To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 885
- compare with another revision
- download diff
- download tarball
- view history from revision 885
- Committer: Teddy Hogeborn
- Date: 2016-10-29 14:22:26 UTC
- Revision ID: teddy@recompile.se-20161029142226-n4s9d70tuk615pg1
Makefile: Clarify message when running client.
* Makefile (run-client): Clarify message.
* Makefile (run-client): Clarify message.
- files added:
- initramfs-tools-hook-conf
- files removed:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
31
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
32
#
33
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
39
39
except ImportError:
40
40
pass
41
41
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
42
try:
48
43
import SocketServer as socketserver
49
44
except ImportError:
50
45
import socketserver
51
46
import socket
47
import argparse
52
48
import datetime
53
49
import errno
54
50
try:
55
51
import ConfigParser as configparser
56
52
except ImportError:
57
53
import configparser
54
import sys
58
55
import re
56
import os
59
57
import signal
60
58
import subprocess
61
59
import atexit
62
60
import stat
61
import logging
63
62
import logging.handlers
64
63
import pwd
65
64
import contextlib
77
76
import itertools
78
77
import collections
79
78
import codecs
80
import random
81
import shlex
82
79
83
80
import dbus
84
81
import dbus.service
85
import gi
86
82
from gi.repository import GLib
87
83
from dbus.mainloop.glib import DBusGMainLoop
88
84
import ctypes
90
86
import xml.dom.minidom
91
87
import inspect
92
88
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
89
# Try to find the value of SO_BINDTODEVICE:
119
90
try:
120
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
140
111
# No value found
141
112
SO_BINDTODEVICE = None
142
113
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
114
if sys.version_info.major == 2:
115
str = unicode
145
116
146
version = "1.8.17"
117
version = "1.7.13"
147
118
stored_state_file = "clients.pickle"
148
119
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
150
logging.captureWarnings(True) # Show warnings via the logging system
120
logger = logging.getLogger()
151
121
syslogger = None
152
122
153
123
try:
189
159
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
160
address="/dev/log"))
191
161
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
162
('Mandos [%(process)d]: %(levelname)s:'
163
' %(message)s'))
164
logger.addHandler(syslogger)
195
165
196
166
if debug:
197
167
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
168
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
169
' [%(process)d]:'
170
' %(levelname)s:'
171
' %(message)s'))
172
logger.addHandler(console)
173
logger.setLevel(level)
204
174
205
175
206
176
class PGPError(Exception):
208
178
pass
209
179
210
180
211
class PGPEngine:
181
class PGPEngine(object):
212
182
"""A simple class for OpenPGP symmetric encryption & decryption"""
213
183
214
184
def __init__(self):
218
188
output = subprocess.check_output(["gpgconf"])
219
189
for line in output.splitlines():
220
190
name, text, path = line.split(b":")
221
if name == b"gpg":
191
if name == "gpg":
222
192
self.gpg = path
223
193
break
224
194
except OSError as e:
225
195
if e.errno != errno.ENOENT:
226
196
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
197
self.gnupgargs = ['--batch',
198
'--homedir', self.tempdir,
199
'--force-mdc',
200
'--quiet']
231
201
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
233
203
self.gnupgargs.append("--no-use-agent")
234
204
235
205
def __enter__(self):
272
242
dir=self.tempdir) as passfile:
273
243
passfile.write(passphrase)
274
244
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
245
proc = subprocess.Popen([self.gpg, '--symmetric',
246
'--passphrase-file',
277
247
passfile.name]
278
248
+ self.gnupgargs,
279
249
stdin=subprocess.PIPE,
290
260
dir=self.tempdir) as passfile:
291
261
passfile.write(passphrase)
292
262
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
263
proc = subprocess.Popen([self.gpg, '--decrypt',
264
'--passphrase-file',
295
265
passfile.name]
296
266
+ self.gnupgargs,
297
267
stdin=subprocess.PIPE,
304
274
305
275
306
276
# Pretend that we have an Avahi module
307
class avahi:
308
"""This isn't so much a class as it is a module-like namespace."""
277
class Avahi(object):
278
"""This isn't so much a class as it is a module-like namespace.
279
It is instantiated once, and simulates having an Avahi module."""
309
280
IF_UNSPEC = -1 # avahi-common/address.h
310
281
PROTO_UNSPEC = -1 # avahi-common/address.h
311
282
PROTO_INET = 0 # avahi-common/address.h
315
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
287
DBUS_PATH_SERVER = "/"
317
288
318
@staticmethod
319
def string_array_to_txt_array(t):
289
def string_array_to_txt_array(self, t):
320
290
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
291
for s in t), signature="ay")
322
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
327
297
SERVER_RUNNING = 2 # avahi-common/defs.h
328
298
SERVER_COLLISION = 3 # avahi-common/defs.h
329
299
SERVER_FAILURE = 4 # avahi-common/defs.h
300
avahi = Avahi()
330
301
331
302
332
303
class AvahiError(Exception):
344
315
pass
345
316
346
317
347
class AvahiService:
318
class AvahiService(object):
348
319
"""An Avahi (Zeroconf) service.
349
320
350
321
Attributes:
351
322
interface: integer; avahi.IF_UNSPEC or an interface index.
352
323
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
324
name: string; Example: 'Mandos'
325
type: string; Example: '_mandos._tcp'.
355
326
See <https://www.iana.org/assignments/service-names-port-numbers>
356
327
port: integer; what port to announce
357
328
TXT: list of strings; TXT record for the service
394
365
def rename(self, remove=True):
395
366
"""Derived from the Avahi example code"""
396
367
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
368
logger.critical("No suitable Zeroconf service name found"
369
" after %i retries, exiting.",
370
self.rename_count)
400
371
raise AvahiServiceError("Too many renames")
401
372
self.name = str(
402
373
self.server.GetAlternativeServiceName(self.name))
403
374
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
375
logger.info("Changing Zeroconf service name to %r ...",
376
self.name)
406
377
if remove:
407
378
self.remove()
408
379
try:
410
381
except dbus.exceptions.DBusException as error:
411
382
if (error.get_dbus_name()
412
383
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
384
logger.info("Local Zeroconf service name collision.")
414
385
return self.rename(remove=False)
415
386
else:
416
log.critical("D-Bus Exception", exc_info=error)
387
logger.critical("D-Bus Exception", exc_info=error)
417
388
self.cleanup()
418
389
os._exit(1)
419
390
435
406
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
407
self.entry_group_state_changed_match = (
437
408
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
409
'StateChanged', self.entry_group_state_changed))
410
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
411
self.name, self.type)
441
412
self.group.AddService(
442
413
self.interface,
443
414
self.protocol,
450
421
451
422
def entry_group_state_changed(self, state, error):
452
423
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
424
logger.debug("Avahi entry group state change: %i", state)
454
425
455
426
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
427
logger.debug("Zeroconf service established.")
457
428
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
429
logger.info("Zeroconf service name collision.")
459
430
self.rename()
460
431
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
432
logger.critical("Avahi: Error in group state changed %s",
433
str(error))
463
434
raise AvahiGroupError("State changed: {!s}".format(error))
464
435
465
436
def cleanup(self):
475
446
476
447
def server_state_changed(self, state, error=None):
477
448
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
449
logger.debug("Avahi server state change: %i", state)
479
450
bad_states = {
480
451
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
452
avahi.SERVER_REGISTERING: None,
485
456
if state in bad_states:
486
457
if bad_states[state] is not None:
487
458
if error is None:
488
log.error(bad_states[state])
459
logger.error(bad_states[state])
489
460
else:
490
log.error(bad_states[state] + ": %r", error)
461
logger.error(bad_states[state] + ": %r", error)
491
462
self.cleanup()
492
463
elif state == avahi.SERVER_RUNNING:
493
464
try:
495
466
except dbus.exceptions.DBusException as error:
496
467
if (error.get_dbus_name()
497
468
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
469
logger.info("Local Zeroconf service name"
470
" collision.")
499
471
return self.rename(remove=False)
500
472
else:
501
log.critical("D-Bus Exception", exc_info=error)
473
logger.critical("D-Bus Exception", exc_info=error)
502
474
self.cleanup()
503
475
os._exit(1)
504
476
else:
505
477
if error is None:
506
log.debug("Unknown state: %r", state)
478
logger.debug("Unknown state: %r", state)
507
479
else:
508
log.debug("Unknown state: %r: %r", state, error)
480
logger.debug("Unknown state: %r: %r", state, error)
509
481
510
482
def activate(self):
511
483
"""Derived from the Avahi example code"""
523
495
class AvahiServiceToSyslog(AvahiService):
524
496
def rename(self, *args, **kwargs):
525
497
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
498
ret = AvahiService.rename(self, *args, **kwargs)
528
499
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
501
.format(self.name)))
531
502
return ret
532
503
533
504
534
505
# Pretend that we have a GnuTLS module
535
class gnutls:
536
"""This isn't so much a class as it is a module-like namespace."""
