/mandos/trunk : revision 1288

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

2

# -*- coding: utf-8; lexical-binding: t -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This file is part of Mandos.

18

#

31

#

32

# Contact the authors at <mandos@recompile.se>.

33

#

34

35

34

from __future__ import (division, absolute_import, print_function,

36

35

unicode_literals)

37

36

40

39

except ImportError:

41

40

pass

42

41

42

import sys

43

import unittest

44

import argparse

45

import logging

46

import os

43

47

try:

44

48

import SocketServer as socketserver

45

49

except ImportError:

46

50

import socketserver

47

51

import socket

48

import argparse

49

52

import datetime

50

53

import errno

51

54

try:

52

55

import ConfigParser as configparser

53

56

except ImportError:

54

57

import configparser

55

import sys

56

58

import re

57

import os

58

59

import signal

59

60

import subprocess

60

61

import atexit

61

62

import stat

62

import logging

63

import logging.handlers

64

import pwd

65

import contextlib

77

import itertools

78

import collections

79

import codecs

80

import unittest

80

import random

81

import shlex

81

82

83

import dbus

83

84

import dbus.service

92

93

if sys.version_info.major == 2:

93

94

__metaclass__ = type

94

95

str = unicode

96

input = raw_input

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

95

112

96

113

# Show warnings by default

97

114

if not sys.warnoptions:

126

143

if sys.version_info < (3, 2):

127

144

configparser.Configparser = configparser.SafeConfigParser

128

145

129

version = "1.8.9"

146

version = "1.8.16"

130

147

stored_state_file = "clients.pickle"

131

148

132

logger = logging.getLogger()

149

log = logging.getLogger(os.path.basename(sys.argv[0]))

133

150

logging.captureWarnings(True) # Show warnings via the logging system

134

151

syslogger = None

135

152

172

189

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

173

190

address="/dev/log"))

174

191

syslogger.setFormatter(logging.Formatter

175

('Mandos [%(process)d]: %(levelname)s:'

176

' %(message)s'))

177

logger.addHandler(syslogger)

192

("Mandos [%(process)d]: %(levelname)s:"

193

" %(message)s"))

194

log.addHandler(syslogger)

178

195

179

196

if debug:

180

197

console = logging.StreamHandler()

181

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

182

' [%(process)d]:'

183

' %(levelname)s:'

184

' %(message)s'))

185

logger.addHandler(console)

186

logger.setLevel(level)

198

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

199

" [%(process)d]:"

200

" %(levelname)s:"

201

" %(message)s"))

202

log.addHandler(console)

203

log.setLevel(level)

187

204

188

205

189

206

class PGPError(Exception):

207

224

except OSError as e:

208

225

if e.errno != errno.ENOENT:

209

226

raise

210

self.gnupgargs = ['--batch',

211

'--homedir', self.tempdir,

212

'--force-mdc',

213

'--quiet']

227

self.gnupgargs = ["--batch",

228

"--homedir", self.tempdir,

229

"--force-mdc",

230

"--quiet"]

214

231

# Only GPG version 1 has the --no-use-agent option.

215

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

216

233

self.gnupgargs.append("--no-use-agent")

255

272

dir=self.tempdir) as passfile:

256

273

passfile.write(passphrase)

257

274

passfile.flush()

258

proc = subprocess.Popen([self.gpg, '--symmetric',

259

'--passphrase-file',

275

proc = subprocess.Popen([self.gpg, "--symmetric",

276

"--passphrase-file",

260

277

passfile.name]

261

278

+ self.gnupgargs,

262

279

stdin=subprocess.PIPE,

273

290

dir=self.tempdir) as passfile:

274

291

passfile.write(passphrase)

275

292

passfile.flush()

276

proc = subprocess.Popen([self.gpg, '--decrypt',

277

'--passphrase-file',

293

proc = subprocess.Popen([self.gpg, "--decrypt",

294

"--passphrase-file",

278

295

passfile.name]

279

296

+ self.gnupgargs,

280

297

stdin=subprocess.PIPE,

333

350

Attributes:

334

351

interface: integer; avahi.IF_UNSPEC or an interface index.

335

352

Used to optionally bind to the specified interface.

336

name: string; Example: 'Mandos'

337

type: string; Example: '_mandos._tcp'.

353

name: string; Example: "Mandos"

354

type: string; Example: "_mandos._tcp".

338

355

See <https://www.iana.org/assignments/service-names-port-numbers>

339

356

port: integer; what port to announce

340

357

TXT: list of strings; TXT record for the service

377

394

def rename(self, remove=True):

378

395

"""Derived from the Avahi example code"""

379

396

if self.rename_count >= self.max_renames:

380

logger.critical("No suitable Zeroconf service name found"

381

" after %i retries, exiting.",

382

self.rename_count)

397

log.critical("No suitable Zeroconf service name found"

398

" after %i retries, exiting.",

399

self.rename_count)

383

400

raise AvahiServiceError("Too many renames")

384

401

self.name = str(

385

402

self.server.GetAlternativeServiceName(self.name))

386

403

self.rename_count += 1

387

logger.info("Changing Zeroconf service name to %r ...",

388

self.name)

404

log.info("Changing Zeroconf service name to %r ...",

405

self.name)

389

406

if remove:

390

407

self.remove()

391

408

try:

393

410

except dbus.exceptions.DBusException as error:

394

411

if (error.get_dbus_name()

395

412

== "org.freedesktop.Avahi.CollisionError"):

396

logger.info("Local Zeroconf service name collision.")

413

log.info("Local Zeroconf service name collision.")

397

414

return self.rename(remove=False)

398

415

else:

399

logger.critical("D-Bus Exception", exc_info=error)

416

log.critical("D-Bus Exception", exc_info=error)

400

417

self.cleanup()

401

418

os._exit(1)

402

419

418

435

avahi.DBUS_INTERFACE_ENTRY_GROUP)

419

436

self.entry_group_state_changed_match = (

420

437

self.group.connect_to_signal(

421

'StateChanged', self.entry_group_state_changed))

422

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

423

self.name, self.type)

438

"StateChanged", self.entry_group_state_changed))

439

log.debug("Adding Zeroconf service '%s' of type '%s' ...",

440

self.name, self.type)

424

441

self.group.AddService(

425

442

self.interface,

426

443

self.protocol,

433

450

434

451

def entry_group_state_changed(self, state, error):

435

452

"""Derived from the Avahi example code"""

436

logger.debug("Avahi entry group state change: %i", state)

453

log.debug("Avahi entry group state change: %i", state)

437

454

438

455

if state == avahi.ENTRY_GROUP_ESTABLISHED:

439

logger.debug("Zeroconf service established.")

456

log.debug("Zeroconf service established.")

440

457

elif state == avahi.ENTRY_GROUP_COLLISION:

441

logger.info("Zeroconf service name collision.")

458

log.info("Zeroconf service name collision.")

