To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 389
- compare with another revision
- download diff
- download tarball
- view history from revision 389
- Committer: Teddy Hogeborn
- Date: 2019-08-05 21:24:02 UTC
- Revision ID: teddy@recompile.se-20190805212402-191ljwqv776i3981
Tags: version-1.8.7-1
* Makefile (version): Change to 1.8.7.
* NEWS (Version 1.8.7): Add new entry.
* debian/changelog (1.8.7-1): - '' -
* NEWS (Version 1.8.7): Add new entry.
* debian/changelog (1.8.7-1): - '' -
- files removed:
- debian/po/de.po
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
39
40
except ImportError:
40
41
pass
41
42
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
43
try:
48
44
import SocketServer as socketserver
49
45
except ImportError:
50
46
import socketserver
51
47
import socket
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
import ConfigParser as configparser
56
53
except ImportError:
57
54
import configparser
55
import sys
58
56
import re
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import random
81
import shlex
82
80
83
81
import dbus
84
82
import dbus.service
90
88
import xml.dom.minidom
91
89
import inspect
92
90
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
91
# Try to find the value of SO_BINDTODEVICE:
119
92
try:
120
93
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
140
113
# No value found
141
114
SO_BINDTODEVICE = None
142
115
116
if sys.version_info.major == 2:
117
str = unicode
118
143
119
if sys.version_info < (3, 2):
144
120
configparser.Configparser = configparser.SafeConfigParser
145
121
146
version = "1.8.15"
122
version = "1.8.7"
147
123
stored_state_file = "clients.pickle"
148
124
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
150
logging.captureWarnings(True) # Show warnings via the logging system
125
logger = logging.getLogger()
151
126
syslogger = None
152
127
153
128
try:
189
164
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
165
address="/dev/log"))
191
166
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
167
('Mandos [%(process)d]: %(levelname)s:'
168
' %(message)s'))
169
logger.addHandler(syslogger)
195
170
196
171
if debug:
197
172
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
173
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
174
' [%(process)d]:'
175
' %(levelname)s:'
176
' %(message)s'))
177
logger.addHandler(console)
178
logger.setLevel(level)
204
179
205
180
206
181
class PGPError(Exception):
208
183
pass
209
184
210
185
211
class PGPEngine:
186
class PGPEngine(object):
212
187
"""A simple class for OpenPGP symmetric encryption & decryption"""
213
188
214
189
def __init__(self):
218
193
output = subprocess.check_output(["gpgconf"])
219
194
for line in output.splitlines():
220
195
name, text, path = line.split(b":")
221
if name == b"gpg":
196
if name == "gpg":
222
197
self.gpg = path
223
198
break
224
199
except OSError as e:
225
200
if e.errno != errno.ENOENT:
226
201
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
202
self.gnupgargs = ['--batch',
203
'--homedir', self.tempdir,
204
'--force-mdc',
205
'--quiet']
231
206
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
207
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
233
208
self.gnupgargs.append("--no-use-agent")
234
209
235
210
def __enter__(self):
272
247
dir=self.tempdir) as passfile:
273
248
passfile.write(passphrase)
274
249
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
250
proc = subprocess.Popen([self.gpg, '--symmetric',
251
'--passphrase-file',
277
252
passfile.name]
278
253
+ self.gnupgargs,
279
254
stdin=subprocess.PIPE,
290
265
dir=self.tempdir) as passfile:
291
266
passfile.write(passphrase)
292
267
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
268
proc = subprocess.Popen([self.gpg, '--decrypt',
269
'--passphrase-file',
295
270
passfile.name]
296
271
+ self.gnupgargs,
297
272
stdin=subprocess.PIPE,
304
279
305
280
306
281
# Pretend that we have an Avahi module
307
class avahi:
282
class avahi(object):
308
283
"""This isn't so much a class as it is a module-like namespace."""
309
284
IF_UNSPEC = -1 # avahi-common/address.h
310
285
PROTO_UNSPEC = -1 # avahi-common/address.h
344
319
pass
345
320
346
321
347
class AvahiService:
322
class AvahiService(object):
348
323
"""An Avahi (Zeroconf) service.
349
324
350
325
Attributes:
351
326
interface: integer; avahi.IF_UNSPEC or an interface index.
352
327
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
328
name: string; Example: 'Mandos'
329
type: string; Example: '_mandos._tcp'.
355
330
See <https://www.iana.org/assignments/service-names-port-numbers>
356
331
port: integer; what port to announce
357
332
TXT: list of strings; TXT record for the service
394
369
def rename(self, remove=True):
395
370
"""Derived from the Avahi example code"""
396
371
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
372
logger.critical("No suitable Zeroconf service name found"
373
" after %i retries, exiting.",
374
self.rename_count)
400
375
raise AvahiServiceError("Too many renames")
401
376
self.name = str(
402
377
self.server.GetAlternativeServiceName(self.name))
403
378
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
379
logger.info("Changing Zeroconf service name to %r ...",
380
self.name)
406
381
if remove:
407
382
self.remove()
408
383
try:
410
385
except dbus.exceptions.DBusException as error:
411
386
if (error.get_dbus_name()
412
387
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
388
logger.info("Local Zeroconf service name collision.")
414
389
return self.rename(remove=False)
415
390
else:
416
log.critical("D-Bus Exception", exc_info=error)
391
logger.critical("D-Bus Exception", exc_info=error)
417
392
self.cleanup()
418
393
os._exit(1)
419
394
435
410
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
411
self.entry_group_state_changed_match = (
437
412
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
413
'StateChanged', self.entry_group_state_changed))
414
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
415
self.name, self.type)
441
416
self.group.AddService(
442
417
self.interface,
443
418
self.protocol,
450
425
451
426
def entry_group_state_changed(self, state, error):
452
427
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
428
logger.debug("Avahi entry group state change: %i", state)
454
429
455
430
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
431
logger.debug("Zeroconf service established.")
457
432
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
433
logger.info("Zeroconf service name collision.")
459
434
self.rename()
460
435
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
436
logger.critical("Avahi: Error in group state changed %s",
437
str(error))
463
438
raise AvahiGroupError("State changed: {!s}".format(error))
464
439
465
440
def cleanup(self):
475
450
476
451
def server_state_changed(self, state, error=None):
477
452
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
453
logger.debug("Avahi server state change: %i", state)
479
454
bad_states = {
480
455
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
456
avahi.SERVER_REGISTERING: None,
485
460
if state in bad_states:
486
461
if bad_states[state] is not None:
487
462
if error is None:
488
log.error(bad_states[state])
463
logger.error(bad_states[state])
489
464
else:
490
log.error(bad_states[state] + ": %r", error)
465
logger.error(bad_states[state] + ": %r", error)
491
466
self.cleanup()
492
467
elif state == avahi.SERVER_RUNNING:
493
468
try:
495
470
except dbus.exceptions.DBusException as error:
496
471
if (error.get_dbus_name()
497
472
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
473
logger.info("Local Zeroconf service name"
474
" collision.")
