To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1274
- compare with another revision
- download diff
- download tarball
- view history from revision 1274
- Committer: Teddy Hogeborn
- Date: 2023-02-11 06:58:15 UTC
- Revision ID: teddy@recompile.se-20230211065815-jtffi61tbdrgr875
Suppress warnings
Suppress warnings about mlock()ing uninitialized memory and reading an
ievent struct.
* dracut-module/password-agent.c (send_password_to_socket): Suppress
"-Wmaybe-uninitialized" when mlock()ing password send buffer.
(test_read_inotify_event_IN_DELETE_badname): When reading from
a struct ievent, suppress "-Wstringop-overread".
Suppress warnings about mlock()ing uninitialized memory and reading an
ievent struct.
* dracut-module/password-agent.c (send_password_to_socket): Suppress
"-Wmaybe-uninitialized" when mlock()ing password send buffer.
(test_read_inotify_event_IN_DELETE_badname): When reading from
a struct ievent, suppress "-Wstringop-overread".
- files added:
- debian/po/es.po
- files modified:
- DBUS-API
added
removed
mandos
1
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
2
# -*- coding: utf-8; lexical-binding: t -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
40
39
except ImportError:
41
40
pass
42
41
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
43
47
try:
44
48
import SocketServer as socketserver
45
49
except ImportError:
46
50
import socketserver
47
51
import socket
48
import argparse
49
52
import datetime
50
53
import errno
51
54
try:
52
55
import ConfigParser as configparser
53
56
except ImportError:
54
57
import configparser
55
import sys
56
58
import re
57
import os
58
59
import signal
59
60
import subprocess
60
61
import atexit
61
62
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import unittest
80
import random
81
import shlex
81
82
82
83
import dbus
83
84
import dbus.service
92
93
if sys.version_info.major == 2:
93
94
__metaclass__ = type
94
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
95
112
96
113
# Show warnings by default
97
114
if not sys.warnoptions:
126
143
if sys.version_info < (3, 2):
127
144
configparser.Configparser = configparser.SafeConfigParser
128
145
129
version = "1.8.9"
146
version = "1.8.16"
130
147
stored_state_file = "clients.pickle"
131
148
132
logger = logging.getLogger()
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
133
150
logging.captureWarnings(True) # Show warnings via the logging system
134
151
syslogger = None
135
152
172
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
173
190
address="/dev/log"))
174
191
syslogger.setFormatter(logging.Formatter
175
('Mandos [%(process)d]: %(levelname)s:'
176
' %(message)s'))
177
logger.addHandler(syslogger)
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
178
195
179
196
if debug:
180
197
console = logging.StreamHandler()
181
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
182
' [%(process)d]:'
183
' %(levelname)s:'
184
' %(message)s'))
185
logger.addHandler(console)
186
logger.setLevel(level)
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
187
204
188
205
189
206
class PGPError(Exception):
207
224
except OSError as e:
208
225
if e.errno != errno.ENOENT:
209
226
raise
210
self.gnupgargs = ['--batch',
211
'--homedir', self.tempdir,
212
'--force-mdc',
213
'--quiet']
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
214
231
# Only GPG version 1 has the --no-use-agent option.
215
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
216
233
self.gnupgargs.append("--no-use-agent")
255
272
dir=self.tempdir) as passfile:
256
273
passfile.write(passphrase)
257
274
passfile.flush()
258
proc = subprocess.Popen([self.gpg, '--symmetric',
259
'--passphrase-file',
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
260
277
passfile.name]
261
278
+ self.gnupgargs,
262
279
stdin=subprocess.PIPE,
273
290
dir=self.tempdir) as passfile:
274
291
passfile.write(passphrase)
275
292
passfile.flush()
276
proc = subprocess.Popen([self.gpg, '--decrypt',
277
'--passphrase-file',
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
278
295
passfile.name]
279
296
+ self.gnupgargs,
280
297
stdin=subprocess.PIPE,
333
350
Attributes:
334
351
interface: integer; avahi.IF_UNSPEC or an interface index.
335
352
Used to optionally bind to the specified interface.
336
name: string; Example: 'Mandos'
337
type: string; Example: '_mandos._tcp'.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
338
355
See <https://www.iana.org/assignments/service-names-port-numbers>
339
356
port: integer; what port to announce
340
357
TXT: list of strings; TXT record for the service
377
394
def rename(self, remove=True):
378
395
"""Derived from the Avahi example code"""
379
396
if self.rename_count >= self.max_renames:
380
logger.critical("No suitable Zeroconf service name found"
381
" after %i retries, exiting.",
382
self.rename_count)
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
383
400
raise AvahiServiceError("Too many renames")
384
401
self.name = str(
385
402
self.server.GetAlternativeServiceName(self.name))
386
403
self.rename_count += 1
387
logger.info("Changing Zeroconf service name to %r ...",
388
self.name)
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
389
406
if remove:
390
407
self.remove()
391
408
try:
393
410
except dbus.exceptions.DBusException as error:
394
411
if (error.get_dbus_name()
395
412
== "org.freedesktop.Avahi.CollisionError"):
396
logger.info("Local Zeroconf service name collision.")
413
log.info("Local Zeroconf service name collision.")
397
414
return self.rename(remove=False)
398
415
else:
399
logger.critical("D-Bus Exception", exc_info=error)
416
log.critical("D-Bus Exception", exc_info=error)
400
417
self.cleanup()
401
418
os._exit(1)
402
419
418
435
avahi.DBUS_INTERFACE_ENTRY_GROUP)
419
436
self.entry_group_state_changed_match = (
420
437
self.group.connect_to_signal(
421
'StateChanged', self.entry_group_state_changed))
422
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
423
self.name, self.type)
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
424
441
self.group.AddService(
425
442
self.interface,
426
443
self.protocol,
433
450
434
451
def entry_group_state_changed(self, state, error):
435
452
"""Derived from the Avahi example code"""
436
logger.debug("Avahi entry group state change: %i", state)
453
log.debug("Avahi entry group state change: %i", state)
437
454
438
455
if state == avahi.ENTRY_GROUP_ESTABLISHED:
439
logger.debug("Zeroconf service established.")
456
log.debug("Zeroconf service established.")
440
457
elif state == avahi.ENTRY_GROUP_COLLISION:
441
logger.info("Zeroconf service name collision.")
458
log.info("Zeroconf service name collision.")
