To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 406
- compare with another revision
- download diff
- download tarball
- view history from revision 406
- Committer: Teddy Hogeborn
- Date: 2022-04-25 18:33:20 UTC
- mfrom: (237.7.808 trunk)
- Revision ID: teddy@recompile.se-20220425183320-w83scg055sinkow4
Merge from trunk
- files added:
- debian/po/es.po
- files modified:
- Makefile
added
removed
mandos
1
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
2
# -*- coding: utf-8; lexical-binding: t -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2020 Teddy Hogeborn
15
# Copyright © 2008-2020 Björn Påhlsson
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
35
34
from __future__ import (division, absolute_import, print_function,
36
35
unicode_literals)
37
36
40
39
except ImportError:
41
40
pass
42
41
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
43
47
try:
44
48
import SocketServer as socketserver
45
49
except ImportError:
46
50
import socketserver
47
51
import socket
48
import argparse
49
52
import datetime
50
53
import errno
51
54
try:
52
55
import ConfigParser as configparser
53
56
except ImportError:
54
57
import configparser
55
import sys
56
58
import re
57
import os
58
59
import signal
59
60
import subprocess
60
61
import atexit
61
62
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import unittest
81
80
import random
82
81
import shlex
83
82
94
93
if sys.version_info.major == 2:
95
94
__metaclass__ = type
96
95
str = unicode
96
input = raw_input
97
97
98
98
# Add collections.abc.Callable if it does not exist
99
99
try:
146
146
version = "1.8.14"
147
147
stored_state_file = "clients.pickle"
148
148
149
logger = logging.getLogger()
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
150
150
logging.captureWarnings(True) # Show warnings via the logging system
151
151
syslogger = None
152
152
189
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
190
address="/dev/log"))
191
191
syslogger.setFormatter(logging.Formatter
192
('Mandos [%(process)d]: %(levelname)s:'
193
' %(message)s'))
194
logger.addHandler(syslogger)
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
195
195
196
196
if debug:
197
197
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
199
' [%(process)d]:'
200
' %(levelname)s:'
201
' %(message)s'))
202
logger.addHandler(console)
203
logger.setLevel(level)
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
204
204
205
205
206
206
class PGPError(Exception):
224
224
except OSError as e:
225
225
if e.errno != errno.ENOENT:
226
226
raise
227
self.gnupgargs = ['--batch',
228
'--homedir', self.tempdir,
229
'--force-mdc',
230
'--quiet']
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
231
231
# Only GPG version 1 has the --no-use-agent option.
232
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
233
self.gnupgargs.append("--no-use-agent")
272
272
dir=self.tempdir) as passfile:
273
273
passfile.write(passphrase)
274
274
passfile.flush()
275
proc = subprocess.Popen([self.gpg, '--symmetric',
276
'--passphrase-file',
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
277
277
passfile.name]
278
278
+ self.gnupgargs,
279
279
stdin=subprocess.PIPE,
290
290
dir=self.tempdir) as passfile:
291
291
passfile.write(passphrase)
292
292
passfile.flush()
293
proc = subprocess.Popen([self.gpg, '--decrypt',
294
'--passphrase-file',
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
295
295
passfile.name]
296
296
+ self.gnupgargs,
297
297
stdin=subprocess.PIPE,
350
350
Attributes:
351
351
interface: integer; avahi.IF_UNSPEC or an interface index.
352
352
Used to optionally bind to the specified interface.
353
name: string; Example: 'Mandos'
354
type: string; Example: '_mandos._tcp'.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
355
355
See <https://www.iana.org/assignments/service-names-port-numbers>
356
356
port: integer; what port to announce
357
357
TXT: list of strings; TXT record for the service
394
394
def rename(self, remove=True):
395
395
"""Derived from the Avahi example code"""
396
396
if self.rename_count >= self.max_renames:
397
logger.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
400
400
raise AvahiServiceError("Too many renames")
401
401
self.name = str(
402
402
self.server.GetAlternativeServiceName(self.name))
403
403
self.rename_count += 1
404
logger.info("Changing Zeroconf service name to %r ...",
405
self.name)
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
406
406
if remove:
407
407
self.remove()
408
408
try:
410
410
except dbus.exceptions.DBusException as error:
411
411
if (error.get_dbus_name()
412
412
== "org.freedesktop.Avahi.CollisionError"):
413
logger.info("Local Zeroconf service name collision.")
413
log.info("Local Zeroconf service name collision.")
414
414
return self.rename(remove=False)
415
415
else:
416
logger.critical("D-Bus Exception", exc_info=error)
416
log.critical("D-Bus Exception", exc_info=error)
417
417
self.cleanup()
418
418
os._exit(1)
419
419
435
435
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
436
self.entry_group_state_changed_match = (
437
437
self.group.connect_to_signal(
438
'StateChanged', self.entry_group_state_changed))
439
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
441
441
self.group.AddService(
442
442
self.interface,
443
443
self.protocol,
450
450
451
451
def entry_group_state_changed(self, state, error):
452
452
"""Derived from the Avahi example code"""
453
logger.debug("Avahi entry group state change: %i", state)
453
log.debug("Avahi entry group state change: %i", state)
454
454
455
455
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
logger.debug("Zeroconf service established.")
456
log.debug("Zeroconf service established.")
457
457
elif state == avahi.ENTRY_GROUP_COLLISION:
458
logger.info("Zeroconf service name collision.")
458
log.info("Zeroconf service name collision.")
459
459
self.rename()
460
460
elif state == avahi.ENTRY_GROUP_FAILURE:
461
logger.critical("Avahi: Error in group state changed %s",
462
str(error))
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
463
463
raise AvahiGroupError("State changed: {!s}".format(error))
464
464
465
465
def cleanup(self):
475
475
476
476
def server_state_changed(self, state, error=None):
477
477
"""Derived from the Avahi example code"""
478
logger.debug("Avahi server state change: %i", state)
478
log.debug("Avahi server state change: %i", state)
479
479
bad_states = {
480
480
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
481
avahi.SERVER_REGISTERING: None,
485
485
if state in bad_states:
486
486
if bad_states[state] is not None:
487
487
if error is None:
488
logger.error(bad_states[state])
488
log.error(bad_states[state])
489
489
else:
490
logger.error(bad_states[state] + ": %r", error)
490
log.error(bad_states[state] + ": %r", error)
491
491
self.cleanup()
492
492
elif state == avahi.SERVER_RUNNING:
493
493
try:
495
495
except dbus.exceptions.DBusException as error:
496
496
if (error.get_dbus_name()
497
497
== "org.freedesktop.Avahi.CollisionError"):
498
logger.info("Local Zeroconf service name"
499
" collision.")
498
log.info("Local Zeroconf service name collision.")
500
499
return self.rename(remove=False)
501
500
else:
502
logger.critical("D-Bus Exception", exc_info=error)
501
log.critical("D-Bus Exception", exc_info=error)
503
502
self.cleanup()
504
503
os._exit(1)
505
504
else:
506
505
if error is None:
507
logger.debug("Unknown state: %r", state)
506
log.debug("Unknown state: %r", state)
508
507
else:
509
logger.debug("Unknown state: %r: %r", state, error)
508
log.debug("Unknown state: %r: %r", state, error)
510
509
511
510
def activate(self):
512
511
"""Derived from the Avahi example code"""
527
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
528
527
**kwargs)
529
528
syslogger.setFormatter(logging.Formatter(
530
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
531
530
.format(self.name)))
532
531
return ret
533
532
563
562
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
564
563
565
564
# Types
566
class session_int(ctypes.Structure):
565
class _session_int(ctypes.Structure):
567
566
_fields_ = []
568
session_t = ctypes.POINTER(session_int)
567
session_t = ctypes.POINTER(_session_int)
569
568
570
569
class certificate_credentials_st(ctypes.Structure):
571
570
_fields_ = []
574
573
certificate_type_t = ctypes.c_int
575
574
576
575
class datum_t(ctypes.Structure):
577
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
578
('size', ctypes.c_uint)]
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
579
578
580
class openpgp_crt_int(ctypes.Structure):
579
class _openpgp_crt_int(ctypes.Structure):
581
580
_fields_ = []
582
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
583
582
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
584
583
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
585
584
credentials_type_t = ctypes.c_int
594
593
# gnutls.strerror()
595
594
self.code = code
596
595
if message is None and code is not None:
597
message = gnutls.strerror(code)
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
598
598
return super(gnutls.Error, self).__init__(
599
599
message, *args)
600
600
601
601
class CertificateSecurityError(Error):
602
602
pass
603
603
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
604
629
# Classes
605
class Credentials:
630
class Credentials(With_from_param):
606
631
def __init__(self):
607
self._c_object = gnutls.certificate_credentials_t()
608
gnutls.certificate_allocate_credentials(
609
ctypes.byref(self._c_object))
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
610
634
self.type = gnutls.CRD_CERTIFICATE
611
635
612
636
def __del__(self):
613
gnutls.certificate_free_credentials(self._c_object)
637
gnutls.certificate_free_credentials(self)
614
638
615
class ClientSession:
639
class ClientSession(With_from_param):
616
640
def __init__(self, socket, credentials=None):
617
self._c_object = gnutls.session_t()
641
self._as_parameter_ = gnutls.session_t()
618
642
gnutls_flags = gnutls.CLIENT
619
643
if gnutls.check_version(b"3.5.6"):
620
644
gnutls_flags |= gnutls.NO_TICKETS
621
645
if gnutls.has_rawpk:
622
646
gnutls_flags |= gnutls.ENABLE_RAWPK
623
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
647
gnutls.init(self, gnutls_flags)
624
648
del gnutls_flags
625
gnutls.set_default_priority(self._c_object)
626
gnutls.transport_set_ptr(self._c_object, socket.fileno())
627
gnutls.handshake_set_private_extensions(self._c_object,
628
True)
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
629
652
self.socket = socket
630
653
if credentials is None:
631
654
credentials = gnutls.Credentials()
632
gnutls.credentials_set(self._c_object, credentials.type,
633
ctypes.cast(credentials._c_object,
634
ctypes.c_void_p))
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
635
657
self.credentials = credentials
636
658
637
659
def __del__(self):
638
gnutls.deinit(self._c_object)
660
gnutls.deinit(self)
639
661
640
662
def handshake(self):
641
return gnutls.handshake(self._c_object)
663
return gnutls.handshake(self)
642
664
643
665
def send(self, data):
644
666
data = bytes(data)
645
667
data_len = len(data)
646
668
while data_len > 0:
647
data_len -= gnutls.record_send(self._c_object,
648
data[-data_len:],
669
data_len -= gnutls.record_send(self, data[-data_len:],
649
670
data_len)
650
671
651
672
def bye(self):
652
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
653
674
654
675
# Error handling functions
655
676
def _error_code(result):
656
677
"""A function to raise exceptions on errors, suitable
657
for the 'restype' attribute on ctypes functions"""
658
if result >= 0:
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
659
680
return result
660
681
if result == gnutls.E_NO_CERTIFICATE_FOUND:
661
682
raise gnutls.CertificateSecurityError(code=result)
662
683
raise gnutls.Error(code=result)
663
684
664
def _retry_on_error(result, func, arguments):
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
665
687
"""A function to retry on some errors, suitable
666
for the 'errcheck' attribute on ctypes functions"""
667
while result < 0:
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
668
690
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
669
691
return _error_code(result)
670
692
result = func(*arguments)
675
697
676
698
# Functions
677
699
priority_set_direct = _library.gnutls_priority_set_direct
678
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
679
701
ctypes.POINTER(ctypes.c_char_p)]
680
702
priority_set_direct.restype = _error_code
681
703
682
704
init = _library.gnutls_init
683
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
684
706
init.restype = _error_code
685
707
686
708
set_default_priority = _library.gnutls_set_default_priority
687
set_default_priority.argtypes = [session_t]
709
set_default_priority.argtypes = [ClientSession]
688
710
set_default_priority.restype = _error_code
689
711
690
712
record_send = _library.gnutls_record_send
691
record_send.argtypes = [session_t, ctypes.c_void_p,
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
692
714
ctypes.c_size_t]
693
715
record_send.restype = ctypes.c_ssize_t
694
716
record_send.errcheck = _retry_on_error
696
718
certificate_allocate_credentials = (
697
719
_library.gnutls_certificate_allocate_credentials)
698
720
certificate_allocate_credentials.argtypes = [
699
ctypes.POINTER(certificate_credentials_t)]
721
PointerTo(Credentials)]
700
722
certificate_allocate_credentials.restype = _error_code
701
723
702
724
certificate_free_credentials = (
703
725
_library.gnutls_certificate_free_credentials)
704
certificate_free_credentials.argtypes = [
705
certificate_credentials_t]
726
certificate_free_credentials.argtypes = [Credentials]
706
727
certificate_free_credentials.restype = None
707
728
708
729
handshake_set_private_extensions = (
709
730
_library.gnutls_handshake_set_private_extensions)
710
handshake_set_private_extensions.argtypes = [session_t,
731
handshake_set_private_extensions.argtypes = [ClientSession,
711
732
ctypes.c_int]
712
733
handshake_set_private_extensions.restype = None
713
734
714
735
credentials_set = _library.gnutls_credentials_set
715
credentials_set.argtypes = [session_t, credentials_type_t,
716
ctypes.c_void_p]
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
717
738
credentials_set.restype = _error_code
718
739
719
740
strerror = _library.gnutls_strerror
721
742
strerror.restype = ctypes.c_char_p
722
743
723
744
certificate_type_get = _library.gnutls_certificate_type_get
724
certificate_type_get.argtypes = [session_t]
745
certificate_type_get.argtypes = [ClientSession]
725
746
certificate_type_get.restype = _error_code
726
747
727
748
certificate_get_peers = _library.gnutls_certificate_get_peers
728
certificate_get_peers.argtypes = [session_t,
749
certificate_get_peers.argtypes = [ClientSession,
729
750
ctypes.POINTER(ctypes.c_uint)]
730
751
certificate_get_peers.restype = ctypes.POINTER(datum_t)
731
752
738
759
global_set_log_function.restype = None
739
760
740
761
deinit = _library.gnutls_deinit
741
deinit.argtypes = [session_t]
762
deinit.argtypes = [ClientSession]
742
763
deinit.restype = None
743
764
744
765
handshake = _library.gnutls_handshake
745
handshake.argtypes = [session_t]
746
handshake.restype = _error_code
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
747
768
handshake.errcheck = _retry_on_error
748
769
749
770
transport_set_ptr = _library.gnutls_transport_set_ptr
750
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
751
772
transport_set_ptr.restype = None
752
773
753
774
bye = _library.gnutls_bye
754
bye.argtypes = [session_t, close_request_t]
755
bye.restype = _error_code
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
756
777
bye.errcheck = _retry_on_error
757
778
758
779
check_version = _library.gnutls_check_version
832
853
833
854
if check_version(b"3.6.4"):
834
855
certificate_type_get2 = _library.gnutls_certificate_type_get2
835
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
836
857
certificate_type_get2.restype = _error_code
837
858
838
859
# Remove non-public functions
854
875
"""A representation of a client host served by this server.
855
876
856
877
Attributes:
857
approved: bool(); 'None' if not yet approved/disapproved
878
approved: bool(); None if not yet approved/disapproved
858
879
approval_delay: datetime.timedelta(); Time to wait for approval
859
880
approval_duration: datetime.timedelta(); Duration of one approval
860
881
checker: multiprocessing.Process(); a running checker process used
861
to see if the client lives. 'None' if no process is
882
to see if the client lives. None if no process is
862
883
running.
863
884
checker_callback_tag: a GLib event source tag, or None
864
885
checker_command: string; External command which is run to check
988
1009
self.last_enabled = None
989
1010
self.expires = None
990
1011
991
logger.debug("Creating client %r", self.name)
992
logger.debug(" Key ID: %s", self.key_id)
993
logger.debug(" Fingerprint: %s", self.fingerprint)
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
994
1015
self.created = settings.get("created",
995
1016
datetime.datetime.utcnow())
996
1017
1035
1056
if not getattr(self, "enabled", False):
1036
1057
return False
1037
1058
if not quiet:
1038
logger.info("Disabling client %s", self.name)
1059
log.info("Disabling client %s", self.name)
1039
1060
if getattr(self, "disable_initiator_tag", None) is not None:
1040
1061
GLib.source_remove(self.disable_initiator_tag)
1041
1062
self.disable_initiator_tag = None
1085
1106
self.last_checker_status = returncode
1086
1107
self.last_checker_signal = None
1087
1108
if self.last_checker_status == 0:
1088
logger.info("Checker for %(name)s succeeded",
1089
vars(self))
1109
log.info("Checker for %(name)s succeeded", vars(self))
1090
1110
self.checked_ok()
1091
1111
else:
1092
logger.info("Checker for %(name)s failed", vars(self))
1112
log.info("Checker for %(name)s failed", vars(self))
1093
1113
else:
1094
1114
self.last_checker_status = -1
1095
1115
self.last_checker_signal = -returncode
1096
logger.warning("Checker for %(name)s crashed?",
1097
vars(self))
1116
log.warning("Checker for %(name)s crashed?", vars(self))
1098
1117
return False
1099
1118
1100
1119
def checked_ok(self):
1134
1153
# should be.
1135
1154
1136
1155
if self.checker is not None and not self.checker.is_alive():
1137
logger.warning("Checker was not alive; joining")
1156
log.warning("Checker was not alive; joining")
1138
1157
self.checker.join()
1139
1158
self.checker = None
1140
1159
# Start a new checker if needed
1146
1165
try:
1147
1166
command = self.checker_command % escaped_attrs
1148
1167
except TypeError as error:
1149
logger.error('Could not format string "%s"',
1150
self.checker_command,
1151
exc_info=error)
1168
log.error('Could not format string "%s"',
1169
self.checker_command, exc_info=error)
1152
1170
return True # Try again later
1153
1171
self.current_checker_command = command
1154
logger.info("Starting checker %r for %s", command,
1155
self.name)
1172
log.info("Starting checker %r for %s", command, self.name)
1156
1173
# We don't need to redirect stdout and stderr, since
1157
1174
# in normal mode, that is already done by daemon(),
1158
1175
# and in debug mode we don't want to. (Stdin is
1187
1204
self.checker_callback_tag = None
1188
1205
if getattr(self, "checker", None) is None:
1189
1206
return
1190
logger.debug("Stopping checker for %(name)s", vars(self))
1207
log.debug("Stopping checker for %(name)s", vars(self))
1191
1208
self.checker.terminate()
1192
1209
self.checker = None
1193
1210
1220
1237
func._dbus_name = func.__name__
1221
1238
if func._dbus_name.endswith("_dbus_property"):
1222
1239
func._dbus_name = func._dbus_name[:-14]
1223
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1240
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1224
1241
return func
1225
1242
1226
1243
return decorator
1315
1332
1316
1333
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1317
1334
out_signature="s",
1318
path_keyword='object_path',
1319
connection_keyword='connection')
1335
path_keyword="object_path",
1336
connection_keyword="connection")
1320
1337
def Introspect(self, object_path, connection):
1321
1338
"""Overloading of standard D-Bus method.
1322
1339
1371
1388
document.unlink()
1372
1389
except (AttributeError, xml.dom.DOMException,
1373
1390
xml.parsers.expat.ExpatError) as error:
1374
logger.error("Failed to override Introspection method",
1375
exc_info=error)
1391
log.error("Failed to override Introspection method",
1392
exc_info=error)
1376
1393
return xmlstring
1377
1394
1378
1395
1475
1492
1476
1493
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1477
1494
out_signature="s",
1478
path_keyword='object_path',
1479
connection_keyword='connection')
1495
path_keyword="object_path",
1496
connection_keyword="connection")
1480
1497
def Introspect(self, object_path, connection):
1481
1498
"""Overloading of standard D-Bus method.
1482
1499
1538
1555
document.unlink()
1539
1556
except (AttributeError, xml.dom.DOMException,
1540
1557
xml.parsers.expat.ExpatError) as error:
1541
logger.error("Failed to override Introspection method",
1542
exc_info=error)
1558
log.error("Failed to override Introspection method",
1559
exc_info=error)
1543
1560
return xmlstring
1544
1561
1545
1562
1577
1594
1578
1595
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1579
1596
out_signature="s",
1580
path_keyword='object_path',
1581
connection_keyword='connection')
1597
path_keyword="object_path",
1598
connection_keyword="connection")
1582
1599
def Introspect(self, object_path, connection):
1583
1600
"""Overloading of standard D-Bus method.
1584
1601
1609
1626
document.unlink()
1610
1627
except (AttributeError, xml.dom.DOMException,
1611
1628
xml.parsers.expat.ExpatError) as error:
1612
logger.error("Failed to override Introspection method",
1613
exc_info=error)
1629
log.error("Failed to override Introspection method",
1630
exc_info=error)
1614
1631
return xmlstring
1615
1632
1616
1633
2250
2267
class ProxyClient:
2251
2268
def __init__(self, child_pipe, key_id, fpr, address):
2252
2269
self._pipe = child_pipe
2253
self._pipe.send(('init', key_id, fpr, address))
2270
self._pipe.send(("init", key_id, fpr, address))
2254
2271
if not self._pipe.recv():
2255
2272
raise KeyError(key_id or fpr)
2256
2273
2257
2274
def __getattribute__(self, name):
2258
if name == '_pipe':
2275
if name == "_pipe":
2259
2276
return super(ProxyClient, self).__getattribute__(name)
2260
self._pipe.send(('getattr', name))
2277
self._pipe.send(("getattr", name))
2261
2278
data = self._pipe.recv()
2262
if data[0] == 'data':
2279
if data[0] == "data":
2263
2280
return data[1]
2264
if data[0] == 'function':
2281
if data[0] == "function":
2265
2282
2266
2283
def func(*args, **kwargs):
2267
self._pipe.send(('funcall', name, args, kwargs))
2284
self._pipe.send(("funcall", name, args, kwargs))
2268
2285
return self._pipe.recv()[1]
2269
2286
2270
2287
return func
2271
2288
2272
2289
def __setattr__(self, name, value):
2273
if name == '_pipe':
2290
if name == "_pipe":
2274
2291
return super(ProxyClient, self).__setattr__(name, value)
2275
self._pipe.send(('setattr', name, value))
2292
self._pipe.send(("setattr", name, value))
2276
2293
2277
2294
2278
2295
class ClientHandler(socketserver.BaseRequestHandler, object):
2283
2300
2284
2301
def handle(self):
2285
2302
with contextlib.closing(self.server.child_pipe) as child_pipe:
2286
logger.info("TCP connection from: %s",
2287
str(self.client_address))
2288
logger.debug("Pipe FD: %d",
2289
self.server.child_pipe.fileno())
2303
log.info("TCP connection from: %s",
2304
str(self.client_address))
2305
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2290
2306
2291
2307
session = gnutls.ClientSession(self.request)
2292
2308
2293
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2309
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2294
2310
# "+AES-256-CBC", "+SHA1",
2295
2311
# "+COMP-NULL", "+CTYPE-OPENPGP",
2296
2312
# "+DHE-DSS"))
2298
2314
priority = self.server.gnutls_priority
2299
2315
if priority is None:
2300
2316
priority = "NORMAL"
2301
gnutls.priority_set_direct(session._c_object,
2302
priority.encode("utf-8"),
2303
None)
2317
gnutls.priority_set_direct(session,
2318
priority.encode("utf-8"), None)
2304
2319
2305
2320
# Start communication using the Mandos protocol
2306
2321
# Get protocol number
2307
2322
line = self.request.makefile().readline()
2308
logger.debug("Protocol version: %r", line)
2323
log.debug("Protocol version: %r", line)
2309
2324
try:
2310
2325
if int(line.strip().split()[0]) > 1:
2311
2326
raise RuntimeError(line)
2312
2327
except (ValueError, IndexError, RuntimeError) as error:
2313
logger.error("Unknown protocol version: %s", error)
2328
log.error("Unknown protocol version: %s", error)
2314
2329
return
2315
2330
2316
2331
# Start GnuTLS connection
2317
2332
try:
2318
2333
session.handshake()
2319
2334
except gnutls.Error as error:
2320
logger.warning("Handshake failed: %s", error)
2335
log.warning("Handshake failed: %s", error)
2321
2336
# Do not run session.bye() here: the session is not
2322
2337
# established. Just abandon the request.
2323
2338
return
2324
logger.debug("Handshake succeeded")
2339
log.debug("Handshake succeeded")
2325
2340
2326
2341
approval_required = False
2327
2342
try:
2331
2346
key_id = self.key_id(
2332
2347
self.peer_certificate(session))
2333
2348
except (TypeError, gnutls.Error) as error:
2334
logger.warning("Bad certificate: %s", error)
2349
log.warning("Bad certificate: %s", error)
2335
2350
return
2336
logger.debug("Key ID: %s", key_id)
2351
log.debug("Key ID: %s",
2352
key_id.decode("utf-8",
2353
errors="replace"))
2337
2354
2338
2355
else:
2339
2356
key_id = b""
2341
2358
fpr = self.fingerprint(
2342
2359
self.peer_certificate(session))
2343
2360
except (TypeError, gnutls.Error) as error:
2344
logger.warning("Bad certificate: %s", error)
2361
log.warning("Bad certificate: %s", error)
2345
2362
return
2346
logger.debug("Fingerprint: %s", fpr)
2363
log.debug("Fingerprint: %s", fpr)
2347
2364
2348
2365
try:
2349
2366
client = ProxyClient(child_pipe, key_id, fpr,
2358
2375
2359
2376
while True:
2360
2377
if not client.enabled:
2361
logger.info("Client %s is disabled",
2362
client.name)
2378
log.info("Client %s is disabled", client.name)
2363
2379
if self.server.use_dbus:
2364
2380
# Emit D-Bus signal
2365
2381
client.Rejected("Disabled")
2369
2385
# We are approved or approval is disabled
2370
2386
break
2371
2387
elif client.approved is None:
2372
logger.info("Client %s needs approval",
2373
client.name)
2388
log.info("Client %s needs approval",
2389
client.name)
2374
2390
if self.server.use_dbus:
2375
2391
# Emit D-Bus signal
2376
2392
client.NeedApproval(
2377
2393
client.approval_delay.total_seconds()
2378
2394
* 1000, client.approved_by_default)
2379
2395
else:
2380
logger.warning("Client %s was not approved",
2381
client.name)
2396
log.warning("Client %s was not approved",
2397
client.name)
2382
2398
if self.server.use_dbus:
2383
2399
# Emit D-Bus signal
2384
2400
client.Rejected("Denied")
2392
2408
time2 = datetime.datetime.now()
2393
2409
if (time2 - time) >= delay:
2394
2410
if not client.approved_by_default:
2395
logger.warning("Client %s timed out while"
2396
" waiting for approval",
2397
client.name)
2411
log.warning("Client %s timed out while"
2412
" waiting for approval",
2413
client.name)
2398
2414
if self.server.use_dbus:
2399
2415
# Emit D-Bus signal
2400
2416
client.Rejected("Approval timed out")
2407
2423
try:
2408
2424
session.send(client.secret)
2409
2425
except gnutls.Error as error:
2410
logger.warning("gnutls send failed",
2411
exc_info=error)
2426
log.warning("gnutls send failed", exc_info=error)
2412
2427
return
2413
2428
2414
logger.info("Sending secret to %s", client.name)
2429
log.info("Sending secret to %s", client.name)
2415
2430
# bump the timeout using extended_timeout
2416
2431
client.bump_timeout(client.extended_timeout)
2417
2432
if self.server.use_dbus:
2424
2439
try:
2425
2440
session.bye()
2426
2441
except gnutls.Error as error:
2427
logger.warning("GnuTLS bye failed",
2428
exc_info=error)
2442
log.warning("GnuTLS bye failed", exc_info=error)
2429
2443
2430
2444
@staticmethod
2431
2445
def peer_certificate(session):
2432
2446
"Return the peer's certificate as a bytestring"
2433
2447
try:
2434
cert_type = gnutls.certificate_type_get2(session._c_object,
2435
gnutls.CTYPE_PEERS)
2448
cert_type = gnutls.certificate_type_get2(
2449
session, gnutls.CTYPE_PEERS)
2436
2450
except AttributeError:
2437
cert_type = gnutls.certificate_type_get(session._c_object)
2451
cert_type = gnutls.certificate_type_get(session)
2438
2452
if gnutls.has_rawpk:
2439
2453
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2440
2454
else:
2441
2455
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2442
2456
# If not a valid certificate type...
2443
2457
if cert_type not in valid_cert_types:
2444
logger.info("Cert type %r not in %r", cert_type,
2445
valid_cert_types)
2458
log.info("Cert type %r not in %r", cert_type,
2459
valid_cert_types)
2446
2460
# ...return invalid data
2447
2461
return b""
2448
2462
list_size = ctypes.c_uint(1)
2449
2463
cert_list = (gnutls.certificate_get_peers
2450
(session._c_object, ctypes.byref(list_size)))
2464
(session, ctypes.byref(list_size)))
2451
2465
if not bool(cert_list) and list_size.value != 0:
2452
2466
raise gnutls.Error("error getting peer certificate")
2453
2467
if list_size.value == 0:
2567
2581
2568
2582
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2569
2583
socketserver.TCPServer):
2570
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2584
"""IPv6-capable TCP server. Accepts None as address and/or port
2571
2585
2572
2586
Attributes:
2573
2587
enabled: Boolean; whether this server is activated yet
2624
2638
if SO_BINDTODEVICE is None:
2625
2639
# Fall back to a hard-coded value which seems to be
2626
2640
# common enough.
2627
logger.warning("SO_BINDTODEVICE not found, trying 25")
2641
log.warning("SO_BINDTODEVICE not found, trying 25")
2628
2642
SO_BINDTODEVICE = 25
2629
2643
try:
2630
2644
self.socket.setsockopt(
2632
2646
(self.interface + "\0").encode("utf-8"))
2633
2647
except socket.error as error:
2634
2648
if error.errno == errno.EPERM:
2635
logger.error("No permission to bind to"
2636
" interface %s", self.interface)
2649
log.error("No permission to bind to interface %s",
2650
self.interface)
2637
2651
elif error.errno == errno.ENOPROTOOPT:
2638
logger.error("SO_BINDTODEVICE not available;"
2639
" cannot bind to interface %s",
2640
self.interface)
2652
log.error("SO_BINDTODEVICE not available; cannot"
2653
" bind to interface %s", self.interface)
2641
2654
elif error.errno == errno.ENODEV:
2642
logger.error("Interface %s does not exist,"
2643
" cannot bind", self.interface)
2655
log.error("Interface %s does not exist, cannot"
2656
" bind", self.interface)
2644
2657
else:
2645
2658
raise
2646
2659
# Only bind(2) the socket if we really need to.
2725
2738
request = parent_pipe.recv()
2726
2739
command = request[0]
2727
2740
2728
if command == 'init':
2741
if command == "init":
2729
2742
key_id = request[1].decode("ascii")
2730
2743
fpr = request[2].decode("ascii")
2731
2744
address = request[3]
2741
2754
client = c
2742
2755
break
2743
2756
else:
2744
logger.info("Client not found for key ID: %s, address"
2745
": %s", key_id or fpr, address)
2757
log.info("Client not found for key ID: %s, address:"
2758
" %s", key_id or fpr, address)
2746
2759
if self.use_dbus:
2747
2760
# Emit D-Bus signal
2748
2761
mandos_dbus_service.ClientNotFound(key_id or fpr,
2761
2774
# remove the old hook in favor of the new above hook on
2762
2775
# same fileno
2763
2776
return False
2764
if command == 'funcall':
2777
if command == "funcall":
2765
2778
funcname = request[1]
2766
2779
args = request[2]
2767
2780
kwargs = request[3]
2768
2781
2769
parent_pipe.send(('data', getattr(client_object,
2782
parent_pipe.send(("data", getattr(client_object,
2770
2783
funcname)(*args,
2771
2784
**kwargs)))
2772
2785
2773
if command == 'getattr':
2786
if command == "getattr":
2774
2787
attrname = request[1]
2775
2788
if isinstance(client_object.__getattribute__(attrname),
2776
2789
collections.abc.Callable):
2777
parent_pipe.send(('function', ))
2790
parent_pipe.send(("function", ))
2778
2791
else:
2779
2792
parent_pipe.send((
2780
'data', client_object.__getattribute__(attrname)))
2793
"data", client_object.__getattribute__(attrname)))
2781
2794
2782
if command == 'setattr':
2795
if command == "setattr":
2783
2796
attrname = request[1]
2784
2797
value = request[2]
2785
2798
setattr(client_object, attrname, value)
2891
2904
def string_to_delta(interval):
2892
2905
"""Parse a string and return a datetime.timedelta
2893
2906
2894
>>> string_to_delta('7d') == datetime.timedelta(7)
2895
True
2896
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2897
True
2898
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2899
True
2900
>>> string_to_delta('24h') == datetime.timedelta(1)
2901
True
2902
>>> string_to_delta('1w') == datetime.timedelta(7)
2903
True
2904
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2907
>>> string_to_delta("7d") == datetime.timedelta(7)
2908
True
2909
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2910
True
2911
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2912
True
2913
>>> string_to_delta("24h") == datetime.timedelta(1)
2914
True
2915
>>> string_to_delta("1w") == datetime.timedelta(7)
2916
True
2917
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2905
2918
True
2906
2919
"""
2907
2920
3111
3124
3112
3125
if server_settings["servicename"] != "Mandos":
3113
3126
syslogger.setFormatter(
3114
logging.Formatter('Mandos ({}) [%(process)d]:'
3115
' %(levelname)s: %(message)s'.format(
3127
logging.Formatter("Mandos ({}) [%(process)d]:"
3128
" %(levelname)s: %(message)s".format(
3116
3129
server_settings["servicename"])))
3117
3130
3118
3131
# Parse config file with clients
3142
3155
try:
3143
3156
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3144
3157
except IOError as e:
3145
logger.error("Could not open file %r", pidfilename,
3146
exc_info=e)
3158
log.error("Could not open file %r", pidfilename,
3159
exc_info=e)
3147
3160
3148
3161
for name, group in (("_mandos", "_mandos"),
3149
3162
("mandos", "mandos"),
3160
3173
try:
3161
3174
os.setgid(gid)
3162
3175
os.setuid(uid)
3163
if debug:
3164
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3165
gid))
3176
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3166
3177
except OSError as error:
3167
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3168
.format(uid, gid, os.strerror(error.errno)))
3178
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3179
os.strerror(error.errno))
3169
3180
if error.errno != errno.EPERM:
3170
3181
raise
3171
3182
3178
3189
3179
3190
@gnutls.log_func
3180
3191
def debug_gnutls(level, string):
3181
logger.debug("GnuTLS: %s", string[:-1])
3192
log.debug("GnuTLS: %s",
3193
string[:-1].decode("utf-8", errors="replace"))
3182
3194
3183
3195
gnutls.global_set_log_function(debug_gnutls)
3184
3196
3213
3225
"se.bsnet.fukt.Mandos", bus,
3214
3226
do_not_queue=True)
3215
3227
except dbus.exceptions.DBusException as e:
3216
logger.error("Disabling D-Bus:", exc_info=e)
3228
log.error("Disabling D-Bus:", exc_info=e)
3217
3229
use_dbus = False
3218
3230
server_settings["use_dbus"] = False
3219
3231
tcp_server.use_dbus = False
3304
3316
os.remove(stored_state_path)
3305
3317
except IOError as e:
3306
3318
if e.errno == errno.ENOENT:
3307
logger.warning("Could not load persistent state:"
3308
" {}".format(os.strerror(e.errno)))
3319
log.warning("Could not load persistent state:"
3320
" %s", os.strerror(e.errno))
3309
3321
else:
3310
logger.critical("Could not load persistent state:",
3311
exc_info=e)
3322
log.critical("Could not load persistent state:",
3323
exc_info=e)
3312
3324
raise
3313
3325
except EOFError as e:
3314
logger.warning("Could not load persistent state: "
3315
"EOFError:",
3316
exc_info=e)
3326
log.warning("Could not load persistent state: EOFError:",
3327
exc_info=e)
3317
3328
3318
3329
with PGPEngine() as pgp:
3319
3330
for client_name, client in clients_data.items():
3346
3357
if client["enabled"]:
3347
3358
if datetime.datetime.utcnow() >= client["expires"]:
3348
3359
if not client["last_checked_ok"]:
3349
logger.warning(
3350
"disabling client {} - Client never "
3351
"performed a successful checker".format(
3352
client_name))
3360
log.warning("disabling client %s - Client"
3361
" never performed a successful"
3362
" checker", client_name)
3353
3363
client["enabled"] = False
3354
3364
elif client["last_checker_status"] != 0:
3355
logger.warning(
3356
"disabling client {} - Client last"
3357
" checker failed with error code"
3358
" {}".format(
3359
client_name,
3360
client["last_checker_status"]))
3365
log.warning("disabling client %s - Client"
3366
" last checker failed with error"
3367
" code %s", client_name,
3368
client["last_checker_status"])
3361
3369
client["enabled"] = False
3362
3370
else:
3363
3371
client["expires"] = (
3364
3372
datetime.datetime.utcnow()
3365
3373
+ client["timeout"])
3366
logger.debug("Last checker succeeded,"
3367
" keeping {} enabled".format(
3368
client_name))
3374
log.debug("Last checker succeeded, keeping %s"
3375
" enabled", client_name)
3369
3376
try:
3370
3377
client["secret"] = pgp.decrypt(
3371
3378
client["encrypted_secret"],
3372
3379
client_settings[client_name]["secret"])
3373
3380
except PGPError:
3374
3381
# If decryption fails, we use secret from new settings
3375
logger.debug("Failed to decrypt {} old secret".format(
3376
client_name))
3382
log.debug("Failed to decrypt %s old secret",
3383
client_name)
3377
3384
client["secret"] = (client_settings[client_name]
3378
3385
["secret"])
3379
3386
3393
3400
server_settings=server_settings)
3394
3401
3395
3402
if not tcp_server.clients:
3396
logger.warning("No clients defined")
3403
log.warning("No clients defined")
3397
3404
3398
3405
if not foreground:
3399
3406
if pidfile is not None:
3402
3409
with pidfile:
3403
3410
print(pid, file=pidfile)
3404
3411
except IOError:
3405
logger.error("Could not write to file %r with PID %d",
3406
pidfilename, pid)
3412
log.error("Could not write to file %r with PID %d",
3413
pidfilename, pid)
3407
3414
del pidfile
3408
3415
del pidfilename
3409
3416
3559
3566
3560
3567
try:
3561
3568
with tempfile.NamedTemporaryFile(
3562
mode='wb',
3569
mode="wb",
3563
3570
suffix=".pickle",
3564
prefix='clients-',
3571
prefix="clients-",
3565
3572
dir=os.path.dirname(stored_state_path),
3566
3573
delete=False) as stored_state:
3567
3574
pickle.dump((clients, client_settings), stored_state,
3575
3582
except NameError:
3576
3583
pass
3577
3584
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3578
logger.warning("Could not save persistent state: {}"
3579
.format(os.strerror(e.errno)))
3585
log.warning("Could not save persistent state: %s",
3586
os.strerror(e.errno))
3580
3587
else:
3581
logger.warning("Could not save persistent state:",
3582
exc_info=e)
3588
log.warning("Could not save persistent state:",
3589
exc_info=e)
3583
3590
raise
3584
3591
3585
3592
# Delete all clients, and settings from config
3611
3618
if zeroconf:
3612
3619
service.port = tcp_server.socket.getsockname()[1]
3613
3620
if use_ipv6:
3614
logger.info("Now listening on address %r, port %d,"
3615
" flowinfo %d, scope_id %d",
3616
*tcp_server.socket.getsockname())
3621
log.info("Now listening on address %r, port %d, flowinfo %d,"
3622
" scope_id %d", *tcp_server.socket.getsockname())
3617
3623
else: # IPv4
3618
logger.info("Now listening on address %r, port %d",
3619
*tcp_server.socket.getsockname())
3624
log.info("Now listening on address %r, port %d",
3625
*tcp_server.socket.getsockname())
3620
3626
3621
3627
# service.interface = tcp_server.socket.getsockname()[3]
3622
3628
3626
3632
try:
3627
3633
service.activate()
3628
3634
except dbus.exceptions.DBusException as error:
3629
logger.critical("D-Bus Exception", exc_info=error)
3635
log.critical("D-Bus Exception", exc_info=error)
3630
3636
cleanup()
3631
3637
sys.exit(1)
3632
3638
# End of Avahi example code
3637
3643
lambda *args, **kwargs: (tcp_server.handle_request
3638
3644
(*args[2:], **kwargs) or True))
3639
3645
3640
logger.debug("Starting main loop")
3646
log.debug("Starting main loop")
3641
3647
main_loop.run()
3642
3648
except AvahiError as error:
3643
logger.critical("Avahi Error", exc_info=error)
3649
log.critical("Avahi Error", exc_info=error)
3644
3650
cleanup()
3645
3651
sys.exit(1)
3646
3652
except KeyboardInterrupt:
3647
3653
if debug:
3648
3654
print("", file=sys.stderr)
3649
logger.debug("Server received KeyboardInterrupt")
3650
logger.debug("Server exiting")
3655
log.debug("Server received KeyboardInterrupt")
3656
log.debug("Server exiting")
3651
3657
# Must run before the D-Bus bus name gets deregistered
3652
3658
cleanup()
3653
3659
3654
3660
3655
def should_only_run_tests():
3661
def parse_test_args():
3662
# type: () -> argparse.Namespace
3656
3663
parser = argparse.ArgumentParser(add_help=False)
3657
parser.add_argument("--check", action='store_true')
3664
parser.add_argument("--check", action="store_true")
3665
parser.add_argument("--prefix", )
3658
3666
args, unknown_args = parser.parse_known_args()
3659
run_tests = args.check
3660
if run_tests:
3661
# Remove --check argument from sys.argv
3667
if args.check:
3668
# Remove test options from sys.argv
3662
3669
sys.argv[1:] = unknown_args
3663
return run_tests
3670
return args
3664
3671
3665
3672
# Add all tests from doctest strings
3666
3673
def load_tests(loader, tests, none):
3668
3675
tests.addTests(doctest.DocTestSuite())
3669
3676
return tests
3670
3677
3671
if __name__ == '__main__':
3678
if __name__ == "__main__":
3679
options = parse_test_args()
3672
3680
try:
3673
if should_only_run_tests():
3674
# Call using ./mandos --check [--verbose]
3675
unittest.main()
3681
if options.check:
3682
extra_test_prefix = options.prefix
3683
if extra_test_prefix is not None:
3684
if not (unittest.main(argv=[""], exit=False)
3685
.result.wasSuccessful()):
3686
sys.exit(1)
3687
class ExtraTestLoader(unittest.TestLoader):
3688
testMethodPrefix = extra_test_prefix
3689
# Call using ./scriptname --test [--verbose]
3690
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3691
else:
3692
unittest.main(argv=[""])
3676
3693
else:
3677
3694
main()
3678
3695
finally:
3679
3696
logging.shutdown()
3697
3698
# Local Variables:
3699
# run-tests:
3700
# (lambda (&optional extra)
3701
# (if (not (funcall run-tests-in-test-buffer default-directory
3702
# extra))
3703
# (funcall show-test-buffer-in-test-window)
3704
# (funcall remove-test-window)
3705
# (if extra (message "Extra tests run successfully!"))))
3706
# run-tests-in-test-buffer:
3707
# (lambda (dir &optional extra)
3708
# (with-current-buffer (get-buffer-create "*Test*")
3709
# (setq buffer-read-only nil
3710
# default-directory dir)
3711
# (erase-buffer)
3712
# (compilation-mode))
3713
# (let ((process-result
3714
# (let ((inhibit-read-only t))
3715
# (process-file-shell-command
3716
# (funcall get-command-line extra) nil "*Test*"))))
3717
# (and (numberp process-result)
3718
# (= process-result 0))))
3719
# get-command-line:
3720
# (lambda (&optional extra)
3721
# (let ((quoted-script
3722
# (shell-quote-argument (funcall get-script-name))))
3723
# (format
3724
# (concat "%s --check" (if extra " --prefix=atest" ""))
3725
# quoted-script)))
3726
# get-script-name:
3727
# (lambda ()
3728
# (if (fboundp 'file-local-name)
3729
# (file-local-name (buffer-file-name))
3730
# (or (file-remote-p (buffer-file-name) 'localname)
3731
# (buffer-file-name))))
3732
# remove-test-window:
3733
# (lambda ()
3734
# (let ((test-window (get-buffer-window "*Test*")))
3735
# (if test-window (delete-window test-window))))
3736
# show-test-buffer-in-test-window:
3737
# (lambda ()
3738
# (when (not (get-buffer-window-list "*Test*"))
3739
# (setq next-error-last-buffer (get-buffer "*Test*"))
3740
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3741
# (display-buffer-overriding-action
3742
# `((display-buffer-in-side-window) (side . ,side)
3743
# (window-height . fit-window-to-buffer)
3744
# (window-width . fit-window-to-buffer))))
3745
# (display-buffer "*Test*"))))
3746
# eval:
3747
# (progn
3748
# (let* ((run-extra-tests (lambda () (interactive)
3749
# (funcall run-tests t)))
3750
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3751
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3752
# (setq minor-mode-overriding-map-alist
3753
# (cons `(run-tests . ,outer-keymap)
3754
# minor-mode-overriding-map-alist)))
3755
# (add-hook 'after-save-hook run-tests 90 t))
3756
# End:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0