499
475
return self.rename(remove=False)
500
476
else:
501
log.critical("D-Bus Exception", exc_info=error)
477
logger.critical("D-Bus Exception", exc_info=error)
502
478
self.cleanup()
503
479
os._exit(1)
504
480
else:
505
481
if error is None:
506
log.debug("Unknown state: %r", state)
482
logger.debug("Unknown state: %r", state)
507
483
else:
508
log.debug("Unknown state: %r: %r", state, error)
484
logger.debug("Unknown state: %r: %r", state, error)
509
485
510
486
def activate(self):
511
487
"""Derived from the Avahi example code"""
523
499
class AvahiServiceToSyslog(AvahiService):
524
500
def rename(self, *args, **kwargs):
525
501
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
502
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
528
503
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
504
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
505
.format(self.name)))
531
506
return ret
532
507
533
508
534
509
# Pretend that we have a GnuTLS module
535
class gnutls:
510
class gnutls(object):
536
511
"""This isn't so much a class as it is a module-like namespace."""
537
512
538
513
library = ctypes.util.find_library("gnutls")
562
537
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
538
564
539
# Types
565
class _session_int(ctypes.Structure):
540
class session_int(ctypes.Structure):
566
541
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
542
session_t = ctypes.POINTER(session_int)
568
543
569
544
class certificate_credentials_st(ctypes.Structure):
570
545
_fields_ = []
573
548
certificate_type_t = ctypes.c_int
574
549
575
550
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
551
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
552
('size', ctypes.c_uint)]
578
553
579
class _openpgp_crt_int(ctypes.Structure):
554
class openpgp_crt_int(ctypes.Structure):
580
555
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
556
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
557
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
558
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
559
credentials_type_t = ctypes.c_int
593
568
# gnutls.strerror()
594
569
self.code = code
595
570
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
571
message = gnutls.strerror(code)
598
572
return super(gnutls.Error, self).__init__(
599
573
message, *args)
600
574
601
575
class CertificateSecurityError(Error):
602
576
pass
603
577
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
578
# Classes
630
class Credentials(With_from_param):
579
class Credentials(object):
631
580
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
581
self._c_object = gnutls.certificate_credentials_t()
582
gnutls.certificate_allocate_credentials(
583
ctypes.byref(self._c_object))
634
584
self.type = gnutls.CRD_CERTIFICATE
635
585
636
586
def __del__(self):
637
gnutls.certificate_free_credentials(self)
587
gnutls.certificate_free_credentials(self._c_object)
638
588
639
class ClientSession(With_from_param):
589
class ClientSession(object):
640
590
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
591
self._c_object = gnutls.session_t()
642
592
gnutls_flags = gnutls.CLIENT
643
593
if gnutls.check_version(b"3.5.6"):
644
594
gnutls_flags |= gnutls.NO_TICKETS
645
595
if gnutls.has_rawpk:
646
596
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
597
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
648
598
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
599
gnutls.set_default_priority(self._c_object)
600
gnutls.transport_set_ptr(self._c_object, socket.fileno())
601
gnutls.handshake_set_private_extensions(self._c_object,
602
True)
652
603
self.socket = socket
653
604
if credentials is None:
654
605
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
606
gnutls.credentials_set(self._c_object, credentials.type,
607
ctypes.cast(credentials._c_object,
608
ctypes.c_void_p))
657
609
self.credentials = credentials
658
610
659
611
def __del__(self):
660
gnutls.deinit(self)
612
gnutls.deinit(self._c_object)
661
613
662
614
def handshake(self):
663
return gnutls.handshake(self)
615
return gnutls.handshake(self._c_object)
664
616
665
617
def send(self, data):
666
618
data = bytes(data)
667
619
data_len = len(data)
668
620
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
621
data_len -= gnutls.record_send(self._c_object,
622
data[-data_len:],
670
623
data_len)
671
624
672
625
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
626
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
627
675
628
# Error handling functions
676
629
def _error_code(result):
677
630
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
631
for the 'restype' attribute on ctypes functions"""
632
if result >= 0:
680
633
return result
681
634
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
635
raise gnutls.CertificateSecurityError(code=result)
683
636
raise gnutls.Error(code=result)
684
637
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
638
def _retry_on_error(result, func, arguments):
687
639
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
640
for the 'errcheck' attribute on ctypes functions"""
641
while result < 0:
690
642
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
643
return _error_code(result)
692
644
result = func(*arguments)
697
649
698
650
# Functions
699
651
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
652
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
653
ctypes.POINTER(ctypes.c_char_p)]
702
654
priority_set_direct.restype = _error_code
703
655
704
656
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
657
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
658
init.restype = _error_code
707
659
708
660
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
661
set_default_priority.argtypes = [session_t]
710
662
set_default_priority.restype = _error_code
711
663
712
664
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
665
record_send.argtypes = [session_t, ctypes.c_void_p,
714
666
ctypes.c_size_t]
715
667
record_send.restype = ctypes.c_ssize_t
716
668
record_send.errcheck = _retry_on_error
718
670
certificate_allocate_credentials = (
719
671
_library.gnutls_certificate_allocate_credentials)
720
672
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
673
ctypes.POINTER(certificate_credentials_t)]
722
674
certificate_allocate_credentials.restype = _error_code
723
675
724
676
certificate_free_credentials = (
725
677
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
678
certificate_free_credentials.argtypes = [
679
certificate_credentials_t]
727
680
certificate_free_credentials.restype = None
728
681
729
682
handshake_set_private_extensions = (
730
683
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
684
handshake_set_private_extensions.argtypes = [session_t,
732
685
ctypes.c_int]
733
686
handshake_set_private_extensions.restype = None
734
687
735
688
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
689
credentials_set.argtypes = [session_t, credentials_type_t,
690
ctypes.c_void_p]
738
691
credentials_set.restype = _error_code
739
692
740
693
strerror = _library.gnutls_strerror
742
695
strerror.restype = ctypes.c_char_p
743
696
744
697
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
698
certificate_type_get.argtypes = [session_t]
746
699
certificate_type_get.restype = _error_code
747
700
748
701
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
702
certificate_get_peers.argtypes = [session_t,
750
703
ctypes.POINTER(ctypes.c_uint)]
751
704
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
705
759
712
global_set_log_function.restype = None
760
713
761
714
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
715
deinit.argtypes = [session_t]
763
716
deinit.restype = None
764
717
765
718
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
719
handshake.argtypes = [session_t]
720
handshake.restype = _error_code
768
721
handshake.errcheck = _retry_on_error
769
722
770
723
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
724
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
725
transport_set_ptr.restype = None
773
726
774
727
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
728
bye.argtypes = [session_t, close_request_t]
729
bye.restype = _error_code
777
730
bye.errcheck = _retry_on_error
778
731
779
732
check_version = _library.gnutls_check_version
796
749
797
750
x509_crt_fmt_t = ctypes.c_int
798
751
799
# All the function declarations below are from
800
# gnutls/abstract.h
752
# All the function declarations below are from gnutls/abstract.h
801
753
pubkey_init = _library.gnutls_pubkey_init
802
754
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
755
pubkey_init.restype = _error_code
817
769
pubkey_deinit.argtypes = [pubkey_t]
818
770
pubkey_deinit.restype = None
819
771
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
772
# All the function declarations below are from gnutls/openpgp.h
822
773
823
774
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
775
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
830
781
openpgp_crt_fmt_t]
831
782
openpgp_crt_import.restype = _error_code
832
783
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
784
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
785
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
786
ctypes.POINTER(ctypes.c_uint)]
840
787
openpgp_crt_verify_self.restype = _error_code
841
788
842
789
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
853
800
854
801
if check_version(b"3.6.4"):
855
802
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
803
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
857
804
certificate_type_get2.restype = _error_code
858
805
859
806
# Remove non-public functions
871
818
connection.close()
872
819
873
820
874
class Client:
821
class Client(object):
875
822
"""A representation of a client host served by this server.
