnutls_strerror

703

743

strerror.restype = ctypes.c_char_p

704

744

705

745

certificate_type_get = _library.gnutls_certificate_type_get

706

certificate_type_get.argtypes = [session_t]

746

certificate_type_get.argtypes = [ClientSession]

707

747

certificate_type_get.restype = _error_code

708

748

709

749

certificate_get_peers = _library.gnutls_certificate_get_peers

710

certificate_get_peers.argtypes = [session_t,

750

certificate_get_peers.argtypes = [ClientSession,

711

751

ctypes.POINTER(ctypes.c_uint)]

712

752

certificate_get_peers.restype = ctypes.POINTER(datum_t)

713

753

720

760

global_set_log_function.restype = None

721

761

722

762

deinit = _library.gnutls_deinit

723

deinit.argtypes = [session_t]

763

deinit.argtypes = [ClientSession]

724

764

deinit.restype = None

725

765

726

766

handshake = _library.gnutls_handshake

727

handshake.argtypes = [session_t]

728

handshake.restype = _error_code

767

handshake.argtypes = [ClientSession]

768

handshake.restype = ctypes.c_int

729

769

handshake.errcheck = _retry_on_error

730

770

731

771

transport_set_ptr = _library.gnutls_transport_set_ptr

732

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

772

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

733

773

transport_set_ptr.restype = None

734

774

735

775

bye = _library.gnutls_bye

736

bye.argtypes = [session_t, close_request_t]

737

bye.restype = _error_code

776

bye.argtypes = [ClientSession, close_request_t]

777

bye.restype = ctypes.c_int

738

778

bye.errcheck = _retry_on_error

739

779

740

780

check_version = _library.gnutls_check_version

757

797

758

798

x509_crt_fmt_t = ctypes.c_int

759

799

760

# All the function declarations below are from gnutls/abstract.h

800

# All the function declarations below are from

801

# gnutls/abstract.h

761

802

pubkey_init = _library.gnutls_pubkey_init

762

803

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

763

804

pubkey_init.restype = _error_code

777

818

pubkey_deinit.argtypes = [pubkey_t]

778

819

pubkey_deinit.restype = None

779

820

else:

780

# All the function declarations below are from gnutls/openpgp.h

821

# All the function declarations below are from

822

# gnutls/openpgp.h

781

823

782

824

openpgp_crt_init = _library.gnutls_openpgp_crt_init

783

825

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

789

831

openpgp_crt_fmt_t]

790

832

openpgp_crt_import.restype = _error_code

791

833

792

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

793

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

794

ctypes.POINTER(ctypes.c_uint)]

834

openpgp_crt_verify_self = \

835

_library.gnutls_openpgp_crt_verify_self

836

openpgp_crt_verify_self.argtypes = [

837

openpgp_crt_t,

838

ctypes.c_uint,

839

ctypes.POINTER(ctypes.c_uint),

840

]

795

841

openpgp_crt_verify_self.restype = _error_code

796

842

797

843

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

808

854

809

855

if check_version(b"3.6.4"):

810

856

certificate_type_get2 = _library.gnutls_certificate_type_get2

811

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

857

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

812

858

certificate_type_get2.restype = _error_code

813

859

814

860

# Remove non-public functions

830

876

"""A representation of a client host served by this server.

831

877

832

878

Attributes:

833

approved: bool(); 'None' if not yet approved/disapproved

879

approved: bool(); None if not yet approved/disapproved

834

880

approval_delay: datetime.timedelta(); Time to wait for approval

835

881

approval_duration: datetime.timedelta(); Duration of one approval

836

882

checker: multiprocessing.Process(); a running checker process used

837

to see if the client lives. 'None' if no process is

883

to see if the client lives. None if no process is

838

884

running.