442

459

self.rename()

443

460

elif state == avahi.ENTRY_GROUP_FAILURE:

444

logger.critical("Avahi: Error in group state changed %s",

445

str(error))

461

log.critical("Avahi: Error in group state changed %s",

462

str(error))

446

463

raise AvahiGroupError("State changed: {!s}".format(error))

447

464

448

465

def cleanup(self):

458

475

459

476

def server_state_changed(self, state, error=None):

460

477

"""Derived from the Avahi example code"""

461

logger.debug("Avahi server state change: %i", state)

478

log.debug("Avahi server state change: %i", state)

462

479

bad_states = {

463

480

avahi.SERVER_INVALID: "Zeroconf server invalid",

464

481

avahi.SERVER_REGISTERING: None,

468

485

if state in bad_states:

469

486

if bad_states[state] is not None:

470

487

if error is None:

471

logger.error(bad_states[state])

488

log.error(bad_states[state])

472

489

else:

473

logger.error(bad_states[state] + ": %r", error)

490

log.error(bad_states[state] + ": %r", error)

474

491

self.cleanup()

475

492

elif state == avahi.SERVER_RUNNING:

476

493

try:

478

495

except dbus.exceptions.DBusException as error:

479

496

if (error.get_dbus_name()

480

497

== "org.freedesktop.Avahi.CollisionError"):

481

logger.info("Local Zeroconf service name"

482

" collision.")

498

log.info("Local Zeroconf service name collision.")

483

499

return self.rename(remove=False)

484

500

else:

485

logger.critical("D-Bus Exception", exc_info=error)

501

log.critical("D-Bus Exception", exc_info=error)

486

502

self.cleanup()

487

503

os._exit(1)

488

504

else:

489

505

if error is None:

490

logger.debug("Unknown state: %r", state)

506

log.debug("Unknown state: %r", state)

491

507

else:

492

logger.debug("Unknown state: %r: %r", state, error)

508

log.debug("Unknown state: %r: %r", state, error)

493

509

494

510

def activate(self):

495

511

"""Derived from the Avahi example code"""

507

523

class AvahiServiceToSyslog(AvahiService):

508

524

def rename(self, *args, **kwargs):

509

525

"""Add the new name to the syslog messages"""

510

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

526

ret = super(AvahiServiceToSyslog, self).rename(*args,

527

**kwargs)

511

528

syslogger.setFormatter(logging.Formatter(

512

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

529

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

513

530

.format(self.name)))

514

531

return ret

515

532

545

562

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

546

563

547

564

# Types

548

class session_int(ctypes.Structure):

565

class _session_int(ctypes.Structure):

549

566

_fields_ = []

550

session_t = ctypes.POINTER(session_int)

567

session_t = ctypes.POINTER(_session_int)

551

568

552

569

class certificate_credentials_st(ctypes.Structure):

553

570

_fields_ = []

556

573

certificate_type_t = ctypes.c_int

557

574

558

575

class datum_t(ctypes.Structure):

559

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

560

('size', ctypes.c_uint)]

576

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

577

("size", ctypes.c_uint)]

561

578

562

class openpgp_crt_int(ctypes.Structure):

579

class _openpgp_crt_int(ctypes.Structure):

563

580

_fields_ = []

564

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

581

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

565

582

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

566

583

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

567

584

credentials_type_t = ctypes.c_int

576

593

# gnutls.strerror()

577

594

self.code = code

578

595

if message is None and code is not None:

579

message = gnutls.strerror(code)

596

message = gnutls.strerror(code).decode(

597

"utf-8", errors="replace")

580

598

return super(gnutls.Error, self).__init__(

581

599

message, *args)

582

600

583

601

class CertificateSecurityError(Error):

584

602

pass

585

603

604

class PointerTo:

605

def __init__(self, cls):

606

self.cls = cls

607

608

def from_param(self, obj):

609

if not isinstance(obj, self.cls):

610

raise TypeError("Not of type {}: {!r}"

611

.format(self.cls.__name__, obj))

612

return ctypes.byref(obj.from_param(obj))

613

614

class CastToVoidPointer:

615

def __init__(self, cls):

616

self.cls = cls

617

618

def from_param(self, obj):

619

if not isinstance(obj, self.cls):

620

raise TypeError("Not of type {}: {!r}"

621

.format(self.cls.__name__, obj))

622

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

623

624

class With_from_param:

625

@classmethod

626

def from_param(cls, obj):

627

return obj._as_parameter_

628

586

629

# Classes

587

class Credentials:

630

class Credentials(With_from_param):

588

631

def __init__(self):

589

self._c_object = gnutls.certificate_credentials_t()

590

gnutls.certificate_allocate_credentials(

591

ctypes.byref(self._c_object))

632

self._as_parameter_ = gnutls.certificate_credentials_t()

633

gnutls.certificate_allocate_credentials(self)

592

634

self.type = gnutls.CRD_CERTIFICATE

593

635

594

636

def __del__(self):

595

gnutls.certificate_free_credentials(self._c_object)

637

gnutls.certificate_free_credentials(self)

596

638

597

class ClientSession:

639

class ClientSession(With_from_param):

598

640

def __init__(self, socket, credentials=None):

599

self._c_object = gnutls.session_t()

641

self._as_parameter_ = gnutls.session_t()

600

642

gnutls_flags = gnutls.CLIENT

601

643

if gnutls.check_version(b"3.5.6"):

602

644

gnutls_flags |= gnutls.NO_TICKETS

603

645

if gnutls.has_rawpk:

604

646

gnutls_flags |= gnutls.ENABLE_RAWPK

605

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

647

gnutls.init(self, gnutls_flags)

606

648

del gnutls_flags

607

gnutls.set_default_priority(self._c_object)

608

gnutls.transport_set_ptr(self._c_object, socket.fileno())

609

gnutls.handshake_set_private_extensions(self._c_object,

610

True)

649

gnutls.set_default_priority(self)

650

gnutls.transport_set_ptr(self, socket.fileno())

651

gnutls.handshake_set_private_extensions(self, True)

611

652

self.socket = socket

612

653

if credentials is None:

613

654

credentials = gnutls.Credentials()

614

gnutls.credentials_set(self._c_object, credentials.type,

615

ctypes.cast(credentials._c_object,

616

ctypes.c_void_p))

655

gnutls.credentials_set(self, credentials.type,

656

credentials)

617

657

self.credentials = credentials

618

658

619

659

def __del__(self):

620

gnutls.deinit(self._c_object)

660

gnutls.deinit(self)

621

661

622

662

def handshake(self):

623

return gnutls.handshake(self._c_object)

663

return gnutls.handshake(self)

624

664

625

665

def send(self, data):

626

666

data = bytes(data)

627

667

data_len = len(data)

628

668

while data_len > 0:

629

data_len -= gnutls.record_send(self._c_object,

630

data[-data_len:],

669

data_len -= gnutls.record_send(self, data[-data_len:],

631

670

data_len)

632

671

633

672

def bye(self):

634

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

673

return gnutls.bye(self, gnutls.SHUT_RDWR)

635

674

636

675

# Error handling functions

637

676

def _error_code(result):

638

677

"""A function to raise exceptions on errors, suitable

639

for the 'restype' attribute on ctypes functions"""

640

if result >= 0:

678

for the "restype" attribute on ctypes functions"""

679

if result >= gnutls.E_SUCCESS:

641

680

return result

642

681

if result == gnutls.E_NO_CERTIFICATE_FOUND:

643

682

raise gnutls.CertificateSecurityError(code=result)

644

683

raise gnutls.Error(code=result)

645

684

646

def _retry_on_error(result, func, arguments):

685

def _retry_on_error(result, func, arguments,

686

_error_code=_error_code):

647

687

"""A function to retry on some errors, suitable

648

for the 'errcheck' attribute on ctypes functions"""

