/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: teddy at recompile
  • Date: 2020-02-05 21:39:28 UTC
  • Revision ID: teddy@recompile.se-20200205213928-vpvt0fwfg47ikv6f
Allow users to alter ask-password-mandos.service

If a user uses dracut with systemd and wishes to modify the options
passed to password-agent(8mandos) or mandos-client(8mandos), they
should be able to do so by simply creating a file
/etc/systemd/system/ask-password-mandos.service.d/override.conf,
containing, for instance:

[Service]
Environment=MANDOS_CLIENT_OPTIONS=--debug

Adding PASSWORD_AGENT_OPTIONS should also be possible (but should not
normally be needed).

* dracut-module/ask-password-mandos.service ([Service]/ExecStart): Add
  $PASSWORD_AGENT_OPTIONS before "--" and "$MANDOS_CLIENT_OPTIONS" to
  end of line.
* dracut-module/module-setup.sh (install): Install all files named
  /etc/systemd/system/ask-password-mandos.service.d/*.conf if any
  exists.  Also add --dh-params before $MANDOS_CLIENT_OPTIONS instead
  of at end of line.

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
1
#!/usr/bin/python3 -bI
2
 
# -*- coding: utf-8; lexical-binding: t -*-
 
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
 
# Copyright © 2008-2022 Teddy Hogeborn
15
 
# Copyright © 2008-2022 Björn Påhlsson
 
14
# Copyright © 2008-2019 Teddy Hogeborn
 
15
# Copyright © 2008-2019 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
 
34
 
34
35
from __future__ import (division, absolute_import, print_function,
35
36
                        unicode_literals)
36
37
 
39
40
except ImportError:
40
41
    pass
41
42
 
42
 
import sys
43
 
import unittest
44
 
import argparse
45
 
import logging
46
 
import os
47
43
try:
48
44
    import SocketServer as socketserver
49
45
except ImportError:
50
46
    import socketserver
51
47
import socket
 
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
    import ConfigParser as configparser
56
53
except ImportError:
57
54
    import configparser
 
55
import sys
58
56
import re
 
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
 
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
 
80
import unittest
80
81
import random
81
 
import shlex
82
82
 
83
83
import dbus
84
84
import dbus.service
93
93
if sys.version_info.major == 2:
94
94
    __metaclass__ = type
95
95
    str = unicode
96
 
    input = raw_input
97
 
 
98
 
# Add collections.abc.Callable if it does not exist
99
 
try:
100
 
    collections.abc.Callable
101
 
except AttributeError:
102
 
    class abc:
103
 
        Callable = collections.Callable
104
 
    collections.abc = abc
105
 
    del abc
106
 
 
107
 
# Add shlex.quote if it does not exist
108
 
try:
109
 
    shlex.quote
110
 
except AttributeError:
111
 
    shlex.quote = re.escape
112
96
 
113
97
# Show warnings by default
114
98
if not sys.warnoptions:
143
127
if sys.version_info < (3, 2):
144
128
    configparser.Configparser = configparser.SafeConfigParser
145
129
 
146
 
version = "1.8.16"
 
130
version = "1.8.9"
147
131
stored_state_file = "clients.pickle"
148
132
 
149
 
log = logging.getLogger(os.path.basename(sys.argv[0]))
 
133
logger = logging.getLogger()
150
134
logging.captureWarnings(True)   # Show warnings via the logging system
151
135
syslogger = None
152
136
 
189
173
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
174
        address="/dev/log"))
191
175
    syslogger.setFormatter(logging.Formatter
192
 
                           ("Mandos [%(process)d]: %(levelname)s:"
193
 
                            " %(message)s"))
194
 
    log.addHandler(syslogger)
 
176
                           ('Mandos [%(process)d]: %(levelname)s:'
 
177
                            ' %(message)s'))
 
178
    logger.addHandler(syslogger)
195
179
 
196
180
    if debug:
197
181
        console = logging.StreamHandler()
198
 
        console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
 
                                               " [%(process)d]:"
200
 
                                               " %(levelname)s:"
201
 
                                               " %(message)s"))
202
 
        log.addHandler(console)
203
 
    log.setLevel(level)
 
