To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1267
- compare with another revision
- download diff
- download tarball
- view history from revision 1267
- Committer: Teddy Hogeborn
- Date: 2023-02-07 19:50:53 UTC
- Revision ID: teddy@recompile.se-20230207195053-0zftuysnfexf6fo6
Improve POSIX shell compatibility
* dracut-module/password-agent.c
(test_start_mandos_client_helper_directory): Use the "printf" shell
command instead of "echo".
* dracut-module/password-agent.c
(test_start_mandos_client_helper_directory): Use the "printf" shell
command instead of "echo".
- files added:
- debian/po/es.po
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
40
39
except ImportError:
41
40
pass
42
41
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
43
47
try:
44
48
import SocketServer as socketserver
45
49
except ImportError:
46
50
import socketserver
47
51
import socket
48
import argparse
49
52
import datetime
50
53
import errno
51
54
try:
52
55
import ConfigParser as configparser
53
56
except ImportError:
54
57
import configparser
55
import sys
56
58
import re
57
import os
58
59
import signal
59
60
import subprocess
60
61
import atexit
61
62
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import unittest
80
import random
81
import shlex
81
82
82
83
import dbus
83
84
import dbus.service
91
92
92
93
if sys.version_info.major == 2:
93
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
94
117
95
118
# Try to find the value of SO_BINDTODEVICE:
96
119
try:
117
140
# No value found
118
141
SO_BINDTODEVICE = None
119
142
120
if sys.version_info.major == 2:
121
str = unicode
122
123
143
if sys.version_info < (3, 2):
124
144
configparser.Configparser = configparser.SafeConfigParser
125
145
126
version = "1.8.8"
146
version = "1.8.15"
127
147
stored_state_file = "clients.pickle"
128
148
129
logger = logging.getLogger()
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
150
logging.captureWarnings(True) # Show warnings via the logging system
130
151
syslogger = None
131
152
132
153
try:
168
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
169
190
address="/dev/log"))
170
191
syslogger.setFormatter(logging.Formatter
171
('Mandos [%(process)d]: %(levelname)s:'
172
' %(message)s'))
173
logger.addHandler(syslogger)
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
174
195
175
196
if debug:
176
197
console = logging.StreamHandler()
177
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
178
' [%(process)d]:'
179
' %(levelname)s:'
180
' %(message)s'))
181
logger.addHandler(console)
182
logger.setLevel(level)
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
183
204
184
205
185
206
class PGPError(Exception):
197
218
output = subprocess.check_output(["gpgconf"])
198
219
for line in output.splitlines():
199
220
name, text, path = line.split(b":")
200
if name == "gpg":
221
if name == b"gpg":
201
222
self.gpg = path
202
223
break
203
224
except OSError as e:
204
225
if e.errno != errno.ENOENT:
205
226
raise
206
self.gnupgargs = ['--batch',
207
'--homedir', self.tempdir,
208
'--force-mdc',
209
'--quiet']
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
210
231
# Only GPG version 1 has the --no-use-agent option.
211
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
212
233
self.gnupgargs.append("--no-use-agent")
213
234
214
235
def __enter__(self):
251
272
dir=self.tempdir) as passfile:
252
273
passfile.write(passphrase)
253
274
passfile.flush()
254
proc = subprocess.Popen([self.gpg, '--symmetric',
255
'--passphrase-file',
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
256
277
passfile.name]
257
278
+ self.gnupgargs,
258
279
stdin=subprocess.PIPE,
269
290
dir=self.tempdir) as passfile:
270
291
passfile.write(passphrase)
271
292
passfile.flush()
272
proc = subprocess.Popen([self.gpg, '--decrypt',
273
'--passphrase-file',
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
274
295
passfile.name]
275
296
+ self.gnupgargs,
276
297
stdin=subprocess.PIPE,
329
350
Attributes:
330
351
interface: integer; avahi.IF_UNSPEC or an interface index.
331
352
Used to optionally bind to the specified interface.
332
name: string; Example: 'Mandos'
333
type: string; Example: '_mandos._tcp'.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
334
355
See <https://www.iana.org/assignments/service-names-port-numbers>
335
356
port: integer; what port to announce
336
357
TXT: list of strings; TXT record for the service
373
394
def rename(self, remove=True):
374
395
"""Derived from the Avahi example code"""
375
396
if self.rename_count >= self.max_renames:
376
logger.critical("No suitable Zeroconf service name found"
377
" after %i retries, exiting.",
378
self.rename_count)
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
379
400
raise AvahiServiceError("Too many renames")
380
401
self.name = str(
381
402
self.server.GetAlternativeServiceName(self.name))
382
403
self.rename_count += 1
383
logger.info("Changing Zeroconf service name to %r ...",
384
self.name)
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
385
406
if remove:
386
407
self.remove()
387
408
try:
389
410
except dbus.exceptions.DBusException as error:
390
411
if (error.get_dbus_name()
391
412
== "org.freedesktop.Avahi.CollisionError"):
392
logger.info("Local Zeroconf service name collision.")
413
log.info("Local Zeroconf service name collision.")
393
414
return self.rename(remove=False)
394
415
else:
395
logger.critical("D-Bus Exception", exc_info=error)
416
log.critical("D-Bus Exception", exc_info=error)
396
417
self.cleanup()
397
418
os._exit(1)
398
419
414
435
avahi.DBUS_INTERFACE_ENTRY_GROUP)
415
436
self.entry_group_state_changed_match = (
416
437
self.group.connect_to_signal(
417
'StateChanged', self.entry_group_state_changed))
418
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
419
self.name, self.type)
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
420
441
self.group.AddService(
421
442
self.interface,
422
443
self.protocol,
429
450
430
451
def entry_group_state_changed(self, state, error):
431
452
"""Derived from the Avahi example code"""
432
logger.debug("Avahi entry group state change: %i", state)
453
log.debug("Avahi entry group state change: %i", state)
433
454
434
455
if state == avahi.ENTRY_GROUP_ESTABLISHED:
435
logger.debug("Zeroconf service established.")
456
log.debug("Zeroconf service established.")
436
457
elif state == avahi.ENTRY_GROUP_COLLISION:
437
logger.info("Zeroconf service name collision.")
458
log.info("Zeroconf service name collision.")
438
459
self.rename()
439
460
elif state == avahi.ENTRY_GROUP_FAILURE:
440
logger.critical("Avahi: Error in group state changed %s",
441
str(error))
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
442
463
raise AvahiGroupError("State changed: {!s}".format(error))
443
464
444
465
def cleanup(self):
454
475
455
476
def server_state_changed(self, state, error=None):
456
477
"""Derived from the Avahi example code"""
457
logger.debug("Avahi server state change: %i", state)
478
log.debug("Avahi server state change: %i", state)
458
479
bad_states = {
459
480
avahi.SERVER_INVALID: "Zeroconf server invalid",
460
481
avahi.SERVER_REGISTERING: None,
464
485
if state in bad_states:
465
486
if bad_states[state] is not None:
466
487
if error is None:
467
logger.error(bad_states[state])
488
log.error(bad_states[state])
468
489
else:
469
logger.error(bad_states[state] + ": %r", error)
490
log.error(bad_states[state] + ": %r", error)
470
491
self.cleanup()
471
492
elif state == avahi.SERVER_RUNNING:
472
493
try:
474
495
except dbus.exceptions.DBusException as error:
475
496
if (error.get_dbus_name()
476
497
== "org.freedesktop.Avahi.CollisionError"):
477
logger.info("Local Zeroconf service name"
478
" collision.")
