To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 921
- compare with another revision
- download diff
- download tarball
- view history from revision 921
- Committer: Teddy Hogeborn
- Date: 2018-02-06 20:03:50 UTC
- Revision ID: teddy@recompile.se-20180206200350-jzvorueb731xkph3
Update Debian Debhelper compatibility version.
* (debian/compat): Change to "10".
* (debian/compat): Change to "10".
- files added:
- initramfs-tools-hook-conf
- files removed:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
14
# Copyright © 2008-2017 Teddy Hogeborn
15
# Copyright © 2008-2017 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
39
40
except ImportError:
40
41
pass
41
42
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
43
try:
48
44
import SocketServer as socketserver
49
45
except ImportError:
50
46
import socketserver
51
47
import socket
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
import ConfigParser as configparser
56
53
except ImportError:
57
54
import configparser
55
import sys
58
56
import re
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import random
81
import shlex
82
80
83
81
import dbus
84
82
import dbus.service
85
import gi
86
83
from gi.repository import GLib
87
84
from dbus.mainloop.glib import DBusGMainLoop
88
85
import ctypes
90
87
import xml.dom.minidom
91
88
import inspect
92
89
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
90
# Try to find the value of SO_BINDTODEVICE:
119
91
try:
120
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
140
112
# No value found
141
113
SO_BINDTODEVICE = None
142
114
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
115
if sys.version_info.major == 2:
116
str = unicode
145
117
146
version = "1.8.16"
118
version = "1.7.16"
147
119
stored_state_file = "clients.pickle"
148
120
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
150
logging.captureWarnings(True) # Show warnings via the logging system
121
logger = logging.getLogger()
151
122
syslogger = None
152
123
153
124
try:
189
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
161
address="/dev/log"))
191
162
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
163
('Mandos [%(process)d]: %(levelname)s:'
164
' %(message)s'))
165
logger.addHandler(syslogger)
195
166
196
167
if debug:
197
168
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
169
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
170
' [%(process)d]:'
171
' %(levelname)s:'
172
' %(message)s'))
173
logger.addHandler(console)
174
logger.setLevel(level)
204
175
205
176
206
177
class PGPError(Exception):
208
179
pass
209
180
210
181
211
class PGPEngine:
182
class PGPEngine(object):
212
183
"""A simple class for OpenPGP symmetric encryption & decryption"""
213
184
214
185
def __init__(self):
218
189
output = subprocess.check_output(["gpgconf"])
219
190
for line in output.splitlines():
220
191
name, text, path = line.split(b":")
221
if name == b"gpg":
192
if name == "gpg":
222
193
self.gpg = path
223
194
break
224
195
except OSError as e:
225
196
if e.errno != errno.ENOENT:
226
197
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
198
self.gnupgargs = ['--batch',
199
'--homedir', self.tempdir,
200
'--force-mdc',
201
'--quiet']
231
202
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
203
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
233
204
self.gnupgargs.append("--no-use-agent")
234
205
235
206
def __enter__(self):
272
243
dir=self.tempdir) as passfile:
273
244
passfile.write(passphrase)
274
245
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
246
proc = subprocess.Popen([self.gpg, '--symmetric',
247
'--passphrase-file',
277
248
passfile.name]
278
249
+ self.gnupgargs,
279
250
stdin=subprocess.PIPE,
290
261
dir=self.tempdir) as passfile:
291
262
passfile.write(passphrase)
292
263
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
264
proc = subprocess.Popen([self.gpg, '--decrypt',
265
'--passphrase-file',
295
266
passfile.name]
296
267
+ self.gnupgargs,
297
268
stdin=subprocess.PIPE,
304
275
305
276
306
277
# Pretend that we have an Avahi module
307
class avahi:
308
"""This isn't so much a class as it is a module-like namespace."""
278
class Avahi(object):
279
"""This isn't so much a class as it is a module-like namespace.
280
It is instantiated once, and simulates having an Avahi module."""
309
281
IF_UNSPEC = -1 # avahi-common/address.h
310
282
PROTO_UNSPEC = -1 # avahi-common/address.h
311
283
PROTO_INET = 0 # avahi-common/address.h
315
287
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
288
DBUS_PATH_SERVER = "/"
317
289
318
@staticmethod
319
def string_array_to_txt_array(t):
290
def string_array_to_txt_array(self, t):
320
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
292
for s in t), signature="ay")
322
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
327
298
SERVER_RUNNING = 2 # avahi-common/defs.h
328
299
SERVER_COLLISION = 3 # avahi-common/defs.h
329
300
SERVER_FAILURE = 4 # avahi-common/defs.h
301
avahi = Avahi()
330
302
331
303
332
304
class AvahiError(Exception):
344
316
pass
345
317
346
318
347
class AvahiService:
319
class AvahiService(object):
348
320
"""An Avahi (Zeroconf) service.
349
321
350
322
Attributes:
351
323
interface: integer; avahi.IF_UNSPEC or an interface index.
352
324
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
325
name: string; Example: 'Mandos'
326
type: string; Example: '_mandos._tcp'.
355
327
See <https://www.iana.org/assignments/service-names-port-numbers>
356
328
port: integer; what port to announce
357
329
TXT: list of strings; TXT record for the service
394
366
def rename(self, remove=True):
395
367
"""Derived from the Avahi example code"""
396
368
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
369
logger.critical("No suitable Zeroconf service name found"
370
" after %i retries, exiting.",
371
self.rename_count)
400
372
raise AvahiServiceError("Too many renames")
401
373
self.name = str(
402
374
self.server.GetAlternativeServiceName(self.name))
403
375
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
376
logger.info("Changing Zeroconf service name to %r ...",
377
self.name)
406
378
if remove:
407
379
self.remove()
408
380
try:
410
382
except dbus.exceptions.DBusException as error:
411
383
if (error.get_dbus_name()
412
384
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
385
logger.info("Local Zeroconf service name collision.")
414
386
return self.rename(remove=False)
415
387
else:
416
log.critical("D-Bus Exception", exc_info=error)
388
logger.critical("D-Bus Exception", exc_info=error)
417
389
self.cleanup()
418
390
os._exit(1)
419
391
435
407
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
408
self.entry_group_state_changed_match = (
437
409
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
410
'StateChanged', self.entry_group_state_changed))
411
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
412
self.name, self.type)
441
413
self.group.AddService(
442
414
self.interface,
443
415
self.protocol,
450
422
451
423
def entry_group_state_changed(self, state, error):
452
424
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
425
logger.debug("Avahi entry group state change: %i", state)
454
426
455
427
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
428
logger.debug("Zeroconf service established.")
457
429
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
430
logger.info("Zeroconf service name collision.")
459
431
self.rename()
460
432
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
433
logger.critical("Avahi: Error in group state changed %s",
434
str(error))
463
435
raise AvahiGroupError("State changed: {!s}".format(error))
464
436
465
437
def cleanup(self):
475
447
476
448
def server_state_changed(self, state, error=None):
477
449
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
450
logger.debug("Avahi server state change: %i", state)
479
451
bad_states = {
480
452
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
453
avahi.SERVER_REGISTERING: None,
485
457
if state in bad_states:
486
458
if bad_states[state] is not None:
487
459
if error is None:
488
log.error(bad_states[state])
460
logger.error(bad_states[state])
489
461
else:
490
log.error(bad_states[state] + ": %r", error)
462
logger.error(bad_states[state] + ": %r", error)
491
463
self.cleanup()
492
464
elif state == avahi.SERVER_RUNNING:
493
465
try:
495
467
except dbus.exceptions.DBusException as error:
496
468
if (error.get_dbus_name()
497
469
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
470
logger.info("Local Zeroconf service name"
471
" collision.")
499
472
return self.rename(remove=False)
500
473
else:
501
log.critical("D-Bus Exception", exc_info=error)
474
logger.critical("D-Bus Exception", exc_info=error)
502
475
self.cleanup()
503
476
os._exit(1)
504
477
else:
505
478
if error is None:
506
log.debug("Unknown state: %r", state)
479
logger.debug("Unknown state: %r", state)
507
480
else:
508
log.debug("Unknown state: %r: %r", state, error)
481
logger.debug("Unknown state: %r: %r", state, error)
509
482
510
483
def activate(self):
511
484
"""Derived from the Avahi example code"""
523
496
class AvahiServiceToSyslog(AvahiService):
524
497
def rename(self, *args, **kwargs):
525
498
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
499
ret = super(AvahiServiceToSyslog, self).rename(self, *args,
527
500
**kwargs)
528
501
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
502
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
503
.format(self.name)))
531
504
return ret
532
505
533
506
534
507
# Pretend that we have a GnuTLS module
535
class gnutls:
536
"""This isn't so much a class as it is a module-like namespace."""