442
459
self.rename()
443
460
elif state == avahi.ENTRY_GROUP_FAILURE:
444
logger.critical("Avahi: Error in group state changed %s",
445
str(error))
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
446
463
raise AvahiGroupError("State changed: {!s}".format(error))
447
464
448
465
def cleanup(self):
458
475
459
476
def server_state_changed(self, state, error=None):
460
477
"""Derived from the Avahi example code"""
461
logger.debug("Avahi server state change: %i", state)
478
log.debug("Avahi server state change: %i", state)
462
479
bad_states = {
463
480
avahi.SERVER_INVALID: "Zeroconf server invalid",
464
481
avahi.SERVER_REGISTERING: None,
468
485
if state in bad_states:
469
486
if bad_states[state] is not None:
470
487
if error is None:
471
logger.error(bad_states[state])
488
log.error(bad_states[state])
472
489
else:
473
logger.error(bad_states[state] + ": %r", error)
490
log.error(bad_states[state] + ": %r", error)
474
491
self.cleanup()
475
492
elif state == avahi.SERVER_RUNNING:
476
493
try:
478
495
except dbus.exceptions.DBusException as error:
479
496
if (error.get_dbus_name()
480
497
== "org.freedesktop.Avahi.CollisionError"):
481
logger.info("Local Zeroconf service name"
482
" collision.")
498
log.info("Local Zeroconf service name collision.")
483
499
return self.rename(remove=False)
484
500
else:
485
logger.critical("D-Bus Exception", exc_info=error)
501
log.critical("D-Bus Exception", exc_info=error)
486
502
self.cleanup()
487
503
os._exit(1)
488
504
else:
489
505
if error is None:
490
logger.debug("Unknown state: %r", state)
506
log.debug("Unknown state: %r", state)
491
507
else:
492
logger.debug("Unknown state: %r: %r", state, error)
508
log.debug("Unknown state: %r: %r", state, error)
493
509
494
510
def activate(self):
495
511
"""Derived from the Avahi example code"""
507
523
class AvahiServiceToSyslog(AvahiService):
508
524
def rename(self, *args, **kwargs):
509
525
"""Add the new name to the syslog messages"""
510
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
511
528
syslogger.setFormatter(logging.Formatter(
512
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
513
530
.format(self.name)))
514
531
return ret
515
532
545
562
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
546
563
547
564
# Types
548
class session_int(ctypes.Structure):
565
class _session_int(ctypes.Structure):
549
566
_fields_ = []
550
session_t = ctypes.POINTER(session_int)
567
session_t = ctypes.POINTER(_session_int)
551
568
552
569
class certificate_credentials_st(ctypes.Structure):
553
570
_fields_ = []
556
573
certificate_type_t = ctypes.c_int
557
574
558
575
class datum_t(ctypes.Structure):
559
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
560
('size', ctypes.c_uint)]
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
561
578
562
class openpgp_crt_int(ctypes.Structure):
579
class _openpgp_crt_int(ctypes.Structure):
563
580
_fields_ = []
564
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
565
582
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
566
583
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
567
584
credentials_type_t = ctypes.c_int
576
593
# gnutls.strerror()
577
594
self.code = code
578
595
if message is None and code is not None:
579
message = gnutls.strerror(code)
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
580
598
return super(gnutls.Error, self).__init__(
581
599
message, *args)
582
600
583
601
class CertificateSecurityError(Error):
584
602
pass
585
603
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
586
629
# Classes
587
class Credentials:
630
class Credentials(With_from_param):
588
631
def __init__(self):
589
self._c_object = gnutls.certificate_credentials_t()
590
gnutls.certificate_allocate_credentials(
591
ctypes.byref(self._c_object))
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
592
634
self.type = gnutls.CRD_CERTIFICATE
593
635
594
636
def __del__(self):
595
gnutls.certificate_free_credentials(self._c_object)
637
gnutls.certificate_free_credentials(self)
596
638
597
class ClientSession:
639
class ClientSession(With_from_param):
598
640
def __init__(self, socket, credentials=None):
599
self._c_object = gnutls.session_t()
641
self._as_parameter_ = gnutls.session_t()
600
642
gnutls_flags = gnutls.CLIENT
601
643
if gnutls.check_version(b"3.5.6"):
602
644
gnutls_flags |= gnutls.NO_TICKETS
603
645
if gnutls.has_rawpk:
604
646
gnutls_flags |= gnutls.ENABLE_RAWPK
605
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
647
gnutls.init(self, gnutls_flags)
606
648
del gnutls_flags
607
gnutls.set_default_priority(self._c_object)
608
gnutls.transport_set_ptr(self._c_object, socket.fileno())
609
gnutls.handshake_set_private_extensions(self._c_object,
610
True)
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
611
652
self.socket = socket
612
653
if credentials is None:
613
654
credentials = gnutls.Credentials()
614
gnutls.credentials_set(self._c_object, credentials.type,
615
ctypes.cast(credentials._c_object,
616
ctypes.c_void_p))
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
617
657
self.credentials = credentials
618
658
619
659
def __del__(self):
620
gnutls.deinit(self._c_object)
660
gnutls.deinit(self)
621
661
622
662
def handshake(self):
623
return gnutls.handshake(self._c_object)
663
return gnutls.handshake(self)
624
664
625
665
def send(self, data):
626
666
data = bytes(data)
627
667
data_len = len(data)
628
668
while data_len > 0:
629
data_len -= gnutls.record_send(self._c_object,
630
data[-data_len:],
669
data_len -= gnutls.record_send(self, data[-data_len:],
631
670
data_len)
632
671
633
672
def bye(self):
634
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
635
674
636
675
# Error handling functions
637
676
def _error_code(result):
638
677
"""A function to raise exceptions on errors, suitable
639
for the 'restype' attribute on ctypes functions"""
640
if result >= 0:
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
641
680
return result
642
681
if result == gnutls.E_NO_CERTIFICATE_FOUND:
643
682
raise gnutls.CertificateSecurityError(code=result)
644
683
raise gnutls.Error(code=result)
645
684
646
def _retry_on_error(result, func, arguments):
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
647
687
"""A function to retry on some errors, suitable
648
for the 'errcheck' attribute on ctypes functions"""
649
while result < 0:
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
650
690
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
651
691
return _error_code(result)
652
692
result = func(*arguments)
657
697
658
698
# Functions
659
699
priority_set_direct = _library.gnutls_priority_set_direct
660
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
661
701
ctypes.POINTER(ctypes.c_char_p)]
662
702
priority_set_direct.restype = _error_code
663
703
664
704
init = _library.gnutls_init
665
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
666
706
init.restype = _error_code
667
707
668
708
set_default_priority = _library.gnutls_set_default_priority
669
set_default_priority.argtypes = [session_t]
709
set_default_priority.argtypes = [ClientSession]
670
710