498
log.info("Local Zeroconf service name collision.")
479
499
return self.rename(remove=False)
480
500
else:
481
logger.critical("D-Bus Exception", exc_info=error)
501
log.critical("D-Bus Exception", exc_info=error)
482
502
self.cleanup()
483
503
os._exit(1)
484
504
else:
485
505
if error is None:
486
logger.debug("Unknown state: %r", state)
506
log.debug("Unknown state: %r", state)
487
507
else:
488
logger.debug("Unknown state: %r: %r", state, error)
508
log.debug("Unknown state: %r: %r", state, error)
489
509
490
510
def activate(self):
491
511
"""Derived from the Avahi example code"""
503
523
class AvahiServiceToSyslog(AvahiService):
504
524
def rename(self, *args, **kwargs):
505
525
"""Add the new name to the syslog messages"""
506
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
507
528
syslogger.setFormatter(logging.Formatter(
508
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
509
530
.format(self.name)))
510
531
return ret
511
532
541
562
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
542
563
543
564
# Types
544
class session_int(ctypes.Structure):
565
class _session_int(ctypes.Structure):
545
566
_fields_ = []
546
session_t = ctypes.POINTER(session_int)
567
session_t = ctypes.POINTER(_session_int)
547
568
548
569
class certificate_credentials_st(ctypes.Structure):
549
570
_fields_ = []
552
573
certificate_type_t = ctypes.c_int
553
574
554
575
class datum_t(ctypes.Structure):
555
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
556
('size', ctypes.c_uint)]
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
557
578
558
class openpgp_crt_int(ctypes.Structure):
579
class _openpgp_crt_int(ctypes.Structure):
559
580
_fields_ = []
560
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
561
582
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
562
583
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
563
584
credentials_type_t = ctypes.c_int
572
593
# gnutls.strerror()
573
594
self.code = code
574
595
if message is None and code is not None:
575
message = gnutls.strerror(code)
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
576
598
return super(gnutls.Error, self).__init__(
577
599
message, *args)
578
600
579
601
class CertificateSecurityError(Error):
580
602
pass
581
603
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
582
629
# Classes
583
class Credentials:
630
class Credentials(With_from_param):
584
631
def __init__(self):
585
self._c_object = gnutls.certificate_credentials_t()
586
gnutls.certificate_allocate_credentials(
587
ctypes.byref(self._c_object))
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
588
634
self.type = gnutls.CRD_CERTIFICATE
589
635
590
636
def __del__(self):
591
gnutls.certificate_free_credentials(self._c_object)
637
gnutls.certificate_free_credentials(self)
592
638
593
class ClientSession:
639
class ClientSession(With_from_param):
594
640
def __init__(self, socket, credentials=None):
595
self._c_object = gnutls.session_t()
641
self._as_parameter_ = gnutls.session_t()
596
642
gnutls_flags = gnutls.CLIENT
597
643
if gnutls.check_version(b"3.5.6"):
598
644
gnutls_flags |= gnutls.NO_TICKETS
599
645
if gnutls.has_rawpk:
600
646
gnutls_flags |= gnutls.ENABLE_RAWPK
601
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
647
gnutls.init(self, gnutls_flags)
602
648
del gnutls_flags
603
gnutls.set_default_priority(self._c_object)
604
gnutls.transport_set_ptr(self._c_object, socket.fileno())
605
gnutls.handshake_set_private_extensions(self._c_object,
606
True)
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
607
652
self.socket = socket
608
653
if credentials is None:
609
654
credentials = gnutls.Credentials()
610
gnutls.credentials_set(self._c_object, credentials.type,
611
ctypes.cast(credentials._c_object,
612
ctypes.c_void_p))
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
613
657
self.credentials = credentials
614
658
615
659
def __del__(self):
616
gnutls.deinit(self._c_object)
660
gnutls.deinit(self)
617
661
618
662
def handshake(self):
619
return gnutls.handshake(self._c_object)
663
return gnutls.handshake(self)
620
664
621
665
def send(self, data):
622
666
data = bytes(data)
623
667
data_len = len(data)
624
668
while data_len > 0:
625
data_len -= gnutls.record_send(self._c_object,
626
data[-data_len:],
669
data_len -= gnutls.record_send(self, data[-data_len:],
627
670
data_len)
628
671
629
672
def bye(self):
630
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
631
674
632
675
# Error handling functions
633
676
def _error_code(result):
634
677
"""A function to raise exceptions on errors, suitable
635
for the 'restype' attribute on ctypes functions"""
636
if result >= 0:
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
637
680
return result
638
681
if result == gnutls.E_NO_CERTIFICATE_FOUND:
639
682
raise gnutls.CertificateSecurityError(code=result)
640
683
raise gnutls.Error(code=result)
641
684
642
def _retry_on_error(result, func, arguments):
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
643
687
"""A function to retry on some errors, suitable
644
for the 'errcheck' attribute on ctypes functions"""
645
while result < 0:
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
646
690
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
647
691
return _error_code(result)
648
692
result = func(*arguments)
653
697
654
698
# Functions
655
699
priority_set_direct = _library.gnutls_priority_set_direct
656
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
657
701
ctypes.POINTER(ctypes.c_char_p)]
658
702
priority_set_direct.restype = _error_code
659
703
660
704
init = _library.gnutls_init
661
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
662
706
init.restype = _error_code
663
707
664
708
set_default_priority = _library.gnutls_set_default_priority
665
set_default_priority.argtypes = [session_t]
709
set_default_priority.argtypes = [ClientSession]
666
710
set_default_priority.restype = _error_code
667
711
668
712
record_send = _library.gnutls_record_send
669
record_send.argtypes = [session_t, ctypes.c_void_p,
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
670
714
ctypes.c_size_t]
671
715
record_send.restype = ctypes.c_ssize_t
672
716
record_send.errcheck = _retry_on_error
674
718
certificate_allocate_credentials = (
675
719
_library.gnutls_certificate_allocate_credentials)
676
720
certificate_allocate_credentials.argtypes = [
677
ctypes.POINTER(certificate_credentials_t)]
721
PointerTo(Credentials)]
678
722
certificate_allocate_credentials.restype = _error_code
679
723
680
724
certificate_free_credentials = (
681
725