508
class GnuTLS(object):
509
"""This isn't so much a class as it is a module-like namespace.
510
It is instantiated once, and simulates having a GnuTLS module."""
537
511
538
512
library = ctypes.util.find_library("gnutls")
539
513
if library is None:
540
514
library = ctypes.util.find_library("gnutls-deb0")
541
515
_library = ctypes.cdll.LoadLibrary(library)
542
516
del library
517
_need_version = b"3.3.0"
518
519
def __init__(self):
520
# Need to use "self" here, since this method is called before
521
# the assignment to the "gnutls" global variable happens.
522
if self.check_version(self._need_version) is None:
523
raise self.Error("Needs GnuTLS {} or later"
524
.format(self._need_version))
543
525
544
526
# Unless otherwise indicated, the constants and types below are
545
527
# all from the gnutls/gnutls.h C header file.
549
531
E_INTERRUPTED = -52
550
532
E_AGAIN = -28
551
533
CRT_OPENPGP = 2
552
CRT_RAWPK = 3
553
534
CLIENT = 2
554
535
SHUT_RDWR = 0
555
536
CRD_CERTIFICATE = 1
556
537
E_NO_CERTIFICATE_FOUND = -49
557
X509_FMT_DER = 0
558
NO_TICKETS = 1<<10
559
ENABLE_RAWPK = 1<<18
560
CTYPE_PEERS = 3
561
KEYID_USE_SHA256 = 1 # gnutls/x509.h
562
538
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
539
564
540
# Types
565
class _session_int(ctypes.Structure):
541
class session_int(ctypes.Structure):
566
542
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
543
session_t = ctypes.POINTER(session_int)
568
544
569
545
class certificate_credentials_st(ctypes.Structure):
570
546
_fields_ = []
573
549
certificate_type_t = ctypes.c_int
574
550
575
551
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
552
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
553
('size', ctypes.c_uint)]
578
554
579
class _openpgp_crt_int(ctypes.Structure):
555
class openpgp_crt_int(ctypes.Structure):
580
556
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
557
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
558
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
559
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
560
credentials_type_t = ctypes.c_int
587
563
588
564
# Exceptions
589
565
class Error(Exception):
566
# We need to use the class name "GnuTLS" here, since this
567
# exception might be raised from within GnuTLS.__init__,
568
# which is called before the assignment to the "gnutls"
569
# global variable has happened.
590
570
def __init__(self, message=None, code=None, args=()):
591
571
# Default usage is by a message string, but if a return
592
572
# code is passed, convert it to a string with
593
573
# gnutls.strerror()
594
574
self.code = code
595
575
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
598
return super(gnutls.Error, self).__init__(
576
message = GnuTLS.strerror(code)
577
return super(GnuTLS.Error, self).__init__(
599
578
message, *args)
600
579
601
580
class CertificateSecurityError(Error):
602
581
pass
603
582
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
583
# Classes
630
class Credentials(With_from_param):
584
class Credentials(object):
631
585
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
586
self._c_object = gnutls.certificate_credentials_t()
587
gnutls.certificate_allocate_credentials(
588
ctypes.byref(self._c_object))
634
589
self.type = gnutls.CRD_CERTIFICATE
635
590
636
591
def __del__(self):
637
gnutls.certificate_free_credentials(self)
592
gnutls.certificate_free_credentials(self._c_object)
638
593
639
class ClientSession(With_from_param):
594
class ClientSession(object):
640
595
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
642
gnutls_flags = gnutls.CLIENT
643
if gnutls.check_version(b"3.5.6"):
644
gnutls_flags |= gnutls.NO_TICKETS
645
if gnutls.has_rawpk:
646
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
648
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
596
self._c_object = gnutls.session_t()
597
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
598
gnutls.set_default_priority(self._c_object)
599
gnutls.transport_set_ptr(self._c_object, socket.fileno())
600
gnutls.handshake_set_private_extensions(self._c_object,
601
True)
652
602
self.socket = socket
653
603
if credentials is None:
654
604
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
605
gnutls.credentials_set(self._c_object, credentials.type,
606
ctypes.cast(credentials._c_object,
607
ctypes.c_void_p))
657
608
self.credentials = credentials
658
609
659
610
def __del__(self):
660
gnutls.deinit(self)
611
gnutls.deinit(self._c_object)
661
612
662
613
def handshake(self):
663
return gnutls.handshake(self)
614
return gnutls.handshake(self._c_object)
664
615
665
616
def send(self, data):
666
617
data = bytes(data)
667
618
data_len = len(data)
668
619
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
620
data_len -= gnutls.record_send(self._c_object,
621
data[-data_len:],
670
622
data_len)
671
623
672
624
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
625
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
626
675
627
# Error handling functions
676
628
def _error_code(result):
677
629
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
630
for the 'restype' attribute on ctypes functions"""
631
if result >= 0:
680
632
return result
681
633
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
634
raise gnutls.CertificateSecurityError(code=result)
683
635
raise gnutls.Error(code=result)
684
636
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
637
def _retry_on_error(result, func, arguments):
687
638
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
639
for the 'errcheck' attribute on ctypes functions"""
640
while result < 0:
690
641
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
642
return _error_code(result)
692
643
result = func(*arguments)
697
648
698
649
# Functions
699
650
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
651
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
652
ctypes.POINTER(ctypes.c_char_p)]
702
653
priority_set_direct.restype = _error_code
703
654
704
655
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
656
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
657
init.restype = _error_code
707
658
708
659
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
660
set_default_priority.argtypes = [session_t]
710
661
set_default_priority.restype = _error_code
711
662
712
663
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
664
record_send.argtypes = [session_t, ctypes.c_void_p,
714
665
ctypes.c_size_t]
715
666
record_send.restype = ctypes.c_ssize_t
716
667
record_send.errcheck = _retry_on_error
718
669
certificate_allocate_credentials = (
719
670
_library.gnutls_certificate_allocate_credentials)
720
671
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
672
ctypes.POINTER(certificate_credentials_t)]
722
673
certificate_allocate_credentials.restype = _error_code
723
674
724
675
certificate_free_credentials = (
725
676
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
677
certificate_free_credentials.argtypes = [
678
certificate_credentials_t]
727
679
certificate_free_credentials.restype = None
728
680
729
681
handshake_set_private_extensions = (
730
682
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
683
handshake_set_private_extensions.argtypes = [session_t,
732
684
ctypes.c_int]
733
685
handshake_set_private_extensions.restype = None
734
686
735
687
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
688
credentials_set.argtypes = [session_t, credentials_type_t,
689
ctypes.c_void_p]
738
690
credentials_set.restype = _error_code
739
691
740
692
strerror = _library.gnutls_strerror
742
694
strerror.restype = ctypes.c_char_p
743
695
744
696
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
697
certificate_type_get.argtypes = [session_t]
746
698
certificate_type_get.restype = _error_code
747
699
748
700
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
701
certificate_get_peers.argtypes = [session_t,
750
702
ctypes.POINTER(ctypes.c_uint)]
751
703
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
704
759
711
global_set_log_function.restype = None
760
712
761
713
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
714
deinit.argtypes = [session_t]
763
715
deinit.restype = None
764
716
765
717
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
718
handshake.argtypes = [session_t]
719
handshake.restype = _error_code
768
720
handshake.errcheck = _retry_on_error
769
721
770
722
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
723
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
724
transport_set_ptr.restype = None
773
725
774
726
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
727
bye.argtypes = [session_t, close_request_t]
728
bye.restype = _error_code
777
729
bye.errcheck = _retry_on_error
778
730
779
731
check_version = _library.gnutls_check_version
780
732
check_version.argtypes = [ctypes.c_char_p]
781
733
check_version.restype = ctypes.c_char_p
782
734
783
_need_version = b"3.3.0"
784
if check_version(_need_version) is None:
785
raise self.Error("Needs GnuTLS {} or later"
786
.format(_need_version))