876
823
877
824
Attributes:
878
approved: bool(); None if not yet approved/disapproved
825
approved: bool(); 'None' if not yet approved/disapproved
879
826
approval_delay: datetime.timedelta(); Time to wait for approval
880
827
approval_duration: datetime.timedelta(); Duration of one approval
881
828
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
829
to see if the client lives. 'None' if no process is
883
830
running.
884
831
checker_callback_tag: a GLib event source tag, or None
885
832
checker_command: string; External command which is run to check
1009
956
self.last_enabled = None
1010
957
self.expires = None
1011
958
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
959
logger.debug("Creating client %r", self.name)
960
logger.debug(" Key ID: %s", self.key_id)
961
logger.debug(" Fingerprint: %s", self.fingerprint)
1015
962
self.created = settings.get("created",
1016
963
datetime.datetime.utcnow())
1017
964
1045
992
if getattr(self, "enabled", False):
1046
993
# Already enabled
1047
994
return
995
self.expires = datetime.datetime.utcnow() + self.timeout
1048
996
self.enabled = True
1049
997
self.last_enabled = datetime.datetime.utcnow()
1050
998
self.init_checker()
1055
1003
if not getattr(self, "enabled", False):
1056
1004
return False
1057
1005
if not quiet:
1058
log.info("Disabling client %s", self.name)
1006
logger.info("Disabling client %s", self.name)
1059
1007
if getattr(self, "disable_initiator_tag", None) is not None:
1060
1008
GLib.source_remove(self.disable_initiator_tag)
1061
1009
self.disable_initiator_tag = None
1073
1021
def __del__(self):
1074
1022
self.disable()
1075
1023
1076
def init_checker(self, randomize_start=False):
1077
# Schedule a new checker to be started a randomly selected
1078
# time (a fraction of 'interval') from now. This spreads out
1079
# the startup of checkers over time when the server is
1080
# started.
1024
def init_checker(self):
1025
# Schedule a new checker to be started an 'interval' from now,
1026
# and every interval from then on.
1081
1027
if self.checker_initiator_tag is not None:
1082
1028
GLib.source_remove(self.checker_initiator_tag)
1083
interval_milliseconds = int(self.interval.total_seconds()
1084
* 1000)
1085
if randomize_start:
1086
delay_milliseconds = random.randrange(
1087
interval_milliseconds + 1)
1088
else:
1089
delay_milliseconds = interval_milliseconds
1090
1029
self.checker_initiator_tag = GLib.timeout_add(
1091
delay_milliseconds, self.start_checker, randomize_start)
1092
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1093
# A checker might take up to an 'interval' of time, so we can
1094
# expire at the soonest one interval after a checker was
1095
# started. Since the initial checker is delayed, the expire
1096
# time might have to be extended.
1097
now = datetime.datetime.utcnow()
1098
self.expires = now + delay + self.interval
1099
# Schedule a disable() at expire time
1030
int(self.interval.total_seconds() * 1000),
1031
self.start_checker)
1032
# Schedule a disable() when 'timeout' has passed
1100
1033
if self.disable_initiator_tag is not None:
1101
1034
GLib.source_remove(self.disable_initiator_tag)
1102
1035
self.disable_initiator_tag = GLib.timeout_add(
1103
int((self.expires - now).total_seconds() * 1000),
1104
self.disable)
1036
int(self.timeout.total_seconds() * 1000), self.disable)
1037
# Also start a new checker *right now*.
1038
self.start_checker()
1105
1039
1106
1040
def checker_callback(self, source, condition, connection,
1107
1041
command):
1109
1043
# Read return code from connection (see call_pipe)
1110
1044
returncode = connection.recv()
1111
1045
connection.close()
1112
if self.checker is not None:
1113
self.checker.join()
1046
self.checker.join()
1114
1047
self.checker_callback_tag = None
1115
1048
self.checker = None
1116
1049
1118
1051
self.last_checker_status = returncode
1119
1052
self.last_checker_signal = None
1120
1053
if self.last_checker_status == 0:
1121
log.info("Checker for %(name)s succeeded", vars(self))
1054
logger.info("Checker for %(name)s succeeded",
1055
vars(self))
1122
1056
self.checked_ok()
1123
1057
else:
1124
log.info("Checker for %(name)s failed", vars(self))
1058
logger.info("Checker for %(name)s failed", vars(self))
1125
1059
else:
1126
1060
self.last_checker_status = -1
1127
1061
self.last_checker_signal = -returncode
1128
log.warning("Checker for %(name)s crashed?", vars(self))
1062
logger.warning("Checker for %(name)s crashed?",
1063
vars(self))
1129
1064
return False
1130
1065
1131
1066
def checked_ok(self):
1150
1085
def need_approval(self):
1151
1086
self.last_approval_request = datetime.datetime.utcnow()
1152
1087
1153
def start_checker(self, start_was_randomized=False):
1088
def start_checker(self):
1154
1089
"""Start a new checker subprocess if one is not running.
1155
1090
1156
1091
If a checker already exists, leave it running and do
1165
1100
# should be.
1166
1101
1167
1102
if self.checker is not None and not self.checker.is_alive():
1168
log.warning("Checker was not alive; joining")
1103
logger.warning("Checker was not alive; joining")
1169
1104
self.checker.join()
1170
1105
self.checker = None
1171
1106
# Start a new checker if needed
1172
1107
if self.checker is None:
1173
1108
# Escape attributes for the shell
1174
1109
escaped_attrs = {
1175
attr: shlex.quote(str(getattr(self, attr)))
1110
attr: re.escape(str(getattr(self, attr)))
1176
1111
for attr in self.runtime_expansions}
1177
1112
try:
1178
1113
command = self.checker_command % escaped_attrs
1179
1114
except TypeError as error:
1180
log.error('Could not format string "%s"',
1181
self.checker_command, exc_info=error)
1115
logger.error('Could not format string "%s"',
1116
self.checker_command,
1117
exc_info=error)
1182
1118
return True # Try again later
1183
1119
self.current_checker_command = command
1184
log.info("Starting checker %r for %s", command, self.name)
1120
logger.info("Starting checker %r for %s", command,
1121
self.name)
1185
1122
# We don't need to redirect stdout and stderr, since
1186
1123
# in normal mode, that is already done by daemon(),
1187
1124
# and in debug mode we don't want to. (Stdin is
1203
1140
kwargs=popen_args)
1204
1141
self.checker.start()
1205
1142
self.checker_callback_tag = GLib.io_add_watch(
1206
GLib.IOChannel.unix_new(pipe[0].fileno()),
1207
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1143
pipe[0].fileno(), GLib.IO_IN,
1208
1144
self.checker_callback, pipe[0], command)
1209
if start_was_randomized:
1210
# We were started after a random delay; Schedule a new
1211
# checker to be started an 'interval' from now, and every
1212
# interval from then on.
1213
now = datetime.datetime.utcnow()
1214
self.checker_initiator_tag = GLib.timeout_add(
1215
int(self.interval.total_seconds() * 1000),
1216
self.start_checker)
1217
self.expires = max(self.expires, now + self.interval)
1218
# Don't start a new checker again after same random delay
1219
return False
1220
1145
# Re-run this periodically if run by GLib.timeout_add
1221
1146
return True
1222
1147
1227
1152
self.checker_callback_tag = None
1228
1153
if getattr(self, "checker", None) is None:
1229
1154
return
1230
log.debug("Stopping checker for %(name)s", vars(self))
1155
logger.debug("Stopping checker for %(name)s", vars(self))
1231
1156
self.checker.terminate()
1232
1157
self.checker = None
1233
1158
1260
1185
func._dbus_name = func.__name__
1261
1186
if func._dbus_name.endswith("_dbus_property"):
1262
1187
func._dbus_name = func._dbus_name[:-14]
1263
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1188
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1264
1189
return func
1265
1190
1266
1191
return decorator
1355
1280
1356
1281
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1357
1282
out_signature="s",
1358
path_keyword="object_path",
1359
connection_keyword="connection")
1283
path_keyword='object_path',
1284
connection_keyword='connection')
1360
1285
def Introspect(self, object_path, connection):
1361
1286
"""Overloading of standard D-Bus method.
1362
1287
1411
1336
document.unlink()
1412
1337
except (AttributeError, xml.dom.DOMException,
1413
1338
xml.parsers.expat.ExpatError) as error:
1414
log.error("Failed to override Introspection method",
1415
exc_info=error)
1339
logger.error("Failed to override Introspection method",
1340
exc_info=error)
1416
1341
return xmlstring
1417
1342
1418
1343
1476
1401
raise ValueError("Byte arrays not supported for non-"
1477
1402
"'ay' signature {!r}"
1478
1403
.format(prop._dbus_signature))
1479
value = dbus.ByteArray(bytes(value))
1404
value = dbus.ByteArray(b''.join(chr(byte)
1405
for byte in value))
1480
1406
prop(value)
1481
1407
1482
1408
@dbus.service.method(dbus.PROPERTIES_IFACE,
1515
1441
1516
1442
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1517
1443
out_signature="s",
1518
path_keyword="object_path",
1519
connection_keyword="connection")
1444
path_keyword='object_path',
1445
connection_keyword='connection')
1520
1446
def Introspect(self, object_path, connection):
1521
1447
"""Overloading of standard D-Bus method.
1522
1448
1578
1504
document.unlink()
1579
1505
except (AttributeError, xml.dom.DOMException,
1580
1506
xml.parsers.expat.ExpatError) as error:
1581
log.error("Failed to override Introspection method",
1582
exc_info=error)
1507
logger.error("Failed to override Introspection method",
1508
exc_info=error)
1583
1509
return xmlstring
1584
1510
1585
1511
1617
1543
1618
1544
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1619
1545
out_signature="s",
1620
path_keyword="object_path",
1621
connection_keyword="connection")
1546
path_keyword='object_path',
1547
connection_keyword='connection')
1622
1548
def Introspect(self, object_path, connection):
1623
1549
"""Overloading of standard D-Bus method.
1624
1550
1649
1575
document.unlink()
1650
1576
except (AttributeError, xml.dom.DOMException,
1651
1577
xml.parsers.expat.ExpatError) as error:
1652
log.error("Failed to override Introspection method",
1653
exc_info=error)
1578
logger.error("Failed to override Introspection method",
1579
exc_info=error)
1654
1580
return xmlstring
1655
1581
1656
1582
2287
2213
del _interface
2288
2214
2289
2215
2290
class ProxyClient:
2216
class ProxyClient(object):
2291
2217
def __init__(self, child_pipe, key_id, fpr, address):
2292
2218
self._pipe = child_pipe
2293
self._pipe.send(("init", key_id, fpr, address))
2219
self._pipe.send(('init', key_id, fpr, address))
2294
2220
if not self._pipe.recv():
2295
2221
raise KeyError(key_id or fpr)
2296
2222
2297
2223
def __getattribute__(self, name):
2298
if name == "_pipe":
2224
if name == '_pipe':
2299
2225
return super(ProxyClient, self).__getattribute__(name)
2300
self._pipe.send(("getattr", name))
2226
self._pipe.send(('getattr', name))
2301
2227
data = self._pipe.recv()
2302
if data[0] == "data":
2228
if data[0] == 'data':
2303
2229
return data[1]
2304
if data[0] == "function":
2230
if data[0] == 'function':
2305
2231
2306
2232
def func(*args, **kwargs):
2307
self._pipe.send(("funcall", name, args, kwargs))
2233
self._pipe.send(('funcall', name, args, kwargs))
2308
2234
return self._pipe.recv()[1]
2309
2235
2310
2236
return func
2311
2237
2312
2238
def __setattr__(self, name, value):
2313
if name == "_pipe":
2239
if name == '_pipe':
2314
2240
return super(ProxyClient, self).__setattr__(name, value)
2315
self._pipe.send(("setattr", name, value))
2241
self._pipe.send(('setattr', name, value))
2316
2242
2317
2243
2318
2244
class ClientHandler(socketserver.BaseRequestHandler, object):
2323
2249
2324
2250
def handle(self):
2325
2251
with contextlib.closing(self.server.child_pipe) as child_pipe:
2326
log.info("TCP connection from: %s",
2327
str(self.client_address))
2328
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2252
logger.info("TCP connection from: %s",
2253
str(self.client_address))
2254
logger.debug("Pipe FD: %d",
2255
self.server.child_pipe.fileno())
2329
2256
2330
2257
session = gnutls.ClientSession(self.request)
2331
2258
2332
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2259
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2333
2260
# "+AES-256-CBC", "+SHA1",
2334
2261
# "+COMP-NULL", "+CTYPE-OPENPGP",
2335
2262
# "+DHE-DSS"))
2337
2264
priority = self.server.gnutls_priority
2338
2265
if priority is None:
2339
2266
priority = "NORMAL"
2340
gnutls.priority_set_direct(session,
2341
priority.encode("utf-8"), None)
2267
gnutls.priority_set_direct(session._c_object,
2268
priority.encode("utf-8"),
2269
None)
2342
2270
2343
2271
# Start communication using the Mandos protocol
2344
2272
# Get protocol number
2345
2273
line = self.request.makefile().readline()
2346
log.debug("Protocol version: %r", line)
2274
logger.debug("Protocol version: %r", line)
2347
2275
try:
2348
2276
if int(line.strip().split()[0]) > 1:
2349
2277
raise RuntimeError(line)
2350
2278
except (ValueError, IndexError, RuntimeError) as error:
2351
log.error("Unknown protocol version: %s", error)
2279
logger.error("Unknown protocol version: %s", error)
2352
2280
return
2353
2281
2354
2282
# Start GnuTLS connection
2355
2283
try:
2356
2284
session.handshake()
2357
2285
except gnutls.Error as error:
2358
log.warning("Handshake failed: %s", error)
2286
logger.warning("Handshake failed: %s", error)