_library.gnutls_certificate_free_credentials)
682
certificate_free_credentials.argtypes = [
683
certificate_credentials_t]
726
certificate_free_credentials.argtypes = [Credentials]
684
727
certificate_free_credentials.restype = None
685
728
686
729
handshake_set_private_extensions = (
687
730
_library.gnutls_handshake_set_private_extensions)
688
handshake_set_private_extensions.argtypes = [session_t,
731
handshake_set_private_extensions.argtypes = [ClientSession,
689
732
ctypes.c_int]
690
733
handshake_set_private_extensions.restype = None
691
734
692
735
credentials_set = _library.gnutls_credentials_set
693
credentials_set.argtypes = [session_t, credentials_type_t,
694
ctypes.c_void_p]
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
695
738
credentials_set.restype = _error_code
696
739
697
740
strerror = _library.gnutls_strerror
699
742
strerror.restype = ctypes.c_char_p
700
743
701
744
certificate_type_get = _library.gnutls_certificate_type_get
702
certificate_type_get.argtypes = [session_t]
745
certificate_type_get.argtypes = [ClientSession]
703
746
certificate_type_get.restype = _error_code
704
747
705
748
certificate_get_peers = _library.gnutls_certificate_get_peers
706
certificate_get_peers.argtypes = [session_t,
749
certificate_get_peers.argtypes = [ClientSession,
707
750
ctypes.POINTER(ctypes.c_uint)]
708
751
certificate_get_peers.restype = ctypes.POINTER(datum_t)
709
752
716
759
global_set_log_function.restype = None
717
760
718
761
deinit = _library.gnutls_deinit
719
deinit.argtypes = [session_t]
762
deinit.argtypes = [ClientSession]
720
763
deinit.restype = None
721
764
722
765
handshake = _library.gnutls_handshake
723
handshake.argtypes = [session_t]
724
handshake.restype = _error_code
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
725
768
handshake.errcheck = _retry_on_error
726
769
727
770
transport_set_ptr = _library.gnutls_transport_set_ptr
728
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
729
772
transport_set_ptr.restype = None
730
773
731
774
bye = _library.gnutls_bye
732
bye.argtypes = [session_t, close_request_t]
733
bye.restype = _error_code
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
734
777
bye.errcheck = _retry_on_error
735
778
736
779
check_version = _library.gnutls_check_version
753
796
754
797
x509_crt_fmt_t = ctypes.c_int
755
798
756
# All the function declarations below are from gnutls/abstract.h
799
# All the function declarations below are from
800
# gnutls/abstract.h
757
801
pubkey_init = _library.gnutls_pubkey_init
758
802
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
759
803
pubkey_init.restype = _error_code
773
817
pubkey_deinit.argtypes = [pubkey_t]
774
818
pubkey_deinit.restype = None
775
819
else:
776
# All the function declarations below are from gnutls/openpgp.h
820
# All the function declarations below are from
821
# gnutls/openpgp.h
777
822
778
823
openpgp_crt_init = _library.gnutls_openpgp_crt_init
779
824
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
785
830
openpgp_crt_fmt_t]
786
831
openpgp_crt_import.restype = _error_code
787
832
788
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
789
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
790
ctypes.POINTER(ctypes.c_uint)]
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
791
840
openpgp_crt_verify_self.restype = _error_code
792
841
793
842
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
804
853
805
854
if check_version(b"3.6.4"):
806
855
certificate_type_get2 = _library.gnutls_certificate_type_get2
807
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
808
857
certificate_type_get2.restype = _error_code
809
858
810
859
# Remove non-public functions
826
875
"""A representation of a client host served by this server.
827
876
828
877
Attributes:
829
approved: bool(); 'None' if not yet approved/disapproved
878
approved: bool(); None if not yet approved/disapproved
830
879
approval_delay: datetime.timedelta(); Time to wait for approval
831
880
approval_duration: datetime.timedelta(); Duration of one approval
832
881
checker: multiprocessing.Process(); a running checker process used
833
to see if the client lives. 'None' if no process is
882
to see if the client lives. None if no process is
834
883
running.
835
884
checker_callback_tag: a GLib event source tag, or None
836
885
checker_command: string; External command which is run to check
960
1009
self.last_enabled = None
961
1010
self.expires = None
962
1011
963
logger.debug("Creating client %r", self.name)
964
logger.debug(" Key ID: %s", self.key_id)
965
logger.debug(" Fingerprint: %s", self.fingerprint)
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
966
1015
self.created = settings.get("created",
967
1016
datetime.datetime.utcnow())
968
1017
1007
1056
if not getattr(self, "enabled", False):
1008
1057
return False
1009
1058
if not quiet:
1010
logger.info("Disabling client %s", self.name)
1059
log.info("Disabling client %s", self.name)
1011
1060
if getattr(self, "disable_initiator_tag", None) is not None:
1012
1061
GLib.source_remove(self.disable_initiator_tag)
1013
1062
self.disable_initiator_tag = None
1031
1080
if self.checker_initiator_tag is not None:
1032
1081
GLib.source_remove(self.checker_initiator_tag)
1033
1082
self.checker_initiator_tag = GLib.timeout_add(
1034
int(self.interval.total_seconds() * 1000),
1083
random.randrange(int(self.interval.total_seconds() * 1000
1084
+ 1)),
1035
1085
self.start_checker)
1036
1086
# Schedule a disable() when 'timeout' has passed
1037
1087
if self.disable_initiator_tag is not None:
1047
1097
# Read return code from connection (see call_pipe)
1048
1098
returncode = connection.recv()
1049
1099
connection.close()
1050
self.checker.join()
1100
if self.checker is not None:
1101
self.checker.join()
1051
1102
self.checker_callback_tag = None
1052
1103
self.checker = None
1053
1104
1055
1106
self.last_checker_status = returncode
1056
1107
self.last_checker_signal = None
1057
1108
if self.last_checker_status == 0:
1058
logger.info("Checker for %(name)s succeeded",
1059
vars(self))
1109
log.info("Checker for %(name)s succeeded", vars(self))
1060
1110
self.checked_ok()
1061
1111
else:
1062
logger.info("Checker for %(name)s failed", vars(self))
1112
log.info("Checker for %(name)s failed", vars(self))
1063
1113
else:
1064
1114
self.last_checker_status = -1
1065
1115
self.last_checker_signal = -returncode
1066
logger.warning("Checker for %(name)s crashed?",
1067
vars(self))
1116
log.warning("Checker for %(name)s crashed?", vars(self))
1068
1117
return False
1069
1118
1070
1119
def checked_ok(self):
