To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1288
- compare with another revision
- download diff
- download tarball
- view history from revision 1288
- Committer: Teddy Hogeborn
- Date: 2024-09-08 05:08:20 UTC
- Revision ID: teddy@recompile.se-20240908050820-jpkid6ufjb9n107o
Fix #1079588 by not outputting to stdout in maintainer scripts
From The Debconf Programmer's Tutorial: "Anything your maintainer
scripts output to standard output is passed into the frontend as a
command". We must make sure to redirect stdout to stderr for every
command in the postinst and postrm scripts which might output to
stdout.
* debian/mandos-client.postinst (update_initramfs): Add "1>&2" to
invocations of update-initramfs and /etc/kernel/postinst.d/dracut.
(add_mandos_user): Add "1>&2" to invocations of usermod, groupmod,
and adduser.
(create_keys): Add "1>&2" to invocations of mandos-keygen,
gpg-connect-agent, certtool, and openssl.
(create_dh_params): Add "1>&2" to invocations of certtool and
openssl. Add "--force" option to "rm".
* debian/mandos-client.postrm (update_initramfs): Add "1>&2" to
invocations of update-initramfs and /etc/kernel/postinst.d/dracut.
Closes: #1079588
Reported-By: Ben Hutchings <ben@decadent.org.uk>
From The Debconf Programmer's Tutorial: "Anything your maintainer
scripts output to standard output is passed into the frontend as a
command". We must make sure to redirect stdout to stderr for every
command in the postinst and postrm scripts which might output to
stdout.
* debian/mandos-client.postinst (update_initramfs): Add "1>&2" to
invocations of update-initramfs and /etc/kernel/postinst.d/dracut.
(add_mandos_user): Add "1>&2" to invocations of usermod, groupmod,
and adduser.
(create_keys): Add "1>&2" to invocations of mandos-keygen,
gpg-connect-agent, certtool, and openssl.
(create_dh_params): Add "1>&2" to invocations of certtool and
openssl. Add "--force" option to "rm".
* debian/mandos-client.postrm (update_initramfs): Add "1>&2" to
invocations of update-initramfs and /etc/kernel/postinst.d/dracut.
Closes: #1079588
Reported-By: Ben Hutchings <ben@decadent.org.uk>
- files added:
- debian/mandos.maintscript
- files modified:
- DBUS-API
added
removed
mandos
1
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
2
# -*- coding: utf-8; lexical-binding: t -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
40
39
except ImportError:
41
40
pass
42
41
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
43
47
try:
44
48
import SocketServer as socketserver
45
49
except ImportError:
46
50
import socketserver
47
51
import socket
48
import argparse
49
52
import datetime
50
53
import errno
51
54
try:
52
55
import ConfigParser as configparser
53
56
except ImportError:
54
57
import configparser
55
import sys
56
58
import re
57
import os
58
59
import signal
59
60
import subprocess
60
61
import atexit
61
62
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import unittest
81
80
import random
81
import shlex
82
82
83
83
import dbus
84
84
import dbus.service
93
93
if sys.version_info.major == 2:
94
94
__metaclass__ = type
95
95
str = unicode
96
input = raw_input
96
97
97
98
# Add collections.abc.Callable if it does not exist
98
99
try:
103
104
collections.abc = abc
104
105
del abc
105
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
106
113
# Show warnings by default
107
114
if not sys.warnoptions:
108
115
import warnings
136
143
if sys.version_info < (3, 2):
137
144
configparser.Configparser = configparser.SafeConfigParser
138
145
139
version = "1.8.9"
146
version = "1.8.16"
140
147
stored_state_file = "clients.pickle"
141
148
142
logger = logging.getLogger()
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
143
150
logging.captureWarnings(True) # Show warnings via the logging system
144
151
syslogger = None
145
152
182
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
183
190
address="/dev/log"))
184
191
syslogger.setFormatter(logging.Formatter
185
('Mandos [%(process)d]: %(levelname)s:'
186
' %(message)s'))
187
logger.addHandler(syslogger)
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
188
195
189
196
if debug:
190
197
console = logging.StreamHandler()
191
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
192
' [%(process)d]:'
193
' %(levelname)s:'
194
' %(message)s'))
195
logger.addHandler(console)
196
logger.setLevel(level)
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
197
204
198
205
199
206
class PGPError(Exception):
217
224
except OSError as e:
218
225
if e.errno != errno.ENOENT:
219
226
raise
220
self.gnupgargs = ['--batch',
221
'--homedir', self.tempdir,
222
'--force-mdc',
223
'--quiet']
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
224
231
# Only GPG version 1 has the --no-use-agent option.
225
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
226
233
self.gnupgargs.append("--no-use-agent")
265
272
dir=self.tempdir) as passfile:
266
273
passfile.write(passphrase)
267
274
passfile.flush()
268
proc = subprocess.Popen([self.gpg, '--symmetric',
269
'--passphrase-file',
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
270
277
passfile.name]
271
278
+ self.gnupgargs,
272
279
stdin=subprocess.PIPE,
283
290
dir=self.tempdir) as passfile:
284
291
passfile.write(passphrase)
285
292
passfile.flush()
286
proc = subprocess.Popen([self.gpg, '--decrypt',
287
'--passphrase-file',
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
288
295
passfile.name]
289
296
+ self.gnupgargs,
290
297
stdin=subprocess.PIPE,
343
350
Attributes:
344
351
interface: integer; avahi.IF_UNSPEC or an interface index.
345
352
Used to optionally bind to the specified interface.
346
name: string; Example: 'Mandos'
347
type: string; Example: '_mandos._tcp'.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
348
355
See <https://www.iana.org/assignments/service-names-port-numbers>
349
356
port: integer; what port to announce
350
357
TXT: list of strings; TXT record for the service
387
394
def rename(self, remove=True):
388
395
"""Derived from the Avahi example code"""
389
396
if self.rename_count >= self.max_renames:
390
logger.critical("No suitable Zeroconf service name found"
391
" after %i retries, exiting.",
392
self.rename_count)
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
393
400
raise AvahiServiceError("Too many renames")
394
401
self.name = str(
395
402
self.server.GetAlternativeServiceName(self.name))
396
403
self.rename_count += 1
397
logger.info("Changing Zeroconf service name to %r ...",
398
self.name)
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
399
406
if remove:
400
407
self.remove()
401
408
try:
403
410
except dbus.exceptions.DBusException as error:
404
411
if (error.get_dbus_name()
405
412
== "org.freedesktop.Avahi.CollisionError"):
406
logger.info("Local Zeroconf service name collision.")
413
log.info("Local Zeroconf service name collision.")
407
414
return self.rename(remove=False)
408
415
else:
409
logger.critical("D-Bus Exception", exc_info=error)
416
log.critical("D-Bus Exception", exc_info=error)
410
417
self.cleanup()
411
418
os._exit(1)
412
419
428
435
avahi.DBUS_INTERFACE_ENTRY_GROUP)
429
436
self.entry_group_state_changed_match = (
430
437
self.group.connect_to_signal(
431
'StateChanged', self.entry_group_state_changed))
432
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
433
self.name, self.type)
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
434
441
self.group.AddService(
435
442
self.interface,
436
443
self.protocol,
443
450
444
451
def entry_group_state_changed(self, state, error):
445
452
"""Derived from the Avahi example code"""
446
logger.debug("Avahi entry group state change: %i", state)
453
log.debug("Avahi entry group state change: %i", state)
447
454
448
455
if state == avahi.ENTRY_GROUP_ESTABLISHED:
449
logger.debug("Zeroconf service established.")