839

885

checker_callback_tag: a GLib event source tag, or None

840

886

checker_command: string; External command which is run to check

1035

1081

if self.checker_initiator_tag is not None:

1036

1082

GLib.source_remove(self.checker_initiator_tag)

1037

1083

self.checker_initiator_tag = GLib.timeout_add(

1038

int(self.interval.total_seconds() * 1000),

1084

random.randrange(int(self.interval.total_seconds() * 1000

1085

+ 1)),

1039

1086

self.start_checker)

1040

1087

# Schedule a disable() when 'timeout' has passed

1041

1088

if self.disable_initiator_tag is not None:

1116

1163

if self.checker is None:

1117

1164

# Escape attributes for the shell

1118

1165

escaped_attrs = {

1119

attr: re.escape(str(getattr(self, attr)))

1166

attr: shlex.quote(str(getattr(self, attr)))

1120

1167

for attr in self.runtime_expansions}

1121

1168

try:

1122

1169

command = self.checker_command % escaped_attrs

1195

1242

func._dbus_name = func.__name__

1196

1243

if func._dbus_name.endswith("_dbus_property"):

1197

1244

func._dbus_name = func._dbus_name[:-14]

1198

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1245

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

1199

1246

return func

1200

1247

1201

1248

return decorator

1290

1337

1291

1338

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1292

1339

out_signature="s",

1293

path_keyword='object_path',

1294

connection_keyword='connection')

1340

path_keyword="object_path",

1341

connection_keyword="connection")

1295

1342

def Introspect(self, object_path, connection):

1296

1343

"""Overloading of standard D-Bus method.

1297

1344

1450

1497

1451

1498

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1452

1499

out_signature="s",

1453

path_keyword='object_path',

1454

connection_keyword='connection')

1500

path_keyword="object_path",

1501

connection_keyword="connection")

1455

1502

def Introspect(self, object_path, connection):

1456

1503

"""Overloading of standard D-Bus method.

1457

1504

1552

1599

1553

1600

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1554

1601

out_signature="s",

1555

path_keyword='object_path',

1556

connection_keyword='connection')

1602

path_keyword="object_path",

1603

connection_keyword="connection")

1557

1604

def Introspect(self, object_path, connection):

1558

1605

"""Overloading of standard D-Bus method.

1559

1606

2225

2272

class ProxyClient:

2226

2273

def __init__(self, child_pipe, key_id, fpr, address):

2227

2274

self._pipe = child_pipe

2228

self._pipe.send(('init', key_id, fpr, address))

2275

self._pipe.send(("init", key_id, fpr, address))

2229

2276

if not self._pipe.recv():

2230

2277

raise KeyError(key_id or fpr)

2231

2278

2232

2279

def __getattribute__(self, name):

2233

if name == '_pipe':

2280

if name == "_pipe":

2234

2281

return super(ProxyClient, self).__getattribute__(name)

2235

self._pipe.send(('getattr', name))

2282

self._pipe.send(("getattr", name))

2236

2283

data = self._pipe.recv()

2237

if data[0] == 'data':

2284

if data[0] == "data":

2238

2285

return data[1]

2239

if data[0] == 'function':

2286

if data[0] == "function":

2240

2287

2241

2288

def func(*args, **kwargs):

2242

self._pipe.send(('funcall', name, args, kwargs))

2289

self._pipe.send(("funcall", name, args, kwargs))

2243

2290

return self._pipe.recv()[1]

2244

2291

2245

2292

return func

2246

2293

2247

2294

def __setattr__(self, name, value):

2248

if name == '_pipe':

2295

if name == "_pipe":

2249

2296

return super(ProxyClient, self).__setattr__(name, value)

2250

self._pipe.send(('setattr', name, value))

2297

self._pipe.send(("setattr", name, value))

2251

2298

2252

2299

2253

2300

class ClientHandler(socketserver.BaseRequestHandler, object):

2265

2312

2266

2313

session = gnutls.ClientSession(self.request)

2267

2314

2268

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2315

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2269

2316

# "+AES-256-CBC", "+SHA1",

2270

2317

# "+COMP-NULL", "+CTYPE-OPENPGP",

2271

2318

# "+DHE-DSS"))

2273

2320

priority = self.server.gnutls_priority

2274

2321

if priority is None:

2275

2322

priority = "NORMAL"

