To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1296
- compare with another revision
- download diff
- download tarball
- view history from revision 1296
- Committer: Teddy Hogeborn
- Date: 2024-09-09 03:08:13 UTC
- Revision ID: teddy@recompile.se-20240909030813-hrv5jg2mlae92dq8
Update Debian Policy version to 4.7.0; no other changes necessary.
* debian/control (Standards-Version): Change to "4.7.0".
* debian/control (Standards-Version): Change to "4.7.0".
- files added:
- debian/mandos.maintscript
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -b
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
40
39
except ImportError:
41
40
pass
42
41
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
43
47
try:
44
48
import SocketServer as socketserver
45
49
except ImportError:
46
50
import socketserver
47
51
import socket
48
import argparse
49
52
import datetime
50
53
import errno
51
54
try:
52
55
import ConfigParser as configparser
53
56
except ImportError:
54
57
import configparser
55
import sys
56
58
import re
57
import os
58
59
import signal
59
60
import subprocess
60
61
import atexit
61
62
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import unittest
80
import random
81
import shlex
81
82
82
83
import dbus
83
84
import dbus.service
91
92
92
93
if sys.version_info.major == 2:
93
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
94
112
95
113
# Show warnings by default
96
114
if not sys.warnoptions:
122
140
# No value found
123
141
SO_BINDTODEVICE = None
124
142
125
if sys.version_info.major == 2:
126
str = unicode
127
128
143
if sys.version_info < (3, 2):
129
144
configparser.Configparser = configparser.SafeConfigParser
130
145
131
version = "1.8.9"
146
version = "1.8.16"
132
147
stored_state_file = "clients.pickle"
133
148
134
logger = logging.getLogger()
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
135
150
logging.captureWarnings(True) # Show warnings via the logging system
136
151
syslogger = None
137
152
174
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
175
190
address="/dev/log"))
176
191
syslogger.setFormatter(logging.Formatter
177
('Mandos [%(process)d]: %(levelname)s:'
178
' %(message)s'))
179
logger.addHandler(syslogger)
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
180
195
181
196
if debug:
182
197
console = logging.StreamHandler()
183
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
184
' [%(process)d]:'
185
' %(levelname)s:'
186
' %(message)s'))
187
logger.addHandler(console)
188
logger.setLevel(level)
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
189
204
190
205
191
206
class PGPError(Exception):
209
224
except OSError as e:
210
225
if e.errno != errno.ENOENT:
211
226
raise
212
self.gnupgargs = ['--batch',
213
'--homedir', self.tempdir,
214
'--force-mdc',
215
'--quiet']
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
216
231
# Only GPG version 1 has the --no-use-agent option.
217
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
218
233
self.gnupgargs.append("--no-use-agent")
257
272
dir=self.tempdir) as passfile:
258
273
passfile.write(passphrase)
259
274
passfile.flush()
260
proc = subprocess.Popen([self.gpg, '--symmetric',
261
'--passphrase-file',
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
262
277
passfile.name]
263
278
+ self.gnupgargs,
264
279
stdin=subprocess.PIPE,
275
290
dir=self.tempdir) as passfile:
276
291
passfile.write(passphrase)
277
292
passfile.flush()
278
proc = subprocess.Popen([self.gpg, '--decrypt',
279
'--passphrase-file',
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
280
295
passfile.name]
281
296
+ self.gnupgargs,
282
297
stdin=subprocess.PIPE,
335
350
Attributes:
336
351
interface: integer; avahi.IF_UNSPEC or an interface index.
337
352
Used to optionally bind to the specified interface.
338
name: string; Example: 'Mandos'
339
type: string; Example: '_mandos._tcp'.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
340
355
See <https://www.iana.org/assignments/service-names-port-numbers>
341
356
port: integer; what port to announce
342
357
TXT: list of strings; TXT record for the service
379
394
def rename(self, remove=True):
380
395
"""Derived from the Avahi example code"""
381
396
if self.rename_count >= self.max_renames:
382
logger.critical("No suitable Zeroconf service name found"
383
" after %i retries, exiting.",
384
self.rename_count)
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
385
400
raise AvahiServiceError("Too many renames")
386
401
self.name = str(
387
402
self.server.GetAlternativeServiceName(self.name))
388
403
self.rename_count += 1
389
logger.info("Changing Zeroconf service name to %r ...",
390
self.name)
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
391
406
if remove:
392
407
self.remove()
393
408
try:
395
410
except dbus.exceptions.DBusException as error:
396
411
if (error.get_dbus_name()
397
412
== "org.freedesktop.Avahi.CollisionError"):
398
logger.info("Local Zeroconf service name collision.")
413
log.info("Local Zeroconf service name collision.")
399
414
return self.rename(remove=False)
400
415
else:
401
logger.critical("D-Bus Exception", exc_info=error)
416
log.critical("D-Bus Exception", exc_info=error)
402
417
self.cleanup()
403
418
os._exit(1)
404
419
420
435
avahi.DBUS_INTERFACE_ENTRY_GROUP)
421
436
self.entry_group_state_changed_match = (
422
437
self.group.connect_to_signal(
423
'StateChanged', self.entry_group_state_changed))
424
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
425
self.name, self.type)
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
426
441
self.group.AddService(
427
442
self.interface,
428
443
self.protocol,
435
450
436
451
def entry_group_state_changed(self, state, error):
437
452
"""Derived from the Avahi example code"""
438
logger.debug("Avahi entry group state change: %i", state)
453
log.debug("Avahi entry group state change: %i", state)
439
454
440
455
if state == avahi.ENTRY_GROUP_ESTABLISHED:
441
logger.debug("Zeroconf service established.")
456
log.debug("Zeroconf service established.")
442
457
elif state == avahi.ENTRY_GROUP_COLLISION:
443
logger.info("Zeroconf service name collision.")
458
log.info("Zeroconf service name collision.")
444
459
self.rename()
445
460
elif state == avahi.ENTRY_GROUP_FAILURE:
446
logger.critical("Avahi: Error in group state changed %s",
447
str(error))
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
448
463
raise AvahiGroupError("State changed: {!s}".format(error))
449
464
450
465
def cleanup(self):
460
475
461
476
def server_state_changed(self, state, error=None):
462
477
"""Derived from the Avahi example code"""
463
logger.debug("Avahi server state change: %i", state)
478
log.debug("Avahi server state change: %i", state)
464
479
bad_states = {
465
480
avahi.SERVER_INVALID: "Zeroconf server invalid",
466
481
avahi.SERVER_REGISTERING: None,
470
485
if state in bad_states:
471
486
if bad_states[state] is not None:
472
487
if error is None:
473
logger.error(bad_states[state])
488
log.error(bad_states[state])
474
489
else:
475
logger.error(bad_states[state] + ": %r", error)
490
log.error(bad_states[state] + ": %r", error)
476
491
self.cleanup()
477
492
elif state == avahi.SERVER_RUNNING:
478
493
try:
480
495
except dbus.exceptions.DBusException as error:
481
496
if (error.get_dbus_name()
482
497
== "org.freedesktop.Avahi.CollisionError"):
483
logger.info("Local Zeroconf service name"
484
" collision.")