506
class GnuTLS(object):
507
"""This isn't so much a class as it is a module-like namespace.
508
It is instantiated once, and simulates having a GnuTLS module."""
537
509
538
510
library = ctypes.util.find_library("gnutls")
539
511
if library is None:
540
512
library = ctypes.util.find_library("gnutls-deb0")
541
513
_library = ctypes.cdll.LoadLibrary(library)
542
514
del library
515
_need_version = b"3.3.0"
516
517
def __init__(self):
518
# Need to use "self" here, since this method is called before
519
# the assignment to the "gnutls" global variable happens.
520
if self.check_version(self._need_version) is None:
521
raise self.Error("Needs GnuTLS {} or later"
522
.format(self._need_version))
543
523
544
524
# Unless otherwise indicated, the constants and types below are
545
525
# all from the gnutls/gnutls.h C header file.
549
529
E_INTERRUPTED = -52
550
530
E_AGAIN = -28
551
531
CRT_OPENPGP = 2
552
CRT_RAWPK = 3
553
532
CLIENT = 2
554
533
SHUT_RDWR = 0
555
534
CRD_CERTIFICATE = 1
556
535
E_NO_CERTIFICATE_FOUND = -49
557
X509_FMT_DER = 0
558
NO_TICKETS = 1<<10
559
ENABLE_RAWPK = 1<<18
560
CTYPE_PEERS = 3
561
KEYID_USE_SHA256 = 1 # gnutls/x509.h
562
536
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
537
564
538
# Types
565
class _session_int(ctypes.Structure):
539
class session_int(ctypes.Structure):
566
540
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
541
session_t = ctypes.POINTER(session_int)
568
542
569
543
class certificate_credentials_st(ctypes.Structure):
570
544
_fields_ = []
573
547
certificate_type_t = ctypes.c_int
574
548
575
549
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
550
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
551
('size', ctypes.c_uint)]
578
552
579
class _openpgp_crt_int(ctypes.Structure):
553
class openpgp_crt_int(ctypes.Structure):
580
554
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
555
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
556
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
557
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
558
credentials_type_t = ctypes.c_int
587
561
588
562
# Exceptions
589
563
class Error(Exception):
564
# We need to use the class name "GnuTLS" here, since this
565
# exception might be raised from within GnuTLS.__init__,
566
# which is called before the assignment to the "gnutls"
567
# global variable has happened.
590
568
def __init__(self, message=None, code=None, args=()):
591
569
# Default usage is by a message string, but if a return
592
570
# code is passed, convert it to a string with
593
571
# gnutls.strerror()
594
572
self.code = code
595
573
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
598
return super(gnutls.Error, self).__init__(
574
message = GnuTLS.strerror(code)
575
return super(GnuTLS.Error, self).__init__(
599
576
message, *args)
600
577
601
578
class CertificateSecurityError(Error):
602
579
pass
603
580
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
581
# Classes
630
class Credentials(With_from_param):
582
class Credentials(object):
631
583
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
584
self._c_object = gnutls.certificate_credentials_t()
585
gnutls.certificate_allocate_credentials(
586
ctypes.byref(self._c_object))
634
587
self.type = gnutls.CRD_CERTIFICATE
635
588
636
589
def __del__(self):
637
gnutls.certificate_free_credentials(self)
590
gnutls.certificate_free_credentials(self._c_object)
638
591
639
class ClientSession(With_from_param):
592
class ClientSession(object):
640
593
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
642
gnutls_flags = gnutls.CLIENT
643
if gnutls.check_version(b"3.5.6"):
644
gnutls_flags |= gnutls.NO_TICKETS
645
if gnutls.has_rawpk:
646
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
648
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
594
self._c_object = gnutls.session_t()
595
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
596
gnutls.set_default_priority(self._c_object)
597
gnutls.transport_set_ptr(self._c_object, socket.fileno())
598
gnutls.handshake_set_private_extensions(self._c_object,
599
True)
652
600
self.socket = socket
653
601
if credentials is None:
654
602
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
603
gnutls.credentials_set(self._c_object, credentials.type,
604
ctypes.cast(credentials._c_object,
605
ctypes.c_void_p))
657
606
self.credentials = credentials
658
607
659
608
def __del__(self):
660
gnutls.deinit(self)
609
gnutls.deinit(self._c_object)
661
610
662
611
def handshake(self):
663
return gnutls.handshake(self)
612
return gnutls.handshake(self._c_object)
664
613
665
614
def send(self, data):
666
615
data = bytes(data)
667
616
data_len = len(data)
668
617
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
618
data_len -= gnutls.record_send(self._c_object,
619
data[-data_len:],
670
620
data_len)
671
621
672
622
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
623
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
624
675
625
# Error handling functions
676
626
def _error_code(result):
677
627
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
628
for the 'restype' attribute on ctypes functions"""
629
if result >= 0:
680
630
return result
681
631
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
632
raise gnutls.CertificateSecurityError(code=result)
683
633
raise gnutls.Error(code=result)
684
634
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
635
def _retry_on_error(result, func, arguments):
687
636
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
637
for the 'errcheck' attribute on ctypes functions"""
638
while result < 0:
690
639
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
640
return _error_code(result)
692
641
result = func(*arguments)
697
646
698
647
# Functions
699
648
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
649
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
650
ctypes.POINTER(ctypes.c_char_p)]
702
651
priority_set_direct.restype = _error_code
703
652
704
653
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
654
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
655
init.restype = _error_code
707
656
708
657
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
658
set_default_priority.argtypes = [session_t]
710
659
set_default_priority.restype = _error_code
711
660
712
661
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
662
record_send.argtypes = [session_t, ctypes.c_void_p,
714
663
ctypes.c_size_t]
715
664
record_send.restype = ctypes.c_ssize_t
716
665
record_send.errcheck = _retry_on_error
718
667
certificate_allocate_credentials = (
719
668
_library.gnutls_certificate_allocate_credentials)
720
669
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
670
ctypes.POINTER(certificate_credentials_t)]
722
671
certificate_allocate_credentials.restype = _error_code
723
672
724
673
certificate_free_credentials = (
725
674
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
675
certificate_free_credentials.argtypes = [
676
certificate_credentials_t]
727
677
certificate_free_credentials.restype = None
728
678
729
679
handshake_set_private_extensions = (
730
680
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
681
handshake_set_private_extensions.argtypes = [session_t,
732
682
ctypes.c_int]
733
683
handshake_set_private_extensions.restype = None
734
684
735
685
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
686
credentials_set.argtypes = [session_t, credentials_type_t,
687
ctypes.c_void_p]
738
688
credentials_set.restype = _error_code
739
689
740
690
strerror = _library.gnutls_strerror
742
692
strerror.restype = ctypes.c_char_p
743
693
744
694
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
695
certificate_type_get.argtypes = [session_t]
746
696
certificate_type_get.restype = _error_code
747
697
748
698
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
699
certificate_get_peers.argtypes = [session_t,
750
700
ctypes.POINTER(ctypes.c_uint)]
751
701
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
702
759
709
global_set_log_function.restype = None
760
710
761
711
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
712
deinit.argtypes = [session_t]
763
713
deinit.restype = None
764
714
765
715
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
716
handshake.argtypes = [session_t]
717
handshake.restype = _error_code
768
718
handshake.errcheck = _retry_on_error
769
719
770
720
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
721
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
722
transport_set_ptr.restype = None
773
723
774
724
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
725
bye.argtypes = [session_t, close_request_t]
726
bye.restype = _error_code
777
727
bye.errcheck = _retry_on_error
778
728
779
729
check_version = _library.gnutls_check_version
780
730
check_version.argtypes = [ctypes.c_char_p]
781
731
check_version.restype = ctypes.c_char_p
782
732
783
_need_version = b"3.3.0"
784
if check_version(_need_version) is None:
785
raise self.Error("Needs GnuTLS {} or later"
786
.format(_need_version))