set_default_priority.restype = _error_code
671
711
672
712
record_send = _library.gnutls_record_send
673
record_send.argtypes = [session_t, ctypes.c_void_p,
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
674
714
ctypes.c_size_t]
675
715
record_send.restype = ctypes.c_ssize_t
676
716
record_send.errcheck = _retry_on_error
678
718
certificate_allocate_credentials = (
679
719
_library.gnutls_certificate_allocate_credentials)
680
720
certificate_allocate_credentials.argtypes = [
681
ctypes.POINTER(certificate_credentials_t)]
721
PointerTo(Credentials)]
682
722
certificate_allocate_credentials.restype = _error_code
683
723
684
724
certificate_free_credentials = (
685
725
_library.gnutls_certificate_free_credentials)
686
certificate_free_credentials.argtypes = [
687
certificate_credentials_t]
726
certificate_free_credentials.argtypes = [Credentials]
688
727
certificate_free_credentials.restype = None
689
728
690
729
handshake_set_private_extensions = (
691
730
_library.gnutls_handshake_set_private_extensions)
692
handshake_set_private_extensions.argtypes = [session_t,
731
handshake_set_private_extensions.argtypes = [ClientSession,
693
732
ctypes.c_int]
694
733
handshake_set_private_extensions.restype = None
695
734
696
735
credentials_set = _library.gnutls_credentials_set
697
credentials_set.argtypes = [session_t, credentials_type_t,
698
ctypes.c_void_p]
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
699
738
credentials_set.restype = _error_code
700
739
701
740
strerror = _library.gnutls_strerror
703
742
strerror.restype = ctypes.c_char_p
704
743
705
744
certificate_type_get = _library.gnutls_certificate_type_get
706
certificate_type_get.argtypes = [session_t]
745
certificate_type_get.argtypes = [ClientSession]
707
746
certificate_type_get.restype = _error_code
708
747
709
748
certificate_get_peers = _library.gnutls_certificate_get_peers
710
certificate_get_peers.argtypes = [session_t,
749
certificate_get_peers.argtypes = [ClientSession,
711
750
ctypes.POINTER(ctypes.c_uint)]
712
751
certificate_get_peers.restype = ctypes.POINTER(datum_t)
713
752
720
759
global_set_log_function.restype = None
721
760
722
761
deinit = _library.gnutls_deinit
723
deinit.argtypes = [session_t]
762
deinit.argtypes = [ClientSession]
724
763
deinit.restype = None
725
764
726
765
handshake = _library.gnutls_handshake
727
handshake.argtypes = [session_t]
728
handshake.restype = _error_code
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
729
768
handshake.errcheck = _retry_on_error
730
769
731
770
transport_set_ptr = _library.gnutls_transport_set_ptr
732
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
733
772
transport_set_ptr.restype = None
734
773
735
774
bye = _library.gnutls_bye
736
bye.argtypes = [session_t, close_request_t]
737
bye.restype = _error_code
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
738
777
bye.errcheck = _retry_on_error
739
778
740
779
check_version = _library.gnutls_check_version
757
796
758
797
x509_crt_fmt_t = ctypes.c_int
759
798
760
# All the function declarations below are from gnutls/abstract.h
799
# All the function declarations below are from
800
# gnutls/abstract.h
761
801
pubkey_init = _library.gnutls_pubkey_init
762
802
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
763
803
pubkey_init.restype = _error_code
777
817
pubkey_deinit.argtypes = [pubkey_t]
778
818
pubkey_deinit.restype = None
779
819
else:
780
# All the function declarations below are from gnutls/openpgp.h
820
# All the function declarations below are from
821
# gnutls/openpgp.h
781
822
782
823
openpgp_crt_init = _library.gnutls_openpgp_crt_init
783
824
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
789
830
openpgp_crt_fmt_t]
790
831
openpgp_crt_import.restype = _error_code
791
832
792
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
793
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
794
ctypes.POINTER(ctypes.c_uint)]
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
795
840
openpgp_crt_verify_self.restype = _error_code
796
841
797
842
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
808
853
809
854
if check_version(b"3.6.4"):
810
855
certificate_type_get2 = _library.gnutls_certificate_type_get2
811
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
812
857
certificate_type_get2.restype = _error_code
813
858
814
859
# Remove non-public functions
830
875
"""A representation of a client host served by this server.
831
876
832
877
Attributes:
833
approved: bool(); 'None' if not yet approved/disapproved
878
approved: bool(); None if not yet approved/disapproved
834
879
approval_delay: datetime.timedelta(); Time to wait for approval
835
880
approval_duration: datetime.timedelta(); Duration of one approval
836
881
checker: multiprocessing.Process(); a running checker process used
837
to see if the client lives. 'None' if no process is
882
to see if the client lives. None if no process is
838
883
running.
839
884
checker_callback_tag: a GLib event source tag, or None
840
885
checker_command: string; External command which is run to check
964
1009
self.last_enabled = None
965
1010
self.expires = None
966
1011
967
logger.debug("Creating client %r", self.name)
968
logger.debug(" Key ID: %s", self.key_id)
969
logger.debug(" Fingerprint: %s", self.fingerprint)
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
970
1015
self.created = settings.get("created",
971
1016
datetime.datetime.utcnow())
972
1017
1000
1045
if getattr(self, "enabled", False):
1001
1046
# Already enabled
1002
1047
return
1003
self.expires = datetime.datetime.utcnow() + self.timeout
1004
1048
self.enabled = True
1005
1049
self.last_enabled = datetime.datetime.utcnow()
1006
1050
self.init_checker()
1011
1055
if not getattr(self, "enabled", False):
1012
1056
return False
1013
1057
if not quiet:
1014
logger.info("Disabling client %s", self.name)
1058
log.info("Disabling client %s", self.name)
1015
1059
if getattr(self, "disable_initiator_tag", None) is not None:
1016
1060
GLib.source_remove(self.disable_initiator_tag)
1017
1061
self.disable_initiator_tag = None
1029
1073
def __del__(self):
1030
1074
self.disable()
1031
1075
1032
def init_checker(self):
1033
# Schedule a new checker to be started an 'interval' from now,
1034
# and every interval from then on.
1076
def init_checker(self, randomize_start=False):
1077
# Schedule a new checker to be started a randomly selected
1078
# time (a fraction of 'interval') from now. This spreads out
1079
# the startup of checkers over time when the server is
1080
# started.
1035
1081
if self.checker_initiator_tag is not None:
1036
1082
GLib.source_remove(self.checker_initiator_tag)
1083
interval_milliseconds = int(self.interval.total_seconds()
1084
* 1000)
1085
if randomize_start:
1086
delay_milliseconds = random.randrange(
1087
interval_milliseconds + 1)
1088
else:
1089
delay_milliseconds = interval_milliseconds
1037
1090
self.checker_initiator_tag = GLib.timeout_add(
1038
int(self.interval.total_seconds() * 1000),
1039
self.start_checker)
1040
# Schedule a disable() when 'timeout' has passed
1091
delay_milliseconds, self.start_checker, randomize_start)