498
log.info("Local Zeroconf service name collision.")
485
499
return self.rename(remove=False)
486
500
else:
487
logger.critical("D-Bus Exception", exc_info=error)
501
log.critical("D-Bus Exception", exc_info=error)
488
502
self.cleanup()
489
503
os._exit(1)
490
504
else:
491
505
if error is None:
492
logger.debug("Unknown state: %r", state)
506
log.debug("Unknown state: %r", state)
493
507
else:
494
logger.debug("Unknown state: %r: %r", state, error)
508
log.debug("Unknown state: %r: %r", state, error)
495
509
496
510
def activate(self):
497
511
"""Derived from the Avahi example code"""
509
523
class AvahiServiceToSyslog(AvahiService):
510
524
def rename(self, *args, **kwargs):
511
525
"""Add the new name to the syslog messages"""
512
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
513
528
syslogger.setFormatter(logging.Formatter(
514
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
515
530
.format(self.name)))
516
531
return ret
517
532
547
562
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
548
563
549
564
# Types
550
class session_int(ctypes.Structure):
565
class _session_int(ctypes.Structure):
551
566
_fields_ = []
552
session_t = ctypes.POINTER(session_int)
567
session_t = ctypes.POINTER(_session_int)
553
568
554
569
class certificate_credentials_st(ctypes.Structure):
555
570
_fields_ = []
558
573
certificate_type_t = ctypes.c_int
559
574
560
575
class datum_t(ctypes.Structure):
561
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
562
('size', ctypes.c_uint)]
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
563
578
564
class openpgp_crt_int(ctypes.Structure):
579
class _openpgp_crt_int(ctypes.Structure):
565
580
_fields_ = []
566
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
567
582
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
568
583
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
569
584
credentials_type_t = ctypes.c_int
578
593
# gnutls.strerror()
579
594
self.code = code
580
595
if message is None and code is not None:
581
message = gnutls.strerror(code)
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
582
598
return super(gnutls.Error, self).__init__(
583
599
message, *args)
584
600
585
601
class CertificateSecurityError(Error):
586
602
pass
587
603
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
588
629
# Classes
589
class Credentials:
630
class Credentials(With_from_param):
590
631
def __init__(self):
591
self._c_object = gnutls.certificate_credentials_t()
592
gnutls.certificate_allocate_credentials(
593
ctypes.byref(self._c_object))
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
594
634
self.type = gnutls.CRD_CERTIFICATE
595
635
596
636
def __del__(self):
597
gnutls.certificate_free_credentials(self._c_object)
637
gnutls.certificate_free_credentials(self)
598
638
599
class ClientSession:
639
class ClientSession(With_from_param):
600
640
def __init__(self, socket, credentials=None):
601
self._c_object = gnutls.session_t()
641
self._as_parameter_ = gnutls.session_t()
602
642
gnutls_flags = gnutls.CLIENT
603
643
if gnutls.check_version(b"3.5.6"):
604
644
gnutls_flags |= gnutls.NO_TICKETS
605
645
if gnutls.has_rawpk:
606
646
gnutls_flags |= gnutls.ENABLE_RAWPK
607
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
647
gnutls.init(self, gnutls_flags)
608
648
del gnutls_flags
609
gnutls.set_default_priority(self._c_object)
610
gnutls.transport_set_ptr(self._c_object, socket.fileno())
611
gnutls.handshake_set_private_extensions(self._c_object,
612
True)
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
613
652
self.socket = socket
614
653
if credentials is None:
615
654
credentials = gnutls.Credentials()
616
gnutls.credentials_set(self._c_object, credentials.type,
617
ctypes.cast(credentials._c_object,
618
ctypes.c_void_p))
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
619
657
self.credentials = credentials
620
658
621
659
def __del__(self):
622
gnutls.deinit(self._c_object)
660
gnutls.deinit(self)
623
661
624
662
def handshake(self):
625
return gnutls.handshake(self._c_object)
663
return gnutls.handshake(self)
626
664
627
665
def send(self, data):
628
666
data = bytes(data)
629
667
data_len = len(data)
630
668
while data_len > 0:
631
data_len -= gnutls.record_send(self._c_object,
632
data[-data_len:],
669
data_len -= gnutls.record_send(self, data[-data_len:],
633
670
data_len)
634
671
635
672
def bye(self):
636
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
637
674
638
675
# Error handling functions
639
676
def _error_code(result):
640
677
"""A function to raise exceptions on errors, suitable
641
for the 'restype' attribute on ctypes functions"""
642
if result >= 0:
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
643
680
return result
644
681
if result == gnutls.E_NO_CERTIFICATE_FOUND:
645
682
raise gnutls.CertificateSecurityError(code=result)
646
683
raise gnutls.Error(code=result)
647
684
648
def _retry_on_error(result, func, arguments):
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
649
687
"""A function to retry on some errors, suitable
650
for the 'errcheck' attribute on ctypes functions"""
651
while result < 0:
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
652
690
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
653
691
return _error_code(result)
654
692
result = func(*arguments)
659
697
660
698
# Functions
661
699
priority_set_direct = _library.gnutls_priority_set_direct
662
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
663
701
ctypes.POINTER(ctypes.c_char_p)]
664
702
priority_set_direct.restype = _error_code
665
703
666
704
init = _library.gnutls_init
667
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
668
706
init.restype = _error_code
669
707
670
708
set_default_priority = _library.gnutls_set_default_priority
671
set_default_priority.argtypes = [session_t]
709
set_default_priority.argtypes = [ClientSession]
672
710
set_default_priority.restype = _error_code
673
711
674
712
record_send = _library.gnutls_record_send
675
record_send.argtypes = [session_t, ctypes.c_void_p,
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
676
714
ctypes.c_size_t]
677
715
record_send.restype = ctypes.c_ssize_t
678
716
record_send.errcheck = _retry_on_error
680
718
certificate_allocate_credentials = (
681
719
_library.gnutls_certificate_allocate_credentials)
682
720
certificate_allocate_credentials.argtypes = [
683
ctypes.POINTER(certificate_credentials_t)]
721
PointerTo(Credentials)]
684
722
certificate_allocate_credentials.restype = _error_code
685
723
686
724
certificate_free_credentials = (
687
725
_library.gnutls_certificate_free_credentials)
688
certificate_free_credentials.argtypes = [
689
certificate_credentials_t]
726
certificate_free_credentials.argtypes = [Credentials]
690
727
certificate_free_credentials.restype = None
691
728
692
729
handshake_set_private_extensions = (