182
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
183
                                               ' [%(process)d]:'
 
184
                                               ' %(levelname)s:'
 
185
                                               ' %(message)s'))
 
186
        logger.addHandler(console)
 
187
    logger.setLevel(level)
204
188
 
205
189
 
206
190
class PGPError(Exception):
224
208
        except OSError as e:
225
209
            if e.errno != errno.ENOENT:
226
210
                raise
227
 
        self.gnupgargs = ["--batch",
228
 
                          "--homedir", self.tempdir,
229
 
                          "--force-mdc",
230
 
                          "--quiet"]
 
211
        self.gnupgargs = ['--batch',
 
212
                          '--homedir', self.tempdir,
 
213
                          '--force-mdc',
 
214
                          '--quiet']
231
215
        # Only GPG version 1 has the --no-use-agent option.
232
216
        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
217
            self.gnupgargs.append("--no-use-agent")
272
256
                dir=self.tempdir) as passfile:
273
257
            passfile.write(passphrase)
274
258
            passfile.flush()
275
 
            proc = subprocess.Popen([self.gpg, "--symmetric",
276
 
                                     "--passphrase-file",
 
259
            proc = subprocess.Popen([self.gpg, '--symmetric',
 
260
                                     '--passphrase-file',
277
261
                                     passfile.name]
278
262
                                    + self.gnupgargs,
279
263
                                    stdin=subprocess.PIPE,
290
274
                dir=self.tempdir) as passfile:
291
275
            passfile.write(passphrase)
292
276
            passfile.flush()
293
 
            proc = subprocess.Popen([self.gpg, "--decrypt",
294
 
                                     "--passphrase-file",
 
277
            proc = subprocess.Popen([self.gpg, '--decrypt',
 
278
                                     '--passphrase-file',
295
279
                                     passfile.name]
296
280
                                    + self.gnupgargs,
297
281
                                    stdin=subprocess.PIPE,
350
334
    Attributes:
351
335
    interface: integer; avahi.IF_UNSPEC or an interface index.
352
336
               Used to optionally bind to the specified interface.
353
 
    name: string; Example: "Mandos"
354
 
    type: string; Example: "_mandos._tcp".
 
337
    name: string; Example: 'Mandos'
 
338
    type: string; Example: '_mandos._tcp'.
355
339
     See <https://www.iana.org/assignments/service-names-port-numbers>
356
340
    port: integer; what port to announce
357
341
    TXT: list of strings; TXT record for the service
394
378
    def rename(self, remove=True):
395
379
        """Derived from the Avahi example code"""
396
380
        if self.rename_count >= self.max_renames:
397
 
            log.critical("No suitable Zeroconf service name found"
398
 
                         " after %i retries, exiting.",
399
 
                         self.rename_count)
 
381
            logger.critical("No suitable Zeroconf service name found"
 
382
                            " after %i retries, exiting.",
 
383
                            self.rename_count)
400
384
            raise AvahiServiceError("Too many renames")
401
385
        self.name = str(
402
386
            self.server.GetAlternativeServiceName(self.name))
403
387
        self.rename_count += 1
404
 
        log.info("Changing Zeroconf service name to %r ...",
405
 
                 self.name)
 
388
        logger.info("Changing Zeroconf service name to %r ...",
 
389
                    self.name)
406
390
        if remove:
407
391
            self.remove()
408
392
        try:
410
394
        except dbus.exceptions.DBusException as error:
411
395
            if (error.get_dbus_name()
412
396
                == "org.freedesktop.Avahi.CollisionError"):
413
 
                log.info("Local Zeroconf service name collision.")
 