787
788
_tls_rawpk_version = b"3.6.6"
789
has_rawpk = bool(check_version(_tls_rawpk_version))
790
791
if has_rawpk:
792
# Types
793
class pubkey_st(ctypes.Structure):
794
_fields = []
795
pubkey_t = ctypes.POINTER(pubkey_st)
796
797
x509_crt_fmt_t = ctypes.c_int
798
799
# All the function declarations below are from
800
# gnutls/abstract.h
801
pubkey_init = _library.gnutls_pubkey_init
802
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
pubkey_init.restype = _error_code
804
805
pubkey_import = _library.gnutls_pubkey_import
806
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
807
x509_crt_fmt_t]
808
pubkey_import.restype = _error_code
809
810
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
811
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
812
ctypes.POINTER(ctypes.c_ubyte),
813
ctypes.POINTER(ctypes.c_size_t)]
814
pubkey_get_key_id.restype = _error_code
815
816
pubkey_deinit = _library.gnutls_pubkey_deinit
817
pubkey_deinit.argtypes = [pubkey_t]
818
pubkey_deinit.restype = None
819
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
822
823
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
825
openpgp_crt_init.restype = _error_code
826
827
openpgp_crt_import = _library.gnutls_openpgp_crt_import
828
openpgp_crt_import.argtypes = [openpgp_crt_t,
829
ctypes.POINTER(datum_t),
830
openpgp_crt_fmt_t]
831
openpgp_crt_import.restype = _error_code
832
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
840
openpgp_crt_verify_self.restype = _error_code
841
842
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
843
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
844
openpgp_crt_deinit.restype = None
845
846
openpgp_crt_get_fingerprint = (
847
_library.gnutls_openpgp_crt_get_fingerprint)
848
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
849
ctypes.c_void_p,
850
ctypes.POINTER(
851
ctypes.c_size_t)]
852
openpgp_crt_get_fingerprint.restype = _error_code
853
854
if check_version(b"3.6.4"):
855
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
857
certificate_type_get2.restype = _error_code
735
# All the function declarations below are from gnutls/openpgp.h
736
737
openpgp_crt_init = _library.gnutls_openpgp_crt_init
738
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
739
openpgp_crt_init.restype = _error_code
740
741
openpgp_crt_import = _library.gnutls_openpgp_crt_import
742
openpgp_crt_import.argtypes = [openpgp_crt_t,
743
ctypes.POINTER(datum_t),
744
openpgp_crt_fmt_t]
745
openpgp_crt_import.restype = _error_code
746
747
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
748
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
749
ctypes.POINTER(ctypes.c_uint)]
750
openpgp_crt_verify_self.restype = _error_code
751
752
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
753
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
754
openpgp_crt_deinit.restype = None
755
756
openpgp_crt_get_fingerprint = (
757
_library.gnutls_openpgp_crt_get_fingerprint)
758
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
759
ctypes.c_void_p,
760
ctypes.POINTER(
761
ctypes.c_size_t)]
762
openpgp_crt_get_fingerprint.restype = _error_code
858
763
859
764
# Remove non-public functions
860
765
del _error_code, _retry_on_error
766
# Create the global "gnutls" object, simulating a module
767
gnutls = GnuTLS()
861
768
862
769
863
770
def call_pipe(connection, # : multiprocessing.Connection
871
778
connection.close()
872
779
873
780
874
class Client:
781
class Client(object):
875
782
"""A representation of a client host served by this server.
876
783
877
784
Attributes:
878
approved: bool(); None if not yet approved/disapproved
785
approved: bool(); 'None' if not yet approved/disapproved
879
786
approval_delay: datetime.timedelta(); Time to wait for approval
880
787
approval_duration: datetime.timedelta(); Duration of one approval
881
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
883
running.
788
checker: subprocess.Popen(); a running checker process used
789
to see if the client lives.
790
'None' if no process is running.
884
791
checker_callback_tag: a GLib event source tag, or None
885
792
checker_command: string; External command which is run to check
886
793
if client lives. %() expansions are done at
894
801
disable_initiator_tag: a GLib event source tag, or None
895
802
enabled: bool()
896
803
fingerprint: string (40 or 32 hexadecimal digits); used to
897
uniquely identify an OpenPGP client
898
key_id: string (64 hexadecimal digits); used to uniquely identify
899
a client using raw public keys
804
uniquely identify the client
900
805
host: string; available for use by the checker command
901
806
interval: datetime.timedelta(); How often to start a new checker
902
807
last_approval_request: datetime.datetime(); (UTC) or None
920
825
"""
921
826
922
827
runtime_expansions = ("approval_delay", "approval_duration",
923
"created", "enabled", "expires", "key_id",
828
"created", "enabled", "expires",
924
829
"fingerprint", "host", "interval",
925
830
"last_approval_request", "last_checked_ok",
926
831
"last_enabled", "name", "timeout")
956
861
client["enabled"] = config.getboolean(client_name,
957
862
"enabled")
958
863
959
# Uppercase and remove spaces from key_id and fingerprint
960
# for later comparison purposes with return value from the
961
# key_id() and fingerprint() functions
962
client["key_id"] = (section.get("key_id", "").upper()
963
.replace(" ", ""))
964
client["fingerprint"] = (section.get("fingerprint",
965
"").upper()
864
# Uppercase and remove spaces from fingerprint for later
865
# comparison purposes with return value from the
866
# fingerprint() function
867
client["fingerprint"] = (section["fingerprint"].upper()
966
868
.replace(" ", ""))
967
if not (client["key_id"] or client["fingerprint"]):
968
log.error("Skipping client %s without key_id or"
969
" fingerprint", client_name)
970
del settings[client_name]
971
continue
972
869
if "secret" in section:
973
870
client["secret"] = codecs.decode(section["secret"]
974
871
.encode("utf-8"),
1015
912
self.last_enabled = None
1016
913
self.expires = None
1017
914
1018
log.debug("Creating client %r", self.name)
1019
log.debug(" Key ID: %s", self.key_id)
1020
log.debug(" Fingerprint: %s", self.fingerprint)
915
logger.debug("Creating client %r", self.name)
916
logger.debug(" Fingerprint: %s", self.fingerprint)
1021
917
self.created = settings.get("created",
1022
918
datetime.datetime.utcnow())
1023
919
1051
947
if getattr(self, "enabled", False):
1052
948
# Already enabled
1053
949
return
950
self.expires = datetime.datetime.utcnow() + self.timeout
1054
951
self.enabled = True
1055
952
self.last_enabled = datetime.datetime.utcnow()
1056
953
self.init_checker()
1061
958
if not getattr(self, "enabled", False):
1062
959
return False
1063
960
if not quiet:
1064
log.info("Disabling client %s", self.name)
961
logger.info("Disabling client %s", self.name)
1065
962
if getattr(self, "disable_initiator_tag", None) is not None:
1066
963
GLib.source_remove(self.disable_initiator_tag)
1067
964
self.disable_initiator_tag = None
1079
976
def __del__(self):
1080
977
self.disable()
1081
978
1082
def init_checker(self, randomize_start=False):
1083
# Schedule a new checker to be started a randomly selected
1084
# time (a fraction of 'interval') from now. This spreads out
1085
# the startup of checkers over time when the server is
1086
# started.
979
def init_checker(self):
980
# Schedule a new checker to be started an 'interval' from now,
981
# and every interval from then on.
1087
982
if self.checker_initiator_tag is not None:
1088
983
GLib.source_remove(self.checker_initiator_tag)
1089
interval_milliseconds = int(self.interval.total_seconds()
1090
* 1000)
1091
if randomize_start:
1092
delay_milliseconds = random.randrange(
1093
interval_milliseconds + 1)
1094
else:
1095
delay_milliseconds = interval_milliseconds
1096
984
self.checker_initiator_tag = GLib.timeout_add(
1097
delay_milliseconds, self.start_checker, randomize_start)
1098
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1099
# A checker might take up to an 'interval' of time, so we can
1100
# expire at the soonest one interval after a checker was
1101
# started. Since the initial checker is delayed, the expire
1102
# time might have to be extended.
1103
now = datetime.datetime.utcnow()
1104
self.expires = now + delay + self.interval
1105
# Schedule a disable() at expire time
985
int(self.interval.total_seconds() * 1000),
986
self.start_checker)
987
# Schedule a disable() when 'timeout' has passed
1106
988
if self.disable_initiator_tag is not None:
1107
989
GLib.source_remove(self.disable_initiator_tag)
1108
990
self.disable_initiator_tag = GLib.timeout_add(
1109
int((self.expires - now).total_seconds() * 1000),
1110
self.disable)
991
int(self.timeout.total_seconds() * 1000), self.disable)
992
# Also start a new checker *right now*.
993
self.start_checker()
1111
994
1112
995
def checker_callback(self, source, condition, connection,
1113
996
command):
1114
997
"""The checker has completed, so take appropriate actions."""