693
730
_library.gnutls_handshake_set_private_extensions)
694
handshake_set_private_extensions.argtypes = [session_t,
731
handshake_set_private_extensions.argtypes = [ClientSession,
695
732
ctypes.c_int]
696
733
handshake_set_private_extensions.restype = None
697
734
698
735
credentials_set = _library.gnutls_credentials_set
699
credentials_set.argtypes = [session_t, credentials_type_t,
700
ctypes.c_void_p]
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
701
738
credentials_set.restype = _error_code
702
739
703
740
strerror = _library.gnutls_strerror
705
742
strerror.restype = ctypes.c_char_p
706
743
707
744
certificate_type_get = _library.gnutls_certificate_type_get
708
certificate_type_get.argtypes = [session_t]
745
certificate_type_get.argtypes = [ClientSession]
709
746
certificate_type_get.restype = _error_code
710
747
711
748
certificate_get_peers = _library.gnutls_certificate_get_peers
712
certificate_get_peers.argtypes = [session_t,
749
certificate_get_peers.argtypes = [ClientSession,
713
750
ctypes.POINTER(ctypes.c_uint)]
714
751
certificate_get_peers.restype = ctypes.POINTER(datum_t)
715
752
722
759
global_set_log_function.restype = None
723
760
724
761
deinit = _library.gnutls_deinit
725
deinit.argtypes = [session_t]
762
deinit.argtypes = [ClientSession]
726
763
deinit.restype = None
727
764
728
765
handshake = _library.gnutls_handshake
729
handshake.argtypes = [session_t]
730
handshake.restype = _error_code
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
731
768
handshake.errcheck = _retry_on_error
732
769
733
770
transport_set_ptr = _library.gnutls_transport_set_ptr
734
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
735
772
transport_set_ptr.restype = None
736
773
737
774
bye = _library.gnutls_bye
738
bye.argtypes = [session_t, close_request_t]
739
bye.restype = _error_code
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
740
777
bye.errcheck = _retry_on_error
741
778
742
779
check_version = _library.gnutls_check_version
759
796
760
797
x509_crt_fmt_t = ctypes.c_int
761
798
762
# All the function declarations below are from gnutls/abstract.h
799
# All the function declarations below are from
800
# gnutls/abstract.h
763
801
pubkey_init = _library.gnutls_pubkey_init
764
802
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
765
803
pubkey_init.restype = _error_code
779
817
pubkey_deinit.argtypes = [pubkey_t]
780
818
pubkey_deinit.restype = None
781
819
else:
782
# All the function declarations below are from gnutls/openpgp.h
820
# All the function declarations below are from
821
# gnutls/openpgp.h
783
822
784
823
openpgp_crt_init = _library.gnutls_openpgp_crt_init
785
824
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
791
830
openpgp_crt_fmt_t]
792
831
openpgp_crt_import.restype = _error_code
793
832
794
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
795
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
796
ctypes.POINTER(ctypes.c_uint)]
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
797
840
openpgp_crt_verify_self.restype = _error_code
798
841
799
842
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
810
853
811
854
if check_version(b"3.6.4"):
812
855
certificate_type_get2 = _library.gnutls_certificate_type_get2
813
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
814
857
certificate_type_get2.restype = _error_code
815
858
816
859
# Remove non-public functions
832
875
"""A representation of a client host served by this server.
833
876
834
877
Attributes:
835
approved: bool(); 'None' if not yet approved/disapproved
878
approved: bool(); None if not yet approved/disapproved
836
879
approval_delay: datetime.timedelta(); Time to wait for approval
837
880
approval_duration: datetime.timedelta(); Duration of one approval
838
881
checker: multiprocessing.Process(); a running checker process used
839
to see if the client lives. 'None' if no process is
882
to see if the client lives. None if no process is
840
883
running.
841
884
checker_callback_tag: a GLib event source tag, or None
842
885
checker_command: string; External command which is run to check
918
961
# key_id() and fingerprint() functions
919
962
client["key_id"] = (section.get("key_id", "").upper()
920
963
.replace(" ", ""))
921
client["fingerprint"] = (section["fingerprint"].upper()
964
client["fingerprint"] = (section.get("fingerprint",
965
"").upper()
922
966
.replace(" ", ""))
967
if not (client["key_id"] or client["fingerprint"]):
968
log.error("Skipping client %s without key_id or"
969
" fingerprint", client_name)
970
del settings[client_name]
971
continue
923
972
if "secret" in section:
924
973
client["secret"] = codecs.decode(section["secret"]
925
974
.encode("utf-8"),
966
1015
self.last_enabled = None
967
1016
self.expires = None
968
1017
969
logger.debug("Creating client %r", self.name)
970
logger.debug(" Key ID: %s", self.key_id)
971
logger.debug(" Fingerprint: %s", self.fingerprint)
1018
log.debug("Creating client %r", self.name)
1019
log.debug(" Key ID: %s", self.key_id)
1020
log.debug(" Fingerprint: %s", self.fingerprint)
972
1021
self.created = settings.get("created",
973
1022
datetime.datetime.utcnow())
974
1023
1002
1051
if getattr(self, "enabled", False):
1003
1052
# Already enabled
1004
1053
return
1005
self.expires = datetime.datetime.utcnow() + self.timeout
1006
1054
self.enabled = True
1007
1055
self.last_enabled = datetime.datetime.utcnow()
1008
1056
self.init_checker()
1013
1061
if not getattr(self, "enabled", False):
1014
1062
return False
1015
1063
if not quiet:
1016
logger.info("Disabling client %s", self.name)
1064
log.info("Disabling client %s", self.name)
1017
1065
if getattr(self, "disable_initiator_tag", None) is not None:
1018
1066
GLib.source_remove(self.disable_initiator_tag)
1019
1067
self.disable_initiator_tag = None
1031
1079
def __del__(self):
1032
1080
self.disable()
1033
1081
1034
def init_checker(self):
1035
# Schedule a new checker to be started an 'interval' from now,
1036
# and every interval from then on.
1082
def init_checker(self, randomize_start=False):
1083
# Schedule a new checker to be started a randomly selected
1084
# time (a fraction of 'interval') from now. This spreads out
1085
# the startup of checkers over time when the server is
1086
# started.
1037
1087
if self.checker_initiator_tag is not None:
1038
1088
GLib.source_remove(self.checker_initiator_tag)
1089
interval_milliseconds = int(self.interval.total_seconds()
1090
* 1000)
1091
if randomize_start:
1092
delay_milliseconds = random.randrange(
1093
interval_milliseconds + 1)
1094
else:
1095
delay_milliseconds = interval_milliseconds
1039
1096
self.checker_initiator_tag = GLib.timeout_add(
1040
int(self.interval.total_seconds() * 1000),
1041
self.start_checker)
1042
# Schedule a disable() when 'timeout' has passed
1097
delay_milliseconds, self.start_checker, randomize_start)
