To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1299
- compare with another revision
- download diff
- download tarball
- view history from revision 1299
- Committer: Teddy Hogeborn
- Date: 2024-09-10 17:27:47 UTC
- Revision ID: teddy@recompile.se-20240910172747-lb81r7e888dwb8ak
Only use linker option --no-warn-execstack if supported
The --no-warn-execstack is new in ld(1) version 2.39; only use the
option if the linker supports it.
* Makefile: Only add "-Xlinker --no-warn-execstack" to LDFLAGS for
various programs if we can successfully run a compiler with that
linker flag.
The --no-warn-execstack is new in ld(1) version 2.39; only use the
option if the linker supports it.
* Makefile: Only add "-Xlinker --no-warn-execstack" to LDFLAGS for
various programs if we can successfully run a compiler with that
linker flag.
- files added:
- debian/mandos.maintscript
- files modified:
- DBUS-API
added
removed
mandos
1
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
2
# -*- coding: utf-8; lexical-binding: t -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
40
39
except ImportError:
41
40
pass
42
41
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
43
47
try:
44
48
import SocketServer as socketserver
45
49
except ImportError:
46
50
import socketserver
47
51
import socket
48
import argparse
49
52
import datetime
50
53
import errno
51
54
try:
52
55
import ConfigParser as configparser
53
56
except ImportError:
54
57
import configparser
55
import sys
56
58
import re
57
import os
58
59
import signal
59
60
import subprocess
60
61
import atexit
61
62
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import unittest
81
80
import random
82
81
import shlex
83
82
94
93
if sys.version_info.major == 2:
95
94
__metaclass__ = type
96
95
str = unicode
96
input = raw_input
97
97
98
98
# Add collections.abc.Callable if it does not exist
99
99
try:
143
143
if sys.version_info < (3, 2):
144
144
configparser.Configparser = configparser.SafeConfigParser
145
145
146
version = "1.8.11"
146
version = "1.8.16"
147
147
stored_state_file = "clients.pickle"
148
148
149
logger = logging.getLogger()
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
150
150
logging.captureWarnings(True) # Show warnings via the logging system
151
151
syslogger = None
152
152
189
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
190
address="/dev/log"))
191
191
syslogger.setFormatter(logging.Formatter
192
('Mandos [%(process)d]: %(levelname)s:'
193
' %(message)s'))
194
logger.addHandler(syslogger)
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
195
195
196
196
if debug:
197
197
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
199
' [%(process)d]:'
200
' %(levelname)s:'
201
' %(message)s'))
202
logger.addHandler(console)
203
logger.setLevel(level)
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
204
204
205
205
206
206
class PGPError(Exception):
224
224
except OSError as e:
225
225
if e.errno != errno.ENOENT:
226
226
raise
227
self.gnupgargs = ['--batch',
228
'--homedir', self.tempdir,
229
'--force-mdc',
230
'--quiet']
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
231
231
# Only GPG version 1 has the --no-use-agent option.
232
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
233
self.gnupgargs.append("--no-use-agent")
272
272
dir=self.tempdir) as passfile:
273
273
passfile.write(passphrase)
274
274
passfile.flush()
275
proc = subprocess.Popen([self.gpg, '--symmetric',
276
'--passphrase-file',
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
277
277
passfile.name]
278
278
+ self.gnupgargs,
279
279
stdin=subprocess.PIPE,
290
290
dir=self.tempdir) as passfile:
291
291
passfile.write(passphrase)
292
292
passfile.flush()
293
proc = subprocess.Popen([self.gpg, '--decrypt',
294
'--passphrase-file',
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
295
295
passfile.name]
296
296
+ self.gnupgargs,
297
297
stdin=subprocess.PIPE,
350
350
Attributes:
351
351
interface: integer; avahi.IF_UNSPEC or an interface index.
352
352
Used to optionally bind to the specified interface.
353
name: string; Example: 'Mandos'
354
type: string; Example: '_mandos._tcp'.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
355
355
See <https://www.iana.org/assignments/service-names-port-numbers>
356
356
port: integer; what port to announce
357
357
TXT: list of strings; TXT record for the service
394
394
def rename(self, remove=True):
395
395
"""Derived from the Avahi example code"""
396
396
if self.rename_count >= self.max_renames:
397
logger.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
400
400
raise AvahiServiceError("Too many renames")
401
401
self.name = str(
402
402
self.server.GetAlternativeServiceName(self.name))
403
403
self.rename_count += 1
404
logger.info("Changing Zeroconf service name to %r ...",
405
self.name)
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
406
406
if remove:
407
407
self.remove()
408
408
try:
410
410
except dbus.exceptions.DBusException as error:
411
411
if (error.get_dbus_name()
412
412
== "org.freedesktop.Avahi.CollisionError"):
413
logger.info("Local Zeroconf service name collision.")
413
log.info("Local Zeroconf service name collision.")
414
414
return self.rename(remove=False)
415
415
else:
416
logger.critical("D-Bus Exception", exc_info=error)
416
log.critical("D-Bus Exception", exc_info=error)
417
417
self.cleanup()
418
418
os._exit(1)
419
419
435
435
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
436
self.entry_group_state_changed_match = (
437
437
self.group.connect_to_signal(
438
'StateChanged', self.entry_group_state_changed))
439
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
441
441
self.group.AddService(
442
442
self.interface,
443
443
self.protocol,
450
450
451
451
def entry_group_state_changed(self, state, error):
452
452
"""Derived from the Avahi example code"""
453
logger.debug("Avahi entry group state change: %i", state)
453
log.debug("Avahi entry group state change: %i", state)
454
454
455
455
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
logger.debug("Zeroconf service established.")
456
log.debug("Zeroconf service established.")
457
457
elif state == avahi.ENTRY_GROUP_COLLISION:
458
logger.info("Zeroconf service name collision.")
458
log.info("Zeroconf service name collision.")
459
459
self.rename()
460
460
elif state == avahi.ENTRY_GROUP_FAILURE:
461
logger.critical("Avahi: Error in group state changed %s",
462
str(error))
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
463
463
raise AvahiGroupError("State changed: {!s}".format(error))
464
464
465
465
def cleanup(self):
475
475
476
476
def server_state_changed(self, state, error=None):
477
477
"""Derived from the Avahi example code"""
478
logger.debug("Avahi server state change: %i", state)
478
log.debug("Avahi server state change: %i", state)
479
479
bad_states = {
480
480
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
481
avahi.SERVER_REGISTERING: None,
485
485
if state in bad_states:
486
486
if bad_states[state] is not None:
487
487
if error is None:
488
logger.error(bad_states[state])
488
log.error(bad_states[state])
489
489
else:
490
logger.error(bad_states[state] + ": %r", error)
490
log.error(bad_states[state] + ": %r", error)
491
491
self.cleanup()
492
492
elif state == avahi.SERVER_RUNNING:
493
493
try:
495
495
except dbus.exceptions.DBusException as error:
496
496
if (error.get_dbus_name()
497
497
== "org.freedesktop.Avahi.CollisionError"):
498
logger.info("Local Zeroconf service name"
499
" collision.")