397
                logger.info("Local Zeroconf service name collision.")
414
398
                return self.rename(remove=False)
415
399
            else:
416
 
                log.critical("D-Bus Exception", exc_info=error)
 
400
                logger.critical("D-Bus Exception", exc_info=error)
417
401
                self.cleanup()
418
402
                os._exit(1)
419
403
 
435
419
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
420
        self.entry_group_state_changed_match = (
437
421
            self.group.connect_to_signal(
438
 
                "StateChanged", self.entry_group_state_changed))
439
 
        log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
 
                  self.name, self.type)
 
422
                'StateChanged', self.entry_group_state_changed))
 
423
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
 
424
                     self.name, self.type)
441
425
        self.group.AddService(
442
426
            self.interface,
443
427
            self.protocol,
450
434
 
451
435
    def entry_group_state_changed(self, state, error):
452
436
        """Derived from the Avahi example code"""
453
 
        log.debug("Avahi entry group state change: %i", state)
 
437
        logger.debug("Avahi entry group state change: %i", state)
454
438
 
455
439
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
 
            log.debug("Zeroconf service established.")
 
440
            logger.debug("Zeroconf service established.")
457
441
        elif state == avahi.ENTRY_GROUP_COLLISION:
458
 
            log.info("Zeroconf service name collision.")
 
442
            logger.info("Zeroconf service name collision.")
459
443
            self.rename()
460
444
        elif state == avahi.ENTRY_GROUP_FAILURE:
461
 
            log.critical("Avahi: Error in group state changed %s",
462
 
                         str(error))
 
445
            logger.critical("Avahi: Error in group state changed %s",
 
446
                            str(error))
463
447
            raise AvahiGroupError("State changed: {!s}".format(error))
464
448
 
465
449
    def cleanup(self):
475
459
 
476
460
    def server_state_changed(self, state, error=None):
477
461
        """Derived from the Avahi example code"""
478
 
        log.debug("Avahi server state change: %i", state)
 
462
        logger.debug("Avahi server state change: %i", state)
479
463
        bad_states = {
480
464
            avahi.SERVER_INVALID: "Zeroconf server invalid",
481
465
            avahi.SERVER_REGISTERING: None,
485
469
        if state in bad_states:
486
470
            if bad_states[state] is not None:
487
471
                if error is None:
488
 
                    log.error(bad_states[state])
 
472
                    logger.error(bad_states[state])
489
473
                else:
490
 
                    log.error(bad_states[state] + ": %r", error)
 
474
                    logger.error(bad_states[state] + ": %r", error)
491
475
            self.cleanup()
492
476
        elif state == avahi.SERVER_RUNNING:
493
477
            try:
495
479
            except dbus.exceptions.DBusException as error:
496
480
                if (error.get_dbus_name()
497
481
                    == "org.freedesktop.Avahi.CollisionError"):
498
 
                    log.info("Local Zeroconf service name collision.")
 
482
                    logger.info("Local Zeroconf service name"
 
483
                                " collision.")
499
484
                    return self.rename(remove=False)
500
485
                else:
501
 
                    log.critical("D-Bus Exception", exc_info=error)
 
486
                    logger.critical("D-Bus Exception", exc_info=error)
502
487
                    self.cleanup()
503
488
                    os._exit(1)
504
489
        else:
505
490
            if error is None:
506
 
                log.debug("Unknown state: %r", state)
 
491
                logger.debug("Unknown state: %r", state)
507
492
            else:
508
 
                log.debug("Unknown state: %r: %r", state, error)
 
493
                logger.debug("Unknown state: %r: %r", state, error)
509
494
 
510
495
    def activate(self):
511
496
        """Derived from the Avahi example code"""
523
508
class AvahiServiceToSyslog(AvahiService):
524
509
    def rename(self, *args, **kwargs):
525
510
        """Add the new name to the syslog messages"""
526
 
        ret = super(AvahiServiceToSyslog, self).rename(*args,
527
 
                                                       **kwargs)
 
511
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
528
512
        syslogger.setFormatter(logging.Formatter(
529
 
            "Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
 
513
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
514
            .format(self.name)))
531
515
        return ret
532
516
 
562
546
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
563
547
 
564
548
    # Types
565
 
    class _session_int(ctypes.Structure):
 
549
    class session_int(ctypes.Structure):
566
550
        _fields_ = []
567
 
    session_t = ctypes.POINTER(_session_int)
 