456
log.debug("Zeroconf service established.")
450
457
elif state == avahi.ENTRY_GROUP_COLLISION:
451
logger.info("Zeroconf service name collision.")
458
log.info("Zeroconf service name collision.")
452
459
self.rename()
453
460
elif state == avahi.ENTRY_GROUP_FAILURE:
454
logger.critical("Avahi: Error in group state changed %s",
455
str(error))
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
456
463
raise AvahiGroupError("State changed: {!s}".format(error))
457
464
458
465
def cleanup(self):
468
475
469
476
def server_state_changed(self, state, error=None):
470
477
"""Derived from the Avahi example code"""
471
logger.debug("Avahi server state change: %i", state)
478
log.debug("Avahi server state change: %i", state)
472
479
bad_states = {
473
480
avahi.SERVER_INVALID: "Zeroconf server invalid",
474
481
avahi.SERVER_REGISTERING: None,
478
485
if state in bad_states:
479
486
if bad_states[state] is not None:
480
487
if error is None:
481
logger.error(bad_states[state])
488
log.error(bad_states[state])
482
489
else:
483
logger.error(bad_states[state] + ": %r", error)
490
log.error(bad_states[state] + ": %r", error)
484
491
self.cleanup()
485
492
elif state == avahi.SERVER_RUNNING:
486
493
try:
488
495
except dbus.exceptions.DBusException as error:
489
496
if (error.get_dbus_name()
490
497
== "org.freedesktop.Avahi.CollisionError"):
491
logger.info("Local Zeroconf service name"
492
" collision.")
498
log.info("Local Zeroconf service name collision.")
493
499
return self.rename(remove=False)
494
500
else:
495
logger.critical("D-Bus Exception", exc_info=error)
501
log.critical("D-Bus Exception", exc_info=error)
496
502
self.cleanup()
497
503
os._exit(1)
498
504
else:
499
505
if error is None:
500
logger.debug("Unknown state: %r", state)
506
log.debug("Unknown state: %r", state)
501
507
else:
502
logger.debug("Unknown state: %r: %r", state, error)
508
log.debug("Unknown state: %r: %r", state, error)
503
509
504
510
def activate(self):
505
511
"""Derived from the Avahi example code"""
517
523
class AvahiServiceToSyslog(AvahiService):
518
524
def rename(self, *args, **kwargs):
519
525
"""Add the new name to the syslog messages"""
520
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
521
528
syslogger.setFormatter(logging.Formatter(
522
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
523
530
.format(self.name)))
524
531
return ret
525
532
555
562
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
556
563
557
564
# Types
558
class session_int(ctypes.Structure):
565
class _session_int(ctypes.Structure):
559
566
_fields_ = []
560
session_t = ctypes.POINTER(session_int)
567
session_t = ctypes.POINTER(_session_int)
561
568
562
569
class certificate_credentials_st(ctypes.Structure):
563
570
_fields_ = []
566
573
certificate_type_t = ctypes.c_int
567
574
568
575
class datum_t(ctypes.Structure):
569
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
570
('size', ctypes.c_uint)]
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
571
578
572
class openpgp_crt_int(ctypes.Structure):
579
class _openpgp_crt_int(ctypes.Structure):
573
580
_fields_ = []
574
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
575
582
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
576
583
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
577
584
credentials_type_t = ctypes.c_int
586
593
# gnutls.strerror()
587
594
self.code = code
588
595
if message is None and code is not None:
589
message = gnutls.strerror(code)
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
590
598
return super(gnutls.Error, self).__init__(
591
599
message, *args)
592
600
593
601
class CertificateSecurityError(Error):
594
602
pass
595
603
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
596
629
# Classes
597
class Credentials:
630
class Credentials(With_from_param):
598
631
def __init__(self):
599
self._c_object = gnutls.certificate_credentials_t()
600
gnutls.certificate_allocate_credentials(
601
ctypes.byref(self._c_object))
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
602
634
self.type = gnutls.CRD_CERTIFICATE
603
635
604
636
def __del__(self):
605
gnutls.certificate_free_credentials(self._c_object)
637
gnutls.certificate_free_credentials(self)
606
638
607
class ClientSession:
639
class ClientSession(With_from_param):
608
640
def __init__(self, socket, credentials=None):
609
self._c_object = gnutls.session_t()
641
self._as_parameter_ = gnutls.session_t()
610
642
gnutls_flags = gnutls.CLIENT
611
643
if gnutls.check_version(b"3.5.6"):
612
644
gnutls_flags |= gnutls.NO_TICKETS
613
645
if gnutls.has_rawpk:
614
646
gnutls_flags |= gnutls.ENABLE_RAWPK
615
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
647
gnutls.init(self, gnutls_flags)
616
648
del gnutls_flags
617
gnutls.set_default_priority(self._c_object)
618
gnutls.transport_set_ptr(self._c_object, socket.fileno())
619
gnutls.handshake_set_private_extensions(self._c_object,
620
True)
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
621
652
self.socket = socket
622
653
if credentials is None:
623
654
credentials = gnutls.Credentials()
624
gnutls.credentials_set(self._c_object, credentials.type,
625
ctypes.cast(credentials._c_object,
626
ctypes.c_void_p))
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
627
657
self.credentials = credentials
628
658
629
659
def __del__(self):
630
gnutls.deinit(self._c_object)
660
gnutls.deinit(self)
631
661
632
662
def handshake(self):
633
return gnutls.handshake(self._c_object)
663
return gnutls.handshake(self)
634
664
635
665
def send(self, data):
636
666
data = bytes(data)
637
667
data_len = len(data)
638
668
while data_len > 0:
639
data_len -= gnutls.record_send(self._c_object,
640
data[-data_len:],
669
data_len -= gnutls.record_send(self, data[-data_len:],
641
670
data_len)
642
671
643
672
def bye(self):
644
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
645
674
646
675
# Error handling functions
647
676
def _error_code(result):
648
677
"""A function to raise exceptions on errors, suitable
649
for the 'restype' attribute on ctypes functions"""
650
if result >= 0:
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
651
680
return result
652
681
if result == gnutls.E_NO_CERTIFICATE_FOUND:
653
682
raise gnutls.CertificateSecurityError(code=result)
654
683
raise gnutls.Error(code=result)
655
684
656
def _retry_on_error(result, func, arguments):
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
657
687
"""A function to retry on some errors, suitable
658
for the 'errcheck' attribute on ctypes functions"""
659
while result < 0:
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
660
690
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
661
691
return _error_code(result)
662
692
result = func(*arguments)
667
697
668
698
# Functions
669
699
priority_set_direct = _library.gnutls_priority_set_direct
670
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
671
701
ctypes.POINTER(ctypes.c_char_p)]
672
702
priority_set_direct.restype = _error_code
673
703
674
704
init = _library.gnutls_init
675
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