1092
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1093
# A checker might take up to an 'interval' of time, so we can
1094
# expire at the soonest one interval after a checker was
1095
# started. Since the initial checker is delayed, the expire
1096
# time might have to be extended.
1097
now = datetime.datetime.utcnow()
1098
self.expires = now + delay + self.interval
1099
# Schedule a disable() at expire time
1041
1100
if self.disable_initiator_tag is not None:
1042
1101
GLib.source_remove(self.disable_initiator_tag)
1043
1102
self.disable_initiator_tag = GLib.timeout_add(
1044
int(self.timeout.total_seconds() * 1000), self.disable)
1045
# Also start a new checker *right now*.
1046
self.start_checker()
1103
int((self.expires - now).total_seconds() * 1000),
1104
self.disable)
1047
1105
1048
1106
def checker_callback(self, source, condition, connection,
1049
1107
command):
1060
1118
self.last_checker_status = returncode
1061
1119
self.last_checker_signal = None
1062
1120
if self.last_checker_status == 0:
1063
logger.info("Checker for %(name)s succeeded",
1064
vars(self))
1121
log.info("Checker for %(name)s succeeded", vars(self))
1065
1122
self.checked_ok()
1066
1123
else:
1067
logger.info("Checker for %(name)s failed", vars(self))
1124
log.info("Checker for %(name)s failed", vars(self))
1068
1125
else:
1069
1126
self.last_checker_status = -1
1070
1127
self.last_checker_signal = -returncode
1071
logger.warning("Checker for %(name)s crashed?",
1072
vars(self))
1128
log.warning("Checker for %(name)s crashed?", vars(self))
1073
1129
return False
1074
1130
1075
1131
def checked_ok(self):
1094
1150
def need_approval(self):
1095
1151
self.last_approval_request = datetime.datetime.utcnow()
1096
1152
1097
def start_checker(self):
1153
def start_checker(self, start_was_randomized=False):
1098
1154
"""Start a new checker subprocess if one is not running.
1099
1155
1100
1156
If a checker already exists, leave it running and do
1109
1165
# should be.
1110
1166
1111
1167
if self.checker is not None and not self.checker.is_alive():
1112
logger.warning("Checker was not alive; joining")
1168
log.warning("Checker was not alive; joining")
1113
1169
self.checker.join()
1114
1170
self.checker = None
1115
1171
# Start a new checker if needed
1116
1172
if self.checker is None:
1117
1173
# Escape attributes for the shell
1118
1174
escaped_attrs = {
1119
attr: re.escape(str(getattr(self, attr)))
1175
attr: shlex.quote(str(getattr(self, attr)))
1120
1176
for attr in self.runtime_expansions}
1121
1177
try:
1122
1178
command = self.checker_command % escaped_attrs
1123
1179
except TypeError as error:
1124
logger.error('Could not format string "%s"',
1125
self.checker_command,
1126
exc_info=error)
1180
log.error('Could not format string "%s"',
1181
self.checker_command, exc_info=error)
1127
1182
return True # Try again later
1128
1183
self.current_checker_command = command
1129
logger.info("Starting checker %r for %s", command,
1130
self.name)
1184
log.info("Starting checker %r for %s", command, self.name)
1131
1185
# We don't need to redirect stdout and stderr, since
1132
1186
# in normal mode, that is already done by daemon(),
1133
1187
# and in debug mode we don't want to. (Stdin is
1152
1206
GLib.IOChannel.unix_new(pipe[0].fileno()),
1153
1207
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1154
1208
self.checker_callback, pipe[0], command)
1209
if start_was_randomized:
1210
# We were started after a random delay; Schedule a new
1211
# checker to be started an 'interval' from now, and every
1212
# interval from then on.
1213
now = datetime.datetime.utcnow()
1214
self.checker_initiator_tag = GLib.timeout_add(
1215
int(self.interval.total_seconds() * 1000),
1216
self.start_checker)
1217
self.expires = max(self.expires, now + self.interval)
1218
# Don't start a new checker again after same random delay
1219
return False
1155
1220
# Re-run this periodically if run by GLib.timeout_add
1156
1221
return True
1157
1222
1162
1227
self.checker_callback_tag = None
1163
1228
if getattr(self, "checker", None) is None:
1164
1229
return
1165
logger.debug("Stopping checker for %(name)s", vars(self))
1230
log.debug("Stopping checker for %(name)s", vars(self))
1166
1231
self.checker.terminate()
1167
1232
self.checker = None
1168
1233
1195
1260
func._dbus_name = func.__name__
1196
1261
if func._dbus_name.endswith("_dbus_property"):
1197
1262
func._dbus_name = func._dbus_name[:-14]
1198
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1263
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1199
1264
return func
1200
1265
1201
1266
return decorator
1290
1355
1291
1356
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1292
1357
out_signature="s",
1293
path_keyword='object_path',
1294
connection_keyword='connection')
1358
path_keyword="object_path",
1359
connection_keyword="connection")
1295
1360
def Introspect(self, object_path, connection):
1296
1361
"""Overloading of standard D-Bus method.
1297
1362
1346
1411
document.unlink()
1347
1412
except (AttributeError, xml.dom.DOMException,
1348
1413
xml.parsers.expat.ExpatError) as error:
1349
logger.error("Failed to override Introspection method",
1350
exc_info=error)
1414
log.error("Failed to override Introspection method",
1415
exc_info=error)
1351
1416
return xmlstring
1352
1417
1353
1418
1450
1515
1451
1516
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1452
1517
out_signature="s",
1453
path_keyword='object_path',
1454
connection_keyword='connection')
1518
path_keyword="object_path",
1519
connection_keyword="connection")
1455
1520
def Introspect(self, object_path, connection):
1456
1521
"""Overloading of standard D-Bus method.
1457
1522
1513
1578
document.unlink()
1514
1579
except (AttributeError, xml.dom.DOMException,
1515
1580
xml.parsers.expat.ExpatError) as error:
1516
logger.error("Failed to override Introspection method",
1517
exc_info=error)
1581
log.error("Failed to override Introspection method",
1582
exc_info=error)
1518
1583
return xmlstring
1519
1584
1520
1585
1552
1617
1553
1618
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1554
1619
out_signature="s",
1555
path_keyword='object_path',
1556
connection_keyword='connection')
1620
path_keyword="object_path",
1621
connection_keyword="connection")
1557
1622
def Introspect(self, object_path, connection):
1558
1623
"""Overloading of standard D-Bus method.