1104
1153
# should be.
1105
1154
1106
1155
if self.checker is not None and not self.checker.is_alive():
1107
logger.warning("Checker was not alive; joining")
1156
log.warning("Checker was not alive; joining")
1108
1157
self.checker.join()
1109
1158
self.checker = None
1110
1159
# Start a new checker if needed
1111
1160
if self.checker is None:
1112
1161
# Escape attributes for the shell
1113
1162
escaped_attrs = {
1114
attr: re.escape(str(getattr(self, attr)))
1163
attr: shlex.quote(str(getattr(self, attr)))
1115
1164
for attr in self.runtime_expansions}
1116
1165
try:
1117
1166
command = self.checker_command % escaped_attrs
1118
1167
except TypeError as error:
1119
logger.error('Could not format string "%s"',
1120
self.checker_command,
1121
exc_info=error)
1168
log.error('Could not format string "%s"',
1169
self.checker_command, exc_info=error)
1122
1170
return True # Try again later
1123
1171
self.current_checker_command = command
1124
logger.info("Starting checker %r for %s", command,
1125
self.name)
1172
log.info("Starting checker %r for %s", command, self.name)
1126
1173
# We don't need to redirect stdout and stderr, since
1127
1174
# in normal mode, that is already done by daemon(),
1128
1175
# and in debug mode we don't want to. (Stdin is
1144
1191
kwargs=popen_args)
1145
1192
self.checker.start()
1146
1193
self.checker_callback_tag = GLib.io_add_watch(
1147
pipe[0].fileno(), GLib.IO_IN,
1194
GLib.IOChannel.unix_new(pipe[0].fileno()),
1195
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1148
1196
self.checker_callback, pipe[0], command)
1149
1197
# Re-run this periodically if run by GLib.timeout_add
1150
1198
return True
1156
1204
self.checker_callback_tag = None
1157
1205
if getattr(self, "checker", None) is None:
1158
1206
return
1159
logger.debug("Stopping checker for %(name)s", vars(self))
1207
log.debug("Stopping checker for %(name)s", vars(self))
1160
1208
self.checker.terminate()
1161
1209
self.checker = None
1162
1210
1189
1237
func._dbus_name = func.__name__
1190
1238
if func._dbus_name.endswith("_dbus_property"):
1191
1239
func._dbus_name = func._dbus_name[:-14]
1192
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1240
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1193
1241
return func
1194
1242
1195
1243
return decorator
1284
1332
1285
1333
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1286
1334
out_signature="s",
1287
path_keyword='object_path',
1288
connection_keyword='connection')
1335
path_keyword="object_path",
1336
connection_keyword="connection")
1289
1337
def Introspect(self, object_path, connection):
1290
1338
"""Overloading of standard D-Bus method.
1291
1339
1340
1388
document.unlink()
1341
1389
except (AttributeError, xml.dom.DOMException,
1342
1390
xml.parsers.expat.ExpatError) as error:
1343
logger.error("Failed to override Introspection method",
1344
exc_info=error)
1391
log.error("Failed to override Introspection method",
1392
exc_info=error)
1345
1393
return xmlstring
1346
1394
1347
1395
1405
1453
raise ValueError("Byte arrays not supported for non-"
1406
1454
"'ay' signature {!r}"
1407
1455
.format(prop._dbus_signature))
1408
value = dbus.ByteArray(b''.join(chr(byte)
1409
for byte in value))
1456
value = dbus.ByteArray(bytes(value))
1410
1457
prop(value)
1411
1458
1412
1459
@dbus.service.method(dbus.PROPERTIES_IFACE,
1445
1492
1446
1493
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1447
1494
out_signature="s",
1448
path_keyword='object_path',
1449
connection_keyword='connection')
1495
path_keyword="object_path",
1496
connection_keyword="connection")
1450
1497
def Introspect(self, object_path, connection):
1451
1498
"""Overloading of standard D-Bus method.
1452
1499
1508
1555
document.unlink()
1509
1556
except (AttributeError, xml.dom.DOMException,
1510
1557
xml.parsers.expat.ExpatError) as error:
1511
logger.error("Failed to override Introspection method",
1512
exc_info=error)
1558
log.error("Failed to override Introspection method",
1559
exc_info=error)
1513
1560
return xmlstring
1514
1561
1515
1562
1547
1594
1548
1595
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1549
1596
out_signature="s",
1550
path_keyword='object_path',
1551
connection_keyword='connection')
1597
path_keyword="object_path",
1598
connection_keyword="connection")
1552
1599
def Introspect(self, object_path, connection):
1553
1600
"""Overloading of standard D-Bus method.
1554
1601
1579
1626
document.unlink()
1580
1627
except (AttributeError, xml.dom.DOMException,
1581
1628
xml.parsers.expat.ExpatError) as error:
1582
logger.error("Failed to override Introspection method",
1583
exc_info=error)
1629
log.error("Failed to override Introspection method",
1630
exc_info=error)
1584
1631
return xmlstring
1585
1632
1586
1633
2220
2267
class ProxyClient:
2221
2268
def __init__(self, child_pipe, key_id, fpr, address):
2222
2269
self._pipe = child_pipe
2223
self._pipe.send(('init', key_id, fpr, address))
2270
self._pipe.send(("init", key_id, fpr, address))
2224
2271
if not self._pipe.recv():
2225
2272
raise KeyError(key_id or fpr)
2226
2273
2227
2274
def __getattribute__(self, name):
2228
if name == '_pipe':
2275
if name == "_pipe":
2229
2276
return super(ProxyClient, self).__getattribute__(name)
2230
self._pipe.send(('getattr', name))
2277
self._pipe.send(("getattr", name))
2231
2278
data = self._pipe.recv()
2232
if data[0] == 'data':
2279
if data[0] == "data":
2233
2280
return data[1]
2234
if data[0] == 'function':
2281
if data[0] == "function":
2235
2282
2236
2283
def func(*args, **kwargs):
2237
self._pipe.send(('funcall', name, args, kwargs))
2284
self._pipe.send(("funcall", name, args, kwargs))
2238
2285
return self._pipe.recv()[1]
2239
2286
2240
2287
return func
2241
2288
2242
2289
def __setattr__(self, name, value):
2243
if name == '_pipe':
2290
if name == "_pipe":
2244
2291
return super(ProxyClient, self).__setattr__(name, value)
2245
self._pipe.send(('setattr', name, value))
2292
self._pipe.send(("setattr", name, value))
2246
2293
2247
2294
2248
2295
class ClientHandler(socketserver.BaseRequestHandler, object):
2253
2300
2254
2301
def handle(self):
2255
2302
with contextlib.closing(self.server.child_pipe) as child_pipe:
2256
logger.info("TCP connection from: %s",
2257
str(self.client_address))
2258
logger.debug("Pipe FD: %d",
2259
self.server.child_pipe.fileno())
2303
log.info("TCP connection from: %s",
2304
str(self.client_address))
2305
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2260
2306
2261
2307
session = gnutls.ClientSession(self.request)
2262
2308
2263
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2309
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2264
2310
# "+AES-256-CBC", "+SHA1",
2265
2311
# "+COMP-NULL", "+CTYPE-OPENPGP",
2266
2312
# "+DHE-DSS"))
2268
2314
priority = self.server.gnutls_priority
2269
2315
if priority is None:
2270
2316
priority = "NORMAL"
2271
gnutls.priority_set_direct(session._c_object,
2272
priority.encode("utf-8"),
2273
None)
2317
gnutls.priority_set_direct(session,
2318
priority.encode("utf-8"), None)
2274
2319
2275
2320
# Start communication using the Mandos protocol
2276
2321
# Get protocol number
2277
2322
line = self.request.makefile().readline()
2278
logger.debug("Protocol version: %r", line)
2323
log.debug("Protocol version: %r", line)
2279
2324
try:
2280
2325
if int(line.strip().split()[0]) > 1:
2281
2326
raise RuntimeError(line)
2282
2327
except (ValueError, IndexError, RuntimeError) as error:
2283
logger.error("Unknown protocol version: %s", error)
2328
log.error("Unknown protocol version: %s", error)
2284
2329
return
2285
2330
2286
2331
# Start GnuTLS connection
2287
2332
try:
2288
2333
session.handshake()
2289
2334
except gnutls.Error as error:
2290
logger.warning("Handshake failed: %s", error)
2335
log.warning("Handshake failed: %s", error)