498
log.info("Local Zeroconf service name collision.")
500
499
return self.rename(remove=False)
501
500
else:
502
logger.critical("D-Bus Exception", exc_info=error)
501
log.critical("D-Bus Exception", exc_info=error)
503
502
self.cleanup()
504
503
os._exit(1)
505
504
else:
506
505
if error is None:
507
logger.debug("Unknown state: %r", state)
506
log.debug("Unknown state: %r", state)
508
507
else:
509
logger.debug("Unknown state: %r: %r", state, error)
508
log.debug("Unknown state: %r: %r", state, error)
510
509
511
510
def activate(self):
512
511
"""Derived from the Avahi example code"""
524
523
class AvahiServiceToSyslog(AvahiService):
525
524
def rename(self, *args, **kwargs):
526
525
"""Add the new name to the syslog messages"""
527
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
528
528
syslogger.setFormatter(logging.Formatter(
529
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
530
530
.format(self.name)))
531
531
return ret
532
532
562
562
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
563
564
564
# Types
565
class session_int(ctypes.Structure):
565
class _session_int(ctypes.Structure):
566
566
_fields_ = []
567
session_t = ctypes.POINTER(session_int)
567
session_t = ctypes.POINTER(_session_int)
568
568
569
569
class certificate_credentials_st(ctypes.Structure):
570
570
_fields_ = []
573
573
certificate_type_t = ctypes.c_int
574
574
575
575
class datum_t(ctypes.Structure):
576
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
577
('size', ctypes.c_uint)]
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
578
578
579
class openpgp_crt_int(ctypes.Structure):
579
class _openpgp_crt_int(ctypes.Structure):
580
580
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
582
582
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
583
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
584
credentials_type_t = ctypes.c_int
593
593
# gnutls.strerror()
594
594
self.code = code
595
595
if message is None and code is not None:
596
message = gnutls.strerror(code)
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
597
598
return super(gnutls.Error, self).__init__(
598
599
message, *args)
599
600
600
601
class CertificateSecurityError(Error):
601
602
pass
602
603
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
603
629
# Classes
604
class Credentials:
630
class Credentials(With_from_param):
605
631
def __init__(self):
606
self._c_object = gnutls.certificate_credentials_t()
607
gnutls.certificate_allocate_credentials(
608
ctypes.byref(self._c_object))
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
609
634
self.type = gnutls.CRD_CERTIFICATE
610
635
611
636
def __del__(self):
612
gnutls.certificate_free_credentials(self._c_object)
637
gnutls.certificate_free_credentials(self)
613
638
614
class ClientSession:
639
class ClientSession(With_from_param):
615
640
def __init__(self, socket, credentials=None):
616
self._c_object = gnutls.session_t()
641
self._as_parameter_ = gnutls.session_t()
617
642
gnutls_flags = gnutls.CLIENT
618
643
if gnutls.check_version(b"3.5.6"):
619
644
gnutls_flags |= gnutls.NO_TICKETS
620
645
if gnutls.has_rawpk:
621
646
gnutls_flags |= gnutls.ENABLE_RAWPK
622
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
647
gnutls.init(self, gnutls_flags)
623
648
del gnutls_flags
624
gnutls.set_default_priority(self._c_object)
625
gnutls.transport_set_ptr(self._c_object, socket.fileno())
626
gnutls.handshake_set_private_extensions(self._c_object,
627
True)
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
628
652
self.socket = socket
629
653
if credentials is None:
630
654
credentials = gnutls.Credentials()
631
gnutls.credentials_set(self._c_object, credentials.type,
632
ctypes.cast(credentials._c_object,
633
ctypes.c_void_p))
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
634
657
self.credentials = credentials
635
658
636
659
def __del__(self):
637
gnutls.deinit(self._c_object)
660
gnutls.deinit(self)
638
661
639
662
def handshake(self):
640
return gnutls.handshake(self._c_object)
663
return gnutls.handshake(self)
641
664
642
665
def send(self, data):
643
666
data = bytes(data)
644
667
data_len = len(data)
645
668
while data_len > 0:
646
data_len -= gnutls.record_send(self._c_object,
647
data[-data_len:],
669
data_len -= gnutls.record_send(self, data[-data_len:],
648
670
data_len)
649
671
650
672
def bye(self):
651
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
652
674
653
675
# Error handling functions
654
676
def _error_code(result):
655
677
"""A function to raise exceptions on errors, suitable
656
for the 'restype' attribute on ctypes functions"""
657
if result >= 0:
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
658
680
return result
659
681
if result == gnutls.E_NO_CERTIFICATE_FOUND:
660
682
raise gnutls.CertificateSecurityError(code=result)
661
683
raise gnutls.Error(code=result)
662
684
663
def _retry_on_error(result, func, arguments):
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
664
687
"""A function to retry on some errors, suitable
665
for the 'errcheck' attribute on ctypes functions"""
666
while result < 0:
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
667
690
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
668
691
return _error_code(result)
669
692
result = func(*arguments)
674
697
675
698
# Functions
676
699
priority_set_direct = _library.gnutls_priority_set_direct
677
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
678
701
ctypes.POINTER(ctypes.c_char_p)]
679
702
priority_set_direct.restype = _error_code
680
703
681
704
init = _library.gnutls_init
682
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
683
706
init.restype = _error_code
684
707
685
708
set_default_priority = _library.gnutls_set_default_priority
686
set_default_priority.argtypes = [session_t]
709
set_default_priority.argtypes = [ClientSession]
687
710
set_default_priority.restype = _error_code
688
711
689
712
record_send = _library.gnutls_record_send
690
record_send.argtypes = [session_t, ctypes.c_void_p,
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
691
714
ctypes.c_size_t]
692
715
record_send.restype = ctypes.c_ssize_t
693
716
record_send.errcheck = _retry_on_error
695
718
certificate_allocate_credentials = (
696
719
_library.gnutls_certificate_allocate_credentials)
697
720
certificate_allocate_credentials.argtypes = [
698
ctypes.POINTER(certificate_credentials_t)]
721
PointerTo(Credentials)]
699
722
certificate_allocate_credentials.restype = _error_code
700
723
701
724
certificate_free_credentials = (
702
725
_library.gnutls_certificate_free_credentials)
703
certificate_free_credentials.argtypes = [
704
certificate_credentials_t]
726
certificate_free_credentials.argtypes = [Credentials]
705
727
certificate_free_credentials.restype = None
706
728
707
729
handshake_set_private_extensions = (
708
730