787
788
_tls_rawpk_version = b"3.6.6"
789
has_rawpk = bool(check_version(_tls_rawpk_version))
790
791
if has_rawpk:
792
# Types
793
class pubkey_st(ctypes.Structure):
794
_fields = []
795
pubkey_t = ctypes.POINTER(pubkey_st)
796
797
x509_crt_fmt_t = ctypes.c_int
798
799
# All the function declarations below are from
800
# gnutls/abstract.h
801
pubkey_init = _library.gnutls_pubkey_init
802
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
pubkey_init.restype = _error_code
804
805
pubkey_import = _library.gnutls_pubkey_import
806
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
807
x509_crt_fmt_t]
808
pubkey_import.restype = _error_code
809
810
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
811
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
812
ctypes.POINTER(ctypes.c_ubyte),
813
ctypes.POINTER(ctypes.c_size_t)]
814
pubkey_get_key_id.restype = _error_code
815
816
pubkey_deinit = _library.gnutls_pubkey_deinit
817
pubkey_deinit.argtypes = [pubkey_t]
818
pubkey_deinit.restype = None
819
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
822
823
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
825
openpgp_crt_init.restype = _error_code
826
827
openpgp_crt_import = _library.gnutls_openpgp_crt_import
828
openpgp_crt_import.argtypes = [openpgp_crt_t,
829
ctypes.POINTER(datum_t),
830
openpgp_crt_fmt_t]
831
openpgp_crt_import.restype = _error_code
832
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
840
openpgp_crt_verify_self.restype = _error_code
841
842
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
843
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
844
openpgp_crt_deinit.restype = None
845
846
openpgp_crt_get_fingerprint = (
847
_library.gnutls_openpgp_crt_get_fingerprint)
848
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
849
ctypes.c_void_p,
850
ctypes.POINTER(
851
ctypes.c_size_t)]
852
openpgp_crt_get_fingerprint.restype = _error_code
853
854
if check_version(b"3.6.4"):
855
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
857
certificate_type_get2.restype = _error_code
733
# All the function declarations below are from gnutls/openpgp.h
734
735
openpgp_crt_init = _library.gnutls_openpgp_crt_init
736
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
737
openpgp_crt_init.restype = _error_code
738
739
openpgp_crt_import = _library.gnutls_openpgp_crt_import
740
openpgp_crt_import.argtypes = [openpgp_crt_t,
741
ctypes.POINTER(datum_t),
742
openpgp_crt_fmt_t]
743
openpgp_crt_import.restype = _error_code
744
745
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
746
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
747
ctypes.POINTER(ctypes.c_uint)]
748
openpgp_crt_verify_self.restype = _error_code
749
750
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
751
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
752
openpgp_crt_deinit.restype = None
753
754
openpgp_crt_get_fingerprint = (
755
_library.gnutls_openpgp_crt_get_fingerprint)
756
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
757
ctypes.c_void_p,
758
ctypes.POINTER(
759
ctypes.c_size_t)]
760
openpgp_crt_get_fingerprint.restype = _error_code
858
761
859
762
# Remove non-public functions
860
763
del _error_code, _retry_on_error
764
# Create the global "gnutls" object, simulating a module
765
gnutls = GnuTLS()
861
766
862
767
863
768
def call_pipe(connection, # : multiprocessing.Connection
871
776
connection.close()
872
777
873
778
874
class Client:
779
class Client(object):
875
780
"""A representation of a client host served by this server.
876
781
877
782
Attributes:
878
approved: bool(); None if not yet approved/disapproved
783
approved: bool(); 'None' if not yet approved/disapproved
879
784
approval_delay: datetime.timedelta(); Time to wait for approval
880
785
approval_duration: datetime.timedelta(); Duration of one approval
881
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
883
running.
786
checker: subprocess.Popen(); a running checker process used
787
to see if the client lives.
788
'None' if no process is running.
884
789
checker_callback_tag: a GLib event source tag, or None
885
790
checker_command: string; External command which is run to check
886
791
if client lives. %() expansions are done at
894
799
disable_initiator_tag: a GLib event source tag, or None
895
800
enabled: bool()
896
801
fingerprint: string (40 or 32 hexadecimal digits); used to
897
uniquely identify an OpenPGP client
898
key_id: string (64 hexadecimal digits); used to uniquely identify
899
a client using raw public keys
802
uniquely identify the client
900
803
host: string; available for use by the checker command
901
804
interval: datetime.timedelta(); How often to start a new checker
902
805
last_approval_request: datetime.datetime(); (UTC) or None
920
823
"""
921
824
922
825
runtime_expansions = ("approval_delay", "approval_duration",
923
"created", "enabled", "expires", "key_id",
826
"created", "enabled", "expires",
924
827
"fingerprint", "host", "interval",
925
828
"last_approval_request", "last_checked_ok",
926
829
"last_enabled", "name", "timeout")
956
859
client["enabled"] = config.getboolean(client_name,
957
860
"enabled")
958
861
959
# Uppercase and remove spaces from key_id and fingerprint
960
# for later comparison purposes with return value from the
961
# key_id() and fingerprint() functions
962
client["key_id"] = (section.get("key_id", "").upper()
963
.replace(" ", ""))
964
client["fingerprint"] = (section.get("fingerprint",
965
"").upper()
862
# Uppercase and remove spaces from fingerprint for later
863
# comparison purposes with return value from the
864
# fingerprint() function
865
client["fingerprint"] = (section["fingerprint"].upper()
966
866
.replace(" ", ""))
967
if not (client["key_id"] or client["fingerprint"]):
968
log.error("Skipping client %s without key_id or"
969
" fingerprint", client_name)
970
del settings[client_name]
971
continue
972
867
if "secret" in section:
973
868
client["secret"] = codecs.decode(section["secret"]
974
869
.encode("utf-8"),
1015
910
self.last_enabled = None
1016
911
self.expires = None
1017
912
1018
log.debug("Creating client %r", self.name)
1019
log.debug(" Key ID: %s", self.key_id)
1020
log.debug(" Fingerprint: %s", self.fingerprint)
913
logger.debug("Creating client %r", self.name)
914
logger.debug(" Fingerprint: %s", self.fingerprint)
1021
915
self.created = settings.get("created",
1022
916
datetime.datetime.utcnow())
1023
917
1051
945
if getattr(self, "enabled", False):
1052
946
# Already enabled
1053
947
return
948
self.expires = datetime.datetime.utcnow() + self.timeout
1054
949
self.enabled = True
1055
950
self.last_enabled = datetime.datetime.utcnow()
1056
951
self.init_checker()
1061
956
if not getattr(self, "enabled", False):
1062
957
return False
1063
958
if not quiet:
1064
log.info("Disabling client %s", self.name)
959
logger.info("Disabling client %s", self.name)
1065
960
if getattr(self, "disable_initiator_tag", None) is not None:
1066
961
GLib.source_remove(self.disable_initiator_tag)
1067
962
self.disable_initiator_tag = None
1079
974
def __del__(self):
1080
975
self.disable()
1081
976
1082
def init_checker(self, randomize_start=False):
1083
# Schedule a new checker to be started a randomly selected
1084
# time (a fraction of 'interval') from now. This spreads out
1085
# the startup of checkers over time when the server is
1086
# started.
977
def init_checker(self):
978
# Schedule a new checker to be started an 'interval' from now,
979
# and every interval from then on.
1087
980
if self.checker_initiator_tag is not None:
1088
981
GLib.source_remove(self.checker_initiator_tag)
1089
interval_milliseconds = int(self.interval.total_seconds()
1090
* 1000)
1091
if randomize_start:
1092
delay_milliseconds = random.randrange(
1093
interval_milliseconds + 1)
1094
else:
1095
delay_milliseconds = interval_milliseconds
1096
982
self.checker_initiator_tag = GLib.timeout_add(
1097
delay_milliseconds, self.start_checker, randomize_start)
1098
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1099
# A checker might take up to an 'interval' of time, so we can
1100
# expire at the soonest one interval after a checker was
1101
# started. Since the initial checker is delayed, the expire
1102
# time might have to be extended.
1103
now = datetime.datetime.utcnow()
1104
self.expires = now + delay + self.interval
1105
# Schedule a disable() at expire time
983
int(self.interval.total_seconds() * 1000),
984
self.start_checker)
985
# Schedule a disable() when 'timeout' has passed
1106
986
if self.disable_initiator_tag is not None:
1107
987
GLib.source_remove(self.disable_initiator_tag)
1108
988
self.disable_initiator_tag = GLib.timeout_add(
1109
int((self.expires - now).total_seconds() * 1000),
1110
self.disable)
989
int(self.timeout.total_seconds() * 1000), self.disable)
990
# Also start a new checker *right now*.
991
self.start_checker()
1111
992
1112
993
def checker_callback(self, source, condition, connection,
1113
994
command):
1114
995
"""The checker has completed, so take appropriate actions."""