2359
2287
# Do not run session.bye() here: the session is not
2360
2288
# established. Just abandon the request.
2361
2289
return
2362
log.debug("Handshake succeeded")
2290
logger.debug("Handshake succeeded")
2363
2291
2364
2292
approval_required = False
2365
2293
try:
2369
2297
key_id = self.key_id(
2370
2298
self.peer_certificate(session))
2371
2299
except (TypeError, gnutls.Error) as error:
2372
log.warning("Bad certificate: %s", error)
2300
logger.warning("Bad certificate: %s", error)
2373
2301
return
2374
log.debug("Key ID: %s",
2375
key_id.decode("utf-8",
2376
errors="replace"))
2302
logger.debug("Key ID: %s", key_id)
2377
2303
2378
2304
else:
2379
2305
key_id = b""
2381
2307
fpr = self.fingerprint(
2382
2308
self.peer_certificate(session))
2383
2309
except (TypeError, gnutls.Error) as error:
2384
log.warning("Bad certificate: %s", error)
2310
logger.warning("Bad certificate: %s", error)
2385
2311
return
2386
log.debug("Fingerprint: %s", fpr)
2312
logger.debug("Fingerprint: %s", fpr)
2387
2313
2388
2314
try:
2389
2315
client = ProxyClient(child_pipe, key_id, fpr,
2398
2324
2399
2325
while True:
2400
2326
if not client.enabled:
2401
log.info("Client %s is disabled", client.name)
2327
logger.info("Client %s is disabled",
2328
client.name)
2402
2329
if self.server.use_dbus:
2403
2330
# Emit D-Bus signal
2404
2331
client.Rejected("Disabled")
2408
2335
# We are approved or approval is disabled
2409
2336
break
2410
2337
elif client.approved is None:
2411
log.info("Client %s needs approval",
2412
client.name)
2338
logger.info("Client %s needs approval",
2339
client.name)
2413
2340
if self.server.use_dbus:
2414
2341
# Emit D-Bus signal
2415
2342
client.NeedApproval(
2416
2343
client.approval_delay.total_seconds()
2417
2344
* 1000, client.approved_by_default)
2418
2345
else:
2419
log.warning("Client %s was not approved",
2420
client.name)
2346
logger.warning("Client %s was not approved",
2347
client.name)
2421
2348
if self.server.use_dbus:
2422
2349
# Emit D-Bus signal
2423
2350
client.Rejected("Denied")
2431
2358
time2 = datetime.datetime.now()
2432
2359
if (time2 - time) >= delay:
2433
2360
if not client.approved_by_default:
2434
log.warning("Client %s timed out while"
2435
" waiting for approval",
2436
client.name)
2361
logger.warning("Client %s timed out while"
2362
" waiting for approval",
2363
client.name)
2437
2364
if self.server.use_dbus:
2438
2365
# Emit D-Bus signal
2439
2366
client.Rejected("Approval timed out")
2446
2373
try:
2447
2374
session.send(client.secret)
2448
2375
except gnutls.Error as error:
2449
log.warning("gnutls send failed", exc_info=error)
2376
logger.warning("gnutls send failed",
2377
exc_info=error)
2450
2378
return
2451
2379
2452
log.info("Sending secret to %s", client.name)
2380
logger.info("Sending secret to %s", client.name)
2453
2381
# bump the timeout using extended_timeout
2454
2382
client.bump_timeout(client.extended_timeout)
2455
2383
if self.server.use_dbus:
2462
2390
try:
2463
2391
session.bye()
2464
2392
except gnutls.Error as error:
2465
log.warning("GnuTLS bye failed", exc_info=error)
2393
logger.warning("GnuTLS bye failed",
2394
exc_info=error)
2466
2395
2467
2396
@staticmethod
2468
2397
def peer_certificate(session):
2469
2398
"Return the peer's certificate as a bytestring"
2470
2399
try:
2471
cert_type = gnutls.certificate_type_get2(
2472
session, gnutls.CTYPE_PEERS)
2400
cert_type = gnutls.certificate_type_get2(session._c_object,
2401
gnutls.CTYPE_PEERS)
2473
2402
except AttributeError:
2474
cert_type = gnutls.certificate_type_get(session)
2403
cert_type = gnutls.certificate_type_get(session._c_object)
2475
2404
if gnutls.has_rawpk:
2476
2405
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2477
2406
else:
2478
2407
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2479
2408
# If not a valid certificate type...
2480
2409
if cert_type not in valid_cert_types:
2481
log.info("Cert type %r not in %r", cert_type,
2482
valid_cert_types)
2410
logger.info("Cert type %r not in %r", cert_type,
2411
valid_cert_types)
2483
2412
# ...return invalid data
2484
2413
return b""
2485
2414
list_size = ctypes.c_uint(1)
2486
2415
cert_list = (gnutls.certificate_get_peers
2487
(session, ctypes.byref(list_size)))
2416
(session._c_object, ctypes.byref(list_size)))
2488
2417
if not bool(cert_list) and list_size.value != 0:
2489
2418
raise gnutls.Error("error getting peer certificate")
2490
2419
if list_size.value == 0:
2512
2441
buf = ctypes.create_string_buffer(32)
2513
2442
buf_len = ctypes.c_size_t(len(buf))
2514
2443
# Get the key ID from the raw public key into the buffer
2515
gnutls.pubkey_get_key_id(
2516
pubkey,
2517
gnutls.KEYID_USE_SHA256,
2518
ctypes.cast(ctypes.byref(buf),
2519
ctypes.POINTER(ctypes.c_ubyte)),
2520
ctypes.byref(buf_len))
2444
gnutls.pubkey_get_key_id(pubkey,
2445
gnutls.KEYID_USE_SHA256,
2446
ctypes.cast(ctypes.byref(buf),
2447
ctypes.POINTER(ctypes.c_ubyte)),
2448
ctypes.byref(buf_len))
2521
2449
# Deinit the certificate
2522
2450
gnutls.pubkey_deinit(pubkey)
2523
2451
2564
2492
return hex_fpr
2565
2493
2566
2494
2567
class MultiprocessingMixIn:
2495
class MultiprocessingMixIn(object):
2568
2496
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2569
2497
2570
2498
def sub_process_main(self, request, address):
2582
2510
return proc
2583
2511
2584
2512
2585
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2513
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2586
2514
""" adds a pipe to the MixIn """
2587
2515
2588
2516
def process_request(self, request, client_address):
2603
2531
2604
2532
2605
2533
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2606
socketserver.TCPServer):
2607
"""IPv6-capable TCP server. Accepts None as address and/or port
2534
socketserver.TCPServer, object):
2535
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2608
2536
2609
2537
Attributes:
2610
2538
enabled: Boolean; whether this server is activated yet
2661
2589
if SO_BINDTODEVICE is None:
2662
2590
# Fall back to a hard-coded value which seems to be
2663
2591
# common enough.
2664
log.warning("SO_BINDTODEVICE not found, trying 25")
2592
logger.warning("SO_BINDTODEVICE not found, trying 25")
2665
2593
SO_BINDTODEVICE = 25
2666
2594
try:
2667
2595
self.socket.setsockopt(
2669
2597
(self.interface + "\0").encode("utf-8"))
2670
2598
except socket.error as error:
2671
2599
if error.errno == errno.EPERM:
2672
log.error("No permission to bind to interface %s",
2673
self.interface)
2600
logger.error("No permission to bind to"
2601
" interface %s", self.interface)
2674
2602
elif error.errno == errno.ENOPROTOOPT:
2675
log.error("SO_BINDTODEVICE not available; cannot"
2676
" bind to interface %s", self.interface)
2603
logger.error("SO_BINDTODEVICE not available;"
2604
" cannot bind to interface %s",
2605
self.interface)
2677
2606
elif error.errno == errno.ENODEV:
2678
log.error("Interface %s does not exist, cannot"
2679
" bind", self.interface)
2607
logger.error("Interface %s does not exist,"
2608
" cannot bind", self.interface)
2680
2609
else:
2681
2610
raise
2682
2611
# Only bind(2) the socket if we really need to.
2741
2670
def add_pipe(self, parent_pipe, proc):
2742
2671
# Call "handle_ipc" for both data and EOF events
2743
2672
GLib.io_add_watch(
2744
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2745
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2673
parent_pipe.fileno(),
2674
GLib.IO_IN | GLib.IO_HUP,
2746
2675
functools.partial(self.handle_ipc,
2747
2676
parent_pipe=parent_pipe,
2748
2677
proc=proc))
2761
2690
request = parent_pipe.recv()
2762
2691
command = request[0]
2763
2692
2764
if command == "init":
2693
if command == 'init':
2765
2694
key_id = request[1].decode("ascii")
2766
2695
fpr = request[2].decode("ascii")
2767
2696
address = request[3]
2768
2697
2769
2698
for c in self.clients.values():
2770
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2771
"27AE41E4649B934CA495991B7852B855"):
2699
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2772
2700
continue
2773
2701
if key_id and c.key_id == key_id:
2774
2702
client = c
2777
2705
client = c
2778
2706
break
2779
2707
else:
2780
log.info("Client not found for key ID: %s, address:"
2781
" %s", key_id or fpr, address)
2708
logger.info("Client not found for key ID: %s, address"
2709
": %s", key_id or fpr, address)
2782
2710
if self.use_dbus:
2783
2711
# Emit D-Bus signal
2784
2712
mandos_dbus_service.ClientNotFound(key_id or fpr,
2787
2715
return False
2788
2716
2789
2717
GLib.io_add_watch(
2790
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2791
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2718
parent_pipe.fileno(),
2719
GLib.IO_IN | GLib.IO_HUP,
2792
2720
functools.partial(self.handle_ipc,
2793
2721
parent_pipe=parent_pipe,
2794
2722
proc=proc,
2797
2725
# remove the old hook in favor of the new above hook on
2798
2726
# same fileno
2799
2727
return False
2800
if command == "funcall":
2728
if command == 'funcall':
2801
2729
funcname = request[1]
2802
2730
args = request[2]
2803
2731
kwargs = request[3]
2804
2732
2805
parent_pipe.send(("data", getattr(client_object,
2733
parent_pipe.send(('data', getattr(client_object,
2806
2734
funcname)(*args,
2807
2735
**kwargs)))
2808
2736
2809
if command == "getattr":
2737
if command == 'getattr':
2810
2738
attrname = request[1]
2811
2739
if isinstance(client_object.__getattribute__(attrname),
2812
collections.abc.Callable):
2813
parent_pipe.send(("function", ))
2740
collections.Callable):
2741
parent_pipe.send(('function', ))
2814
2742
else:
2815
2743
parent_pipe.send((
2816
"data", client_object.__getattribute__(attrname)))
2744
'data', client_object.__getattribute__(attrname)))
2817
2745
2818
if command == "setattr":
2746
if command == 'setattr':
2819
2747
attrname = request[1]
2820
2748
value = request[2]
2821
2749
setattr(client_object, attrname, value)
2826
2754
def rfc3339_duration_to_delta(duration):
2827
2755
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2828
2756
2829
>>> timedelta = datetime.timedelta
2830
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2831
True
2832
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2833
True
2834
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2835
True
2836
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2837
True
2838
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2839
True
2840
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2841
True
2842
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2843
True
2844
>>> del timedelta
2757
>>> rfc3339_duration_to_delta("P7D")
2758
datetime.timedelta(7)
2759
>>> rfc3339_duration_to_delta("PT60S")
2760
datetime.timedelta(0, 60)
2761
>>> rfc3339_duration_to_delta("PT60M")
2762
datetime.timedelta(0, 3600)
2763
>>> rfc3339_duration_to_delta("PT24H")
2764
datetime.timedelta(1)
2765
>>> rfc3339_duration_to_delta("P1W")
2766
datetime.timedelta(7)
2767
>>> rfc3339_duration_to_delta("PT5M30S")
2768
datetime.timedelta(0, 330)
2769
>>> rfc3339_duration_to_delta("P1DT3M20S")
2770
datetime.timedelta(1, 200)
2845
2771
"""
2846
2772
2847
2773
# Parsing an RFC 3339 duration with regular expressions is not
2927
2853
def string_to_delta(interval):
2928
2854
"""Parse a string and return a datetime.timedelta
2929
2855
2930
>>> string_to_delta("7d") == datetime.timedelta(7)
2931
True
2932
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2933
True
2934
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2935
True
2936
>>> string_to_delta("24h") == datetime.timedelta(1)
2937
True
2938
>>> string_to_delta("1w") == datetime.timedelta(7)
2939
True
2940
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2941
True
2856
>>> string_to_delta('7d')
2857
datetime.timedelta(7)
2858
>>> string_to_delta('60s')
2859
datetime.timedelta(0, 60)
2860
>>> string_to_delta('60m')
2861
datetime.timedelta(0, 3600)
2862
>>> string_to_delta('24h')
2863
datetime.timedelta(1)
2864
>>> string_to_delta('1w')
2865
datetime.timedelta(7)
2866
>>> string_to_delta('5m 30s')
2867
datetime.timedelta(0, 330)
2942
2868
"""
2943
2869
2944
2870
try:
3046
2972
3047
2973
options = parser.parse_args()
3048
2974
2975
if options.check:
2976
import doctest
2977
fail_count, test_count = doctest.testmod()
2978
