To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1127
- compare with another revision
- download diff
- download tarball
- view history from revision 1127
- Committer: Teddy Hogeborn
- Date: 2019-07-27 10:11:45 UTC
- Revision ID: teddy@recompile.se-20190727101145-jnpbpf8220gldbcd
Add dracut(8) support
Add support for the dracut(8) system for generating initramfs image
files; dracut is an alternative to the "initramfs-tools" package.
* .bzrignore (dracut-module/password-agent): Ignore new binary file.
* dracut-module: New directory for the dracut module.
* INSTALL (Prerequisites/Libraries/Mandos Client): Add dracut as an
alternative to
initramfs-tools,
and also add GLib.
* Makefile (DRACUTMODULE, GLIB_CFLAGS, GLIB_LIBS): New.
(CPROGS): Add "dracut-module/password-agent".
(DOCS): Add "dracut-module/password-agent.8mandos".
(dracut-module/password-agent.8mandos): New.
(dracut-module/password-agent.8mandos.xhtml): - '' -
(dracut-module/password-agent): - '' -
(check): Add command to run tests of password-agent(8mandos).
(install-client-nokey): Also install the dracut module directory,
its files, and the password-agent(8mandos)
manual page.
(install-client): To update the initramfs image file, run
update-initramfs or dracut depending on what is
installed.
(uninstall-client): - '' - and also uninstall the the files in the
dracut module directory, that directory itself,
and the password-agent(8mandos) manual page.
* debian/control (Build-Depends): Add "libglib2.0-dev (>=2.40)".
(Package: mandos-client/Depends): Add "dracut (>= 044+241-3)" as an
alternative dependency to
initramfs-tools.
(Package: mandos-client/Conflicts): New; set to
"dracut-config-generic".
(debian/mandos-client.README.Debian): Document alternative commands
to update the initramfs image
for when dracut is used.
* debian/mandos-client.postinst (update_initramfs): Use alternative
commands to update
the initramfs
image for when
dracut is used.
* debian/tests/control (password-agent, password-agent-suid): Add two
new tests.
* dracut-module/ask-password-mandos.path: New.
* dracut-module/ask-password-mandos.service: - '' -
* dracut-module/cmdline-mandos.sh: - '' -
* dracut-module/module-setup.sh: - '' -
* dracut-module/password-agent.c: - '' -
* dracut-module/password-agent.xml: - '' -
* initramfs-unpack: Use the dracut "skipcpio" command, if available.
Also be more flexible and try hard to detect where
compressed data starts.
* plugins.d/mandos-client.xml (SECURITY): Be more precise that the
mandos-client binary might
not always be setuid, but
that the program assumes
that it has been started
that way.
* plugins.d/password-prompt.c: Add new "--prompt" option.
(conflict_detection): First try to detect the new PID file of
plymouth.
(main): Define and use new "prompt" variable.
* plugins.d/password-prompt.xml (SYNOPSIS): Show new --prompt option.
(DESCRIPTION): Describe new behavior of looking for plymouth PID
file.
(OPTIONS): Document new "--prompt" option.
(ENVIRONMENT): Clarify that the CRYPTTAB_SOURCE and CRYPTTAB_NAME
environment variables are not used if the --prompt
option is used. Remove unnecessarily specific
details about where the CRYPTTAB_SOURCE and
CRYPTTAB_NAME comes from, since this can now be
either initramfs-tools or dracut.
(SEE ALSO): Remove superfluous crypttab(5) reference, and add commas
to separate the other references.
* plugins.d/plymouth.c: Add new "--prompt" and "--debug" options.
(debug): New global flag.
(fprintf_plus): New function, used for debug output.
(exec_and_wait): Add extra "const" to "argv" argument.
(main): Define and use new "prompt" variable. Add debug output.
(main/options, main/parse_opt): New; used to parse options.
* plugins.d/plymouth.xml (SYNOPSIS): Show new options.
(OPTIONS): Document new options.
(ENVIRONMENT): Clarify that the cryptsource and crypttarget
environment variables are not used if the --prompt
option is used. Remove unnecessarily specific
details about where the cryptsource and crypttarget
comes from, since this can now be either
initramfs-tools or dracut.
(EXAMPLE): Add an example using an option.
(SEE ALSO): Remove superfluous crypttab(5) reference.
* plugins.d/splashy.xml (ENVIRONMENT): Clarify that the cryptsource
and crypttarget environment
variables are not used if the
--prompt option is used.
Remove unnecessarily specific
details about where the
cryptsource and crypttarget
comes from, since this can now
be either initramfs-tools or
dracut.
(SEE ALSO): Remove superfluous crypttab(5) reference.
* plugins.d/usplash.xml (ENVIRONMENT): Clarify that the cryptsource
and crypttarget environment
variables are not used if the
--prompt option is used.
Remove unnecessarily specific
details about where the
cryptsource and crypttarget
comes from, since this can now
be either initramfs-tools or
dracut.
(SEE ALSO): Remove superfluous crypttab(5) reference.
Add support for the dracut(8) system for generating initramfs image
files; dracut is an alternative to the "initramfs-tools" package.
* .bzrignore (dracut-module/password-agent): Ignore new binary file.
* dracut-module: New directory for the dracut module.
* INSTALL (Prerequisites/Libraries/Mandos Client): Add dracut as an
alternative to
initramfs-tools,
and also add GLib.
* Makefile (DRACUTMODULE, GLIB_CFLAGS, GLIB_LIBS): New.
(CPROGS): Add "dracut-module/password-agent".
(DOCS): Add "dracut-module/password-agent.8mandos".
(dracut-module/password-agent.8mandos): New.
(dracut-module/password-agent.8mandos.xhtml): - '' -
(dracut-module/password-agent): - '' -
(check): Add command to run tests of password-agent(8mandos).
(install-client-nokey): Also install the dracut module directory,
its files, and the password-agent(8mandos)
manual page.
(install-client): To update the initramfs image file, run
update-initramfs or dracut depending on what is
installed.
(uninstall-client): - '' - and also uninstall the the files in the
dracut module directory, that directory itself,
and the password-agent(8mandos) manual page.
* debian/control (Build-Depends): Add "libglib2.0-dev (>=2.40)".
(Package: mandos-client/Depends): Add "dracut (>= 044+241-3)" as an
alternative dependency to
initramfs-tools.
(Package: mandos-client/Conflicts): New; set to
"dracut-config-generic".
(debian/mandos-client.README.Debian): Document alternative commands
to update the initramfs image
for when dracut is used.
* debian/mandos-client.postinst (update_initramfs): Use alternative
commands to update
the initramfs
image for when
dracut is used.
* debian/tests/control (password-agent, password-agent-suid): Add two
new tests.
* dracut-module/ask-password-mandos.path: New.
* dracut-module/ask-password-mandos.service: - '' -
* dracut-module/cmdline-mandos.sh: - '' -
* dracut-module/module-setup.sh: - '' -
* dracut-module/password-agent.c: - '' -
* dracut-module/password-agent.xml: - '' -
* initramfs-unpack: Use the dracut "skipcpio" command, if available.
Also be more flexible and try hard to detect where
compressed data starts.
* plugins.d/mandos-client.xml (SECURITY): Be more precise that the
mandos-client binary might
not always be setuid, but
that the program assumes
that it has been started
that way.
* plugins.d/password-prompt.c: Add new "--prompt" option.
(conflict_detection): First try to detect the new PID file of
plymouth.
(main): Define and use new "prompt" variable.
* plugins.d/password-prompt.xml (SYNOPSIS): Show new --prompt option.
(DESCRIPTION): Describe new behavior of looking for plymouth PID
file.
(OPTIONS): Document new "--prompt" option.
(ENVIRONMENT): Clarify that the CRYPTTAB_SOURCE and CRYPTTAB_NAME
environment variables are not used if the --prompt
option is used. Remove unnecessarily specific
details about where the CRYPTTAB_SOURCE and
CRYPTTAB_NAME comes from, since this can now be
either initramfs-tools or dracut.
(SEE ALSO): Remove superfluous crypttab(5) reference, and add commas
to separate the other references.
* plugins.d/plymouth.c: Add new "--prompt" and "--debug" options.
(debug): New global flag.
(fprintf_plus): New function, used for debug output.
(exec_and_wait): Add extra "const" to "argv" argument.
(main): Define and use new "prompt" variable. Add debug output.
(main/options, main/parse_opt): New; used to parse options.
