Merge "Allow correct interpretation of ANDROID_ACTIVE_PARTITION"
diff --git a/bouncer/Makefile b/bouncer/Makefile
index bda3d81..db66253 100644
--- a/bouncer/Makefile
+++ b/bouncer/Makefile
@@ -1,6 +1,8 @@
default: all
+INSTALL?=install
BINDIR=$(DESTDIR)/bin
+LIBDIR=$(DESTDIR)/usr/bouncer
GPYLINT=$(shell \
if which gpylint >/dev/null; then \
echo gpylint; \
@@ -8,26 +10,21 @@
echo 'echo "(gpylint-missing)" >&2'; \
fi \
)
+NOINSTALL=options.py
-TARGETS=authorizer hash_mac_addr http_bouncer
-
-HOST_TARGETS=$(addprefix host-,$(TARGETS))
-
-all: $(TARGETS) $(HOST_TARGETS)
+all:
install:
- mkdir -p $(BINDIR)
- cp $(TARGETS) $(BINDIR)
+ mkdir -p $(LIBDIR) $(BINDIR)
+ $(INSTALL) -m 0644 $(filter-out $(NOINSTALL) $(TARGETS), $(wildcard *.py)) $(LIBDIR)/
+ for t in authorizer hash_mac_addr http_bouncer; do \
+ $(INSTALL) -m 0755 $$t.py $(LIBDIR)/; \
+ ln -fs /usr/bouncer/$$t.py $(BINDIR)/$$t; \
+ done
install-libs:
@echo "No libs to install."
-%: %.py
- ln -s $< $@
-
-host-%: %.py
- ln -s $< $@
-
TESTS = $(wildcard test-*.sh) $(wildcard test-*.py) $(wildcard *_test.py)
runtests: all $(TESTS)
set -e; \
diff --git a/bouncer/authorizer.py b/bouncer/authorizer.py
index f355917..0c5e0b1 100755
--- a/bouncer/authorizer.py
+++ b/bouncer/authorizer.py
@@ -43,6 +43,7 @@
MAX_TRIES = 300
+in_progress_users = {}
known_users = {}
@@ -55,13 +56,22 @@
return x | y
+def is_valid_acceptance(response_obj):
+ accepted_time = response_obj.get('accepted')
+ return accepted_time + (opt.max_age * 86400) > time.time()
+
+
+def allow_mac_rule(mac_addr):
+ # iptables, unlike other Linux utilities, capitalizes MAC addresses
+ return ('-m', 'mac', '--mac-source', mac_addr.upper(), '-j', 'ACCEPT')
+
+
class Checker(object):
"""Manage checking and polling for Terms of Service acceptance."""
- def __init__(self, mac_addr, hashed_mac_addr, url):
+ def __init__(self, mac_addr, url):
self.mac_addr = mac_addr
- self.hashed_mac_addr = hashed_mac_addr
- self.url = url % {'mac': hashed_mac_addr}
+ self.url = url % {'mac': hash_mac_addr.hash_mac_addr(self.mac_addr)}
self.tries = 0
self.callback = None
@@ -69,41 +79,43 @@
"""Check if a remote service knows about a device with a supplied MAC."""