sys.exit(os.EX_OK if fail_count == 0 else 1)
2979
3049
2980
# Default values for config file for server-global settings
3050
2981
if gnutls.has_rawpk:
3051
2982
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3147
3078
3148
3079
if server_settings["servicename"] != "Mandos":
3149
3080
syslogger.setFormatter(
3150
logging.Formatter("Mandos ({}) [%(process)d]:"
3151
" %(levelname)s: %(message)s".format(
3081
logging.Formatter('Mandos ({}) [%(process)d]:'
3082
' %(levelname)s: %(message)s'.format(
3152
3083
server_settings["servicename"])))
3153
3084
3154
3085
# Parse config file with clients
3178
3109
try:
3179
3110
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3180
3111
except IOError as e:
3181
log.error("Could not open file %r", pidfilename,
3182
exc_info=e)
3112
logger.error("Could not open file %r", pidfilename,
3113
exc_info=e)
3183
3114
3184
3115
for name, group in (("_mandos", "_mandos"),
3185
3116
("mandos", "mandos"),
3196
3127
try:
3197
3128
os.setgid(gid)
3198
3129
os.setuid(uid)
3199
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3130
if debug:
3131
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3132
gid))
3200
3133
except OSError as error:
3201
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3202
os.strerror(error.errno))
3134
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3135
.format(uid, gid, os.strerror(error.errno)))
3203
3136
if error.errno != errno.EPERM:
3204
3137
raise
3205
3138
3212
3145
3213
3146
@gnutls.log_func
3214
3147
def debug_gnutls(level, string):
3215
log.debug("GnuTLS: %s",
3216
string[:-1].decode("utf-8", errors="replace"))
3148
logger.debug("GnuTLS: %s", string[:-1])
3217
3149
3218
3150
gnutls.global_set_log_function(debug_gnutls)
3219
3151
3248
3180
"se.bsnet.fukt.Mandos", bus,
3249
3181
do_not_queue=True)
3250
3182
except dbus.exceptions.DBusException as e:
3251
log.error("Disabling D-Bus:", exc_info=e)
3183
logger.error("Disabling D-Bus:", exc_info=e)
3252
3184
use_dbus = False
3253
3185
server_settings["use_dbus"] = False
3254
3186
tcp_server.use_dbus = False
3313
3245
if isinstance(s, bytes)
3314
3246
else s) for s in
3315
3247
value["client_structure"]]
3316
# .name, .host, and .checker_command
3317
for k in ("name", "host", "checker_command"):
3248
# .name & .host
3249
for k in ("name", "host"):
3318
3250
if isinstance(value[k], bytes):
3319
3251
value[k] = value[k].decode("utf-8")
3320
3252
if "key_id" not in value:
3330
3262
for key, value in
3331
3263
bytes_old_client_settings.items()}
3332
3264
del bytes_old_client_settings
3333
# .host and .checker_command
3265
# .host
3334
3266
for value in old_client_settings.values():
3335
for attribute in ("host", "checker_command"):
3336
if isinstance(value[attribute], bytes):
3337
value[attribute] = (value[attribute]
3338
.decode("utf-8"))
3267
if isinstance(value["host"], bytes):
3268
value["host"] = (value["host"]
3269
.decode("utf-8"))
3339
3270
os.remove(stored_state_path)
3340
3271
except IOError as e:
3341
3272
if e.errno == errno.ENOENT:
3342
log.warning("Could not load persistent state:"
3343
" %s", os.strerror(e.errno))
3273
logger.warning("Could not load persistent state:"
3274
" {}".format(os.strerror(e.errno)))
3344
3275
else:
3345
log.critical("Could not load persistent state:",
3346
exc_info=e)
3276
logger.critical("Could not load persistent state:",
3277
exc_info=e)
3347
3278
raise
3348
3279
except EOFError as e:
3349
log.warning("Could not load persistent state: EOFError:",
3350
exc_info=e)
3280
logger.warning("Could not load persistent state: "
3281
"EOFError:",
3282
exc_info=e)
3351
3283
3352
3284
with PGPEngine() as pgp:
3353
3285
for client_name, client in clients_data.items():
3380
3312
if client["enabled"]:
3381
3313
if datetime.datetime.utcnow() >= client["expires"]:
3382
3314
if not client["last_checked_ok"]:
3383
log.warning("disabling client %s - Client"
3384
" never performed a successful"
3385
" checker", client_name)
3315
logger.warning(
3316
"disabling client {} - Client never "
3317
"performed a successful checker".format(
3318
client_name))
3386
3319
client["enabled"] = False
3387
3320
elif client["last_checker_status"] != 0:
3388
log.warning("disabling client %s - Client"
3389
" last checker failed with error"
3390
" code %s", client_name,
3391
client["last_checker_status"])
3321
logger.warning(
3322
"disabling client {} - Client last"
3323
" checker failed with error code"
3324
" {}".format(
3325
client_name,
3326
client["last_checker_status"]))
3392
3327
client["enabled"] = False
3393
3328
else:
3394
3329
client["expires"] = (
3395
3330
datetime.datetime.utcnow()
3396
3331
+ client["timeout"])
3397
log.debug("Last checker succeeded, keeping %s"
3398
" enabled", client_name)
3332
logger.debug("Last checker succeeded,"
3333
" keeping {} enabled".format(
3334
client_name))
3399
3335
try:
3400
3336
client["secret"] = pgp.decrypt(
3401
3337
client["encrypted_secret"],
3402
3338
client_settings[client_name]["secret"])
3403
3339
except PGPError:
3404
3340
# If decryption fails, we use secret from new settings
3405
log.debug("Failed to decrypt %s old secret",
3406
client_name)
3341
logger.debug("Failed to decrypt {} old secret".format(
3342
client_name))
3407
3343
client["secret"] = (client_settings[client_name]
3408
3344
["secret"])
3409
3345
3423
3359
server_settings=server_settings)
3424
3360
3425
3361
if not tcp_server.clients:
3426
log.warning("No clients defined")
3362
logger.warning("No clients defined")
3427
3363
3428
3364
if not foreground:
3429
3365
if pidfile is not None:
3432
3368
with pidfile:
3433
3369
print(pid, file=pidfile)
3434
3370
except IOError:
3435
log.error("Could not write to file %r with PID %d",
3436
pidfilename, pid)
3371
logger.error("Could not write to file %r with PID %d",
3372
pidfilename, pid)
3437
3373
del pidfile
3438
3374
del pidfilename
3439
3375
3589
3525
3590
3526
try:
3591
3527
with tempfile.NamedTemporaryFile(
3592
mode="wb",
3528
mode='wb',
3593
3529
suffix=".pickle",
3594
prefix="clients-",
3530
prefix='clients-',
3595
3531
dir=os.path.dirname(stored_state_path),
3596
3532
delete=False) as stored_state:
3597
3533
pickle.dump((clients, client_settings), stored_state,
3605
3541
except NameError:
3606
3542
pass
3607
3543