_library.gnutls_handshake_set_private_extensions)
709
handshake_set_private_extensions.argtypes = [session_t,
731
handshake_set_private_extensions.argtypes = [ClientSession,
710
732
ctypes.c_int]
711
733
handshake_set_private_extensions.restype = None
712
734
713
735
credentials_set = _library.gnutls_credentials_set
714
credentials_set.argtypes = [session_t, credentials_type_t,
715
ctypes.c_void_p]
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
716
738
credentials_set.restype = _error_code
717
739
718
740
strerror = _library.gnutls_strerror
720
742
strerror.restype = ctypes.c_char_p
721
743
722
744
certificate_type_get = _library.gnutls_certificate_type_get
723
certificate_type_get.argtypes = [session_t]
745
certificate_type_get.argtypes = [ClientSession]
724
746
certificate_type_get.restype = _error_code
725
747
726
748
certificate_get_peers = _library.gnutls_certificate_get_peers
727
certificate_get_peers.argtypes = [session_t,
749
certificate_get_peers.argtypes = [ClientSession,
728
750
ctypes.POINTER(ctypes.c_uint)]
729
751
certificate_get_peers.restype = ctypes.POINTER(datum_t)
730
752
737
759
global_set_log_function.restype = None
738
760
739
761
deinit = _library.gnutls_deinit
740
deinit.argtypes = [session_t]
762
deinit.argtypes = [ClientSession]
741
763
deinit.restype = None
742
764
743
765
handshake = _library.gnutls_handshake
744
handshake.argtypes = [session_t]
745
handshake.restype = _error_code
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
746
768
handshake.errcheck = _retry_on_error
747
769
748
770
transport_set_ptr = _library.gnutls_transport_set_ptr
749
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
750
772
transport_set_ptr.restype = None
751
773
752
774
bye = _library.gnutls_bye
753
bye.argtypes = [session_t, close_request_t]
754
bye.restype = _error_code
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
755
777
bye.errcheck = _retry_on_error
756
778
757
779
check_version = _library.gnutls_check_version
774
796
775
797
x509_crt_fmt_t = ctypes.c_int
776
798
777
# All the function declarations below are from gnutls/abstract.h
799
# All the function declarations below are from
800
# gnutls/abstract.h
778
801
pubkey_init = _library.gnutls_pubkey_init
779
802
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
780
803
pubkey_init.restype = _error_code
794
817
pubkey_deinit.argtypes = [pubkey_t]
795
818
pubkey_deinit.restype = None
796
819
else:
797
# All the function declarations below are from gnutls/openpgp.h
820
# All the function declarations below are from
821
# gnutls/openpgp.h
798
822
799
823
openpgp_crt_init = _library.gnutls_openpgp_crt_init
800
824
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
806
830
openpgp_crt_fmt_t]
807
831
openpgp_crt_import.restype = _error_code
808
832
809
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
810
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
811
ctypes.POINTER(ctypes.c_uint)]
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
812
840
openpgp_crt_verify_self.restype = _error_code
813
841
814
842
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
825
853
826
854
if check_version(b"3.6.4"):
827
855
certificate_type_get2 = _library.gnutls_certificate_type_get2
828
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
829
857
certificate_type_get2.restype = _error_code
830
858
831
859
# Remove non-public functions
847
875
"""A representation of a client host served by this server.
848
876
849
877
Attributes:
850
approved: bool(); 'None' if not yet approved/disapproved
878
approved: bool(); None if not yet approved/disapproved
851
879
approval_delay: datetime.timedelta(); Time to wait for approval
852
880
approval_duration: datetime.timedelta(); Duration of one approval
853
881
checker: multiprocessing.Process(); a running checker process used
854
to see if the client lives. 'None' if no process is
882
to see if the client lives. None if no process is
855
883
running.
856
884
checker_callback_tag: a GLib event source tag, or None
857
885
checker_command: string; External command which is run to check
933
961
# key_id() and fingerprint() functions
934
962
client["key_id"] = (section.get("key_id", "").upper()
935
963
.replace(" ", ""))
936
client["fingerprint"] = (section["fingerprint"].upper()
964
client["fingerprint"] = (section.get("fingerprint",
965
"").upper()
937
966
.replace(" ", ""))
967
if not (client["key_id"] or client["fingerprint"]):
968
log.error("Skipping client %s without key_id or"
969
" fingerprint", client_name)
970
del settings[client_name]
971
continue
938
972
if "secret" in section:
939
973
client["secret"] = codecs.decode(section["secret"]
940
974
.encode("utf-8"),
981
1015
self.last_enabled = None
982
1016
self.expires = None
983
1017
984
logger.debug("Creating client %r", self.name)
985
logger.debug(" Key ID: %s", self.key_id)
986
logger.debug(" Fingerprint: %s", self.fingerprint)
1018
log.debug("Creating client %r", self.name)
1019
log.debug(" Key ID: %s", self.key_id)
1020
log.debug(" Fingerprint: %s", self.fingerprint)
987
1021
self.created = settings.get("created",
988
1022
datetime.datetime.utcnow())
989
1023
1017
1051
if getattr(self, "enabled", False):
1018
1052
# Already enabled
1019
1053
return
1020
self.expires = datetime.datetime.utcnow() + self.timeout
1021
1054
self.enabled = True
1022
1055
self.last_enabled = datetime.datetime.utcnow()
1023
1056
self.init_checker()
1028
1061
if not getattr(self, "enabled", False):
1029
1062
return False
1030
1063
if not quiet:
1031
logger.info("Disabling client %s", self.name)
1064
log.info("Disabling client %s", self.name)
1032
1065
if getattr(self, "disable_initiator_tag", None) is not None:
1033
1066
GLib.source_remove(self.disable_initiator_tag)
1034
1067
self.disable_initiator_tag = None
1046
1079
def __del__(self):
1047
1080
self.disable()
1048
1081
1049
def init_checker(self):
1050
# Schedule a new checker to be started an 'interval' from now,
1051
# and every interval from then on.
1082
def init_checker(self, randomize_start=False):
1083
# Schedule a new checker to be started a randomly selected
1084
# time (a fraction of 'interval') from now. This spreads out
1085
# the startup of checkers over time when the server is
1086
# started.
1052
1087
if self.checker_initiator_tag is not None:
1053
1088
GLib.source_remove(self.checker_initiator_tag)
1089
interval_milliseconds = int(self.interval.total_seconds()
1090
* 1000)
1091
if randomize_start:
1092
delay_milliseconds = random.randrange(
1093
interval_milliseconds + 1)
1094
else:
1095
delay_milliseconds = interval_milliseconds
1054
1096
self.checker_initiator_tag = GLib.timeout_add(
1055
random.randrange(int(self.interval.total_seconds() * 1000
1056
+ 1)),
1057
self.start_checker)
1058
# Schedule a disable() when 'timeout' has passed
1097
delay_milliseconds, self.start_checker, randomize_start)