2291
2336
# Do not run session.bye() here: the session is not
2292
2337
# established. Just abandon the request.
2293
2338
return
2294
logger.debug("Handshake succeeded")
2339
log.debug("Handshake succeeded")
2295
2340
2296
2341
approval_required = False
2297
2342
try:
2301
2346
key_id = self.key_id(
2302
2347
self.peer_certificate(session))
2303
2348
except (TypeError, gnutls.Error) as error:
2304
logger.warning("Bad certificate: %s", error)
2349
log.warning("Bad certificate: %s", error)
2305
2350
return
2306
logger.debug("Key ID: %s", key_id)
2351
log.debug("Key ID: %s",
2352
key_id.decode("utf-8",
2353
errors="replace"))
2307
2354
2308
2355
else:
2309
2356
key_id = b""
2311
2358
fpr = self.fingerprint(
2312
2359
self.peer_certificate(session))
2313
2360
except (TypeError, gnutls.Error) as error:
2314
logger.warning("Bad certificate: %s", error)
2361
log.warning("Bad certificate: %s", error)
2315
2362
return
2316
logger.debug("Fingerprint: %s", fpr)
2363
log.debug("Fingerprint: %s", fpr)
2317
2364
2318
2365
try:
2319
2366
client = ProxyClient(child_pipe, key_id, fpr,
2328
2375
2329
2376
while True:
2330
2377
if not client.enabled:
2331
logger.info("Client %s is disabled",
2332
client.name)
2378
log.info("Client %s is disabled", client.name)
2333
2379
if self.server.use_dbus:
2334
2380
# Emit D-Bus signal
2335
2381
client.Rejected("Disabled")
2339
2385
# We are approved or approval is disabled
2340
2386
break
2341
2387
elif client.approved is None:
2342
logger.info("Client %s needs approval",
2343
client.name)
2388
log.info("Client %s needs approval",
2389
client.name)
2344
2390
if self.server.use_dbus:
2345
2391
# Emit D-Bus signal
2346
2392
client.NeedApproval(
2347
2393
client.approval_delay.total_seconds()
2348
2394
* 1000, client.approved_by_default)
2349
2395
else:
2350
logger.warning("Client %s was not approved",
2351
client.name)
2396
log.warning("Client %s was not approved",
2397
client.name)
2352
2398
if self.server.use_dbus:
2353
2399
# Emit D-Bus signal
2354
2400
client.Rejected("Denied")
2362
2408
time2 = datetime.datetime.now()
2363
2409
if (time2 - time) >= delay:
2364
2410
if not client.approved_by_default:
2365
logger.warning("Client %s timed out while"
2366
" waiting for approval",
2367
client.name)
2411
log.warning("Client %s timed out while"
2412
" waiting for approval",
2413
client.name)
2368
2414
if self.server.use_dbus:
2369
2415
# Emit D-Bus signal
2370
2416
client.Rejected("Approval timed out")
2377
2423
try:
2378
2424
session.send(client.secret)
2379
2425
except gnutls.Error as error:
2380
logger.warning("gnutls send failed",
2381
exc_info=error)
2426
log.warning("gnutls send failed", exc_info=error)
2382
2427
return
2383
2428
2384
logger.info("Sending secret to %s", client.name)
2429
log.info("Sending secret to %s", client.name)
2385
2430
# bump the timeout using extended_timeout
2386
2431
client.bump_timeout(client.extended_timeout)
2387
2432
if self.server.use_dbus:
2394
2439
try:
2395
2440
session.bye()
2396
2441
except gnutls.Error as error:
2397
logger.warning("GnuTLS bye failed",
2398
exc_info=error)
2442
log.warning("GnuTLS bye failed", exc_info=error)
2399
2443
2400
2444
@staticmethod
2401
2445
def peer_certificate(session):
2402
2446
"Return the peer's certificate as a bytestring"
2403
2447
try:
2404
cert_type = gnutls.certificate_type_get2(session._c_object,
2405
gnutls.CTYPE_PEERS)
2448
cert_type = gnutls.certificate_type_get2(
2449
session, gnutls.CTYPE_PEERS)
2406
2450
except AttributeError:
2407
cert_type = gnutls.certificate_type_get(session._c_object)
2451
cert_type = gnutls.certificate_type_get(session)
2408
2452
if gnutls.has_rawpk:
2409
2453
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2410
2454
else:
2411
2455
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2412
2456
# If not a valid certificate type...
2413
2457
if cert_type not in valid_cert_types:
2414
logger.info("Cert type %r not in %r", cert_type,
2415
valid_cert_types)
2458
log.info("Cert type %r not in %r", cert_type,
2459
valid_cert_types)
2416
2460
# ...return invalid data
2417
2461
return b""
2418
2462
list_size = ctypes.c_uint(1)
2419
2463
cert_list = (gnutls.certificate_get_peers
2420
(session._c_object, ctypes.byref(list_size)))
2464
(session, ctypes.byref(list_size)))
2421
2465
if not bool(cert_list) and list_size.value != 0:
2422
2466
raise gnutls.Error("error getting peer certificate")
2423
2467
if list_size.value == 0:
2445
2489
buf = ctypes.create_string_buffer(32)
2446
2490
buf_len = ctypes.c_size_t(len(buf))
2447
2491
# Get the key ID from the raw public key into the buffer
2448
gnutls.pubkey_get_key_id(pubkey,
2449
gnutls.KEYID_USE_SHA256,
2450
ctypes.cast(ctypes.byref(buf),
2451
ctypes.POINTER(ctypes.c_ubyte)),
2452
ctypes.byref(buf_len))
2492
gnutls.pubkey_get_key_id(
2493
pubkey,
2494
gnutls.KEYID_USE_SHA256,
2495
ctypes.cast(ctypes.byref(buf),
2496
ctypes.POINTER(ctypes.c_ubyte)),
2497
ctypes.byref(buf_len))
2453
2498
# Deinit the certificate
2454
2499
gnutls.pubkey_deinit(pubkey)
2455
2500
2536
2581
2537
2582
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2538
2583
socketserver.TCPServer):
2539
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2584
"""IPv6-capable TCP server. Accepts None as address and/or port
2540
2585
2541
2586
Attributes:
2542
2587
enabled: Boolean; whether this server is activated yet
2593
2638
if SO_BINDTODEVICE is None:
2594
2639
# Fall back to a hard-coded value which seems to be
2595
2640
# common enough.
2596
logger.warning("SO_BINDTODEVICE not found, trying 25")
2641
log.warning("SO_BINDTODEVICE not found, trying 25")
2597
2642
SO_BINDTODEVICE = 25
2598
2643
try:
2599
2644
self.socket.setsockopt(
2601
2646
(self.interface + "\0").encode("utf-8"))
2602
2647
except socket.error as error:
2603
2648
if error.errno == errno.EPERM:
2604
logger.error("No permission to bind to"
2605
" interface %s", self.interface)
2649
log.error("No permission to bind to interface %s",
2650
self.interface)
2606
2651
elif error.errno == errno.ENOPROTOOPT:
2607
logger.error("SO_BINDTODEVICE not available;"
2608
" cannot bind to interface %s",
2609
self.interface)
2652
log.error("SO_BINDTODEVICE not available; cannot"
2653
" bind to interface %s", self.interface)
2610
2654
elif error.errno == errno.ENODEV:
2611
logger.error("Interface %s does not exist,"
2612
" cannot bind", self.interface)
2655
log.error("Interface %s does not exist, cannot"
2656
" bind", self.interface)
2613
2657
else:
2614
2658
raise
2615
2659
# Only bind(2) the socket if we really need to.
2674
2718
def add_pipe(self, parent_pipe, proc):
2675
2719
# Call "handle_ipc" for both data and EOF events
2676
2720
GLib.io_add_watch(
2677
parent_pipe.fileno(),
2678
GLib.IO_IN | GLib.IO_HUP,
2721
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2722
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2679
2723
functools.partial(self.handle_ipc,
2680
2724
parent_pipe=parent_pipe,
2681
2725
proc=proc))
2694
2738
request = parent_pipe.recv()
2695
2739
command = request[0]
2696
2740
2697
if command == 'init':
2741
if command == "init":
2698
2742
key_id = request[1].decode("ascii")
2699
2743
fpr = request[2].decode("ascii")
2700
2744
address = request[3]
2701
2745
2702
2746
for c in self.clients.values():
2703
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2747
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2748
"27AE41E4649B934CA495991B7852B855"):
2704
2749
continue
2705
2750
if key_id and c.key_id == key_id:
2706
2751
client = c
2709
2754
client = c
2710
2755
break
2711
2756
else:
2712
logger.info("Client not found for key ID: %s, address"
2713
": %s", key_id or fpr, address)
2757
log.info("Client not found for key ID: %s, address:"
2758
" %s", key_id or fpr, address)
2714
2759
if self.use_dbus:
2715
2760
# Emit D-Bus signal
2716
2761
mandos_dbus_service.ClientNotFound(key_id or fpr,
2719
2764
return False
2720
2765
2721
2766
GLib.io_add_watch(
2722
parent_pipe.fileno(),
2723
GLib.IO_IN | GLib.IO_HUP,
2767
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2768
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2724
2769
functools.partial(self.handle_ipc,
2725
2770
parent_pipe=parent_pipe,
2726
2771
proc=proc,
2729
2774
# remove the old hook in favor of the new above hook on
2730
2775
# same fileno
2731
2776
return False
2732
if command == 'funcall':
2777
if command == "funcall":
2733
2778
funcname = request[1]
2734
2779
args = request[2]
2735
2780
kwargs = request[3]
2736
2781
2737
parent_pipe.send(('data', getattr(client_object,
2782
parent_pipe.send(("data", getattr(client_object,
2738
2783
funcname)(*args,
2739
2784
**kwargs)))
2740
2785
2741
if command == 'getattr':
2786
if command == "getattr":
2742
2787
attrname = request[1]
2743
2788
if isinstance(client_object.__getattribute__(attrname),
2744
collections.Callable):
2745
parent_pipe.send(('function', ))
2789
collections.abc.Callable):
2790
parent_pipe.send(("function", ))
2746
2791
else:
2747
2792
parent_pipe.send((
2748
'data', client_object.__getattribute__(attrname)))
2793
"data", client_object.__getattribute__(attrname)))
2749
2794
2750
if command == 'setattr':
2795
if command == "setattr":
2751
2796
attrname = request[1]
2752
2797
value = request[2]
2753
2798
setattr(client_object, attrname, value)
2758
2803
def rfc3339_duration_to_delta(duration):
2759
2804
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2760
2805
2761
>>> rfc3339_duration_to_delta("P7D")
2762
datetime.timedelta(7)
2763
>>> rfc3339_duration_to_delta("PT60S")
2764
datetime.timedelta(0, 60)
2765
>>> rfc3339_duration_to_delta("PT60M")
2766
datetime.timedelta(0, 3600)
2767
>>> rfc3339_duration_to_delta("PT24H")
2768
datetime.timedelta(1)
2769
>>> rfc3339_duration_to_delta("P1W")
2770
datetime.timedelta(7)
2771
>>> rfc3339_duration_to_delta("PT5M30S")
2772
datetime.timedelta(0, 330)
2773
>>> rfc3339_duration_to_delta("P1DT3M20S")
2774
datetime.timedelta(1, 200)
2806
>>> timedelta = datetime.timedelta
2807
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2808
True
2809
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2810
True
2811
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2812
True
2813
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2814
True
2815
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2816
True
2817
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2818
True
2819
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2820
True
2821
>>> del timedelta
2775
2822
"""
2776
2823
2777
2824
# Parsing an RFC 3339 duration with regular expressions is not
2857
2904
def string_to_delta(interval):
2858
2905
"""Parse a string and return a datetime.timedelta
2859
2906
2860
>>> string_to_delta('7d')
2861
datetime.timedelta(7)
2862
>>> string_to_delta('60s')
2863
datetime.timedelta(0, 60)
2864
>>> string_to_delta('60m')
2865
datetime.timedelta(0, 3600)
2866
>>> string_to_delta('24h')
2867
datetime.timedelta(1)
2868
>>> string_to_delta('1w')
2869
datetime.timedelta(7)
2870
>>> string_to_delta('5m 30s')
2871
datetime.timedelta(0, 330)
2907
>>> string_to_delta("7d") == datetime.timedelta(7)
2908
True
2909
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2910
True
2911
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2912
True
2913
>>> string_to_delta("24h") == datetime.timedelta(1)
2914
True
2915
>>> string_to_delta("1w") == datetime.timedelta(7)
2916
True
2917
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2918
True
2872
2919
"""
2873
2920
2874
2921
try:
3077
3124
3078
3125
if server_settings["servicename"] != "Mandos":