996
self.checker_callback_tag = None
997
self.checker = None
1115
998
# Read return code from connection (see call_pipe)
1116
999
returncode = connection.recv()
1117
1000
connection.close()
1118
if self.checker is not None:
1119
self.checker.join()
1120
self.checker_callback_tag = None
1121
self.checker = None
1122
1001
1123
1002
if returncode >= 0:
1124
1003
self.last_checker_status = returncode
1125
1004
self.last_checker_signal = None
1126
1005
if self.last_checker_status == 0:
1127
log.info("Checker for %(name)s succeeded", vars(self))
1006
logger.info("Checker for %(name)s succeeded",
1007
vars(self))
1128
1008
self.checked_ok()
1129
1009
else:
1130
log.info("Checker for %(name)s failed", vars(self))
1010
logger.info("Checker for %(name)s failed", vars(self))
1131
1011
else:
1132
1012
self.last_checker_status = -1
1133
1013
self.last_checker_signal = -returncode
1134
log.warning("Checker for %(name)s crashed?", vars(self))
1014
logger.warning("Checker for %(name)s crashed?",
1015
vars(self))
1135
1016
return False
1136
1017
1137
1018
def checked_ok(self):
1156
1037
def need_approval(self):
1157
1038
self.last_approval_request = datetime.datetime.utcnow()
1158
1039
1159
def start_checker(self, start_was_randomized=False):
1040
def start_checker(self):
1160
1041
"""Start a new checker subprocess if one is not running.
1161
1042
1162
1043
If a checker already exists, leave it running and do
1171
1052
# should be.
1172
1053
1173
1054
if self.checker is not None and not self.checker.is_alive():
1174
log.warning("Checker was not alive; joining")
1055
logger.warning("Checker was not alive; joining")
1175
1056
self.checker.join()
1176
1057
self.checker = None
1177
1058
# Start a new checker if needed
1178
1059
if self.checker is None:
1179
1060
# Escape attributes for the shell
1180
1061
escaped_attrs = {
1181
attr: shlex.quote(str(getattr(self, attr)))
1062
attr: re.escape(str(getattr(self, attr)))
1182
1063
for attr in self.runtime_expansions}
1183
1064
try:
1184
1065
command = self.checker_command % escaped_attrs
1185
1066
except TypeError as error:
1186
log.error('Could not format string "%s"',
1187
self.checker_command, exc_info=error)
1067
logger.error('Could not format string "%s"',
1068
self.checker_command,
1069
exc_info=error)
1188
1070
return True # Try again later
1189
1071
self.current_checker_command = command
1190
log.info("Starting checker %r for %s", command, self.name)
1072
logger.info("Starting checker %r for %s", command,
1073
self.name)
1191
1074
# We don't need to redirect stdout and stderr, since
1192
1075
# in normal mode, that is already done by daemon(),
1193
1076
# and in debug mode we don't want to. (Stdin is
1209
1092
kwargs=popen_args)
1210
1093
self.checker.start()
1211
1094
self.checker_callback_tag = GLib.io_add_watch(
1212
GLib.IOChannel.unix_new(pipe[0].fileno()),
1213
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1095
pipe[0].fileno(), GLib.IO_IN,
1214
1096
self.checker_callback, pipe[0], command)
1215
if start_was_randomized:
1216
# We were started after a random delay; Schedule a new
1217
# checker to be started an 'interval' from now, and every
1218
# interval from then on.
1219
now = datetime.datetime.utcnow()
1220
self.checker_initiator_tag = GLib.timeout_add(
1221
int(self.interval.total_seconds() * 1000),
1222
self.start_checker)
1223
self.expires = max(self.expires, now + self.interval)
1224
# Don't start a new checker again after same random delay
1225
return False
1226
1097
# Re-run this periodically if run by GLib.timeout_add
1227
1098
return True
1228
1099
1233
1104
self.checker_callback_tag = None
1234
1105
if getattr(self, "checker", None) is None:
1235
1106
return
1236
log.debug("Stopping checker for %(name)s", vars(self))
1107
logger.debug("Stopping checker for %(name)s", vars(self))
1237
1108
self.checker.terminate()
1238
1109
self.checker = None
1239
1110
1266
1137
func._dbus_name = func.__name__
1267
1138
if func._dbus_name.endswith("_dbus_property"):
1268
1139
func._dbus_name = func._dbus_name[:-14]
1269
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1140
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1270
1141
return func
1271
1142
1272
1143
return decorator
1361
1232
1362
1233
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1363
1234
out_signature="s",
1364
path_keyword="object_path",
1365
connection_keyword="connection")
1235
path_keyword='object_path',
1236
connection_keyword='connection')
1366
1237
def Introspect(self, object_path, connection):
1367
1238
"""Overloading of standard D-Bus method.
1368
1239
1417
1288
document.unlink()
1418
1289
except (AttributeError, xml.dom.DOMException,
1419
1290
xml.parsers.expat.ExpatError) as error:
1420
log.error("Failed to override Introspection method",
1421
exc_info=error)
1291
logger.error("Failed to override Introspection method",
1292
exc_info=error)
1422
1293
return xmlstring
1423
1294
1424
1295
1482
1353
raise ValueError("Byte arrays not supported for non-"
1483
1354
"'ay' signature {!r}"
1484
1355
.format(prop._dbus_signature))
1485
value = dbus.ByteArray(bytes(value))
1356
value = dbus.ByteArray(b''.join(chr(byte)
1357
for byte in value))
1486
1358
prop(value)
1487
1359
1488
1360
@dbus.service.method(dbus.PROPERTIES_IFACE,
1521
1393
1522
1394
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1523
1395
out_signature="s",
1524
path_keyword="object_path",
1525
connection_keyword="connection")
1396
path_keyword='object_path',
1397
connection_keyword='connection')
1526
1398
def Introspect(self, object_path, connection):
1527
1399
"""Overloading of standard D-Bus method.
1528
1400
1584
1456
document.unlink()
1585
1457
except (AttributeError, xml.dom.DOMException,
1586
1458
xml.parsers.expat.ExpatError) as error:
1587
log.error("Failed to override Introspection method",
1588
exc_info=error)
1459
logger.error("Failed to override Introspection method",
1460
exc_info=error)
1589
1461
return xmlstring
1590
1462
1591
1592
1463
try:
1593
1464
dbus.OBJECT_MANAGER_IFACE
1594
1465
except AttributeError:
1623
1494
1624
1495
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1625
1496
out_signature="s",
1626
path_keyword="object_path",
1627
connection_keyword="connection")
1497
path_keyword='object_path',
1498
connection_keyword='connection')
1628
1499
def Introspect(self, object_path, connection):
1629
1500
"""Overloading of standard D-Bus method.