649

while result < 0:

688

for the "errcheck" attribute on ctypes functions"""

689

while result < gnutls.E_SUCCESS:

650

690

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

651

691

return _error_code(result)

652

692

result = func(*arguments)

657

697

658

698

# Functions

659

699

priority_set_direct = _library.gnutls_priority_set_direct

660

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

700

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

661

701

ctypes.POINTER(ctypes.c_char_p)]

662

702

priority_set_direct.restype = _error_code

663

703

664

704

init = _library.gnutls_init

665

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

705

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

666

706

init.restype = _error_code

667

707

668

708

set_default_priority = _library.gnutls_set_default_priority

669

set_default_priority.argtypes = [session_t]

709

set_default_priority.argtypes = [ClientSession]

670

710

set_default_priority.restype = _error_code

671

711

672

712

record_send = _library.gnutls_record_send

673

record_send.argtypes = [session_t, ctypes.c_void_p,

713

record_send.argtypes = [ClientSession, ctypes.c_void_p,

674

714

ctypes.c_size_t]

675

715

record_send.restype = ctypes.c_ssize_t

676

716

record_send.errcheck = _retry_on_error

678

718

certificate_allocate_credentials = (

679

719

_library.gnutls_certificate_allocate_credentials)

680

720

certificate_allocate_credentials.argtypes = [

681

ctypes.POINTER(certificate_credentials_t)]

721

PointerTo(Credentials)]

682

722

certificate_allocate_credentials.restype = _error_code

683

723

684

724

certificate_free_credentials = (

685

725

_library.gnutls_certificate_free_credentials)

686

certificate_free_credentials.argtypes = [

687

certificate_credentials_t]

726

certificate_free_credentials.argtypes = [Credentials]

688

727

certificate_free_credentials.restype = None

689

728

690

729

handshake_set_private_extensions = (

691

730

_library.gnutls_handshake_set_private_extensions)

692

handshake_set_private_extensions.argtypes = [session_t,

731

handshake_set_private_extensions.argtypes = [ClientSession,

693

732

ctypes.c_int]

694

733

handshake_set_private_extensions.restype = None

695

734

696

735

credentials_set = _library.gnutls_credentials_set

697

credentials_set.argtypes = [session_t, credentials_type_t,

698

ctypes.c_void_p]

736

credentials_set.argtypes = [ClientSession, credentials_type_t,

737

CastToVoidPointer(Credentials)]

699

738

credentials_set.restype = _error_code

700

739

701

740

strerror = _library.gnutls_strerror

703

742

strerror.restype = ctypes.c_char_p

704

743

705

744

certificate_type_get = _library.gnutls_certificate_type_get

706

certificate_type_get.argtypes = [session_t]

745

certificate_type_get.argtypes = [ClientSession]

707

746

certificate_type_get.restype = _error_code

708

747

709

748

certificate_get_peers = _library.gnutls_certificate_get_peers

710

certificate_get_peers.argtypes = [session_t,

749

certificate_get_peers.argtypes = [ClientSession,

711

750

ctypes.POINTER(ctypes.c_uint)]

712

751

certificate_get_peers.restype = ctypes.POINTER(datum_t)

713

752

720

759

global_set_log_function.restype = None

721

760

722

761

deinit = _library.gnutls_deinit

723

deinit.argtypes = [session_t]

762

deinit.argtypes = [ClientSession]

724

763

deinit.restype = None

725

764

726

765

handshake = _library.gnutls_handshake

727

handshake.argtypes = [session_t]

728

handshake.restype = _error_code

766

handshake.argtypes = [ClientSession]

767

handshake.restype = ctypes.c_int

729

768

handshake.errcheck = _retry_on_error

730

769

731

770

transport_set_ptr = _library.gnutls_transport_set_ptr

732

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

771

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

733

772

transport_set_ptr.restype = None

734

773

735

774

bye = _library.gnutls_bye

736

bye.argtypes = [session_t, close_request_t]

737

bye.restype = _error_code

775

bye.argtypes = [ClientSession, close_request_t]

776

bye.restype = ctypes.c_int

738

777

bye.errcheck = _retry_on_error

739

778

740

779

check_version = _library.gnutls_check_version

757

796

758

797

x509_crt_fmt_t = ctypes.c_int

759

798

760

# All the function declarations below are from gnutls/abstract.h

799

# All the function declarations below are from

800

# gnutls/abstract.h

761

801

pubkey_init = _library.gnutls_pubkey_init

762

802

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

763

803

pubkey_init.restype = _error_code

777

817

pubkey_deinit.argtypes = [pubkey_t]

778

818

pubkey_deinit.restype = None

779

819

else:

780

# All the function declarations below are from gnutls/openpgp.h

820

# All the function declarations below are from

821

# gnutls/openpgp.h

781

822

782

823

openpgp_crt_init = _library.gnutls_openpgp_crt_init

783

824

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

789

830

openpgp_crt_fmt_t]

790

831

openpgp_crt_import.restype = _error_code

791

832

792

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

793

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

794

ctypes.POINTER(ctypes.c_uint)]

833

openpgp_crt_verify_self = \

834

_library.gnutls_openpgp_crt_verify_self

835

openpgp_crt_verify_self.argtypes = [

836

openpgp_crt_t,

837

ctypes.c_uint,

838

ctypes.POINTER(ctypes.c_uint),

839

]

795

840

openpgp_crt_verify_self.restype = _error_code

796

841

797

842

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

808

853

809

854

if check_version(b"3.6.4"):

810

855

certificate_type_get2 = _library.gnutls_certificate_type_get2

811

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

856

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

812

857

certificate_type_get2.restype = _error_code

813

858

814

859

# Remove non-public functions

830

875

"""A representation of a client host served by this server.

831

876

832

877

Attributes:

833

approved: bool(); 'None' if not yet approved/disapproved

878

approved: bool(); None if not yet approved/disapproved

834

879

approval_delay: datetime.timedelta(); Time to wait for approval

835

880

approval_duration: datetime.timedelta(); Duration of one approval

836

881

checker: multiprocessing.Process(); a running checker process used

837

to see if the client lives. 'None' if no process is

882

to see if the client lives. None if no process is

838

883

running.

839

884

checker_callback_tag: a GLib event source tag, or None

840

885

checker_command: string; External command which is run to check

916

961

# key_id() and fingerprint() functions

917

962

client["key_id"] = (section.get("key_id", "").upper()

918

963

.replace(" ", ""))

919

client["fingerprint"] = (section["fingerprint"].upper()

964

client["fingerprint"] = (section.get("fingerprint",

965

"").upper()

920

966

.replace(" ", ""))

967

if not (client["key_id"] or client["fingerprint"]):

968

log.error("Skipping client %s without key_id or"

969

" fingerprint", client_name)

970

del settings[client_name]

971

continue

921

972

if "secret" in section:

922

973

client["secret"] = codecs.decode(section["secret"]

923

974

.encode("utf-8"),

964

1015

self.last_enabled = None

965

1016

self.expires = None

966

1017

967

logger.debug("Creating client %r", self.name)

968

logger.debug(" Key ID: %s", self.key_id)

969

logger.debug(" Fingerprint: %s", self.fingerprint)

1018

log.debug("Creating client %r", self.name)

1019

log.debug(" Key ID: %s", self.key_id)