1098
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1099
# A checker might take up to an 'interval' of time, so we can
1100
# expire at the soonest one interval after a checker was
1101
# started. Since the initial checker is delayed, the expire
1102
# time might have to be extended.
1103
now = datetime.datetime.utcnow()
1104
self.expires = now + delay + self.interval
1105
# Schedule a disable() at expire time
1043
1106
if self.disable_initiator_tag is not None:
1044
1107
GLib.source_remove(self.disable_initiator_tag)
1045
1108
self.disable_initiator_tag = GLib.timeout_add(
1046
int(self.timeout.total_seconds() * 1000), self.disable)
1047
# Also start a new checker *right now*.
1048
self.start_checker()
1109
int((self.expires - now).total_seconds() * 1000),
1110
self.disable)
1049
1111
1050
1112
def checker_callback(self, source, condition, connection,
1051
1113
command):
1062
1124
self.last_checker_status = returncode
1063
1125
self.last_checker_signal = None
1064
1126
if self.last_checker_status == 0:
1065
logger.info("Checker for %(name)s succeeded",
1066
vars(self))
1127
log.info("Checker for %(name)s succeeded", vars(self))
1067
1128
self.checked_ok()
1068
1129
else:
1069
logger.info("Checker for %(name)s failed", vars(self))
1130
log.info("Checker for %(name)s failed", vars(self))
1070
1131
else:
1071
1132
self.last_checker_status = -1
1072
1133
self.last_checker_signal = -returncode
1073
logger.warning("Checker for %(name)s crashed?",
1074
vars(self))
1134
log.warning("Checker for %(name)s crashed?", vars(self))
1075
1135
return False
1076
1136
1077
1137
def checked_ok(self):
1096
1156
def need_approval(self):
1097
1157
self.last_approval_request = datetime.datetime.utcnow()
1098
1158
1099
def start_checker(self):
1159
def start_checker(self, start_was_randomized=False):
1100
1160
"""Start a new checker subprocess if one is not running.
1101
1161
1102
1162
If a checker already exists, leave it running and do
1111
1171
# should be.
1112
1172
1113
1173
if self.checker is not None and not self.checker.is_alive():
1114
logger.warning("Checker was not alive; joining")
1174
log.warning("Checker was not alive; joining")
1115
1175
self.checker.join()
1116
1176
self.checker = None
1117
1177
# Start a new checker if needed
1118
1178
if self.checker is None:
1119
1179
# Escape attributes for the shell
1120
1180
escaped_attrs = {
1121
attr: re.escape(str(getattr(self, attr)))
1181
attr: shlex.quote(str(getattr(self, attr)))
1122
1182
for attr in self.runtime_expansions}
1123
1183
try:
1124
1184
command = self.checker_command % escaped_attrs
1125
1185
except TypeError as error:
1126
logger.error('Could not format string "%s"',
1127
self.checker_command,
1128
exc_info=error)
1186
log.error('Could not format string "%s"',
1187
self.checker_command, exc_info=error)
1129
1188
return True # Try again later
1130
1189
self.current_checker_command = command
1131
logger.info("Starting checker %r for %s", command,
1132
self.name)
1190
log.info("Starting checker %r for %s", command, self.name)
1133
1191
# We don't need to redirect stdout and stderr, since
1134
1192
# in normal mode, that is already done by daemon(),
1135
1193
# and in debug mode we don't want to. (Stdin is
1154
1212
GLib.IOChannel.unix_new(pipe[0].fileno()),
1155
1213
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1156
1214
self.checker_callback, pipe[0], command)
1215
if start_was_randomized:
1216
# We were started after a random delay; Schedule a new
1217
# checker to be started an 'interval' from now, and every
1218
# interval from then on.
1219
now = datetime.datetime.utcnow()
1220
self.checker_initiator_tag = GLib.timeout_add(
1221
int(self.interval.total_seconds() * 1000),
1222
self.start_checker)
1223
self.expires = max(self.expires, now + self.interval)
1224
# Don't start a new checker again after same random delay
1225
return False
1157
1226
# Re-run this periodically if run by GLib.timeout_add
1158
1227
return True
1159
1228
1164
1233
self.checker_callback_tag = None
1165
1234
if getattr(self, "checker", None) is None:
1166
1235
return
1167
logger.debug("Stopping checker for %(name)s", vars(self))
1236
log.debug("Stopping checker for %(name)s", vars(self))
1168
1237
self.checker.terminate()
1169
1238
self.checker = None
1170
1239
1197
1266
func._dbus_name = func.__name__
1198
1267
if func._dbus_name.endswith("_dbus_property"):
1199
1268
func._dbus_name = func._dbus_name[:-14]
1200
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1269
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1201
1270
return func
1202
1271
1203
1272
return decorator
1292
1361
1293
1362
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1294
1363
out_signature="s",
1295
path_keyword='object_path',
1296
connection_keyword='connection')
1364
path_keyword="object_path",
1365
connection_keyword="connection")
1297
1366
def Introspect(self, object_path, connection):
1298
1367
"""Overloading of standard D-Bus method.
1299
1368
1348
1417
document.unlink()
1349
1418
except (AttributeError, xml.dom.DOMException,
1350
1419
xml.parsers.expat.ExpatError) as error:
1351
logger.error("Failed to override Introspection method",
1352
exc_info=error)
1420
log.error("Failed to override Introspection method",
1421
exc_info=error)
1353
1422
return xmlstring
1354
1423
1355
1424
1413
1482
raise ValueError("Byte arrays not supported for non-"
1414
1483
"'ay' signature {!r}"
1415
1484
.format(prop._dbus_signature))
1416
value = dbus.ByteArray(b''.join(chr(byte)
1417
for byte in value))
1485
value = dbus.ByteArray(bytes(value))
1418
1486
prop(value)
1419
1487
1420
1488
@dbus.service.method(dbus.PROPERTIES_IFACE,
1453
1521
1454
1522
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1455
1523
out_signature="s",
1456
path_keyword='object_path',
1457
connection_keyword='connection')
1524
path_keyword="object_path",
1525
connection_keyword="connection")
1458
1526
def Introspect(self, object_path, connection):
1459
1527
"""Overloading of standard D-Bus method.
1460
1528
1516
1584
document.unlink()
1517
1585
except (AttributeError, xml.dom.DOMException,
1518
1586
xml.parsers.expat.ExpatError) as error:
1519
logger.error("Failed to override Introspection method",
1520
exc_info=error)
1587
log.error("Failed to override Introspection method",
1588
exc_info=error)
1521
1589
return xmlstring
1522
1590
1523
1591
1555
1623
1556
1624
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1557
1625
out_signature="s",
1558
path_keyword='object_path',
1559
connection_keyword='connection')
1626
path_keyword="object_path",
1627
connection_keyword="connection")
1560
1628
def Introspect(self, object_path, connection):
1561
1629
"""Overloading of standard D-Bus method.