1630
1501
1655
1526
document.unlink()
1656
1527
except (AttributeError, xml.dom.DOMException,
1657
1528
xml.parsers.expat.ExpatError) as error:
1658
log.error("Failed to override Introspection method",
1659
exc_info=error)
1529
logger.error("Failed to override Introspection method",
1530
exc_info=error)
1660
1531
return xmlstring
1661
1532
1662
1533
2126
1997
def Name_dbus_property(self):
2127
1998
return dbus.String(self.name)
2128
1999
2129
# KeyID - property
2130
@dbus_annotations(
2131
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2132
@dbus_service_property(_interface, signature="s", access="read")
2133
def KeyID_dbus_property(self):
2134
return dbus.String(self.key_id)
2135
2136
2000
# Fingerprint - property
2137
2001
@dbus_annotations(
2138
2002
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2293
2157
del _interface
2294
2158
2295
2159
2296
class ProxyClient:
2297
def __init__(self, child_pipe, key_id, fpr, address):
2160
class ProxyClient(object):
2161
def __init__(self, child_pipe, fpr, address):
2298
2162
self._pipe = child_pipe
2299
self._pipe.send(("init", key_id, fpr, address))
2163
self._pipe.send(('init', fpr, address))
2300
2164
if not self._pipe.recv():
2301
raise KeyError(key_id or fpr)
2165
raise KeyError(fpr)
2302
2166
2303
2167
def __getattribute__(self, name):
2304
if name == "_pipe":
2168
if name == '_pipe':
2305
2169
return super(ProxyClient, self).__getattribute__(name)
2306
self._pipe.send(("getattr", name))
2170
self._pipe.send(('getattr', name))
2307
2171
data = self._pipe.recv()
2308
if data[0] == "data":
2172
if data[0] == 'data':
2309
2173
return data[1]
2310
if data[0] == "function":
2174
if data[0] == 'function':
2311
2175
2312
2176
def func(*args, **kwargs):
2313
self._pipe.send(("funcall", name, args, kwargs))
2177
self._pipe.send(('funcall', name, args, kwargs))
2314
2178
return self._pipe.recv()[1]
2315
2179
2316
2180
return func
2317
2181
2318
2182
def __setattr__(self, name, value):
2319
if name == "_pipe":
2183
if name == '_pipe':
2320
2184
return super(ProxyClient, self).__setattr__(name, value)
2321
self._pipe.send(("setattr", name, value))
2185
self._pipe.send(('setattr', name, value))
2322
2186
2323
2187
2324
2188
class ClientHandler(socketserver.BaseRequestHandler, object):
2329
2193
2330
2194
def handle(self):
2331
2195
with contextlib.closing(self.server.child_pipe) as child_pipe:
2332
log.info("TCP connection from: %s",
2333
str(self.client_address))
2334
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2196
logger.info("TCP connection from: %s",
2197
str(self.client_address))
2198
logger.debug("Pipe FD: %d",
2199
self.server.child_pipe.fileno())
2335
2200
2336
2201
session = gnutls.ClientSession(self.request)
2337
2202
2338
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2203
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2339
2204
# "+AES-256-CBC", "+SHA1",
2340
2205
# "+COMP-NULL", "+CTYPE-OPENPGP",
2341
2206
# "+DHE-DSS"))
2343
2208
priority = self.server.gnutls_priority
2344
2209
if priority is None:
2345
2210
priority = "NORMAL"
2346
gnutls.priority_set_direct(session,
2347
priority.encode("utf-8"), None)
2211
gnutls.priority_set_direct(session._c_object,
2212
priority.encode("utf-8"),
2213
None)
2348
2214
2349
2215
# Start communication using the Mandos protocol
2350
2216
# Get protocol number
2351
2217
line = self.request.makefile().readline()
2352
log.debug("Protocol version: %r", line)
2218
logger.debug("Protocol version: %r", line)
2353
2219
try:
2354
2220
if int(line.strip().split()[0]) > 1:
2355
2221
raise RuntimeError(line)
2356
2222
except (ValueError, IndexError, RuntimeError) as error:
2357
log.error("Unknown protocol version: %s", error)
2223
logger.error("Unknown protocol version: %s", error)
2358
2224
return
2359
2225
2360
2226
# Start GnuTLS connection
2361
2227
try:
2362
2228
session.handshake()
2363
2229
except gnutls.Error as error:
2364
log.warning("Handshake failed: %s", error)
2230
logger.warning("Handshake failed: %s", error)
2365
2231
# Do not run session.bye() here: the session is not
2366
2232
# established. Just abandon the request.
2367
2233
return
2368
log.debug("Handshake succeeded")
2234
logger.debug("Handshake succeeded")
2369
2235
2370
2236
approval_required = False
2371
2237
try:
2372
if gnutls.has_rawpk:
2373
fpr = b""
2374
try:
2375
key_id = self.key_id(
2376
self.peer_certificate(session))
2377
except (TypeError, gnutls.Error) as error:
2378
log.warning("Bad certificate: %s", error)
2379
return
2380
log.debug("Key ID: %s",
2381
key_id.decode("utf-8",
2382
errors="replace"))
2383
2384
else:
2385
key_id = b""
2386
try:
2387
fpr = self.fingerprint(
2388
self.peer_certificate(session))
2389
except (TypeError, gnutls.Error) as error:
2390
log.warning("Bad certificate: %s", error)
2391
return
2392
log.debug("Fingerprint: %s", fpr)
2393
2394
try:
2395
client = ProxyClient(child_pipe, key_id, fpr,
2238
try:
2239
fpr = self.fingerprint(
2240
self.peer_certificate(session))
2241
except (TypeError, gnutls.Error) as error:
2242
logger.warning("Bad certificate: %s", error)
2243
return
2244
logger.debug("Fingerprint: %s", fpr)
2245
2246
try:
2247
client = ProxyClient(child_pipe, fpr,
2396
2248
self.client_address)
2397
2249
except KeyError:
2398
2250
return
2404
2256
2405
2257
while True:
2406
2258
if not client.enabled:
2407
log.info("Client %s is disabled", client.name)
2259
logger.info("Client %s is disabled",
2260
client.name)
2408
2261
if self.server.use_dbus:
2409
2262
# Emit D-Bus signal
2410
2263
client.Rejected("Disabled")
2414
2267
# We are approved or approval is disabled
2415
2268
break
2416
2269
elif client.approved is None:
2417
log.info("Client %s needs approval",
2418
client.name)
2270
logger.info("Client %s needs approval",
2271
client.name)
2419
2272
if self.server.use_dbus:
2420
2273
# Emit D-Bus signal
2421
2274
client.NeedApproval(
2422
2275
client.approval_delay.total_seconds()
2423
2276
* 1000, client.approved_by_default)
2424
2277
else:
2425
log.warning("Client %s was not approved",
2426
client.name)
2278
logger.warning("Client %s was not approved",
2279
client.name)
2427
2280
if self.server.use_dbus:
2428
2281
# Emit D-Bus signal
2429
2282
client.Rejected("Denied")
2437
2290
time2 = datetime.datetime.now()
2438
2291
if (time2 - time) >= delay:
2439
2292
if not client.approved_by_default:
2440
log.warning("Client %s timed out while"
2441
" waiting for approval",
2442
client.name)
2293
logger.warning("Client %s timed out while"
2294
" waiting for approval",
2295
client.name)
2443
2296
if self.server.use_dbus:
2444
2297
# Emit D-Bus signal
2445
2298
client.Rejected("Approval timed out")
2452
2305
try:
2453
2306
session.send(client.secret)
2454
2307
except gnutls.Error as error:
2455
log.warning("gnutls send failed", exc_info=error)
2308
logger.warning("gnutls send failed",
2309
exc_info=error)
2456
2310
return
2457
2311
2458
log.info("Sending secret to %s", client.name)
2312
logger.info("Sending secret to %s", client.name)
2459
2313
# bump the timeout using extended_timeout
2460
2314
client.bump_timeout(client.extended_timeout)
2461
2315
if self.server.use_dbus:
2468
2322
try:
2469
2323
session.bye()
2470
2324
except gnutls.Error as error:
2471
log.warning("GnuTLS bye failed", exc_info=error)
2325
logger.warning("GnuTLS bye failed",
2326
exc_info=error)
2472
2327
2473
2328
@staticmethod
2474
2329
def peer_certificate(session):
2475
"Return the peer's certificate as a bytestring"
2476
try:
2477
cert_type = gnutls.certificate_type_get2(
2478
session, gnutls.CTYPE_PEERS)
2479
except AttributeError:
2480
cert_type = gnutls.certificate_type_get(session)
2481
if gnutls.has_rawpk:
2482
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2483
else:
2484
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2485
# If not a valid certificate type...
2486
if cert_type not in valid_cert_types:
2487
log.info("Cert type %r not in %r", cert_type,
2488
valid_cert_types)
2330
"Return the peer's OpenPGP certificate as a bytestring"