676
706
init.restype = _error_code
677
707
678
708
set_default_priority = _library.gnutls_set_default_priority
679
set_default_priority.argtypes = [session_t]
709
set_default_priority.argtypes = [ClientSession]
680
710
set_default_priority.restype = _error_code
681
711
682
712
record_send = _library.gnutls_record_send
683
record_send.argtypes = [session_t, ctypes.c_void_p,
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
684
714
ctypes.c_size_t]
685
715
record_send.restype = ctypes.c_ssize_t
686
716
record_send.errcheck = _retry_on_error
688
718
certificate_allocate_credentials = (
689
719
_library.gnutls_certificate_allocate_credentials)
690
720
certificate_allocate_credentials.argtypes = [
691
ctypes.POINTER(certificate_credentials_t)]
721
PointerTo(Credentials)]
692
722
certificate_allocate_credentials.restype = _error_code
693
723
694
724
certificate_free_credentials = (
695
725
_library.gnutls_certificate_free_credentials)
696
certificate_free_credentials.argtypes = [
697
certificate_credentials_t]
726
certificate_free_credentials.argtypes = [Credentials]
698
727
certificate_free_credentials.restype = None
699
728
700
729
handshake_set_private_extensions = (
701
730
_library.gnutls_handshake_set_private_extensions)
702
handshake_set_private_extensions.argtypes = [session_t,
731
handshake_set_private_extensions.argtypes = [ClientSession,
703
732
ctypes.c_int]
704
733
handshake_set_private_extensions.restype = None
705
734
706
735
credentials_set = _library.gnutls_credentials_set
707
credentials_set.argtypes = [session_t, credentials_type_t,
708
ctypes.c_void_p]
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
709
738
credentials_set.restype = _error_code
710
739
711
740
strerror = _library.gnutls_strerror
713
742
strerror.restype = ctypes.c_char_p
714
743
715
744
certificate_type_get = _library.gnutls_certificate_type_get
716
certificate_type_get.argtypes = [session_t]
745
certificate_type_get.argtypes = [ClientSession]
717
746
certificate_type_get.restype = _error_code
718
747
719
748
certificate_get_peers = _library.gnutls_certificate_get_peers
720
certificate_get_peers.argtypes = [session_t,
749
certificate_get_peers.argtypes = [ClientSession,
721
750
ctypes.POINTER(ctypes.c_uint)]
722
751
certificate_get_peers.restype = ctypes.POINTER(datum_t)
723
752
730
759
global_set_log_function.restype = None
731
760
732
761
deinit = _library.gnutls_deinit
733
deinit.argtypes = [session_t]
762
deinit.argtypes = [ClientSession]
734
763
deinit.restype = None
735
764
736
765
handshake = _library.gnutls_handshake
737
handshake.argtypes = [session_t]
738
handshake.restype = _error_code
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
739
768
handshake.errcheck = _retry_on_error
740
769
741
770
transport_set_ptr = _library.gnutls_transport_set_ptr
742
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
743
772
transport_set_ptr.restype = None
744
773
745
774
bye = _library.gnutls_bye
746
bye.argtypes = [session_t, close_request_t]
747
bye.restype = _error_code
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
748
777
bye.errcheck = _retry_on_error
749
778
750
779
check_version = _library.gnutls_check_version
767
796
768
797
x509_crt_fmt_t = ctypes.c_int
769
798
770
# All the function declarations below are from gnutls/abstract.h
799
# All the function declarations below are from
800
# gnutls/abstract.h
771
801
pubkey_init = _library.gnutls_pubkey_init
772
802
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
773
803
pubkey_init.restype = _error_code
787
817
pubkey_deinit.argtypes = [pubkey_t]
788
818
pubkey_deinit.restype = None
789
819
else:
790
# All the function declarations below are from gnutls/openpgp.h
820
# All the function declarations below are from
821
# gnutls/openpgp.h
791
822
792
823
openpgp_crt_init = _library.gnutls_openpgp_crt_init
793
824
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
799
830
openpgp_crt_fmt_t]
800
831
openpgp_crt_import.restype = _error_code
801
832
802
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
803
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
804
ctypes.POINTER(ctypes.c_uint)]
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
805
840
openpgp_crt_verify_self.restype = _error_code
806
841
807
842
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
818
853
819
854
if check_version(b"3.6.4"):
820
855
certificate_type_get2 = _library.gnutls_certificate_type_get2
821
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
822
857
certificate_type_get2.restype = _error_code
823
858
824
859
# Remove non-public functions
840
875
"""A representation of a client host served by this server.
841
876
842
877
Attributes:
843
approved: bool(); 'None' if not yet approved/disapproved
878
approved: bool(); None if not yet approved/disapproved
844
879
approval_delay: datetime.timedelta(); Time to wait for approval
845
880
approval_duration: datetime.timedelta(); Duration of one approval
846
881
checker: multiprocessing.Process(); a running checker process used
847
to see if the client lives. 'None' if no process is
882
to see if the client lives. None if no process is
848
883
running.
849
884
checker_callback_tag: a GLib event source tag, or None
850
885
checker_command: string; External command which is run to check
926
961
# key_id() and fingerprint() functions
927
962
client["key_id"] = (section.get("key_id", "").upper()
928
963
.replace(" ", ""))
929
client["fingerprint"] = (section["fingerprint"].upper()
964
client["fingerprint"] = (section.get("fingerprint",
965
"").upper()
930
966
.replace(" ", ""))
967
if not (client["key_id"] or client["fingerprint"]):
968
log.error("Skipping client %s without key_id or"
969
" fingerprint", client_name)
970
del settings[client_name]
971
continue
931
972
if "secret" in section:
932
973
client["secret"] = codecs.decode(section["secret"]
933
974
.encode("utf-8"),
974
1015
self.last_enabled = None
975
1016
self.expires = None
976
1017
977
logger.debug("Creating client %r", self.name)
978
logger.debug(" Key ID: %s", self.key_id)
979
logger.debug(" Fingerprint: %s", self.fingerprint)
1018
log.debug("Creating client %r", self.name)
1019
log.debug(" Key ID: %s", self.key_id)
1020
log.debug(" Fingerprint: %s", self.fingerprint)
980
1021
self.created = settings.get("created",
981
1022
datetime.datetime.utcnow())
982
1023
1010
1051
if getattr(self, "enabled", False):
1011
1052
# Already enabled
1012
1053
return
1013
self.expires = datetime.datetime.utcnow() + self.timeout
1014
1054
self.enabled = True
1015
1055
self.last_enabled = datetime.datetime.utcnow()
1016
1056
self.init_checker()
1021
1061
if not getattr(self, "enabled", False):
1022
1062
return False
1023
1063
if not quiet:
1024
logger.info("Disabling client %s", self.name)
1064
log.info("Disabling client %s", self.name)
1025
1065
if getattr(self, "disable_initiator_tag", None) is not None:
1026
1066
GLib.source_remove(self.disable_initiator_tag)
1027
1067
self.disable_initiator_tag = None
1039
1079
def __del__(self):
1040
1080
self.disable()
1041
1081
1042
def init_checker(self):