1562
1630
1587
1655
document.unlink()
1588
1656
except (AttributeError, xml.dom.DOMException,
1589
1657
xml.parsers.expat.ExpatError) as error:
1590
logger.error("Failed to override Introspection method",
1591
exc_info=error)
1658
log.error("Failed to override Introspection method",
1659
exc_info=error)
1592
1660
return xmlstring
1593
1661
1594
1662
2228
2296
class ProxyClient:
2229
2297
def __init__(self, child_pipe, key_id, fpr, address):
2230
2298
self._pipe = child_pipe
2231
self._pipe.send(('init', key_id, fpr, address))
2299
self._pipe.send(("init", key_id, fpr, address))
2232
2300
if not self._pipe.recv():
2233
2301
raise KeyError(key_id or fpr)
2234
2302
2235
2303
def __getattribute__(self, name):
2236
if name == '_pipe':
2304
if name == "_pipe":
2237
2305
return super(ProxyClient, self).__getattribute__(name)
2238
self._pipe.send(('getattr', name))
2306
self._pipe.send(("getattr", name))
2239
2307
data = self._pipe.recv()
2240
if data[0] == 'data':
2308
if data[0] == "data":
2241
2309
return data[1]
2242
if data[0] == 'function':
2310
if data[0] == "function":
2243
2311
2244
2312
def func(*args, **kwargs):
2245
self._pipe.send(('funcall', name, args, kwargs))
2313
self._pipe.send(("funcall", name, args, kwargs))
2246
2314
return self._pipe.recv()[1]
2247
2315
2248
2316
return func
2249
2317
2250
2318
def __setattr__(self, name, value):
2251
if name == '_pipe':
2319
if name == "_pipe":
2252
2320
return super(ProxyClient, self).__setattr__(name, value)
2253
self._pipe.send(('setattr', name, value))
2321
self._pipe.send(("setattr", name, value))
2254
2322
2255
2323
2256
2324
class ClientHandler(socketserver.BaseRequestHandler, object):
2261
2329
2262
2330
def handle(self):
2263
2331
with contextlib.closing(self.server.child_pipe) as child_pipe:
2264
logger.info("TCP connection from: %s",
2265
str(self.client_address))
2266
logger.debug("Pipe FD: %d",
2267
self.server.child_pipe.fileno())
2332
log.info("TCP connection from: %s",
2333
str(self.client_address))
2334
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2268
2335
2269
2336
session = gnutls.ClientSession(self.request)
2270
2337
2271
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2338
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2272
2339
# "+AES-256-CBC", "+SHA1",
2273
2340
# "+COMP-NULL", "+CTYPE-OPENPGP",
2274
2341
# "+DHE-DSS"))
2276
2343
priority = self.server.gnutls_priority
2277
2344
if priority is None:
2278
2345
priority = "NORMAL"
2279
gnutls.priority_set_direct(session._c_object,
2280
priority.encode("utf-8"),
2281
None)
2346
gnutls.priority_set_direct(session,
2347
priority.encode("utf-8"), None)
2282
2348
2283
2349
# Start communication using the Mandos protocol
2284
2350
# Get protocol number
2285
2351
line = self.request.makefile().readline()
2286
logger.debug("Protocol version: %r", line)
2352
log.debug("Protocol version: %r", line)
2287
2353
try:
2288
2354
if int(line.strip().split()[0]) > 1:
2289
2355
raise RuntimeError(line)
2290
2356
except (ValueError, IndexError, RuntimeError) as error:
2291
logger.error("Unknown protocol version: %s", error)
2357
log.error("Unknown protocol version: %s", error)
2292
2358
return
2293
2359
2294
2360
# Start GnuTLS connection
2295
2361
try:
2296
2362
session.handshake()
2297
2363
except gnutls.Error as error:
2298
logger.warning("Handshake failed: %s", error)
2364
log.warning("Handshake failed: %s", error)
2299
2365
# Do not run session.bye() here: the session is not
2300
2366
# established. Just abandon the request.
2301
2367
return
2302
logger.debug("Handshake succeeded")
2368
log.debug("Handshake succeeded")
2303
2369
2304
2370
approval_required = False
2305
2371
try:
2309
2375
key_id = self.key_id(
2310
2376
self.peer_certificate(session))
2311
2377
except (TypeError, gnutls.Error) as error:
2312
logger.warning("Bad certificate: %s", error)
2378
log.warning("Bad certificate: %s", error)
2313
2379
return
2314
logger.debug("Key ID: %s", key_id)
2380
log.debug("Key ID: %s",
2381
key_id.decode("utf-8",
2382
errors="replace"))
2315
2383
2316
2384
else:
2317
2385
key_id = b""
2319
2387
fpr = self.fingerprint(
2320
2388
self.peer_certificate(session))
2321
2389
except (TypeError, gnutls.Error) as error:
2322
logger.warning("Bad certificate: %s", error)
2390
log.warning("Bad certificate: %s", error)
2323
2391
return
2324
logger.debug("Fingerprint: %s", fpr)
2392
log.debug("Fingerprint: %s", fpr)
2325
2393
2326
2394
try:
2327
2395
client = ProxyClient(child_pipe, key_id, fpr,
2336
2404
2337
2405
while True:
2338
2406
if not client.enabled:
2339
logger.info("Client %s is disabled",
2340
client.name)
2407
log.info("Client %s is disabled", client.name)
2341
2408
if self.server.use_dbus:
2342
2409
# Emit D-Bus signal
2343
2410
client.Rejected("Disabled")
2347
2414
# We are approved or approval is disabled
2348
2415
break
2349
2416
elif client.approved is None:
2350
logger.info("Client %s needs approval",
2351
client.name)
2417
log.info("Client %s needs approval",
2418
client.name)
2352
2419
if self.server.use_dbus:
2353
2420
# Emit D-Bus signal
2354
2421
client.NeedApproval(
2355
2422
client.approval_delay.total_seconds()
2356
2423
* 1000, client.approved_by_default)
2357
2424
else:
2358
logger.warning("Client %s was not approved",
2359
client.name)
2425
log.warning("Client %s was not approved",
2426
client.name)
2360
2427
if self.server.use_dbus:
2361
2428
# Emit D-Bus signal
2362
2429
client.Rejected("Denied")
2370
2437
time2 = datetime.datetime.now()
2371
2438
if (time2 - time) >= delay:
2372
2439
if not client.approved_by_default:
2373
logger.warning("Client %s timed out while"
2374
" waiting for approval",
2375
client.name)
2440
log.warning("Client %s timed out while"
2441
" waiting for approval",
2442
client.name)
2376
2443
if self.server.use_dbus:
2377
2444
# Emit D-Bus signal
2378
2445
client.Rejected("Approval timed out")
2385
2452
try:
2386
2453
session.send(client.secret)
2387
2454
except gnutls.Error as error:
2388
logger.warning("gnutls send failed",
2389
exc_info=error)
2455
log.warning("gnutls send failed", exc_info=error)
2390
2456
return
2391
2457
2392
logger.info("Sending secret to %s", client.name)
2458
log.info("Sending secret to %s", client.name)
2393
2459
# bump the timeout using extended_timeout
2394
2460
client.bump_timeout(client.extended_timeout)
2395
2461
if self.server.use_dbus:
2402
2468
try:
2403
2469
session.bye()
2404
2470
except gnutls.Error as error:
2405
logger.warning("GnuTLS bye failed",
2406
exc_info=error)
2471
log.warning("GnuTLS bye failed", exc_info=error)
2407
2472
2408
2473
@staticmethod
2409
2474
def peer_certificate(session):
2410
2475
"Return the peer's certificate as a bytestring"
2411
2476
try:
2412
cert_type = gnutls.certificate_type_get2(session._c_object,
2413
gnutls.CTYPE_PEERS)
2477
cert_type = gnutls.certificate_type_get2(
2478
session, gnutls.CTYPE_PEERS)
2414
2479
except AttributeError:
2415
cert_type = gnutls.certificate_type_get(session._c_object)
2480
cert_type = gnutls.certificate_type_get(session)
2416
2481
if gnutls.has_rawpk:
2417
2482
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2418
2483
else:
2419
2484
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2420
2485
# If not a valid certificate type...
2421
2486
if cert_type not in valid_cert_types:
2422
logger.info("Cert type %r not in %r", cert_type,
2423
valid_cert_types)
2487
log.info("Cert type %r not in %r", cert_type,
2488
valid_cert_types)
2424
2489
# ...return invalid data
2425
2490
return b""
2426
2491
list_size = ctypes.c_uint(1)
2427
2492
cert_list = (gnutls.certificate_get_peers
2428
(session._c_object, ctypes.byref(list_size)))
2493
(session, ctypes.byref(list_size)))
2429
2494
if not bool(cert_list) and list_size.value != 0:
2430
2495
raise gnutls.Error("error getting peer certificate")
2431
2496
if list_size.value == 0:
2453
2518
buf = ctypes.create_string_buffer(32)
2454
2519
buf_len = ctypes.c_size_t(len(buf))
2455
2520
# Get the key ID from the raw public key into the buffer
2456
gnutls.pubkey_get_key_id(pubkey,
2457
gnutls.KEYID_USE_SHA256,
2458
ctypes.cast(ctypes.byref(buf),
2459
ctypes.POINTER(ctypes.c_ubyte)),
2460
ctypes.byref(buf_len))
2521
gnutls.pubkey_get_key_id(
2522
pubkey,
2523
gnutls.KEYID_USE_SHA256,
2524
ctypes.cast(ctypes.byref(buf),
2525
ctypes.POINTER(ctypes.c_ubyte)),
2526
ctypes.byref(buf_len))
2461
2527
# Deinit the certificate
2462
2528
gnutls.pubkey_deinit(pubkey)
2463
2529
2544
2610
2545
2611
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2546
2612
socketserver.TCPServer):
2547
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2613
"""IPv6-capable TCP server. Accepts None as address and/or port
2548
2614
2549
2615
Attributes:
2550
2616
enabled: Boolean; whether this server is activated yet
2601
2667
if SO_BINDTODEVICE is None:
2602
2668
# Fall back to a hard-coded value which seems to be
2603
2669
# common enough.
2604
logger.warning("SO_BINDTODEVICE not found, trying 25")
2670
log.warning("SO_BINDTODEVICE not found, trying 25")
2605
2671
SO_BINDTODEVICE = 25
2606
2672
try:
2607
2673
self.socket.setsockopt(
2609
2675
(self.interface + "\0").encode("utf-8"))
2610
2676
except socket.error as error:
2611
2677
if error.errno == errno.EPERM:
2612
logger.error("No permission to bind to"
2613
" interface %s", self.interface)
2678
log.error("No permission to bind to interface %s",
2679
self.interface)
2614
2680
elif error.errno == errno.ENOPROTOOPT:
2615
logger.error("SO_BINDTODEVICE not available;"
2616
" cannot bind to interface %s",
2617
self.interface)
2681
log.error("SO_BINDTODEVICE not available; cannot"
2682
" bind to interface %s", self.interface)
2618
2683
elif error.errno == errno.ENODEV:
2619
logger.error("Interface %s does not exist,"
2620
" cannot bind", self.interface)
2684
log.error("Interface %s does not exist, cannot"
2685
" bind", self.interface)
2621
2686
else:
2622
2687
raise
2623
2688
# Only bind(2) the socket if we really need to.
2702
2767
request = parent_pipe.recv()
2703
2768
command = request[0]
2704
2769
2705
if command == 'init':
2770
if command == "init":
2706
2771
key_id = request[1].decode("ascii")
2707
2772
fpr = request[2].decode("ascii")
2708
2773
address = request[3]
2709
2774
2710
2775
for c in self.clients.values():
2711
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2776
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2777
"27AE41E4649B934CA495991B7852B855"):
2712
2778
continue
2713
2779
if key_id and c.key_id == key_id:
2714
2780
client = c
2717
2783
client = c
2718
2784
break
2719
2785
else:
2720
logger.info("Client not found for key ID: %s, address"
2721
": %s", key_id or fpr, address)
2786
log.info("Client not found for key ID: %s, address:"
2787
" %s", key_id or fpr, address)
2722
2788
if self.use_dbus:
2723
2789
# Emit D-Bus signal
2724
2790
mandos_dbus_service.ClientNotFound(key_id or fpr,
2737
2803
# remove the old hook in favor of the new above hook on
2738
2804
# same fileno
2739
2805
return False
2740
if command == 'funcall':
2806
if command == "funcall":
2741
2807
funcname = request[1]
2742
2808
args = request[2]
2743
2809
kwargs = request[3]
2744
2810
2745
parent_pipe.send(('data', getattr(client_object,
2811
parent_pipe.send(("data", getattr(client_object,
2746
2812
funcname)(*args,
2747
2813
**kwargs)))
2748
2814
2749
if command == 'getattr':
2815
if command == "getattr":
2750
2816
attrname = request[1]
2751
2817
if isinstance(client_object.__getattribute__(attrname),
2752
collections.Callable):
2753
parent_pipe.send(('function', ))
2818
collections.abc.Callable):
2819
parent_pipe.send(("function", ))
2754
2820
else:
2755
2821
parent_pipe.send((
2756
'data', client_object.__getattribute__(attrname)))
2822
"data", client_object.__getattribute__(attrname)))
2757
2823
2758
if command == 'setattr':
2824
if command == "setattr":
2759
2825
attrname = request[1]
2760
2826
value = request[2]
2761
2827
setattr(client_object, attrname, value)
2766
2832
def rfc3339_duration_to_delta(duration):
2767
2833
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2768
2834
2769
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2770
True
2771
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2772
True
2773
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2774
True
2775
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2776
True
2777
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2778
True
2779
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2780
True
2781
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2782
True
2835
>>> timedelta = datetime.timedelta
2836
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2837
True
2838
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2839
True
2840
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2841
True
2842
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2843
True
2844
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2845
True
2846
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2847
True
2848
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2849
True
2850
>>> del timedelta
2783
2851
"""
2784
2852
2785
2853
# Parsing an RFC 3339 duration with regular expressions is not
2865
2933
def string_to_delta(interval):
2866
2934
"""Parse a string and return a datetime.timedelta
2867
2935
2868