2331
# If not an OpenPGP certificate...
2332
if (gnutls.certificate_type_get(session._c_object)
2333
!= gnutls.CRT_OPENPGP):
2489
2334
# ...return invalid data
2490
2335
return b""
2491
2336
list_size = ctypes.c_uint(1)
2492
2337
cert_list = (gnutls.certificate_get_peers
2493
(session, ctypes.byref(list_size)))
2338
(session._c_object, ctypes.byref(list_size)))
2494
2339
if not bool(cert_list) and list_size.value != 0:
2495
2340
raise gnutls.Error("error getting peer certificate")
2496
2341
if list_size.value == 0:
2499
2344
return ctypes.string_at(cert.data, cert.size)
2500
2345
2501
2346
@staticmethod
2502
def key_id(certificate):
2503
"Convert a certificate bytestring to a hexdigit key ID"
2504
# New GnuTLS "datum" with the public key
2505
datum = gnutls.datum_t(
2506
ctypes.cast(ctypes.c_char_p(certificate),
2507
ctypes.POINTER(ctypes.c_ubyte)),
2508
ctypes.c_uint(len(certificate)))
2509
# XXX all these need to be created in the gnutls "module"
2510
# New empty GnuTLS certificate
2511
pubkey = gnutls.pubkey_t()
2512
gnutls.pubkey_init(ctypes.byref(pubkey))
2513
# Import the raw public key into the certificate
2514
gnutls.pubkey_import(pubkey,
2515
ctypes.byref(datum),
2516
gnutls.X509_FMT_DER)
2517
# New buffer for the key ID
2518
buf = ctypes.create_string_buffer(32)
2519
buf_len = ctypes.c_size_t(len(buf))
2520
# Get the key ID from the raw public key into the buffer
2521
gnutls.pubkey_get_key_id(
2522
pubkey,
2523
gnutls.KEYID_USE_SHA256,
2524
ctypes.cast(ctypes.byref(buf),
2525
ctypes.POINTER(ctypes.c_ubyte)),
2526
ctypes.byref(buf_len))
2527
# Deinit the certificate
2528
gnutls.pubkey_deinit(pubkey)
2529
2530
# Convert the buffer to a Python bytestring
2531
key_id = ctypes.string_at(buf, buf_len.value)
2532
# Convert the bytestring to hexadecimal notation
2533
hex_key_id = binascii.hexlify(key_id).upper()
2534
return hex_key_id
2535
2536
@staticmethod
2537
2347
def fingerprint(openpgp):
2538
2348
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2539
2349
# New GnuTLS "datum" with the OpenPGP public key
2553
2363
ctypes.byref(crtverify))
2554
2364
if crtverify.value != 0:
2555
2365
gnutls.openpgp_crt_deinit(crt)
2556
raise gnutls.CertificateSecurityError(code
2557
=crtverify.value)
2366
raise gnutls.CertificateSecurityError("Verify failed")
2558
2367
# New buffer for the fingerprint
2559
2368
buf = ctypes.create_string_buffer(20)
2560
2369
buf_len = ctypes.c_size_t()
2570
2379
return hex_fpr
2571
2380
2572
2381
2573
class MultiprocessingMixIn:
2382
class MultiprocessingMixIn(object):
2574
2383
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2575
2384
2576
2385
def sub_process_main(self, request, address):
2588
2397
return proc
2589
2398
2590
2399
2591
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2400
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2592
2401
""" adds a pipe to the MixIn """
2593
2402
2594
2403
def process_request(self, request, client_address):
2609
2418
2610
2419
2611
2420
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2612
socketserver.TCPServer):
2613
"""IPv6-capable TCP server. Accepts None as address and/or port
2421
socketserver.TCPServer, object):
2422
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2614
2423
2615
2424
Attributes:
2616
2425
enabled: Boolean; whether this server is activated yet
2667
2476
if SO_BINDTODEVICE is None:
2668
2477
# Fall back to a hard-coded value which seems to be
2669
2478
# common enough.
2670
log.warning("SO_BINDTODEVICE not found, trying 25")
2479
logger.warning("SO_BINDTODEVICE not found, trying 25")
2671
2480
SO_BINDTODEVICE = 25
2672
2481
try:
2673
2482
self.socket.setsockopt(
2675
2484
(self.interface + "\0").encode("utf-8"))
2676
2485
except socket.error as error:
2677
2486
if error.errno == errno.EPERM:
2678
log.error("No permission to bind to interface %s",
2679
self.interface)
2487
logger.error("No permission to bind to"
2488
" interface %s", self.interface)
2680
2489
elif error.errno == errno.ENOPROTOOPT:
2681
log.error("SO_BINDTODEVICE not available; cannot"
2682
" bind to interface %s", self.interface)
2490
logger.error("SO_BINDTODEVICE not available;"
2491
" cannot bind to interface %s",
2492
self.interface)
2683
2493
elif error.errno == errno.ENODEV:
2684
log.error("Interface %s does not exist, cannot"
2685
" bind", self.interface)
2494
logger.error("Interface %s does not exist,"
2495
" cannot bind", self.interface)
2686
2496
else:
2687
2497
raise
2688
2498
# Only bind(2) the socket if we really need to.
2689
2499
if self.server_address[0] or self.server_address[1]:
2690
if self.server_address[1]:
2691
self.allow_reuse_address = True
2692
2500
if not self.server_address[0]:
2693
2501
if self.address_family == socket.AF_INET6:
2694
2502
any_address = "::" # in6addr_any
2747
2555
def add_pipe(self, parent_pipe, proc):
2748
2556
# Call "handle_ipc" for both data and EOF events
2749
2557
GLib.io_add_watch(
2750
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2751
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2558
parent_pipe.fileno(),
2559
GLib.IO_IN | GLib.IO_HUP,
2752
2560
functools.partial(self.handle_ipc,
2753
2561
parent_pipe=parent_pipe,
2754
2562
proc=proc))
2767
2575
request = parent_pipe.recv()
2768
2576
command = request[0]
2769
2577
2770
if command == "init":
2771
key_id = request[1].decode("ascii")
2772
fpr = request[2].decode("ascii")
2773
address = request[3]
2578
if command == 'init':
2579
fpr = request[1]
2580
address = request[2]
2774
2581
2775
2582
for c in self.clients.values():
2776
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2777
"27AE41E4649B934CA495991B7852B855"):
2778
continue
2779
if key_id and c.key_id == key_id:
2780
client = c
2781
break
2782
if fpr and c.fingerprint == fpr:
2583
if c.fingerprint == fpr:
2783
2584
client = c
2784
2585
break
2785
2586
else:
2786
log.info("Client not found for key ID: %s, address:"
2787
" %s", key_id or fpr, address)
2587
logger.info("Client not found for fingerprint: %s, ad"
2588
"dress: %s", fpr, address)
2788
2589
if self.use_dbus:
2789
2590
# Emit D-Bus signal
2790
mandos_dbus_service.ClientNotFound(key_id or fpr,
2591
mandos_dbus_service.ClientNotFound(fpr,
2791
2592
address[0])
2792
2593
parent_pipe.send(False)
2793
2594
return False
2794
2595
2795
2596
GLib.io_add_watch(
2796
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2797
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2597
parent_pipe.fileno(),
2598
GLib.IO_IN | GLib.IO_HUP,
2798
2599
functools.partial(self.handle_ipc,
2799
2600
parent_pipe=parent_pipe,
2800
2601
proc=proc,
2803
2604
# remove the old hook in favor of the new above hook on
2804
2605
# same fileno
2805
2606
return False
2806
if command == "funcall":
2607
if command == 'funcall':
2807
2608
funcname = request[1]
2808
2609
args = request[2]
2809
2610
kwargs = request[3]
2810
2611
2811
parent_pipe.send(("data", getattr(client_object,
2612
parent_pipe.send(('data', getattr(client_object,
2812
2613
funcname)(*args,
2813
2614
**kwargs)))
2814
2615
2815
if command == "getattr":
2616
if command == 'getattr':
2816
2617
attrname = request[1]
2817
2618
if isinstance(client_object.__getattribute__(attrname),
2818
collections.abc.Callable):
2819
parent_pipe.send(("function", ))
2619
collections.Callable):
2620
parent_pipe.send(('function', ))
2820
2621
else:
2821
2622
parent_pipe.send((
2822
"data", client_object.__getattribute__(attrname)))
2623
'data', client_object.__getattribute__(attrname)))
2823
2624
2824
if command == "setattr":
2625
if command == 'setattr':
2825
2626
attrname = request[1]
2826
2627
value = request[2]
2827
2628
setattr(client_object, attrname, value)
2832
2633
def rfc3339_duration_to_delta(duration):
2833
2634
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2834
2635
2835
>>> timedelta = datetime.timedelta
2836
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2837
True
2838
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2839
True
2840
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2841
True
2842
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2843
True
2844
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2845
True
2846
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2847
True
2848
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2849
True
2850
>>> del timedelta
2636
>>> rfc3339_duration_to_delta("P7D")
2637