1043
# Schedule a new checker to be started an 'interval' from now,
1044
# and every interval from then on.
1082
def init_checker(self, randomize_start=False):
1083
# Schedule a new checker to be started a randomly selected
1084
# time (a fraction of 'interval') from now. This spreads out
1085
# the startup of checkers over time when the server is
1086
# started.
1045
1087
if self.checker_initiator_tag is not None:
1046
1088
GLib.source_remove(self.checker_initiator_tag)
1089
interval_milliseconds = int(self.interval.total_seconds()
1090
* 1000)
1091
if randomize_start:
1092
delay_milliseconds = random.randrange(
1093
interval_milliseconds + 1)
1094
else:
1095
delay_milliseconds = interval_milliseconds
1047
1096
self.checker_initiator_tag = GLib.timeout_add(
1048
random.randrange(int(self.interval.total_seconds() * 1000
1049
+ 1)),
1050
self.start_checker)
1051
# Schedule a disable() when 'timeout' has passed
1097
delay_milliseconds, self.start_checker, randomize_start)
1098
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1099
# A checker might take up to an 'interval' of time, so we can
1100
# expire at the soonest one interval after a checker was
1101
# started. Since the initial checker is delayed, the expire
1102
# time might have to be extended.
1103
now = datetime.datetime.utcnow()
1104
self.expires = now + delay + self.interval
1105
# Schedule a disable() at expire time
1052
1106
if self.disable_initiator_tag is not None:
1053
1107
GLib.source_remove(self.disable_initiator_tag)
1054
1108
self.disable_initiator_tag = GLib.timeout_add(
1055
int(self.timeout.total_seconds() * 1000), self.disable)
1056
# Also start a new checker *right now*.
1057
self.start_checker()
1109
int((self.expires - now).total_seconds() * 1000),
1110
self.disable)
1058
1111
1059
1112
def checker_callback(self, source, condition, connection,
1060
1113
command):
1071
1124
self.last_checker_status = returncode
1072
1125
self.last_checker_signal = None
1073
1126
if self.last_checker_status == 0:
1074
logger.info("Checker for %(name)s succeeded",
1075
vars(self))
1127
log.info("Checker for %(name)s succeeded", vars(self))
1076
1128
self.checked_ok()
1077
1129
else:
1078
logger.info("Checker for %(name)s failed", vars(self))
1130
log.info("Checker for %(name)s failed", vars(self))
1079
1131
else:
1080
1132
self.last_checker_status = -1
1081
1133
self.last_checker_signal = -returncode
1082
logger.warning("Checker for %(name)s crashed?",
1083
vars(self))
1134
log.warning("Checker for %(name)s crashed?", vars(self))
1084
1135
return False
1085
1136
1086
1137
def checked_ok(self):
1105
1156
def need_approval(self):
1106
1157
self.last_approval_request = datetime.datetime.utcnow()
1107
1158
1108
def start_checker(self):
1159
def start_checker(self, start_was_randomized=False):
1109
1160
"""Start a new checker subprocess if one is not running.
1110
1161
1111
1162
If a checker already exists, leave it running and do
1120
1171
# should be.
1121
1172
1122
1173
if self.checker is not None and not self.checker.is_alive():
1123
logger.warning("Checker was not alive; joining")
1174
log.warning("Checker was not alive; joining")
1124
1175
self.checker.join()
1125
1176
self.checker = None
1126
1177
# Start a new checker if needed
1127
1178
if self.checker is None:
1128
1179
# Escape attributes for the shell
1129
1180
escaped_attrs = {
1130
attr: re.escape(str(getattr(self, attr)))
1181
attr: shlex.quote(str(getattr(self, attr)))
1131
1182
for attr in self.runtime_expansions}
1132
1183
try:
1133
1184
command = self.checker_command % escaped_attrs
1134
1185
except TypeError as error:
1135
logger.error('Could not format string "%s"',
1136
self.checker_command,
1137
exc_info=error)
1186
log.error('Could not format string "%s"',
1187
self.checker_command, exc_info=error)
1138
1188
return True # Try again later
1139
1189
self.current_checker_command = command
1140
logger.info("Starting checker %r for %s", command,
1141
self.name)
1190
log.info("Starting checker %r for %s", command, self.name)
1142
1191
# We don't need to redirect stdout and stderr, since
1143
1192
# in normal mode, that is already done by daemon(),
1144
1193
# and in debug mode we don't want to. (Stdin is
1163
1212
GLib.IOChannel.unix_new(pipe[0].fileno()),
1164
1213
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1165
1214
self.checker_callback, pipe[0], command)
1215
if start_was_randomized:
1216
# We were started after a random delay; Schedule a new
1217
# checker to be started an 'interval' from now, and every
1218
# interval from then on.
1219
now = datetime.datetime.utcnow()
1220
self.checker_initiator_tag = GLib.timeout_add(
1221
int(self.interval.total_seconds() * 1000),
1222
self.start_checker)
1223
self.expires = max(self.expires, now + self.interval)
1224
# Don't start a new checker again after same random delay
1225
return False
1166
1226
# Re-run this periodically if run by GLib.timeout_add
1167
1227
return True
1168
1228
1173
1233
self.checker_callback_tag = None
1174
1234
if getattr(self, "checker", None) is None:
1175
1235
return
1176
logger.debug("Stopping checker for %(name)s", vars(self))
1236
log.debug("Stopping checker for %(name)s", vars(self))
1177
1237
self.checker.terminate()
1178
1238
self.checker = None
1179
1239
1206
1266
func._dbus_name = func.__name__
1207
1267
if func._dbus_name.endswith("_dbus_property"):
1208
1268
func._dbus_name = func._dbus_name[:-14]
1209
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1269
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1210
1270
return func
1211
1271
1212
1272
return decorator
1301
1361
1302
1362
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1303
1363
out_signature="s",
1304
path_keyword='object_path',
1305
connection_keyword='connection')
1364
path_keyword="object_path",
1365
connection_keyword="connection")
1306
1366
def Introspect(self, object_path, connection):
1307
1367
"""Overloading of standard D-Bus method.
1308
1368
1357
1417
document.unlink()
1358
1418
except (AttributeError, xml.dom.DOMException,
1359
1419
xml.parsers.expat.ExpatError) as error:
1360
logger.error("Failed to override Introspection method",
1361
exc_info=error)
1420
log.error("Failed to override Introspection method",
1421
exc_info=error)
1362
1422
return xmlstring
1363
1423
1364
1424
1461
1521
1462
1522
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1463
1523
out_signature="s",
1464
path_keyword='object_path',
1465
connection_keyword='connection')
1524
path_keyword="object_path",
1525
connection_keyword="connection")
1466
1526
def Introspect(self, object_path, connection):
1467
1527
"""Overloading of standard D-Bus method.