>>> string_to_delta('7d') == datetime.timedelta(7)
2869
True
2870
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2871
True
2872
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2873
True
2874
>>> string_to_delta('24h') == datetime.timedelta(1)
2875
True
2876
>>> string_to_delta('1w') == datetime.timedelta(7)
2877
True
2878
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2936
>>> string_to_delta("7d") == datetime.timedelta(7)
2937
True
2938
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2939
True
2940
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2941
True
2942
>>> string_to_delta("24h") == datetime.timedelta(1)
2943
True
2944
>>> string_to_delta("1w") == datetime.timedelta(7)
2945
True
2946
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2879
2947
True
2880
2948
"""
2881
2949
3085
3153
3086
3154
if server_settings["servicename"] != "Mandos":
3087
3155
syslogger.setFormatter(
3088
logging.Formatter('Mandos ({}) [%(process)d]:'
3089
' %(levelname)s: %(message)s'.format(
3156
logging.Formatter("Mandos ({}) [%(process)d]:"
3157
" %(levelname)s: %(message)s".format(
3090
3158
server_settings["servicename"])))
3091
3159
3092
3160
# Parse config file with clients
3116
3184
try:
3117
3185
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3118
3186
except IOError as e:
3119
logger.error("Could not open file %r", pidfilename,
3120
exc_info=e)
3187
log.error("Could not open file %r", pidfilename,
3188
exc_info=e)
3121
3189
3122
3190
for name, group in (("_mandos", "_mandos"),
3123
3191
("mandos", "mandos"),
3134
3202
try:
3135
3203
os.setgid(gid)
3136
3204
os.setuid(uid)
3137
if debug:
3138
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3139
gid))
3205
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3140
3206
except OSError as error:
3141
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3142
.format(uid, gid, os.strerror(error.errno)))
3207
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3208
os.strerror(error.errno))
3143
3209
if error.errno != errno.EPERM:
3144
3210
raise
3145
3211
3152
3218
3153
3219
@gnutls.log_func
3154
3220
def debug_gnutls(level, string):
3155
logger.debug("GnuTLS: %s", string[:-1])
3221
log.debug("GnuTLS: %s",
3222
string[:-1].decode("utf-8", errors="replace"))
3156
3223
3157
3224
gnutls.global_set_log_function(debug_gnutls)
3158
3225
3187
3254
"se.bsnet.fukt.Mandos", bus,
3188
3255
do_not_queue=True)
3189
3256
except dbus.exceptions.DBusException as e:
3190
logger.error("Disabling D-Bus:", exc_info=e)
3257
log.error("Disabling D-Bus:", exc_info=e)
3191
3258
use_dbus = False
3192
3259
server_settings["use_dbus"] = False
3193
3260
tcp_server.use_dbus = False
3278
3345
os.remove(stored_state_path)
3279
3346
except IOError as e:
3280
3347
if e.errno == errno.ENOENT:
3281
logger.warning("Could not load persistent state:"
3282
" {}".format(os.strerror(e.errno)))
3348
log.warning("Could not load persistent state:"
3349
" %s", os.strerror(e.errno))
3283
3350
else:
3284
logger.critical("Could not load persistent state:",
3285
exc_info=e)
3351
log.critical("Could not load persistent state:",
3352
exc_info=e)
3286
3353
raise
3287
3354
except EOFError as e:
3288
logger.warning("Could not load persistent state: "
3289
"EOFError:",
3290
exc_info=e)
3355
log.warning("Could not load persistent state: EOFError:",
3356
exc_info=e)
3291
3357
3292
3358
with PGPEngine() as pgp:
3293
3359
for client_name, client in clients_data.items():
3320
3386
if client["enabled"]:
3321
3387
if datetime.datetime.utcnow() >= client["expires"]:
3322
3388
if not client["last_checked_ok"]:
3323
logger.warning(
3324
"disabling client {} - Client never "
3325
"performed a successful checker".format(
3326
client_name))
3389
log.warning("disabling client %s - Client"
3390
" never performed a successful"
3391
" checker", client_name)
3327
3392
client["enabled"] = False
3328
3393
elif client["last_checker_status"] != 0:
3329
logger.warning(
3330
"disabling client {} - Client last"
3331
" checker failed with error code"
3332
" {}".format(
3333
client_name,
3334
client["last_checker_status"]))
3394
log.warning("disabling client %s - Client"
3395
" last checker failed with error"
3396
" code %s", client_name,
3397
client["last_checker_status"])
3335
3398
client["enabled"] = False
3336
3399
else:
3337
3400
client["expires"] = (
3338
3401
datetime.datetime.utcnow()
3339
3402
+ client["timeout"])
3340
logger.debug("Last checker succeeded,"
3341
" keeping {} enabled".format(
3342
client_name))
3403
log.debug("Last checker succeeded, keeping %s"
3404
" enabled", client_name)
3343
3405
try:
3344
3406
client["secret"] = pgp.decrypt(
3345
3407
client["encrypted_secret"],
3346
3408
client_settings[client_name]["secret"])
3347
3409
except PGPError:
3348
3410
# If decryption fails, we use secret from new settings
3349
logger.debug("Failed to decrypt {} old secret".format(
3350
client_name))
3411
log.debug("Failed to decrypt %s old secret",
3412
client_name)
3351
3413
client["secret"] = (client_settings[client_name]
3352
3414
["secret"])
3353
3415
3367
3429
server_settings=server_settings)
3368
3430
3369
3431
if not tcp_server.clients:
3370
logger.warning("No clients defined")
3432
log.warning("No clients defined")
3371
3433
3372
3434
if not foreground:
3373
3435
if pidfile is not None:
3376
3438
with pidfile:
3377
3439
print(pid, file=pidfile)
3378
3440
except IOError:
3379
logger.error("Could not write to file %r with PID %d",
3380
pidfilename, pid)
3441
log.error("Could not write to file %r with PID %d",
3442
pidfilename, pid)
3381
3443
del pidfile
3382
3444
del pidfilename
3383
3445
3533
3595
3534
3596
try:
3535
3597
with tempfile.NamedTemporaryFile(
3536
mode='wb',
3598
mode="wb",
3537
3599
suffix=".pickle",
3538
prefix='clients-',
3600
prefix="clients-",
3539
3601
dir=os.path.dirname(stored_state_path),
3540
3602
delete=False) as stored_state:
3541
3603
pickle.dump((clients, client_settings), stored_state,
3549
3611
except NameError:
3550
3612
pass
3551
3613
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3552
logger.warning("Could not save persistent state: {}"
3553
.format(os.strerror(e.errno)))
3614