1559
1624
1584
1649
document.unlink()
1585
1650
except (AttributeError, xml.dom.DOMException,
1586
1651
xml.parsers.expat.ExpatError) as error:
1587
logger.error("Failed to override Introspection method",
1588
exc_info=error)
1652
log.error("Failed to override Introspection method",
1653
exc_info=error)
1589
1654
return xmlstring
1590
1655
1591
1656
2225
2290
class ProxyClient:
2226
2291
def __init__(self, child_pipe, key_id, fpr, address):
2227
2292
self._pipe = child_pipe
2228
self._pipe.send(('init', key_id, fpr, address))
2293
self._pipe.send(("init", key_id, fpr, address))
2229
2294
if not self._pipe.recv():
2230
2295
raise KeyError(key_id or fpr)
2231
2296
2232
2297
def __getattribute__(self, name):
2233
if name == '_pipe':
2298
if name == "_pipe":
2234
2299
return super(ProxyClient, self).__getattribute__(name)
2235
self._pipe.send(('getattr', name))
2300
self._pipe.send(("getattr", name))
2236
2301
data = self._pipe.recv()
2237
if data[0] == 'data':
2302
if data[0] == "data":
2238
2303
return data[1]
2239
if data[0] == 'function':
2304
if data[0] == "function":
2240
2305
2241
2306
def func(*args, **kwargs):
2242
self._pipe.send(('funcall', name, args, kwargs))
2307
self._pipe.send(("funcall", name, args, kwargs))
2243
2308
return self._pipe.recv()[1]
2244
2309
2245
2310
return func
2246
2311
2247
2312
def __setattr__(self, name, value):
2248
if name == '_pipe':
2313
if name == "_pipe":
2249
2314
return super(ProxyClient, self).__setattr__(name, value)
2250
self._pipe.send(('setattr', name, value))
2315
self._pipe.send(("setattr", name, value))
2251
2316
2252
2317
2253
2318
class ClientHandler(socketserver.BaseRequestHandler, object):
2258
2323
2259
2324
def handle(self):
2260
2325
with contextlib.closing(self.server.child_pipe) as child_pipe:
2261
logger.info("TCP connection from: %s",
2262
str(self.client_address))
2263
logger.debug("Pipe FD: %d",
2264
self.server.child_pipe.fileno())
2326
log.info("TCP connection from: %s",
2327
str(self.client_address))
2328
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2265
2329
2266
2330
session = gnutls.ClientSession(self.request)
2267
2331
2268
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2332
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2269
2333
# "+AES-256-CBC", "+SHA1",
2270
2334
# "+COMP-NULL", "+CTYPE-OPENPGP",
2271
2335
# "+DHE-DSS"))
2273
2337
priority = self.server.gnutls_priority
2274
2338
if priority is None:
2275
2339
priority = "NORMAL"
2276
gnutls.priority_set_direct(session._c_object,
2277
priority.encode("utf-8"),
2278
None)
2340
gnutls.priority_set_direct(session,
2341
priority.encode("utf-8"), None)
2279
2342
2280
2343
# Start communication using the Mandos protocol
2281
2344
# Get protocol number
2282
2345
line = self.request.makefile().readline()
2283
logger.debug("Protocol version: %r", line)
2346
log.debug("Protocol version: %r", line)
2284
2347
try:
2285
2348
if int(line.strip().split()[0]) > 1:
2286
2349
raise RuntimeError(line)
2287
2350
except (ValueError, IndexError, RuntimeError) as error:
2288
logger.error("Unknown protocol version: %s", error)
2351
log.error("Unknown protocol version: %s", error)
2289
2352
return
2290
2353
2291
2354
# Start GnuTLS connection
2292
2355
try:
2293
2356
session.handshake()
2294
2357
except gnutls.Error as error:
2295
logger.warning("Handshake failed: %s", error)
2358
log.warning("Handshake failed: %s", error)
2296
2359
# Do not run session.bye() here: the session is not
2297
2360
# established. Just abandon the request.
2298
2361
return
2299
logger.debug("Handshake succeeded")
2362
log.debug("Handshake succeeded")
2300
2363
2301
2364
approval_required = False
2302
2365
try:
2306
2369
key_id = self.key_id(
2307
2370
self.peer_certificate(session))
2308
2371
except (TypeError, gnutls.Error) as error:
2309
logger.warning("Bad certificate: %s", error)
2372
log.warning("Bad certificate: %s", error)
2310
2373
return
2311
logger.debug("Key ID: %s", key_id)
2374
log.debug("Key ID: %s",
2375
key_id.decode("utf-8",
2376
errors="replace"))
2312
2377
2313
2378
else:
2314
2379
key_id = b""
2316
2381
fpr = self.fingerprint(
2317
2382
self.peer_certificate(session))
2318
2383
except (TypeError, gnutls.Error) as error:
2319
logger.warning("Bad certificate: %s", error)
2384
log.warning("Bad certificate: %s", error)
2320
2385
return
2321
logger.debug("Fingerprint: %s", fpr)
2386
log.debug("Fingerprint: %s", fpr)
2322
2387
2323
2388
try:
2324
2389
client = ProxyClient(child_pipe, key_id, fpr,
2333
2398
2334
2399
while True:
2335
2400
if not client.enabled:
2336
logger.info("Client %s is disabled",
2337
client.name)
2401
log.info("Client %s is disabled", client.name)
2338
2402
if self.server.use_dbus:
2339
2403
# Emit D-Bus signal
2340
2404
client.Rejected("Disabled")
2344
2408
# We are approved or approval is disabled
2345
2409
break
2346
2410
elif client.approved is None:
2347
logger.info("Client %s needs approval",
2348
client.name)
2411
log.info("Client %s needs approval",
2412
client.name)
2349
2413
if self.server.use_dbus:
2350
2414
# Emit D-Bus signal
2351
2415
client.NeedApproval(
2352
2416
client.approval_delay.total_seconds()
2353
2417
* 1000, client.approved_by_default)
2354
2418
else:
2355
logger.warning("Client %s was not approved",
2356
client.name)
2419
log.warning("Client %s was not approved",
2420
client.name)
2357
2421
if self.server.use_dbus:
2358
2422
# Emit D-Bus signal
2359
2423
client.Rejected("Denied")
2367
2431
time2 = datetime.datetime.now()
2368
2432
if (time2 - time) >= delay:
2369
2433
if not client.approved_by_default:
2370
logger.warning("Client %s timed out while"
2371
" waiting for approval",
2372
client.name)
2434
log.warning("Client %s timed out while"
2435
" waiting for approval",
2436
client.name)
2373
2437
if self.server.use_dbus:
2374
2438
# Emit D-Bus signal
2375
2439
client.Rejected("Approval timed out")
2382
2446
try:
2383
2447
session.send(client.secret)
2384
2448
except gnutls.Error as error:
2385
logger.warning("gnutls send failed",
2386
exc_info=error)
2449
log.warning("gnutls send failed", exc_info=error)
2387
2450
return
2388
2451
2389
logger.info("Sending secret to %s", client.name)
2452
log.info("Sending secret to %s", client.name)
2390
2453
# bump the timeout using extended_timeout
2391
2454
client.bump_timeout(client.extended_timeout)
2392
2455
if self.server.use_dbus:
2399
2462
try:
2400
2463
session.bye()
2401
2464
except gnutls.Error as error:
2402
logger.warning("GnuTLS bye failed",
2403
exc_info=error)
2465
log.warning("GnuTLS bye failed", exc_info=error)
2404
2466
2405
2467
@staticmethod
2406
2468
def peer_certificate(session):
2407
2469
"Return the peer's certificate as a bytestring"
2408
2470
try:
2409
cert_type = gnutls.certificate_type_get2(session._c_object,
2410
gnutls.CTYPE_PEERS)
2471
cert_type = gnutls.certificate_type_get2(
2472
session, gnutls.CTYPE_PEERS)
2411
2473
except AttributeError:
2412
cert_type = gnutls.certificate_type_get(session._c_object)
2474
cert_type = gnutls.certificate_type_get(session)
2413
2475
if gnutls.has_rawpk:
2414
2476
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2415
2477
else:
2416
2478
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2417
2479
# If not a valid certificate type...
2418
2480
if cert_type not in valid_cert_types:
2419
logger.info("Cert type %r not in %r", cert_type,
2420
valid_cert_types)
2481
log.info("Cert type %r not in %r", cert_type,
2482
valid_cert_types)
2421
2483
# ...return invalid data
2422
2484
return b""
2423
2485
list_size = ctypes.c_uint(1)
2424
2486
cert_list = (gnutls.certificate_get_peers
2425
(session._c_object, ctypes.byref(list_size)))
2487
(session, ctypes.byref(list_size)))
2426
2488
if not bool(cert_list) and list_size.value != 0:
2427
2489
raise gnutls.Error("error getting peer certificate")
2428
2490
if list_size.value == 0:
2450
2512
buf = ctypes.create_string_buffer(32)
2451
2513
buf_len = ctypes.c_size_t(len(buf))
2452
2514
# Get the key ID from the raw public key into the buffer
2453
gnutls.pubkey_get_key_id(pubkey,
2454
gnutls.KEYID_USE_SHA256,
2455
ctypes.cast(ctypes.byref(buf),
2456
ctypes.POINTER(ctypes.c_ubyte)),
2457
ctypes.byref(buf_len))
2515
gnutls.pubkey_get_key_id(
2516
pubkey,
2517
gnutls.KEYID_USE_SHA256,
2518
ctypes.cast(ctypes.byref(buf),
2519
ctypes.POINTER(ctypes.c_ubyte)),
2520
ctypes.byref(buf_len))
2458
2521
# Deinit the certificate
2459
2522
gnutls.pubkey_deinit(pubkey)
2460
2523
2541
2604
2542
2605
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2543
2606
socketserver.TCPServer):
2544
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2607
"""IPv6-capable TCP server. Accepts None as address and/or port
2545
2608
2546
2609
Attributes:
2547
2610
enabled: Boolean; whether this server is activated yet
2598
2661
if SO_BINDTODEVICE is None:
2599
2662
# Fall back to a hard-coded value which seems to be
2600
2663
# common enough.
2601
logger.warning("SO_BINDTODEVICE not found, trying 25")
2664
log.warning("SO_BINDTODEVICE not found, trying 25")
2602
2665
SO_BINDTODEVICE = 25
2603
2666
try:
2604
2667
self.socket.setsockopt(
2606
2669
(self.interface + "\0").encode("utf-8"))
2607
2670
except socket.error as error:
2608
2671
if error.errno == errno.EPERM:
2609
logger.error("No permission to bind to"
2610
" interface %s", self.interface)
2672
log.error("No permission to bind to interface %s",
2673
self.interface)
2611
2674
elif error.errno == errno.ENOPROTOOPT:
2612
logger.error("SO_BINDTODEVICE not available;"
2613
" cannot bind to interface %s",
2614
self.interface)
2675
log.error("SO_BINDTODEVICE not available; cannot"
2676
" bind to interface %s", self.interface)
2615
2677
elif error.errno == errno.ENODEV:
2616
logger.error("Interface %s does not exist,"
2617
" cannot bind", self.interface)
2678
log.error("Interface %s does not exist, cannot"
2679
" bind", self.interface)
2618
2680
else:
2619
2681
raise
2620
2682
# Only bind(2) the socket if we really need to.
2699
2761
request = parent_pipe.recv()
2700
2762
command = request[0]
2701
2763
2702
if command == 'init':
2764
if command == "init":
2703
2765
key_id = request[1].decode("ascii")
2704
2766
fpr = request[2].decode("ascii")
2705
2767
address = request[3]
2706
2768
2707
2769
for c in self.clients.values():
2708
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2770
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2771
"27AE41E4649B934CA495991B7852B855"):
2709
2772
continue
2710
2773
if key_id and c.key_id == key_id:
2711
2774
client = c
2714
2777
client = c
2715
2778
break
2716
2779
else:
2717
logger.info("Client not found for key ID: %s, address"
2718
": %s", key_id or fpr, address)
2780
log.info("Client not found for key ID: %s, address:"
2781
" %s", key_id or fpr, address)
2719
2782
if self.use_dbus:
2720
2783
# Emit D-Bus signal
2721
2784
mandos_dbus_service.ClientNotFound(key_id or fpr,
2734
2797
# remove the old hook in favor of the new above hook on
2735
2798
# same fileno
2736
2799
return False
2737
if command == 'funcall':
2800
if command == "funcall":
2738
2801
funcname = request[1]
2739
2802
args = request[2]
2740
2803
kwargs = request[3]
2741
2804
2742
parent_pipe.send(('data', getattr(client_object,
2805
parent_pipe.send(("data", getattr(client_object,
2743
2806
funcname)(*args,
2744
2807
**kwargs)))
2745
2808
2746
if command == 'getattr':
2809
if command == "getattr":
2747
2810
attrname = request[1]
2748
2811
if isinstance(client_object.__getattribute__(attrname),
2749
collections.Callable):
2750
parent_pipe.send(('function', ))
2812
collections.abc.Callable):
2813
parent_pipe.send(("function", ))
2751
2814
else:
2752
2815
parent_pipe.send((
2753
'data', client_object.__getattribute__(attrname)))
2816
"data", client_object.__getattribute__(attrname)))
2754
2817
2755
if command == 'setattr':
2818
if command == "setattr":
2756
2819
attrname = request[1]
2757
2820
value = request[2]
2758
2821
setattr(client_object, attrname, value)
2763
2826
def rfc3339_duration_to_delta(duration):
2764
2827
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2765
2828
2766
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2767
True
2768
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2769
True
2770
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2771
True
2772
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2773
True
2774
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2775
True
2776
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2777
True
2778
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2779
True
2829
>>> timedelta = datetime.timedelta
2830
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2831
True
2832
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2833
True
2834
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2835
True
2836
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2837
True
2838
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2839
True
2840
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2841
True
2842
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2843
True
2844
>>> del timedelta
2780
2845
"""
2781
2846
2782
2847
# Parsing an RFC 3339 duration with regular expressions is not
2862
2927
def string_to_delta(interval):
2863
2928
"""Parse a string and return a datetime.timedelta
2864
2929
2865