datetime.timedelta(7)
2638
>>> rfc3339_duration_to_delta("PT60S")
2639
datetime.timedelta(0, 60)
2640
>>> rfc3339_duration_to_delta("PT60M")
2641
datetime.timedelta(0, 3600)
2642
>>> rfc3339_duration_to_delta("PT24H")
2643
datetime.timedelta(1)
2644
>>> rfc3339_duration_to_delta("P1W")
2645
datetime.timedelta(7)
2646
>>> rfc3339_duration_to_delta("PT5M30S")
2647
datetime.timedelta(0, 330)
2648
>>> rfc3339_duration_to_delta("P1DT3M20S")
2649
datetime.timedelta(1, 200)
2851
2650
"""
2852
2651
2853
2652
# Parsing an RFC 3339 duration with regular expressions is not
2933
2732
def string_to_delta(interval):
2934
2733
"""Parse a string and return a datetime.timedelta
2935
2734
2936
>>> string_to_delta("7d") == datetime.timedelta(7)
2937
True
2938
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2939
True
2940
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2941
True
2942
>>> string_to_delta("24h") == datetime.timedelta(1)
2943
True
2944
>>> string_to_delta("1w") == datetime.timedelta(7)
2945
True
2946
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2947
True
2735
>>> string_to_delta('7d')
2736
datetime.timedelta(7)
2737
>>> string_to_delta('60s')
2738
datetime.timedelta(0, 60)
2739
>>> string_to_delta('60m')
2740
datetime.timedelta(0, 3600)
2741
>>> string_to_delta('24h')
2742
datetime.timedelta(1)
2743
>>> string_to_delta('1w')
2744
datetime.timedelta(7)
2745
>>> string_to_delta('5m 30s')
2746
datetime.timedelta(0, 330)
2948
2747
"""
2949
2748
2950
2749
try:
3052
2851
3053
2852
options = parser.parse_args()
3054
2853
2854
if options.check:
2855
import doctest
2856
fail_count, test_count = doctest.testmod()
2857
sys.exit(os.EX_OK if fail_count == 0 else 1)
2858
3055
2859
# Default values for config file for server-global settings
3056
if gnutls.has_rawpk:
3057
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3058
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3059
else:
3060
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3061
":+SIGN-DSA-SHA256")
3062
2860
server_defaults = {"interface": "",
3063
2861
"address": "",
3064
2862
"port": "",
3065
2863
"debug": "False",
3066
"priority": priority,
2864
"priority":
2865
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2866
":+SIGN-DSA-SHA256",
3067
2867
"servicename": "Mandos",
3068
2868
"use_dbus": "True",
3069
2869
"use_ipv6": "True",
3074
2874
"foreground": "False",
3075
2875
"zeroconf": "True",
3076
2876
}
3077
del priority
3078
2877
3079
2878
# Parse config file for server-global settings
3080
server_config = configparser.ConfigParser(server_defaults)
2879
server_config = configparser.SafeConfigParser(server_defaults)
3081
2880
del server_defaults
3082
2881
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3083
# Convert the ConfigParser object to a dict
2882
# Convert the SafeConfigParser object to a dict
3084
2883
server_settings = server_config.defaults()
3085
2884
# Use the appropriate methods on the non-string config options
3086
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3087
"foreground", "zeroconf"):
2885
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3088
2886
server_settings[option] = server_config.getboolean("DEFAULT",
3089
2887
option)
3090
2888
if server_settings["port"]:
3153
2951
3154
2952
if server_settings["servicename"] != "Mandos":
3155
2953
syslogger.setFormatter(
3156
logging.Formatter("Mandos ({}) [%(process)d]:"
3157
" %(levelname)s: %(message)s".format(
2954
logging.Formatter('Mandos ({}) [%(process)d]:'
2955
' %(levelname)s: %(message)s'.format(
3158
2956
server_settings["servicename"])))
3159
2957
3160
2958
# Parse config file with clients
3161
client_config = configparser.ConfigParser(Client.client_defaults)
2959
client_config = configparser.SafeConfigParser(Client
2960
.client_defaults)
3162
2961
client_config.read(os.path.join(server_settings["configdir"],
3163
2962
"clients.conf"))
3164
2963
3184
2983
try:
3185
2984
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3186
2985
except IOError as e:
3187
log.error("Could not open file %r", pidfilename,
3188
exc_info=e)
2986
logger.error("Could not open file %r", pidfilename,
2987
exc_info=e)
3189
2988
3190
2989
for name, group in (("_mandos", "_mandos"),
3191
2990
("mandos", "mandos"),
3202
3001
try:
3203
3002
os.setgid(gid)
3204
3003
os.setuid(uid)
3205
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3004
if debug:
3005
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3006
gid))
3206
3007
except OSError as error:
3207
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3208
os.strerror(error.errno))
3008
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3009
.format(uid, gid, os.strerror(error.errno)))
3209
3010
if error.errno != errno.EPERM:
3210
3011
raise
3211
3012
3218
3019
3219
3020
@gnutls.log_func
3220
3021
def debug_gnutls(level, string):
3221
log.debug("GnuTLS: %s",
3222
string[:-1].decode("utf-8", errors="replace"))
3022
logger.debug("GnuTLS: %s", string[:-1])
3223
3023
3224
3024
gnutls.global_set_log_function(debug_gnutls)
3225
3025
3234
3034
# Close all input and output, do double fork, etc.
3235
3035
daemon()
3236
3036
3237
if gi.version_info < (3, 10, 2):
3238
# multiprocessing will use threads, so before we use GLib we
3239
# need to inform GLib that threads will be used.
3240
GLib.threads_init()
3037
# multiprocessing will use threads, so before we use GLib we need
3038
# to inform GLib that threads will be used.
3039
GLib.threads_init()
3241
3040
3242
3041
global main_loop
3243
3042
# From the Avahi example code
3254
3053
"se.bsnet.fukt.Mandos", bus,
3255
3054
do_not_queue=True)
3256
3055
except dbus.exceptions.DBusException as e:
3257
log.error("Disabling D-Bus:", exc_info=e)
3056
logger.error("Disabling D-Bus:", exc_info=e)
3258
3057
use_dbus = False
3259
3058
server_settings["use_dbus"] = False
3260
3059
tcp_server.use_dbus = False
3319
3118
if isinstance(s, bytes)
3320
3119
else s) for s in
3321
3120
value["client_structure"]]
3322
# .name, .host, and .checker_command
3323
for k in ("name", "host", "checker_command"):
3121
# .name & .host
3122
for k in ("name", "host"):
3324
3123
if isinstance(value[k], bytes):
3325
3124
value[k] = value[k].decode("utf-8")
3326
if "key_id" not in value:
3327
value["key_id"] = ""
3328
elif "fingerprint" not in value:
3329
value["fingerprint"] = ""
3330
3125
# old_client_settings
3331
3126
# .keys()
3332
3127
old_client_settings = {
3336
3131
for key, value in
3337
3132
bytes_old_client_settings.items()}
3338
3133
del bytes_old_client_settings
3339
# .host and .checker_command
3134
# .host
3340
3135
for value in old_client_settings.values():
3341
for attribute in ("host", "checker_command"):
3342
if isinstance(value[attribute], bytes):
3343
value[attribute] = (value[attribute]
3344
.decode("utf-8"))
3136
if isinstance(value["host"], bytes):
3137
value["host"] = (value["host"]
3138
.decode("utf-8"))
3345
3139
os.remove(stored_state_path)
3346
3140
except IOError as e:
3347
3141
if e.errno == errno.ENOENT:
3348
log.warning("Could not load persistent state:"
3349
" %s", os.strerror(e.errno))
3142
logger.warning("Could not load persistent state:"
3143
" {}".format(os.strerror(e.errno)))
3350
3144
else:
3351
log.critical("Could not load persistent state:",
3352
exc_info=e)
3145
logger.critical("Could not load persistent state:",
3146
exc_info=e)
3353
3147
raise
3354
3148
except EOFError as e:
3355
log.warning("Could not load persistent state: EOFError:",
3356
exc_info=e)
3149
logger.warning("Could not load persistent state: "
3150
"EOFError:",
3151
exc_info=e)
3357
3152
3358
3153
with PGPEngine() as pgp:
3359
3154
for client_name, client in clients_data.items():
3386
3181
if client["enabled"]:
3387
3182
if datetime.datetime.utcnow() >= client["expires"]:
3388
3183
if not client["last_checked_ok"]:
3389
log.warning("disabling client %s - Client"
3390
" never performed a successful"
3391
" checker", client_name)
3184
logger.warning(
3185
"disabling client {} - Client never "
3186
"performed a successful checker".format(
3187
client_name))
3392
3188
client["enabled"] = False
3393
3189
elif client["last_checker_status"] != 0:
3394
log.warning("disabling client %s - Client"
3395
" last checker failed with error"
3396
" code %s", client_name,
3397
client["last_checker_status"])
3190
logger.warning(
3191
"disabling client {} - Client last"
3192