551
    session_t = ctypes.POINTER(session_int)
568
552
 
569
553
    class certificate_credentials_st(ctypes.Structure):
570
554
        _fields_ = []
573
557
    certificate_type_t = ctypes.c_int
574
558
 
575
559
    class datum_t(ctypes.Structure):
576
 
        _fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
 
                    ("size", ctypes.c_uint)]
 
560
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
 
561
                    ('size', ctypes.c_uint)]
578
562
 
579
 
    class _openpgp_crt_int(ctypes.Structure):
 
563
    class openpgp_crt_int(ctypes.Structure):
580
564
        _fields_ = []
581
 
    openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
 
565
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
566
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
583
567
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
568
    credentials_type_t = ctypes.c_int
593
577
            # gnutls.strerror()
594
578
            self.code = code
595
579
            if message is None and code is not None:
596
 
                message = gnutls.strerror(code).decode(
597
 
                    "utf-8", errors="replace")
 
580
                message = gnutls.strerror(code)
598
581
            return super(gnutls.Error, self).__init__(
599
582
                message, *args)
600
583
 
601
584
    class CertificateSecurityError(Error):
602
585
        pass
603
586
 
604
 
    class PointerTo:
605
 
        def __init__(self, cls):
606
 
            self.cls = cls
607
 
 
608
 
        def from_param(self, obj):
609
 
            if not isinstance(obj, self.cls):
610
 
                raise TypeError("Not of type {}: {!r}"
611
 
                                .format(self.cls.__name__, obj))
612
 
            return ctypes.byref(obj.from_param(obj))
613
 
 
614
 
    class CastToVoidPointer:
615
 
        def __init__(self, cls):
616
 
            self.cls = cls
617
 
 
618
 
        def from_param(self, obj):
619
 
            if not isinstance(obj, self.cls):
620
 
                raise TypeError("Not of type {}: {!r}"
621
 
                                .format(self.cls.__name__, obj))
622
 
            return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
 
 
624
 
    class With_from_param:
625
 
        @classmethod
626
 
        def from_param(cls, obj):
627
 
            return obj._as_parameter_
628
 
 
629
587
    # Classes
630
 
    class Credentials(With_from_param):
 
588
    class Credentials:
631
589
        def __init__(self):
632
 
            self._as_parameter_ = gnutls.certificate_credentials_t()
633
 
            gnutls.certificate_allocate_credentials(self)
 
590
            self._c_object = gnutls.certificate_credentials_t()
 
591
            gnutls.certificate_allocate_credentials(
 
592
                ctypes.byref(self._c_object))
634
593
            self.type = gnutls.CRD_CERTIFICATE
635
594
 
636
595
        def __del__(self):
637
 
            gnutls.certificate_free_credentials(self)
 
596
            gnutls.certificate_free_credentials(self._c_object)
638
597
 
639
 
    class ClientSession(With_from_param):
 
598
    class ClientSession:
640
599
        def __init__(self, socket, credentials=None):
641
 
            self._as_parameter_ = gnutls.session_t()
 
600
            self._c_object = gnutls.session_t()
642
601
            gnutls_flags = gnutls.CLIENT
643
602
            if gnutls.check_version(b"3.5.6"):
644
603
                gnutls_flags |= gnutls.NO_TICKETS
645
604
            if gnutls.has_rawpk:
646
605
                gnutls_flags |= gnutls.ENABLE_RAWPK
647
 
            gnutls.init(self, gnutls_flags)
 
606
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
648
607
            del gnutls_flags
649
 
            gnutls.set_default_priority(self)
650
 
            gnutls.transport_set_ptr(self, socket.fileno())
651
 
            gnutls.handshake_set_private_extensions(self, True)
 
608
            gnutls.set_default_priority(self._c_object)
 
609
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
 
610
            gnutls.handshake_set_private_extensions(self._c_object,
 
611
                                                    True)
652
612
            self.socket = socket
653
613
            if credentials is None:
654
614
                credentials = gnutls.Credentials()
655
 
            gnutls.credentials_set(self, credentials.type,
656
 
                                   credentials)
 