* plugins.d/plymouth.xml (SYNOPSIS): Show new options.
(OPTIONS): Document new options.
(ENVIRONMENT): Clarify that the cryptsource and crypttarget
environment variables are not used if the --prompt
option is used. Remove unnecessarily specific
details about where the cryptsource and crypttarget
comes from, since this can now be either
initramfs-tools or dracut.
(EXAMPLE): Add an example using an option.
(SEE ALSO): Remove superfluous crypttab(5) reference.
* plugins.d/splashy.xml (ENVIRONMENT): Clarify that the cryptsource
and crypttarget environment
variables are not used if the
--prompt option is used.
Remove unnecessarily specific
details about where the
cryptsource and crypttarget
comes from, since this can now
be either initramfs-tools or
dracut.
(SEE ALSO): Remove superfluous crypttab(5) reference.
* plugins.d/usplash.xml (ENVIRONMENT): Clarify that the cryptsource
and crypttarget environment
variables are not used if the
--prompt option is used.
Remove unnecessarily specific
details about where the
cryptsource and crypttarget
comes from, since this can now
be either initramfs-tools or
dracut.
(SEE ALSO): Remove superfluous crypttab(5) reference.
- files removed:
- debian/po/POTFILES.in
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
39
40
except ImportError:
40
41
pass
41
42
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
43
try:
48
44
import SocketServer as socketserver
49
45
except ImportError:
50
46
import socketserver
51
47
import socket
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
import ConfigParser as configparser
56
53
except ImportError:
57
54
import configparser
55
import sys
58
56
import re
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import random
81
import shlex
82
80
83
81
import dbus
84
82
import dbus.service
85
import gi
86
83
from gi.repository import GLib
87
84
from dbus.mainloop.glib import DBusGMainLoop
88
85
import ctypes
90
87
import xml.dom.minidom
91
88
import inspect
92
89
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
90
# Try to find the value of SO_BINDTODEVICE:
119
91
try:
120
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
140
112
# No value found
141
113
SO_BINDTODEVICE = None
142
114
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
115
if sys.version_info.major == 2:
116
str = unicode
145
117
146
version = "1.8.15"
118
version = "1.8.4"
147
119
stored_state_file = "clients.pickle"
148
120
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
150
logging.captureWarnings(True) # Show warnings via the logging system
121
logger = logging.getLogger()
151
122
syslogger = None
152
123
153
124
try:
189
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
161
address="/dev/log"))
191
162
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
163
('Mandos [%(process)d]: %(levelname)s:'
164
' %(message)s'))
165
logger.addHandler(syslogger)
195
166
196
167
if debug:
197
168
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
169
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
170
' [%(process)d]:'
171
' %(levelname)s:'
172
' %(message)s'))
173
logger.addHandler(console)
174
logger.setLevel(level)
204
175
205
176
206
177
class PGPError(Exception):
208
179
pass
209
180
210
181
211
class PGPEngine:
182
class PGPEngine(object):
212
183
"""A simple class for OpenPGP symmetric encryption & decryption"""
213
184
214
185
def __init__(self):
218
189
output = subprocess.check_output(["gpgconf"])
219
190
for line in output.splitlines():
220
191
name, text, path = line.split(b":")
221
if name == b"gpg":
192
if name == "gpg":
222
193
self.gpg = path
223
194
break
224
195
except OSError as e:
225
196
if e.errno != errno.ENOENT:
226
197
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
198
self.gnupgargs = ['--batch',
199
'--homedir', self.tempdir,
200
'--force-mdc',
201
'--quiet']
231
202
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
203
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
233
204
self.gnupgargs.append("--no-use-agent")
234
205
235
206
def __enter__(self):
272
243
dir=self.tempdir) as passfile:
273
244
passfile.write(passphrase)
274
245
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
246
proc = subprocess.Popen([self.gpg, '--symmetric',
247
'--passphrase-file',
277
248
passfile.name]
278
249
+ self.gnupgargs,
279
250
stdin=subprocess.PIPE,
290
261
dir=self.tempdir) as passfile:
291
262
passfile.write(passphrase)
292
263
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
264
proc = subprocess.Popen([self.gpg, '--decrypt',
265
'--passphrase-file',
295
266
passfile.name]
296
267
+ self.gnupgargs,
297
268
stdin=subprocess.PIPE,
304
275
305
276
306
277
# Pretend that we have an Avahi module
307
class avahi:
278
class avahi(object):
308
279
"""This isn't so much a class as it is a module-like namespace."""
309
280
IF_UNSPEC = -1 # avahi-common/address.h
310
281
PROTO_UNSPEC = -1 # avahi-common/address.h
344
315
pass
345
316
346
317
347
class AvahiService:
318
class AvahiService(object):
348
319
"""An Avahi (Zeroconf) service.
349
320
350
321
Attributes:
351
322
interface: integer; avahi.IF_UNSPEC or an interface index.
352
323
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
324
name: string; Example: 'Mandos'
325
type: string; Example: '_mandos._tcp'.
355
326
See <https://www.iana.org/assignments/service-names-port-numbers>
356
327
port: integer; what port to announce
357
328
TXT: list of strings; TXT record for the service
394
365
def rename(self, remove=True):
395
366
"""Derived from the Avahi example code"""
396
367
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
368
logger.critical("No suitable Zeroconf service name found"
369
" after %i retries, exiting.",
370
self.rename_count)
400
371
raise AvahiServiceError("Too many renames")
401
372
self.name = str(
402
373
self.server.GetAlternativeServiceName(self.name))
403
374
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
375
logger.info("Changing Zeroconf service name to %r ...",
376
self.name)
406
377
if remove:
407
378
self.remove()
408
379
try:
410
381
except dbus.exceptions.DBusException as error:
411
382
if (error.get_dbus_name()
412
383
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
384
logger.info("Local Zeroconf service name collision.")
414
385
return self.rename(remove=False)
415
386
else:
416
log.critical("D-Bus Exception", exc_info=error)
387
logger.critical("D-Bus Exception", exc_info=error)
417
388
self.cleanup()
418
389
os._exit(1)
419
390
435
406
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
407
self.entry_group_state_changed_match = (
437
408
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
409
'StateChanged', self.entry_group_state_changed))
410
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
411
self.name, self.type)
441
412
self.group.AddService(
442
413
self.interface,
443
414
self.protocol,
450
421
451
422
def entry_group_state_changed(self, state, error):
452
423
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
424
logger.debug("Avahi entry group state change: %i", state)
454
425
455
426
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
427
logger.debug("Zeroconf service established.")
457
428
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
429
logger.info("Zeroconf service name collision.")
459
430
self.rename()
460
431
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
432
logger.critical("Avahi: Error in group state changed %s",
433
str(error))
463
434
raise AvahiGroupError("State changed: {!s}".format(error))
464
435
465
436
def cleanup(self):
475
446
476
447
def server_state_changed(self, state, error=None):
477
448
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
449
logger.debug("Avahi server state change: %i", state)
479
450
bad_states = {
480
451
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
452
avahi.SERVER_REGISTERING: None,
485
456
if state in bad_states:
486
457
if bad_states[state] is not None:
487
458
if error is None:
488
log.error(bad_states[state])
459
logger.error(bad_states[state])
489
460
else:
490
log.error(bad_states[state] + ": %r", error)
461
logger.error(bad_states[state] + ": %r", error)
491
462
self.cleanup()
492
463
elif state == avahi.SERVER_RUNNING:
493
464
try:
495
466
except dbus.exceptions.DBusException as error:
496
467
if (error.get_dbus_name()
497
468
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
469
logger.info("Local Zeroconf service name"
470
" collision.")
499
471
return self.rename(remove=False)
500
472
else:
501
log.critical("D-Bus Exception", exc_info=error)
473
logger.critical("D-Bus Exception", exc_info=error)
502
474
self.cleanup()
503
475
os._exit(1)
504
476
else:
505
477
if error is None:
506
log.debug("Unknown state: %r", state)
478
logger.debug("Unknown state: %r", state)
507
479
else:
508
log.debug("Unknown state: %r: %r", state, error)
480
logger.debug("Unknown state: %r: %r", state, error)
509
481
510
482
def activate(self):
511
483
"""Derived from the Avahi example code"""
523
495
class AvahiServiceToSyslog(AvahiService):
524
496
def rename(self, *args, **kwargs):
525
497
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
498
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
528
499
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
501
.format(self.name)))
531
502
return ret
532
503
533
504
534
505
# Pretend that we have a GnuTLS module
535
class gnutls:
506
class gnutls(object):
536
507
"""This isn't so much a class as it is a module-like namespace."""