1098
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1099
# A checker might take up to an 'interval' of time, so we can
1100
# expire at the soonest one interval after a checker was
1101
# started. Since the initial checker is delayed, the expire
1102
# time might have to be extended.
1103
now = datetime.datetime.utcnow()
1104
self.expires = now + delay + self.interval
1105
# Schedule a disable() at expire time
1059
1106
if self.disable_initiator_tag is not None:
1060
1107
GLib.source_remove(self.disable_initiator_tag)
1061
1108
self.disable_initiator_tag = GLib.timeout_add(
1062
int(self.timeout.total_seconds() * 1000), self.disable)
1063
# Also start a new checker *right now*.
1064
self.start_checker()
1109
int((self.expires - now).total_seconds() * 1000),
1110
self.disable)
1065
1111
1066
1112
def checker_callback(self, source, condition, connection,
1067
1113
command):
1078
1124
self.last_checker_status = returncode
1079
1125
self.last_checker_signal = None
1080
1126
if self.last_checker_status == 0:
1081
logger.info("Checker for %(name)s succeeded",
1082
vars(self))
1127
log.info("Checker for %(name)s succeeded", vars(self))
1083
1128
self.checked_ok()
1084
1129
else:
1085
logger.info("Checker for %(name)s failed", vars(self))
1130
log.info("Checker for %(name)s failed", vars(self))
1086
1131
else:
1087
1132
self.last_checker_status = -1
1088
1133
self.last_checker_signal = -returncode
1089
logger.warning("Checker for %(name)s crashed?",
1090
vars(self))
1134
log.warning("Checker for %(name)s crashed?", vars(self))
1091
1135
return False
1092
1136
1093
1137
def checked_ok(self):
1112
1156
def need_approval(self):
1113
1157
self.last_approval_request = datetime.datetime.utcnow()
1114
1158
1115
def start_checker(self):
1159
def start_checker(self, start_was_randomized=False):
1116
1160
"""Start a new checker subprocess if one is not running.
1117
1161
1118
1162
If a checker already exists, leave it running and do
1127
1171
# should be.
1128
1172
1129
1173
if self.checker is not None and not self.checker.is_alive():
1130
logger.warning("Checker was not alive; joining")
1174
log.warning("Checker was not alive; joining")
1131
1175
self.checker.join()
1132
1176
self.checker = None
1133
1177
# Start a new checker if needed
1139
1183
try:
1140
1184
command = self.checker_command % escaped_attrs
1141
1185
except TypeError as error:
1142
logger.error('Could not format string "%s"',
1143
self.checker_command,
1144
exc_info=error)
1186
log.error('Could not format string "%s"',
1187
self.checker_command, exc_info=error)
1145
1188
return True # Try again later
1146
1189
self.current_checker_command = command
1147
logger.info("Starting checker %r for %s", command,
1148
self.name)
1190
log.info("Starting checker %r for %s", command, self.name)
1149
1191
# We don't need to redirect stdout and stderr, since
1150
1192
# in normal mode, that is already done by daemon(),
1151
1193
# and in debug mode we don't want to. (Stdin is
1170
1212
GLib.IOChannel.unix_new(pipe[0].fileno()),
1171
1213
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1172
1214
self.checker_callback, pipe[0], command)
1215
if start_was_randomized:
1216
# We were started after a random delay; Schedule a new
1217
# checker to be started an 'interval' from now, and every
1218
# interval from then on.
1219
now = datetime.datetime.utcnow()
1220
self.checker_initiator_tag = GLib.timeout_add(
1221
int(self.interval.total_seconds() * 1000),
1222
self.start_checker)
1223
self.expires = max(self.expires, now + self.interval)
1224
# Don't start a new checker again after same random delay
1225
return False
1173
1226
# Re-run this periodically if run by GLib.timeout_add
1174
1227
return True
1175
1228
1180
1233
self.checker_callback_tag = None
1181
1234
if getattr(self, "checker", None) is None:
1182
1235
return
1183
logger.debug("Stopping checker for %(name)s", vars(self))
1236
log.debug("Stopping checker for %(name)s", vars(self))
1184
1237
self.checker.terminate()
1185
1238
self.checker = None
1186
1239
1213
1266
func._dbus_name = func.__name__
1214
1267
if func._dbus_name.endswith("_dbus_property"):
1215
1268
func._dbus_name = func._dbus_name[:-14]
1216
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1269
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1217
1270
return func
1218
1271
1219
1272
return decorator
1308
1361
1309
1362
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1310
1363
out_signature="s",
1311
path_keyword='object_path',
1312
connection_keyword='connection')
1364
path_keyword="object_path",
1365
connection_keyword="connection")
1313
1366
def Introspect(self, object_path, connection):
1314
1367
"""Overloading of standard D-Bus method.
1315
1368
1364
1417
document.unlink()
1365
1418
except (AttributeError, xml.dom.DOMException,
1366
1419
xml.parsers.expat.ExpatError) as error:
1367
logger.error("Failed to override Introspection method",
1368
exc_info=error)
1420
log.error("Failed to override Introspection method",
1421
exc_info=error)
1369
1422
return xmlstring
1370
1423
1371
1424
1468
1521
1469
1522
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1470
1523
out_signature="s",
1471
path_keyword='object_path',
1472
connection_keyword='connection')
1524
path_keyword="object_path",
1525
connection_keyword="connection")
1473
1526
def Introspect(self, object_path, connection):
1474
1527
"""Overloading of standard D-Bus method.
1475
1528
1531
1584
document.unlink()
1532
1585
except (AttributeError, xml.dom.DOMException,
1533
1586
xml.parsers.expat.ExpatError) as error:
1534
logger.error("Failed to override Introspection method",
1535
exc_info=error)
1587
log.error("Failed to override Introspection method",
1588
exc_info=error)
1536
1589
return xmlstring
1537
1590
1538
1591
1570
1623
1571
1624
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1572
1625
out_signature="s",
1573
path_keyword='object_path',
1574
connection_keyword='connection')
1626
path_keyword="object_path",
1627
connection_keyword="connection")
1575
1628
def Introspect(self, object_path, connection):
1576
1629
"""Overloading of standard D-Bus method.