998
self.checker_callback_tag = None
999
self.checker = None
1115
1000
# Read return code from connection (see call_pipe)
1116
1001
returncode = connection.recv()
1117
1002
connection.close()
1118
if self.checker is not None:
1119
self.checker.join()
1120
self.checker_callback_tag = None
1121
self.checker = None
1122
1003
1123
1004
if returncode >= 0:
1124
1005
self.last_checker_status = returncode
1125
1006
self.last_checker_signal = None
1126
1007
if self.last_checker_status == 0:
1127
log.info("Checker for %(name)s succeeded", vars(self))
1008
logger.info("Checker for %(name)s succeeded",
1009
vars(self))
1128
1010
self.checked_ok()
1129
1011
else:
1130
log.info("Checker for %(name)s failed", vars(self))
1012
logger.info("Checker for %(name)s failed", vars(self))
1131
1013
else:
1132
1014
self.last_checker_status = -1
1133
1015
self.last_checker_signal = -returncode
1134
log.warning("Checker for %(name)s crashed?", vars(self))
1016
logger.warning("Checker for %(name)s crashed?",
1017
vars(self))
1135
1018
return False
1136
1019
1137
1020
def checked_ok(self):
1156
1039
def need_approval(self):
1157
1040
self.last_approval_request = datetime.datetime.utcnow()
1158
1041
1159
def start_checker(self, start_was_randomized=False):
1042
def start_checker(self):
1160
1043
"""Start a new checker subprocess if one is not running.
1161
1044
1162
1045
If a checker already exists, leave it running and do
1171
1054
# should be.
1172
1055
1173
1056
if self.checker is not None and not self.checker.is_alive():
1174
log.warning("Checker was not alive; joining")
1057
logger.warning("Checker was not alive; joining")
1175
1058
self.checker.join()
1176
1059
self.checker = None
1177
1060
# Start a new checker if needed
1178
1061
if self.checker is None:
1179
1062
# Escape attributes for the shell
1180
1063
escaped_attrs = {
1181
attr: shlex.quote(str(getattr(self, attr)))
1064
attr: re.escape(str(getattr(self, attr)))
1182
1065
for attr in self.runtime_expansions}
1183
1066
try:
1184
1067
command = self.checker_command % escaped_attrs
1185
1068
except TypeError as error:
1186
log.error('Could not format string "%s"',
1187
self.checker_command, exc_info=error)
1069
logger.error('Could not format string "%s"',
1070
self.checker_command,
1071
exc_info=error)
1188
1072
return True # Try again later
1189
1073
self.current_checker_command = command
1190
log.info("Starting checker %r for %s", command, self.name)
1074
logger.info("Starting checker %r for %s", command,
1075
self.name)
1191
1076
# We don't need to redirect stdout and stderr, since
1192
1077
# in normal mode, that is already done by daemon(),
1193
1078
# and in debug mode we don't want to. (Stdin is
1209
1094
kwargs=popen_args)
1210
1095
self.checker.start()
1211
1096
self.checker_callback_tag = GLib.io_add_watch(
1212
GLib.IOChannel.unix_new(pipe[0].fileno()),
1213
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1097
pipe[0].fileno(), GLib.IO_IN,
1214
1098
self.checker_callback, pipe[0], command)
1215
if start_was_randomized:
1216
# We were started after a random delay; Schedule a new
1217
# checker to be started an 'interval' from now, and every
1218
# interval from then on.
1219
now = datetime.datetime.utcnow()
1220
self.checker_initiator_tag = GLib.timeout_add(
1221
int(self.interval.total_seconds() * 1000),
1222
self.start_checker)
1223
self.expires = max(self.expires, now + self.interval)
1224
# Don't start a new checker again after same random delay
1225
return False
1226
1099
# Re-run this periodically if run by GLib.timeout_add
1227
1100
return True
1228
1101
1233
1106
self.checker_callback_tag = None
1234
1107
if getattr(self, "checker", None) is None:
1235
1108
return
1236
log.debug("Stopping checker for %(name)s", vars(self))
1109
logger.debug("Stopping checker for %(name)s", vars(self))
1237
1110
self.checker.terminate()
1238
1111
self.checker = None
1239
1112
1266
1139
func._dbus_name = func.__name__
1267
1140
if func._dbus_name.endswith("_dbus_property"):
1268
1141
func._dbus_name = func._dbus_name[:-14]
1269
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1142
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1270
1143
return func
1271
1144
1272
1145
return decorator
1361
1234
1362
1235
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1363
1236
out_signature="s",
1364
path_keyword="object_path",
1365
connection_keyword="connection")
1237
path_keyword='object_path',
1238
connection_keyword='connection')
1366
1239
def Introspect(self, object_path, connection):
1367
1240
"""Overloading of standard D-Bus method.
1368
1241
1417
1290
document.unlink()
1418
1291
except (AttributeError, xml.dom.DOMException,
1419
1292
xml.parsers.expat.ExpatError) as error:
1420
log.error("Failed to override Introspection method",
1421
exc_info=error)
1293
logger.error("Failed to override Introspection method",
1294
exc_info=error)
1422
1295
return xmlstring
1423
1296
1424
1297
1482
1355
raise ValueError("Byte arrays not supported for non-"
1483
1356
"'ay' signature {!r}"
1484
1357
.format(prop._dbus_signature))
1485
value = dbus.ByteArray(bytes(value))
1358
value = dbus.ByteArray(b''.join(chr(byte)
1359
for byte in value))
1486
1360
prop(value)
1487
1361
1488
1362
@dbus.service.method(dbus.PROPERTIES_IFACE,
1521
1395
1522
1396
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1523
1397
out_signature="s",
1524
path_keyword="object_path",
1525
connection_keyword="connection")
1398
path_keyword='object_path',
1399
connection_keyword='connection')
1526
1400
def Introspect(self, object_path, connection):
1527
1401
"""Overloading of standard D-Bus method.
1528
1402
1584
1458
document.unlink()
1585
1459
except (AttributeError, xml.dom.DOMException,
1586
1460
xml.parsers.expat.ExpatError) as error:
1587
log.error("Failed to override Introspection method",
1588
exc_info=error)
1461
logger.error("Failed to override Introspection method",
1462
exc_info=error)
1589
1463
return xmlstring
1590
1464
1591
1465
1623
1497
1624
1498
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1625
1499
out_signature="s",
1626
path_keyword="object_path",
1627
connection_keyword="connection")
1500
path_keyword='object_path',
1501
connection_keyword='connection')
1628
1502
def Introspect(self, object_path, connection):
1629
1503
"""Overloading of standard D-Bus method.
