To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 921
- compare with another revision
- download diff
- download tarball
- view history from revision 921
- Committer: Teddy Hogeborn
- Date: 2018-02-06 20:03:50 UTC
- Revision ID: teddy@recompile.se-20180206200350-jzvorueb731xkph3
Update Debian Debhelper compatibility version.
* (debian/compat): Change to "10".
* (debian/compat): Change to "10".
- files added:
- initramfs-tools-hook-conf
- files removed:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
14
# Copyright © 2008-2017 Teddy Hogeborn
15
# Copyright © 2008-2017 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
39
40
except ImportError:
40
41
pass
41
42
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
43
try:
48
44
import SocketServer as socketserver
49
45
except ImportError:
50
46
import socketserver
51
47
import socket
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
import ConfigParser as configparser
56
53
except ImportError:
57
54
import configparser
55
import sys
58
56
import re
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import random
81
import shlex
82
80
83
81
import dbus
84
82
import dbus.service
85
import gi
86
83
from gi.repository import GLib
87
84
from dbus.mainloop.glib import DBusGMainLoop
88
85
import ctypes
90
87
import xml.dom.minidom
91
88
import inspect
92
89
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Add os.set_inheritable if it does not exist
114
try:
115
os.set_inheritable
116
except AttributeError:
117
def set_inheritable(fd, inheritable):
118
flags = fcntl.fcntl(fd, fcntl.F_GETFD)
119
if inheritable and ((flags & fcntl.FD_CLOEXEC) != 0):
120
fcntl.fcntl(fd, fcntl.F_SETFL, flags & ~fcntl.FD_CLOEXEC)
121
elif (not inheritable) and ((flags & fcntl.FD_CLOEXEC) == 0):
122
fcntl.fcntl(fd, fcntl.F_SETFL, flags | fcntl.FD_CLOEXEC)
123
os.set_inheritable = set_inheritable
124
del set_inheritable
125
126
# Show warnings by default
127
if not sys.warnoptions:
128
import warnings
129
warnings.simplefilter("default")
130
131
90
# Try to find the value of SO_BINDTODEVICE:
132
91
try:
133
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
153
112
# No value found
154
113
SO_BINDTODEVICE = None
155
114
156
if sys.version_info < (3, 2):
157
configparser.Configparser = configparser.SafeConfigParser
115
if sys.version_info.major == 2:
116
str = unicode
158
117
159
version = "1.8.17"
118
version = "1.7.16"
160
119
stored_state_file = "clients.pickle"
161
120
162
log = logging.getLogger(os.path.basename(sys.argv[0]))
163
logging.captureWarnings(True) # Show warnings via the logging system
121
logger = logging.getLogger()
164
122
syslogger = None
165
123
166
124
try:
202
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
203
161
address="/dev/log"))
204
162
syslogger.setFormatter(logging.Formatter
205
("Mandos [%(process)d]: %(levelname)s:"
206
" %(message)s"))
207
log.addHandler(syslogger)
163
('Mandos [%(process)d]: %(levelname)s:'
164
' %(message)s'))
165
logger.addHandler(syslogger)
208
166
209
167
if debug:
210
168
console = logging.StreamHandler()
211
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
212
" [%(process)d]:"
213
" %(levelname)s:"
214
" %(message)s"))
215
log.addHandler(console)
216
log.setLevel(level)
169
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
170
' [%(process)d]:'
171
' %(levelname)s:'
172
' %(message)s'))
173
logger.addHandler(console)
174
logger.setLevel(level)
217
175
218
176
219
177
class PGPError(Exception):
221
179
pass
222
180
223
181
224
class PGPEngine:
182
class PGPEngine(object):
225
183
"""A simple class for OpenPGP symmetric encryption & decryption"""
226
184
227
185
def __init__(self):
231
189
output = subprocess.check_output(["gpgconf"])
232
190
for line in output.splitlines():
233
191
name, text, path = line.split(b":")
234
if name == b"gpg":
192
if name == "gpg":
235
193
self.gpg = path
236
194
break
237
195
except OSError as e:
238
196
if e.errno != errno.ENOENT:
239
197
raise
240
self.gnupgargs = ["--batch",
241
"--homedir", self.tempdir,
242
"--force-mdc",
243
"--quiet"]
198
self.gnupgargs = ['--batch',
199
'--homedir', self.tempdir,
200
'--force-mdc',
201
'--quiet']
244
202
# Only GPG version 1 has the --no-use-agent option.
245
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
203
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
246
204
self.gnupgargs.append("--no-use-agent")
247
205
248
206
def __enter__(self):
285
243
dir=self.tempdir) as passfile:
286
244
passfile.write(passphrase)
287
245
passfile.flush()
288
proc = subprocess.Popen([self.gpg, "--symmetric",
289
"--passphrase-file",
246
proc = subprocess.Popen([self.gpg, '--symmetric',
247
'--passphrase-file',
290
248
passfile.name]
291
249
+ self.gnupgargs,
292
250
stdin=subprocess.PIPE,
303
261
dir=self.tempdir) as passfile:
304
262
passfile.write(passphrase)
305
263
passfile.flush()
306
proc = subprocess.Popen([self.gpg, "--decrypt",
307
"--passphrase-file",
264
proc = subprocess.Popen([self.gpg, '--decrypt',
265
'--passphrase-file',
308
266
passfile.name]
309
267
+ self.gnupgargs,
310
268
stdin=subprocess.PIPE,
317
275
318
276
319
277
# Pretend that we have an Avahi module
320
class avahi:
321
"""This isn't so much a class as it is a module-like namespace."""
278
class Avahi(object):
279
"""This isn't so much a class as it is a module-like namespace.
280
It is instantiated once, and simulates having an Avahi module."""
322
281
IF_UNSPEC = -1 # avahi-common/address.h
323
282
PROTO_UNSPEC = -1 # avahi-common/address.h
324
283
PROTO_INET = 0 # avahi-common/address.h
328
287
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
329
288
DBUS_PATH_SERVER = "/"
330
289
331
@staticmethod
332
def string_array_to_txt_array(t):
290
def string_array_to_txt_array(self, t):
333
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
334
292
for s in t), signature="ay")
335
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
340
298
SERVER_RUNNING = 2 # avahi-common/defs.h
341
299
SERVER_COLLISION = 3 # avahi-common/defs.h
342
300
SERVER_FAILURE = 4 # avahi-common/defs.h
301
avahi = Avahi()
343
302
344
303
345
304
class AvahiError(Exception):
357
316
pass
358
317
359
318
360
class AvahiService:
319
class AvahiService(object):
361
320
"""An Avahi (Zeroconf) service.
362
321
363
322
Attributes:
364
323
interface: integer; avahi.IF_UNSPEC or an interface index.
365
324
Used to optionally bind to the specified interface.
366
name: string; Example: "Mandos"
367
type: string; Example: "_mandos._tcp".
325
name: string; Example: 'Mandos'
326
type: string; Example: '_mandos._tcp'.
368
327
See <https://www.iana.org/assignments/service-names-port-numbers>
369
328
port: integer; what port to announce
370
329
TXT: list of strings; TXT record for the service
407
366
def rename(self, remove=True):
408
367
"""Derived from the Avahi example code"""
409
368
if self.rename_count >= self.max_renames:
410
log.critical("No suitable Zeroconf service name found"
411
" after %i retries, exiting.",
412
self.rename_count)
369
logger.critical("No suitable Zeroconf service name found"
370
" after %i retries, exiting.",
371
self.rename_count)
413
372
raise AvahiServiceError("Too many renames")
414
373
self.name = str(
415
374
self.server.GetAlternativeServiceName(self.name))
416
375
self.rename_count += 1
417
log.info("Changing Zeroconf service name to %r ...",
418
self.name)
376
logger.info("Changing Zeroconf service name to %r ...",
377
self.name)
419
378
if remove:
420
379
self.remove()
421
380
try:
423
382
except dbus.exceptions.DBusException as error:
424
383
if (error.get_dbus_name()
425
384
== "org.freedesktop.Avahi.CollisionError"):
426
log.info("Local Zeroconf service name collision.")
385
logger.info("Local Zeroconf service name collision.")
427
386
return self.rename(remove=False)
428
387
else:
429
log.critical("D-Bus Exception", exc_info=error)
388
logger.critical("D-Bus Exception", exc_info=error)
430
389
self.cleanup()
431
390
os._exit(1)
432
391
448
407
avahi.DBUS_INTERFACE_ENTRY_GROUP)
449
408
self.entry_group_state_changed_match = (
450
409
self.group.connect_to_signal(
451
"StateChanged", self.entry_group_state_changed))
452
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
453
self.name, self.type)
410
'StateChanged', self.entry_group_state_changed))
411
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
412
self.name, self.type)
454
413
self.group.AddService(
455
414
self.interface,
456
415
self.protocol,
463
422
464
423
def entry_group_state_changed(self, state, error):
465
424
"""Derived from the Avahi example code"""
466
log.debug("Avahi entry group state change: %i", state)
425
logger.debug("Avahi entry group state change: %i", state)
467
426
468
427
if state == avahi.ENTRY_GROUP_ESTABLISHED:
469
log.debug("Zeroconf service established.")
428
logger.debug("Zeroconf service established.")
470
429
elif state == avahi.ENTRY_GROUP_COLLISION:
471
log.info("Zeroconf service name collision.")
430
logger.info("Zeroconf service name collision.")