1577
1630
1602
1655
document.unlink()
1603
1656
except (AttributeError, xml.dom.DOMException,
1604
1657
xml.parsers.expat.ExpatError) as error:
1605
logger.error("Failed to override Introspection method",
1606
exc_info=error)
1658
log.error("Failed to override Introspection method",
1659
exc_info=error)
1607
1660
return xmlstring
1608
1661
1609
1662
2243
2296
class ProxyClient:
2244
2297
def __init__(self, child_pipe, key_id, fpr, address):
2245
2298
self._pipe = child_pipe
2246
self._pipe.send(('init', key_id, fpr, address))
2299
self._pipe.send(("init", key_id, fpr, address))
2247
2300
if not self._pipe.recv():
2248
2301
raise KeyError(key_id or fpr)
2249
2302
2250
2303
def __getattribute__(self, name):
2251
if name == '_pipe':
2304
if name == "_pipe":
2252
2305
return super(ProxyClient, self).__getattribute__(name)
2253
self._pipe.send(('getattr', name))
2306
self._pipe.send(("getattr", name))
2254
2307
data = self._pipe.recv()
2255
if data[0] == 'data':
2308
if data[0] == "data":
2256
2309
return data[1]
2257
if data[0] == 'function':
2310
if data[0] == "function":
2258
2311
2259
2312
def func(*args, **kwargs):
2260
self._pipe.send(('funcall', name, args, kwargs))
2313
self._pipe.send(("funcall", name, args, kwargs))
2261
2314
return self._pipe.recv()[1]
2262
2315
2263
2316
return func
2264
2317
2265
2318
def __setattr__(self, name, value):
2266
if name == '_pipe':
2319
if name == "_pipe":
2267
2320
return super(ProxyClient, self).__setattr__(name, value)
2268
self._pipe.send(('setattr', name, value))
2321
self._pipe.send(("setattr", name, value))
2269
2322
2270
2323
2271
2324
class ClientHandler(socketserver.BaseRequestHandler, object):
2276
2329
2277
2330
def handle(self):
2278
2331
with contextlib.closing(self.server.child_pipe) as child_pipe:
2279
logger.info("TCP connection from: %s",
2280
str(self.client_address))
2281
logger.debug("Pipe FD: %d",
2282
self.server.child_pipe.fileno())
2332
log.info("TCP connection from: %s",
2333
str(self.client_address))
2334
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2283
2335
2284
2336
session = gnutls.ClientSession(self.request)
2285
2337
2286
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2338
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2287
2339
# "+AES-256-CBC", "+SHA1",
2288
2340
# "+COMP-NULL", "+CTYPE-OPENPGP",
2289
2341
# "+DHE-DSS"))
2291
2343
priority = self.server.gnutls_priority
2292
2344
if priority is None:
2293
2345
priority = "NORMAL"
2294
gnutls.priority_set_direct(session._c_object,
2295
priority.encode("utf-8"),
2296
None)
2346
gnutls.priority_set_direct(session,
2347
priority.encode("utf-8"), None)
2297
2348
2298
2349
# Start communication using the Mandos protocol
2299
2350
# Get protocol number
2300
2351
line = self.request.makefile().readline()
2301
logger.debug("Protocol version: %r", line)
2352
log.debug("Protocol version: %r", line)
2302
2353
try:
2303
2354
if int(line.strip().split()[0]) > 1:
2304
2355
raise RuntimeError(line)
2305
2356
except (ValueError, IndexError, RuntimeError) as error:
2306
logger.error("Unknown protocol version: %s", error)
2357
log.error("Unknown protocol version: %s", error)
2307
2358
return
2308
2359
2309
2360
# Start GnuTLS connection
2310
2361
try:
2311
2362
session.handshake()
2312
2363
except gnutls.Error as error:
2313
logger.warning("Handshake failed: %s", error)
2364
log.warning("Handshake failed: %s", error)
2314
2365
# Do not run session.bye() here: the session is not
2315
2366
# established. Just abandon the request.
2316
2367
return
2317
logger.debug("Handshake succeeded")
2368
log.debug("Handshake succeeded")
2318
2369
2319
2370
approval_required = False
2320
2371
try:
2324
2375
key_id = self.key_id(
2325
2376
self.peer_certificate(session))
2326
2377
except (TypeError, gnutls.Error) as error:
2327
logger.warning("Bad certificate: %s", error)
2378
log.warning("Bad certificate: %s", error)
2328
2379
return
2329
logger.debug("Key ID: %s", key_id)
2380
log.debug("Key ID: %s",
2381
key_id.decode("utf-8",
2382
errors="replace"))
2330
2383
2331
2384
else:
2332
2385
key_id = b""
2334
2387
fpr = self.fingerprint(
2335
2388
self.peer_certificate(session))
2336
2389
except (TypeError, gnutls.Error) as error:
2337
logger.warning("Bad certificate: %s", error)
2390
log.warning("Bad certificate: %s", error)
2338
2391
return
2339
logger.debug("Fingerprint: %s", fpr)
2392
log.debug("Fingerprint: %s", fpr)
2340
2393
2341
2394
try:
2342
2395
client = ProxyClient(child_pipe, key_id, fpr,
2351
2404
2352
2405
while True:
2353
2406
if not client.enabled:
2354
logger.info("Client %s is disabled",
2355
client.name)
2407
log.info("Client %s is disabled", client.name)
2356
2408
if self.server.use_dbus:
2357
2409
# Emit D-Bus signal
2358
2410
client.Rejected("Disabled")
2362
2414
# We are approved or approval is disabled
2363
2415
break
2364
2416
elif client.approved is None:
2365
logger.info("Client %s needs approval",
2366
client.name)
2417
log.info("Client %s needs approval",
2418
client.name)
2367
2419
if self.server.use_dbus:
2368
2420
# Emit D-Bus signal
2369
2421
client.NeedApproval(
2370
2422
client.approval_delay.total_seconds()
2371
2423
* 1000, client.approved_by_default)
2372
2424
else:
2373
logger.warning("Client %s was not approved",
2374
client.name)
2425
log.warning("Client %s was not approved",
2426
client.name)
2375
2427
if self.server.use_dbus:
2376
2428
# Emit D-Bus signal
2377
2429
client.Rejected("Denied")
2385
2437
time2 = datetime.datetime.now()
2386
2438
if (time2 - time) >= delay:
2387
2439
if not client.approved_by_default:
2388
logger.warning("Client %s timed out while"
2389
" waiting for approval",
2390
client.name)
2440
log.warning("Client %s timed out while"
2441
" waiting for approval",
2442
client.name)
2391
2443
if self.server.use_dbus:
2392
2444
# Emit D-Bus signal
2393
2445
client.Rejected("Approval timed out")
2400
2452
try:
2401
2453
session.send(client.secret)
2402
2454
except gnutls.Error as error:
2403
logger.warning("gnutls send failed",
2404
exc_info=error)
2455
log.warning("gnutls send failed", exc_info=error)
2405
2456
return
2406
2457
2407
logger.info("Sending secret to %s", client.name)
2458
log.info("Sending secret to %s", client.name)
2408
2459
# bump the timeout using extended_timeout
2409
2460
client.bump_timeout(client.extended_timeout)
2410
2461
if self.server.use_dbus:
2417
2468
try:
2418
2469
session.bye()
2419
2470
except gnutls.Error as error:
2420
logger.warning("GnuTLS bye failed",
2421
exc_info=error)
2471
log.warning("GnuTLS bye failed", exc_info=error)
2422
2472
2423
2473
@staticmethod
2424
2474
def peer_certificate(session):
2425
2475
"Return the peer's certificate as a bytestring"
2426
2476
try:
2427
cert_type = gnutls.certificate_type_get2(session._c_object,
2428
gnutls.CTYPE_PEERS)
2477
cert_type = gnutls.certificate_type_get2(
2478
session, gnutls.CTYPE_PEERS)
2429
2479
except AttributeError:
2430
cert_type = gnutls.certificate_type_get(session._c_object)
2480
cert_type = gnutls.certificate_type_get(session)
2431
2481
if gnutls.has_rawpk:
2432
2482
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2433
2483
else:
2434
2484
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2435
2485
# If not a valid certificate type...
2436
2486
if cert_type not in valid_cert_types:
2437
logger.info("Cert type %r not in %r", cert_type,
2438
valid_cert_types)
2487
log.info("Cert type %r not in %r", cert_type,
2488
valid_cert_types)
2439
2489
# ...return invalid data
2440
2490
return b""
2441
2491
list_size = ctypes.c_uint(1)
2442
2492
cert_list = (gnutls.certificate_get_peers
2443
(session._c_object, ctypes.byref(list_size)))
2493
(session, ctypes.byref(list_size)))
2444
2494
if not bool(cert_list) and list_size.value != 0:
2445
2495
raise gnutls.Error("error getting peer certificate")
2446
2496
if list_size.value == 0:
2468
2518
buf = ctypes.create_string_buffer(32)
2469
2519
buf_len = ctypes.c_size_t(len(buf))
2470
2520
# Get the key ID from the raw public key into the buffer
2471
gnutls.pubkey_get_key_id(pubkey,
2472
gnutls.KEYID_USE_SHA256,
2473
ctypes.cast(ctypes.byref(buf),
2474
ctypes.POINTER(ctypes.c_ubyte)),
2475
ctypes.byref(buf_len))
2521
gnutls.pubkey_get_key_id(
2522
pubkey,
2523
gnutls.KEYID_USE_SHA256,
2524
ctypes.cast(ctypes.byref(buf),
2525
ctypes.POINTER(ctypes.c_ubyte)),
2526
ctypes.byref(buf_len))
2476
2527
# Deinit the certificate
2477
2528
gnutls.pubkey_deinit(pubkey)
2478
2529
2559
2610
2560
2611
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2561
2612
socketserver.TCPServer):
2562
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2613
"""IPv6-capable TCP server. Accepts None as address and/or port
2563
2614
2564
2615
Attributes:
2565
2616
enabled: Boolean; whether this server is activated yet
2616
2667
if SO_BINDTODEVICE is None:
2617
2668
# Fall back to a hard-coded value which seems to be
2618
2669
# common enough.
2619
logger.warning("SO_BINDTODEVICE not found, trying 25")
2670
log.warning("SO_BINDTODEVICE not found, trying 25")
2620
2671
SO_BINDTODEVICE = 25
2621
2672
try:
2622
2673
self.socket.setsockopt(
2624
2675
(self.interface + "\0").encode("utf-8"))
2625
2676
except socket.error as error:
2626
2677
if error.errno == errno.EPERM:
2627
logger.error("No permission to bind to"
2628
" interface %s", self.interface)
2678
log.error("No permission to bind to interface %s",
2679
self.interface)
2629
2680
elif error.errno == errno.ENOPROTOOPT:
2630
logger.error("SO_BINDTODEVICE not available;"
2631
" cannot bind to interface %s",
2632
self.interface)
2681
log.error("SO_BINDTODEVICE not available; cannot"
2682
" bind to interface %s", self.interface)
2633
2683
elif error.errno == errno.ENODEV:
2634
logger.error("Interface %s does not exist,"
2635
" cannot bind", self.interface)
2684
log.error("Interface %s does not exist, cannot"
2685
" bind", self.interface)
2636
2686
else:
2637
2687
raise
2638
2688
# Only bind(2) the socket if we really need to.
2717
2767
request = parent_pipe.recv()
2718
2768
command = request[0]
2719
2769
2720
if command == 'init':
2770
if command == "init":
2721
2771
key_id = request[1].decode("ascii")
2722
2772
fpr = request[2].decode("ascii")
2723
2773
address = request[3]
2724
2774
2725
2775
for c in self.clients.values():
2726
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2776
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2777
"27AE41E4649B934CA495991B7852B855"):
2727
2778
continue
2728
2779
if key_id and c.key_id == key_id:
2729
2780
client = c
2732
2783
client = c
2733
2784
break
2734
2785
else:
2735
logger.info("Client not found for key ID: %s, address"
2736
": %s", key_id or fpr, address)
2786
log.info("Client not found for key ID: %s, address:"
2787
" %s", key_id or fpr, address)
2737
2788
if self.use_dbus:
2738
2789
# Emit D-Bus signal
2739
2790
mandos_dbus_service.ClientNotFound(key_id or fpr,
2752
2803
# remove the old hook in favor of the new above hook on
2753
2804
# same fileno
2754
2805
return False
2755
if command == 'funcall':
2806
if command == "funcall":
2756
2807
funcname = request[1]
2757
2808
args = request[2]
2758
2809
kwargs = request[3]
2759
2810
2760
parent_pipe.send(('data', getattr(client_object,
2811
parent_pipe.send(("data", getattr(client_object,
2761
2812
funcname)(*args,
2762
2813
**kwargs)))
2763
2814
2764
if command == 'getattr':
2815
if command == "getattr":
2765
2816
attrname = request[1]
2766
2817
if isinstance(client_object.__getattribute__(attrname),
2767
2818
collections.abc.Callable):
2768
parent_pipe.send(('function', ))
2819
parent_pipe.send(("function", ))
2769
2820
else:
2770
2821
parent_pipe.send((
2771
'data', client_object.__getattribute__(attrname)))
2822
"data", client_object.__getattribute__(attrname)))
2772
2823
2773
if command == 'setattr':
2824
if command == "setattr":
2774
2825
attrname = request[1]
2775
2826
value = request[2]
2776
2827
setattr(client_object, attrname, value)
2781
2832
def rfc3339_duration_to_delta(duration):
2782
2833
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2783
2834
2784
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2785
True
2786
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2787
True
2788
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2789
True
2790
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2791
True
2792
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2793
True
2794
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2795
True
2796
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2797
True
2835
>>> timedelta = datetime.timedelta
2836
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2837
True
2838
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2839
True
2840
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2841
True
2842
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2843
True
2844
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2845
True
2846
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2847
True
2848
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2849
True
2850
>>> del timedelta
2798
2851
"""
2799
2852
2800
2853
# Parsing an RFC 3339 duration with regular expressions is not
2880
2933
def string_to_delta(interval):
2881
2934
"""Parse a string and return a datetime.timedelta
2882
2935
2883
>>> string_to_delta('7d') == datetime.timedelta(7)
2884
True
2885
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2886
True
2887
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2888
True
2889
>>> string_to_delta('24h') == datetime.timedelta(1)
2890
True
2891
>>> string_to_delta('1w') == datetime.timedelta(7)
2892
True
2893
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2936
>>> string_to_delta("7d") == datetime.timedelta(7)
2937
True
2938
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2939
True
2940
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2941
True
2942
>>> string_to_delta("24h") == datetime.timedelta(1)
2943
True
2944
>>> string_to_delta("1w") == datetime.timedelta(7)
2945
True
2946
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2894
2947
True
2895
2948
"""
2896
2949
3100
3153
3101
3154
if server_settings["servicename"] != "Mandos":
3102
3155
syslogger.setFormatter(
3103
logging.Formatter('Mandos ({}) [%(process)d]:'
3104
' %(levelname)s: %(message)s'.format(
3156
logging.Formatter("Mandos ({}) [%(process)d]:"
3157
" %(levelname)s: %(message)s".format(
3105
3158
server_settings["servicename"])))
3106
3159
3107
3160
# Parse config file with clients
3131
3184
try:
3132
3185
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3133
3186
except IOError as e:
3134
logger.error("Could not open file %r", pidfilename,
3135
exc_info=e)
3187
log.error("Could not open file %r", pidfilename,
3188
exc_info=e)
3136
3189
3137
3190
for name, group in (("_mandos", "_mandos"),
3138
3191
("mandos", "mandos"),
3149
3202
try:
3150
3203
os.setgid(gid)
3151
3204
os.setuid(uid)
3152
if debug:
3153
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3154
gid))
3205
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3155
3206
except OSError as error:
3156
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3157
.format(uid, gid, os.strerror(error.errno)))
3207
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3208
os.strerror(error.errno))
3158
3209
if error.errno != errno.EPERM:
3159
3210
raise
3160
3211
3167
3218
3168
3219
@gnutls.log_func
3169
3220
def debug_gnutls(level, string):
3170
logger.debug("GnuTLS: %s", string[:-1])
3221
log.debug("GnuTLS: %s",
3222
string[:-1].decode("utf-8", errors="replace"))
3171
3223
3172
3224
gnutls.global_set_log_function(debug_gnutls)
3173
3225
3202
3254
"se.bsnet.fukt.Mandos", bus,
3203
3255
do_not_queue=True)
3204
3256
except dbus.exceptions.DBusException as e:
3205
logger.error("Disabling D-Bus:", exc_info=e)
3257
log.error("Disabling D-Bus:", exc_info=e)
3206
3258
use_dbus = False
3207
3259
server_settings["use_dbus"] = False
3208
3260
tcp_server.use_dbus = False
3293
3345
os.remove(stored_state_path)
3294
3346
except IOError as e:
3295
3347
if e.errno == errno.ENOENT:
3296
logger.warning("Could not load persistent state:"
3297
" {}".format(os.strerror(e.errno)))
3348
log.warning("Could not load persistent state:"
3349
" %s", os.strerror(e.errno))
3298
3350
else:
3299
logger.critical("Could not load persistent state:",
3300
exc_info=e)
3351
log.critical("Could not load persistent state:",
3352
exc_info=e)
3301
3353
raise
3302
3354
except EOFError as e:
3303
logger.warning("Could not load persistent state: "
3304
"EOFError:",
3305
exc_info=e)
3355
log.warning("Could not load persistent state: EOFError:",
3356
exc_info=e)
3306
3357
3307
3358
with PGPEngine() as pgp:
3308
3359
for client_name, client in clients_data.items():
3335
3386
if client["enabled"]:
3336
3387
if datetime.datetime.utcnow() >= client["expires"]:
3337
3388
if not client["last_checked_ok"]:
3338
logger.warning(
3339
"disabling client {} - Client never "
3340
"performed a successful checker".format(
3341
client_name))
3389
log.warning("disabling client %s - Client"
3390
" never performed a successful"
3391
" checker", client_name)
3342
3392
client["enabled"] = False
3343
3393
elif client["last_checker_status"] != 0:
3344
logger.warning(
3345
"disabling client {} - Client last"
3346
" checker failed with error code"
3347
" {}".format(
3348
client_name,
3349
client["last_checker_status"]))
3394
log.warning("disabling client %s - Client"
3395
" last checker failed with error"
3396
" code %s", client_name,
3397
client["last_checker_status"])
3350
3398
client["enabled"] = False
3351
3399
else:
3352
3400
client["expires"] = (
3353
3401
datetime.datetime.utcnow()
3354
3402
+ client["timeout"])
3355
logger.debug("Last checker succeeded,"
3356
" keeping {} enabled".format(
3357
client_name))
3403
log.debug("Last checker succeeded, keeping %s"
3404
" enabled", client_name)
3358
3405
try:
3359
3406
client["secret"] = pgp.decrypt(
3360
3407
client["encrypted_secret"],
3361
3408
client_settings[client_name]["secret"])
3362
3409
except PGPError:
3363
3410
# If decryption fails, we use secret from new settings
3364
logger.debug("Failed to decrypt {} old secret".format(
3365
client_name))
3411
log.debug("Failed to decrypt %s old secret",
3412
client_name)
3366
3413
client["secret"] = (client_settings[client_name]
3367
3414
["secret"])
3368
3415
3382
3429
server_settings=server_settings)
3383
3430
3384
3431
if not tcp_server.clients:
3385
logger.warning("No clients defined")
3432
log.warning("No clients defined")
3386
3433
3387
3434
if not foreground:
3388
3435
if pidfile is not None:
3391
3438
with pidfile:
3392
3439
print(pid, file=pidfile)
3393
3440
except IOError:
3394
logger.error("Could not write to file %r with PID %d",
3395
pidfilename, pid)
3441
log.error("Could not write to file %r with PID %d",
3442
pidfilename, pid)
3396
3443
del pidfile
3397
3444
del pidfilename
3398
3445
3548
3595
3549
3596
try:
3550
3597
with tempfile.NamedTemporaryFile(
3551
mode='wb',
3598
mode="wb",
3552
3599
suffix=".pickle",
3553
prefix='clients-',
3600
prefix="clients-",
3554
3601
dir=os.path.dirname(stored_state_path),
3555
3602
delete=False) as stored_state:
3556
3603
pickle.dump((clients, client_settings), stored_state,
3564
3611
except NameError:
3565
3612
pass
3566
3613
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3567
logger.warning("Could not save persistent state: {}"
3568
.format(os.strerror(e.errno)))
3614
log.warning("Could not save persistent state: %s",
3615
os.strerror(e.errno))
3569
3616
else:
3570
logger.warning("Could not save persistent state:",
3571
exc_info=e)
3617
log.warning("Could not save persistent state:",
3618
exc_info=e)
3572
3619
raise
3573
3620
3574
3621
# Delete all clients, and settings from config
3591
3638
mandos_dbus_service.client_added_signal(client)
3592
3639
# Need to initiate checking of clients
3593
3640
if client.enabled:
3594
client.init_checker()
3641
client.init_checker(randomize_start=True)
3595
3642
3596
3643
tcp_server.enable()
3597
3644
tcp_server.server_activate()
3600
3647
if zeroconf:
3601
3648
service.port = tcp_server.socket.getsockname()[1]
3602
3649
if use_ipv6:
3603
logger.info("Now listening on address %r, port %d,"
3604
" flowinfo %d, scope_id %d",
3605
*tcp_server.socket.getsockname())
3650
log.info("Now listening on address %r, port %d, flowinfo %d,"
3651
" scope_id %d", *tcp_server.socket.getsockname())
3606
3652
else: # IPv4
3607
logger.info("Now listening on address %r, port %d",
3608
*tcp_server.socket.getsockname())
3653
log.info("Now listening on address %r, port %d",
3654
*tcp_server.socket.getsockname())
3609
3655
3610
3656
# service.interface = tcp_server.socket.getsockname()[3]
3611
3657
3615
3661
try:
3616
3662
service.activate()
3617
3663
except dbus.exceptions.DBusException as error:
3618
logger.critical("D-Bus Exception", exc_info=error)
3664
log.critical("D-Bus Exception", exc_info=error)
3619
3665
cleanup()
3620
3666
sys.exit(1)
3621
3667
# End of Avahi example code
3626
3672
lambda *args, **kwargs: (tcp_server.handle_request
3627
3673
(*args[2:], **kwargs) or True))
3628
3674
3629
logger.debug("Starting main loop")
3675
log.debug("Starting main loop")
3630
3676
main_loop.run()
3631
3677
except AvahiError as error:
3632
logger.critical("Avahi Error", exc_info=error)
3678
log.critical("Avahi Error", exc_info=error)
3633
3679
cleanup()
3634
3680
sys.exit(1)
3635
3681
except KeyboardInterrupt:
3636
3682
if debug:
3637
3683
print("", file=sys.stderr)
3638
logger.debug("Server received KeyboardInterrupt")
3639
logger.debug("Server exiting")
3684
log.debug("Server received KeyboardInterrupt")
3685
log.debug("Server exiting")
3640
3686
# Must run before the D-Bus bus name gets deregistered
3641
3687
cleanup()
3642
3688
3643
3689
3644
def should_only_run_tests():
3690
def parse_test_args():
3691
# type: () -> argparse.Namespace
3645
3692
parser = argparse.ArgumentParser(add_help=False)
3646
parser.add_argument("--check", action='store_true')
3693
parser.add_argument("--check", action="store_true")
3694
parser.add_argument("--prefix", )
3647
3695
args, unknown_args = parser.parse_known_args()
3648
run_tests = args.check
3649
if run_tests:
3650
# Remove --check argument from sys.argv
3696
if args.check:
3697
# Remove test options from sys.argv
3651
3698
sys.argv[1:] = unknown_args
3652
return run_tests
3699
return args
3653
3700
3654
3701
# Add all tests from doctest strings
3655
3702
def load_tests(loader, tests, none):
3657
3704
tests.addTests(doctest.DocTestSuite())
3658
3705
return tests
3659
3706
3660
if __name__ == '__main__':
3707
if __name__ == "__main__":
3708
options = parse_test_args()
3661
3709
try:
3662
if should_only_run_tests():
3663
# Call using ./mandos --check [--verbose]
3664
unittest.main()
3710
if options.check:
3711
extra_test_prefix = options.prefix
3712
if extra_test_prefix is not None:
3713
if not (unittest.main(argv=[""], exit=False)
3714
.result.wasSuccessful()):
3715
sys.exit(1)
3716
class ExtraTestLoader(unittest.TestLoader):
3717
testMethodPrefix = extra_test_prefix
3718
# Call using ./scriptname --test [--verbose]
3719
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3720
else:
3721
unittest.main(argv=[""])
3665
3722
else:
3666
3723
main()
3667
3724
finally:
3668
3725
logging.shutdown()
3726
3727
# Local Variables:
3728
# run-tests:
3729
# (lambda (&optional extra)
3730
# (if (not (funcall run-tests-in-test-buffer default-directory
3731
# extra))
3732
# (funcall show-test-buffer-in-test-window)
3733
# (funcall remove-test-window)
3734
# (if extra (message "Extra tests run successfully!"))))
3735
# run-tests-in-test-buffer:
3736
# (lambda (dir &optional extra)
3737
# (with-current-buffer (get-buffer-create "*Test*")
3738
# (setq buffer-read-only nil
3739
# default-directory dir)
3740
# (erase-buffer)
3741
# (compilation-mode))
3742
# (let ((process-result
3743
# (let ((inhibit-read-only t))
3744
# (process-file-shell-command
3745
# (funcall get-command-line extra) nil "*Test*"))))
3746
# (and (numberp process-result)
3747
# (= process-result 0))))
3748
# get-command-line:
3749
# (lambda (&optional extra)
3750
# (let ((quoted-script
3751
# (shell-quote-argument (funcall get-script-name))))
3752
# (format
3753
# (concat "%s --check" (if extra " --prefix=atest" ""))
3754
# quoted-script)))
3755
# get-script-name:
3756
# (lambda ()
3757
# (if (fboundp 'file-local-name)
3758
# (file-local-name (buffer-file-name))
3759
# (or (file-remote-p (buffer-file-name) 'localname)
3760
# (buffer-file-name))))
3761
# remove-test-window:
3762
# (lambda ()
3763
# (let ((test-window (get-buffer-window "*Test*")))
3764
# (if test-window (delete-window test-window))))
3765
# show-test-buffer-in-test-window:
3766
# (lambda ()
3767
# (when (not (get-buffer-window-list "*Test*"))
3768
# (setq next-error-last-buffer (get-buffer "*Test*"))
3769
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3770
# (display-buffer-overriding-action
3771
# `((display-buffer-in-side-window) (side . ,side)
3772
# (window-height . fit-window-to-buffer)
3773
# (window-width . fit-window-to-buffer))))
3774
# (display-buffer "*Test*"))))
3775
# eval:
3776
# (progn
3777
# (let* ((run-extra-tests (lambda () (interactive)
3778
# (funcall run-tests t)))
3779
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3780
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3781
# (setq minor-mode-overriding-map-alist
3782
# (cons `(run-tests . ,outer-keymap)
3783
# minor-mode-overriding-map-alist)))
3784
# (add-hook 'after-save-hook run-tests 90 t))
3785
# End:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0