logging.info('Checking TOS for %s', self.mac_addr)
http_client = tornado.httpclient.HTTPClient()
- response = http_client.fetch(self.url, ca_certs=opt.ca_certs)
- response_obj = tornado.escape.json_decode(response.body)
- accepted_time = response_obj.get('accepted')
self.tries += 1
- accepted = False
- if accepted_time:
- if accepted_time + (opt.max_age * 86400) > time.time():
- accepted = True
- if self.callback: self.callback.stop()
- logging.info('TOS accepted for %s', self.mac_addr)
+ try:
+ response = http_client.fetch(self.url, ca_certs=opt.ca_certs)
+ response_obj = tornado.escape.json_decode(response.body)
+ valid = is_valid_acceptance(response_obj)
+ except tornado.httpclient.HTTPError as e:
+ logging.warning('Error checking authorization: %r', e)
+ valid = False
- known_users[self.mac_addr] = response_obj
- result = ip46tables('-A', opt.filter_chain, '-m', 'mac',
- '--mac-source', self.mac_addr, '-j', 'ACCEPT')
- result |= ip46tables('-t', 'nat', '-A', opt.nat_chain, '-m', 'mac',
- '--mac-source', self.mac_addr, '-j', 'ACCEPT')
- if result:
- logging.error('Could not update firewall for device %s',
- self.mac_addr)
- else:
- logging.info('TOS accepted too long ago for %s: %r',
- self.mac_addr, accepted_time)
+ if valid:
+ logging.info('TOS accepted for %s', self.mac_addr)
- elif self.callback and self.tries > MAX_TRIES:
- if not accepted:
- logging.info('TOS not accepted for %s before timeout.',
- self.mac_addr)
- self.callback.stop()
+ known_users[self.mac_addr] = response_obj
+ result = ip46tables('-A', opt.filter_chain,
+ *allow_mac_rule(self.mac_addr))
+ result |= ip46tables('-t', 'nat', '-A', opt.nat_chain,
+ *allow_mac_rule(self.mac_addr))
+ if result:
+ logging.error('Could not update firewall for device %s',
+ self.mac_addr)
- return response, accepted
+ if valid or self.tries > MAX_TRIES:
+ if self.callback:
+ self.callback.stop()
+ if self.mac_addr in in_progress_users:
+ del in_progress_users[self.mac_addr]
+ else:
+ in_progress_users[self.mac_addr] = self
+ self.poll()
+
+ return response
def poll(self):
- self.callback = tornado.ioloop.PeriodicCallback(self.check, 1000)
- self.callback.start()
+ if not self.callback:
+ self.callback = tornado.ioloop.PeriodicCallback(self.check, 1000)
+ self.callback.start()
def accept(connection, unused_address):
@@ -112,27 +124,46 @@
maybe_mac_addr = cf.readline().strip()
try:
- mac_addr, hashed_mac_addr = hash_mac_addr.hash_mac_addr(maybe_mac_addr)
+ mac_addr = hash_mac_addr.normalize_mac_addr(maybe_mac_addr)
except ValueError:
logging.warning('can only check authorization for a MAC address.')
cf.write('{}')
return
if mac_addr in known_users:
- logging.info('TOS accepted (cached) for %s', mac_addr)
cached_response = known_users[mac_addr]
- cached_response['cached'] = True
- cf.write(tornado.escape.json_encode(cached_response))
- return
+ if is_valid_acceptance(cached_response):
+ logging.info('TOS accepted (cached) for %s', mac_addr)
+ cached_response['cached'] = True
+ cf.write(tornado.escape.json_encode(cached_response))
+ return
- checker = Checker(mac_addr, hashed_mac_addr, opt.url)
- response, accepted = checker.check()
- if not accepted:
- checker.poll()
+ if mac_addr in in_progress_users:
+ checker = in_progress_users[mac_addr]
+ else:
+ checker = Checker(mac_addr, opt.url)
+ response = checker.check()
cf.write(response.body)
+def expire_cache():
+ """Remove users whose authorization has expired from the cache."""
+ expired_users = set(mac_addr for mac_addr, cached_response
+ in known_users.items()
+ if not is_valid_acceptance(cached_response))
+
+ for mac_addr in expired_users:
+ logging.info('Removing expired user %s', mac_addr)
+ del known_users[mac_addr]
+
+ result = ip46tables('-D', opt.filter_chain, *allow_mac_rule(mac_addr))
+ result |= ip46tables('-t', 'nat', '-D', opt.nat_chain,
+ *allow_mac_rule(mac_addr))
+ if result:
+ logging.warning('Error removing expired user %s !', mac_addr)
+
+
if __name__ == '__main__':
o = options.Options(optspec)
opt, flags, extra = o.parse(sys.argv[1:])
@@ -157,3 +188,6 @@
logging.info('Started authorizer.')
ioloop.start()
+ expirer = tornado.ioloop.PeriodicCallback(expire_cache, 60 * 60 * 1000)
+ expirer.start()
+
diff --git a/bouncer/hash_mac_addr.py b/bouncer/hash_mac_addr.py
index 961bf10..23b45d1 100755
--- a/bouncer/hash_mac_addr.py
+++ b/bouncer/hash_mac_addr.py
@@ -15,13 +15,16 @@
"""
-def hash_mac_addr(maybe_mac_addr):
+def normalize_mac_addr(maybe_mac_addr):
if re.match('([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}$', maybe_mac_addr):
- mac_addr = maybe_mac_addr.lower()
+ return maybe_mac_addr.lower()
else:
raise ValueError('%r not a MAC address' % maybe_mac_addr)
- return mac_addr, hashlib.sha1(mac_addr).hexdigest()
+
+def hash_mac_addr(maybe_mac_addr):
+ mac_addr = normalize_mac_addr(maybe_mac_addr)
+ return hashlib.sha1(mac_addr).hexdigest()
if __name__ == '__main__':
@@ -32,7 +35,7 @@
o.usage()
try:
- _, hashed_mac_addr = hash_mac_addr(str(opt.addr))
+ hashed_mac_addr = hash_mac_addr(str(opt.addr))
print hashed_mac_addr
except ValueError as e:
print >>sys.stderr, 'error:', e.message
diff --git a/bouncer/http_bouncer.py b/bouncer/http_bouncer.py
index 380da4b..5fe0a53 100755
--- a/bouncer/http_bouncer.py
+++ b/bouncer/http_bouncer.py
@@ -68,8 +68,7 @@
else:
if self.substitute_mac:
mac = mac_for_ip(self.request.remote_ip)
- _, hashed_mac = hash_mac_addr.hash_mac_addr(mac)
- self.redirect(opt.url % {'mac': hashed_mac})
+ self.redirect(opt.url % {'mac': hash_mac_addr.hash_mac_addr(mac)})
if opt.unix_path:
try:
diff --git a/bouncer/test-hash_mac_addr.sh b/bouncer/test-hash_mac_addr.sh
index 3c84424..db6f10b 100755
--- a/bouncer/test-hash_mac_addr.sh
+++ b/bouncer/test-hash_mac_addr.sh
@@ -4,7 +4,7 @@
WVSTART "hash_mac_addr test"
-HASH_MAC_ADDR=./host-hash_mac_addr
+HASH_MAC_ADDR=./hash_mac_addr.py
WVFAIL $HASH_MAC_ADDR
WVFAIL $HASH_MAC_ADDR -a nonsense
diff --git a/bouncer/test-http_bouncer.sh b/bouncer/test-http_bouncer.sh
index dedd742..b5bd72a 100755
--- a/bouncer/test-http_bouncer.sh
+++ b/bouncer/test-http_bouncer.sh
@@ -5,7 +5,7 @@
. ./wvtest/wvtest.sh
-HTTP_BOUNCER=./host-http_bouncer
+HTTP_BOUNCER=./http_bouncer.py
PORT="1337"
URL="http://example.com"
diff --git a/conman/connection_manager.py b/conman/connection_manager.py
index 8307efd..c27ef8d 100755
--- a/conman/connection_manager.py
+++ b/conman/connection_manager.py
@@ -620,9 +620,6 @@
route = ifc.current_routes().get('default', None)
if route:
metric = route.get('metric', 0)
- # Skip temporary connection_check routes.
- if metric == '99':
- continue
candidate = (metric, ifc)
if (lowest_metric_interface is None or
candidate < lowest_metric_interface):
diff --git a/logupload/client/debian/init b/logupload/client/debian/init
index b349b5e..bbf7cad 100755
--- a/logupload/client/debian/init
+++ b/logupload/client/debian/init
@@ -36,10 +36,11 @@
# Our hostnames are something like hostname.cluster.whatever.com.
# We want the hostname.cluster part to be part of the certname, but
# sadly the name field in our certs isn't super happy about that, so
- # let's use _ instead of dot, where relevant.
+ # let's use _ instead of dot and strip hyphens, where relevant.
hostname -f |
sed -e 's/\([^.]*\.[^.]*\).*/\1/' \
- -e 's/\./_/g' |
+ -e 's/\./_/g' \
+ -e 's/-//g' |
atomic_stdin /tmp/serial
cd /
upload-logs-loop </dev/null &