1020

log.debug(" Fingerprint: %s", self.fingerprint)

970

1021

self.created = settings.get("created",

971

1022

datetime.datetime.utcnow())

972

1023

1000

1051

if getattr(self, "enabled", False):

1001

1052

# Already enabled

1002

1053

return

1003

self.expires = datetime.datetime.utcnow() + self.timeout

1004

1054

self.enabled = True

1005

1055

self.last_enabled = datetime.datetime.utcnow()

1006

1056

self.init_checker()

1011

1061

if not getattr(self, "enabled", False):

1012

1062

return False

1013

1063

if not quiet:

1014

logger.info("Disabling client %s", self.name)

1064

log.info("Disabling client %s", self.name)

1015

1065

if getattr(self, "disable_initiator_tag", None) is not None:

1016

1066

GLib.source_remove(self.disable_initiator_tag)

1017

1067

self.disable_initiator_tag = None

1029

1079

def __del__(self):

1030

1080

self.disable()

1031

1081

1032

def init_checker(self):

1033

# Schedule a new checker to be started an 'interval' from now,

1034

# and every interval from then on.

1082

def init_checker(self, randomize_start=False):

1083

# Schedule a new checker to be started a randomly selected

1084

# time (a fraction of 'interval') from now. This spreads out

1085

# the startup of checkers over time when the server is

1086

# started.

1035

1087

if self.checker_initiator_tag is not None:

1036

1088

GLib.source_remove(self.checker_initiator_tag)

1089

interval_milliseconds = int(self.interval.total_seconds()

1090

* 1000)

1091

if randomize_start:

1092

delay_milliseconds = random.randrange(

1093

interval_milliseconds + 1)

1094

else:

1095

delay_milliseconds = interval_milliseconds

1037

1096

self.checker_initiator_tag = GLib.timeout_add(

1038

int(self.interval.total_seconds() * 1000),

1039

self.start_checker)

1040

# Schedule a disable() when 'timeout' has passed

1097

delay_milliseconds, self.start_checker, randomize_start)

1098

delay = datetime.timedelta(0, 0, 0, delay_milliseconds)

1099

# A checker might take up to an 'interval' of time, so we can

1100

# expire at the soonest one interval after a checker was

1101

# started. Since the initial checker is delayed, the expire

1102

# time might have to be extended.

1103

now = datetime.datetime.utcnow()

1104

self.expires = now + delay + self.interval

1105

# Schedule a disable() at expire time

1041

1106

if self.disable_initiator_tag is not None:

1042

1107

GLib.source_remove(self.disable_initiator_tag)

1043

1108

self.disable_initiator_tag = GLib.timeout_add(

1044

int(self.timeout.total_seconds() * 1000), self.disable)

1045

# Also start a new checker *right now*.

1046

self.start_checker()

1109

int((self.expires - now).total_seconds() * 1000),

1110

self.disable)

1047

1111

1048

1112

def checker_callback(self, source, condition, connection,

1049

1113

command):

1060

1124

self.last_checker_status = returncode

1061

1125

self.last_checker_signal = None

1062

1126

if self.last_checker_status == 0:

1063

logger.info("Checker for %(name)s succeeded",

1064

vars(self))

1127

log.info("Checker for %(name)s succeeded", vars(self))

1065

1128

self.checked_ok()

1066

1129

else:

1067

logger.info("Checker for %(name)s failed", vars(self))

1130

log.info("Checker for %(name)s failed", vars(self))

1068

1131

else:

1069

1132

self.last_checker_status = -1

1070

1133

self.last_checker_signal = -returncode

1071

logger.warning("Checker for %(name)s crashed?",

1072

vars(self))

1134

log.warning("Checker for %(name)s crashed?", vars(self))

1073

1135

return False

1074

1136

1075

1137

def checked_ok(self):

1094

1156

def need_approval(self):

1095

1157

self.last_approval_request = datetime.datetime.utcnow()

1096

1158

1097

def start_checker(self):

1159

def start_checker(self, start_was_randomized=False):

1098

1160

"""Start a new checker subprocess if one is not running.

1099

1161

1100

1162

If a checker already exists, leave it running and do

1109

1171

# should be.

1110

1172

1111

1173

if self.checker is not None and not self.checker.is_alive():

1112

logger.warning("Checker was not alive; joining")

1174

log.warning("Checker was not alive; joining")

1113

1175

self.checker.join()

1114

1176

self.checker = None

1115

1177

# Start a new checker if needed

1116

1178

if self.checker is None:

1117

1179

# Escape attributes for the shell

1118

1180

escaped_attrs = {

1119

attr: re.escape(str(getattr(self, attr)))

1181

attr: shlex.quote(str(getattr(self, attr)))

1120

1182

for attr in self.runtime_expansions}

1121

1183

try:

1122

1184

command = self.checker_command % escaped_attrs

1123

1185

except TypeError as error:

1124

logger.error('Could not format string "%s"',

1125

self.checker_command,

1126

exc_info=error)

1186

log.error('Could not format string "%s"',

1187

self.checker_command, exc_info=error)

1127

1188

return True # Try again later

1128

1189

self.current_checker_command = command

1129

logger.info("Starting checker %r for %s", command,

1130

self.name)

1190

log.info("Starting checker %r for %s", command, self.name)

1131

1191

# We don't need to redirect stdout and stderr, since

1132

1192

# in normal mode, that is already done by daemon(),

1133

1193

# and in debug mode we don't want to. (Stdin is

1152

1212

GLib.IOChannel.unix_new(pipe[0].fileno()),

1153

1213

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1154

1214

self.checker_callback, pipe[0], command)

1215

if start_was_randomized:

1216

# We were started after a random delay; Schedule a new

1217

# checker to be started an 'interval' from now, and every

1218

# interval from then on.

1219

now = datetime.datetime.utcnow()

1220

self.checker_initiator_tag = GLib.timeout_add(

1221

int(self.interval.total_seconds() * 1000),

1222

self.start_checker)

1223

self.expires = max(self.expires, now + self.interval)

1224

# Don't start a new checker again after same random delay

1225

return False

1155

1226

# Re-run this periodically if run by GLib.timeout_add

1156

1227

return True

1157

1228

1162

1233

self.checker_callback_tag = None

1163

1234

if getattr(self, "checker", None) is None:

1164

1235

return

1165

logger.debug("Stopping checker for %(name)s", vars(self))

1236

log.debug("Stopping checker for %(name)s", vars(self))

1166

1237

self.checker.terminate()

1167

1238

self.checker = None

1168

1239

1195

1266

func._dbus_name = func.__name__

1196

1267

if func._dbus_name.endswith("_dbus_property"):

1197

1268

func._dbus_name = func._dbus_name[:-14]

1198

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1269

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

1199

1270

return func

1200

1271

1201

1272

return decorator

1290

1361

1291

1362

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1292

1363

out_signature="s",

1293

path_keyword='object_path',

1294

connection_keyword='connection')

1364

path_keyword="object_path",

1365

connection_keyword="connection")

1295

1366

def Introspect(self, object_path, connection):

1296

1367

"""Overloading of standard D-Bus method.

