/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-ctl

  • Committer: Teddy Hogeborn
  • Date: 2015-07-20 03:03:33 UTC
  • Revision ID: teddy@recompile.se-20150720030333-203m2aeblypcsfte
Bug fix for GnuTLS 3: be compatible with old 2048-bit DSA keys.

The mandos-keygen program in Mandos version 1.6.0 and older generated
2048-bit DSA keys, and when GnuTLS uses these it has trouble
connecting using the Mandos default priority string.  This was
previously fixed in Mandos 1.6.2, but the bug reappeared when using
GnuTLS 3, so the default priority string has to change again; this
time also the Mandos client has to change its default, so now the
server and the client should use the same default priority string:

SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256

* mandos (main/server_defaults): Changed default priority string.
* mandos-options.xml (/section/para[id="priority_compat"]): Removed.
  (/section/para[id="priority"]): Changed default priority string.
* mandos.conf ([DEFAULT]/priority): - '' -
* mandos.conf.xml (OPTIONS/priority): Refer to the id "priority"
                                      instead of "priority_compat".
* mandos.xml (OPTIONS/--priority): - '' -
* plugins.d/mandos-client.c (main): Changed default priority string.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-ctl
111
111
    # avoid excessive use of external libraries.
112
112
    
113
113
    # New type for defining tokens, syntax, and semantics all-in-one
114
 
    Token = collections.namedtuple("Token",
115
 
                                   ("regexp", # To match token; if
116
 
                                              # "value" is not None,
117
 
                                              # must have a "group"
118
 
                                              # containing digits
119
 
                                    "value",  # datetime.timedelta or
120
 
                                              # None
121
 
                                    "followers")) # Tokens valid after
122
 
                                                  # this token
 
114
    Token = collections.namedtuple("Token", (
 
115
        "regexp",  # To match token; if "value" is not None, must have
 
116
                   # a "group" containing digits
 
117
        "value",   # datetime.timedelta or None
 
118
        "followers"))           # Tokens valid after this token
123
119
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
124
120
    # the "duration" ABNF definition in RFC 3339, Appendix A.
125
121
    token_end = Token(re.compile(r"$"), None, frozenset())
178
174
                break
179
175
        else:
180
176
            # No currently valid tokens were found
181
 
            raise ValueError("Invalid RFC 3339 duration")
 
177
            raise ValueError("Invalid RFC 3339 duration: {!r}"
 
178
                             .format(duration))
182
179
    # End token found
183
180
    return value
184
181
 
186
183
def string_to_delta(interval):
187
184
    """Parse a string and return a datetime.timedelta
188
185
    
189
 
    >>> string_to_delta("7d")
 
186
    >>> string_to_delta('7d')
190
187
    datetime.timedelta(7)
191
 
    >>> string_to_delta("60s")
 
188
    >>> string_to_delta('60s')
192
189
    datetime.timedelta(0, 60)
193
 
    >>> string_to_delta("60m")
 
190
    >>> string_to_delta('60m')
194
191
    datetime.timedelta(0, 3600)
195
 
    >>> string_to_delta("24h")
 
192
    >>> string_to_delta('24h')
196
193
    datetime.timedelta(1)
197
 
    >>> string_to_delta("1w")
 
194
    >>> string_to_delta('1w')
198
195
    datetime.timedelta(7)
199
 
    >>> string_to_delta("5m 30s")
 
196
    >>> string_to_delta('5m 30s')
200
197
    datetime.timedelta(0, 330)
201
198
    """
202
199