615
            gnutls.credentials_set(self._c_object, credentials.type,
 
616
                                   ctypes.cast(credentials._c_object,
 
617
                                               ctypes.c_void_p))
657
618
            self.credentials = credentials
658
619
 
659
620
        def __del__(self):
660
 
            gnutls.deinit(self)
 
621
            gnutls.deinit(self._c_object)
661
622
 
662
623
        def handshake(self):
663
 
            return gnutls.handshake(self)
 
624
            return gnutls.handshake(self._c_object)
664
625
 
665
626
        def send(self, data):
666
627
            data = bytes(data)
667
628
            data_len = len(data)
668
629
            while data_len > 0:
669
 
                data_len -= gnutls.record_send(self, data[-data_len:],
 
630
                data_len -= gnutls.record_send(self._c_object,
 
631
                                               data[-data_len:],
670
632
                                               data_len)
671
633
 
672
634
        def bye(self):
673
 
            return gnutls.bye(self, gnutls.SHUT_RDWR)
 
635
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
636
 
675
637
    # Error handling functions
676
638
    def _error_code(result):
677
639
        """A function to raise exceptions on errors, suitable
678
 
        for the "restype" attribute on ctypes functions"""
679
 
        if result >= gnutls.E_SUCCESS:
 
640
        for the 'restype' attribute on ctypes functions"""
 
641
        if result >= 0:
680
642
            return result
681
643
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
644
            raise gnutls.CertificateSecurityError(code=result)
683
645
        raise gnutls.Error(code=result)
684
646
 
685
 
    def _retry_on_error(result, func, arguments,
686
 
                        _error_code=_error_code):
 
647
    def _retry_on_error(result, func, arguments):
687
648
        """A function to retry on some errors, suitable
688
 
        for the "errcheck" attribute on ctypes functions"""
689
 
        while result < gnutls.E_SUCCESS:
 
649
        for the 'errcheck' attribute on ctypes functions"""
 
650
        while result < 0:
690
651
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
652
                return _error_code(result)
692
653
            result = func(*arguments)
697
658
 
698
659
    # Functions
699
660
    priority_set_direct = _library.gnutls_priority_set_direct
700
 
    priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
 
661
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
662
                                    ctypes.POINTER(ctypes.c_char_p)]
702
663
    priority_set_direct.restype = _error_code
703
664
 
704
665
    init = _library.gnutls_init
705
 
    init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
 
666
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
667
    init.restype = _error_code
707
668
 
708
669
    set_default_priority = _library.gnutls_set_default_priority
709
 
    set_default_priority.argtypes = [ClientSession]
 
670
    set_default_priority.argtypes = [session_t]
710
671
    set_default_priority.restype = _error_code
711
672
 
712
673
    record_send = _library.gnutls_record_send
713
 
    record_send.argtypes = [ClientSession, ctypes.c_void_p,
 
674
    record_send.argtypes = [session_t, ctypes.c_void_p,
714
675
                            ctypes.c_size_t]
715
676
    record_send.restype = ctypes.c_ssize_t
716
677
    record_send.errcheck = _retry_on_error
718
679
    certificate_allocate_credentials = (
719
680
        _library.gnutls_certificate_allocate_credentials)
720
681
    certificate_allocate_credentials.argtypes = [
721
 
        PointerTo(Credentials)]
 
682
        ctypes.POINTER(certificate_credentials_t)]
722
683
    certificate_allocate_credentials.restype = _error_code
723
684
 
724
685
    certificate_free_credentials = (
725
686
        _library.gnutls_certificate_free_credentials)
726
 
    certificate_free_credentials.argtypes = [Credentials]
 
687
    certificate_free_credentials.argtypes = [
 
688
        certificate_credentials_t]
727
689
    certificate_free_credentials.restype = None
728
690
 
729
691
    handshake_set_private_extensions = (
730
692
        _library.gnutls_handshake_set_private_extensions)
731
 
    handshake_set_private_extensions.argtypes = [ClientSession,
 
693
    handshake_set_private_extensions.argtypes = [session_t,
732
694
                                                 ctypes.c_int]
733
695
    handshake_set_private_extensions.restype = None
734
696
 