1630
1504
1655
1529
document.unlink()
1656
1530
except (AttributeError, xml.dom.DOMException,
1657
1531
xml.parsers.expat.ExpatError) as error:
1658
log.error("Failed to override Introspection method",
1659
exc_info=error)
1532
logger.error("Failed to override Introspection method",
1533
exc_info=error)
1660
1534
return xmlstring
1661
1535
1662
1536
2126
2000
def Name_dbus_property(self):
2127
2001
return dbus.String(self.name)
2128
2002
2129
# KeyID - property
2130
@dbus_annotations(
2131
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2132
@dbus_service_property(_interface, signature="s", access="read")
2133
def KeyID_dbus_property(self):
2134
return dbus.String(self.key_id)
2135
2136
2003
# Fingerprint - property
2137
2004
@dbus_annotations(
2138
2005
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2293
2160
del _interface
2294
2161
2295
2162
2296
class ProxyClient:
2297
def __init__(self, child_pipe, key_id, fpr, address):
2163
class ProxyClient(object):
2164
def __init__(self, child_pipe, fpr, address):
2298
2165
self._pipe = child_pipe
2299
self._pipe.send(("init", key_id, fpr, address))
2166
self._pipe.send(('init', fpr, address))
2300
2167
if not self._pipe.recv():
2301
raise KeyError(key_id or fpr)
2168
raise KeyError(fpr)
2302
2169
2303
2170
def __getattribute__(self, name):
2304
if name == "_pipe":
2171
if name == '_pipe':
2305
2172
return super(ProxyClient, self).__getattribute__(name)
2306
self._pipe.send(("getattr", name))
2173
self._pipe.send(('getattr', name))
2307
2174
data = self._pipe.recv()
2308
if data[0] == "data":
2175
if data[0] == 'data':
2309
2176
return data[1]
2310
if data[0] == "function":
2177
if data[0] == 'function':
2311
2178
2312
2179
def func(*args, **kwargs):
2313
self._pipe.send(("funcall", name, args, kwargs))
2180
self._pipe.send(('funcall', name, args, kwargs))
2314
2181
return self._pipe.recv()[1]
2315
2182
2316
2183
return func
2317
2184
2318
2185
def __setattr__(self, name, value):
2319
if name == "_pipe":
2186
if name == '_pipe':
2320
2187
return super(ProxyClient, self).__setattr__(name, value)
2321
self._pipe.send(("setattr", name, value))
2188
self._pipe.send(('setattr', name, value))
2322
2189
2323
2190
2324
2191
class ClientHandler(socketserver.BaseRequestHandler, object):
2329
2196
2330
2197
def handle(self):
2331
2198
with contextlib.closing(self.server.child_pipe) as child_pipe:
2332
log.info("TCP connection from: %s",
2333
str(self.client_address))
2334
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2199
logger.info("TCP connection from: %s",
2200
str(self.client_address))
2201
logger.debug("Pipe FD: %d",
2202
self.server.child_pipe.fileno())
2335
2203
2336
2204
session = gnutls.ClientSession(self.request)
2337
2205
2338
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2206
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2339
2207
# "+AES-256-CBC", "+SHA1",
2340
2208
# "+COMP-NULL", "+CTYPE-OPENPGP",
2341
2209
# "+DHE-DSS"))
2343
2211
priority = self.server.gnutls_priority
2344
2212
if priority is None:
2345
2213
priority = "NORMAL"
2346
gnutls.priority_set_direct(session,
2347
priority.encode("utf-8"), None)
2214
gnutls.priority_set_direct(session._c_object,
2215
priority.encode("utf-8"),
2216
None)
2348
2217
2349
2218
# Start communication using the Mandos protocol
2350
2219
# Get protocol number
2351
2220
line = self.request.makefile().readline()
2352
log.debug("Protocol version: %r", line)
2221
logger.debug("Protocol version: %r", line)
2353
2222
try:
2354
2223
if int(line.strip().split()[0]) > 1:
2355
2224
raise RuntimeError(line)
2356
2225
except (ValueError, IndexError, RuntimeError) as error:
2357
log.error("Unknown protocol version: %s", error)
2226
logger.error("Unknown protocol version: %s", error)
2358
2227
return
2359
2228
2360
2229
# Start GnuTLS connection
2361
2230
try:
2362
2231
session.handshake()
2363
2232
except gnutls.Error as error:
2364
log.warning("Handshake failed: %s", error)
2233
logger.warning("Handshake failed: %s", error)
2365
2234
# Do not run session.bye() here: the session is not
2366
2235
# established. Just abandon the request.
2367
2236
return
2368
log.debug("Handshake succeeded")
2237
logger.debug("Handshake succeeded")
2369
2238
2370
2239
approval_required = False
2371
2240
try:
2372
if gnutls.has_rawpk:
2373
fpr = b""
2374
try:
2375
key_id = self.key_id(
2376
self.peer_certificate(session))
2377
except (TypeError, gnutls.Error) as error:
2378
log.warning("Bad certificate: %s", error)
2379
return
2380
log.debug("Key ID: %s",
2381
key_id.decode("utf-8",
2382
errors="replace"))
2383
2384
else:
2385
key_id = b""
2386
try:
2387
fpr = self.fingerprint(
2388
self.peer_certificate(session))
2389
except (TypeError, gnutls.Error) as error:
2390
log.warning("Bad certificate: %s", error)
2391
return
2392
log.debug("Fingerprint: %s", fpr)
2393
2394
try:
2395
client = ProxyClient(child_pipe, key_id, fpr,
2241
try:
2242
fpr = self.fingerprint(
2243
self.peer_certificate(session))
2244
except (TypeError, gnutls.Error) as error:
2245
logger.warning("Bad certificate: %s", error)
2246
return
2247
logger.debug("Fingerprint: %s", fpr)
2248
2249
try:
2250
client = ProxyClient(child_pipe, fpr,
2396
2251
self.client_address)
2397
2252
except KeyError:
2398
2253
return
2404
2259
2405
2260
while True:
2406
2261
if not client.enabled:
2407
log.info("Client %s is disabled", client.name)
2262
logger.info("Client %s is disabled",
2263
client.name)
2408
2264
if self.server.use_dbus:
2409
2265
# Emit D-Bus signal
2410
2266
client.Rejected("Disabled")
2414
2270
# We are approved or approval is disabled
2415
2271
break
2416
2272
elif client.approved is None:
2417
log.info("Client %s needs approval",
2418
client.name)
2273
logger.info("Client %s needs approval",
2274
client.name)
2419
2275
if self.server.use_dbus:
2420
2276
# Emit D-Bus signal
2421
2277
client.NeedApproval(
2422
2278
client.approval_delay.total_seconds()
2423
2279
* 1000, client.approved_by_default)
2424
2280
else:
2425
log.warning("Client %s was not approved",
2426
client.name)
2281
logger.warning("Client %s was not approved",
2282
client.name)
2427
2283
if self.server.use_dbus:
2428
2284
# Emit D-Bus signal
2429
2285
client.Rejected("Denied")
2437
2293
time2 = datetime.datetime.now()
2438
2294
if (time2 - time) >= delay:
2439
2295
if not client.approved_by_default:
2440
log.warning("Client %s timed out while"
2441
" waiting for approval",
2442
client.name)
2296
logger.warning("Client %s timed out while"
2297
" waiting for approval",
2298
client.name)
2443
2299
if self.server.use_dbus:
2444
2300
# Emit D-Bus signal
2445
2301
client.Rejected("Approval timed out")
2452
2308
try:
2453
2309
session.send(client.secret)
2454
2310
except gnutls.Error as error:
2455
log.warning("gnutls send failed", exc_info=error)
2311
logger.warning("gnutls send failed",
2312
exc_info=error)
2456
2313
return
2457
2314
2458
log.info("Sending secret to %s", client.name)
2315
logger.info("Sending secret to %s", client.name)
2459
2316
# bump the timeout using extended_timeout
2460
2317
client.bump_timeout(client.extended_timeout)
2461
2318
if self.server.use_dbus:
2468
2325
try:
2469
2326
session.bye()
2470
2327
except gnutls.Error as error:
2471
log.warning("GnuTLS bye failed", exc_info=error)
2328
logger.warning("GnuTLS bye failed",
2329
exc_info=error)
2472
2330
2473
2331
@staticmethod
2474
2332
def peer_certificate(session):
2475
"Return the peer's certificate as a bytestring"
2476
try:
2477
cert_type = gnutls.certificate_type_get2(
2478
session, gnutls.CTYPE_PEERS)
2479
except AttributeError:
2480
cert_type = gnutls.certificate_type_get(session)
2481
if gnutls.has_rawpk:
2482
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2483
else:
2484
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2485
# If not a valid certificate type...
2486
if cert_type not in valid_cert_types:
2487
log.info("Cert type %r not in %r", cert_type,
2488
valid_cert_types)
2333
"Return the peer's OpenPGP certificate as a bytestring"