537
508
538
509
library = ctypes.util.find_library("gnutls")
562
533
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
534
564
535
# Types
565
class _session_int(ctypes.Structure):
536
class session_int(ctypes.Structure):
566
537
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
538
session_t = ctypes.POINTER(session_int)
568
539
569
540
class certificate_credentials_st(ctypes.Structure):
570
541
_fields_ = []
573
544
certificate_type_t = ctypes.c_int
574
545
575
546
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
547
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
548
('size', ctypes.c_uint)]
578
549
579
class _openpgp_crt_int(ctypes.Structure):
550
class openpgp_crt_int(ctypes.Structure):
580
551
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
552
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
553
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
554
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
555
credentials_type_t = ctypes.c_int
593
564
# gnutls.strerror()
594
565
self.code = code
595
566
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
567
message = gnutls.strerror(code)
598
568
return super(gnutls.Error, self).__init__(
599
569
message, *args)
600
570
601
571
class CertificateSecurityError(Error):
602
572
pass
603
573
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
574
# Classes
630
class Credentials(With_from_param):
575
class Credentials(object):
631
576
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
577
self._c_object = gnutls.certificate_credentials_t()
578
gnutls.certificate_allocate_credentials(
579
ctypes.byref(self._c_object))
634
580
self.type = gnutls.CRD_CERTIFICATE
635
581
636
582
def __del__(self):
637
gnutls.certificate_free_credentials(self)
583
gnutls.certificate_free_credentials(self._c_object)
638
584
639
class ClientSession(With_from_param):
585
class ClientSession(object):
640
586
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
587
self._c_object = gnutls.session_t()
642
588
gnutls_flags = gnutls.CLIENT
643
if gnutls.check_version(b"3.5.6"):
589
if gnutls.check_version("3.5.6"):
644
590
gnutls_flags |= gnutls.NO_TICKETS
645
591
if gnutls.has_rawpk:
646
592
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
593
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
648
594
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
595
gnutls.set_default_priority(self._c_object)
596
gnutls.transport_set_ptr(self._c_object, socket.fileno())
597
gnutls.handshake_set_private_extensions(self._c_object,
598
True)
652
599
self.socket = socket
653
600
if credentials is None:
654
601
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
602
gnutls.credentials_set(self._c_object, credentials.type,
603
ctypes.cast(credentials._c_object,
604
ctypes.c_void_p))
657
605
self.credentials = credentials
658
606
659
607
def __del__(self):
660
gnutls.deinit(self)
608
gnutls.deinit(self._c_object)
661
609
662
610
def handshake(self):
663
return gnutls.handshake(self)
611
return gnutls.handshake(self._c_object)
664
612
665
613
def send(self, data):
666
614
data = bytes(data)
667
615
data_len = len(data)
668
616
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
617
data_len -= gnutls.record_send(self._c_object,
618
data[-data_len:],
670
619
data_len)
671
620
672
621
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
622
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
623
675
624
# Error handling functions
676
625
def _error_code(result):
677
626
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
627
for the 'restype' attribute on ctypes functions"""
628
if result >= 0:
680
629
return result
681
630
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
631
raise gnutls.CertificateSecurityError(code=result)
683
632
raise gnutls.Error(code=result)
684
633
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
634
def _retry_on_error(result, func, arguments):
687
635
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
636
for the 'errcheck' attribute on ctypes functions"""
637
while result < 0:
690
638
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
639
return _error_code(result)
692
640
result = func(*arguments)
697
645
698
646
# Functions
699
647
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
648
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
649
ctypes.POINTER(ctypes.c_char_p)]
702
650
priority_set_direct.restype = _error_code
703
651
704
652
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
653
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
654
init.restype = _error_code
707
655
708
656
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
657
set_default_priority.argtypes = [session_t]
710
658
set_default_priority.restype = _error_code
711
659
712
660
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
661
record_send.argtypes = [session_t, ctypes.c_void_p,
714
662
ctypes.c_size_t]
715
663
record_send.restype = ctypes.c_ssize_t
716
664
record_send.errcheck = _retry_on_error
718
666
certificate_allocate_credentials = (
719
667
_library.gnutls_certificate_allocate_credentials)
720
668
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
669
ctypes.POINTER(certificate_credentials_t)]
722
670
certificate_allocate_credentials.restype = _error_code
723
671
724
672
certificate_free_credentials = (
725
673
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
674
certificate_free_credentials.argtypes = [
675
certificate_credentials_t]
727
676
certificate_free_credentials.restype = None
728
677
729
678
handshake_set_private_extensions = (
730
679
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
680
handshake_set_private_extensions.argtypes = [session_t,
732
681
ctypes.c_int]
733
682
handshake_set_private_extensions.restype = None
734
683
735
684
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
685
credentials_set.argtypes = [session_t, credentials_type_t,
686
ctypes.c_void_p]
738
687
credentials_set.restype = _error_code
739
688
740
689
strerror = _library.gnutls_strerror
742
691
strerror.restype = ctypes.c_char_p
743
692
744
693
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
694
certificate_type_get.argtypes = [session_t]
746
695
certificate_type_get.restype = _error_code
747
696
748
697
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
698
certificate_get_peers.argtypes = [session_t,
750
699
ctypes.POINTER(ctypes.c_uint)]
751
700
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
701
759
708
global_set_log_function.restype = None
760
709
761
710
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
711
deinit.argtypes = [session_t]
763
712
deinit.restype = None
764
713
765
714
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
715
handshake.argtypes = [session_t]
716
handshake.restype = _error_code
768
717
handshake.errcheck = _retry_on_error
769
718
770
719
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
720
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
721
transport_set_ptr.restype = None
773
722
774
723
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
724
bye.argtypes = [session_t, close_request_t]
725
bye.restype = _error_code
777
726
bye.errcheck = _retry_on_error
778
727
779
728
check_version = _library.gnutls_check_version
796
745
797
746
x509_crt_fmt_t = ctypes.c_int
798
747
799
# All the function declarations below are from
800
# gnutls/abstract.h
748
# All the function declarations below are from gnutls/abstract.h
801
749
pubkey_init = _library.gnutls_pubkey_init
802
750
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
751
pubkey_init.restype = _error_code
817
765
pubkey_deinit.argtypes = [pubkey_t]
818
766
pubkey_deinit.restype = None
819
767
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
768
# All the function declarations below are from gnutls/openpgp.h
822
769
823
770
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
771
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
830
777
openpgp_crt_fmt_t]
831
778
openpgp_crt_import.restype = _error_code
832
779
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
780
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
781
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
782
ctypes.POINTER(ctypes.c_uint)]
840
783
openpgp_crt_verify_self.restype = _error_code
841
784
842
785
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
851
794
ctypes.c_size_t)]
852
795
openpgp_crt_get_fingerprint.restype = _error_code
853
796
854
if check_version(b"3.6.4"):
797
if check_version("3.6.4"):
855
798
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
799
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
857
800
certificate_type_get2.restype = _error_code
858
801
859
802
# Remove non-public functions
871
814
connection.close()
872
815
873
816
874
class Client:
817
class Client(object):
875
818
"""A representation of a client host served by this server.
876
819
877
820
Attributes:
878
approved: bool(); None if not yet approved/disapproved
821
approved: bool(); 'None' if not yet approved/disapproved
879
822
approval_delay: datetime.timedelta(); Time to wait for approval
880
823
approval_duration: datetime.timedelta(); Duration of one approval
881
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
883
running.
824
checker: subprocess.Popen(); a running checker process used
825
to see if the client lives.
826
'None' if no process is running.