735
697
    credentials_set = _library.gnutls_credentials_set
736
 
    credentials_set.argtypes = [ClientSession, credentials_type_t,
737
 
                                CastToVoidPointer(Credentials)]
 
698
    credentials_set.argtypes = [session_t, credentials_type_t,
 
699
                                ctypes.c_void_p]
738
700
    credentials_set.restype = _error_code
739
701
 
740
702
    strerror = _library.gnutls_strerror
742
704
    strerror.restype = ctypes.c_char_p
743
705
 
744
706
    certificate_type_get = _library.gnutls_certificate_type_get
745
 
    certificate_type_get.argtypes = [ClientSession]
 
707
    certificate_type_get.argtypes = [session_t]
746
708
    certificate_type_get.restype = _error_code
747
709
 
748
710
    certificate_get_peers = _library.gnutls_certificate_get_peers
749
 
    certificate_get_peers.argtypes = [ClientSession,
 
711
    certificate_get_peers.argtypes = [session_t,
750
712
                                      ctypes.POINTER(ctypes.c_uint)]
751
713
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
714
 
759
721
    global_set_log_function.restype = None
760
722
 
761
723
    deinit = _library.gnutls_deinit
762
 
    deinit.argtypes = [ClientSession]
 
724
    deinit.argtypes = [session_t]
763
725
    deinit.restype = None
764
726
 
765
727
    handshake = _library.gnutls_handshake
766
 
    handshake.argtypes = [ClientSession]
767
 
    handshake.restype = ctypes.c_int
 
728
    handshake.argtypes = [session_t]
 
729
    handshake.restype = _error_code
768
730
    handshake.errcheck = _retry_on_error
769
731
 
770
732
    transport_set_ptr = _library.gnutls_transport_set_ptr
771
 
    transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
 
733
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
734
    transport_set_ptr.restype = None
773
735
 
774
736
    bye = _library.gnutls_bye
775
 
    bye.argtypes = [ClientSession, close_request_t]
776
 
    bye.restype = ctypes.c_int
 
737
    bye.argtypes = [session_t, close_request_t]
 
738
    bye.restype = _error_code
777
739
    bye.errcheck = _retry_on_error
778
740
 
779
741
    check_version = _library.gnutls_check_version
796
758
 
797
759
        x509_crt_fmt_t = ctypes.c_int
798
760
 
799
 
        # All the function declarations below are from
800
 
        # gnutls/abstract.h
 
761
        # All the function declarations below are from gnutls/abstract.h
801
762
        pubkey_init = _library.gnutls_pubkey_init
802
763
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
764
        pubkey_init.restype = _error_code
817
778
        pubkey_deinit.argtypes = [pubkey_t]
818
779
        pubkey_deinit.restype = None
819
780
    else:
820
 
        # All the function declarations below are from
821
 
        # gnutls/openpgp.h
 
781
        # All the function declarations below are from gnutls/openpgp.h
822
782
 
823
783
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
784
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
830
790
                                       openpgp_crt_fmt_t]
831
791
        openpgp_crt_import.restype = _error_code
832
792
 
833
 
        openpgp_crt_verify_self = \
834
 
            _library.gnutls_openpgp_crt_verify_self
835
 
        openpgp_crt_verify_self.argtypes = [
836
 
            openpgp_crt_t,
837
 
            ctypes.c_uint,
838
 
            ctypes.POINTER(ctypes.c_uint),
839
 
        ]
 
793
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
 
794
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
 
795
                                            ctypes.POINTER(ctypes.c_uint)]
840
796
        openpgp_crt_verify_self.restype = _error_code
841
797
 
842
798
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
853
809
 
854
810
    if check_version(b"3.6.4"):
855
811
        certificate_type_get2 = _library.gnutls_certificate_type_get2
856
 
        certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
 
812
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
857
813
        certificate_type_get2.restype = _error_code
858
814
 
859
815
    # Remove non-public functions
875
831
    """A representation of a client host served by this server.
876
832
 