472
431
self.rename()
473
432
elif state == avahi.ENTRY_GROUP_FAILURE:
474
log.critical("Avahi: Error in group state changed %s",
475
str(error))
433
logger.critical("Avahi: Error in group state changed %s",
434
str(error))
476
435
raise AvahiGroupError("State changed: {!s}".format(error))
477
436
478
437
def cleanup(self):
488
447
489
448
def server_state_changed(self, state, error=None):
490
449
"""Derived from the Avahi example code"""
491
log.debug("Avahi server state change: %i", state)
450
logger.debug("Avahi server state change: %i", state)
492
451
bad_states = {
493
452
avahi.SERVER_INVALID: "Zeroconf server invalid",
494
453
avahi.SERVER_REGISTERING: None,
498
457
if state in bad_states:
499
458
if bad_states[state] is not None:
500
459
if error is None:
501
log.error(bad_states[state])
460
logger.error(bad_states[state])
502
461
else:
503
log.error(bad_states[state] + ": %r", error)
462
logger.error(bad_states[state] + ": %r", error)
504
463
self.cleanup()
505
464
elif state == avahi.SERVER_RUNNING:
506
465
try:
508
467
except dbus.exceptions.DBusException as error:
509
468
if (error.get_dbus_name()
510
469
== "org.freedesktop.Avahi.CollisionError"):
511
log.info("Local Zeroconf service name collision.")
470
logger.info("Local Zeroconf service name"
471
" collision.")
512
472
return self.rename(remove=False)
513
473
else:
514
log.critical("D-Bus Exception", exc_info=error)
474
logger.critical("D-Bus Exception", exc_info=error)
515
475
self.cleanup()
516
476
os._exit(1)
517
477
else:
518
478
if error is None:
519
log.debug("Unknown state: %r", state)
479
logger.debug("Unknown state: %r", state)
520
480
else:
521
log.debug("Unknown state: %r: %r", state, error)
481
logger.debug("Unknown state: %r: %r", state, error)
522
482
523
483
def activate(self):
524
484
"""Derived from the Avahi example code"""
536
496
class AvahiServiceToSyslog(AvahiService):
537
497
def rename(self, *args, **kwargs):
538
498
"""Add the new name to the syslog messages"""
539
ret = super(AvahiServiceToSyslog, self).rename(*args,
499
ret = super(AvahiServiceToSyslog, self).rename(self, *args,
540
500
**kwargs)
541
501
syslogger.setFormatter(logging.Formatter(
542
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
502
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
543
503
.format(self.name)))
544
504
return ret
545
505
546
506
547
507
# Pretend that we have a GnuTLS module
548
class gnutls:
549
"""This isn't so much a class as it is a module-like namespace."""
508
class GnuTLS(object):
509
"""This isn't so much a class as it is a module-like namespace.
510
It is instantiated once, and simulates having a GnuTLS module."""
550
511
551
512
library = ctypes.util.find_library("gnutls")
552
513
if library is None:
553
514
library = ctypes.util.find_library("gnutls-deb0")
554
515
_library = ctypes.cdll.LoadLibrary(library)
555
516
del library
517
_need_version = b"3.3.0"
518
519
def __init__(self):
520
# Need to use "self" here, since this method is called before
521
# the assignment to the "gnutls" global variable happens.
522
if self.check_version(self._need_version) is None:
523
raise self.Error("Needs GnuTLS {} or later"
524
.format(self._need_version))
556
525
557
526
# Unless otherwise indicated, the constants and types below are
558
527
# all from the gnutls/gnutls.h C header file.
562
531
E_INTERRUPTED = -52
563
532
E_AGAIN = -28
564
533
CRT_OPENPGP = 2
565
CRT_RAWPK = 3
566
534
CLIENT = 2
567
535
SHUT_RDWR = 0
568
536
CRD_CERTIFICATE = 1
569
537
E_NO_CERTIFICATE_FOUND = -49
570
X509_FMT_DER = 0
571
NO_TICKETS = 1<<10
572
ENABLE_RAWPK = 1<<18
573
CTYPE_PEERS = 3
574
KEYID_USE_SHA256 = 1 # gnutls/x509.h
575
538
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
576
539
577
540
# Types
578
class _session_int(ctypes.Structure):
541
class session_int(ctypes.Structure):
579
542
_fields_ = []
580
session_t = ctypes.POINTER(_session_int)
543
session_t = ctypes.POINTER(session_int)
581
544
582
545
class certificate_credentials_st(ctypes.Structure):
583
546
_fields_ = []
586
549
certificate_type_t = ctypes.c_int
587
550
588
551
class datum_t(ctypes.Structure):
589
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
590
("size", ctypes.c_uint)]
552
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
553
('size', ctypes.c_uint)]
591
554
592
class _openpgp_crt_int(ctypes.Structure):
555
class openpgp_crt_int(ctypes.Structure):
593
556
_fields_ = []
594
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
557
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
595
558
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
596
559
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
597
560
credentials_type_t = ctypes.c_int
600
563
601
564
# Exceptions
602
565
class Error(Exception):
566
# We need to use the class name "GnuTLS" here, since this
567
# exception might be raised from within GnuTLS.__init__,
568
# which is called before the assignment to the "gnutls"
569
# global variable has happened.
603
570
def __init__(self, message=None, code=None, args=()):
604
571
# Default usage is by a message string, but if a return
605
572
# code is passed, convert it to a string with
606
573
# gnutls.strerror()
607
574
self.code = code
608
575
if message is None and code is not None:
609
message = gnutls.strerror(code).decode(
610
"utf-8", errors="replace")
611
return super(gnutls.Error, self).__init__(
576
message = GnuTLS.strerror(code)
577
return super(GnuTLS.Error, self).__init__(
612
578
message, *args)
613
579
614
580
class CertificateSecurityError(Error):
615
581
pass
616
582
617
class PointerTo:
618
def __init__(self, cls):
619
self.cls = cls
620
621
def from_param(self, obj):
622
if not isinstance(obj, self.cls):
623
raise TypeError("Not of type {}: {!r}"
624
.format(self.cls.__name__, obj))
625
return ctypes.byref(obj.from_param(obj))
626
627
class CastToVoidPointer:
628
def __init__(self, cls):
629
self.cls = cls
630
631
def from_param(self, obj):
632
if not isinstance(obj, self.cls):
633
raise TypeError("Not of type {}: {!r}"
634
.format(self.cls.__name__, obj))
635
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
636
637
class With_from_param:
638
@classmethod
639
def from_param(cls, obj):
640
return obj._as_parameter_
641
642
583
# Classes
643
class Credentials(With_from_param):
584
class Credentials(object):
644
585
def __init__(self):
645
self._as_parameter_ = gnutls.certificate_credentials_t()
646
gnutls.certificate_allocate_credentials(self)
586
self._c_object = gnutls.certificate_credentials_t()
587
gnutls.certificate_allocate_credentials(
588
ctypes.byref(self._c_object))
647
589
self.type = gnutls.CRD_CERTIFICATE
648
590
649
591
def __del__(self):
650
gnutls.certificate_free_credentials(self)
592
gnutls.certificate_free_credentials(self._c_object)
651
593
652
class ClientSession(With_from_param):
594
class ClientSession(object):
653
595
def __init__(self, socket, credentials=None):
654
self._as_parameter_ = gnutls.session_t()
655
gnutls_flags = gnutls.CLIENT
656
if gnutls.check_version(b"3.5.6"):
657
gnutls_flags |= gnutls.NO_TICKETS
658
if gnutls.has_rawpk:
659
gnutls_flags |= gnutls.ENABLE_RAWPK
660
gnutls.init(self, gnutls_flags)
661
del gnutls_flags
662
gnutls.set_default_priority(self)
663
gnutls.transport_set_ptr(self, socket.fileno())
664
gnutls.handshake_set_private_extensions(self, True)
596
self._c_object = gnutls.session_t()
597
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
598
gnutls.set_default_priority(self._c_object)
599
gnutls.transport_set_ptr(self._c_object, socket.fileno())
600
gnutls.handshake_set_private_extensions(self._c_object,
601
True)
665
602
self.socket = socket
666
603
if credentials is None:
667
604
credentials = gnutls.Credentials()
668
gnutls.credentials_set(self, credentials.type,
669
credentials)
605
gnutls.credentials_set(self._c_object, credentials.type,
606
ctypes.cast(credentials._c_object,
607
ctypes.c_void_p))
670
608
self.credentials = credentials
671
609
672
610
def __del__(self):
673
gnutls.deinit(self)
611
gnutls.deinit(self._c_object)
674
612
675
613
def handshake(self):
676
return gnutls.handshake(self)
614
return gnutls.handshake(self._c_object)
677
615
678
616
def send(self, data):
679
617
data = bytes(data)
680
618
data_len = len(data)
681
619
while data_len > 0:
682
data_len -= gnutls.record_send(self, data[-data_len:],
620
data_len -= gnutls.record_send(self._c_object,
621
data[-data_len:],
683
622
data_len)
684
623
685
624
def bye(self):
686
return gnutls.bye(self, gnutls.SHUT_RDWR)
625
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
687
626
688
627
# Error handling functions
689
628
def _error_code(result):
690
629
"""A function to raise exceptions on errors, suitable
691
for the "restype" attribute on ctypes functions"""
692
if result >= gnutls.E_SUCCESS:
630
for the 'restype' attribute on ctypes functions"""
631
if result >= 0:
693
632
return result
694
633
if result == gnutls.E_NO_CERTIFICATE_FOUND:
695
634
raise gnutls.CertificateSecurityError(code=result)