884
827
checker_callback_tag: a GLib event source tag, or None
885
828
checker_command: string; External command which is run to check
886
829
if client lives. %() expansions are done at
1009
952
self.last_enabled = None
1010
953
self.expires = None
1011
954
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
955
logger.debug("Creating client %r", self.name)
956
logger.debug(" Key ID: %s", self.key_id)
957
logger.debug(" Fingerprint: %s", self.fingerprint)
1015
958
self.created = settings.get("created",
1016
959
datetime.datetime.utcnow())
1017
960
1045
988
if getattr(self, "enabled", False):
1046
989
# Already enabled
1047
990
return
991
self.expires = datetime.datetime.utcnow() + self.timeout
1048
992
self.enabled = True
1049
993
self.last_enabled = datetime.datetime.utcnow()
1050
994
self.init_checker()
1055
999
if not getattr(self, "enabled", False):
1056
1000
return False
1057
1001
if not quiet:
1058
log.info("Disabling client %s", self.name)
1002
logger.info("Disabling client %s", self.name)
1059
1003
if getattr(self, "disable_initiator_tag", None) is not None:
1060
1004
GLib.source_remove(self.disable_initiator_tag)
1061
1005
self.disable_initiator_tag = None
1073
1017
def __del__(self):
1074
1018
self.disable()
1075
1019
1076
def init_checker(self, randomize_start=False):
1077
# Schedule a new checker to be started a randomly selected
1078
# time (a fraction of 'interval') from now. This spreads out
1079
# the startup of checkers over time when the server is
1080
# started.
1020
def init_checker(self):
1021
# Schedule a new checker to be started an 'interval' from now,
1022
# and every interval from then on.
1081
1023
if self.checker_initiator_tag is not None:
1082
1024
GLib.source_remove(self.checker_initiator_tag)
1083
interval_milliseconds = int(self.interval.total_seconds()
1084
* 1000)
1085
if randomize_start:
1086
delay_milliseconds = random.randrange(
1087
interval_milliseconds + 1)
1088
else:
1089
delay_milliseconds = interval_milliseconds
1090
1025
self.checker_initiator_tag = GLib.timeout_add(
1091
delay_milliseconds, self.start_checker, randomize_start)
1092
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1093
# A checker might take up to an 'interval' of time, so we can
1094
# expire at the soonest one interval after a checker was
1095
# started. Since the initial checker is delayed, the expire
1096
# time might have to be extended.
1097
now = datetime.datetime.utcnow()
1098
self.expires = now + delay + self.interval
1099
# Schedule a disable() at expire time
1026
int(self.interval.total_seconds() * 1000),
1027
self.start_checker)
1028
# Schedule a disable() when 'timeout' has passed
1100
1029
if self.disable_initiator_tag is not None:
1101
1030
GLib.source_remove(self.disable_initiator_tag)
1102
1031
self.disable_initiator_tag = GLib.timeout_add(
1103
int((self.expires - now).total_seconds() * 1000),
1104
self.disable)
1032
int(self.timeout.total_seconds() * 1000), self.disable)
1033
# Also start a new checker *right now*.
1034
self.start_checker()
1105
1035
1106
1036
def checker_callback(self, source, condition, connection,
1107
1037
command):
1108
1038
"""The checker has completed, so take appropriate actions."""
1039
self.checker_callback_tag = None
1040
self.checker = None
1109
1041
# Read return code from connection (see call_pipe)
1110
1042
returncode = connection.recv()
1111
1043
connection.close()
1112
if self.checker is not None:
1113
self.checker.join()
1114
self.checker_callback_tag = None
1115
self.checker = None
1116
1044
1117
1045
if returncode >= 0:
1118
1046
self.last_checker_status = returncode
1119
1047
self.last_checker_signal = None
1120
1048
if self.last_checker_status == 0:
1121
log.info("Checker for %(name)s succeeded", vars(self))
1049
logger.info("Checker for %(name)s succeeded",
1050
vars(self))
1122
1051
self.checked_ok()
1123
1052
else:
1124
log.info("Checker for %(name)s failed", vars(self))
1053
logger.info("Checker for %(name)s failed", vars(self))
1125
1054
else:
1126
1055
self.last_checker_status = -1
1127
1056
self.last_checker_signal = -returncode
1128
log.warning("Checker for %(name)s crashed?", vars(self))
1057
logger.warning("Checker for %(name)s crashed?",
1058
vars(self))
1129
1059
return False
1130
1060
1131
1061
def checked_ok(self):
1150
1080
def need_approval(self):
1151
1081
self.last_approval_request = datetime.datetime.utcnow()
1152
1082
1153
def start_checker(self, start_was_randomized=False):
1083
def start_checker(self):
1154
1084
"""Start a new checker subprocess if one is not running.
1155
1085
1156
1086
If a checker already exists, leave it running and do
1165
1095
# should be.
1166
1096
1167
1097
if self.checker is not None and not self.checker.is_alive():
1168
log.warning("Checker was not alive; joining")
1098
logger.warning("Checker was not alive; joining")
1169
1099
self.checker.join()
1170
1100
self.checker = None
1171
1101
# Start a new checker if needed
1172
1102
if self.checker is None:
1173
1103
# Escape attributes for the shell
1174
1104
escaped_attrs = {
1175
attr: shlex.quote(str(getattr(self, attr)))
1105
attr: re.escape(str(getattr(self, attr)))
1176
1106
for attr in self.runtime_expansions}
1177
1107
try:
1178
1108
command = self.checker_command % escaped_attrs
1179
1109
except TypeError as error:
1180
log.error('Could not format string "%s"',
1181
self.checker_command, exc_info=error)
1110
logger.error('Could not format string "%s"',
1111
self.checker_command,
1112
exc_info=error)
1182
1113
return True # Try again later
1183
1114
self.current_checker_command = command
1184
log.info("Starting checker %r for %s", command, self.name)
1115
logger.info("Starting checker %r for %s", command,
1116
self.name)
1185
1117
# We don't need to redirect stdout and stderr, since
1186
1118
# in normal mode, that is already done by daemon(),
1187
1119
# and in debug mode we don't want to. (Stdin is
1203
1135
kwargs=popen_args)
1204
1136
self.checker.start()
1205
1137
self.checker_callback_tag = GLib.io_add_watch(
1206
GLib.IOChannel.unix_new(pipe[0].fileno()),
1207
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1138
pipe[0].fileno(), GLib.IO_IN,
1208
1139
self.checker_callback, pipe[0], command)
1209
if start_was_randomized:
1210
# We were started after a random delay; Schedule a new
1211
# checker to be started an 'interval' from now, and every
1212
# interval from then on.
1213
now = datetime.datetime.utcnow()
1214
self.checker_initiator_tag = GLib.timeout_add(
1215
int(self.interval.total_seconds() * 1000),
1216
self.start_checker)
1217
self.expires = max(self.expires, now + self.interval)
1218
# Don't start a new checker again after same random delay
1219
return False
1220
1140
# Re-run this periodically if run by GLib.timeout_add
1221
1141
return True
1222
1142
1227
1147
self.checker_callback_tag = None
1228
1148
if getattr(self, "checker", None) is None:
1229
1149
return
1230
log.debug("Stopping checker for %(name)s", vars(self))
1150
logger.debug("Stopping checker for %(name)s", vars(self))
1231
1151
self.checker.terminate()
1232
1152
self.checker = None
1233
1153
1260
1180
func._dbus_name = func.__name__
1261
1181
if func._dbus_name.endswith("_dbus_property"):
1262
1182
func._dbus_name = func._dbus_name[:-14]
1263
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1183
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1264
1184
return func
1265
1185
1266
1186
return decorator
1355
1275
1356
1276
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1357
1277
out_signature="s",
1358
path_keyword="object_path",
1359
connection_keyword="connection")
1278
path_keyword='object_path',
1279
connection_keyword='connection')
1360
1280
def Introspect(self, object_path, connection):
1361
1281
"""Overloading of standard D-Bus method.
1362
1282
1411
1331
document.unlink()
1412
1332
except (AttributeError, xml.dom.DOMException,
1413
1333
xml.parsers.expat.ExpatError) as error:
1414
log.error("Failed to override Introspection method",
1415
exc_info=error)
1334
logger.error("Failed to override Introspection method",
1335
exc_info=error)
1416
1336
return xmlstring
1417
1337
1418
1338
1476
1396
raise ValueError("Byte arrays not supported for non-"
1477
1397
"'ay' signature {!r}"
1478
1398
.format(prop._dbus_signature))
1479
value = dbus.ByteArray(bytes(value))
1399
value = dbus.ByteArray(b''.join(chr(byte)
1400
for byte in value))
1480
1401
prop(value)
1481
1402
1482
1403
@dbus.service.method(dbus.PROPERTIES_IFACE,
1515
1436
1516
1437
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1517
1438
out_signature="s",
1518
path_keyword="object_path",
1519
connection_keyword="connection")
1439
path_keyword='object_path',
1440
connection_keyword='connection')
1520
1441
def Introspect(self, object_path, connection):
1521
1442
"""Overloading of standard D-Bus method.