877
833
    Attributes:
878
 
    approved:   bool(); None if not yet approved/disapproved
 
834
    approved:   bool(); 'None' if not yet approved/disapproved
879
835
    approval_delay: datetime.timedelta(); Time to wait for approval
880
836
    approval_duration: datetime.timedelta(); Duration of one approval
881
837
    checker: multiprocessing.Process(); a running checker process used
882
 
             to see if the client lives. None if no process is
 
838
             to see if the client lives. 'None' if no process is
883
839
             running.
884
840
    checker_callback_tag: a GLib event source tag, or None
885
841
    checker_command: string; External command which is run to check
1009
965
            self.last_enabled = None
1010
966
            self.expires = None
1011
967
 
1012
 
        log.debug("Creating client %r", self.name)
1013
 
        log.debug("  Key ID: %s", self.key_id)
1014
 
        log.debug("  Fingerprint: %s", self.fingerprint)
 
968
        logger.debug("Creating client %r", self.name)
 
969
        logger.debug("  Key ID: %s", self.key_id)
 
970
        logger.debug("  Fingerprint: %s", self.fingerprint)
1015
971
        self.created = settings.get("created",
1016
972
                                    datetime.datetime.utcnow())
1017
973
 
1045
1001
        if getattr(self, "enabled", False):
1046
1002
            # Already enabled
1047
1003
            return
 
1004
        self.expires = datetime.datetime.utcnow() + self.timeout
1048
1005
        self.enabled = True
1049
1006
        self.last_enabled = datetime.datetime.utcnow()
1050
1007
        self.init_checker()
1055
1012
        if not getattr(self, "enabled", False):
1056
1013
            return False
1057
1014
        if not quiet:
1058
 
            log.info("Disabling client %s", self.name)
 
1015
            logger.info("Disabling client %s", self.name)
1059
1016
        if getattr(self, "disable_initiator_tag", None) is not None:
1060
1017
            GLib.source_remove(self.disable_initiator_tag)
1061
1018
            self.disable_initiator_tag = None
1073
1030
    def __del__(self):
1074
1031
        self.disable()
1075
1032
 
1076
 
    def init_checker(self, randomize_start=False):
1077
 
        # Schedule a new checker to be started a randomly selected
1078
 
        # time (a fraction of 'interval') from now.  This spreads out
1079
 
        # the startup of checkers over time when the server is
1080
 
        # started.
 
1033
    def init_checker(self):
 
1034
        # Schedule a new checker to be started an 'interval' from now,
 
1035
        # and every interval from then on.
1081
1036
        if self.checker_initiator_tag is not None:
1082
1037
            GLib.source_remove(self.checker_initiator_tag)
1083
 
        interval_milliseconds = int(self.interval.total_seconds()
1084
 
                                    * 1000)
1085
 
        if randomize_start:
1086
 
            delay_milliseconds = random.randrange(
1087
 
                interval_milliseconds + 1)
1088
 
        else:
1089
 
            delay_milliseconds = interval_milliseconds
1090
1038
        self.checker_initiator_tag = GLib.timeout_add(
1091
 
            delay_milliseconds, self.start_checker, randomize_start)
1092
 
        delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1093
 
        # A checker might take up to an 'interval' of time, so we can
1094
 
        # expire at the soonest one interval after a checker was
1095
 
        # started.  Since the initial checker is delayed, the expire
1096
 
        # time might have to be extended.
1097
 
        now = datetime.datetime.utcnow()
1098
 
        self.expires = now + delay + self.interval
1099
 
        # Schedule a disable() at expire time
 
1039
            random.randrange(int(self.interval.total_seconds() * 1000
 
1040
                                 + 1)),
 
1041
            self.start_checker)
 
1042
        # Schedule a disable() when 'timeout' has passed
1100
1043
        if self.disable_initiator_tag is not None:
1101
1044
            GLib.source_remove(self.disable_initiator_tag)
1102
1045
        self.disable_initiator_tag = GLib.timeout_add(
1103
 
            int((self.expires - now).total_seconds() * 1000),
1104
 
            self.disable)
 
1046
            int(self.timeout.total_seconds() * 1000), self.disable)
 
1047
        # Also start a new checker *right now*.
 