2334
# If not an OpenPGP certificate...
2335
if (gnutls.certificate_type_get(session._c_object)
2336
!= gnutls.CRT_OPENPGP):
2489
2337
# ...return invalid data
2490
2338
return b""
2491
2339
list_size = ctypes.c_uint(1)
2492
2340
cert_list = (gnutls.certificate_get_peers
2493
(session, ctypes.byref(list_size)))
2341
(session._c_object, ctypes.byref(list_size)))
2494
2342
if not bool(cert_list) and list_size.value != 0:
2495
2343
raise gnutls.Error("error getting peer certificate")
2496
2344
if list_size.value == 0:
2499
2347
return ctypes.string_at(cert.data, cert.size)
2500
2348
2501
2349
@staticmethod
2502
def key_id(certificate):
2503
"Convert a certificate bytestring to a hexdigit key ID"
2504
# New GnuTLS "datum" with the public key
2505
datum = gnutls.datum_t(
2506
ctypes.cast(ctypes.c_char_p(certificate),
2507
ctypes.POINTER(ctypes.c_ubyte)),
2508
ctypes.c_uint(len(certificate)))
2509
# XXX all these need to be created in the gnutls "module"
2510
# New empty GnuTLS certificate
2511
pubkey = gnutls.pubkey_t()
2512
gnutls.pubkey_init(ctypes.byref(pubkey))
2513
# Import the raw public key into the certificate
2514
gnutls.pubkey_import(pubkey,
2515
ctypes.byref(datum),
2516
gnutls.X509_FMT_DER)
2517
# New buffer for the key ID
2518
buf = ctypes.create_string_buffer(32)
2519
buf_len = ctypes.c_size_t(len(buf))
2520
# Get the key ID from the raw public key into the buffer
2521
gnutls.pubkey_get_key_id(
2522
pubkey,
2523
gnutls.KEYID_USE_SHA256,
2524
ctypes.cast(ctypes.byref(buf),
2525
ctypes.POINTER(ctypes.c_ubyte)),
2526
ctypes.byref(buf_len))
2527
# Deinit the certificate
2528
gnutls.pubkey_deinit(pubkey)
2529
2530
# Convert the buffer to a Python bytestring
2531
key_id = ctypes.string_at(buf, buf_len.value)
2532
# Convert the bytestring to hexadecimal notation
2533
hex_key_id = binascii.hexlify(key_id).upper()
2534
return hex_key_id
2535
2536
@staticmethod
2537
2350
def fingerprint(openpgp):
2538
2351
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2539
2352
# New GnuTLS "datum" with the OpenPGP public key
2553
2366
ctypes.byref(crtverify))
2554
2367
if crtverify.value != 0:
2555
2368
gnutls.openpgp_crt_deinit(crt)
2556
raise gnutls.CertificateSecurityError(code
2557
=crtverify.value)
2369
raise gnutls.CertificateSecurityError("Verify failed")
2558
2370
# New buffer for the fingerprint
2559
2371
buf = ctypes.create_string_buffer(20)
2560
2372
buf_len = ctypes.c_size_t()
2570
2382
return hex_fpr
2571
2383
2572
2384
2573
class MultiprocessingMixIn:
2385
class MultiprocessingMixIn(object):
2574
2386
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2575
2387
2576
2388
def sub_process_main(self, request, address):
2588
2400
return proc
2589
2401
2590
2402
2591
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2403
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2592
2404
""" adds a pipe to the MixIn """
2593
2405
2594
2406
def process_request(self, request, client_address):
2609
2421
2610
2422
2611
2423
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2612
socketserver.TCPServer):
2613
"""IPv6-capable TCP server. Accepts None as address and/or port
2424
socketserver.TCPServer, object):
2425
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2614
2426
2615
2427
Attributes:
2616
2428
enabled: Boolean; whether this server is activated yet
2667
2479
if SO_BINDTODEVICE is None:
2668
2480
# Fall back to a hard-coded value which seems to be
2669
2481
# common enough.
2670
log.warning("SO_BINDTODEVICE not found, trying 25")
2482
logger.warning("SO_BINDTODEVICE not found, trying 25")
2671
2483
SO_BINDTODEVICE = 25
2672
2484
try:
2673
2485
self.socket.setsockopt(
2675
2487
(self.interface + "\0").encode("utf-8"))
2676
2488
except socket.error as error:
2677
2489
if error.errno == errno.EPERM:
2678
log.error("No permission to bind to interface %s",
2679
self.interface)
2490
logger.error("No permission to bind to"
2491
" interface %s", self.interface)
2680
2492
elif error.errno == errno.ENOPROTOOPT:
2681
log.error("SO_BINDTODEVICE not available; cannot"
2682
" bind to interface %s", self.interface)
2493
logger.error("SO_BINDTODEVICE not available;"
2494
" cannot bind to interface %s",
2495
self.interface)
2683
2496
elif error.errno == errno.ENODEV:
2684
log.error("Interface %s does not exist, cannot"
2685
" bind", self.interface)
2497
logger.error("Interface %s does not exist,"
2498
" cannot bind", self.interface)
2686
2499
else:
2687
2500
raise
2688
2501
# Only bind(2) the socket if we really need to.
2689
2502
if self.server_address[0] or self.server_address[1]:
2690
if self.server_address[1]:
2691
self.allow_reuse_address = True
2692
2503
if not self.server_address[0]:
2693
2504
if self.address_family == socket.AF_INET6:
2694
2505
any_address = "::" # in6addr_any
2747
2558
def add_pipe(self, parent_pipe, proc):
2748
2559
# Call "handle_ipc" for both data and EOF events
2749
2560
GLib.io_add_watch(
2750
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2751
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2561
parent_pipe.fileno(),
2562
GLib.IO_IN | GLib.IO_HUP,
2752
2563
functools.partial(self.handle_ipc,
2753
2564
parent_pipe=parent_pipe,
2754
2565
proc=proc))
2767
2578
request = parent_pipe.recv()
2768
2579
command = request[0]
2769
2580
2770
if command == "init":
2771
key_id = request[1].decode("ascii")
2772
fpr = request[2].decode("ascii")
2773
address = request[3]
2581
if command == 'init':
2582
fpr = request[1].decode("ascii")
2583
address = request[2]
2774
2584
2775
2585
for c in self.clients.values():
2776
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2777
"27AE41E4649B934CA495991B7852B855"):
2778
continue
2779
if key_id and c.key_id == key_id:
2780
client = c
2781
break
2782
if fpr and c.fingerprint == fpr:
2586
if c.fingerprint == fpr:
2783
2587
client = c
2784
2588
break
2785
2589
else:
2786
log.info("Client not found for key ID: %s, address:"
2787
" %s", key_id or fpr, address)
2590
logger.info("Client not found for fingerprint: %s, ad"
2591
"dress: %s", fpr, address)
2788
2592
if self.use_dbus:
2789
2593
# Emit D-Bus signal
2790
mandos_dbus_service.ClientNotFound(key_id or fpr,
2594
mandos_dbus_service.ClientNotFound(fpr,
2791
2595
address[0])
2792
2596
parent_pipe.send(False)
2793
2597
return False
2794
2598
2795
2599
GLib.io_add_watch(
2796
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2797
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2600
parent_pipe.fileno(),
2601
GLib.IO_IN | GLib.IO_HUP,
2798
2602
functools.partial(self.handle_ipc,
2799
2603
parent_pipe=parent_pipe,
2800
2604
proc=proc,
2803
2607
# remove the old hook in favor of the new above hook on
2804
2608
# same fileno
2805
2609
return False
2806
if command == "funcall":
2610
if command == 'funcall':
2807
2611
funcname = request[1]
2808
2612
args = request[2]
2809
2613
kwargs = request[3]
2810
2614
2811
parent_pipe.send(("data", getattr(client_object,
2615
parent_pipe.send(('data', getattr(client_object,
2812
2616
funcname)(*args,
2813
2617
**kwargs)))
2814
2618
2815
if command == "getattr":
2619
if command == 'getattr':
2816
2620
attrname = request[1]
2817
2621
if isinstance(client_object.__getattribute__(attrname),
2818
collections.abc.Callable):
2819
parent_pipe.send(("function", ))
2622
collections.Callable):
2623
parent_pipe.send(('function', ))
2820
2624
else:
2821
2625
parent_pipe.send((
2822
"data", client_object.__getattribute__(attrname)))
2626
'data', client_object.__getattribute__(attrname)))
2823
2627
2824
if command == "setattr":
2628
if command == 'setattr':
2825
2629
attrname = request[1]
2826
2630
value = request[2]
2827
2631
setattr(client_object, attrname, value)
2832
2636
def rfc3339_duration_to_delta(duration):
2833
2637
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2834
2638
2835
>>> timedelta = datetime.timedelta
2836
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2837
True
2838
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2839
True
2840
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2841
True
2842
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2843
True
2844
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2845
True
2846
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2847
True
2848
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2849