696
635
raise gnutls.Error(code=result)
697
636
698
def _retry_on_error(result, func, arguments,
699
_error_code=_error_code):
637
def _retry_on_error(result, func, arguments):
700
638
"""A function to retry on some errors, suitable
701
for the "errcheck" attribute on ctypes functions"""
702
while result < gnutls.E_SUCCESS:
639
for the 'errcheck' attribute on ctypes functions"""
640
while result < 0:
703
641
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
704
642
return _error_code(result)
705
643
result = func(*arguments)
710
648
711
649
# Functions
712
650
priority_set_direct = _library.gnutls_priority_set_direct
713
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
651
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
714
652
ctypes.POINTER(ctypes.c_char_p)]
715
653
priority_set_direct.restype = _error_code
716
654
717
655
init = _library.gnutls_init
718
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
656
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
719
657
init.restype = _error_code
720
658
721
659
set_default_priority = _library.gnutls_set_default_priority
722
set_default_priority.argtypes = [ClientSession]
660
set_default_priority.argtypes = [session_t]
723
661
set_default_priority.restype = _error_code
724
662
725
663
record_send = _library.gnutls_record_send
726
record_send.argtypes = [ClientSession, ctypes.c_void_p,
664
record_send.argtypes = [session_t, ctypes.c_void_p,
727
665
ctypes.c_size_t]
728
666
record_send.restype = ctypes.c_ssize_t
729
667
record_send.errcheck = _retry_on_error
731
669
certificate_allocate_credentials = (
732
670
_library.gnutls_certificate_allocate_credentials)
733
671
certificate_allocate_credentials.argtypes = [
734
PointerTo(Credentials)]
672
ctypes.POINTER(certificate_credentials_t)]
735
673
certificate_allocate_credentials.restype = _error_code
736
674
737
675
certificate_free_credentials = (
738
676
_library.gnutls_certificate_free_credentials)
739
certificate_free_credentials.argtypes = [Credentials]
677
certificate_free_credentials.argtypes = [
678
certificate_credentials_t]
740
679
certificate_free_credentials.restype = None
741
680
742
681
handshake_set_private_extensions = (
743
682
_library.gnutls_handshake_set_private_extensions)
744
handshake_set_private_extensions.argtypes = [ClientSession,
683
handshake_set_private_extensions.argtypes = [session_t,
745
684
ctypes.c_int]
746
685
handshake_set_private_extensions.restype = None
747
686
748
687
credentials_set = _library.gnutls_credentials_set
749
credentials_set.argtypes = [ClientSession, credentials_type_t,
750
CastToVoidPointer(Credentials)]
688
credentials_set.argtypes = [session_t, credentials_type_t,
689
ctypes.c_void_p]
751
690
credentials_set.restype = _error_code
752
691
753
692
strerror = _library.gnutls_strerror
755
694
strerror.restype = ctypes.c_char_p
756
695
757
696
certificate_type_get = _library.gnutls_certificate_type_get
758
certificate_type_get.argtypes = [ClientSession]
697
certificate_type_get.argtypes = [session_t]
759
698
certificate_type_get.restype = _error_code
760
699
761
700
certificate_get_peers = _library.gnutls_certificate_get_peers
762
certificate_get_peers.argtypes = [ClientSession,
701
certificate_get_peers.argtypes = [session_t,
763
702
ctypes.POINTER(ctypes.c_uint)]
764
703
certificate_get_peers.restype = ctypes.POINTER(datum_t)
765
704
772
711
global_set_log_function.restype = None
773
712
774
713
deinit = _library.gnutls_deinit
775
deinit.argtypes = [ClientSession]
714
deinit.argtypes = [session_t]
776
715
deinit.restype = None
777
716
778
717
handshake = _library.gnutls_handshake
779
handshake.argtypes = [ClientSession]
780
handshake.restype = ctypes.c_int
718
handshake.argtypes = [session_t]
719
handshake.restype = _error_code
781
720
handshake.errcheck = _retry_on_error
782
721
783
722
transport_set_ptr = _library.gnutls_transport_set_ptr
784
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
723
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
785
724
transport_set_ptr.restype = None
786
725
787
726
bye = _library.gnutls_bye
788
bye.argtypes = [ClientSession, close_request_t]
789
bye.restype = ctypes.c_int
727
bye.argtypes = [session_t, close_request_t]
728
bye.restype = _error_code
790
729
bye.errcheck = _retry_on_error
791
730
792
731
check_version = _library.gnutls_check_version
793
732
check_version.argtypes = [ctypes.c_char_p]
794
733
check_version.restype = ctypes.c_char_p
795
734
796
_need_version = b"3.3.0"
797
if check_version(_need_version) is None:
798
raise self.Error("Needs GnuTLS {} or later"
799
.format(_need_version))
800
801
_tls_rawpk_version = b"3.6.6"
802
has_rawpk = bool(check_version(_tls_rawpk_version))
803
804
if has_rawpk:
805
# Types
806
class pubkey_st(ctypes.Structure):
807
_fields = []
808
pubkey_t = ctypes.POINTER(pubkey_st)
809
810
x509_crt_fmt_t = ctypes.c_int
811
812
# All the function declarations below are from
813
# gnutls/abstract.h
814
pubkey_init = _library.gnutls_pubkey_init
815
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
816
pubkey_init.restype = _error_code
817
818
pubkey_import = _library.gnutls_pubkey_import
819
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
820
x509_crt_fmt_t]
821
pubkey_import.restype = _error_code
822
823
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
824
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
825
ctypes.POINTER(ctypes.c_ubyte),
826
ctypes.POINTER(ctypes.c_size_t)]
827
pubkey_get_key_id.restype = _error_code
828
829
pubkey_deinit = _library.gnutls_pubkey_deinit
830
pubkey_deinit.argtypes = [pubkey_t]
831
pubkey_deinit.restype = None
832
else:
833
# All the function declarations below are from
834
# gnutls/openpgp.h
835
836
openpgp_crt_init = _library.gnutls_openpgp_crt_init
837
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
838
openpgp_crt_init.restype = _error_code
839
840
openpgp_crt_import = _library.gnutls_openpgp_crt_import
841
openpgp_crt_import.argtypes = [openpgp_crt_t,
842
ctypes.POINTER(datum_t),
843
openpgp_crt_fmt_t]
844
openpgp_crt_import.restype = _error_code
845
846
openpgp_crt_verify_self = \
847
_library.gnutls_openpgp_crt_verify_self
848
openpgp_crt_verify_self.argtypes = [
849
openpgp_crt_t,
850
ctypes.c_uint,
851
ctypes.POINTER(ctypes.c_uint),
852
]
853
openpgp_crt_verify_self.restype = _error_code
854
855
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
856
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
857
openpgp_crt_deinit.restype = None
858
859
openpgp_crt_get_fingerprint = (
860
_library.gnutls_openpgp_crt_get_fingerprint)
861
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
862
ctypes.c_void_p,
863
ctypes.POINTER(
864
ctypes.c_size_t)]
865
openpgp_crt_get_fingerprint.restype = _error_code
866
867
if check_version(b"3.6.4"):
868
certificate_type_get2 = _library.gnutls_certificate_type_get2
869
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
870
certificate_type_get2.restype = _error_code
735
# All the function declarations below are from gnutls/openpgp.h
736
737
openpgp_crt_init = _library.gnutls_openpgp_crt_init
738
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
739
openpgp_crt_init.restype = _error_code
740
741
openpgp_crt_import = _library.gnutls_openpgp_crt_import
742
openpgp_crt_import.argtypes = [openpgp_crt_t,
743
ctypes.POINTER(datum_t),
744
openpgp_crt_fmt_t]
745
openpgp_crt_import.restype = _error_code
746
747
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
748
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
749
ctypes.POINTER(ctypes.c_uint)]
750
openpgp_crt_verify_self.restype = _error_code
751
752
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
753
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
754
openpgp_crt_deinit.restype = None
755
756
openpgp_crt_get_fingerprint = (
757
_library.gnutls_openpgp_crt_get_fingerprint)
758
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
759
ctypes.c_void_p,
760
ctypes.POINTER(
761
ctypes.c_size_t)]
762
openpgp_crt_get_fingerprint.restype = _error_code
871
763
872
764
# Remove non-public functions
873
765
del _error_code, _retry_on_error
766
# Create the global "gnutls" object, simulating a module
767
gnutls = GnuTLS()
874
768
875
769
876
770
def call_pipe(connection, # : multiprocessing.Connection
884
778
connection.close()
885
779
886
780
887
class Client:
781
class Client(object):
888
782
"""A representation of a client host served by this server.
889
783
890
784
Attributes:
891
approved: bool(); None if not yet approved/disapproved
785
approved: bool(); 'None' if not yet approved/disapproved
892
786
approval_delay: datetime.timedelta(); Time to wait for approval
893
787
approval_duration: datetime.timedelta(); Duration of one approval
894
checker: multiprocessing.Process(); a running checker process used
895
to see if the client lives. None if no process is
896
running.
788
checker: subprocess.Popen(); a running checker process used
789
to see if the client lives.
790
'None' if no process is running.