log.warning("Could not save persistent state: %s",
3615
os.strerror(e.errno))
3554
3616
else:
3555
logger.warning("Could not save persistent state:",
3556
exc_info=e)
3617
log.warning("Could not save persistent state:",
3618
exc_info=e)
3557
3619
raise
3558
3620
3559
3621
# Delete all clients, and settings from config
3576
3638
mandos_dbus_service.client_added_signal(client)
3577
3639
# Need to initiate checking of clients
3578
3640
if client.enabled:
3579
client.init_checker()
3641
client.init_checker(randomize_start=True)
3580
3642
3581
3643
tcp_server.enable()
3582
3644
tcp_server.server_activate()
3585
3647
if zeroconf:
3586
3648
service.port = tcp_server.socket.getsockname()[1]
3587
3649
if use_ipv6:
3588
logger.info("Now listening on address %r, port %d,"
3589
" flowinfo %d, scope_id %d",
3590
*tcp_server.socket.getsockname())
3650
log.info("Now listening on address %r, port %d, flowinfo %d,"
3651
" scope_id %d", *tcp_server.socket.getsockname())
3591
3652
else: # IPv4
3592
logger.info("Now listening on address %r, port %d",
3593
*tcp_server.socket.getsockname())
3653
log.info("Now listening on address %r, port %d",
3654
*tcp_server.socket.getsockname())
3594
3655
3595
3656
# service.interface = tcp_server.socket.getsockname()[3]
3596
3657
3600
3661
try:
3601
3662
service.activate()
3602
3663
except dbus.exceptions.DBusException as error:
3603
logger.critical("D-Bus Exception", exc_info=error)
3664
log.critical("D-Bus Exception", exc_info=error)
3604
3665
cleanup()
3605
3666
sys.exit(1)
3606
3667
# End of Avahi example code
3611
3672
lambda *args, **kwargs: (tcp_server.handle_request
3612
3673
(*args[2:], **kwargs) or True))
3613
3674
3614
logger.debug("Starting main loop")
3675
log.debug("Starting main loop")
3615
3676
main_loop.run()
3616
3677
except AvahiError as error:
3617
logger.critical("Avahi Error", exc_info=error)
3678
log.critical("Avahi Error", exc_info=error)
3618
3679
cleanup()
3619
3680
sys.exit(1)
3620
3681
except KeyboardInterrupt:
3621
3682
if debug:
3622
3683
print("", file=sys.stderr)
3623
logger.debug("Server received KeyboardInterrupt")
3624
logger.debug("Server exiting")
3684
log.debug("Server received KeyboardInterrupt")
3685
log.debug("Server exiting")
3625
3686
# Must run before the D-Bus bus name gets deregistered
3626
3687
cleanup()
3627
3688
3628
3689
3629
def should_only_run_tests():
3690
def parse_test_args():
3691
# type: () -> argparse.Namespace
3630
3692
parser = argparse.ArgumentParser(add_help=False)
3631
parser.add_argument("--check", action='store_true')
3693
parser.add_argument("--check", action="store_true")
3694
parser.add_argument("--prefix", )
3632
3695
args, unknown_args = parser.parse_known_args()
3633
run_tests = args.check
3634
if run_tests:
3635
# Remove --check argument from sys.argv
3696
if args.check:
3697
# Remove test options from sys.argv
3636
3698
sys.argv[1:] = unknown_args
3637
return run_tests
3699
return args
3638
3700
3639
3701
# Add all tests from doctest strings
3640
3702
def load_tests(loader, tests, none):
3642
3704
tests.addTests(doctest.DocTestSuite())
3643
3705
return tests
3644
3706
3645
if __name__ == '__main__':
3707
if __name__ == "__main__":
3708
options = parse_test_args()
3646
3709
try:
3647
if should_only_run_tests():
3648
# Call using ./mandos --check [--verbose]
3649
unittest.main()
3710
if options.check:
3711
extra_test_prefix = options.prefix
3712
if extra_test_prefix is not None:
3713
if not (unittest.main(argv=[""], exit=False)
3714
.result.wasSuccessful()):
3715
sys.exit(1)
3716
class ExtraTestLoader(unittest.TestLoader):
3717
testMethodPrefix = extra_test_prefix
3718
# Call using ./scriptname --test [--verbose]
3719
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3720
else:
3721
unittest.main(argv=[""])
3650
3722
else:
3651
3723
main()
3652
3724
finally:
3653
3725
logging.shutdown()
3726
3727
# Local Variables:
3728
# run-tests:
3729
# (lambda (&optional extra)
3730
# (if (not (funcall run-tests-in-test-buffer default-directory
3731
# extra))
3732
# (funcall show-test-buffer-in-test-window)
3733
# (funcall remove-test-window)
3734
# (if extra (message "Extra tests run successfully!"))))
3735
# run-tests-in-test-buffer:
3736
# (lambda (dir &optional extra)
3737
# (with-current-buffer (get-buffer-create "*Test*")
3738
# (setq buffer-read-only nil
3739
# default-directory dir)
3740
# (erase-buffer)
3741
# (compilation-mode))
3742
# (let ((process-result
3743
# (let ((inhibit-read-only t))
3744
# (process-file-shell-command
3745
# (funcall get-command-line extra) nil "*Test*"))))
3746
# (and (numberp process-result)
3747
# (= process-result 0))))
3748
# get-command-line:
3749
# (lambda (&optional extra)
3750
# (let ((quoted-script
3751
# (shell-quote-argument (funcall get-script-name))))
3752
# (format
3753
# (concat "%s --check" (if extra " --prefix=atest" ""))
3754
# quoted-script)))
3755
# get-script-name:
3756
# (lambda ()
3757
# (if (fboundp 'file-local-name)
3758
# (file-local-name (buffer-file-name))
3759
# (or (file-remote-p (buffer-file-name) 'localname)
3760
# (buffer-file-name))))
3761
# remove-test-window:
3762
# (lambda ()
3763
# (let ((test-window (get-buffer-window "*Test*")))
3764
# (if test-window (delete-window test-window))))
3765
# show-test-buffer-in-test-window:
3766
# (lambda ()
3767
# (when (not (get-buffer-window-list "*Test*"))
3768
# (setq next-error-last-buffer (get-buffer "*Test*"))
3769
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3770
# (display-buffer-overriding-action
3771
# `((display-buffer-in-side-window) (side . ,side)
3772
# (window-height . fit-window-to-buffer)
3773
# (window-width . fit-window-to-buffer))))
3774
# (display-buffer "*Test*"))))
3775
# eval:
3776
# (progn
3777
# (let* ((run-extra-tests (lambda () (interactive)
3778
# (funcall run-tests t)))
3779
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3780
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3781
# (setq minor-mode-overriding-map-alist
3782
# (cons `(run-tests . ,outer-keymap)
3783
# minor-mode-overriding-map-alist)))
3784
# (add-hook 'after-save-hook run-tests 90 t))
3785
# End:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0