1297

1368

1346

1417

document.unlink()

1347

1418

except (AttributeError, xml.dom.DOMException,

1348

1419

xml.parsers.expat.ExpatError) as error:

1349

logger.error("Failed to override Introspection method",

1350

exc_info=error)

1420

log.error("Failed to override Introspection method",

1421

exc_info=error)

1351

1422

return xmlstring

1352

1423

1353

1424

1450

1521

1451

1522

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1452

1523

out_signature="s",

1453

path_keyword='object_path',

1454

connection_keyword='connection')

1524

path_keyword="object_path",

1525

connection_keyword="connection")

1455

1526

def Introspect(self, object_path, connection):

1456

1527

"""Overloading of standard D-Bus method.

1457

1528

1513

1584

document.unlink()

1514

1585

except (AttributeError, xml.dom.DOMException,

1515

1586

xml.parsers.expat.ExpatError) as error:

1516

logger.error("Failed to override Introspection method",

1517

exc_info=error)

1587

log.error("Failed to override Introspection method",

1588

exc_info=error)

1518

1589

return xmlstring

1519

1590

1520

1591

1552

1623

1553

1624

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1554

1625

out_signature="s",

1555

path_keyword='object_path',

1556

connection_keyword='connection')

1626

path_keyword="object_path",

1627

connection_keyword="connection")

1557

1628

def Introspect(self, object_path, connection):

1558

1629

"""Overloading of standard D-Bus method.

1559

1630

1584

1655

document.unlink()

1585

1656

except (AttributeError, xml.dom.DOMException,

1586

1657

xml.parsers.expat.ExpatError) as error:

1587

logger.error("Failed to override Introspection method",

1588

exc_info=error)

1658

log.error("Failed to override Introspection method",

1659

exc_info=error)

1589

1660

return xmlstring

1590

1661

1591

1662

2225

2296

class ProxyClient:

2226

2297

def __init__(self, child_pipe, key_id, fpr, address):

2227

2298

self._pipe = child_pipe

2228

self._pipe.send(('init', key_id, fpr, address))

2299

self._pipe.send(("init", key_id, fpr, address))

2229

2300

if not self._pipe.recv():

2230

2301

raise KeyError(key_id or fpr)

2231

2302

2232

2303

def __getattribute__(self, name):

2233

if name == '_pipe':

2304

if name == "_pipe":

2234

2305

return super(ProxyClient, self).__getattribute__(name)

2235

self._pipe.send(('getattr', name))

2306

self._pipe.send(("getattr", name))

2236

2307

data = self._pipe.recv()

2237

if data[0] == 'data':

2308

if data[0] == "data":

2238

2309

return data[1]

2239

if data[0] == 'function':

2310

if data[0] == "function":

2240

2311

2241

2312

def func(*args, **kwargs):

2242

self._pipe.send(('funcall', name, args, kwargs))

2313

self._pipe.send(("funcall", name, args, kwargs))

2243

2314

return self._pipe.recv()[1]

2244

2315

2245

2316

return func

2246

2317

2247

2318

def __setattr__(self, name, value):

2248

if name == '_pipe':

2319

if name == "_pipe":

2249

2320

return super(ProxyClient, self).__setattr__(name, value)

2250

self._pipe.send(('setattr', name, value))

2321

self._pipe.send(("setattr", name, value))

2251

2322

2252

2323

2253

2324

class ClientHandler(socketserver.BaseRequestHandler, object):

2258

2329

2259

2330

def handle(self):

2260

2331

with contextlib.closing(self.server.child_pipe) as child_pipe:

2261

logger.info("TCP connection from: %s",

2262

str(self.client_address))

2263

logger.debug("Pipe FD: %d",

2264

self.server.child_pipe.fileno())

2332

log.info("TCP connection from: %s",

2333

str(self.client_address))

2334

log.debug("Pipe FD: %d", self.server.child_pipe.fileno())

2265

2335

2266

2336

session = gnutls.ClientSession(self.request)

2267

2337

2268

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2338

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2269

2339

# "+AES-256-CBC", "+SHA1",

2270

2340

# "+COMP-NULL", "+CTYPE-OPENPGP",

2271

2341

# "+DHE-DSS"))

2273

2343

priority = self.server.gnutls_priority

2274

2344

if priority is None:

2275

2345

priority = "NORMAL"

2276

gnutls.priority_set_direct(session._c_object,

2277

priority.encode("utf-8"),

2278

None)

2346

gnutls.priority_set_direct(session,

2347

priority.encode("utf-8"), None)

2279

2348

2280

2349

# Start communication using the Mandos protocol

2281

2350

# Get protocol number

2282

2351

line = self.request.makefile().readline()

2283

logger.debug("Protocol version: %r", line)

2352

log.debug("Protocol version: %r", line)

2284

2353

try:

2285

2354

if int(line.strip().split()[0]) > 1:

2286

2355

raise RuntimeError(line)

2287

2356

except (ValueError, IndexError, RuntimeError) as error:

2288

logger.error("Unknown protocol version: %s", error)

2357

log.error("Unknown protocol version: %s", error)

2289

2358

return

2290

2359

2291

2360

# Start GnuTLS connection

2292

2361

try:

2293

2362

session.handshake()

2294

2363

except gnutls.Error as error:

2295

logger.warning("Handshake failed: %s", error)

2364

log.warning("Handshake failed: %s", error)

2296

2365

# Do not run session.bye() here: the session is not

2297

2366

# established. Just abandon the request.

2298

2367

return

2299

logger.debug("Handshake succeeded")

2368

log.debug("Handshake succeeded")

2300

2369

2301

2370

approval_required = False

2302

2371

try:

2306

2375

key_id = self.key_id(

2307

2376

self.peer_certificate(session))

2308

2377

except (TypeError, gnutls.Error) as error:

2309

logger.warning("Bad certificate: %s", error)

2378

log.warning("Bad certificate: %s", error)

2310

2379

return

2311

logger.debug("Key ID: %s", key_id)

2380

log.debug("Key ID: %s",

2381

key_id.decode("utf-8",

2382

errors="replace"))

2312

2383

2313

2384

else:

2314

2385

key_id = b""

2316

2387

fpr = self.fingerprint(

2317

2388

self.peer_certificate(session))

2318

2389

except (TypeError, gnutls.Error) as error:

2319

logger.warning("Bad certificate: %s", error)

2390

log.warning("Bad certificate: %s", error)

2320

2391

return

2321

logger.debug("Fingerprint: %s", fpr)

2392

log.debug("Fingerprint: %s", fpr)

2322

2393

2323

2394

try:

2324

2395

client = ProxyClient(child_pipe, key_id, fpr,

2333

2404

2334

2405

while True:

2335

2406

if not client.enabled:

2336

logger.info("Client %s is disabled",

2337

client.name)

2407

log.info("Client %s is disabled", client.name)

2338

2408

if self.server.use_dbus:

2339

2409

# Emit D-Bus signal

2340

2410

client.Rejected("Disabled")

2344

2414

# We are approved or approval is disabled

2345

2415

break

2346

2416

elif client.approved is None:

2347

logger.info("Client %s needs approval",

2348

client.name)

2417

log.info("Client %s needs approval",

2418

client.name)

2349

2419

if self.server.use_dbus:

2350

2420

# Emit D-Bus signal

2351

2421

client.NeedApproval(

2352

2422

client.approval_delay.total_seconds()

2353

2423

* 1000, client.approved_by_default)

2354

2424

else:

2355

logger.warning("Client %s was not approved",

2356

client.name)

2425

log.warning("Client %s was not approved",

2426

client.name)