897
791
checker_callback_tag: a GLib event source tag, or None
898
792
checker_command: string; External command which is run to check
899
793
if client lives. %() expansions are done at
907
801
disable_initiator_tag: a GLib event source tag, or None
908
802
enabled: bool()
909
803
fingerprint: string (40 or 32 hexadecimal digits); used to
910
uniquely identify an OpenPGP client
911
key_id: string (64 hexadecimal digits); used to uniquely identify
912
a client using raw public keys
804
uniquely identify the client
913
805
host: string; available for use by the checker command
914
806
interval: datetime.timedelta(); How often to start a new checker
915
807
last_approval_request: datetime.datetime(); (UTC) or None
933
825
"""
934
826
935
827
runtime_expansions = ("approval_delay", "approval_duration",
936
"created", "enabled", "expires", "key_id",
828
"created", "enabled", "expires",
937
829
"fingerprint", "host", "interval",
938
830
"last_approval_request", "last_checked_ok",
939
831
"last_enabled", "name", "timeout")
969
861
client["enabled"] = config.getboolean(client_name,
970
862
"enabled")
971
863
972
# Uppercase and remove spaces from key_id and fingerprint
973
# for later comparison purposes with return value from the
974
# key_id() and fingerprint() functions
975
client["key_id"] = (section.get("key_id", "").upper()
976
.replace(" ", ""))
977
client["fingerprint"] = (section.get("fingerprint",
978
"").upper()
864
# Uppercase and remove spaces from fingerprint for later
865
# comparison purposes with return value from the
866
# fingerprint() function
867
client["fingerprint"] = (section["fingerprint"].upper()
979
868
.replace(" ", ""))
980
if not (client["key_id"] or client["fingerprint"]):
981
log.error("Skipping client %s without key_id or"
982
" fingerprint", client_name)
983
del settings[client_name]
984
continue
985
869
if "secret" in section:
986
870
client["secret"] = codecs.decode(section["secret"]
987
871
.encode("utf-8"),
1028
912
self.last_enabled = None
1029
913
self.expires = None
1030
914
1031
log.debug("Creating client %r", self.name)
1032
log.debug(" Key ID: %s", self.key_id)
1033
log.debug(" Fingerprint: %s", self.fingerprint)
915
logger.debug("Creating client %r", self.name)
916
logger.debug(" Fingerprint: %s", self.fingerprint)
1034
917
self.created = settings.get("created",
1035
918
datetime.datetime.utcnow())
1036
919
1064
947
if getattr(self, "enabled", False):
1065
948
# Already enabled
1066
949
return
950
self.expires = datetime.datetime.utcnow() + self.timeout
1067
951
self.enabled = True
1068
952
self.last_enabled = datetime.datetime.utcnow()
1069
953
self.init_checker()
1074
958
if not getattr(self, "enabled", False):
1075
959
return False
1076
960
if not quiet:
1077
log.info("Disabling client %s", self.name)
961
logger.info("Disabling client %s", self.name)
1078
962
if getattr(self, "disable_initiator_tag", None) is not None:
1079
963
GLib.source_remove(self.disable_initiator_tag)
1080
964
self.disable_initiator_tag = None
1092
976
def __del__(self):
1093
977
self.disable()
1094
978
1095
def init_checker(self, randomize_start=False):
1096
# Schedule a new checker to be started a randomly selected
1097
# time (a fraction of 'interval') from now. This spreads out
1098
# the startup of checkers over time when the server is
1099
# started.
979
def init_checker(self):
980
# Schedule a new checker to be started an 'interval' from now,
981
# and every interval from then on.
1100
982
if self.checker_initiator_tag is not None:
1101
983
GLib.source_remove(self.checker_initiator_tag)
1102
interval_milliseconds = int(self.interval.total_seconds()
1103
* 1000)
1104
if randomize_start:
1105
delay_milliseconds = random.randrange(
1106
interval_milliseconds + 1)
1107
else:
1108
delay_milliseconds = interval_milliseconds
1109
984
self.checker_initiator_tag = GLib.timeout_add(
1110
delay_milliseconds, self.start_checker, randomize_start)
1111
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1112
# A checker might take up to an 'interval' of time, so we can
1113
# expire at the soonest one interval after a checker was
1114
# started. Since the initial checker is delayed, the expire
1115
# time might have to be extended.
1116
now = datetime.datetime.utcnow()
1117
self.expires = now + delay + self.interval
1118
# Schedule a disable() at expire time
985
int(self.interval.total_seconds() * 1000),
986
self.start_checker)
987
# Schedule a disable() when 'timeout' has passed
1119
988
if self.disable_initiator_tag is not None:
1120
989
GLib.source_remove(self.disable_initiator_tag)
1121
990
self.disable_initiator_tag = GLib.timeout_add(
1122
int((self.expires - now).total_seconds() * 1000),
1123
self.disable)
991
int(self.timeout.total_seconds() * 1000), self.disable)
992
# Also start a new checker *right now*.
993
self.start_checker()
1124
994
1125
995
def checker_callback(self, source, condition, connection,
1126
996
command):
1127
997
"""The checker has completed, so take appropriate actions."""
998
self.checker_callback_tag = None
999
self.checker = None
1128
1000
# Read return code from connection (see call_pipe)
1129
1001
returncode = connection.recv()
1130
1002
connection.close()
1131
if self.checker is not None:
1132
self.checker.join()
1133
self.checker_callback_tag = None
1134
self.checker = None
1135
1003
1136
1004
if returncode >= 0:
1137
1005
self.last_checker_status = returncode
1138
1006
self.last_checker_signal = None
1139
1007
if self.last_checker_status == 0:
1140
log.info("Checker for %(name)s succeeded", vars(self))
1008
logger.info("Checker for %(name)s succeeded",
1009
vars(self))
1141
1010
self.checked_ok()
1142
1011
else:
1143
log.info("Checker for %(name)s failed", vars(self))
1012
logger.info("Checker for %(name)s failed", vars(self))
1144
1013
else:
1145
1014
self.last_checker_status = -1
1146
1015
self.last_checker_signal = -returncode
1147
log.warning("Checker for %(name)s crashed?", vars(self))
1016
logger.warning("Checker for %(name)s crashed?",
1017
vars(self))
1148
1018
return False
1149
1019
1150
1020
def checked_ok(self):
1169
1039
def need_approval(self):
1170
1040
self.last_approval_request = datetime.datetime.utcnow()
1171
1041
1172
def start_checker(self, start_was_randomized=False):
1042
def start_checker(self):
1173
1043
"""Start a new checker subprocess if one is not running.
1174
1044
1175
1045
If a checker already exists, leave it running and do
1184
1054
# should be.
1185
1055
1186
1056
if self.checker is not None and not self.checker.is_alive():
1187
log.warning("Checker was not alive; joining")
1057
logger.warning("Checker was not alive; joining")
1188
1058
self.checker.join()
1189
1059
self.checker = None
1190
1060
# Start a new checker if needed
1191
1061
if self.checker is None:
1192
1062
# Escape attributes for the shell
1193
1063
escaped_attrs = {
1194
attr: shlex.quote(str(getattr(self, attr)))
1064
attr: re.escape(str(getattr(self, attr)))
1195
1065
for attr in self.runtime_expansions}
1196
1066
try:
1197
1067
command = self.checker_command % escaped_attrs
1198
1068
except TypeError as error:
1199
log.error('Could not format string "%s"',
1200
self.checker_command, exc_info=error)
1069
logger.error('Could not format string "%s"',
1070
self.checker_command,
1071
exc_info=error)
1201
1072
return True # Try again later
1202
1073
self.current_checker_command = command
1203
log.info("Starting checker %r for %s", command, self.name)
1074
logger.info("Starting checker %r for %s", command,
1075
self.name)
1204
1076
# We don't need to redirect stdout and stderr, since
1205
1077
# in normal mode, that is already done by daemon(),
1206
1078
# and in debug mode we don't want to. (Stdin is
1222
1094
kwargs=popen_args)
1223
1095
self.checker.start()
1224
1096
self.checker_callback_tag = GLib.io_add_watch(
1225
GLib.IOChannel.unix_new(pipe[0].fileno()),
1226
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1097
pipe[0].fileno(), GLib.IO_IN,
1227
1098
self.checker_callback, pipe[0], command)
1228
if start_was_randomized:
1229
# We were started after a random delay; Schedule a new
1230
# checker to be started an 'interval' from now, and every
1231
# interval from then on.
1232
now = datetime.datetime.utcnow()
1233
self.checker_initiator_tag = GLib.timeout_add(
1234
int(self.interval.total_seconds() * 1000),
1235
self.start_checker)
1236
self.expires = max(self.expires, now + self.interval)
1237
# Don't start a new checker again after same random delay
1238
return False
1239
1099
# Re-run this periodically if run by GLib.timeout_add
1240
1100
return True
1241
1101
1246
1106
self.checker_callback_tag = None
1247
1107
if getattr(self, "checker", None) is None:
1248
1108
return
1249
log.debug("Stopping checker for %(name)s", vars(self))
1109
logger.debug("Stopping checker for %(name)s", vars(self))
1250
1110
self.checker.terminate()
1251
1111
self.checker = None
1252
1112
1279
1139
func._dbus_name = func.__name__
1280
1140
if func._dbus_name.endswith("_dbus_property"):
1281
1141
func._dbus_name = func._dbus_name[:-14]
1282
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1142
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1283
1143
return func
1284
1144
1285
1145
return decorator
1374
1234
1375
1235
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1376
1236
out_signature="s",
1377
path_keyword="object_path",
1378
connection_keyword="connection")
1237
path_keyword='object_path',
1238
connection_keyword='connection')
1379
1239
def Introspect(self, object_path, connection):
1380
1240
"""Overloading of standard D-Bus method.