2276

gnutls.priority_set_direct(session._c_object,

2277

priority.encode("utf-8"),

2278

None)

2323

gnutls.priority_set_direct(session,

2324

priority.encode("utf-8"), None)

2279

2325

2280

2326

# Start communication using the Mandos protocol

2281

2327

# Get protocol number

2308

2354

except (TypeError, gnutls.Error) as error:

2309

2355

logger.warning("Bad certificate: %s", error)

2310

2356

return

2311

logger.debug("Key ID: %s", key_id)

2357

logger.debug("Key ID: %s",

2358

key_id.decode("utf-8",

2359

errors="replace"))

2312

2360

2313

2361

else:

2314

2362

key_id = b""

2406

2454

def peer_certificate(session):

2407

2455

"Return the peer's certificate as a bytestring"

2408

2456

try:

2409

cert_type = gnutls.certificate_type_get2(session._c_object,

2410

gnutls.CTYPE_PEERS)

2457

cert_type = gnutls.certificate_type_get2(

2458

session, gnutls.CTYPE_PEERS)

2411

2459

except AttributeError:

2412

cert_type = gnutls.certificate_type_get(session._c_object)

2460

cert_type = gnutls.certificate_type_get(session)

2413

2461

if gnutls.has_rawpk:

2414

2462

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2415

2463

else:

2422

2470

return b""

2423

2471

list_size = ctypes.c_uint(1)

2424

2472

cert_list = (gnutls.certificate_get_peers

2425

(session._c_object, ctypes.byref(list_size)))

2473

(session, ctypes.byref(list_size)))

2426

2474

if not bool(cert_list) and list_size.value != 0:

2427

2475

raise gnutls.Error("error getting peer certificate")

2428

2476

if list_size.value == 0:

2450

2498

buf = ctypes.create_string_buffer(32)

2451

2499

buf_len = ctypes.c_size_t(len(buf))

2452

2500

# Get the key ID from the raw public key into the buffer

2453

gnutls.pubkey_get_key_id(pubkey,

2454

gnutls.KEYID_USE_SHA256,

2455

ctypes.cast(ctypes.byref(buf),

2456

ctypes.POINTER(ctypes.c_ubyte)),

2457

ctypes.byref(buf_len))

2501

gnutls.pubkey_get_key_id(

2502

pubkey,

2503

gnutls.KEYID_USE_SHA256,

2504

ctypes.cast(ctypes.byref(buf),

2505

ctypes.POINTER(ctypes.c_ubyte)),

2506

ctypes.byref(buf_len))

2458

2507

# Deinit the certificate

2459

2508

gnutls.pubkey_deinit(pubkey)

2460

2509

2541

2590

2542

2591

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2543

2592

socketserver.TCPServer):

2544

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2593

"""IPv6-capable TCP server. Accepts None as address and/or port

2545

2594

2546

2595

Attributes:

2547

2596

enabled: Boolean; whether this server is activated yet

2699

2748

request = parent_pipe.recv()

2700

2749

command = request[0]

2701

2750

2702

if command == 'init':

2751

if command == "init":

2703

2752

key_id = request[1].decode("ascii")

2704

2753

fpr = request[2].decode("ascii")

2705

2754

address = request[3]

2706

2755

2707

2756

for c in self.clients.values():

2708

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2757

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2758

"27AE41E4649B934CA495991B7852B855"):

2709

2759

continue

2710

2760

if key_id and c.key_id == key_id:

2711

2761

client = c

2734

2784

# remove the old hook in favor of the new above hook on

2735

2785

# same fileno

2736

2786

return False

2737

if command == 'funcall':

2787

if command == "funcall":

2738

2788

funcname = request[1]

2739

2789

args = request[2]

2740

2790

kwargs = request[3]

2741

2791

2742

parent_pipe.send(('data', getattr(client_object,

2792

parent_pipe.send(("data", getattr(client_object,

2743

2793

funcname)(*args,

2744

2794

**kwargs)))

2745

2795

2746

if command == 'getattr':

2796

if command == "getattr":