1522
1443
1578
1499
document.unlink()
1579
1500
except (AttributeError, xml.dom.DOMException,
1580
1501
xml.parsers.expat.ExpatError) as error:
1581
log.error("Failed to override Introspection method",
1582
exc_info=error)
1502
logger.error("Failed to override Introspection method",
1503
exc_info=error)
1583
1504
return xmlstring
1584
1505
1585
1506
1617
1538
1618
1539
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1619
1540
out_signature="s",
1620
path_keyword="object_path",
1621
connection_keyword="connection")
1541
path_keyword='object_path',
1542
connection_keyword='connection')
1622
1543
def Introspect(self, object_path, connection):
1623
1544
"""Overloading of standard D-Bus method.
1624
1545
1649
1570
document.unlink()
1650
1571
except (AttributeError, xml.dom.DOMException,
1651
1572
xml.parsers.expat.ExpatError) as error:
1652
log.error("Failed to override Introspection method",
1653
exc_info=error)
1573
logger.error("Failed to override Introspection method",
1574
exc_info=error)
1654
1575
return xmlstring
1655
1576
1656
1577
2287
2208
del _interface
2288
2209
2289
2210
2290
class ProxyClient:
2211
class ProxyClient(object):
2291
2212
def __init__(self, child_pipe, key_id, fpr, address):
2292
2213
self._pipe = child_pipe
2293
self._pipe.send(("init", key_id, fpr, address))
2214
self._pipe.send(('init', key_id, fpr, address))
2294
2215
if not self._pipe.recv():
2295
2216
raise KeyError(key_id or fpr)
2296
2217
2297
2218
def __getattribute__(self, name):
2298
if name == "_pipe":
2219
if name == '_pipe':
2299
2220
return super(ProxyClient, self).__getattribute__(name)
2300
self._pipe.send(("getattr", name))
2221
self._pipe.send(('getattr', name))
2301
2222
data = self._pipe.recv()
2302
if data[0] == "data":
2223
if data[0] == 'data':
2303
2224
return data[1]
2304
if data[0] == "function":
2225
if data[0] == 'function':
2305
2226
2306
2227
def func(*args, **kwargs):
2307
self._pipe.send(("funcall", name, args, kwargs))
2228
self._pipe.send(('funcall', name, args, kwargs))
2308
2229
return self._pipe.recv()[1]
2309
2230
2310
2231
return func
2311
2232
2312
2233
def __setattr__(self, name, value):
2313
if name == "_pipe":
2234
if name == '_pipe':
2314
2235
return super(ProxyClient, self).__setattr__(name, value)
2315
self._pipe.send(("setattr", name, value))
2236
self._pipe.send(('setattr', name, value))
2316
2237
2317
2238
2318
2239
class ClientHandler(socketserver.BaseRequestHandler, object):
2323
2244
2324
2245
def handle(self):
2325
2246
with contextlib.closing(self.server.child_pipe) as child_pipe:
2326
log.info("TCP connection from: %s",
2327
str(self.client_address))
2328
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2247
logger.info("TCP connection from: %s",
2248
str(self.client_address))
2249
logger.debug("Pipe FD: %d",
2250
self.server.child_pipe.fileno())
2329
2251
2330
2252
session = gnutls.ClientSession(self.request)
2331
2253
2332
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2254
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2333
2255
# "+AES-256-CBC", "+SHA1",
2334
2256
# "+COMP-NULL", "+CTYPE-OPENPGP",
2335
2257
# "+DHE-DSS"))
2337
2259
priority = self.server.gnutls_priority
2338
2260
if priority is None:
2339
2261
priority = "NORMAL"
2340
gnutls.priority_set_direct(session,
2341
priority.encode("utf-8"), None)
2262
gnutls.priority_set_direct(session._c_object,
2263
priority.encode("utf-8"),
2264
None)
2342
2265
2343
2266
# Start communication using the Mandos protocol
2344
2267
# Get protocol number
2345
2268
line = self.request.makefile().readline()
2346
log.debug("Protocol version: %r", line)
2269
logger.debug("Protocol version: %r", line)
2347
2270
try:
2348
2271
if int(line.strip().split()[0]) > 1:
2349
2272
raise RuntimeError(line)
2350
2273
except (ValueError, IndexError, RuntimeError) as error:
2351
log.error("Unknown protocol version: %s", error)
2274
logger.error("Unknown protocol version: %s", error)
2352
2275
return
2353
2276
2354
2277
# Start GnuTLS connection
2355
2278
try:
2356
2279
session.handshake()
2357
2280
except gnutls.Error as error:
2358
log.warning("Handshake failed: %s", error)
2281
logger.warning("Handshake failed: %s", error)
2359
2282
# Do not run session.bye() here: the session is not
2360
2283
# established. Just abandon the request.
2361
2284
return
2362
log.debug("Handshake succeeded")
2285
logger.debug("Handshake succeeded")
2363
2286
2364
2287
approval_required = False
2365
2288
try:
2366
2289
if gnutls.has_rawpk:
2367
fpr = b""
2290
fpr = ""
2368
2291
try:
2369
2292
key_id = self.key_id(
2370
2293
self.peer_certificate(session))
2371
2294
except (TypeError, gnutls.Error) as error:
2372
log.warning("Bad certificate: %s", error)
2295
logger.warning("Bad certificate: %s", error)
2373
2296
return
2374
log.debug("Key ID: %s",
2375
key_id.decode("utf-8",
2376
errors="replace"))
2297
logger.debug("Key ID: %s", key_id)
2377
2298
2378
2299
else:
2379
key_id = b""
2300
key_id = ""
2380
2301
try:
2381
2302
fpr = self.fingerprint(
2382
2303
self.peer_certificate(session))
2383
2304
except (TypeError, gnutls.Error) as error:
2384
log.warning("Bad certificate: %s", error)
2305
logger.warning("Bad certificate: %s", error)
2385
2306
return
2386
log.debug("Fingerprint: %s", fpr)
2307
logger.debug("Fingerprint: %s", fpr)
2387
2308
2388
2309
try:
2389
2310
client = ProxyClient(child_pipe, key_id, fpr,
2398
2319
2399
2320
while True:
2400
2321
if not client.enabled:
2401
log.info("Client %s is disabled", client.name)
2322
logger.info("Client %s is disabled",
2323
client.name)
2402
2324
if self.server.use_dbus:
2403
2325
# Emit D-Bus signal
2404
2326
client.Rejected("Disabled")
2408
2330
# We are approved or approval is disabled
2409
2331
break
2410
2332
elif client.approved is None:
2411
log.info("Client %s needs approval",
2412
client.name)
2333
logger.info("Client %s needs approval",
2334
client.name)
2413
2335
if self.server.use_dbus:
2414
2336
# Emit D-Bus signal
2415
2337
client.NeedApproval(
2416
2338
client.approval_delay.total_seconds()
2417
2339
* 1000, client.approved_by_default)
2418
2340
else:
2419
log.warning("Client %s was not approved",
2420
client.name)
2341
logger.warning("Client %s was not approved",
2342
client.name)
2421
2343
if self.server.use_dbus:
2422
2344
# Emit D-Bus signal
2423
2345
client.Rejected("Denied")
2431
2353
time2 = datetime.datetime.now()
2432
2354
if (time2 - time) >= delay:
2433
2355
if not client.approved_by_default:
2434
log.warning("Client %s timed out while"
2435
" waiting for approval",
2436
client.name)
2356
logger.warning("Client %s timed out while"
2357
" waiting for approval",
2358
client.name)
2437
2359
if self.server.use_dbus:
2438
2360
# Emit D-Bus signal
2439
2361
client.Rejected("Approval timed out")
2446
2368
try:
2447
2369
session.send(client.secret)
2448
2370
except gnutls.Error as error:
2449
log.warning("gnutls send failed", exc_info=error)
2371
logger.warning("gnutls send failed",
2372
exc_info=error)
2450
2373
return
2451
2374
2452
log.info("Sending secret to %s", client.name)
2375
logger.info("Sending secret to %s", client.name)
2453
2376
# bump the timeout using extended_timeout
2454
2377
client.bump_timeout(client.extended_timeout)
2455
2378
if self.server.use_dbus:
2462
2385
try:
2463
2386
session.bye()
2464
2387
except gnutls.Error as error:
2465
log.warning("GnuTLS bye failed", exc_info=error)
2388
logger.warning("GnuTLS bye failed",
2389
exc_info=error)
2466
2390
2467
2391
@staticmethod
2468
2392
def peer_certificate(session):
2469
2393
"Return the peer's certificate as a bytestring"
2470
2394
try:
2471
cert_type = gnutls.certificate_type_get2(
2472
session, gnutls.CTYPE_PEERS)
2395
cert_type = gnutls.certificate_type_get2(session._c_object,
2396
gnutls.CTYPE_PEERS)
2473
2397
except AttributeError:
2474
cert_type = gnutls.certificate_type_get(session)
2398
cert_type = gnutls.certificate_type_get(session._c_object)
2475
2399
if gnutls.has_rawpk:
2476
2400
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2477
2401
else:
2478
2402
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2479
2403
# If not a valid certificate type...
2480
2404
if cert_type not in valid_cert_types:
2481
log.info("Cert type %r not in %r", cert_type,
2482
valid_cert_types)
2405
logger.info("Cert type %r not in %r", cert_type,
2406
valid_cert_types)
2483
2407
# ...return invalid data
2484
2408
return b""
2485
2409
list_size = ctypes.c_uint(1)
2486
2410
cert_list = (gnutls.certificate_get_peers
2487
(session, ctypes.byref(list_size)))
2411
(session._c_object, ctypes.byref(list_size)))
2488
2412
if not bool(cert_list) and list_size.value != 0:
2489
2413
raise gnutls.Error("error getting peer certificate")
2490
2414
if list_size.value == 0:
2512
2436
buf = ctypes.create_string_buffer(32)
2513
2437
buf_len = ctypes.c_size_t(len(buf))
2514
2438
# Get the key ID from the raw public key into the buffer
2515
gnutls.pubkey_get_key_id(
2516
pubkey,
2517
gnutls.KEYID_USE_SHA256,
2518
ctypes.cast(ctypes.byref(buf),
2519
ctypes.POINTER(ctypes.c_ubyte)),
2520
ctypes.byref(buf_len))
2439
gnutls.pubkey_get_key_id(pubkey,
2440
gnutls.KEYID_USE_SHA256,
2441
ctypes.cast(ctypes.byref(buf),
2442
ctypes.POINTER(ctypes.c_ubyte)),
2443
ctypes.byref(buf_len))
2521
2444
# Deinit the certificate
2522
2445
gnutls.pubkey_deinit(pubkey)
2523
2446
2564
2487
return hex_fpr
2565
2488
2566
2489
2567
class MultiprocessingMixIn:
2490
class MultiprocessingMixIn(object):
2568
2491
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2569
2492
2570
2493
def sub_process_main(self, request, address):
2582
2505
return proc
2583
2506
2584
2507
2585
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2508
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2586
2509
""" adds a pipe to the MixIn """
2587
2510
2588
2511
def process_request(self, request, client_address):
2603
2526
2604
2527
2605
2528
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2606
socketserver.TCPServer):
2607
"""IPv6-capable TCP server. Accepts None as address and/or port
2529
socketserver.TCPServer, object):
2530
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2608
2531
2609
2532
Attributes:
2610
2533
enabled: Boolean; whether this server is activated yet
2661
2584
if SO_BINDTODEVICE is None:
2662
2585
# Fall back to a hard-coded value which seems to be
2663
2586
# common enough.
2664
log.warning("SO_BINDTODEVICE not found, trying 25")
2587
logger.warning("SO_BINDTODEVICE not found, trying 25")
2665
2588
SO_BINDTODEVICE = 25
2666
2589
try:
2667
2590
self.socket.setsockopt(
2669
2592
(self.interface + "\0").encode("utf-8"))
2670
2593
except socket.error as error:
2671
2594
if error.errno == errno.EPERM:
2672
log.error("No permission to bind to interface %s",
2673
self.interface)
2595
logger.error("No permission to bind to"
2596
" interface %s", self.interface)
2674
2597
elif error.errno == errno.ENOPROTOOPT:
2675
log.error("SO_BINDTODEVICE not available; cannot"
2676
" bind to interface %s", self.interface)
2598
logger.error("SO_BINDTODEVICE not available;"
2599
" cannot bind to interface %s",
2600
self.interface)
2677
2601
elif error.errno == errno.ENODEV:
2678
log.error("Interface %s does not exist, cannot"
2679
" bind", self.interface)
2602
logger.error("Interface %s does not exist,"
2603
" cannot bind", self.interface)
2680
2604
else:
2681
2605
raise
2682
2606
# Only bind(2) the socket if we really need to.
2741
2665
def add_pipe(self, parent_pipe, proc):
2742
2666
# Call "handle_ipc" for both data and EOF events
2743
2667
GLib.io_add_watch(
2744
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2745
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2668
parent_pipe.fileno(),
2669
GLib.IO_IN | GLib.IO_HUP,
2746
2670
functools.partial(self.handle_ipc,
2747
2671
parent_pipe=parent_pipe,
2748
2672
proc=proc))
2761
2685
request = parent_pipe.recv()
2762
2686
command = request[0]
2763
2687
2764
if command == "init":
2688
if command == 'init':
2765
2689
key_id = request[1].decode("ascii")
2766
2690
fpr = request[2].decode("ascii")
2767
2691
address = request[3]
2768
2692
2769
2693
for c in self.clients.values():
2770
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2771
"27AE41E4649B934CA495991B7852B855"):
2694
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2772
2695
continue
2773
2696
if key_id and c.key_id == key_id:
2774
2697
client = c
2777
2700
client = c
2778
2701
break
2779
2702
else:
2780
log.info("Client not found for key ID: %s, address:"
2781
" %s", key_id or fpr, address)
2703
logger.info("Client not found for key ID: %s, address"
2704
": %s", key_id or fpr, address)
2782
2705
if self.use_dbus:
2783
2706
# Emit D-Bus signal
2784
2707
mandos_dbus_service.ClientNotFound(key_id or fpr,
2787
2710
return False
2788
2711
2789
2712
GLib.io_add_watch(
2790
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2791
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2713
parent_pipe.fileno(),
2714
GLib.IO_IN | GLib.IO_HUP,
2792
2715
functools.partial(self.handle_ipc,
2793
2716
parent_pipe=parent_pipe,
2794
2717
proc=proc,
2797
2720
# remove the old hook in favor of the new above hook on
2798
2721
# same fileno
2799
2722
return False
2800
if command == "funcall":
2723
if command == 'funcall':
2801
2724
funcname = request[1]
2802
2725
args = request[2]
2803
2726
kwargs = request[3]
2804
2727
2805
parent_pipe.send(("data", getattr(client_object,
2728
parent_pipe.send(('data', getattr(client_object,
2806
2729
funcname)(*args,
2807
2730
**kwargs)))
2808
2731
2809
if command == "getattr":
2732
if command == 'getattr':
2810
2733
attrname = request[1]
2811
2734
if isinstance(client_object.__getattribute__(attrname),
2812
collections.abc.Callable):
2813
parent_pipe.send(("function", ))
2735
collections.Callable):
2736
parent_pipe.send(('function', ))
2814
2737
else:
2815
2738
parent_pipe.send((
2816
"data", client_object.__getattribute__(attrname)))
2739
'data', client_object.__getattribute__(attrname)))
2817
2740
2818
if command == "setattr":
2741
if command == 'setattr':
2819
2742
attrname = request[1]
2820
2743
value = request[2]
2821
2744
setattr(client_object, attrname, value)
2826
2749
def rfc3339_duration_to_delta(duration):
2827
2750
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2828
2751
2829
>>> timedelta = datetime.timedelta
2830
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2831
True
2832
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2833
True
2834
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2835
True
2836
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2837
True
2838
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2839
True
2840
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2841
True
2842
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2843
True
2844
>>> del timedelta
2752
>>> rfc3339_duration_to_delta("P7D")
2753
datetime.timedelta(7)
2754
>>> rfc3339_duration_to_delta("PT60S")
2755
datetime.timedelta(0, 60)
2756
>>> rfc3339_duration_to_delta("PT60M")
2757
datetime.timedelta(0, 3600)
2758
>>> rfc3339_duration_to_delta("PT24H")
2759
datetime.timedelta(1)
2760
>>> rfc3339_duration_to_delta("P1W")
2761
datetime.timedelta(7)
2762
>>> rfc3339_duration_to_delta("PT5M30S")
2763
datetime.timedelta(0, 330)
2764
>>> rfc3339_duration_to_delta("P1DT3M20S")
2765
datetime.timedelta(1, 200)
2845
2766
"""
2846
2767
2847
2768
# Parsing an RFC 3339 duration with regular expressions is not
2927
2848
def string_to_delta(interval):
2928
2849
"""Parse a string and return a datetime.timedelta
2929
2850
2930