1381
1241
1430
1290
document.unlink()
1431
1291
except (AttributeError, xml.dom.DOMException,
1432
1292
xml.parsers.expat.ExpatError) as error:
1433
log.error("Failed to override Introspection method",
1434
exc_info=error)
1293
logger.error("Failed to override Introspection method",
1294
exc_info=error)
1435
1295
return xmlstring
1436
1296
1437
1297
1495
1355
raise ValueError("Byte arrays not supported for non-"
1496
1356
"'ay' signature {!r}"
1497
1357
.format(prop._dbus_signature))
1498
value = dbus.ByteArray(bytes(value))
1358
value = dbus.ByteArray(b''.join(chr(byte)
1359
for byte in value))
1499
1360
prop(value)
1500
1361
1501
1362
@dbus.service.method(dbus.PROPERTIES_IFACE,
1534
1395
1535
1396
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1536
1397
out_signature="s",
1537
path_keyword="object_path",
1538
connection_keyword="connection")
1398
path_keyword='object_path',
1399
connection_keyword='connection')
1539
1400
def Introspect(self, object_path, connection):
1540
1401
"""Overloading of standard D-Bus method.
1541
1402
1597
1458
document.unlink()
1598
1459
except (AttributeError, xml.dom.DOMException,
1599
1460
xml.parsers.expat.ExpatError) as error:
1600
log.error("Failed to override Introspection method",
1601
exc_info=error)
1461
logger.error("Failed to override Introspection method",
1462
exc_info=error)
1602
1463
return xmlstring
1603
1464
1604
1465
1636
1497
1637
1498
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1638
1499
out_signature="s",
1639
path_keyword="object_path",
1640
connection_keyword="connection")
1500
path_keyword='object_path',
1501
connection_keyword='connection')
1641
1502
def Introspect(self, object_path, connection):
1642
1503
"""Overloading of standard D-Bus method.
1643
1504
1668
1529
document.unlink()
1669
1530
except (AttributeError, xml.dom.DOMException,
1670
1531
xml.parsers.expat.ExpatError) as error:
1671
log.error("Failed to override Introspection method",
1672
exc_info=error)
1532
logger.error("Failed to override Introspection method",
1533
exc_info=error)
1673
1534
return xmlstring
1674
1535
1675
1536
2139
2000
def Name_dbus_property(self):
2140
2001
return dbus.String(self.name)
2141
2002
2142
# KeyID - property
2143
@dbus_annotations(
2144
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2145
@dbus_service_property(_interface, signature="s", access="read")
2146
def KeyID_dbus_property(self):
2147
return dbus.String(self.key_id)
2148
2149
2003
# Fingerprint - property
2150
2004
@dbus_annotations(
2151
2005
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2306
2160
del _interface
2307
2161
2308
2162
2309
class ProxyClient:
2310
def __init__(self, child_pipe, key_id, fpr, address):
2163
class ProxyClient(object):
2164
def __init__(self, child_pipe, fpr, address):
2311
2165
self._pipe = child_pipe
2312
self._pipe.send(("init", key_id, fpr, address))
2166
self._pipe.send(('init', fpr, address))
2313
2167
if not self._pipe.recv():
2314
raise KeyError(key_id or fpr)
2168
raise KeyError(fpr)
2315
2169
2316
2170
def __getattribute__(self, name):
2317
if name == "_pipe":
2171
if name == '_pipe':
2318
2172
return super(ProxyClient, self).__getattribute__(name)
2319
self._pipe.send(("getattr", name))
2173
self._pipe.send(('getattr', name))
2320
2174
data = self._pipe.recv()
2321
if data[0] == "data":
2175
if data[0] == 'data':
2322
2176
return data[1]
2323
if data[0] == "function":
2177
if data[0] == 'function':
2324
2178
2325
2179
def func(*args, **kwargs):
2326
self._pipe.send(("funcall", name, args, kwargs))
2180
self._pipe.send(('funcall', name, args, kwargs))
2327
2181
return self._pipe.recv()[1]
2328
2182
2329
2183
return func
2330
2184
2331
2185
def __setattr__(self, name, value):
2332
if name == "_pipe":
2186
if name == '_pipe':
2333
2187
return super(ProxyClient, self).__setattr__(name, value)
2334
self._pipe.send(("setattr", name, value))
2188
self._pipe.send(('setattr', name, value))
2335
2189
2336
2190
2337
2191
class ClientHandler(socketserver.BaseRequestHandler, object):
2342
2196
2343
2197
def handle(self):
2344
2198
with contextlib.closing(self.server.child_pipe) as child_pipe:
2345
log.info("TCP connection from: %s",
2346
str(self.client_address))
2347
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2199
logger.info("TCP connection from: %s",
2200
str(self.client_address))
2201
logger.debug("Pipe FD: %d",
2202
self.server.child_pipe.fileno())
2348
2203
2349
2204
session = gnutls.ClientSession(self.request)
2350
2205
2351
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2206
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2352
2207
# "+AES-256-CBC", "+SHA1",
2353
2208
# "+COMP-NULL", "+CTYPE-OPENPGP",
2354
2209
# "+DHE-DSS"))
2356
2211
priority = self.server.gnutls_priority
2357
2212
if priority is None:
2358
2213
priority = "NORMAL"
2359
gnutls.priority_set_direct(session,
2360
priority.encode("utf-8"), None)
2214
gnutls.priority_set_direct(session._c_object,
2215
priority.encode("utf-8"),
2216
None)
2361
2217
2362
2218
# Start communication using the Mandos protocol
2363
2219
# Get protocol number
2364
2220
line = self.request.makefile().readline()
2365
log.debug("Protocol version: %r", line)
2221
logger.debug("Protocol version: %r", line)
2366
2222
try:
2367
2223
if int(line.strip().split()[0]) > 1:
2368
2224
raise RuntimeError(line)
2369
2225
except (ValueError, IndexError, RuntimeError) as error:
2370
log.error("Unknown protocol version: %s", error)
2226
logger.error("Unknown protocol version: %s", error)
2371
2227
return
2372
2228
2373
2229
# Start GnuTLS connection
2374
2230
try:
2375
2231
session.handshake()
2376
2232
except gnutls.Error as error:
2377
log.warning("Handshake failed: %s", error)
2233
logger.warning("Handshake failed: %s", error)
2378
2234
# Do not run session.bye() here: the session is not
2379
2235
# established. Just abandon the request.
2380
2236
return
2381
log.debug("Handshake succeeded")
2237
logger.debug("Handshake succeeded")
2382
2238
2383
2239
approval_required = False
2384
2240
try:
2385
if gnutls.has_rawpk:
2386
fpr = b""
2387
try:
2388
key_id = self.key_id(
2389
self.peer_certificate(session))
2390
except (TypeError, gnutls.Error) as error:
2391
log.warning("Bad certificate: %s", error)
2392
return
2393
log.debug("Key ID: %s",
2394
key_id.decode("utf-8",
2395
errors="replace"))
2396
2397
else:
2398
key_id = b""
2399
try:
2400
fpr = self.fingerprint(
2401
self.peer_certificate(session))
2402
except (TypeError, gnutls.Error) as error:
2403
log.warning("Bad certificate: %s", error)
2404
return
2405
log.debug("Fingerprint: %s", fpr)
2406
2407
try:
2408
client = ProxyClient(child_pipe, key_id, fpr,
2241
try:
2242
fpr = self.fingerprint(
2243
self.peer_certificate(session))
2244
except (TypeError, gnutls.Error) as error:
2245
logger.warning("Bad certificate: %s", error)
2246
return
2247
logger.debug("Fingerprint: %s", fpr)
2248
2249
try:
2250
client = ProxyClient(child_pipe, fpr,
2409
2251
self.client_address)
2410
2252
except KeyError:
2411
2253
return
2417
2259
2418
2260
while True:
2419
2261
if not client.enabled:
2420
log.info("Client %s is disabled", client.name)
2262
logger.info("Client %s is disabled",
2263
client.name)
2421
2264
if self.server.use_dbus:
2422
2265
# Emit D-Bus signal
2423
2266
client.Rejected("Disabled")
2427
2270
# We are approved or approval is disabled
2428
2271
break
2429
2272
elif client.approved is None:
2430
log.info("Client %s needs approval",
2431
client.name)
2273
logger.info("Client %s needs approval",
2274
client.name)
2432
2275
if self.server.use_dbus:
2433
2276
# Emit D-Bus signal
2434
2277
client.NeedApproval(
2435
2278
client.approval_delay.total_seconds()
2436
2279
* 1000, client.approved_by_default)
2437
2280
else:
2438
log.warning("Client %s was not approved",
2439
client.name)
2281
logger.warning("Client %s was not approved",
2282
client.name)
2440
2283
if self.server.use_dbus:
2441
2284
# Emit D-Bus signal
2442
2285
client.Rejected("Denied")
2450
2293
time2 = datetime.datetime.now()
2451
2294
if (time2 - time) >= delay:
2452
2295
if not client.approved_by_default:
2453
log.warning("Client %s timed out while"
2454
" waiting for approval",
2455
client.name)
2296
logger.warning("Client %s timed out while"
2297
" waiting for approval",
2298
client.name)
2456
2299
if self.server.use_dbus:
2457
2300
# Emit D-Bus signal
2458
2301
client.Rejected("Approval timed out")
2465
2308
try:
2466
2309
session.send(client.secret)
2467
2310
except gnutls.Error as error:
2468
log.warning("gnutls send failed", exc_info=error)
2311
logger.warning("gnutls send failed",
2312
exc_info=error)
2469
2313
return
2470
2314
2471
log.info("Sending secret to %s", client.name)
2315
logger.info("Sending secret to %s", client.name)
2472
2316
# bump the timeout using extended_timeout
2473
2317
client.bump_timeout(client.extended_timeout)
2474
2318
if self.server.use_dbus:
2481
2325
try:
2482
2326
session.bye()
2483
2327
except gnutls.Error as error:
2484
log.warning("GnuTLS bye failed", exc_info=error)
2328
logger.warning("GnuTLS bye failed",
2329
exc_info=error)
2485
2330
2486
2331
@staticmethod
2487
2332
def peer_certificate(session):
2488
"Return the peer's certificate as a bytestring"
2489
try:
2490
cert_type = gnutls.certificate_type_get2(
2491
session, gnutls.CTYPE_PEERS)
2492
except AttributeError:
2493
cert_type = gnutls.certificate_type_get(session)
2494
if gnutls.has_rawpk:
2495
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2496
else:
2497
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2498
# If not a valid certificate type...
2499
if cert_type not in valid_cert_types:
2500
log.info("Cert type %r not in %r", cert_type,
2501
valid_cert_types)
2333
"Return the peer's OpenPGP certificate as a bytestring"
2334
# If not an OpenPGP certificate...
2335
if (gnutls.certificate_type_get(session._c_object)
2336
!= gnutls.CRT_OPENPGP):
2502
2337
# ...return invalid data
2503
2338
return b""
2504
2339
list_size = ctypes.c_uint(1)
2505
2340
cert_list = (gnutls.certificate_get_peers
2506
(session, ctypes.byref(list_size)))
2341
(session._c_object, ctypes.byref(list_size)))
2507
2342
if not bool(cert_list) and list_size.value != 0:
2508
2343
raise gnutls.Error("error getting peer certificate")
2509
2344
if list_size.value == 0:
2512
2347
return ctypes.string_at(cert.data, cert.size)
2513
2348
2514
2349
@staticmethod
2515
def key_id(certificate):
2516
"Convert a certificate bytestring to a hexdigit key ID"
2517
# New GnuTLS "datum" with the public key
2518
datum = gnutls.datum_t(
2519
ctypes.cast(ctypes.c_char_p(certificate),
2520
ctypes.POINTER(ctypes.c_ubyte)),
2521
ctypes.c_uint(len(certificate)))
2522
# XXX all these need to be created in the gnutls "module"
2523
# New empty GnuTLS certificate
2524
pubkey = gnutls.pubkey_t()
2525
gnutls.pubkey_init(ctypes.byref(pubkey))
2526
# Import the raw public key into the certificate
2527
gnutls.pubkey_import(pubkey,
2528
ctypes.byref(datum),
2529
gnutls.X509_FMT_DER)
2530
# New buffer for the key ID
2531
buf = ctypes.create_string_buffer(32)
2532
buf_len = ctypes.c_size_t(len(buf))
2533
# Get the key ID from the raw public key into the buffer
2534
gnutls.pubkey_get_key_id(
2535
pubkey,
2536
gnutls.KEYID_USE_SHA256,
2537
ctypes.cast(ctypes.byref(buf),
2538
ctypes.POINTER(ctypes.c_ubyte)),
2539
ctypes.byref(buf_len))
2540
# Deinit the certificate
2541
gnutls.pubkey_deinit(pubkey)
2542
2543
# Convert the buffer to a Python bytestring
2544
key_id = ctypes.string_at(buf, buf_len.value)
2545
# Convert the bytestring to hexadecimal notation
2546
hex_key_id = binascii.hexlify(key_id).upper()
2547
return hex_key_id
2548
2549
@staticmethod
2550
2350
def fingerprint(openpgp):
2551
2351
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2552
2352
# New GnuTLS "datum" with the OpenPGP public key
2566
2366
ctypes.byref(crtverify))
2567
2367
if crtverify.value != 0:
2568
2368
gnutls.openpgp_crt_deinit(crt)
2569
raise gnutls.CertificateSecurityError(code
2570
=crtverify.value)
2369
raise gnutls.CertificateSecurityError("Verify failed")
2571
2370
# New buffer for the fingerprint
2572
2371
buf = ctypes.create_string_buffer(20)
2573
2372
buf_len = ctypes.c_size_t()
2583
2382
return hex_fpr
2584
2383
2585
2384
2586
class MultiprocessingMixIn:
2385
class MultiprocessingMixIn(object):
2587
2386
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2588
2387
2589
2388
def sub_process_main(self, request, address):
2601
2400
return proc
2602
2401
2603
2402
2604
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2403
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2605
2404
""" adds a pipe to the MixIn """
2606
2405
2607
2406
def process_request(self, request, client_address):
2622
2421
2623
2422
2624
2423
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2625
socketserver.TCPServer):
2626
"""IPv6-capable TCP server. Accepts None as address and/or port
2424
socketserver.TCPServer, object):
2425
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2627
2426
2628
2427
Attributes:
2629
2428
enabled: Boolean; whether this server is activated yet
2680
2479
if SO_BINDTODEVICE is None:
2681
2480
# Fall back to a hard-coded value which seems to be
2682
2481
# common enough.
2683
log.warning("SO_BINDTODEVICE not found, trying 25")
2482
logger.warning("SO_BINDTODEVICE not found, trying 25")
2684
2483
SO_BINDTODEVICE = 25
2685
2484
try:
2686
2485
self.socket.setsockopt(
2688
2487
(self.interface + "\0").encode("utf-8"))
2689
2488
except socket.error as error:
2690
2489
if error.errno == errno.EPERM:
2691
log.error("No permission to bind to interface %s",
2692
self.interface)
2490
logger.error("No permission to bind to"
2491
" interface %s", self.interface)
2693
2492
elif error.errno == errno.ENOPROTOOPT:
2694
log.error("SO_BINDTODEVICE not available; cannot"
2695
" bind to interface %s", self.interface)
2493
logger.error("SO_BINDTODEVICE not available;"
2494
" cannot bind to interface %s",
2495
self.interface)
2696
2496
elif error.errno == errno.ENODEV:
2697
log.error("Interface %s does not exist, cannot"
2698
" bind", self.interface)
2497
logger.error("Interface %s does not exist,"
2498
" cannot bind", self.interface)
2699
2499
else:
2700
2500
raise
2701
2501
# Only bind(2) the socket if we really need to.
2702
2502
if self.server_address[0] or self.server_address[1]:
2703
if self.server_address[1]:
2704
self.allow_reuse_address = True
2705
2503
if not self.server_address[0]:
2706
2504
if self.address_family == socket.AF_INET6:
2707
2505
any_address = "::" # in6addr_any
2760
2558
def add_pipe(self, parent_pipe, proc):
2761
2559
# Call "handle_ipc" for both data and EOF events
2762
2560
GLib.io_add_watch(
2763
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2764
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2561
parent_pipe.fileno(),
2562
GLib.IO_IN | GLib.IO_HUP,
2765
2563
functools.partial(self.handle_ipc,
2766
2564
parent_pipe=parent_pipe,
2767
2565
proc=proc))
2780
2578
request = parent_pipe.recv()
2781
2579
command = request[0]
2782
2580
2783
if command == "init":
2784
key_id = request[1].decode("ascii")
2785
fpr = request[2].decode("ascii")
2786
address = request[3]
2581
if command == 'init':
2582
fpr = request[1].decode("ascii")
2583
address = request[2]
2787
2584
2788
2585
for c in self.clients.values():
2789
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2790
"27AE41E4649B934CA495991B7852B855"):
2791
continue
2792
if key_id and c.key_id == key_id:
2793
client = c
2794
break
2795
if fpr and c.fingerprint == fpr:
2586
if c.fingerprint == fpr:
2796
2587
client = c
2797
2588
break
2798
2589
else:
2799
log.info("Client not found for key ID: %s, address:"
2800
" %s", key_id or fpr, address)
2590
logger.info("Client not found for fingerprint: %s, ad"
2591
"dress: %s", fpr, address)
2801
2592
if self.use_dbus:
2802
2593
# Emit D-Bus signal
2803
mandos_dbus_service.ClientNotFound(key_id or fpr,
2594
mandos_dbus_service.ClientNotFound(fpr,
2804
2595
address[0])
2805
2596
parent_pipe.send(False)
2806
2597
return False
2807
2598
2808
2599
GLib.io_add_watch(
2809
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2810
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2600
parent_pipe.fileno(),
2601
GLib.IO_IN | GLib.IO_HUP,
2811
2602
functools.partial(self.handle_ipc,
2812
2603
parent_pipe=parent_pipe,
2813
2604
proc=proc,
2816
2607
# remove the old hook in favor of the new above hook on
2817
2608
# same fileno
2818
2609
return False
2819
if command == "funcall":
2610
if command == 'funcall':
2820
2611
funcname = request[1]
2821
2612
args = request[2]
2822
2613
kwargs = request[3]
2823
2614
2824
parent_pipe.send(("data", getattr(client_object,
2615
parent_pipe.send(('data', getattr(client_object,
2825
2616
funcname)(*args,
2826
2617
**kwargs)))
2827
2618
2828
if command == "getattr":
2619
if command == 'getattr':
2829
2620
attrname = request[1]
2830
2621
if isinstance(client_object.__getattribute__(attrname),
2831
collections.abc.Callable):
2832
parent_pipe.send(("function", ))
2622
collections.Callable):
2623
parent_pipe.send(('function', ))
2833
2624
else:
2834
2625
parent_pipe.send((
2835
"data", client_object.__getattribute__(attrname)))
2626
'data', client_object.__getattribute__(attrname)))
2836
2627
2837
if command == "setattr":
2628
if command == 'setattr':
2838
2629
attrname = request[1]
2839
2630
value = request[2]
2840
2631
setattr(client_object, attrname, value)
2845
2636
def rfc3339_duration_to_delta(duration):
2846
2637
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2847
2638
2848
>>> timedelta = datetime.timedelta
2849
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2850
True
2851
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2852
True
2853
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2854
True
2855
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2856
True
2857
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2858
True
2859
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2860
True
2861
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2862
True
2863
>>> del timedelta
2639
>>> rfc3339_duration_to_delta("P7D")