>>> string_to_delta('7d') == datetime.timedelta(7)
2866
True
2867
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2868
True
2869
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2870
True
2871
>>> string_to_delta('24h') == datetime.timedelta(1)
2872
True
2873
>>> string_to_delta('1w') == datetime.timedelta(7)
2874
True
2875
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2930
>>> string_to_delta("7d") == datetime.timedelta(7)
2931
True
2932
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2933
True
2934
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2935
True
2936
>>> string_to_delta("24h") == datetime.timedelta(1)
2937
True
2938
>>> string_to_delta("1w") == datetime.timedelta(7)
2939
True
2940
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2876
2941
True
2877
2942
"""
2878
2943
3082
3147
3083
3148
if server_settings["servicename"] != "Mandos":
3084
3149
syslogger.setFormatter(
3085
logging.Formatter('Mandos ({}) [%(process)d]:'
3086
' %(levelname)s: %(message)s'.format(
3150
logging.Formatter("Mandos ({}) [%(process)d]:"
3151
" %(levelname)s: %(message)s".format(
3087
3152
server_settings["servicename"])))
3088
3153
3089
3154
# Parse config file with clients
3113
3178
try:
3114
3179
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3115
3180
except IOError as e:
3116
logger.error("Could not open file %r", pidfilename,
3117
exc_info=e)
3181
log.error("Could not open file %r", pidfilename,
3182
exc_info=e)
3118
3183
3119
3184
for name, group in (("_mandos", "_mandos"),
3120
3185
("mandos", "mandos"),
3131
3196
try:
3132
3197
os.setgid(gid)
3133
3198
os.setuid(uid)
3134
if debug:
3135
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3136
gid))
3199
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3137
3200
except OSError as error:
3138
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3139
.format(uid, gid, os.strerror(error.errno)))
3201
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3202
os.strerror(error.errno))
3140
3203
if error.errno != errno.EPERM:
3141
3204
raise
3142
3205
3149
3212
3150
3213
@gnutls.log_func
3151
3214
def debug_gnutls(level, string):
3152
logger.debug("GnuTLS: %s", string[:-1])
3215
log.debug("GnuTLS: %s",
3216
string[:-1].decode("utf-8", errors="replace"))
3153
3217
3154
3218
gnutls.global_set_log_function(debug_gnutls)
3155
3219
3184
3248
"se.bsnet.fukt.Mandos", bus,
3185
3249
do_not_queue=True)
3186
3250
except dbus.exceptions.DBusException as e:
3187
logger.error("Disabling D-Bus:", exc_info=e)
3251
log.error("Disabling D-Bus:", exc_info=e)
3188
3252
use_dbus = False
3189
3253
server_settings["use_dbus"] = False
3190
3254
tcp_server.use_dbus = False
3275
3339
os.remove(stored_state_path)
3276
3340
except IOError as e:
3277
3341
if e.errno == errno.ENOENT:
3278
logger.warning("Could not load persistent state:"
3279
" {}".format(os.strerror(e.errno)))
3342
log.warning("Could not load persistent state:"
3343
" %s", os.strerror(e.errno))
3280
3344
else:
3281
logger.critical("Could not load persistent state:",
3282
exc_info=e)
3345
log.critical("Could not load persistent state:",
3346
exc_info=e)
3283
3347
raise
3284
3348
except EOFError as e:
3285
logger.warning("Could not load persistent state: "
3286
"EOFError:",
3287
exc_info=e)
3349
log.warning("Could not load persistent state: EOFError:",
3350
exc_info=e)
3288
3351
3289
3352
with PGPEngine() as pgp:
3290
3353
for client_name, client in clients_data.items():
3317
3380
if client["enabled"]:
3318
3381
if datetime.datetime.utcnow() >= client["expires"]:
3319
3382
if not client["last_checked_ok"]:
3320
logger.warning(
3321
"disabling client {} - Client never "
3322
"performed a successful checker".format(
3323
client_name))
3383
log.warning("disabling client %s - Client"
3384
" never performed a successful"
3385
" checker", client_name)
3324
3386
client["enabled"] = False
3325
3387
elif client["last_checker_status"] != 0:
3326
logger.warning(
3327
"disabling client {} - Client last"
3328
" checker failed with error code"
3329
" {}".format(
3330
client_name,
3331
client["last_checker_status"]))
3388
log.warning("disabling client %s - Client"
3389
" last checker failed with error"
3390
" code %s", client_name,
3391
client["last_checker_status"])
3332
3392
client["enabled"] = False
3333
3393
else:
3334
3394
client["expires"] = (
3335
3395
datetime.datetime.utcnow()
3336
3396
+ client["timeout"])
3337
logger.debug("Last checker succeeded,"
3338
" keeping {} enabled".format(
3339
client_name))
3397
log.debug("Last checker succeeded, keeping %s"
3398
" enabled", client_name)
3340
3399
try:
3341
3400
client["secret"] = pgp.decrypt(
3342
3401
client["encrypted_secret"],
3343
3402
client_settings[client_name]["secret"])
3344
3403
except PGPError:
3345
3404
# If decryption fails, we use secret from new settings
3346
logger.debug("Failed to decrypt {} old secret".format(
3347
client_name))
3405
log.debug("Failed to decrypt %s old secret",
3406
client_name)
3348
3407
client["secret"] = (client_settings[client_name]
3349
3408
["secret"])
3350
3409
3364
3423
server_settings=server_settings)
3365
3424
3366
3425
if not tcp_server.clients:
3367
logger.warning("No clients defined")
3426
log.warning("No clients defined")
3368
3427
3369
3428
if not foreground:
3370
3429
if pidfile is not None:
3373
3432
with pidfile:
3374
3433
print(pid, file=pidfile)
3375
3434
except IOError:
3376
logger.error("Could not write to file %r with PID %d",
3377
pidfilename, pid)
3435
log.error("Could not write to file %r with PID %d",
3436
pidfilename, pid)
3378
3437
del pidfile
3379
3438
del pidfilename
3380
3439
3530
3589
3531
3590
try:
3532
3591
with tempfile.NamedTemporaryFile(
3533
mode='wb',
3592
mode="wb",
3534
3593
suffix=".pickle",
3535
prefix='clients-',
3594
prefix="clients-",
3536
3595
dir=os.path.dirname(stored_state_path),
3537
3596
delete=False) as stored_state:
3538
3597
pickle.dump((clients, client_settings), stored_state,
3546
3605
except NameError:
3547
3606
pass
3548
3607
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3549
logger.warning("Could not save persistent state: {}"
3550
.format(os.strerror(e.errno)))
3608