>>> string_to_delta("7d") == datetime.timedelta(7)
2931
True
2932
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2933
True
2934
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2935
True
2936
>>> string_to_delta("24h") == datetime.timedelta(1)
2937
True
2938
>>> string_to_delta("1w") == datetime.timedelta(7)
2939
True
2940
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2941
True
2851
>>> string_to_delta('7d')
2852
datetime.timedelta(7)
2853
>>> string_to_delta('60s')
2854
datetime.timedelta(0, 60)
2855
>>> string_to_delta('60m')
2856
datetime.timedelta(0, 3600)
2857
>>> string_to_delta('24h')
2858
datetime.timedelta(1)
2859
>>> string_to_delta('1w')
2860
datetime.timedelta(7)
2861
>>> string_to_delta('5m 30s')
2862
datetime.timedelta(0, 330)
2942
2863
"""
2943
2864
2944
2865
try:
3046
2967
3047
2968
options = parser.parse_args()
3048
2969
2970
if options.check:
2971
import doctest
2972
fail_count, test_count = doctest.testmod()
2973
sys.exit(os.EX_OK if fail_count == 0 else 1)
2974
3049
2975
# Default values for config file for server-global settings
3050
2976
if gnutls.has_rawpk:
3051
2977
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3071
2997
del priority
3072
2998
3073
2999
# Parse config file for server-global settings
3074
server_config = configparser.ConfigParser(server_defaults)
3000
server_config = configparser.SafeConfigParser(server_defaults)
3075
3001
del server_defaults
3076
3002
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3077
# Convert the ConfigParser object to a dict
3003
# Convert the SafeConfigParser object to a dict
3078
3004
server_settings = server_config.defaults()
3079
3005
# Use the appropriate methods on the non-string config options
3080
3006
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3147
3073
3148
3074
if server_settings["servicename"] != "Mandos":
3149
3075
syslogger.setFormatter(
3150
logging.Formatter("Mandos ({}) [%(process)d]:"
3151
" %(levelname)s: %(message)s".format(
3076
logging.Formatter('Mandos ({}) [%(process)d]:'
3077
' %(levelname)s: %(message)s'.format(
3152
3078
server_settings["servicename"])))
3153
3079
3154
3080
# Parse config file with clients
3155
client_config = configparser.ConfigParser(Client.client_defaults)
3081
client_config = configparser.SafeConfigParser(Client
3082
.client_defaults)
3156
3083
client_config.read(os.path.join(server_settings["configdir"],
3157
3084
"clients.conf"))
3158
3085
3178
3105
try:
3179
3106
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3180
3107
except IOError as e:
3181
log.error("Could not open file %r", pidfilename,
3182
exc_info=e)
3108
logger.error("Could not open file %r", pidfilename,
3109
exc_info=e)
3183
3110
3184
3111
for name, group in (("_mandos", "_mandos"),
3185
3112
("mandos", "mandos"),
3196
3123
try:
3197
3124
os.setgid(gid)
3198
3125
os.setuid(uid)
3199
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3126
if debug:
3127
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3128
gid))
3200
3129
except OSError as error:
3201
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3202
os.strerror(error.errno))
3130
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3131
.format(uid, gid, os.strerror(error.errno)))
3203
3132
if error.errno != errno.EPERM:
3204
3133
raise
3205
3134
3212
3141
3213
3142
@gnutls.log_func
3214
3143
def debug_gnutls(level, string):
3215
log.debug("GnuTLS: %s",
3216
string[:-1].decode("utf-8", errors="replace"))
3144
logger.debug("GnuTLS: %s", string[:-1])
3217
3145
3218
3146
gnutls.global_set_log_function(debug_gnutls)
3219
3147
3228
3156
# Close all input and output, do double fork, etc.
3229
3157
daemon()
3230
3158
3231
if gi.version_info < (3, 10, 2):
3232
# multiprocessing will use threads, so before we use GLib we
3233
# need to inform GLib that threads will be used.
3234
GLib.threads_init()
3159
# multiprocessing will use threads, so before we use GLib we need
3160
# to inform GLib that threads will be used.
3161
GLib.threads_init()
3235
3162
3236
3163
global main_loop
3237
3164
# From the Avahi example code
3248
3175
"se.bsnet.fukt.Mandos", bus,
3249
3176
do_not_queue=True)
3250
3177
except dbus.exceptions.DBusException as e:
3251
log.error("Disabling D-Bus:", exc_info=e)
3178
logger.error("Disabling D-Bus:", exc_info=e)
3252
3179
use_dbus = False
3253
3180
server_settings["use_dbus"] = False
3254
3181
tcp_server.use_dbus = False
3313
3240
if isinstance(s, bytes)
3314
3241
else s) for s in
3315
3242
value["client_structure"]]
3316
# .name, .host, and .checker_command
3317
for k in ("name", "host", "checker_command"):
3243
# .name & .host
3244
for k in ("name", "host"):
3318
3245
if isinstance(value[k], bytes):
3319
3246
value[k] = value[k].decode("utf-8")
3320
if "key_id" not in value:
3247
if not value.has_key("key_id"):
3321
3248
value["key_id"] = ""
3322
elif "fingerprint" not in value:
3249
elif not value.has_key("fingerprint"):
3323
3250
value["fingerprint"] = ""
3324
3251
# old_client_settings
3325
3252
# .keys()
3330
3257
for key, value in
3331
3258
bytes_old_client_settings.items()}
3332
3259
del bytes_old_client_settings
3333
# .host and .checker_command
3260
# .host
3334
3261
for value in old_client_settings.values():
3335
for attribute in ("host", "checker_command"):
3336
if isinstance(value[attribute], bytes):
3337
value[attribute] = (value[attribute]
3338
.decode("utf-8"))
3262
if isinstance(value["host"], bytes):
3263
value["host"] = (value["host"]
3264
.decode("utf-8"))
3339
3265
os.remove(stored_state_path)
3340
3266
except IOError as e:
3341
3267
if e.errno == errno.ENOENT:
3342
log.warning("Could not load persistent state:"
3343
" %s", os.strerror(e.errno))
3268
logger.warning("Could not load persistent state:"
3269
" {}".format(os.strerror(e.errno)))
3344
3270
else:
3345
log.critical("Could not load persistent state:",
3346
exc_info=e)
3271
logger.critical("Could not load persistent state:",
3272
exc_info=e)
3347
3273
raise
3348
3274
except EOFError as e:
3349
log.warning("Could not load persistent state: EOFError:",
3350
exc_info=e)
3275
logger.warning("Could not load persistent state: "
3276
"EOFError:",
3277
exc_info=e)
3351
3278
3352
3279
with PGPEngine() as pgp:
3353
3280
for client_name, client in clients_data.items():
3380
3307
if client["enabled"]:
3381
3308
if datetime.datetime.utcnow() >= client["expires"]:
3382
3309
if not client["last_checked_ok"]:
3383
log.warning("disabling client %s - Client"
3384
" never performed a successful"
3385
" checker", client_name)
3310
logger.warning(
3311
"disabling client {} - Client never "
3312
"performed a successful checker".format(
3313
client_name))
3386
3314
client["enabled"] = False
3387
3315
elif client["last_checker_status"] != 0:
3388
log.warning("disabling client %s - Client"
3389
" last checker failed with error"
3390
" code %s", client_name,
3391
client["last_checker_status"])
3316
logger.warning(
3317
"disabling client {} - Client last"
3318
" checker failed with error code"
3319
" {}".format(
3320
client_name,
3321
client["last_checker_status"]))
3392
3322
client["enabled"] = False
3393
3323
else:
3394
3324
client["expires"] = (
3395
3325
datetime.datetime.utcnow()
3396
3326
+ client["timeout"])
3397
log.debug("Last checker succeeded, keeping %s"
3398
" enabled", client_name)
3327
logger.debug("Last checker succeeded,"
3328
" keeping {} enabled".format(
3329
client_name))
3399
3330
try:
3400
3331
client["secret"] = pgp.decrypt(
3401
3332
client["encrypted_secret"],
3402
3333
client_settings[client_name]["secret"])
3403