2747

2797

attrname = request[1]

2748

2798

if isinstance(client_object.__getattribute__(attrname),

2749

collections.Callable):

2750

parent_pipe.send(('function', ))

2799

collections.abc.Callable):

2800

parent_pipe.send(("function", ))

2751

2801

else:

2752

2802

parent_pipe.send((

2753

'data', client_object.__getattribute__(attrname)))

2803

"data", client_object.__getattribute__(attrname)))

2754

2804

2755

if command == 'setattr':

2805

if command == "setattr":

2756

2806

attrname = request[1]

2757

2807

value = request[2]

2758

2808

setattr(client_object, attrname, value)

2763

2813

def rfc3339_duration_to_delta(duration):

2764

2814

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2765

2815

2766

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2767

True

2768

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2769

True

2770

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2771

True

2772

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2773

True

2774

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2775

True

2776

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2777

True

2778

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2779

True

2816

>>> timedelta = datetime.timedelta

2817

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2818

True

2819

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2820

True

2821

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2822

True

2823

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2824

True

2825

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2826

True

2827

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2828

True

2829

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2830

True

2831

>>> del timedelta

2780

2832

"""

2781

2833

2782

2834

# Parsing an RFC 3339 duration with regular expressions is not

2862

2914

def string_to_delta(interval):

2863

2915

"""Parse a string and return a datetime.timedelta

2864

2916

2865

>>> string_to_delta('7d') == datetime.timedelta(7)

2866

True

2867

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2868

True

2869

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2870

True

2871

>>> string_to_delta('24h') == datetime.timedelta(1)

2872

True

2873

>>> string_to_delta('1w') == datetime.timedelta(7)

2874

True

2875

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2917

>>> string_to_delta("7d") == datetime.timedelta(7)

2918

True

2919

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2920

True

2921

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2922

True

2923

>>> string_to_delta("24h") == datetime.timedelta(1)

2924

True

2925

>>> string_to_delta("1w") == datetime.timedelta(7)

2926

True

2927

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2876

2928

True

2877

2929

"""

2878

2930

3082

3134

3083

3135

if server_settings["servicename"] != "Mandos":

3084

3136

syslogger.setFormatter(

3085

logging.Formatter('Mandos ({}) [%(process)d]:'

3086

' %(levelname)s: %(message)s'.format(

3137

logging.Formatter("Mandos ({}) [%(process)d]:"

3138

" %(levelname)s: %(message)s".format(

3087

3139

server_settings["servicename"])))

3088

3140

3089

3141

# Parse config file with clients

3149

3201

3150

3202

@gnutls.log_func

3151

3203

def debug_gnutls(level, string):

3152

logger.debug("GnuTLS: %s", string[:-1])

3204

logger.debug("GnuTLS: %s",

3205

string[:-1].decode("utf-8",

3206

errors="replace"))

3153

3207

3154

3208

gnutls.global_set_log_function(debug_gnutls)

3155

3209

3530

3584

3531

3585

try:

3532

3586

with tempfile.NamedTemporaryFile(

3533

mode='wb',

3587

mode="wb",

3534

3588

suffix=".pickle",

3535

prefix='clients-',

3589

prefix="clients-",

3536

3590

dir=os.path.dirname(stored_state_path),

3537

3591

delete=False) as stored_state:

3538

3592

pickle.dump((clients, client_settings), stored_state,

3625

3679

3626

3680

def should_only_run_tests():

3627

3681

parser = argparse.ArgumentParser(add_help=False)

3628

parser.add_argument("--check", action='store_true')

3682

parser.add_argument("--check", action="store_true")

3629

3683

args, unknown_args = parser.parse_known_args()

3630

3684

run_tests = args.check

3631

3685

if run_tests:

3639

3693

tests.addTests(doctest.DocTestSuite())

3640

3694

return tests

3641

3695

3642

if __name__ == '__main__':

3696

if __name__ == "__main__":

3643

3697

try:

3644

3698

if should_only_run_tests():

3645

3699

# Call using ./mandos --check [--verbose]