log.warning("Could not save persistent state: %s",
3609
os.strerror(e.errno))
3551
3610
else:
3552
logger.warning("Could not save persistent state:",
3553
exc_info=e)
3611
log.warning("Could not save persistent state:",
3612
exc_info=e)
3554
3613
raise
3555
3614
3556
3615
# Delete all clients, and settings from config
3573
3632
mandos_dbus_service.client_added_signal(client)
3574
3633
# Need to initiate checking of clients
3575
3634
if client.enabled:
3576
client.init_checker()
3635
client.init_checker(randomize_start=True)
3577
3636
3578
3637
tcp_server.enable()
3579
3638
tcp_server.server_activate()
3582
3641
if zeroconf:
3583
3642
service.port = tcp_server.socket.getsockname()[1]
3584
3643
if use_ipv6:
3585
logger.info("Now listening on address %r, port %d,"
3586
" flowinfo %d, scope_id %d",
3587
*tcp_server.socket.getsockname())
3644
log.info("Now listening on address %r, port %d, flowinfo %d,"
3645
" scope_id %d", *tcp_server.socket.getsockname())
3588
3646
else: # IPv4
3589
logger.info("Now listening on address %r, port %d",
3590
*tcp_server.socket.getsockname())
3647
log.info("Now listening on address %r, port %d",
3648
*tcp_server.socket.getsockname())
3591
3649
3592
3650
# service.interface = tcp_server.socket.getsockname()[3]
3593
3651
3597
3655
try:
3598
3656
service.activate()
3599
3657
except dbus.exceptions.DBusException as error:
3600
logger.critical("D-Bus Exception", exc_info=error)
3658
log.critical("D-Bus Exception", exc_info=error)
3601
3659
cleanup()
3602
3660
sys.exit(1)
3603
3661
# End of Avahi example code
3608
3666
lambda *args, **kwargs: (tcp_server.handle_request
3609
3667
(*args[2:], **kwargs) or True))
3610
3668
3611
logger.debug("Starting main loop")
3669
log.debug("Starting main loop")
3612
3670
main_loop.run()
3613
3671
except AvahiError as error:
3614
logger.critical("Avahi Error", exc_info=error)
3672
log.critical("Avahi Error", exc_info=error)
3615
3673
cleanup()
3616
3674
sys.exit(1)
3617
3675
except KeyboardInterrupt:
3618
3676
if debug:
3619
3677
print("", file=sys.stderr)
3620
logger.debug("Server received KeyboardInterrupt")
3621
logger.debug("Server exiting")
3678
log.debug("Server received KeyboardInterrupt")
3679
log.debug("Server exiting")
3622
3680
# Must run before the D-Bus bus name gets deregistered
3623
3681
cleanup()
3624
3682
3625
3683
3626
def should_only_run_tests():
3684
def parse_test_args():
3685
# type: () -> argparse.Namespace
3627
3686
parser = argparse.ArgumentParser(add_help=False)
3628
parser.add_argument("--check", action='store_true')
3687
parser.add_argument("--check", action="store_true")
3688
parser.add_argument("--prefix", )
3629
3689
args, unknown_args = parser.parse_known_args()
3630
run_tests = args.check
3631
if run_tests:
3632
# Remove --check argument from sys.argv
3690
if args.check:
3691
# Remove test options from sys.argv
3633
3692
sys.argv[1:] = unknown_args
3634
return run_tests
3693
return args
3635
3694
3636
3695
# Add all tests from doctest strings
3637
3696
def load_tests(loader, tests, none):
3639
3698
tests.addTests(doctest.DocTestSuite())
3640
3699
return tests
3641
3700
3642
if __name__ == '__main__':
3701
if __name__ == "__main__":
3702
options = parse_test_args()
3643
3703
try:
3644
if should_only_run_tests():
3645
# Call using ./mandos --check [--verbose]
3646
unittest.main()
3704
if options.check:
3705
extra_test_prefix = options.prefix
3706
if extra_test_prefix is not None:
3707
if not (unittest.main(argv=[""], exit=False)
3708
.result.wasSuccessful()):
3709
sys.exit(1)
3710
class ExtraTestLoader(unittest.TestLoader):
3711
testMethodPrefix = extra_test_prefix
3712
# Call using ./scriptname --test [--verbose]
3713
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3714
else:
3715
unittest.main(argv=[""])
3647
3716
else:
3648
3717
main()
3649
3718
finally:
3650
3719
logging.shutdown()
3720
3721
# Local Variables:
3722
# run-tests:
3723
# (lambda (&optional extra)
3724
# (if (not (funcall run-tests-in-test-buffer default-directory
3725
# extra))
3726
# (funcall show-test-buffer-in-test-window)
3727
# (funcall remove-test-window)
3728
# (if extra (message "Extra tests run successfully!"))))
3729
# run-tests-in-test-buffer:
3730
# (lambda (dir &optional extra)
3731
# (with-current-buffer (get-buffer-create "*Test*")
3732
# (setq buffer-read-only nil
3733
# default-directory dir)
3734
# (erase-buffer)
3735
# (compilation-mode))
3736
# (let ((process-result
3737
# (let ((inhibit-read-only t))
3738
# (process-file-shell-command
3739
# (funcall get-command-line extra) nil "*Test*"))))
3740
# (and (numberp process-result)
3741
# (= process-result 0))))
3742
# get-command-line:
3743
# (lambda (&optional extra)
3744
# (let ((quoted-script
3745
# (shell-quote-argument (funcall get-script-name))))
3746
# (format
3747
# (concat "%s --check" (if extra " --prefix=atest" ""))
3748
# quoted-script)))
3749
# get-script-name:
3750
# (lambda ()
3751
# (if (fboundp 'file-local-name)
3752
# (file-local-name (buffer-file-name))
3753
# (or (file-remote-p (buffer-file-name) 'localname)
3754
# (buffer-file-name))))
3755
# remove-test-window:
3756
# (lambda ()
3757
# (let ((test-window (get-buffer-window "*Test*")))
3758
# (if test-window (delete-window test-window))))
3759
# show-test-buffer-in-test-window:
3760
# (lambda ()
3761
# (when (not (get-buffer-window-list "*Test*"))
3762
# (setq next-error-last-buffer (get-buffer "*Test*"))
3763
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3764
# (display-buffer-overriding-action
3765
# `((display-buffer-in-side-window) (side . ,side)
3766
# (window-height . fit-window-to-buffer)
3767
# (window-width . fit-window-to-buffer))))
3768
# (display-buffer "*Test*"))))
3769
# eval:
3770
# (progn
3771
# (let* ((run-extra-tests (lambda () (interactive)
3772
# (funcall run-tests t)))
3773
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3774
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3775
# (setq minor-mode-overriding-map-alist
3776
# (cons `(run-tests . ,outer-keymap)
3777
# minor-mode-overriding-map-alist)))
3778
# (add-hook 'after-save-hook run-tests 90 t))
3779
# End:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0