2357

2427

if self.server.use_dbus:

2358

2428

# Emit D-Bus signal

2359

2429

client.Rejected("Denied")

2367

2437

time2 = datetime.datetime.now()

2368

2438

if (time2 - time) >= delay:

2369

2439

if not client.approved_by_default:

2370

logger.warning("Client %s timed out while"

2371

" waiting for approval",

2372

client.name)

2440

log.warning("Client %s timed out while"

2441

" waiting for approval",

2442

client.name)

2373

2443

if self.server.use_dbus:

2374

2444

# Emit D-Bus signal

2375

2445

client.Rejected("Approval timed out")

2382

2452

try:

2383

2453

session.send(client.secret)

2384

2454

except gnutls.Error as error:

2385

logger.warning("gnutls send failed",

2386

exc_info=error)

2455

log.warning("gnutls send failed", exc_info=error)

2387

2456

return

2388

2457

2389

logger.info("Sending secret to %s", client.name)

2458

log.info("Sending secret to %s", client.name)

2390

2459

# bump the timeout using extended_timeout

2391

2460

client.bump_timeout(client.extended_timeout)

2392

2461

if self.server.use_dbus:

2399

2468

try:

2400

2469

session.bye()

2401

2470

except gnutls.Error as error:

2402

logger.warning("GnuTLS bye failed",

2403

exc_info=error)

2471

log.warning("GnuTLS bye failed", exc_info=error)

2404

2472

2405

2473

@staticmethod

2406

2474

def peer_certificate(session):

2407

2475

"Return the peer's certificate as a bytestring"

2408

2476

try:

2409

cert_type = gnutls.certificate_type_get2(session._c_object,

2410

gnutls.CTYPE_PEERS)

2477

cert_type = gnutls.certificate_type_get2(

2478

session, gnutls.CTYPE_PEERS)

2411

2479

except AttributeError:

2412

cert_type = gnutls.certificate_type_get(session._c_object)

2480

cert_type = gnutls.certificate_type_get(session)

2413

2481

if gnutls.has_rawpk:

2414

2482

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2415

2483

else:

2416

2484

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2417

2485

# If not a valid certificate type...

2418

2486

if cert_type not in valid_cert_types:

2419

logger.info("Cert type %r not in %r", cert_type,

2420

valid_cert_types)

2487

log.info("Cert type %r not in %r", cert_type,

2488

valid_cert_types)

2421

2489

# ...return invalid data

2422

2490

return b""

2423

2491

list_size = ctypes.c_uint(1)

2424

2492

cert_list = (gnutls.certificate_get_peers

2425

(session._c_object, ctypes.byref(list_size)))

2493

(session, ctypes.byref(list_size)))

2426

2494

if not bool(cert_list) and list_size.value != 0:

2427

2495

raise gnutls.Error("error getting peer certificate")

2428

2496

if list_size.value == 0:

2450

2518

buf = ctypes.create_string_buffer(32)

2451

2519

buf_len = ctypes.c_size_t(len(buf))

2452

2520

# Get the key ID from the raw public key into the buffer

2453

gnutls.pubkey_get_key_id(pubkey,

2454

gnutls.KEYID_USE_SHA256,

2455

ctypes.cast(ctypes.byref(buf),

2456

ctypes.POINTER(ctypes.c_ubyte)),

2457

ctypes.byref(buf_len))

2521

gnutls.pubkey_get_key_id(

2522

pubkey,

2523

gnutls.KEYID_USE_SHA256,

2524

ctypes.cast(ctypes.byref(buf),

2525

ctypes.POINTER(ctypes.c_ubyte)),

2526

ctypes.byref(buf_len))

2458

2527

# Deinit the certificate

2459

2528

gnutls.pubkey_deinit(pubkey)

2460

2529

2541

2610

2542

2611

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2543

2612

socketserver.TCPServer):

2544

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2613

"""IPv6-capable TCP server. Accepts None as address and/or port

2545

2614

2546

2615

Attributes:

2547

2616

enabled: Boolean; whether this server is activated yet

2598

2667

if SO_BINDTODEVICE is None:

2599

2668

# Fall back to a hard-coded value which seems to be

2600

2669

# common enough.

2601

logger.warning("SO_BINDTODEVICE not found, trying 25")

2670

log.warning("SO_BINDTODEVICE not found, trying 25")

2602

2671

SO_BINDTODEVICE = 25

2603

2672

try:

2604

2673

self.socket.setsockopt(

2606

2675

(self.interface + "\0").encode("utf-8"))

2607

2676

except socket.error as error:

2608

2677

if error.errno == errno.EPERM:

2609

logger.error("No permission to bind to"

2610

" interface %s", self.interface)

2678

log.error("No permission to bind to interface %s",

2679

self.interface)

2611

2680

elif error.errno == errno.ENOPROTOOPT:

2612

logger.error("SO_BINDTODEVICE not available;"

2613

" cannot bind to interface %s",

2614

self.interface)

2681

log.error("SO_BINDTODEVICE not available; cannot"

2682

" bind to interface %s", self.interface)

2615

2683

elif error.errno == errno.ENODEV:

2616

logger.error("Interface %s does not exist,"

2617

" cannot bind", self.interface)

2684

log.error("Interface %s does not exist, cannot"

2685

" bind", self.interface)

2618

2686

else:

2619

2687

raise

2620

2688

# Only bind(2) the socket if we really need to.

2699

2767

request = parent_pipe.recv()

2700

2768

command = request[0]

2701

2769

2702

if command == 'init':

2770

if command == "init":

2703

2771

key_id = request[1].decode("ascii")

2704

2772

fpr = request[2].decode("ascii")

2705

2773

address = request[3]

2706

2774

2707

2775

for c in self.clients.values():

2708

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2776

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2777

"27AE41E4649B934CA495991B7852B855"):

2709

2778

continue

2710

2779

if key_id and c.key_id == key_id:

2711

2780

client = c

2714

2783

client = c

2715

2784

break

2716

2785

else:

2717

logger.info("Client not found for key ID: %s, address"

2718

": %s", key_id or fpr, address)

2786

log.info("Client not found for key ID: %s, address:"

2787

" %s", key_id or fpr, address)

2719

2788

if self.use_dbus:

2720

2789

# Emit D-Bus signal

2721

2790

mandos_dbus_service.ClientNotFound(key_id or fpr,

2734

2803

# remove the old hook in favor of the new above hook on

2735

2804

# same fileno

2736

2805

return False

2737

if command == 'funcall':

2806

if command == "funcall":

2738

2807

funcname = request[1]

2739

2808

args = request[2]

2740

2809

kwargs = request[3]

2741

2810

2742

parent_pipe.send(('data', getattr(client_object,

2811

parent_pipe.send(("data", getattr(client_object,

2743

2812

funcname)(*args,

2744

2813

**kwargs)))

2745

2814

2746

if command == 'getattr':

2815

if command == "getattr":

2747

2816

attrname = request[1]

2748

2817

if isinstance(client_object.__getattribute__(attrname),

2749

collections.Callable):

2750

parent_pipe.send(('function', ))

2818

collections.abc.Callable):

2819

parent_pipe.send(("function", ))

2751

2820

else:

2752

2821

parent_pipe.send((

2753

'data', client_object.__getattribute__(attrname)))

2822

"data", client_object.__getattribute__(attrname)))