True
2850
>>> del timedelta
2639
>>> rfc3339_duration_to_delta("P7D")
2640
datetime.timedelta(7)
2641
>>> rfc3339_duration_to_delta("PT60S")
2642
datetime.timedelta(0, 60)
2643
>>> rfc3339_duration_to_delta("PT60M")
2644
datetime.timedelta(0, 3600)
2645
>>> rfc3339_duration_to_delta("PT24H")
2646
datetime.timedelta(1)
2647
>>> rfc3339_duration_to_delta("P1W")
2648
datetime.timedelta(7)
2649
>>> rfc3339_duration_to_delta("PT5M30S")
2650
datetime.timedelta(0, 330)
2651
>>> rfc3339_duration_to_delta("P1DT3M20S")
2652
datetime.timedelta(1, 200)
2851
2653
"""
2852
2654
2853
2655
# Parsing an RFC 3339 duration with regular expressions is not
2933
2735
def string_to_delta(interval):
2934
2736
"""Parse a string and return a datetime.timedelta
2935
2737
2936
>>> string_to_delta("7d") == datetime.timedelta(7)
2937
True
2938
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2939
True
2940
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2941
True
2942
>>> string_to_delta("24h") == datetime.timedelta(1)
2943
True
2944
>>> string_to_delta("1w") == datetime.timedelta(7)
2945
True
2946
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2947
True
2738
>>> string_to_delta('7d')
2739
datetime.timedelta(7)
2740
>>> string_to_delta('60s')
2741
datetime.timedelta(0, 60)
2742
>>> string_to_delta('60m')
2743
datetime.timedelta(0, 3600)
2744
>>> string_to_delta('24h')
2745
datetime.timedelta(1)
2746
>>> string_to_delta('1w')
2747
datetime.timedelta(7)
2748
>>> string_to_delta('5m 30s')
2749
datetime.timedelta(0, 330)
2948
2750
"""
2949
2751
2950
2752
try:
3052
2854
3053
2855
options = parser.parse_args()
3054
2856
2857
if options.check:
2858
import doctest
2859
fail_count, test_count = doctest.testmod()
2860
sys.exit(os.EX_OK if fail_count == 0 else 1)
2861
3055
2862
# Default values for config file for server-global settings
3056
if gnutls.has_rawpk:
3057
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3058
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3059
else:
3060
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3061
":+SIGN-DSA-SHA256")
3062
2863
server_defaults = {"interface": "",
3063
2864
"address": "",
3064
2865
"port": "",
3065
2866
"debug": "False",
3066
"priority": priority,
2867
"priority":
2868
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2869
":+SIGN-DSA-SHA256",
3067
2870
"servicename": "Mandos",
3068
2871
"use_dbus": "True",
3069
2872
"use_ipv6": "True",
3074
2877
"foreground": "False",
3075
2878
"zeroconf": "True",
3076
2879
}
3077
del priority
3078
2880
3079
2881
# Parse config file for server-global settings
3080
server_config = configparser.ConfigParser(server_defaults)
2882
server_config = configparser.SafeConfigParser(server_defaults)
3081
2883
del server_defaults
3082
2884
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3083
# Convert the ConfigParser object to a dict
2885
# Convert the SafeConfigParser object to a dict
3084
2886
server_settings = server_config.defaults()
3085
2887
# Use the appropriate methods on the non-string config options
3086
2888
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3153
2955
3154
2956
if server_settings["servicename"] != "Mandos":
3155
2957
syslogger.setFormatter(
3156
logging.Formatter("Mandos ({}) [%(process)d]:"
3157
" %(levelname)s: %(message)s".format(
2958
logging.Formatter('Mandos ({}) [%(process)d]:'
2959
' %(levelname)s: %(message)s'.format(
3158
2960
server_settings["servicename"])))
3159
2961
3160
2962
# Parse config file with clients
3161
client_config = configparser.ConfigParser(Client.client_defaults)
2963
client_config = configparser.SafeConfigParser(Client
2964
.client_defaults)
3162
2965
client_config.read(os.path.join(server_settings["configdir"],
3163
2966
"clients.conf"))
3164
2967
3184
2987
try:
3185
2988
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3186
2989
except IOError as e:
3187
log.error("Could not open file %r", pidfilename,
3188
exc_info=e)
2990
logger.error("Could not open file %r", pidfilename,
2991
exc_info=e)
3189
2992
3190
2993
for name, group in (("_mandos", "_mandos"),
3191
2994
("mandos", "mandos"),
3202
3005
try:
3203
3006
os.setgid(gid)
3204
3007
os.setuid(uid)
3205
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3008
if debug:
3009
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3010
gid))
3206
3011
except OSError as error:
3207
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3208
os.strerror(error.errno))
3012
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3013
.format(uid, gid, os.strerror(error.errno)))
3209
3014
if error.errno != errno.EPERM:
3210
3015
raise
3211
3016
3218
3023
3219
3024
@gnutls.log_func
3220
3025
def debug_gnutls(level, string):
3221
log.debug("GnuTLS: %s",
3222
string[:-1].decode("utf-8", errors="replace"))
3026
logger.debug("GnuTLS: %s", string[:-1])
3223
3027
3224
3028
gnutls.global_set_log_function(debug_gnutls)
3225
3029
3234
3038
# Close all input and output, do double fork, etc.
3235
3039
daemon()
3236
3040
3237
if gi.version_info < (3, 10, 2):
3238
# multiprocessing will use threads, so before we use GLib we
3239
# need to inform GLib that threads will be used.
3240
GLib.threads_init()
3041
# multiprocessing will use threads, so before we use GLib we need
3042
# to inform GLib that threads will be used.
3043
GLib.threads_init()
3241
3044
3242
3045
global main_loop
3243
3046
# From the Avahi example code
3254
3057
"se.bsnet.fukt.Mandos", bus,
3255
3058
do_not_queue=True)
3256
3059
except dbus.exceptions.DBusException as e:
3257
log.error("Disabling D-Bus:", exc_info=e)
3060
logger.error("Disabling D-Bus:", exc_info=e)
3258
3061
use_dbus = False
3259
3062
server_settings["use_dbus"] = False
3260
3063
tcp_server.use_dbus = False
3319
3122
if isinstance(s, bytes)
3320
3123
else s) for s in
3321
3124
value["client_structure"]]
3322
# .name, .host, and .checker_command
3323
for k in ("name", "host", "checker_command"):
3125
# .name & .host
3126
for k in ("name", "host"):
3324
3127
if isinstance(value[k], bytes):
3325
3128
value[k] = value[k].decode("utf-8")
3326
if "key_id" not in value:
3327
value["key_id"] = ""
3328
elif "fingerprint" not in value:
3329
value["fingerprint"] = ""
3330
3129
# old_client_settings
3331
3130
# .keys()
3332
3131
old_client_settings = {
3336
3135
for key, value in
3337
3136
bytes_old_client_settings.items()}
3338
3137
del bytes_old_client_settings
3339
# .host and .checker_command
3138
# .host
3340
3139
for value in old_client_settings.values():
3341
for attribute in ("host", "checker_command"):
3342
if isinstance(value[attribute], bytes):
3343
value[attribute] = (value[attribute]
3344
.decode("utf-8"))
3140
if isinstance(value["host"], bytes):
3141
value["host"] = (value["host"]
3142
.decode("utf-8"))
3345
3143
os.remove(stored_state_path)
3346
3144
except IOError as e:
3347
3145
if e.errno == errno.ENOENT:
3348
log.warning("Could not load persistent state:"
3349
" %s", os.strerror(e.errno))
3146
logger.warning("Could not load persistent state:"
3147
" {}".format(os.strerror(e.errno)))
3350
3148
else:
3351
log.critical("Could not load persistent state:",
3352
exc_info=e)
3149
logger.critical("Could not load persistent state:",
3150
exc_info=e)
3353
3151
raise
3354
3152
except EOFError as e:
3355
log.warning("Could not load persistent state: EOFError:",
3356
exc_info=e)
3153
logger.warning("Could not load persistent state: "
3154
"EOFError:",
3155
exc_info=e)
3357
3156
3358
3157
with PGPEngine() as pgp:
3359
3158
for client_name, client in clients_data.items():
3386
3185
if client["enabled"]:
3387
3186
if datetime.datetime.utcnow() >= client["expires"]:
3388
3187
if not client["last_checked_ok"]:
3389
log.warning("disabling client %s - Client"
3390
" never performed a successful"
3391
" checker", client_name)
3188
logger.warning(
3189
"disabling client {} - Client never "
3190
"performed a successful checker".format(
3191
client_name))
3392
3192
client["enabled"] = False
3393
3193
elif client["last_checker_status"] != 0:
3394
log.warning("disabling client %s - Client"
3395
" last checker failed with error"
3396
" code %s", client_name,
3397
client["last_checker_status"])
3194
logger.warning(
3195
"disabling client {} - Client last"
3196
" checker failed with error code"
3197
" {}".format(
3198
client_name,