3079
3126
syslogger.setFormatter(
3080
logging.Formatter('Mandos ({}) [%(process)d]:'
3081
' %(levelname)s: %(message)s'.format(
3127
logging.Formatter("Mandos ({}) [%(process)d]:"
3128
" %(levelname)s: %(message)s".format(
3082
3129
server_settings["servicename"])))
3083
3130
3084
3131
# Parse config file with clients
3108
3155
try:
3109
3156
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3110
3157
except IOError as e:
3111
logger.error("Could not open file %r", pidfilename,
3112
exc_info=e)
3158
log.error("Could not open file %r", pidfilename,
3159
exc_info=e)
3113
3160
3114
3161
for name, group in (("_mandos", "_mandos"),
3115
3162
("mandos", "mandos"),
3126
3173
try:
3127
3174
os.setgid(gid)
3128
3175
os.setuid(uid)
3129
if debug:
3130
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3131
gid))
3176
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3132
3177
except OSError as error:
3133
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3134
.format(uid, gid, os.strerror(error.errno)))
3178
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3179
os.strerror(error.errno))
3135
3180
if error.errno != errno.EPERM:
3136
3181
raise
3137
3182
3144
3189
3145
3190
@gnutls.log_func
3146
3191
def debug_gnutls(level, string):
3147
logger.debug("GnuTLS: %s", string[:-1])
3192
log.debug("GnuTLS: %s",
3193
string[:-1].decode("utf-8", errors="replace"))
3148
3194
3149
3195
gnutls.global_set_log_function(debug_gnutls)
3150
3196
3179
3225
"se.bsnet.fukt.Mandos", bus,
3180
3226
do_not_queue=True)
3181
3227
except dbus.exceptions.DBusException as e:
3182
logger.error("Disabling D-Bus:", exc_info=e)
3228
log.error("Disabling D-Bus:", exc_info=e)
3183
3229
use_dbus = False
3184
3230
server_settings["use_dbus"] = False
3185
3231
tcp_server.use_dbus = False
3244
3290
if isinstance(s, bytes)
3245
3291
else s) for s in
3246
3292
value["client_structure"]]
3247
# .name & .host
3248
for k in ("name", "host"):
3293
# .name, .host, and .checker_command
3294
for k in ("name", "host", "checker_command"):
3249
3295
if isinstance(value[k], bytes):
3250
3296
value[k] = value[k].decode("utf-8")
3251
3297
if "key_id" not in value:
3261
3307
for key, value in
3262
3308
bytes_old_client_settings.items()}
3263
3309
del bytes_old_client_settings
3264
# .host
3310
# .host and .checker_command
3265
3311
for value in old_client_settings.values():
3266
if isinstance(value["host"], bytes):
3267
value["host"] = (value["host"]
3268
.decode("utf-8"))
3312
for attribute in ("host", "checker_command"):
3313
if isinstance(value[attribute], bytes):
3314
value[attribute] = (value[attribute]
3315
.decode("utf-8"))
3269
3316
os.remove(stored_state_path)
3270
3317
except IOError as e:
3271
3318
if e.errno == errno.ENOENT:
3272
logger.warning("Could not load persistent state:"
3273
" {}".format(os.strerror(e.errno)))
3319
log.warning("Could not load persistent state:"
3320
" %s", os.strerror(e.errno))
3274
3321
else:
3275
logger.critical("Could not load persistent state:",
3276
exc_info=e)
3322
log.critical("Could not load persistent state:",
3323
exc_info=e)
3277
3324
raise
3278
3325
except EOFError as e:
3279
logger.warning("Could not load persistent state: "
3280
"EOFError:",
3281
exc_info=e)
3326
log.warning("Could not load persistent state: EOFError:",
3327
exc_info=e)
3282
3328
3283
3329
with PGPEngine() as pgp:
3284
3330
for client_name, client in clients_data.items():
3311
3357
if client["enabled"]:
3312
3358
if datetime.datetime.utcnow() >= client["expires"]:
3313
3359
if not client["last_checked_ok"]:
3314
logger.warning(
3315
"disabling client {} - Client never "
3316
"performed a successful checker".format(
3317
client_name))
3360
log.warning("disabling client %s - Client"
3361
" never performed a successful"
3362
" checker", client_name)
3318
3363
client["enabled"] = False
3319
3364
elif client["last_checker_status"] != 0:
3320
logger.warning(
3321
"disabling client {} - Client last"
3322
" checker failed with error code"
3323
" {}".format(
3324
client_name,
3325
client["last_checker_status"]))
3365
log.warning("disabling client %s - Client"
3366
" last checker failed with error"
3367
" code %s", client_name,
3368
client["last_checker_status"])
3326
3369
client["enabled"] = False
3327
3370
else:
3328
3371
client["expires"] = (
3329
3372
datetime.datetime.utcnow()
3330
3373
+ client["timeout"])
3331
logger.debug("Last checker succeeded,"
3332
" keeping {} enabled".format(
3333
client_name))
3374
log.debug("Last checker succeeded, keeping %s"
3375
" enabled", client_name)
3334
3376
try:
3335
3377
client["secret"] = pgp.decrypt(
3336
3378
client["encrypted_secret"],
3337
3379
client_settings[client_name]["secret"])
3338
3380
except PGPError:
3339
3381
# If decryption fails, we use secret from new settings
3340
logger.debug("Failed to decrypt {} old secret".format(
3341
client_name))
3382
log.debug("Failed to decrypt %s old secret",
3383
client_name)
3342
3384
client["secret"] = (client_settings[client_name]
3343
3385
["secret"])
3344
3386
3358
3400
server_settings=server_settings)
3359
3401
3360
3402
if not tcp_server.clients:
3361
logger.warning("No clients defined")
3403
log.warning("No clients defined")
3362
3404
3363
3405
if not foreground:
3364
3406
if pidfile is not None:
3367
3409
with pidfile:
3368
3410
print(pid, file=pidfile)
3369
3411
except IOError:
3370
logger.error("Could not write to file %r with PID %d",
3371
pidfilename, pid)
3412
log.error("Could not write to file %r with PID %d",
3413
pidfilename, pid)
3372
3414
del pidfile
3373
3415
del pidfilename
3374
3416
3524
3566
3525
3567
try:
3526
3568
with tempfile.NamedTemporaryFile(
3527
mode='wb',
3569
mode="wb",
3528
3570
suffix=".pickle",
3529
prefix='clients-',
3571
prefix="clients-",
3530
3572
dir=os.path.dirname(stored_state_path),
3531
3573
delete=False) as stored_state:
3532
3574
pickle.dump((clients, client_settings), stored_state,
3540
3582
except NameError:
3541
3583
pass
3542
3584
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3543
logger.warning("Could not save persistent state: {}"
3544
.format(os.strerror(e.errno)))
3585
log.warning("Could not save persistent state: %s",