2754

2823

2755

if command == 'setattr':

2824

if command == "setattr":

2756

2825

attrname = request[1]

2757

2826

value = request[2]

2758

2827

setattr(client_object, attrname, value)

2763

2832

def rfc3339_duration_to_delta(duration):

2764

2833

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2765

2834

2766

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2767

True

2768

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2769

True

2770

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2771

True

2772

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2773

True

2774

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2775

True

2776

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2777

True

2778

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2779

True

2835

>>> timedelta = datetime.timedelta

2836

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2837

True

2838

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2839

True

2840

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2841

True

2842

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2843

True

2844

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2845

True

2846

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2847

True

2848

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2849

True

2850

>>> del timedelta

2780

2851

"""

2781

2852

2782

2853

# Parsing an RFC 3339 duration with regular expressions is not

2862

2933

def string_to_delta(interval):

2863

2934

"""Parse a string and return a datetime.timedelta

2864

2935

2865

>>> string_to_delta('7d') == datetime.timedelta(7)

2866

True

2867

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2868

True

2869

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2870

True

2871

>>> string_to_delta('24h') == datetime.timedelta(1)

2872

True

2873

>>> string_to_delta('1w') == datetime.timedelta(7)

2874

True

2875

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2936

>>> string_to_delta("7d") == datetime.timedelta(7)

2937

True

2938

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2939

True

2940

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2941

True

2942

>>> string_to_delta("24h") == datetime.timedelta(1)

2943

True

2944

>>> string_to_delta("1w") == datetime.timedelta(7)

2945

True

2946

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2876

2947

True

2877

2948

"""

2878

2949

3082

3153

3083

3154

if server_settings["servicename"] != "Mandos":

3084

3155

syslogger.setFormatter(

3085

logging.Formatter('Mandos ({}) [%(process)d]:'

3086

' %(levelname)s: %(message)s'.format(

3156

logging.Formatter("Mandos ({}) [%(process)d]:"

3157

" %(levelname)s: %(message)s".format(

3087

3158

server_settings["servicename"])))

3088

3159

3089

3160

# Parse config file with clients

3113

3184

try:

3114

3185

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

3115

3186

except IOError as e:

3116

logger.error("Could not open file %r", pidfilename,

3117

exc_info=e)

3187

log.error("Could not open file %r", pidfilename,

3188

exc_info=e)

3118

3189

3119

3190

for name, group in (("_mandos", "_mandos"),

3120

3191

("mandos", "mandos"),

3131

3202

try:

3132

3203

os.setgid(gid)

3133

3204

os.setuid(uid)

3134

if debug:

3135

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3136

gid))

3205

log.debug("Did setuid/setgid to %s:%s", uid, gid)

3137

3206

except OSError as error:

3138

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3139

.format(uid, gid, os.strerror(error.errno)))

3207

log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,

3208

os.strerror(error.errno))

3140

3209

if error.errno != errno.EPERM:

3141

3210

raise

3142

3211

3149

3218

3150

3219

@gnutls.log_func

3151

3220

def debug_gnutls(level, string):

3152

logger.debug("GnuTLS: %s", string[:-1])

3221

log.debug("GnuTLS: %s",

3222

string[:-1].decode("utf-8", errors="replace"))

3153

3223

3154

3224

gnutls.global_set_log_function(debug_gnutls)

3155

3225

3184

3254

"se.bsnet.fukt.Mandos", bus,

3185

3255

do_not_queue=True)

3186

3256

except dbus.exceptions.DBusException as e:

3187

logger.error("Disabling D-Bus:", exc_info=e)

3257

log.error("Disabling D-Bus:", exc_info=e)

3188

3258

use_dbus = False

3189

3259

server_settings["use_dbus"] = False

3190

3260

tcp_server.use_dbus = False

3275

3345

os.remove(stored_state_path)

3276

3346

except IOError as e:

3277

3347

if e.errno == errno.ENOENT:

3278

logger.warning("Could not load persistent state:"

3279

" {}".format(os.strerror(e.errno)))

3348

log.warning("Could not load persistent state:"

3349

" %s", os.strerror(e.errno))

3280

3350

else:

3281

logger.critical("Could not load persistent state:",

3282

exc_info=e)

3351

log.critical("Could not load persistent state:",

3352

exc_info=e)

3283

3353

raise

3284

3354

except EOFError as e:

3285

logger.warning("Could not load persistent state: "

3286

"EOFError:",

3287

exc_info=e)

3355

log.warning("Could not load persistent state: EOFError:",

3356

exc_info=e)

3288

3357

3289

3358

with PGPEngine() as pgp:

3290

3359

for client_name, client in clients_data.items():

3317

3386

if client["enabled"]:

3318

3387

if datetime.datetime.utcnow() >= client["expires"]:

3319

3388

if not client["last_checked_ok"]:

3320

logger.warning(

3321

"disabling client {} - Client never "

3322

"performed a successful checker".format(

3323

client_name))

3389

log.warning("disabling client %s - Client"

3390

" never performed a successful"

3391

" checker", client_name)

3324

3392

client["enabled"] = False

3325

3393

elif client["last_checker_status"] != 0:

3326

logger.warning(

3327

"disabling client {} - Client last"

3328

" checker failed with error code"

3329

" {}".format(

3330

client_name,

3331

client["last_checker_status"]))

3394

log.warning("disabling client %s - Client"

3395

" last checker failed with error"

3396

" code %s", client_name,

3397

client["last_checker_status"])

3332

3398

client["enabled"] = False

3333

3399

else:

3334

3400

client["expires"] = (

3335

3401

datetime.datetime.utcnow()

3336

3402

+ client["timeout"])

3337

logger.debug("Last checker succeeded,"

3338

" keeping {} enabled".format(

3339

client_name))

3403

log.debug("Last checker succeeded, keeping %s"

3404

" enabled", client_name)

3340

3405

try:

3341

3406

client["secret"] = pgp.decrypt(

3342

3407

client["encrypted_secret"],

3343

3408

client_settings[client_name]["secret"])

3344

3409

except PGPError:

3345

3410

# If decryption fails, we use secret from new settings

3346

logger.debug("Failed to decrypt {} old secret".format(

3347

client_name))

3411

log.debug("Failed to decrypt %s old secret",

3412

client_name)

3348

3413

client["secret"] = (client_settings[client_name]

3349

3414

["secret"])

3350

3415

3364

3429

server_settings=server_settings)

3365

3430

3366

3431

if not tcp_server.clients:

3367

logger.warning("No clients defined")

3432

log.warning("No clients defined")

3368

3433

3369

3434

if not foreground:

3370

3435

if pidfile is not None:

3373

3438

with pidfile:

3374

3439

print(pid, file=pidfile)

3375

3440

except IOError:

3376

logger.error("Could not write to file %r with PID %d",

3377

pidfilename, pid)

3441

log.error("Could not write to file %r with PID %d",

3442

pidfilename, pid)

3378

3443

del pidfile

3379

3444

del pidfilename

3380

3445

3530

3595

3531

3596

try:

3532

3597

with tempfile.NamedTemporaryFile(

3533

mode='wb',

3598

mode="wb",

3534

3599

suffix=".pickle",

3535

prefix='clients-',

3600

prefix="clients-",

3536

3601

dir=os.path.dirname(stored_state_path),

3537

3602

delete=False) as stored_state:

3538

3603

pickle.dump((clients, client_settings), stored_state,

3546

3611

except NameError:

3547

3612

pass

3548

3613

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3549

logger.warning("Could not save persistent state: {}"

3550

.format(os.strerror(e.errno)))

3614

log.warning("Could not save persistent state: %s",

3615

os.strerror(e.errno))

3551

3616

else:

3552

logger.warning("Could not save persistent state:",

3553

exc_info=e)

3617

log.warning("Could not save persistent state:",

3618

exc_info=e)

3554

3619

raise

3555

3620

3556

3621

# Delete all clients, and settings from config

3573

3638

mandos_dbus_service.client_added_signal(client)

3574

3639

# Need to initiate checking of clients

3575

3640

if client.enabled:

3576

client.init_checker()

3641

client.init_checker(randomize_start=True)

3577

3642

3578

3643

tcp_server.enable()

3579

3644

tcp_server.server_activate()

3582

3647

if zeroconf:

3583

3648

service.port = tcp_server.socket.getsockname()[1]

3584

3649

if use_ipv6:

3585

logger.info("Now listening on address %r, port %d,"

3586

" flowinfo %d, scope_id %d",

3587

*tcp_server.socket.getsockname())

3650

log.info("Now listening on address %r, port %d, flowinfo %d,"

3651

" scope_id %d", *tcp_server.socket.getsockname())

3588

3652

else: # IPv4

3589

logger.info("Now listening on address %r, port %d",

3590

*tcp_server.socket.getsockname())

3653

log.info("Now listening on address %r, port %d",

3654

*tcp_server.socket.getsockname())

3591

3655

3592

3656

# service.interface = tcp_server.socket.getsockname()[3]

3593

3657

3597

3661

try:

3598

3662

service.activate()

3599

3663

except dbus.exceptions.DBusException as error:

3600

logger.critical("D-Bus Exception", exc_info=error)

3664

log.critical("D-Bus Exception", exc_info=error)

3601

3665

cleanup()

3602

3666

sys.exit(1)

3603

3667

# End of Avahi example code

3608

3672

lambda *args, **kwargs: (tcp_server.handle_request

3609

3673

(*args[2:], **kwargs) or True))

3610

3674

3611

logger.debug("Starting main loop")

3675

log.debug("Starting main loop")

3612

3676

main_loop.run()

3613

3677

except AvahiError as error:

3614

logger.critical("Avahi Error", exc_info=error)

3678

log.critical("Avahi Error", exc_info=error)

3615

3679

cleanup()

3616

3680

sys.exit(1)

3617

3681

except KeyboardInterrupt:

3618

3682

if debug:

3619

3683

print("", file=sys.stderr)

3620

logger.debug("Server received KeyboardInterrupt")

3621

logger.debug("Server exiting")

3684

log.debug("Server received KeyboardInterrupt")

3685

log.debug("Server exiting")

3622

3686

# Must run before the D-Bus bus name gets deregistered

3623

3687

cleanup()

3624

3688

3625

3689

3626

def should_only_run_tests():

3690

def parse_test_args():

3691

# type: () -> argparse.Namespace

3627

3692

parser = argparse.ArgumentParser(add_help=False)

3628

parser.add_argument("--check", action='store_true')

3693

parser.add_argument("--check", action="store_true")

3694

parser.add_argument("--prefix", )

3629

3695

args, unknown_args = parser.parse_known_args()

3630

run_tests = args.check

3631

if run_tests:

3632

# Remove --check argument from sys.argv

3696

if args.check:

3697

# Remove test options from sys.argv

3633

3698

sys.argv[1:] = unknown_args

3634

return run_tests

3699

return args

3635

3700

3636

3701

# Add all tests from doctest strings

3637

3702

def load_tests(loader, tests, none):

3639

3704

tests.addTests(doctest.DocTestSuite())

3640

3705

return tests

3641

3706

3642

if __name__ == '__main__':

3707

if __name__ == "__main__":

3708

options = parse_test_args()

3643

3709

try:

3644

if should_only_run_tests():

3645

# Call using ./mandos --check [--verbose]

3646

unittest.main()

3710

if options.check:

3711

extra_test_prefix = options.prefix

3712

if extra_test_prefix is not None:

3713

if not (unittest.main(argv=[""], exit=False)

3714

.result.wasSuccessful()):

3715

sys.exit(1)

3716

class ExtraTestLoader(unittest.TestLoader):

3717

testMethodPrefix = extra_test_prefix

3718

# Call using ./scriptname --test [--verbose]

3719

unittest.main(argv=[""], testLoader=ExtraTestLoader())

3720

else:

3721

unittest.main(argv=[""])

3647

3722

else:

3648

3723

main()

3649

3724

finally:

3650

3725

logging.shutdown()

3726

3727

# Local Variables:

3728

# run-tests:

3729

# (lambda (&optional extra)

3730

# (if (not (funcall run-tests-in-test-buffer default-directory

3731

# extra))

3732

# (funcall show-test-buffer-in-test-window)

3733

# (funcall remove-test-window)

3734

# (if extra (message "Extra tests run successfully!"))))

3735

# run-tests-in-test-buffer:

3736

# (lambda (dir &optional extra)

3737

# (with-current-buffer (get-buffer-create "*Test*")

3738

# (setq buffer-read-only nil

3739

# default-directory dir)

3740

# (erase-buffer)

3741

# (compilation-mode))

3742

# (let ((process-result

3743

# (let ((inhibit-read-only t))

3744

# (process-file-shell-command

3745

# (funcall get-command-line extra) nil "*Test*"))))

3746

# (and (numberp process-result)

3747

# (= process-result 0))))

3748

# get-command-line:

3749

# (lambda (&optional extra)

3750

# (let ((quoted-script

3751

# (shell-quote-argument (funcall get-script-name))))

3752

# (format

3753

# (concat "%s --check" (if extra " --prefix=atest" ""))

3754

# quoted-script)))

3755

# get-script-name:

3756

# (lambda ()

3757

# (if (fboundp 'file-local-name)

3758

# (file-local-name (buffer-file-name))

3759

# (or (file-remote-p (buffer-file-name) 'localname)

3760

# (buffer-file-name))))

3761

# remove-test-window:

3762

# (lambda ()

3763

# (let ((test-window (get-buffer-window "*Test*")))

3764

# (if test-window (delete-window test-window))))

3765

# show-test-buffer-in-test-window:

3766

# (lambda ()

3767

# (when (not (get-buffer-window-list "*Test*"))

3768

# (setq next-error-last-buffer (get-buffer "*Test*"))

3769

# (let* ((side (if (>= (window-width) 146) 'right 'bottom))

3770

# (display-buffer-overriding-action

3771

# `((display-buffer-in-side-window) (side . ,side)

3772

# (window-height . fit-window-to-buffer)

3773

# (window-width . fit-window-to-buffer))))

3774

# (display-buffer "*Test*"))))

3775

# eval:

3776

# (progn

3777

# (let* ((run-extra-tests (lambda () (interactive)

3778

# (funcall run-tests t)))

3779

# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t

3780

# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c

3781

# (setq minor-mode-overriding-map-alist

3782

# (cons `(run-tests . ,outer-keymap)

3783

# minor-mode-overriding-map-alist)))

3784

# (add-hook 'after-save-hook run-tests 90 t))

3785

# End: