To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.4.120
- compare with another revision
- download diff
- download tarball
- view history from revision 237.4.120
- Committer: Teddy Hogeborn
- Date: 2019-08-05 21:24:02 UTC
- mto: This revision was merged to the branch mainline in revision 1153.
- Revision ID: teddy@recompile.se-20190805212402-191ljwqv776i3981
Tags: version-1.8.7-1
* Makefile (version): Change to 1.8.7.
* NEWS (Version 1.8.7): Add new entry.
* debian/changelog (1.8.7-1): - '' -
* NEWS (Version 1.8.7): Add new entry.
* debian/changelog (1.8.7-1): - '' -
- files removed:
- debian/po/de.po
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
39
40
except ImportError:
40
41
pass
41
42
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
43
try:
48
44
import SocketServer as socketserver
49
45
except ImportError:
50
46
import socketserver
51
47
import socket
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
import ConfigParser as configparser
56
53
except ImportError:
57
54
import configparser
55
import sys
58
56
import re
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import random
81
import shlex
82
80
83
81
import dbus
84
82
import dbus.service
90
88
import xml.dom.minidom
91
89
import inspect
92
90
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
91
# Try to find the value of SO_BINDTODEVICE:
119
92
try:
120
93
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
140
113
# No value found
141
114
SO_BINDTODEVICE = None
142
115
116
if sys.version_info.major == 2:
117
str = unicode
118
143
119
if sys.version_info < (3, 2):
144
120
configparser.Configparser = configparser.SafeConfigParser
145
121
146
version = "1.8.15"
122
version = "1.8.7"
147
123
stored_state_file = "clients.pickle"
148
124
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
150
logging.captureWarnings(True) # Show warnings via the logging system
125
logger = logging.getLogger()
151
126
syslogger = None
152
127
153
128
try:
189
164
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
165
address="/dev/log"))
191
166
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
167
('Mandos [%(process)d]: %(levelname)s:'
168
' %(message)s'))
169
logger.addHandler(syslogger)
195
170
196
171
if debug:
197
172
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
173
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
174
' [%(process)d]:'
175
' %(levelname)s:'
176
' %(message)s'))
177
logger.addHandler(console)
178
logger.setLevel(level)
204
179
205
180
206
181
class PGPError(Exception):
208
183
pass
209
184
210
185
211
class PGPEngine:
186
class PGPEngine(object):
212
187
"""A simple class for OpenPGP symmetric encryption & decryption"""
213
188
214
189
def __init__(self):
218
193
output = subprocess.check_output(["gpgconf"])
219
194
for line in output.splitlines():
220
195
name, text, path = line.split(b":")
221
if name == b"gpg":
196
if name == "gpg":
222
197
self.gpg = path
223
198
break
224
199
except OSError as e:
225
200
if e.errno != errno.ENOENT:
226
201
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
202
self.gnupgargs = ['--batch',
203
'--homedir', self.tempdir,
204
'--force-mdc',
205
'--quiet']
231
206
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
207
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
233
208
self.gnupgargs.append("--no-use-agent")
234
209
235
210
def __enter__(self):
272
247
dir=self.tempdir) as passfile:
273
248
passfile.write(passphrase)
274
249
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
250
proc = subprocess.Popen([self.gpg, '--symmetric',
251
'--passphrase-file',
277
252
passfile.name]
278
253
+ self.gnupgargs,
279
254
stdin=subprocess.PIPE,
290
265
dir=self.tempdir) as passfile:
291
266
passfile.write(passphrase)
292
267
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
268
proc = subprocess.Popen([self.gpg, '--decrypt',
269
'--passphrase-file',
295
270
passfile.name]
296
271
+ self.gnupgargs,
297
272
stdin=subprocess.PIPE,
304
279
305
280
306
281
# Pretend that we have an Avahi module
307
class avahi:
282
class avahi(object):
308
283
"""This isn't so much a class as it is a module-like namespace."""
309
284
IF_UNSPEC = -1 # avahi-common/address.h
310
285
PROTO_UNSPEC = -1 # avahi-common/address.h
344
319
pass
345
320
346
321
347
class AvahiService:
322
class AvahiService(object):
348
323
"""An Avahi (Zeroconf) service.
349
324
350
325
Attributes:
351
326
interface: integer; avahi.IF_UNSPEC or an interface index.
352
327
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
328
name: string; Example: 'Mandos'
329
type: string; Example: '_mandos._tcp'.
355
330
See <https://www.iana.org/assignments/service-names-port-numbers>
356
331
port: integer; what port to announce
357
332
TXT: list of strings; TXT record for the service
394
369
def rename(self, remove=True):
395
370
"""Derived from the Avahi example code"""
396
371
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
372
logger.critical("No suitable Zeroconf service name found"
373
" after %i retries, exiting.",
374
self.rename_count)
400
375
raise AvahiServiceError("Too many renames")
401
376
self.name = str(
402
377
self.server.GetAlternativeServiceName(self.name))
403
378
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
379
logger.info("Changing Zeroconf service name to %r ...",
380
self.name)
406
381
if remove:
407
382
self.remove()
408
383
try:
410
385
except dbus.exceptions.DBusException as error:
411
386
if (error.get_dbus_name()
412
387
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
388
logger.info("Local Zeroconf service name collision.")
414
389
return self.rename(remove=False)
415
390
else:
416
log.critical("D-Bus Exception", exc_info=error)
391
logger.critical("D-Bus Exception", exc_info=error)
417
392
self.cleanup()
418
393
os._exit(1)
419
394
435
410
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
411
self.entry_group_state_changed_match = (
437
412
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
413
'StateChanged', self.entry_group_state_changed))
414
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
415
self.name, self.type)
441
416
self.group.AddService(
442
417
self.interface,
443
418
self.protocol,
450
425
451
426
def entry_group_state_changed(self, state, error):
452
427
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
428
logger.debug("Avahi entry group state change: %i", state)
454
429
455
430
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
431
logger.debug("Zeroconf service established.")
457
432
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
433
logger.info("Zeroconf service name collision.")
459
434
self.rename()
460
435
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
436
logger.critical("Avahi: Error in group state changed %s",
437
str(error))
463
438
raise AvahiGroupError("State changed: {!s}".format(error))
464
439
465
440
def cleanup(self):
475
450
476
451
def server_state_changed(self, state, error=None):
477
452
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
453
logger.debug("Avahi server state change: %i", state)
479
454
bad_states = {
480
455
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
456
avahi.SERVER_REGISTERING: None,
485
460
if state in bad_states:
486
461
if bad_states[state] is not None:
487
462
if error is None:
488
log.error(bad_states[state])
463
logger.error(bad_states[state])
489
464
else:
490
log.error(bad_states[state] + ": %r", error)
465
logger.error(bad_states[state] + ": %r", error)
491
466
self.cleanup()
492
467
elif state == avahi.SERVER_RUNNING:
493
468
try:
495
470
except dbus.exceptions.DBusException as error:
496
471
if (error.get_dbus_name()
497
472
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
473
logger.info("Local Zeroconf service name"
474
" collision.")
499
475
return self.rename(remove=False)
500
476
else:
501
log.critical("D-Bus Exception", exc_info=error)
477
logger.critical("D-Bus Exception", exc_info=error)
502
478
self.cleanup()
503
479
os._exit(1)
504
480
else:
505
481
if error is None:
506
log.debug("Unknown state: %r", state)
482
logger.debug("Unknown state: %r", state)
507
483
else:
508
log.debug("Unknown state: %r: %r", state, error)
484
logger.debug("Unknown state: %r: %r", state, error)
509
485
510
486
def activate(self):
511
487
"""Derived from the Avahi example code"""
523
499
class AvahiServiceToSyslog(AvahiService):
524
500
def rename(self, *args, **kwargs):
525
501
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
502
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
528
503
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
504
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
505
.format(self.name)))
531
506
return ret
532
507
533
508
534
509
# Pretend that we have a GnuTLS module
535
class gnutls:
510
class gnutls(object):
536
511
"""This isn't so much a class as it is a module-like namespace."""
537
512
538
513
library = ctypes.util.find_library("gnutls")
562
537
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
538
564
539
# Types
565
class _session_int(ctypes.Structure):
540
class session_int(ctypes.Structure):
566
541
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
542
session_t = ctypes.POINTER(session_int)
568
543
569
544
class certificate_credentials_st(ctypes.Structure):
570
545
_fields_ = []
573
548
certificate_type_t = ctypes.c_int
574
549
575
550
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
551
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
552
('size', ctypes.c_uint)]
578
553
579
class _openpgp_crt_int(ctypes.Structure):
554
class openpgp_crt_int(ctypes.Structure):
580
555
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
556
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
557
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
558
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
559
credentials_type_t = ctypes.c_int
593
568
# gnutls.strerror()
594
569
self.code = code
595
570
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
571
message = gnutls.strerror(code)
598
572
return super(gnutls.Error, self).__init__(
599
573
message, *args)
600
574
601
575
class CertificateSecurityError(Error):
602
576
pass
603
577
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
578
# Classes
630
class Credentials(With_from_param):
579
class Credentials(object):
631
580
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
581
self._c_object = gnutls.certificate_credentials_t()
582
gnutls.certificate_allocate_credentials(
583
ctypes.byref(self._c_object))
634
584
self.type = gnutls.CRD_CERTIFICATE
635
585
636
586
def __del__(self):
637
gnutls.certificate_free_credentials(self)
587
gnutls.certificate_free_credentials(self._c_object)
638
588
639
class ClientSession(With_from_param):
589
class ClientSession(object):
640
590
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
591
self._c_object = gnutls.session_t()
642
592
gnutls_flags = gnutls.CLIENT
643
593
if gnutls.check_version(b"3.5.6"):
644
594
gnutls_flags |= gnutls.NO_TICKETS
645
595
if gnutls.has_rawpk:
646
596
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
597
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
648
598
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
599
gnutls.set_default_priority(self._c_object)
600
gnutls.transport_set_ptr(self._c_object, socket.fileno())
601
gnutls.handshake_set_private_extensions(self._c_object,
602
True)
652
603
self.socket = socket
653
604
if credentials is None:
654
605
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
606
gnutls.credentials_set(self._c_object, credentials.type,
607
ctypes.cast(credentials._c_object,
608
ctypes.c_void_p))
657
609
self.credentials = credentials
658
610
659
611
def __del__(self):
660
gnutls.deinit(self)
612
gnutls.deinit(self._c_object)
661
613
662
614
def handshake(self):
663
return gnutls.handshake(self)
615
return gnutls.handshake(self._c_object)
664
616
665
617
def send(self, data):
666
618
data = bytes(data)
667
619
data_len = len(data)
668
620
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
621
data_len -= gnutls.record_send(self._c_object,
622
data[-data_len:],
670
623
data_len)
671
624
672
625
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
626
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
627
675
628
# Error handling functions
676
629
def _error_code(result):
677
630
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
631
for the 'restype' attribute on ctypes functions"""
632
if result >= 0:
680
633
return result
681
634
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
635
raise gnutls.CertificateSecurityError(code=result)
683
636
raise gnutls.Error(code=result)
684
637
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
638
def _retry_on_error(result, func, arguments):
687
639
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
640
for the 'errcheck' attribute on ctypes functions"""
641
while result < 0:
690
642
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
643
return _error_code(result)
692
644
result = func(*arguments)
697
649
698
650
# Functions
699
651
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
652
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
653
ctypes.POINTER(ctypes.c_char_p)]
702
654
priority_set_direct.restype = _error_code
703
655
704
656
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
657
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
658
init.restype = _error_code
707
659
708
660
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
661
set_default_priority.argtypes = [session_t]
710
662
set_default_priority.restype = _error_code
711
663
712
664
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
665
record_send.argtypes = [session_t, ctypes.c_void_p,
714
666
ctypes.c_size_t]
715
667
record_send.restype = ctypes.c_ssize_t
716
668
record_send.errcheck = _retry_on_error
718
670
certificate_allocate_credentials = (
719
671
_library.gnutls_certificate_allocate_credentials)
720
672
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
673
ctypes.POINTER(certificate_credentials_t)]
722
674
certificate_allocate_credentials.restype = _error_code
723
675
724
676
certificate_free_credentials = (
725
677
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
678
certificate_free_credentials.argtypes = [
679
certificate_credentials_t]
727
680
certificate_free_credentials.restype = None
728
681
729
682
handshake_set_private_extensions = (
730
683
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
684
handshake_set_private_extensions.argtypes = [session_t,
732
685
ctypes.c_int]
733
686
handshake_set_private_extensions.restype = None
734
687
735
688
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
689
credentials_set.argtypes = [session_t, credentials_type_t,
690
ctypes.c_void_p]
738
691
credentials_set.restype = _error_code
739
692
740
693
strerror = _library.gnutls_strerror
742
695
strerror.restype = ctypes.c_char_p
743
696
744
697
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
698
certificate_type_get.argtypes = [session_t]
746
699
certificate_type_get.restype = _error_code
747
700
748
701
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
702
certificate_get_peers.argtypes = [session_t,
750
703
ctypes.POINTER(ctypes.c_uint)]
751
704
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
705
759
712
global_set_log_function.restype = None
760
713
761
714
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
715
deinit.argtypes = [session_t]
763
716
deinit.restype = None
764
717
765
718
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
719
handshake.argtypes = [session_t]
720
handshake.restype = _error_code
768
721
handshake.errcheck = _retry_on_error
769
722
770
723
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
724
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
725
transport_set_ptr.restype = None
773
726
774
727
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
728
bye.argtypes = [session_t, close_request_t]
729
bye.restype = _error_code
777
730
bye.errcheck = _retry_on_error
778
731
779
732
check_version = _library.gnutls_check_version
796
749
797
750
x509_crt_fmt_t = ctypes.c_int
798
751
799
# All the function declarations below are from
800
# gnutls/abstract.h
752
# All the function declarations below are from gnutls/abstract.h
801
753
pubkey_init = _library.gnutls_pubkey_init
802
754
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
755
pubkey_init.restype = _error_code
817
769
pubkey_deinit.argtypes = [pubkey_t]
818
770
pubkey_deinit.restype = None
819
771
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
772
# All the function declarations below are from gnutls/openpgp.h
822
773
823
774
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
775
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
830
781
openpgp_crt_fmt_t]
831
782
openpgp_crt_import.restype = _error_code
832
783
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
784
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
785
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
786
ctypes.POINTER(ctypes.c_uint)]
840
787
openpgp_crt_verify_self.restype = _error_code
841
788
842
789
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
853
800
854
801
if check_version(b"3.6.4"):
855
802
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
803
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
857
804
certificate_type_get2.restype = _error_code
858
805
859
806
# Remove non-public functions
871
818
connection.close()
872
819
873
820
874
class Client:
821
class Client(object):
875
822
"""A representation of a client host served by this server.
876
823
877
824
Attributes:
878
approved: bool(); None if not yet approved/disapproved
825
approved: bool(); 'None' if not yet approved/disapproved
879
826
approval_delay: datetime.timedelta(); Time to wait for approval
880
827
approval_duration: datetime.timedelta(); Duration of one approval
881
828
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
829
to see if the client lives. 'None' if no process is
883
830
running.
884
831
checker_callback_tag: a GLib event source tag, or None
885
832
checker_command: string; External command which is run to check
1009
956
self.last_enabled = None
1010
957
self.expires = None
1011
958
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
959
logger.debug("Creating client %r", self.name)
960
logger.debug(" Key ID: %s", self.key_id)
961
logger.debug(" Fingerprint: %s", self.fingerprint)
1015
962
self.created = settings.get("created",
1016
963
datetime.datetime.utcnow())
1017
964
1056
1003
if not getattr(self, "enabled", False):
1057
1004
return False
1058
1005
if not quiet:
1059
log.info("Disabling client %s", self.name)
1006
logger.info("Disabling client %s", self.name)
1060
1007
if getattr(self, "disable_initiator_tag", None) is not None:
1061
1008
GLib.source_remove(self.disable_initiator_tag)
1062
1009
self.disable_initiator_tag = None
1080
1027
if self.checker_initiator_tag is not None:
1081
1028
GLib.source_remove(self.checker_initiator_tag)
1082
1029
self.checker_initiator_tag = GLib.timeout_add(
1083
random.randrange(int(self.interval.total_seconds() * 1000
1084
+ 1)),
1030
int(self.interval.total_seconds() * 1000),
1085
1031
self.start_checker)
1086
1032
# Schedule a disable() when 'timeout' has passed
1087
1033
if self.disable_initiator_tag is not None:
1097
1043
# Read return code from connection (see call_pipe)
1098
1044
returncode = connection.recv()
1099
1045
connection.close()
1100
if self.checker is not None:
1101
self.checker.join()
1046
self.checker.join()
1102
1047
self.checker_callback_tag = None
1103
1048
self.checker = None
1104
1049
1106
1051
self.last_checker_status = returncode
1107
1052
self.last_checker_signal = None
1108
1053
if self.last_checker_status == 0:
1109
log.info("Checker for %(name)s succeeded", vars(self))
1054
logger.info("Checker for %(name)s succeeded",
1055
vars(self))
1110
1056
self.checked_ok()
1111
1057
else:
1112
log.info("Checker for %(name)s failed", vars(self))
1058
logger.info("Checker for %(name)s failed", vars(self))
1113
1059
else:
1114
1060
self.last_checker_status = -1
1115
1061
self.last_checker_signal = -returncode
1116
log.warning("Checker for %(name)s crashed?", vars(self))
1062
logger.warning("Checker for %(name)s crashed?",
1063
vars(self))
1117
1064
return False
1118
1065
1119
1066
def checked_ok(self):
1153
1100
# should be.
1154
1101
1155
1102
if self.checker is not None and not self.checker.is_alive():
1156
log.warning("Checker was not alive; joining")
1103
logger.warning("Checker was not alive; joining")
1157
1104
self.checker.join()
1158
1105
self.checker = None
1159
1106
# Start a new checker if needed
1160
1107
if self.checker is None:
1161
1108
# Escape attributes for the shell
1162
1109
escaped_attrs = {
1163
attr: shlex.quote(str(getattr(self, attr)))
1110
attr: re.escape(str(getattr(self, attr)))
1164
1111
for attr in self.runtime_expansions}
1165
1112
try:
1166
1113
command = self.checker_command % escaped_attrs
1167
1114
except TypeError as error:
1168
log.error('Could not format string "%s"',
1169
self.checker_command, exc_info=error)
1115
logger.error('Could not format string "%s"',
1116
self.checker_command,
1117
exc_info=error)
1170
1118
return True # Try again later
1171
1119
self.current_checker_command = command
1172
log.info("Starting checker %r for %s", command, self.name)
1120
logger.info("Starting checker %r for %s", command,
1121
self.name)
1173
1122
# We don't need to redirect stdout and stderr, since
1174
1123
# in normal mode, that is already done by daemon(),
1175
1124
# and in debug mode we don't want to. (Stdin is
1191
1140
kwargs=popen_args)
1192
1141
self.checker.start()
1193
1142
self.checker_callback_tag = GLib.io_add_watch(
1194
GLib.IOChannel.unix_new(pipe[0].fileno()),
1195
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1143
pipe[0].fileno(), GLib.IO_IN,
1196
1144
self.checker_callback, pipe[0], command)
1197
1145
# Re-run this periodically if run by GLib.timeout_add
1198
1146
return True
1204
1152
self.checker_callback_tag = None
1205
1153
if getattr(self, "checker", None) is None:
1206
1154
return
1207
log.debug("Stopping checker for %(name)s", vars(self))
1155
logger.debug("Stopping checker for %(name)s", vars(self))
1208
1156
self.checker.terminate()
1209
1157
self.checker = None
1210
1158
1237
1185
func._dbus_name = func.__name__
1238
1186
if func._dbus_name.endswith("_dbus_property"):
1239
1187
func._dbus_name = func._dbus_name[:-14]
1240
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1188
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1241
1189
return func
1242
1190
1243
1191
return decorator
1332
1280
1333
1281
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1334
1282
out_signature="s",
1335
path_keyword="object_path",
1336
connection_keyword="connection")
1283
path_keyword='object_path',
1284
connection_keyword='connection')
1337
1285
def Introspect(self, object_path, connection):
1338
1286
"""Overloading of standard D-Bus method.
1339
1287
1388
1336
document.unlink()
1389
1337
except (AttributeError, xml.dom.DOMException,
1390
1338
xml.parsers.expat.ExpatError) as error:
1391
log.error("Failed to override Introspection method",
1392
exc_info=error)
1339
logger.error("Failed to override Introspection method",
1340
exc_info=error)
1393
1341
return xmlstring
1394
1342
1395
1343
1453
1401
raise ValueError("Byte arrays not supported for non-"
1454
1402
"'ay' signature {!r}"
1455
1403
.format(prop._dbus_signature))
1456
value = dbus.ByteArray(bytes(value))
1404
value = dbus.ByteArray(b''.join(chr(byte)
1405
for byte in value))
1457
1406
prop(value)
1458
1407
1459
1408
@dbus.service.method(dbus.PROPERTIES_IFACE,
1492
1441
1493
1442
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1494
1443
out_signature="s",
1495
path_keyword="object_path",
1496
connection_keyword="connection")
1444
path_keyword='object_path',
1445
connection_keyword='connection')
1497
1446
def Introspect(self, object_path, connection):
1498
1447
"""Overloading of standard D-Bus method.
1499
1448
1555
1504
document.unlink()
1556
1505
except (AttributeError, xml.dom.DOMException,
1557
1506
xml.parsers.expat.ExpatError) as error:
1558
log.error("Failed to override Introspection method",
1559
exc_info=error)
1507
logger.error("Failed to override Introspection method",
1508
exc_info=error)
1560
1509
return xmlstring
1561
1510
1562
1511
1594
1543
1595
1544
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1596
1545
out_signature="s",
1597
path_keyword="object_path",
1598
connection_keyword="connection")
1546
path_keyword='object_path',
1547
connection_keyword='connection')
1599
1548
def Introspect(self, object_path, connection):
1600
1549
"""Overloading of standard D-Bus method.
1601
1550
1626
1575
document.unlink()
1627
1576
except (AttributeError, xml.dom.DOMException,
1628
1577
xml.parsers.expat.ExpatError) as error:
1629
log.error("Failed to override Introspection method",
1630
exc_info=error)
1578
logger.error("Failed to override Introspection method",
1579
exc_info=error)
1631
1580
return xmlstring
1632
1581
1633
1582
2264
2213
del _interface
2265
2214
2266
2215
2267
class ProxyClient:
2216
class ProxyClient(object):
2268
2217
def __init__(self, child_pipe, key_id, fpr, address):
2269
2218
self._pipe = child_pipe
2270
self._pipe.send(("init", key_id, fpr, address))
2219
self._pipe.send(('init', key_id, fpr, address))
2271
2220
if not self._pipe.recv():
2272
2221
raise KeyError(key_id or fpr)
2273
2222
2274
2223
def __getattribute__(self, name):
2275
if name == "_pipe":
2224
if name == '_pipe':
2276
2225
return super(ProxyClient, self).__getattribute__(name)
2277
self._pipe.send(("getattr", name))
2226
self._pipe.send(('getattr', name))
2278
2227
data = self._pipe.recv()
2279
if data[0] == "data":
2228
if data[0] == 'data':
2280
2229
return data[1]
2281
if data[0] == "function":
2230
if data[0] == 'function':
2282
2231
2283
2232
def func(*args, **kwargs):
2284
self._pipe.send(("funcall", name, args, kwargs))
2233
self._pipe.send(('funcall', name, args, kwargs))
2285
2234
return self._pipe.recv()[1]
2286
2235
2287
2236
return func
2288
2237
2289
2238
def __setattr__(self, name, value):
2290
if name == "_pipe":
2239
if name == '_pipe':
2291
2240
return super(ProxyClient, self).__setattr__(name, value)
2292
self._pipe.send(("setattr", name, value))
2241
self._pipe.send(('setattr', name, value))
2293
2242
2294
2243
2295
2244
class ClientHandler(socketserver.BaseRequestHandler, object):
2300
2249
2301
2250
def handle(self):
2302
2251
with contextlib.closing(self.server.child_pipe) as child_pipe:
2303
log.info("TCP connection from: %s",
2304
str(self.client_address))
2305
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2252
logger.info("TCP connection from: %s",
2253
str(self.client_address))
2254
logger.debug("Pipe FD: %d",
2255
self.server.child_pipe.fileno())
2306
2256
2307
2257
session = gnutls.ClientSession(self.request)
2308
2258
2309
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2259
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2310
2260
# "+AES-256-CBC", "+SHA1",
2311
2261
# "+COMP-NULL", "+CTYPE-OPENPGP",
2312
2262
# "+DHE-DSS"))
2314
2264
priority = self.server.gnutls_priority
2315
2265
if priority is None:
2316
2266
priority = "NORMAL"
2317
gnutls.priority_set_direct(session,
2318
priority.encode("utf-8"), None)
2267
gnutls.priority_set_direct(session._c_object,
2268
priority.encode("utf-8"),
2269
None)
2319
2270
2320
2271
# Start communication using the Mandos protocol
2321
2272
# Get protocol number
2322
2273
line = self.request.makefile().readline()
2323
log.debug("Protocol version: %r", line)
2274
logger.debug("Protocol version: %r", line)
2324
2275
try:
2325
2276
if int(line.strip().split()[0]) > 1:
2326
2277
raise RuntimeError(line)
2327
2278
except (ValueError, IndexError, RuntimeError) as error:
2328
log.error("Unknown protocol version: %s", error)
2279
logger.error("Unknown protocol version: %s", error)
2329
2280
return
2330
2281
2331
2282
# Start GnuTLS connection
2332
2283
try:
2333
2284
session.handshake()
2334
2285
except gnutls.Error as error:
2335
log.warning("Handshake failed: %s", error)
2286
logger.warning("Handshake failed: %s", error)
2336
2287
# Do not run session.bye() here: the session is not
2337
2288
# established. Just abandon the request.
2338
2289
return
2339
log.debug("Handshake succeeded")
2290
logger.debug("Handshake succeeded")
2340
2291
2341
2292
approval_required = False
2342
2293
try:
2346
2297
key_id = self.key_id(
2347
2298
self.peer_certificate(session))
2348
2299
except (TypeError, gnutls.Error) as error:
2349
log.warning("Bad certificate: %s", error)
2300
logger.warning("Bad certificate: %s", error)
2350
2301
return
2351
log.debug("Key ID: %s",
2352
key_id.decode("utf-8",
2353
errors="replace"))
2302
logger.debug("Key ID: %s", key_id)
2354
2303
2355
2304
else:
2356
2305
key_id = b""
2358
2307
fpr = self.fingerprint(
2359
2308
self.peer_certificate(session))
2360
2309
except (TypeError, gnutls.Error) as error:
2361
log.warning("Bad certificate: %s", error)
2310
logger.warning("Bad certificate: %s", error)
2362
2311
return
2363
log.debug("Fingerprint: %s", fpr)
2312
logger.debug("Fingerprint: %s", fpr)
2364
2313
2365
2314
try:
2366
2315
client = ProxyClient(child_pipe, key_id, fpr,
2375
2324
2376
2325
while True:
2377
2326
if not client.enabled:
2378
log.info("Client %s is disabled", client.name)
2327
logger.info("Client %s is disabled",
2328
client.name)
2379
2329
if self.server.use_dbus:
2380
2330
# Emit D-Bus signal
2381
2331
client.Rejected("Disabled")
2385
2335
# We are approved or approval is disabled
2386
2336
break
2387
2337
elif client.approved is None:
2388
log.info("Client %s needs approval",
2389
client.name)
2338
logger.info("Client %s needs approval",
2339
client.name)
2390
2340
if self.server.use_dbus:
2391
2341
# Emit D-Bus signal
2392
2342
client.NeedApproval(
2393
2343
client.approval_delay.total_seconds()
2394
2344
* 1000, client.approved_by_default)
2395
2345
else:
2396
log.warning("Client %s was not approved",
2397
client.name)
2346
logger.warning("Client %s was not approved",
2347
client.name)
2398
2348
if self.server.use_dbus:
2399
2349
# Emit D-Bus signal
2400
2350
client.Rejected("Denied")
2408
2358
time2 = datetime.datetime.now()
2409
2359
if (time2 - time) >= delay:
2410
2360
if not client.approved_by_default:
2411
log.warning("Client %s timed out while"
2412
" waiting for approval",
2413
client.name)
2361
logger.warning("Client %s timed out while"
2362
" waiting for approval",
2363
client.name)
2414
2364
if self.server.use_dbus:
2415
2365
# Emit D-Bus signal
2416
2366
client.Rejected("Approval timed out")
2423
2373
try:
2424
2374
session.send(client.secret)
2425
2375
except gnutls.Error as error:
2426
log.warning("gnutls send failed", exc_info=error)
2376
logger.warning("gnutls send failed",
2377
exc_info=error)
2427
2378
return
2428
2379
2429
log.info("Sending secret to %s", client.name)
2380
logger.info("Sending secret to %s", client.name)
2430
2381
# bump the timeout using extended_timeout
2431
2382
client.bump_timeout(client.extended_timeout)
2432
2383
if self.server.use_dbus:
2439
2390
try:
2440
2391
session.bye()
2441
2392
except gnutls.Error as error:
2442
log.warning("GnuTLS bye failed", exc_info=error)
2393
logger.warning("GnuTLS bye failed",
2394
exc_info=error)
2443
2395
2444
2396
@staticmethod
2445
2397
def peer_certificate(session):
2446
2398
"Return the peer's certificate as a bytestring"
2447
2399
try:
2448
cert_type = gnutls.certificate_type_get2(
2449
session, gnutls.CTYPE_PEERS)
2400
cert_type = gnutls.certificate_type_get2(session._c_object,
2401
gnutls.CTYPE_PEERS)
2450
2402
except AttributeError:
2451
cert_type = gnutls.certificate_type_get(session)
2403
cert_type = gnutls.certificate_type_get(session._c_object)
2452
2404
if gnutls.has_rawpk:
2453
2405
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2454
2406
else:
2455
2407
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2456
2408
# If not a valid certificate type...
2457
2409
if cert_type not in valid_cert_types:
2458
log.info("Cert type %r not in %r", cert_type,
2459
valid_cert_types)
2410
logger.info("Cert type %r not in %r", cert_type,
2411
valid_cert_types)
2460
2412
# ...return invalid data
2461
2413
return b""
2462
2414
list_size = ctypes.c_uint(1)
2463
2415
cert_list = (gnutls.certificate_get_peers
2464
(session, ctypes.byref(list_size)))
2416
(session._c_object, ctypes.byref(list_size)))
2465
2417
if not bool(cert_list) and list_size.value != 0:
2466
2418
raise gnutls.Error("error getting peer certificate")
2467
2419
if list_size.value == 0:
2489
2441
buf = ctypes.create_string_buffer(32)
2490
2442
buf_len = ctypes.c_size_t(len(buf))
2491
2443
# Get the key ID from the raw public key into the buffer
2492
gnutls.pubkey_get_key_id(
2493
pubkey,
2494
gnutls.KEYID_USE_SHA256,
2495
ctypes.cast(ctypes.byref(buf),
2496
ctypes.POINTER(ctypes.c_ubyte)),
2497
ctypes.byref(buf_len))
2444
gnutls.pubkey_get_key_id(pubkey,
2445
gnutls.KEYID_USE_SHA256,
2446
ctypes.cast(ctypes.byref(buf),
2447
ctypes.POINTER(ctypes.c_ubyte)),
2448
ctypes.byref(buf_len))
2498
2449
# Deinit the certificate
2499
2450
gnutls.pubkey_deinit(pubkey)
2500
2451
2541
2492
return hex_fpr
2542
2493
2543
2494
2544
class MultiprocessingMixIn:
2495
class MultiprocessingMixIn(object):
2545
2496
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2546
2497
2547
2498
def sub_process_main(self, request, address):
2559
2510
return proc
2560
2511
2561
2512
2562
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2513
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2563
2514
""" adds a pipe to the MixIn """
2564
2515
2565
2516
def process_request(self, request, client_address):
2580
2531
2581
2532
2582
2533
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2583
socketserver.TCPServer):
2584
"""IPv6-capable TCP server. Accepts None as address and/or port
2534
socketserver.TCPServer, object):
2535
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2585
2536
2586
2537
Attributes:
2587
2538
enabled: Boolean; whether this server is activated yet
2638
2589
if SO_BINDTODEVICE is None:
2639
2590
# Fall back to a hard-coded value which seems to be
2640
2591
# common enough.
2641
log.warning("SO_BINDTODEVICE not found, trying 25")
2592
logger.warning("SO_BINDTODEVICE not found, trying 25")
2642
2593
SO_BINDTODEVICE = 25
2643
2594
try:
2644
2595
self.socket.setsockopt(
2646
2597
(self.interface + "\0").encode("utf-8"))
2647
2598
except socket.error as error:
2648
2599
if error.errno == errno.EPERM:
2649
log.error("No permission to bind to interface %s",
2650
self.interface)
2600
logger.error("No permission to bind to"
2601
" interface %s", self.interface)
2651
2602
elif error.errno == errno.ENOPROTOOPT:
2652
log.error("SO_BINDTODEVICE not available; cannot"
2653
" bind to interface %s", self.interface)
2603
logger.error("SO_BINDTODEVICE not available;"
2604
" cannot bind to interface %s",
2605
self.interface)
2654
2606
elif error.errno == errno.ENODEV:
2655
log.error("Interface %s does not exist, cannot"
2656
" bind", self.interface)
2607
logger.error("Interface %s does not exist,"
2608
" cannot bind", self.interface)
2657
2609
else:
2658
2610
raise
2659
2611
# Only bind(2) the socket if we really need to.
2718
2670
def add_pipe(self, parent_pipe, proc):
2719
2671
# Call "handle_ipc" for both data and EOF events
2720
2672
GLib.io_add_watch(
2721
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2722
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2673
parent_pipe.fileno(),
2674
GLib.IO_IN | GLib.IO_HUP,
2723
2675
functools.partial(self.handle_ipc,
2724
2676
parent_pipe=parent_pipe,
2725
2677
proc=proc))
2738
2690
request = parent_pipe.recv()
2739
2691
command = request[0]
2740
2692
2741
if command == "init":
2693
if command == 'init':
2742
2694
key_id = request[1].decode("ascii")
2743
2695
fpr = request[2].decode("ascii")
2744
2696
address = request[3]
2745
2697
2746
2698
for c in self.clients.values():
2747
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2748
"27AE41E4649B934CA495991B7852B855"):
2699
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2749
2700
continue
2750
2701
if key_id and c.key_id == key_id:
2751
2702
client = c
2754
2705
client = c
2755
2706
break
2756
2707
else:
2757
log.info("Client not found for key ID: %s, address:"
2758
" %s", key_id or fpr, address)
2708
logger.info("Client not found for key ID: %s, address"
2709
": %s", key_id or fpr, address)
2759
2710
if self.use_dbus:
2760
2711
# Emit D-Bus signal
2761
2712
mandos_dbus_service.ClientNotFound(key_id or fpr,
2764
2715
return False
2765
2716
2766
2717
GLib.io_add_watch(
2767
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2768
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2718
parent_pipe.fileno(),
2719
GLib.IO_IN | GLib.IO_HUP,
2769
2720
functools.partial(self.handle_ipc,
2770
2721
parent_pipe=parent_pipe,
2771
2722
proc=proc,
2774
2725
# remove the old hook in favor of the new above hook on
2775
2726
# same fileno
2776
2727
return False
2777
if command == "funcall":
2728
if command == 'funcall':
2778
2729
funcname = request[1]
2779
2730
args = request[2]
2780
2731
kwargs = request[3]
2781
2732
2782
parent_pipe.send(("data", getattr(client_object,
2733
parent_pipe.send(('data', getattr(client_object,
2783
2734
funcname)(*args,
2784
2735
**kwargs)))
2785
2736
2786
if command == "getattr":
2737
if command == 'getattr':
2787
2738
attrname = request[1]
2788
2739
if isinstance(client_object.__getattribute__(attrname),
2789
collections.abc.Callable):
2790
parent_pipe.send(("function", ))
2740
collections.Callable):
2741
parent_pipe.send(('function', ))
2791
2742
else:
2792
2743
parent_pipe.send((
2793
"data", client_object.__getattribute__(attrname)))
2744
'data', client_object.__getattribute__(attrname)))
2794
2745
2795
if command == "setattr":
2746
if command == 'setattr':
2796
2747
attrname = request[1]
2797
2748
value = request[2]
2798
2749
setattr(client_object, attrname, value)
2803
2754
def rfc3339_duration_to_delta(duration):
2804
2755
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2805
2756
2806
>>> timedelta = datetime.timedelta
2807
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2808
True
2809
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2810
True
2811
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2812
True
2813
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2814
True
2815
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2816
True
2817
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2818
True
2819
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2820
True
2821
>>> del timedelta
2757
>>> rfc3339_duration_to_delta("P7D")
2758
datetime.timedelta(7)
2759
>>> rfc3339_duration_to_delta("PT60S")
2760
datetime.timedelta(0, 60)
2761
>>> rfc3339_duration_to_delta("PT60M")
2762
datetime.timedelta(0, 3600)
2763
>>> rfc3339_duration_to_delta("PT24H")
2764
datetime.timedelta(1)
2765
>>> rfc3339_duration_to_delta("P1W")
2766
datetime.timedelta(7)
2767
>>> rfc3339_duration_to_delta("PT5M30S")
2768
datetime.timedelta(0, 330)
2769
>>> rfc3339_duration_to_delta("P1DT3M20S")
2770
datetime.timedelta(1, 200)
2822
2771
"""
2823
2772
2824
2773
# Parsing an RFC 3339 duration with regular expressions is not
2904
2853
def string_to_delta(interval):
2905
2854
"""Parse a string and return a datetime.timedelta
2906
2855
2907
>>> string_to_delta("7d") == datetime.timedelta(7)
2908
True
2909
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2910
True
2911
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2912
True
2913
>>> string_to_delta("24h") == datetime.timedelta(1)
2914
True
2915
>>> string_to_delta("1w") == datetime.timedelta(7)
2916
True
2917
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2918
True
2856
>>> string_to_delta('7d')
2857
datetime.timedelta(7)
2858
>>> string_to_delta('60s')
2859
datetime.timedelta(0, 60)
2860
>>> string_to_delta('60m')
2861
datetime.timedelta(0, 3600)
2862
>>> string_to_delta('24h')
2863
datetime.timedelta(1)
2864
>>> string_to_delta('1w')
2865
datetime.timedelta(7)
2866
>>> string_to_delta('5m 30s')
2867
datetime.timedelta(0, 330)
2919
2868
"""
2920
2869
2921
2870
try:
3023
2972
3024
2973
options = parser.parse_args()
3025
2974
2975
if options.check:
2976
import doctest
2977
fail_count, test_count = doctest.testmod()
2978
sys.exit(os.EX_OK if fail_count == 0 else 1)
2979
3026
2980
# Default values for config file for server-global settings
3027
2981
if gnutls.has_rawpk:
3028
2982
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3124
3078
3125
3079
if server_settings["servicename"] != "Mandos":
3126
3080
syslogger.setFormatter(
3127
logging.Formatter("Mandos ({}) [%(process)d]:"
3128
" %(levelname)s: %(message)s".format(
3081
logging.Formatter('Mandos ({}) [%(process)d]:'
3082
' %(levelname)s: %(message)s'.format(
3129
3083
server_settings["servicename"])))
3130
3084
3131
3085
# Parse config file with clients
3155
3109
try:
3156
3110
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3157
3111
except IOError as e:
3158
log.error("Could not open file %r", pidfilename,
3159
exc_info=e)
3112
logger.error("Could not open file %r", pidfilename,
3113
exc_info=e)
3160
3114
3161
3115
for name, group in (("_mandos", "_mandos"),
3162
3116
("mandos", "mandos"),
3173
3127
try:
3174
3128
os.setgid(gid)
3175
3129
os.setuid(uid)
3176
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3130
if debug:
3131
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3132
gid))
3177
3133
except OSError as error:
3178
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3179
os.strerror(error.errno))
3134
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3135
.format(uid, gid, os.strerror(error.errno)))
3180
3136
if error.errno != errno.EPERM:
3181
3137
raise
3182
3138
3189
3145
3190
3146
@gnutls.log_func
3191
3147
def debug_gnutls(level, string):
3192
log.debug("GnuTLS: %s",
3193
string[:-1].decode("utf-8", errors="replace"))
3148
logger.debug("GnuTLS: %s", string[:-1])
3194
3149
3195
3150
gnutls.global_set_log_function(debug_gnutls)
3196
3151
3225
3180
"se.bsnet.fukt.Mandos", bus,
3226
3181
do_not_queue=True)
3227
3182
except dbus.exceptions.DBusException as e:
3228
log.error("Disabling D-Bus:", exc_info=e)
3183
logger.error("Disabling D-Bus:", exc_info=e)
3229
3184
use_dbus = False
3230
3185
server_settings["use_dbus"] = False
3231
3186
tcp_server.use_dbus = False
3290
3245
if isinstance(s, bytes)
3291
3246
else s) for s in
3292
3247
value["client_structure"]]
3293
# .name, .host, and .checker_command
3294
for k in ("name", "host", "checker_command"):
3248
# .name & .host
3249
for k in ("name", "host"):
3295
3250
if isinstance(value[k], bytes):
3296
3251
value[k] = value[k].decode("utf-8")
3297
3252
if "key_id" not in value:
3307
3262
for key, value in
3308
3263
bytes_old_client_settings.items()}
3309
3264
del bytes_old_client_settings
3310
# .host and .checker_command
3265
# .host
3311
3266
for value in old_client_settings.values():
3312
for attribute in ("host", "checker_command"):
3313
if isinstance(value[attribute], bytes):
3314
value[attribute] = (value[attribute]
3315
.decode("utf-8"))
3267
if isinstance(value["host"], bytes):
3268
value["host"] = (value["host"]
3269
.decode("utf-8"))
3316
3270
os.remove(stored_state_path)
3317
3271
except IOError as e:
3318
3272
if e.errno == errno.ENOENT:
3319
log.warning("Could not load persistent state:"
3320
" %s", os.strerror(e.errno))
3273
logger.warning("Could not load persistent state:"
3274
" {}".format(os.strerror(e.errno)))
3321
3275
else:
3322
log.critical("Could not load persistent state:",
3323
exc_info=e)
3276
logger.critical("Could not load persistent state:",
3277
exc_info=e)
3324
3278
raise
3325
3279
except EOFError as e:
3326
log.warning("Could not load persistent state: EOFError:",
3327
exc_info=e)
3280
logger.warning("Could not load persistent state: "
3281
"EOFError:",
3282
exc_info=e)
3328
3283
3329
3284
with PGPEngine() as pgp:
3330
3285
for client_name, client in clients_data.items():
3357
3312
if client["enabled"]:
3358
3313
if datetime.datetime.utcnow() >= client["expires"]:
3359
3314
if not client["last_checked_ok"]:
3360
log.warning("disabling client %s - Client"
3361
" never performed a successful"
3362
" checker", client_name)
3315
logger.warning(
3316
"disabling client {} - Client never "
3317
"performed a successful checker".format(
3318
client_name))
3363
3319
client["enabled"] = False
3364
3320
elif client["last_checker_status"] != 0:
3365
log.warning("disabling client %s - Client"
3366
" last checker failed with error"
3367
" code %s", client_name,
3368
client["last_checker_status"])
3321
logger.warning(
3322
"disabling client {} - Client last"
3323
" checker failed with error code"
3324
" {}".format(
3325
client_name,
3326
client["last_checker_status"]))
3369
3327
client["enabled"] = False
3370
3328
else:
3371
3329
client["expires"] = (
3372
3330
datetime.datetime.utcnow()
3373
3331
+ client["timeout"])
3374
log.debug("Last checker succeeded, keeping %s"
3375
" enabled", client_name)
3332
logger.debug("Last checker succeeded,"
3333
" keeping {} enabled".format(
3334
client_name))
3376
3335
try:
3377
3336
client["secret"] = pgp.decrypt(
3378
3337
client["encrypted_secret"],
3379
3338
client_settings[client_name]["secret"])
3380
3339
except PGPError:
3381
3340
# If decryption fails, we use secret from new settings
3382
log.debug("Failed to decrypt %s old secret",
3383
client_name)
3341
logger.debug("Failed to decrypt {} old secret".format(
3342
client_name))
3384
3343
client["secret"] = (client_settings[client_name]
3385
3344
["secret"])
3386
3345
3400
3359
server_settings=server_settings)
3401
3360
3402
3361
if not tcp_server.clients:
3403
log.warning("No clients defined")
3362
logger.warning("No clients defined")
3404
3363
3405
3364
if not foreground:
3406
3365
if pidfile is not None:
3409
3368
with pidfile:
3410
3369
print(pid, file=pidfile)
3411
3370
except IOError:
3412
log.error("Could not write to file %r with PID %d",
3413
pidfilename, pid)
3371
logger.error("Could not write to file %r with PID %d",
3372
pidfilename, pid)
3414
3373
del pidfile
3415
3374
del pidfilename
3416
3375
3566
3525
3567
3526
try:
3568
3527
with tempfile.NamedTemporaryFile(
3569
mode="wb",
3528
mode='wb',
3570
3529
suffix=".pickle",
3571
prefix="clients-",
3530
prefix='clients-',
3572
3531
dir=os.path.dirname(stored_state_path),
3573
3532
delete=False) as stored_state:
3574
3533
pickle.dump((clients, client_settings), stored_state,
3582
3541
except NameError:
3583
3542
pass
3584
3543
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3585
log.warning("Could not save persistent state: %s",
3586
os.strerror(e.errno))
3544
logger.warning("Could not save persistent state: {}"
3545
.format(os.strerror(e.errno)))
3587
3546
else:
3588
log.warning("Could not save persistent state:",
3589
exc_info=e)
3547
logger.warning("Could not save persistent state:",
3548
exc_info=e)
3590
3549
raise
3591
3550
3592
3551
# Delete all clients, and settings from config
3618
3577
if zeroconf:
3619
3578
service.port = tcp_server.socket.getsockname()[1]
3620
3579
if use_ipv6:
3621
log.info("Now listening on address %r, port %d, flowinfo %d,"
3622
" scope_id %d", *tcp_server.socket.getsockname())
3580
logger.info("Now listening on address %r, port %d,"
3581
" flowinfo %d, scope_id %d",
3582
*tcp_server.socket.getsockname())
3623
3583
else: # IPv4
3624
log.info("Now listening on address %r, port %d",
3625
*tcp_server.socket.getsockname())
3584
logger.info("Now listening on address %r, port %d",
3585
*tcp_server.socket.getsockname())
3626
3586
3627
3587
# service.interface = tcp_server.socket.getsockname()[3]
3628
3588
3632
3592
try:
3633
3593
service.activate()
3634
3594
except dbus.exceptions.DBusException as error:
3635
log.critical("D-Bus Exception", exc_info=error)
3595
logger.critical("D-Bus Exception", exc_info=error)
3636
3596
cleanup()
3637
3597
sys.exit(1)
3638
3598
# End of Avahi example code
3639
3599
3640
GLib.io_add_watch(
3641
GLib.IOChannel.unix_new(tcp_server.fileno()),
3642
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3643
lambda *args, **kwargs: (tcp_server.handle_request
3644
(*args[2:], **kwargs) or True))
3600
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3601
lambda *args, **kwargs:
3602
(tcp_server.handle_request
3603
(*args[2:], **kwargs) or True))
3645
3604
3646
log.debug("Starting main loop")
3605
logger.debug("Starting main loop")
3647
3606
main_loop.run()
3648
3607
except AvahiError as error:
3649
log.critical("Avahi Error", exc_info=error)
3608
logger.critical("Avahi Error", exc_info=error)
3650
3609
cleanup()
3651
3610
sys.exit(1)
3652
3611
except KeyboardInterrupt:
3653
3612
if debug:
3654
3613
print("", file=sys.stderr)
3655
log.debug("Server received KeyboardInterrupt")
3656
log.debug("Server exiting")
3614
logger.debug("Server received KeyboardInterrupt")
3615
logger.debug("Server exiting")
3657
3616
# Must run before the D-Bus bus name gets deregistered
3658
3617
cleanup()
3659
3618
3660
3661
def parse_test_args():
3662
# type: () -> argparse.Namespace
3663
parser = argparse.ArgumentParser(add_help=False)
3664
parser.add_argument("--check", action="store_true")
3665
parser.add_argument("--prefix", )
3666
args, unknown_args = parser.parse_known_args()
3667
if args.check:
3668
# Remove test options from sys.argv
3669
sys.argv[1:] = unknown_args
3670
return args
3671
3672
# Add all tests from doctest strings
3673
def load_tests(loader, tests, none):
3674
import doctest
3675
tests.addTests(doctest.DocTestSuite())
3676
return tests
3677
3678
if __name__ == "__main__":
3679
options = parse_test_args()
3680
try:
3681
if options.check:
3682
extra_test_prefix = options.prefix
3683
if extra_test_prefix is not None:
3684
if not (unittest.main(argv=[""], exit=False)
3685
.result.wasSuccessful()):
3686
sys.exit(1)
3687
class ExtraTestLoader(unittest.TestLoader):
3688
testMethodPrefix = extra_test_prefix
3689
# Call using ./scriptname --test [--verbose]
3690
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3691
else:
3692
unittest.main(argv=[""])
3693
else:
3694
main()
3695
finally:
3696
logging.shutdown()
3697
3698
# Local Variables:
3699
# run-tests:
3700
# (lambda (&optional extra)
3701
# (if (not (funcall run-tests-in-test-buffer default-directory
3702
# extra))
3703
# (funcall show-test-buffer-in-test-window)
3704
# (funcall remove-test-window)
3705
# (if extra (message "Extra tests run successfully!"))))
3706
# run-tests-in-test-buffer:
3707
# (lambda (dir &optional extra)
3708
# (with-current-buffer (get-buffer-create "*Test*")
3709
# (setq buffer-read-only nil
3710
# default-directory dir)
3711
# (erase-buffer)
3712
# (compilation-mode))
3713
# (let ((process-result
3714
# (let ((inhibit-read-only t))
3715
# (process-file-shell-command
3716
# (funcall get-command-line extra) nil "*Test*"))))
3717
# (and (numberp process-result)
3718
# (= process-result 0))))
3719
# get-command-line:
3720
# (lambda (&optional extra)
3721
# (let ((quoted-script
3722
# (shell-quote-argument (funcall get-script-name))))
3723
# (format
3724
# (concat "%s --check" (if extra " --prefix=atest" ""))
3725
# quoted-script)))
3726
# get-script-name:
3727
# (lambda ()
3728
# (if (fboundp 'file-local-name)
3729
# (file-local-name (buffer-file-name))
3730
# (or (file-remote-p (buffer-file-name) 'localname)
3731
# (buffer-file-name))))
3732
# remove-test-window:
3733
# (lambda ()
3734
# (let ((test-window (get-buffer-window "*Test*")))
3735
# (if test-window (delete-window test-window))))
3736
# show-test-buffer-in-test-window:
3737
# (lambda ()
3738
# (when (not (get-buffer-window-list "*Test*"))
3739
# (setq next-error-last-buffer (get-buffer "*Test*"))
3740
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3741
# (display-buffer-overriding-action
3742
# `((display-buffer-in-side-window) (side . ,side)
3743
# (window-height . fit-window-to-buffer)
3744
# (window-width . fit-window-to-buffer))))
3745
# (display-buffer "*Test*"))))
3746
# eval:
3747
# (progn
3748
# (let* ((run-extra-tests (lambda () (interactive)
3749
# (funcall run-tests t)))
3750
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3751
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3752
# (setq minor-mode-overriding-map-alist
3753
# (cons `(run-tests . ,outer-keymap)
3754
# minor-mode-overriding-map-alist)))
3755
# (add-hook 'after-save-hook run-tests 90 t))
3756
# End:
3619
3620
if __name__ == '__main__':
3621
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0