3586
os.strerror(e.errno))
3545
3587
else:
3546
logger.warning("Could not save persistent state:",
3547
exc_info=e)
3588
log.warning("Could not save persistent state:",
3589
exc_info=e)
3548
3590
raise
3549
3591
3550
3592
# Delete all clients, and settings from config
3576
3618
if zeroconf:
3577
3619
service.port = tcp_server.socket.getsockname()[1]
3578
3620
if use_ipv6:
3579
logger.info("Now listening on address %r, port %d,"
3580
" flowinfo %d, scope_id %d",
3581
*tcp_server.socket.getsockname())
3621
log.info("Now listening on address %r, port %d, flowinfo %d,"
3622
" scope_id %d", *tcp_server.socket.getsockname())
3582
3623
else: # IPv4
3583
logger.info("Now listening on address %r, port %d",
3584
*tcp_server.socket.getsockname())
3624
log.info("Now listening on address %r, port %d",
3625
*tcp_server.socket.getsockname())
3585
3626
3586
3627
# service.interface = tcp_server.socket.getsockname()[3]
3587
3628
3591
3632
try:
3592
3633
service.activate()
3593
3634
except dbus.exceptions.DBusException as error:
3594
logger.critical("D-Bus Exception", exc_info=error)
3635
log.critical("D-Bus Exception", exc_info=error)
3595
3636
cleanup()
3596
3637
sys.exit(1)
3597
3638
# End of Avahi example code
3598
3639
3599
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3600
lambda *args, **kwargs:
3601
(tcp_server.handle_request
3602
(*args[2:], **kwargs) or True))
3640
GLib.io_add_watch(
3641
GLib.IOChannel.unix_new(tcp_server.fileno()),
3642
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3643
lambda *args, **kwargs: (tcp_server.handle_request
3644
(*args[2:], **kwargs) or True))
3603
3645
3604
logger.debug("Starting main loop")
3646
log.debug("Starting main loop")
3605
3647
main_loop.run()
3606
3648
except AvahiError as error:
3607
logger.critical("Avahi Error", exc_info=error)
3649
log.critical("Avahi Error", exc_info=error)
3608
3650
cleanup()
3609
3651
sys.exit(1)
3610
3652
except KeyboardInterrupt:
3611
3653
if debug:
3612
3654
print("", file=sys.stderr)
3613
logger.debug("Server received KeyboardInterrupt")
3614
logger.debug("Server exiting")
3655
log.debug("Server received KeyboardInterrupt")
3656
log.debug("Server exiting")
3615
3657
# Must run before the D-Bus bus name gets deregistered
3616
3658
cleanup()
3617
3659
3618
3660
3619
def should_only_run_tests():
3661
def parse_test_args():
3662
# type: () -> argparse.Namespace
3620
3663
parser = argparse.ArgumentParser(add_help=False)
3621
parser.add_argument("--check", action='store_true')
3664
parser.add_argument("--check", action="store_true")
3665
parser.add_argument("--prefix", )
3622
3666
args, unknown_args = parser.parse_known_args()
3623
run_tests = args.check
3624
if run_tests:
3625
# Remove --check argument from sys.argv
3667
if args.check:
3668
# Remove test options from sys.argv
3626
3669
sys.argv[1:] = unknown_args
3627
return run_tests
3670
return args
3628
3671
3629
3672
# Add all tests from doctest strings
3630
3673
def load_tests(loader, tests, none):
3632
3675
tests.addTests(doctest.DocTestSuite())
3633
3676
return tests
3634
3677
3635
if __name__ == '__main__':
3678
if __name__ == "__main__":
3679
options = parse_test_args()
3636
3680
try:
3637
if should_only_run_tests():
3638
# Call using ./mandos --check [--verbose]
3639
unittest.main()
3681
if options.check:
3682
extra_test_prefix = options.prefix
3683
if extra_test_prefix is not None:
3684
if not (unittest.main(argv=[""], exit=False)
3685
.result.wasSuccessful()):
3686
sys.exit(1)
3687
class ExtraTestLoader(unittest.TestLoader):
3688
testMethodPrefix = extra_test_prefix
3689
# Call using ./scriptname --test [--verbose]
3690
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3691
else:
3692
unittest.main(argv=[""])
3640
3693
else:
3641
3694
main()
3642
3695
finally:
3643
3696
logging.shutdown()
3697
3698
# Local Variables:
3699
# run-tests:
3700
# (lambda (&optional extra)
3701
# (if (not (funcall run-tests-in-test-buffer default-directory
3702
# extra))
3703
# (funcall show-test-buffer-in-test-window)
3704
# (funcall remove-test-window)
3705
# (if extra (message "Extra tests run successfully!"))))
3706
# run-tests-in-test-buffer:
3707
# (lambda (dir &optional extra)
3708
# (with-current-buffer (get-buffer-create "*Test*")
3709
# (setq buffer-read-only nil
3710
# default-directory dir)
3711
# (erase-buffer)
3712
# (compilation-mode))
3713
# (let ((process-result
3714
# (let ((inhibit-read-only t))
3715
# (process-file-shell-command
3716
# (funcall get-command-line extra) nil "*Test*"))))
3717
# (and (numberp process-result)
3718
# (= process-result 0))))
3719
# get-command-line:
3720
# (lambda (&optional extra)
3721
# (let ((quoted-script
3722
# (shell-quote-argument (funcall get-script-name))))
3723
# (format
3724
# (concat "%s --check" (if extra " --prefix=atest" ""))
3725
# quoted-script)))
3726
# get-script-name:
3727
# (lambda ()
3728
# (if (fboundp 'file-local-name)
3729
# (file-local-name (buffer-file-name))
3730
# (or (file-remote-p (buffer-file-name) 'localname)
3731
# (buffer-file-name))))
3732
# remove-test-window:
3733
# (lambda ()
3734
# (let ((test-window (get-buffer-window "*Test*")))
3735
# (if test-window (delete-window test-window))))
3736
# show-test-buffer-in-test-window:
3737
# (lambda ()
3738
# (when (not (get-buffer-window-list "*Test*"))
3739
# (setq next-error-last-buffer (get-buffer "*Test*"))
3740
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3741
# (display-buffer-overriding-action
3742
# `((display-buffer-in-side-window) (side . ,side)
3743
# (window-height . fit-window-to-buffer)
3744
# (window-width . fit-window-to-buffer))))
3745
# (display-buffer "*Test*"))))
3746
# eval:
3747
# (progn
3748
# (let* ((run-extra-tests (lambda () (interactive)
3749
# (funcall run-tests t)))
3750
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3751
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3752
# (setq minor-mode-overriding-map-alist
3753
# (cons `(run-tests . ,outer-keymap)
3754
# minor-mode-overriding-map-alist)))
3755
# (add-hook 'after-save-hook run-tests 90 t))
3756
# End:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0