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3608
log.warning("Could not save persistent state: %s",
3609
os.strerror(e.errno))
3544
logger.warning("Could not save persistent state: {}"
3545
.format(os.strerror(e.errno)))
3610
3546
else:
3611
log.warning("Could not save persistent state:",
3612
exc_info=e)
3547
logger.warning("Could not save persistent state:",
3548
exc_info=e)
3613
3549
raise
3614
3550
3615
3551
# Delete all clients, and settings from config
3632
3568
mandos_dbus_service.client_added_signal(client)
3633
3569
# Need to initiate checking of clients
3634
3570
if client.enabled:
3635
client.init_checker(randomize_start=True)
3571
client.init_checker()
3636
3572
3637
3573
tcp_server.enable()
3638
3574
tcp_server.server_activate()
3641
3577
if zeroconf:
3642
3578
service.port = tcp_server.socket.getsockname()[1]
3643
3579
if use_ipv6:
3644
log.info("Now listening on address %r, port %d, flowinfo %d,"
3645
" scope_id %d", *tcp_server.socket.getsockname())
3580
logger.info("Now listening on address %r, port %d,"
3581
" flowinfo %d, scope_id %d",
3582
*tcp_server.socket.getsockname())
3646
3583
else: # IPv4
3647
log.info("Now listening on address %r, port %d",
3648
*tcp_server.socket.getsockname())
3584
logger.info("Now listening on address %r, port %d",
3585
*tcp_server.socket.getsockname())
3649
3586
3650
3587
# service.interface = tcp_server.socket.getsockname()[3]
3651
3588
3655
3592
try:
3656
3593
service.activate()
3657
3594
except dbus.exceptions.DBusException as error:
3658
log.critical("D-Bus Exception", exc_info=error)
3595
logger.critical("D-Bus Exception", exc_info=error)
3659
3596
cleanup()
3660
3597
sys.exit(1)
3661
3598
# End of Avahi example code
3662
3599
3663
GLib.io_add_watch(
3664
GLib.IOChannel.unix_new(tcp_server.fileno()),
3665
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3666
lambda *args, **kwargs: (tcp_server.handle_request
3667
(*args[2:], **kwargs) or True))
3600
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3601
lambda *args, **kwargs:
3602
(tcp_server.handle_request
3603
(*args[2:], **kwargs) or True))
3668
3604
3669
log.debug("Starting main loop")
3605
logger.debug("Starting main loop")
3670
3606
main_loop.run()
3671
3607
except AvahiError as error:
3672
log.critical("Avahi Error", exc_info=error)
3608
logger.critical("Avahi Error", exc_info=error)
3673
3609
cleanup()
3674
3610
sys.exit(1)
3675
3611
except KeyboardInterrupt:
3676
3612
if debug:
3677
3613
print("", file=sys.stderr)
3678
log.debug("Server received KeyboardInterrupt")
3679
log.debug("Server exiting")
3614
logger.debug("Server received KeyboardInterrupt")
3615
logger.debug("Server exiting")
3680
3616
# Must run before the D-Bus bus name gets deregistered
3681
3617
cleanup()
3682
3618
3683
3684
def parse_test_args():
3685
# type: () -> argparse.Namespace
3686
parser = argparse.ArgumentParser(add_help=False)
3687
parser.add_argument("--check", action="store_true")
3688
parser.add_argument("--prefix", )
3689
args, unknown_args = parser.parse_known_args()
3690
if args.check:
3691
# Remove test options from sys.argv
3692
sys.argv[1:] = unknown_args
3693
return args
3694
3695
# Add all tests from doctest strings
3696
def load_tests(loader, tests, none):
3697
import doctest
3698
tests.addTests(doctest.DocTestSuite())
3699
return tests
3700
3701
if __name__ == "__main__":
3702
options = parse_test_args()
3703
try:
3704
if options.check:
3705
extra_test_prefix = options.prefix
3706
if extra_test_prefix is not None:
3707
if not (unittest.main(argv=[""], exit=False)
3708
.result.wasSuccessful()):
3709
sys.exit(1)
3710
class ExtraTestLoader(unittest.TestLoader):
3711
testMethodPrefix = extra_test_prefix
3712
# Call using ./scriptname --test [--verbose]
3713
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3714
else:
3715
unittest.main(argv=[""])
3716
else:
3717
main()
3718
finally:
3719
logging.shutdown()
3720
3721
# Local Variables:
3722
# run-tests:
3723
# (lambda (&optional extra)
3724
# (if (not (funcall run-tests-in-test-buffer default-directory
3725
# extra))
3726
# (funcall show-test-buffer-in-test-window)
3727
# (funcall remove-test-window)
3728
# (if extra (message "Extra tests run successfully!"))))
3729
# run-tests-in-test-buffer:
3730
# (lambda (dir &optional extra)
3731
# (with-current-buffer (get-buffer-create "*Test*")
3732
# (setq buffer-read-only nil
3733
# default-directory dir)
3734
# (erase-buffer)
3735
# (compilation-mode))
3736
# (let ((process-result
3737
# (let ((inhibit-read-only t))
3738
# (process-file-shell-command
3739
# (funcall get-command-line extra) nil "*Test*"))))
3740
# (and (numberp process-result)
3741
# (= process-result 0))))
3742
# get-command-line:
3743
# (lambda (&optional extra)
3744
# (let ((quoted-script
3745
# (shell-quote-argument (funcall get-script-name))))
3746
# (format
3747
# (concat "%s --check" (if extra " --prefix=atest" ""))
3748
# quoted-script)))
3749
# get-script-name:
3750
# (lambda ()
3751
# (if (fboundp 'file-local-name)
3752
# (file-local-name (buffer-file-name))
3753
# (or (file-remote-p (buffer-file-name) 'localname)
3754
# (buffer-file-name))))
3755
# remove-test-window:
3756
# (lambda ()
3757
# (let ((test-window (get-buffer-window "*Test*")))
3758
# (if test-window (delete-window test-window))))
3759
# show-test-buffer-in-test-window:
3760
# (lambda ()
3761
# (when (not (get-buffer-window-list "*Test*"))
3762
# (setq next-error-last-buffer (get-buffer "*Test*"))
3763
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3764
# (display-buffer-overriding-action
3765
# `((display-buffer-in-side-window) (side . ,side)
3766
# (window-height . fit-window-to-buffer)
3767
# (window-width . fit-window-to-buffer))))
3768
# (display-buffer "*Test*"))))
3769
# eval:
3770
# (progn
3771
# (let* ((run-extra-tests (lambda () (interactive)
3772
# (funcall run-tests t)))
3773
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3774
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3775
# (setq minor-mode-overriding-map-alist
3776
# (cons `(run-tests . ,outer-keymap)
3777
# minor-mode-overriding-map-alist)))
3778
# (add-hook 'after-save-hook run-tests 90 t))
3779
# End:
3619
3620
if __name__ == '__main__':
3621
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0