1468
1528
1524
1584
document.unlink()
1525
1585
except (AttributeError, xml.dom.DOMException,
1526
1586
xml.parsers.expat.ExpatError) as error:
1527
logger.error("Failed to override Introspection method",
1528
exc_info=error)
1587
log.error("Failed to override Introspection method",
1588
exc_info=error)
1529
1589
return xmlstring
1530
1590
1531
1591
1563
1623
1564
1624
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1565
1625
out_signature="s",
1566
path_keyword='object_path',
1567
connection_keyword='connection')
1626
path_keyword="object_path",
1627
connection_keyword="connection")
1568
1628
def Introspect(self, object_path, connection):
1569
1629
"""Overloading of standard D-Bus method.
1570
1630
1595
1655
document.unlink()
1596
1656
except (AttributeError, xml.dom.DOMException,
1597
1657
xml.parsers.expat.ExpatError) as error:
1598
logger.error("Failed to override Introspection method",
1599
exc_info=error)
1658
log.error("Failed to override Introspection method",
1659
exc_info=error)
1600
1660
return xmlstring
1601
1661
1602
1662
2236
2296
class ProxyClient:
2237
2297
def __init__(self, child_pipe, key_id, fpr, address):
2238
2298
self._pipe = child_pipe
2239
self._pipe.send(('init', key_id, fpr, address))
2299
self._pipe.send(("init", key_id, fpr, address))
2240
2300
if not self._pipe.recv():
2241
2301
raise KeyError(key_id or fpr)
2242
2302
2243
2303
def __getattribute__(self, name):
2244
if name == '_pipe':
2304
if name == "_pipe":
2245
2305
return super(ProxyClient, self).__getattribute__(name)
2246
self._pipe.send(('getattr', name))
2306
self._pipe.send(("getattr", name))
2247
2307
data = self._pipe.recv()
2248
if data[0] == 'data':
2308
if data[0] == "data":
2249
2309
return data[1]
2250
if data[0] == 'function':
2310
if data[0] == "function":
2251
2311
2252
2312
def func(*args, **kwargs):
2253
self._pipe.send(('funcall', name, args, kwargs))
2313
self._pipe.send(("funcall", name, args, kwargs))
2254
2314
return self._pipe.recv()[1]
2255
2315
2256
2316
return func
2257
2317
2258
2318
def __setattr__(self, name, value):
2259
if name == '_pipe':
2319
if name == "_pipe":
2260
2320
return super(ProxyClient, self).__setattr__(name, value)
2261
self._pipe.send(('setattr', name, value))
2321
self._pipe.send(("setattr", name, value))
2262
2322
2263
2323
2264
2324
class ClientHandler(socketserver.BaseRequestHandler, object):
2269
2329
2270
2330
def handle(self):
2271
2331
with contextlib.closing(self.server.child_pipe) as child_pipe:
2272
logger.info("TCP connection from: %s",
2273
str(self.client_address))
2274
logger.debug("Pipe FD: %d",
2275
self.server.child_pipe.fileno())
2332
log.info("TCP connection from: %s",
2333
str(self.client_address))
2334
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2276
2335
2277
2336
session = gnutls.ClientSession(self.request)
2278
2337
2279
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2338
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2280
2339
# "+AES-256-CBC", "+SHA1",
2281
2340
# "+COMP-NULL", "+CTYPE-OPENPGP",
2282
2341
# "+DHE-DSS"))
2284
2343
priority = self.server.gnutls_priority
2285
2344
if priority is None:
2286
2345
priority = "NORMAL"
2287
gnutls.priority_set_direct(session._c_object,
2288
priority.encode("utf-8"),
2289
None)
2346
gnutls.priority_set_direct(session,
2347
priority.encode("utf-8"), None)
2290
2348
2291
2349
# Start communication using the Mandos protocol
2292
2350
# Get protocol number
2293
2351
line = self.request.makefile().readline()
2294
logger.debug("Protocol version: %r", line)
2352
log.debug("Protocol version: %r", line)
2295
2353
try:
2296
2354
if int(line.strip().split()[0]) > 1:
2297
2355
raise RuntimeError(line)
2298
2356
except (ValueError, IndexError, RuntimeError) as error:
2299
logger.error("Unknown protocol version: %s", error)
2357
log.error("Unknown protocol version: %s", error)
2300
2358
return
2301
2359
2302
2360
# Start GnuTLS connection
2303
2361
try:
2304
2362
session.handshake()
2305
2363
except gnutls.Error as error:
2306
logger.warning("Handshake failed: %s", error)
2364
log.warning("Handshake failed: %s", error)
2307
2365
# Do not run session.bye() here: the session is not
2308
2366
# established. Just abandon the request.
2309
2367
return
2310
logger.debug("Handshake succeeded")
2368
log.debug("Handshake succeeded")
2311
2369
2312
2370
approval_required = False
2313
2371
try:
2317
2375
key_id = self.key_id(
2318
2376
self.peer_certificate(session))
2319
2377
except (TypeError, gnutls.Error) as error:
2320
logger.warning("Bad certificate: %s", error)
2378
log.warning("Bad certificate: %s", error)
2321
2379
return
2322
logger.debug("Key ID: %s", key_id)
2380
log.debug("Key ID: %s",
2381
key_id.decode("utf-8",
2382
errors="replace"))
2323
2383
2324
2384
else:
2325
2385
key_id = b""
2327
2387
fpr = self.fingerprint(
2328
2388
self.peer_certificate(session))
2329
2389
except (TypeError, gnutls.Error) as error:
2330
logger.warning("Bad certificate: %s", error)
2390
log.warning("Bad certificate: %s", error)
2331
2391
return
2332
logger.debug("Fingerprint: %s", fpr)
2392
log.debug("Fingerprint: %s", fpr)
2333
2393
2334
2394
try:
2335
2395
client = ProxyClient(child_pipe, key_id, fpr,
2344
2404
2345
2405
while True:
2346
2406
if not client.enabled:
2347
logger.info("Client %s is disabled",
2348
client.name)
2407
log.info("Client %s is disabled", client.name)
2349
2408
if self.server.use_dbus:
2350
2409
# Emit D-Bus signal
2351
2410
client.Rejected("Disabled")
2355
2414
# We are approved or approval is disabled
2356
2415
break
2357
2416
elif client.approved is None:
2358
logger.info("Client %s needs approval",
2359
client.name)
2417
log.info("Client %s needs approval",
2418
client.name)
2360
2419
if self.server.use_dbus:
2361
2420
# Emit D-Bus signal
2362
2421
client.NeedApproval(
2363
2422
client.approval_delay.total_seconds()
2364
2423
* 1000, client.approved_by_default)
2365
2424
else:
2366
logger.warning("Client %s was not approved",
2367
client.name)
2425
log.warning("Client %s was not approved",
2426
client.name)
2368
2427
if self.server.use_dbus:
2369
2428
# Emit D-Bus signal
2370
2429
client.Rejected("Denied")
2378
2437
time2 = datetime.datetime.now()
2379
2438
if (time2 - time) >= delay:
2380
2439
if not client.approved_by_default:
2381
logger.warning("Client %s timed out while"
2382
" waiting for approval",
2383
client.name)
2440
log.warning("Client %s timed out while"
2441
" waiting for approval",
2442
client.name)
2384
2443
if self.server.use_dbus:
2385
2444
# Emit D-Bus signal
2386
2445
client.Rejected("Approval timed out")
2393
2452
try:
2394
2453
session.send(client.secret)
2395
2454
except gnutls.Error as error:
2396
logger.warning("gnutls send failed",
2397
exc_info=error)
2455
log.warning("gnutls send failed", exc_info=error)
2398
2456
return
2399
2457
2400
logger.info("Sending secret to %s", client.name)
2458
log.info("Sending secret to %s", client.name)
2401
2459
# bump the timeout using extended_timeout
2402
2460
client.bump_timeout(client.extended_timeout)
2403
2461
if self.server.use_dbus:
2410
2468
try:
2411
2469
session.bye()
2412
2470
except gnutls.Error as error:
2413
logger.warning("GnuTLS bye failed",
2414
exc_info=error)
2471
log.warning("GnuTLS bye failed", exc_info=error)
2415
2472
2416
2473
@staticmethod
2417
2474
def peer_certificate(session):
2418
2475
"Return the peer's certificate as a bytestring"
2419
2476
try:
2420
cert_type = gnutls.certificate_type_get2(session._c_object,
2421
gnutls.CTYPE_PEERS)
2477
cert_type = gnutls.certificate_type_get2(
2478
session, gnutls.CTYPE_PEERS)
2422
2479
except AttributeError:
2423
cert_type = gnutls.certificate_type_get(session._c_object)
2480
cert_type = gnutls.certificate_type_get(session)
2424
2481
if gnutls.has_rawpk:
2425
2482
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2426
2483
else:
2427
2484
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2428
2485
# If not a valid certificate type...
2429
2486
if cert_type not in valid_cert_types:
2430
logger.info("Cert type %r not in %r", cert_type,
2431
valid_cert_types)
2487
log.info("Cert type %r not in %r", cert_type,
2488
valid_cert_types)
2432
2489
# ...return invalid data
2433
2490
return b""
2434
2491
list_size = ctypes.c_uint(1)
2435
2492
cert_list = (gnutls.certificate_get_peers
2436
(session._c_object, ctypes.byref(list_size)))
2493
(session, ctypes.byref(list_size)))
2437
2494
if not bool(cert_list) and list_size.value != 0:
2438
2495
raise gnutls.Error("error getting peer certificate")
2439
2496
if list_size.value == 0:
2461
2518
buf = ctypes.create_string_buffer(32)
2462
2519
buf_len = ctypes.c_size_t(len(buf))
2463
2520
# Get the key ID from the raw public key into the buffer
2464
gnutls.pubkey_get_key_id(pubkey,
2465
gnutls.KEYID_USE_SHA256,
2466
ctypes.cast(ctypes.byref(buf),
2467
ctypes.POINTER(ctypes.c_ubyte)),
2468
ctypes.byref(buf_len))
2521
gnutls.pubkey_get_key_id(
2522
pubkey,
2523
gnutls.KEYID_USE_SHA256,
2524
ctypes.cast(ctypes.byref(buf),
2525
ctypes.POINTER(ctypes.c_ubyte)),
2526
ctypes.byref(buf_len))
2469
2527
# Deinit the certificate
2470
2528
gnutls.pubkey_deinit(pubkey)
2471
2529
2552
2610
2553
2611
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2554
2612
socketserver.TCPServer):
2555
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2613
"""IPv6-capable TCP server. Accepts None as address and/or port
2556
2614
2557
2615
Attributes:
2558
2616
enabled: Boolean; whether this server is activated yet
2609
2667
if SO_BINDTODEVICE is None:
2610
2668
# Fall back to a hard-coded value which seems to be
2611
2669
# common enough.
2612
logger.warning("SO_BINDTODEVICE not found, trying 25")
2670
log.warning("SO_BINDTODEVICE not found, trying 25")
2613
2671
SO_BINDTODEVICE = 25
2614
2672
try:
2615
2673
self.socket.setsockopt(
2617
2675
(self.interface + "\0").encode("utf-8"))
2618
2676
except socket.error as error:
2619
2677
if error.errno == errno.EPERM:
2620
logger.error("No permission to bind to"
2621
" interface %s", self.interface)
2678
log.error("No permission to bind to interface %s",
2679
self.interface)
2622
2680
elif error.errno == errno.ENOPROTOOPT:
2623
logger.error("SO_BINDTODEVICE not available;"
2624
" cannot bind to interface %s",
2625
self.interface)
2681
log.error("SO_BINDTODEVICE not available; cannot"
2682
" bind to interface %s", self.interface)
2626
2683
elif error.errno == errno.ENODEV:
2627
logger.error("Interface %s does not exist,"
2628
" cannot bind", self.interface)
2684
log.error("Interface %s does not exist, cannot"
2685
" bind", self.interface)
2629
2686
else:
2630
2687
raise
2631
2688
# Only bind(2) the socket if we really need to.
2710
2767
request = parent_pipe.recv()
2711
2768
command = request[0]
2712
2769
2713
if command == 'init':
2770
if command == "init":
2714
2771
key_id = request[1].decode("ascii")
2715
2772
fpr = request[2].decode("ascii")
2716
2773
address = request[3]
2717
2774
2718
2775
for c in self.clients.values():
2719
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2776
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2777
"27AE41E4649B934CA495991B7852B855"):
2720
2778
continue
2721
2779
if key_id and c.key_id == key_id:
2722
2780
client = c
2725
2783
client = c
2726
2784
break
2727
2785
else:
2728
logger.info("Client not found for key ID: %s, address"
2729
": %s", key_id or fpr, address)
2786
log.info("Client not found for key ID: %s, address:"
2787
" %s", key_id or fpr, address)
2730
2788
if self.use_dbus:
2731
2789
# Emit D-Bus signal
2732
2790
mandos_dbus_service.ClientNotFound(key_id or fpr,
2745
2803
# remove the old hook in favor of the new above hook on
2746
2804
# same fileno
2747
2805
return False
2748
if command == 'funcall':
2806
if command == "funcall":
2749
2807
funcname = request[1]
2750
2808
args = request[2]
2751
2809
kwargs = request[3]
2752
2810
2753
parent_pipe.send(('data', getattr(client_object,
2811
parent_pipe.send(("data", getattr(client_object,
2754
2812
funcname)(*args,
2755
2813
**kwargs)))
2756
2814
2757
if command == 'getattr':
2815
if command == "getattr":
2758
2816
attrname = request[1]
2759
2817
if isinstance(client_object.__getattribute__(attrname),
2760
2818
collections.abc.Callable):
2761
parent_pipe.send(('function', ))
2819
parent_pipe.send(("function", ))
2762
2820
else:
2763
2821
parent_pipe.send((
2764
'data', client_object.__getattribute__(attrname)))
2822
"data", client_object.__getattribute__(attrname)))
2765
2823
2766
if command == 'setattr':
2824
if command == "setattr":
2767
2825
attrname = request[1]
2768
2826
value = request[2]
2769
2827
setattr(client_object, attrname, value)
2774
2832
def rfc3339_duration_to_delta(duration):
2775
2833
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2776
2834
2777
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2778
True
2779
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2780
True
2781
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2782
True
2783
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2784
True
2785
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2786
True
2787
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2788
True
2789
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2790
True
2835
>>> timedelta = datetime.timedelta
2836
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2837
True
2838
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2839
True
2840
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2841
True
2842
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2843
True
2844
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2845
True
2846
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2847
True
2848
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2849
True
2850
>>> del timedelta
2791
2851
"""
2792
2852
2793
2853
# Parsing an RFC 3339 duration with regular expressions is not
2873
2933
def string_to_delta(interval):
2874
2934
"""Parse a string and return a datetime.timedelta
2875
2935
2876