2640
datetime.timedelta(7)
2641
>>> rfc3339_duration_to_delta("PT60S")
2642
datetime.timedelta(0, 60)
2643
>>> rfc3339_duration_to_delta("PT60M")
2644
datetime.timedelta(0, 3600)
2645
>>> rfc3339_duration_to_delta("PT24H")
2646
datetime.timedelta(1)
2647
>>> rfc3339_duration_to_delta("P1W")
2648
datetime.timedelta(7)
2649
>>> rfc3339_duration_to_delta("PT5M30S")
2650
datetime.timedelta(0, 330)
2651
>>> rfc3339_duration_to_delta("P1DT3M20S")
2652
datetime.timedelta(1, 200)
2864
2653
"""
2865
2654
2866
2655
# Parsing an RFC 3339 duration with regular expressions is not
2946
2735
def string_to_delta(interval):
2947
2736
"""Parse a string and return a datetime.timedelta
2948
2737
2949
>>> string_to_delta("7d") == datetime.timedelta(7)
2950
True
2951
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2952
True
2953
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2954
True
2955
>>> string_to_delta("24h") == datetime.timedelta(1)
2956
True
2957
>>> string_to_delta("1w") == datetime.timedelta(7)
2958
True
2959
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2960
True
2738
>>> string_to_delta('7d')
2739
datetime.timedelta(7)
2740
>>> string_to_delta('60s')
2741
datetime.timedelta(0, 60)
2742
>>> string_to_delta('60m')
2743
datetime.timedelta(0, 3600)
2744
>>> string_to_delta('24h')
2745
datetime.timedelta(1)
2746
>>> string_to_delta('1w')
2747
datetime.timedelta(7)
2748
>>> string_to_delta('5m 30s')
2749
datetime.timedelta(0, 330)
2961
2750
"""
2962
2751
2963
2752
try:
3065
2854
3066
2855
options = parser.parse_args()
3067
2856
2857
if options.check:
2858
import doctest
2859
fail_count, test_count = doctest.testmod()
2860
sys.exit(os.EX_OK if fail_count == 0 else 1)
2861
3068
2862
# Default values for config file for server-global settings
3069
if gnutls.has_rawpk:
3070
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3071
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3072
else:
3073
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3074
":+SIGN-DSA-SHA256")
3075
2863
server_defaults = {"interface": "",
3076
2864
"address": "",
3077
2865
"port": "",
3078
2866
"debug": "False",
3079
"priority": priority,
2867
"priority":
2868
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2869
":+SIGN-DSA-SHA256",
3080
2870
"servicename": "Mandos",
3081
2871
"use_dbus": "True",
3082
2872
"use_ipv6": "True",
3087
2877
"foreground": "False",
3088
2878
"zeroconf": "True",
3089
2879
}
3090
del priority
3091
2880
3092
2881
# Parse config file for server-global settings
3093
server_config = configparser.ConfigParser(server_defaults)
2882
server_config = configparser.SafeConfigParser(server_defaults)
3094
2883
del server_defaults
3095
2884
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3096
# Convert the ConfigParser object to a dict
2885
# Convert the SafeConfigParser object to a dict
3097
2886
server_settings = server_config.defaults()
3098
2887
# Use the appropriate methods on the non-string config options
3099
2888
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3109
2898
# Later, stdin will, and stdout and stderr might, be dup'ed
3110
2899
# over with an opened os.devnull. But we don't want this to
3111
2900
# happen with a supplied network socket.
3112
while 0 <= server_settings["socket"] <= 2:
2901
if 0 <= server_settings["socket"] <= 2:
3113
2902
server_settings["socket"] = os.dup(server_settings
3114
2903
["socket"])
3115
os.set_inheritable(server_settings["socket"], False)
3116
2904
del server_config
3117
2905
3118
2906
# Override the settings from the config file with command line
3167
2955
3168
2956
if server_settings["servicename"] != "Mandos":
3169
2957
syslogger.setFormatter(
3170
logging.Formatter("Mandos ({}) [%(process)d]:"
3171
" %(levelname)s: %(message)s".format(
2958
logging.Formatter('Mandos ({}) [%(process)d]:'
2959
' %(levelname)s: %(message)s'.format(
3172
2960
server_settings["servicename"])))
3173
2961
3174
2962
# Parse config file with clients
3175
client_config = configparser.ConfigParser(Client.client_defaults)
2963
client_config = configparser.SafeConfigParser(Client
2964
.client_defaults)
3176
2965
client_config.read(os.path.join(server_settings["configdir"],
3177
2966
"clients.conf"))
3178
2967
3198
2987
try:
3199
2988
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3200
2989
except IOError as e:
3201
log.error("Could not open file %r", pidfilename,
3202
exc_info=e)
2990
logger.error("Could not open file %r", pidfilename,
2991
exc_info=e)
3203
2992
3204
2993
for name, group in (("_mandos", "_mandos"),
3205
2994
("mandos", "mandos"),
3216
3005
try:
3217
3006
os.setgid(gid)
3218
3007
os.setuid(uid)
3219
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3008
if debug:
3009
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3010
gid))
3220
3011
except OSError as error:
3221
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3222
os.strerror(error.errno))
3012
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3013
.format(uid, gid, os.strerror(error.errno)))
3223
3014
if error.errno != errno.EPERM:
3224
3015
raise
3225
3016
3232
3023
3233
3024
@gnutls.log_func
3234
3025
def debug_gnutls(level, string):
3235
log.debug("GnuTLS: %s",
3236
string[:-1].decode("utf-8", errors="replace"))
3026
logger.debug("GnuTLS: %s", string[:-1])
3237
3027
3238
3028
gnutls.global_set_log_function(debug_gnutls)
3239
3029
3248
3038
# Close all input and output, do double fork, etc.
3249
3039
daemon()
3250
3040
3251
if gi.version_info < (3, 10, 2):
3252
# multiprocessing will use threads, so before we use GLib we
3253
# need to inform GLib that threads will be used.
3254
GLib.threads_init()
3041
# multiprocessing will use threads, so before we use GLib we need
3042
# to inform GLib that threads will be used.
3043
GLib.threads_init()
3255
3044
3256
3045
global main_loop
3257
3046
# From the Avahi example code
3258
3047
DBusGMainLoop(set_as_default=True)
3259
3048
main_loop = GLib.MainLoop()
3260
if use_dbus or zeroconf:
3261
bus = dbus.SystemBus()
3049
bus = dbus.SystemBus()
3262
3050
# End of Avahi example code
3263
3051
if use_dbus:
3264
3052
try:
3269
3057
"se.bsnet.fukt.Mandos", bus,
3270
3058
do_not_queue=True)
3271
3059
except dbus.exceptions.DBusException as e:
3272
log.error("Disabling D-Bus:", exc_info=e)
3060
logger.error("Disabling D-Bus:", exc_info=e)
3273
3061
use_dbus = False
3274
3062
server_settings["use_dbus"] = False
3275
3063
tcp_server.use_dbus = False
3334
3122
if isinstance(s, bytes)
3335
3123
else s) for s in
3336
3124
value["client_structure"]]
3337
# .name, .host, and .checker_command
3338
for k in ("name", "host", "checker_command"):
3125
# .name & .host
3126
for k in ("name", "host"):
3339
3127
if isinstance(value[k], bytes):
3340
3128
value[k] = value[k].decode("utf-8")
3341
if "key_id" not in value:
3342
value["key_id"] = ""
3343
elif "fingerprint" not in value:
3344
value["fingerprint"] = ""
3345
3129
# old_client_settings
3346
3130
# .keys()
3347
3131
old_client_settings = {
3351
3135
for key, value in
3352
3136
bytes_old_client_settings.items()}
3353
3137
del bytes_old_client_settings
3354
# .host and .checker_command
3138
# .host
3355
3139
for value in old_client_settings.values():
3356
for attribute in ("host", "checker_command"):
3357
if isinstance(value[attribute], bytes):
3358
value[attribute] = (value[attribute]
3359
.decode("utf-8"))
3140
if isinstance(value["host"], bytes):
3141
value["host"] = (value["host"]
3142
.decode("utf-8"))
3360
3143
os.remove(stored_state_path)
3361
3144
except IOError as e:
3362
3145
if e.errno == errno.ENOENT:
3363
log.warning("Could not load persistent state:"
3364
" %s", os.strerror(e.errno))
3146
logger.warning("Could not load persistent state:"
3147
" {}".format(os.strerror(e.errno)))
3365
3148
else:
3366
log.critical("Could not load persistent state:",
3367
exc_info=e)
3149
logger.critical("Could not load persistent state:",
3150
exc_info=e)
3368
3151
raise
3369
3152
except EOFError as e:
3370
log.warning("Could not load persistent state: EOFError:",
3371
exc_info=e)
3153
logger.warning("Could not load persistent state: "
3154
"EOFError:",
3155
exc_info=e)
3372
3156
3373
3157
with PGPEngine() as pgp:
3374
3158
for client_name, client in clients_data.items():
3401
3185
if client["enabled"]:
3402
3186
if datetime.datetime.utcnow() >= client["expires"]:
3403
3187
if not client["last_checked_ok"]:
3404
log.warning("disabling client %s - Client"
3405
" never performed a successful"
3406
" checker", client_name)
3188
logger.warning(
3189
"disabling client {} - Client never "
3190
"performed a successful checker".format(
3191
client_name))
3407
3192