3334
except PGPError:
3404
3335
# If decryption fails, we use secret from new settings
3405
log.debug("Failed to decrypt %s old secret",
3406
client_name)
3336
logger.debug("Failed to decrypt {} old secret".format(
3337
client_name))
3407
3338
client["secret"] = (client_settings[client_name]
3408
3339
["secret"])
3409
3340
3423
3354
server_settings=server_settings)
3424
3355
3425
3356
if not tcp_server.clients:
3426
log.warning("No clients defined")
3357
logger.warning("No clients defined")
3427
3358
3428
3359
if not foreground:
3429
3360
if pidfile is not None:
3432
3363
with pidfile:
3433
3364
print(pid, file=pidfile)
3434
3365
except IOError:
3435
log.error("Could not write to file %r with PID %d",
3436
pidfilename, pid)
3366
logger.error("Could not write to file %r with PID %d",
3367
pidfilename, pid)
3437
3368
del pidfile
3438
3369
del pidfilename
3439
3370
3589
3520
3590
3521
try:
3591
3522
with tempfile.NamedTemporaryFile(
3592
mode="wb",
3523
mode='wb',
3593
3524
suffix=".pickle",
3594
prefix="clients-",
3525
prefix='clients-',
3595
3526
dir=os.path.dirname(stored_state_path),
3596
3527
delete=False) as stored_state:
3597
3528
pickle.dump((clients, client_settings), stored_state,
3605
3536
except NameError:
3606
3537
pass
3607
3538
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3608
log.warning("Could not save persistent state: %s",
3609
os.strerror(e.errno))
3539
logger.warning("Could not save persistent state: {}"
3540
.format(os.strerror(e.errno)))
3610
3541
else:
3611
log.warning("Could not save persistent state:",
3612
exc_info=e)
3542
logger.warning("Could not save persistent state:",
3543
exc_info=e)
3613
3544
raise
3614
3545
3615
3546
# Delete all clients, and settings from config
3632
3563
mandos_dbus_service.client_added_signal(client)
3633
3564
# Need to initiate checking of clients
3634
3565
if client.enabled:
3635
client.init_checker(randomize_start=True)
3566
client.init_checker()
3636
3567
3637
3568
tcp_server.enable()
3638
3569
tcp_server.server_activate()
3641
3572
if zeroconf:
3642
3573
service.port = tcp_server.socket.getsockname()[1]
3643
3574
if use_ipv6:
3644
log.info("Now listening on address %r, port %d, flowinfo %d,"
3645
" scope_id %d", *tcp_server.socket.getsockname())
3575
logger.info("Now listening on address %r, port %d,"
3576
" flowinfo %d, scope_id %d",
3577
*tcp_server.socket.getsockname())
3646
3578
else: # IPv4
3647
log.info("Now listening on address %r, port %d",
3648
*tcp_server.socket.getsockname())
3579
logger.info("Now listening on address %r, port %d",
3580
*tcp_server.socket.getsockname())
3649
3581
3650
3582
# service.interface = tcp_server.socket.getsockname()[3]
3651
3583
3655
3587
try:
3656
3588
service.activate()
3657
3589
except dbus.exceptions.DBusException as error:
3658
log.critical("D-Bus Exception", exc_info=error)
3590
logger.critical("D-Bus Exception", exc_info=error)
3659
3591
cleanup()
3660
3592
sys.exit(1)
3661
3593
# End of Avahi example code
3662
3594
3663
GLib.io_add_watch(
3664
GLib.IOChannel.unix_new(tcp_server.fileno()),
3665
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3666
lambda *args, **kwargs: (tcp_server.handle_request
3667
(*args[2:], **kwargs) or True))
3595
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3596
lambda *args, **kwargs:
3597
(tcp_server.handle_request
3598
(*args[2:], **kwargs) or True))
3668
3599
3669
log.debug("Starting main loop")
3600
logger.debug("Starting main loop")
3670
3601
main_loop.run()
3671
3602
except AvahiError as error:
3672
log.critical("Avahi Error", exc_info=error)
3603
logger.critical("Avahi Error", exc_info=error)
3673
3604
cleanup()
3674
3605
sys.exit(1)
3675
3606
except KeyboardInterrupt:
3676
3607
if debug:
3677
3608
print("", file=sys.stderr)
3678
log.debug("Server received KeyboardInterrupt")
3679
log.debug("Server exiting")
3609
logger.debug("Server received KeyboardInterrupt")
3610
logger.debug("Server exiting")
3680
3611
# Must run before the D-Bus bus name gets deregistered
3681
3612
cleanup()
3682
3613
3683
3684
def parse_test_args():
3685
# type: () -> argparse.Namespace
3686
parser = argparse.ArgumentParser(add_help=False)
3687
parser.add_argument("--check", action="store_true")
3688
parser.add_argument("--prefix", )
3689
args, unknown_args = parser.parse_known_args()
3690
if args.check:
3691
# Remove test options from sys.argv
3692
sys.argv[1:] = unknown_args
3693
return args
3694
3695
# Add all tests from doctest strings
3696
def load_tests(loader, tests, none):
3697
import doctest
3698
tests.addTests(doctest.DocTestSuite())
3699
return tests
3700
3701
if __name__ == "__main__":
3702
options = parse_test_args()
3703
try:
3704
if options.check:
3705
extra_test_prefix = options.prefix
3706
if extra_test_prefix is not None:
3707
if not (unittest.main(argv=[""], exit=False)
3708
.result.wasSuccessful()):
3709
sys.exit(1)
3710
class ExtraTestLoader(unittest.TestLoader):
3711
testMethodPrefix = extra_test_prefix
3712
# Call using ./scriptname --test [--verbose]
3713
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3714
else:
3715
unittest.main(argv=[""])
3716
else:
3717
main()
3718
finally:
3719
logging.shutdown()
3720
3721
# Local Variables:
3722
# run-tests:
3723
# (lambda (&optional extra)
3724
# (if (not (funcall run-tests-in-test-buffer default-directory
3725
# extra))
3726
# (funcall show-test-buffer-in-test-window)
3727
# (funcall remove-test-window)
3728
# (if extra (message "Extra tests run successfully!"))))
3729
# run-tests-in-test-buffer:
3730
# (lambda (dir &optional extra)
3731
# (with-current-buffer (get-buffer-create "*Test*")
3732
# (setq buffer-read-only nil
3733
# default-directory dir)
3734
# (erase-buffer)
3735
# (compilation-mode))
3736
# (let ((process-result
3737
# (let ((inhibit-read-only t))
3738
# (process-file-shell-command
3739
# (funcall get-command-line extra) nil "*Test*"))))
3740
# (and (numberp process-result)
3741
# (= process-result 0))))
3742
# get-command-line:
3743
# (lambda (&optional extra)
3744
# (let ((quoted-script
3745
# (shell-quote-argument (funcall get-script-name))))
3746
# (format
3747
# (concat "%s --check" (if extra " --prefix=atest" ""))
3748
# quoted-script)))
3749
# get-script-name:
3750
# (lambda ()
3751
# (if (fboundp 'file-local-name)
3752
# (file-local-name (buffer-file-name))
3753
# (or (file-remote-p (buffer-file-name) 'localname)
3754
# (buffer-file-name))))
3755
# remove-test-window:
3756
# (lambda ()
3757
# (let ((test-window (get-buffer-window "*Test*")))
3758
# (if test-window (delete-window test-window))))
3759
# show-test-buffer-in-test-window:
3760
# (lambda ()
3761
# (when (not (get-buffer-window-list "*Test*"))
3762
# (setq next-error-last-buffer (get-buffer "*Test*"))
3763
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3764
# (display-buffer-overriding-action
3765
# `((display-buffer-in-side-window) (side . ,side)
3766
# (window-height . fit-window-to-buffer)
3767
# (window-width . fit-window-to-buffer))))
3768
# (display-buffer "*Test*"))))
3769
# eval:
3770
# (progn
3771
# (let* ((run-extra-tests (lambda () (interactive)
3772
# (funcall run-tests t)))
3773
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3774
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3775
# (setq minor-mode-overriding-map-alist
3776
# (cons `(run-tests . ,outer-keymap)
3777
# minor-mode-overriding-map-alist)))
3778
# (add-hook 'after-save-hook run-tests 90 t))
3779
# End:
3614
3615
if __name__ == '__main__':
3616
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0