" checker failed with error code"
3193
" {}".format(
3194
client_name,
3195
client["last_checker_status"]))
3398
3196
client["enabled"] = False
3399
3197
else:
3400
3198
client["expires"] = (
3401
3199
datetime.datetime.utcnow()
3402
3200
+ client["timeout"])
3403
log.debug("Last checker succeeded, keeping %s"
3404
" enabled", client_name)
3201
logger.debug("Last checker succeeded,"
3202
" keeping {} enabled".format(
3203
client_name))
3405
3204
try:
3406
3205
client["secret"] = pgp.decrypt(
3407
3206
client["encrypted_secret"],
3408
3207
client_settings[client_name]["secret"])
3409
3208
except PGPError:
3410
3209
# If decryption fails, we use secret from new settings
3411
log.debug("Failed to decrypt %s old secret",
3412
client_name)
3210
logger.debug("Failed to decrypt {} old secret".format(
3211
client_name))
3413
3212
client["secret"] = (client_settings[client_name]
3414
3213
["secret"])
3415
3214
3429
3228
server_settings=server_settings)
3430
3229
3431
3230
if not tcp_server.clients:
3432
log.warning("No clients defined")
3231
logger.warning("No clients defined")
3433
3232
3434
3233
if not foreground:
3435
3234
if pidfile is not None:
3438
3237
with pidfile:
3439
3238
print(pid, file=pidfile)
3440
3239
except IOError:
3441
log.error("Could not write to file %r with PID %d",
3442
pidfilename, pid)
3240
logger.error("Could not write to file %r with PID %d",
3241
pidfilename, pid)
3443
3242
del pidfile
3444
3243
del pidfilename
3445
3244
3465
3264
pass
3466
3265
3467
3266
@dbus.service.signal(_interface, signature="ss")
3468
def ClientNotFound(self, key_id, address):
3267
def ClientNotFound(self, fingerprint, address):
3469
3268
"D-Bus signal"
3470
3269
pass
3471
3270
3595
3394
3596
3395
try:
3597
3396
with tempfile.NamedTemporaryFile(
3598
mode="wb",
3397
mode='wb',
3599
3398
suffix=".pickle",
3600
prefix="clients-",
3399
prefix='clients-',
3601
3400
dir=os.path.dirname(stored_state_path),
3602
3401
delete=False) as stored_state:
3603
3402
pickle.dump((clients, client_settings), stored_state,
3611
3410
except NameError:
3612
3411
pass
3613
3412
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3614
log.warning("Could not save persistent state: %s",
3615
os.strerror(e.errno))
3413
logger.warning("Could not save persistent state: {}"
3414
.format(os.strerror(e.errno)))
3616
3415
else:
3617
log.warning("Could not save persistent state:",
3618
exc_info=e)
3416
logger.warning("Could not save persistent state:",
3417
exc_info=e)
3619
3418
raise
3620
3419
3621
3420
# Delete all clients, and settings from config
3638
3437
mandos_dbus_service.client_added_signal(client)
3639
3438
# Need to initiate checking of clients
3640
3439
if client.enabled:
3641
client.init_checker(randomize_start=True)
3440
client.init_checker()
3642
3441
3643
3442
tcp_server.enable()
3644
3443
tcp_server.server_activate()
3647
3446
if zeroconf:
3648
3447
service.port = tcp_server.socket.getsockname()[1]
3649
3448
if use_ipv6:
3650
log.info("Now listening on address %r, port %d, flowinfo %d,"
3651
" scope_id %d", *tcp_server.socket.getsockname())
3449
logger.info("Now listening on address %r, port %d,"
3450
" flowinfo %d, scope_id %d",
3451
*tcp_server.socket.getsockname())
3652
3452
else: # IPv4
3653
log.info("Now listening on address %r, port %d",
3654
*tcp_server.socket.getsockname())
3453
logger.info("Now listening on address %r, port %d",
3454
*tcp_server.socket.getsockname())
3655
3455
3656
3456
# service.interface = tcp_server.socket.getsockname()[3]
3657
3457
3661
3461
try:
3662
3462
service.activate()
3663
3463
except dbus.exceptions.DBusException as error:
3664
log.critical("D-Bus Exception", exc_info=error)
3464
logger.critical("D-Bus Exception", exc_info=error)
3665
3465
cleanup()
3666
3466
sys.exit(1)
3667
3467
# End of Avahi example code
3668
3468
3669
GLib.io_add_watch(
3670
GLib.IOChannel.unix_new(tcp_server.fileno()),
3671
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3672
lambda *args, **kwargs: (tcp_server.handle_request
3673
(*args[2:], **kwargs) or True))
3469
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3470
lambda *args, **kwargs:
3471
(tcp_server.handle_request
3472
(*args[2:], **kwargs) or True))
3674
3473
3675
log.debug("Starting main loop")
3474
logger.debug("Starting main loop")
3676
3475
main_loop.run()
3677
3476
except AvahiError as error:
3678
log.critical("Avahi Error", exc_info=error)
3477
logger.critical("Avahi Error", exc_info=error)
3679
3478
cleanup()
3680
3479
sys.exit(1)
3681
3480
except KeyboardInterrupt:
3682
3481
if debug:
3683
3482
print("", file=sys.stderr)
3684
log.debug("Server received KeyboardInterrupt")
3685
log.debug("Server exiting")
3483
logger.debug("Server received KeyboardInterrupt")
3484
logger.debug("Server exiting")
3686
3485
# Must run before the D-Bus bus name gets deregistered
3687
3486
cleanup()
3688
3487
3689
3690
def parse_test_args():
3691
# type: () -> argparse.Namespace
3692
parser = argparse.ArgumentParser(add_help=False)
3693
parser.add_argument("--check", action="store_true")
3694
parser.add_argument("--prefix", )
3695
args, unknown_args = parser.parse_known_args()
3696
if args.check:
3697
# Remove test options from sys.argv
3698
sys.argv[1:] = unknown_args
3699
return args
3700
3701
# Add all tests from doctest strings
3702
def load_tests(loader, tests, none):
3703
import doctest
3704
tests.addTests(doctest.DocTestSuite())
3705
return tests
3706
3707
if __name__ == "__main__":
3708
options = parse_test_args()
3709
try:
3710
if options.check:
3711
extra_test_prefix = options.prefix
3712
if extra_test_prefix is not None:
3713
if not (unittest.main(argv=[""], exit=False)
3714
.result.wasSuccessful()):
3715
sys.exit(1)
3716
class ExtraTestLoader(unittest.TestLoader):
3717
testMethodPrefix = extra_test_prefix
3718
# Call using ./scriptname --test [--verbose]
3719
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3720
else:
3721
unittest.main(argv=[""])
3722
else:
3723
main()
3724
finally:
3725
logging.shutdown()
3726
3727
# Local Variables:
3728
# run-tests:
3729
# (lambda (&optional extra)
3730
# (if (not (funcall run-tests-in-test-buffer default-directory
3731
# extra))
3732
# (funcall show-test-buffer-in-test-window)
3733
# (funcall remove-test-window)
3734
# (if extra (message "Extra tests run successfully!"))))
3735
# run-tests-in-test-buffer:
3736
# (lambda (dir &optional extra)
3737
# (with-current-buffer (get-buffer-create "*Test*")
3738
# (setq buffer-read-only nil
3739
# default-directory dir)
3740
# (erase-buffer)
3741
# (compilation-mode))
3742
# (let ((process-result
3743
# (let ((inhibit-read-only t))
3744
# (process-file-shell-command
3745
# (funcall get-command-line extra) nil "*Test*"))))
3746
# (and (numberp process-result)
3747
# (= process-result 0))))
3748
# get-command-line:
3749
# (lambda (&optional extra)
3750
# (let ((quoted-script
3751
# (shell-quote-argument (funcall get-script-name))))
3752
# (format
3753
# (concat "%s --check" (if extra " --prefix=atest" ""))
3754
# quoted-script)))
3755
# get-script-name:
3756
# (lambda ()
3757
# (if (fboundp 'file-local-name)
3758
# (file-local-name (buffer-file-name))
3759
# (or (file-remote-p (buffer-file-name) 'localname)
3760
# (buffer-file-name))))
3761
# remove-test-window:
3762
# (lambda ()
3763
# (let ((test-window (get-buffer-window "*Test*")))
3764
# (if test-window (delete-window test-window))))
3765
# show-test-buffer-in-test-window:
3766
# (lambda ()
3767
# (when (not (get-buffer-window-list "*Test*"))
3768
# (setq next-error-last-buffer (get-buffer "*Test*"))
3769
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3770
# (display-buffer-overriding-action
3771
# `((display-buffer-in-side-window) (side . ,side)
3772
# (window-height . fit-window-to-buffer)
3773
# (window-width . fit-window-to-buffer))))
3774
# (display-buffer "*Test*"))))
3775
# eval:
3776
# (progn
3777
# (let* ((run-extra-tests (lambda () (interactive)
3778
# (funcall run-tests t)))
3779
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3780
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3781
# (setq minor-mode-overriding-map-alist
3782
# (cons `(run-tests . ,outer-keymap)
3783
# minor-mode-overriding-map-alist)))
3784
# (add-hook 'after-save-hook run-tests 90 t))
3785
# End:
3488
3489
if __name__ == '__main__':
3490
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0