>>> string_to_delta('7d') == datetime.timedelta(7)
2877
True
2878
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2879
True
2880
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2881
True
2882
>>> string_to_delta('24h') == datetime.timedelta(1)
2883
True
2884
>>> string_to_delta('1w') == datetime.timedelta(7)
2885
True
2886
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2936
>>> string_to_delta("7d") == datetime.timedelta(7)
2937
True
2938
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2939
True
2940
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2941
True
2942
>>> string_to_delta("24h") == datetime.timedelta(1)
2943
True
2944
>>> string_to_delta("1w") == datetime.timedelta(7)
2945
True
2946
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2887
2947
True
2888
2948
"""
2889
2949
3093
3153
3094
3154
if server_settings["servicename"] != "Mandos":
3095
3155
syslogger.setFormatter(
3096
logging.Formatter('Mandos ({}) [%(process)d]:'
3097
' %(levelname)s: %(message)s'.format(
3156
logging.Formatter("Mandos ({}) [%(process)d]:"
3157
" %(levelname)s: %(message)s".format(
3098
3158
server_settings["servicename"])))
3099
3159
3100
3160
# Parse config file with clients
3124
3184
try:
3125
3185
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3126
3186
except IOError as e:
3127
logger.error("Could not open file %r", pidfilename,
3128
exc_info=e)
3187
log.error("Could not open file %r", pidfilename,
3188
exc_info=e)
3129
3189
3130
3190
for name, group in (("_mandos", "_mandos"),
3131
3191
("mandos", "mandos"),
3142
3202
try:
3143
3203
os.setgid(gid)
3144
3204
os.setuid(uid)
3145
if debug:
3146
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3147
gid))
3205
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3148
3206
except OSError as error:
3149
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3150
.format(uid, gid, os.strerror(error.errno)))
3207
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3208
os.strerror(error.errno))
3151
3209
if error.errno != errno.EPERM:
3152
3210
raise
3153
3211
3160
3218
3161
3219
@gnutls.log_func
3162
3220
def debug_gnutls(level, string):
3163
logger.debug("GnuTLS: %s", string[:-1])
3221
log.debug("GnuTLS: %s",
3222
string[:-1].decode("utf-8", errors="replace"))
3164
3223
3165
3224
gnutls.global_set_log_function(debug_gnutls)
3166
3225
3195
3254
"se.bsnet.fukt.Mandos", bus,
3196
3255
do_not_queue=True)
3197
3256
except dbus.exceptions.DBusException as e:
3198
logger.error("Disabling D-Bus:", exc_info=e)
3257
log.error("Disabling D-Bus:", exc_info=e)
3199
3258
use_dbus = False
3200
3259
server_settings["use_dbus"] = False
3201
3260
tcp_server.use_dbus = False
3286
3345
os.remove(stored_state_path)
3287
3346
except IOError as e:
3288
3347
if e.errno == errno.ENOENT:
3289
logger.warning("Could not load persistent state:"
3290
" {}".format(os.strerror(e.errno)))
3348
log.warning("Could not load persistent state:"
3349
" %s", os.strerror(e.errno))
3291
3350
else:
3292
logger.critical("Could not load persistent state:",
3293
exc_info=e)
3351
log.critical("Could not load persistent state:",
3352
exc_info=e)
3294
3353
raise
3295
3354
except EOFError as e:
3296
logger.warning("Could not load persistent state: "
3297
"EOFError:",
3298
exc_info=e)
3355
log.warning("Could not load persistent state: EOFError:",
3356
exc_info=e)
3299
3357
3300
3358
with PGPEngine() as pgp:
3301
3359
for client_name, client in clients_data.items():
3328
3386
if client["enabled"]:
3329
3387
if datetime.datetime.utcnow() >= client["expires"]:
3330
3388
if not client["last_checked_ok"]:
3331
logger.warning(
3332
"disabling client {} - Client never "
3333
"performed a successful checker".format(
3334
client_name))
3389
log.warning("disabling client %s - Client"
3390
" never performed a successful"
3391
" checker", client_name)
3335
3392
client["enabled"] = False
3336
3393
elif client["last_checker_status"] != 0:
3337
logger.warning(
3338
"disabling client {} - Client last"
3339
" checker failed with error code"
3340
" {}".format(
3341
client_name,
3342
client["last_checker_status"]))
3394
log.warning("disabling client %s - Client"
3395
" last checker failed with error"
3396
" code %s", client_name,
3397
client["last_checker_status"])
3343
3398
client["enabled"] = False
3344
3399
else:
3345
3400
client["expires"] = (
3346
3401
datetime.datetime.utcnow()
3347
3402
+ client["timeout"])
3348
logger.debug("Last checker succeeded,"
3349
" keeping {} enabled".format(
3350
client_name))
3403
log.debug("Last checker succeeded, keeping %s"
3404
" enabled", client_name)
3351
3405
try:
3352
3406
client["secret"] = pgp.decrypt(
3353
3407
client["encrypted_secret"],
3354
3408
client_settings[client_name]["secret"])
3355
3409
except PGPError:
3356
3410
# If decryption fails, we use secret from new settings
3357
logger.debug("Failed to decrypt {} old secret".format(
3358
client_name))
3411
log.debug("Failed to decrypt %s old secret",
3412
client_name)
3359
3413
client["secret"] = (client_settings[client_name]
3360
3414
["secret"])
3361
3415
3375
3429
server_settings=server_settings)
3376
3430
3377
3431
if not tcp_server.clients:
3378
logger.warning("No clients defined")
3432
log.warning("No clients defined")
3379
3433
3380
3434
if not foreground:
3381
3435
if pidfile is not None:
3384
3438
with pidfile:
3385
3439
print(pid, file=pidfile)
3386
3440
except IOError:
3387
logger.error("Could not write to file %r with PID %d",
3388
pidfilename, pid)
3441
log.error("Could not write to file %r with PID %d",
3442
pidfilename, pid)
3389
3443
del pidfile
3390
3444
del pidfilename
3391
3445
3541
3595
3542
3596
try:
3543
3597
with tempfile.NamedTemporaryFile(
3544
mode='wb',
3598
mode="wb",
3545
3599
suffix=".pickle",
3546
prefix='clients-',
3600
prefix="clients-",
3547
3601
dir=os.path.dirname(stored_state_path),
3548
3602
delete=False) as stored_state:
3549
3603
pickle.dump((clients, client_settings), stored_state,
3557
3611
except NameError:
3558
3612
pass
3559
3613
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3560
logger.warning("Could not save persistent state: {}"
3561
.format(os.strerror(e.errno)))
3614