client["enabled"] = False
3408
3193
elif client["last_checker_status"] != 0:
3409
log.warning("disabling client %s - Client"
3410
" last checker failed with error"
3411
" code %s", client_name,
3412
client["last_checker_status"])
3194
logger.warning(
3195
"disabling client {} - Client last"
3196
" checker failed with error code"
3197
" {}".format(
3198
client_name,
3199
client["last_checker_status"]))
3413
3200
client["enabled"] = False
3414
3201
else:
3415
3202
client["expires"] = (
3416
3203
datetime.datetime.utcnow()
3417
3204
+ client["timeout"])
3418
log.debug("Last checker succeeded, keeping %s"
3419
" enabled", client_name)
3205
logger.debug("Last checker succeeded,"
3206
" keeping {} enabled".format(
3207
client_name))
3420
3208
try:
3421
3209
client["secret"] = pgp.decrypt(
3422
3210
client["encrypted_secret"],
3423
3211
client_settings[client_name]["secret"])
3424
3212
except PGPError:
3425
3213
# If decryption fails, we use secret from new settings
3426
log.debug("Failed to decrypt %s old secret",
3427
client_name)
3214
logger.debug("Failed to decrypt {} old secret".format(
3215
client_name))
3428
3216
client["secret"] = (client_settings[client_name]
3429
3217
["secret"])
3430
3218
3444
3232
server_settings=server_settings)
3445
3233
3446
3234
if not tcp_server.clients:
3447
log.warning("No clients defined")
3235
logger.warning("No clients defined")
3448
3236
3449
3237
if not foreground:
3450
3238
if pidfile is not None:
3453
3241
with pidfile:
3454
3242
print(pid, file=pidfile)
3455
3243
except IOError:
3456
log.error("Could not write to file %r with PID %d",
3457
pidfilename, pid)
3244
logger.error("Could not write to file %r with PID %d",
3245
pidfilename, pid)
3458
3246
del pidfile
3459
3247
del pidfilename
3460
3248
3480
3268
pass
3481
3269
3482
3270
@dbus.service.signal(_interface, signature="ss")
3483
def ClientNotFound(self, key_id, address):
3271
def ClientNotFound(self, fingerprint, address):
3484
3272
"D-Bus signal"
3485
3273
pass
3486
3274
3610
3398
3611
3399
try:
3612
3400
with tempfile.NamedTemporaryFile(
3613
mode="wb",
3401
mode='wb',
3614
3402
suffix=".pickle",
3615
prefix="clients-",
3403
prefix='clients-',
3616
3404
dir=os.path.dirname(stored_state_path),
3617
3405
delete=False) as stored_state:
3618
3406
pickle.dump((clients, client_settings), stored_state,
3626
3414
except NameError:
3627
3415
pass
3628
3416
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3629
log.warning("Could not save persistent state: %s",
3630
os.strerror(e.errno))
3417
logger.warning("Could not save persistent state: {}"
3418
.format(os.strerror(e.errno)))
3631
3419
else:
3632
log.warning("Could not save persistent state:",
3633
exc_info=e)
3420
logger.warning("Could not save persistent state:",
3421
exc_info=e)
3634
3422
raise
3635
3423
3636
3424
# Delete all clients, and settings from config
3653
3441
mandos_dbus_service.client_added_signal(client)
3654
3442
# Need to initiate checking of clients
3655
3443
if client.enabled:
3656
client.init_checker(randomize_start=True)
3444
client.init_checker()
3657
3445
3658
3446
tcp_server.enable()
3659
3447
tcp_server.server_activate()
3662
3450
if zeroconf:
3663
3451
service.port = tcp_server.socket.getsockname()[1]
3664
3452
if use_ipv6:
3665
log.info("Now listening on address %r, port %d, flowinfo %d,"
3666
" scope_id %d", *tcp_server.socket.getsockname())
3453
logger.info("Now listening on address %r, port %d,"
3454
" flowinfo %d, scope_id %d",
3455
*tcp_server.socket.getsockname())
3667
3456
else: # IPv4
3668
log.info("Now listening on address %r, port %d",
3669
*tcp_server.socket.getsockname())
3457
logger.info("Now listening on address %r, port %d",
3458
*tcp_server.socket.getsockname())
3670
3459
3671
3460
# service.interface = tcp_server.socket.getsockname()[3]
3672
3461
3676
3465
try:
3677
3466
service.activate()
3678
3467
except dbus.exceptions.DBusException as error:
3679
log.critical("D-Bus Exception", exc_info=error)
3468
logger.critical("D-Bus Exception", exc_info=error)
3680
3469
cleanup()
3681
3470
sys.exit(1)
3682
3471
# End of Avahi example code
3683
3472
3684
GLib.io_add_watch(
3685
GLib.IOChannel.unix_new(tcp_server.fileno()),
3686
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3687
lambda *args, **kwargs: (tcp_server.handle_request
3688
(*args[2:], **kwargs) or True))
3473
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3474
lambda *args, **kwargs:
3475
(tcp_server.handle_request
3476
(*args[2:], **kwargs) or True))
3689
3477
3690
log.debug("Starting main loop")
3478
logger.debug("Starting main loop")
3691
3479
main_loop.run()
3692
3480
except AvahiError as error:
3693
log.critical("Avahi Error", exc_info=error)
3481
logger.critical("Avahi Error", exc_info=error)
3694
3482
cleanup()
3695
3483
sys.exit(1)
3696
3484
except KeyboardInterrupt:
3697
3485
if debug:
3698
3486
print("", file=sys.stderr)
3699
log.debug("Server received KeyboardInterrupt")
3700
log.debug("Server exiting")
3487
logger.debug("Server received KeyboardInterrupt")
3488
logger.debug("Server exiting")
3701
3489
# Must run before the D-Bus bus name gets deregistered
3702
3490
cleanup()
3703
3491
3704
3705
def parse_test_args():
3706
# type: () -> argparse.Namespace
3707
parser = argparse.ArgumentParser(add_help=False)
3708
parser.add_argument("--check", action="store_true")
3709
parser.add_argument("--prefix", )
3710
args, unknown_args = parser.parse_known_args()
3711
if args.check:
3712
# Remove test options from sys.argv
3713
sys.argv[1:] = unknown_args
3714
return args
3715
3716
# Add all tests from doctest strings
3717
def load_tests(loader, tests, none):
3718
import doctest
3719
tests.addTests(doctest.DocTestSuite())
3720
return tests
3721
3722
if __name__ == "__main__":
3723
options = parse_test_args()
3724
try:
3725
if options.check:
3726
extra_test_prefix = options.prefix
3727
if extra_test_prefix is not None:
3728
if not (unittest.main(argv=[""], exit=False)
3729
.result.wasSuccessful()):
3730
sys.exit(1)
3731
class ExtraTestLoader(unittest.TestLoader):
3732
testMethodPrefix = extra_test_prefix
3733
# Call using ./scriptname --test [--verbose]
3734
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3735
else:
3736
unittest.main(argv=[""])
3737
else:
3738
main()
3739
finally:
3740
logging.shutdown()
3741
3742
# Local Variables:
3743
# run-tests:
3744
# (lambda (&optional extra)
3745
# (if (not (funcall run-tests-in-test-buffer default-directory
3746
# extra))
3747
# (funcall show-test-buffer-in-test-window)
3748
# (funcall remove-test-window)
3749
# (if extra (message "Extra tests run successfully!"))))
3750
# run-tests-in-test-buffer:
3751
# (lambda (dir &optional extra)
3752
# (with-current-buffer (get-buffer-create "*Test*")
3753
# (setq buffer-read-only nil
3754
# default-directory dir)
3755
# (erase-buffer)
3756
# (compilation-mode))
3757
# (let ((process-result
3758
# (let ((inhibit-read-only t))
3759
# (process-file-shell-command
3760
# (funcall get-command-line extra) nil "*Test*"))))
3761
# (and (numberp process-result)
3762
# (= process-result 0))))
3763
# get-command-line:
3764
# (lambda (&optional extra)
3765
# (let ((quoted-script
3766
# (shell-quote-argument (funcall get-script-name))))
3767
# (format
3768
# (concat "%s --check" (if extra " --prefix=atest" ""))
3769
# quoted-script)))
3770
# get-script-name:
3771
# (lambda ()
3772
# (if (fboundp 'file-local-name)
3773
# (file-local-name (buffer-file-name))
3774
# (or (file-remote-p (buffer-file-name) 'localname)
3775
# (buffer-file-name))))
3776
# remove-test-window:
3777
# (lambda ()
3778
# (let ((test-window (get-buffer-window "*Test*")))
3779
# (if test-window (delete-window test-window))))
3780
# show-test-buffer-in-test-window:
3781
# (lambda ()
3782
# (when (not (get-buffer-window-list "*Test*"))
3783
# (setq next-error-last-buffer (get-buffer "*Test*"))
3784
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3785
# (display-buffer-overriding-action
3786
# `((display-buffer-in-side-window) (side . ,side)
3787
# (window-height . fit-window-to-buffer)
3788
# (window-width . fit-window-to-buffer))))
3789
# (display-buffer "*Test*"))))
3790
# eval:
3791
# (progn
3792
# (let* ((run-extra-tests (lambda () (interactive)
3793
# (funcall run-tests t)))
3794
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3795
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3796
# (setq minor-mode-overriding-map-alist
3797
# (cons `(run-tests . ,outer-keymap)
3798
# minor-mode-overriding-map-alist)))
3799
# (add-hook 'after-save-hook run-tests 90 t))
3800
# End:
3492
3493
if __name__ == '__main__':
3494
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0