3199
client["last_checker_status"]))
3398
3200
client["enabled"] = False
3399
3201
else:
3400
3202
client["expires"] = (
3401
3203
datetime.datetime.utcnow()
3402
3204
+ client["timeout"])
3403
log.debug("Last checker succeeded, keeping %s"
3404
" enabled", client_name)
3205
logger.debug("Last checker succeeded,"
3206
" keeping {} enabled".format(
3207
client_name))
3405
3208
try:
3406
3209
client["secret"] = pgp.decrypt(
3407
3210
client["encrypted_secret"],
3408
3211
client_settings[client_name]["secret"])
3409
3212
except PGPError:
3410
3213
# If decryption fails, we use secret from new settings
3411
log.debug("Failed to decrypt %s old secret",
3412
client_name)
3214
logger.debug("Failed to decrypt {} old secret".format(
3215
client_name))
3413
3216
client["secret"] = (client_settings[client_name]
3414
3217
["secret"])
3415
3218
3429
3232
server_settings=server_settings)
3430
3233
3431
3234
if not tcp_server.clients:
3432
log.warning("No clients defined")
3235
logger.warning("No clients defined")
3433
3236
3434
3237
if not foreground:
3435
3238
if pidfile is not None:
3438
3241
with pidfile:
3439
3242
print(pid, file=pidfile)
3440
3243
except IOError:
3441
log.error("Could not write to file %r with PID %d",
3442
pidfilename, pid)
3244
logger.error("Could not write to file %r with PID %d",
3245
pidfilename, pid)
3443
3246
del pidfile
3444
3247
del pidfilename
3445
3248
3465
3268
pass
3466
3269
3467
3270
@dbus.service.signal(_interface, signature="ss")
3468
def ClientNotFound(self, key_id, address):
3271
def ClientNotFound(self, fingerprint, address):
3469
3272
"D-Bus signal"
3470
3273
pass
3471
3274
3595
3398
3596
3399
try:
3597
3400
with tempfile.NamedTemporaryFile(
3598
mode="wb",
3401
mode='wb',
3599
3402
suffix=".pickle",
3600
prefix="clients-",
3403
prefix='clients-',
3601
3404
dir=os.path.dirname(stored_state_path),
3602
3405
delete=False) as stored_state:
3603
3406
pickle.dump((clients, client_settings), stored_state,
3611
3414
except NameError:
3612
3415
pass
3613
3416
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3614
log.warning("Could not save persistent state: %s",
3615
os.strerror(e.errno))
3417
logger.warning("Could not save persistent state: {}"
3418
.format(os.strerror(e.errno)))
3616
3419
else:
3617
log.warning("Could not save persistent state:",
3618
exc_info=e)
3420
logger.warning("Could not save persistent state:",
3421
exc_info=e)
3619
3422
raise
3620
3423
3621
3424
# Delete all clients, and settings from config
3638
3441
mandos_dbus_service.client_added_signal(client)
3639
3442
# Need to initiate checking of clients
3640
3443
if client.enabled:
3641
client.init_checker(randomize_start=True)
3444
client.init_checker()
3642
3445
3643
3446
tcp_server.enable()
3644
3447
tcp_server.server_activate()
3647
3450
if zeroconf:
3648
3451
service.port = tcp_server.socket.getsockname()[1]
3649
3452
if use_ipv6:
3650
log.info("Now listening on address %r, port %d, flowinfo %d,"
3651
" scope_id %d", *tcp_server.socket.getsockname())
3453
logger.info("Now listening on address %r, port %d,"
3454
" flowinfo %d, scope_id %d",
3455
*tcp_server.socket.getsockname())
3652
3456
else: # IPv4
3653
log.info("Now listening on address %r, port %d",
3654
*tcp_server.socket.getsockname())
3457
logger.info("Now listening on address %r, port %d",
3458
*tcp_server.socket.getsockname())
3655
3459
3656
3460
# service.interface = tcp_server.socket.getsockname()[3]
3657
3461
3661
3465
try:
3662
3466
service.activate()
3663
3467
except dbus.exceptions.DBusException as error:
3664
log.critical("D-Bus Exception", exc_info=error)
3468
logger.critical("D-Bus Exception", exc_info=error)
3665
3469
cleanup()
3666
3470
sys.exit(1)
3667
3471
# End of Avahi example code
3668
3472
3669
GLib.io_add_watch(
3670
GLib.IOChannel.unix_new(tcp_server.fileno()),
3671
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3672
lambda *args, **kwargs: (tcp_server.handle_request
3673
(*args[2:], **kwargs) or True))
3473
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3474
lambda *args, **kwargs:
3475
(tcp_server.handle_request
3476
(*args[2:], **kwargs) or True))
3674
3477
3675
log.debug("Starting main loop")
3478
logger.debug("Starting main loop")
3676
3479
main_loop.run()
3677
3480
except AvahiError as error:
3678
log.critical("Avahi Error", exc_info=error)
3481
logger.critical("Avahi Error", exc_info=error)
3679
3482
cleanup()
3680
3483
sys.exit(1)
3681
3484
except KeyboardInterrupt:
3682
3485
if debug:
3683
3486
print("", file=sys.stderr)
3684
log.debug("Server received KeyboardInterrupt")
3685
log.debug("Server exiting")
3487
logger.debug("Server received KeyboardInterrupt")
3488
logger.debug("Server exiting")
3686
3489
# Must run before the D-Bus bus name gets deregistered
3687
3490
cleanup()
3688
3491
3689
3690
def parse_test_args():
3691
# type: () -> argparse.Namespace
3692
parser = argparse.ArgumentParser(add_help=False)
3693
parser.add_argument("--check", action="store_true")
3694
parser.add_argument("--prefix", )
3695
args, unknown_args = parser.parse_known_args()
3696
if args.check:
3697
# Remove test options from sys.argv
3698
sys.argv[1:] = unknown_args
3699
return args
3700
3701
# Add all tests from doctest strings
3702
def load_tests(loader, tests, none):
3703
import doctest
3704
tests.addTests(doctest.DocTestSuite())
3705
return tests
3706
3707
if __name__ == "__main__":
3708
options = parse_test_args()
3709
try:
3710
if options.check:
3711
extra_test_prefix = options.prefix
3712
if extra_test_prefix is not None:
3713
if not (unittest.main(argv=[""], exit=False)
3714
.result.wasSuccessful()):
3715
sys.exit(1)
3716
class ExtraTestLoader(unittest.TestLoader):
3717
testMethodPrefix = extra_test_prefix
3718
# Call using ./scriptname --test [--verbose]
3719
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3720
else:
3721
unittest.main(argv=[""])
3722
else:
3723
main()
3724
finally:
3725
logging.shutdown()
3726
3727
# Local Variables:
3728
# run-tests:
3729
# (lambda (&optional extra)
3730
# (if (not (funcall run-tests-in-test-buffer default-directory
3731
# extra))
3732
# (funcall show-test-buffer-in-test-window)
3733
# (funcall remove-test-window)
3734
# (if extra (message "Extra tests run successfully!"))))
3735
# run-tests-in-test-buffer:
3736
# (lambda (dir &optional extra)
3737
# (with-current-buffer (get-buffer-create "*Test*")
3738
# (setq buffer-read-only nil
3739
# default-directory dir)
3740
# (erase-buffer)
3741
# (compilation-mode))
3742
# (let ((process-result
3743
# (let ((inhibit-read-only t))
3744
# (process-file-shell-command
3745
# (funcall get-command-line extra) nil "*Test*"))))
3746
# (and (numberp process-result)
3747
# (= process-result 0))))
3748
# get-command-line:
3749
# (lambda (&optional extra)
3750
# (let ((quoted-script
3751
# (shell-quote-argument (funcall get-script-name))))
3752
# (format
3753
# (concat "%s --check" (if extra " --prefix=atest" ""))
3754
# quoted-script)))
3755
# get-script-name:
3756
# (lambda ()
3757
# (if (fboundp 'file-local-name)
3758
# (file-local-name (buffer-file-name))
3759
# (or (file-remote-p (buffer-file-name) 'localname)
3760
# (buffer-file-name))))
3761
# remove-test-window:
3762
# (lambda ()
3763
# (let ((test-window (get-buffer-window "*Test*")))
3764
# (if test-window (delete-window test-window))))
3765
# show-test-buffer-in-test-window:
3766
# (lambda ()
3767
# (when (not (get-buffer-window-list "*Test*"))
3768
# (setq next-error-last-buffer (get-buffer "*Test*"))
3769
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3770
# (display-buffer-overriding-action
3771
# `((display-buffer-in-side-window) (side . ,side)
3772
# (window-height . fit-window-to-buffer)
3773
# (window-width . fit-window-to-buffer))))
3774
# (display-buffer "*Test*"))))
3775
# eval:
3776
# (progn
3777
# (let* ((run-extra-tests (lambda () (interactive)
3778
# (funcall run-tests t)))
3779
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3780
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3781
# (setq minor-mode-overriding-map-alist
3782
# (cons `(run-tests . ,outer-keymap)
3783
# minor-mode-overriding-map-alist)))
3784
# (add-hook 'after-save-hook run-tests 90 t))
3785
# End:
3492
3493
if __name__ == '__main__':
3494
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0