log.warning("Could not save persistent state: %s",
3615
os.strerror(e.errno))
3562
3616
else:
3563
logger.warning("Could not save persistent state:",
3564
exc_info=e)
3617
log.warning("Could not save persistent state:",
3618
exc_info=e)
3565
3619
raise
3566
3620
3567
3621
# Delete all clients, and settings from config
3584
3638
mandos_dbus_service.client_added_signal(client)
3585
3639
# Need to initiate checking of clients
3586
3640
if client.enabled:
3587
client.init_checker()
3641
client.init_checker(randomize_start=True)
3588
3642
3589
3643
tcp_server.enable()
3590
3644
tcp_server.server_activate()
3593
3647
if zeroconf:
3594
3648
service.port = tcp_server.socket.getsockname()[1]
3595
3649
if use_ipv6:
3596
logger.info("Now listening on address %r, port %d,"
3597
" flowinfo %d, scope_id %d",
3598
*tcp_server.socket.getsockname())
3650
log.info("Now listening on address %r, port %d, flowinfo %d,"
3651
" scope_id %d", *tcp_server.socket.getsockname())
3599
3652
else: # IPv4
3600
logger.info("Now listening on address %r, port %d",
3601
*tcp_server.socket.getsockname())
3653
log.info("Now listening on address %r, port %d",
3654
*tcp_server.socket.getsockname())
3602
3655
3603
3656
# service.interface = tcp_server.socket.getsockname()[3]
3604
3657
3608
3661
try:
3609
3662
service.activate()
3610
3663
except dbus.exceptions.DBusException as error:
3611
logger.critical("D-Bus Exception", exc_info=error)
3664
log.critical("D-Bus Exception", exc_info=error)
3612
3665
cleanup()
3613
3666
sys.exit(1)
3614
3667
# End of Avahi example code
3619
3672
lambda *args, **kwargs: (tcp_server.handle_request
3620
3673
(*args[2:], **kwargs) or True))
3621
3674
3622
logger.debug("Starting main loop")
3675
log.debug("Starting main loop")
3623
3676
main_loop.run()
3624
3677
except AvahiError as error:
3625
logger.critical("Avahi Error", exc_info=error)
3678
log.critical("Avahi Error", exc_info=error)
3626
3679
cleanup()
3627
3680
sys.exit(1)
3628
3681
except KeyboardInterrupt:
3629
3682
if debug:
3630
3683
print("", file=sys.stderr)
3631
logger.debug("Server received KeyboardInterrupt")
3632
logger.debug("Server exiting")
3684
log.debug("Server received KeyboardInterrupt")
3685
log.debug("Server exiting")
3633
3686
# Must run before the D-Bus bus name gets deregistered
3634
3687
cleanup()
3635
3688
3636
3689
3637
def should_only_run_tests():
3690
def parse_test_args():
3691
# type: () -> argparse.Namespace
3638
3692
parser = argparse.ArgumentParser(add_help=False)
3639
parser.add_argument("--check", action='store_true')
3693
parser.add_argument("--check", action="store_true")
3694
parser.add_argument("--prefix", )
3640
3695
args, unknown_args = parser.parse_known_args()
3641
run_tests = args.check
3642
if run_tests:
3643
# Remove --check argument from sys.argv
3696
if args.check:
3697
# Remove test options from sys.argv
3644
3698
sys.argv[1:] = unknown_args
3645
return run_tests
3699
return args
3646
3700
3647
3701
# Add all tests from doctest strings
3648
3702
def load_tests(loader, tests, none):
3650
3704
tests.addTests(doctest.DocTestSuite())
3651
3705
return tests
3652
3706
3653
if __name__ == '__main__':
3707
if __name__ == "__main__":
3708
options = parse_test_args()
3654
3709
try:
3655
if should_only_run_tests():
3656
# Call using ./mandos --check [--verbose]
3657
unittest.main()
3710
if options.check:
3711
extra_test_prefix = options.prefix
3712
if extra_test_prefix is not None:
3713
if not (unittest.main(argv=[""], exit=False)
3714
.result.wasSuccessful()):
3715
sys.exit(1)
3716
class ExtraTestLoader(unittest.TestLoader):
3717
testMethodPrefix = extra_test_prefix
3718
# Call using ./scriptname --test [--verbose]
3719
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3720
else:
3721
unittest.main(argv=[""])
3658
3722
else:
3659
3723
main()
3660
3724
finally:
3661
3725
logging.shutdown()
3726
3727
# Local Variables:
3728
# run-tests:
3729
# (lambda (&optional extra)
3730
# (if (not (funcall run-tests-in-test-buffer default-directory
3731
# extra))
3732
# (funcall show-test-buffer-in-test-window)
3733
# (funcall remove-test-window)
3734
# (if extra (message "Extra tests run successfully!"))))
3735
# run-tests-in-test-buffer:
3736
# (lambda (dir &optional extra)
3737
# (with-current-buffer (get-buffer-create "*Test*")
3738
# (setq buffer-read-only nil
3739
# default-directory dir)
3740
# (erase-buffer)
3741
# (compilation-mode))
3742
# (let ((process-result
3743
# (let ((inhibit-read-only t))
3744
# (process-file-shell-command
3745
# (funcall get-command-line extra) nil "*Test*"))))
3746
# (and (numberp process-result)
3747
# (= process-result 0))))
3748
# get-command-line:
3749
# (lambda (&optional extra)
3750
# (let ((quoted-script
3751
# (shell-quote-argument (funcall get-script-name))))
3752
# (format
3753
# (concat "%s --check" (if extra " --prefix=atest" ""))
3754
# quoted-script)))
3755
# get-script-name:
3756
# (lambda ()
3757
# (if (fboundp 'file-local-name)
3758
# (file-local-name (buffer-file-name))
3759
# (or (file-remote-p (buffer-file-name) 'localname)
3760
# (buffer-file-name))))
3761
# remove-test-window:
3762
# (lambda ()
3763
# (let ((test-window (get-buffer-window "*Test*")))
3764
# (if test-window (delete-window test-window))))
3765
# show-test-buffer-in-test-window:
3766
# (lambda ()
3767
# (when (not (get-buffer-window-list "*Test*"))
3768
# (setq next-error-last-buffer (get-buffer "*Test*"))
3769
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3770
# (display-buffer-overriding-action
3771
# `((display-buffer-in-side-window) (side . ,side)
3772
# (window-height . fit-window-to-buffer)
3773
# (window-width . fit-window-to-buffer))))
3774
# (display-buffer "*Test*"))))
3775
# eval:
3776
# (progn
3777
# (let* ((run-extra-tests (lambda () (interactive)
3778
# (funcall run-tests t)))
3779
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3780
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3781
# (setq minor-mode-overriding-map-alist
3782
# (cons `(run-tests . ,outer-keymap)
3783
# minor-mode-overriding-map-alist)))
3784
# (add-hook 'after-save-hook run-tests 90 t))
3785
# End:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0