1048
        self.start_checker()
1105
1049
 
1106
1050
    def checker_callback(self, source, condition, connection,
1107
1051
                         command):
1118
1062
            self.last_checker_status = returncode
1119
1063
            self.last_checker_signal = None
1120
1064
            if self.last_checker_status == 0:
1121
 
                log.info("Checker for %(name)s succeeded", vars(self))
 
1065
                logger.info("Checker for %(name)s succeeded",
 
1066
                            vars(self))
1122
1067
                self.checked_ok()
1123
1068
            else:
1124
 
                log.info("Checker for %(name)s failed", vars(self))
 
1069
                logger.info("Checker for %(name)s failed", vars(self))
1125
1070
        else:
1126
1071
            self.last_checker_status = -1
1127
1072
            self.last_checker_signal = -returncode
1128
 
            log.warning("Checker for %(name)s crashed?", vars(self))
 
1073
            logger.warning("Checker for %(name)s crashed?",
 
1074
                           vars(self))
1129
1075
        return False
1130
1076
 
1131
1077
    def checked_ok(self):
1150
1096
    def need_approval(self):
1151
1097
        self.last_approval_request = datetime.datetime.utcnow()
1152
1098
 
1153
 
    def start_checker(self, start_was_randomized=False):
 
1099
    def start_checker(self):
1154
1100
        """Start a new checker subprocess if one is not running.
1155
1101
 
1156
1102
        If a checker already exists, leave it running and do
1165
1111
        # should be.
1166
1112
 
1167
1113
        if self.checker is not None and not self.checker.is_alive():
1168
 
            log.warning("Checker was not alive; joining")
 
1114
            logger.warning("Checker was not alive; joining")
1169
1115
            self.checker.join()
1170
1116
            self.checker = None
1171
1117
        # Start a new checker if needed
1172
1118
        if self.checker is None:
1173
1119
            # Escape attributes for the shell
1174
1120
            escaped_attrs = {
1175
 
                attr: shlex.quote(str(getattr(self, attr)))
 
1121
                attr: re.escape(str(getattr(self, attr)))
1176
1122
                for attr in self.runtime_expansions}
1177
1123
            try:
1178
1124
                command = self.checker_command % escaped_attrs
1179
1125
            except TypeError as error:
1180
 
                log.error('Could not format string "%s"',
1181
 
                          self.checker_command, exc_info=error)
 
1126
                logger.error('Could not format string "%s"',
 
1127
                             self.checker_command,
 
1128
                             exc_info=error)
1182
1129
                return True     # Try again later
1183
1130
            self.current_checker_command = command
1184
 
            log.info("Starting checker %r for %s", command, self.name)
 
1131
            logger.info("Starting checker %r for %s", command,
 
1132
                        self.name)
1185
1133
            # We don't need to redirect stdout and stderr, since
1186
1134
            # in normal mode, that is already done by daemon(),
1187
1135
            # and in debug mode we don't want to.  (Stdin is
1206
1154
                GLib.IOChannel.unix_new(pipe[0].fileno()),
1207
1155
                GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1208
1156
                self.checker_callback, pipe[0], command)
1209
 
        if start_was_randomized:
1210
 
            # We were started after a random delay; Schedule a new
1211
 
            # checker to be started an 'interval' from now, and every
1212
 
            # interval from then on.
1213
 
            now = datetime.datetime.utcnow()
1214
 
            self.checker_initiator_tag = GLib.timeout_add(
1215
 
                int(self.interval.total_seconds() * 1000),
1216
 
                self.start_checker)
1217
 
            self.expires = max(self.expires, now + self.interval)
1218
 
            # Don't start a new checker again after same random delay
1219
 
            return False
1220
1157
        # Re-run this periodically if run by GLib.timeout_add
1221
1158
        return True
1222
1159
 
1227
1164
            self.checker_callback_tag = None
1228
1165
        if getattr(self, "checker", None) is None:
1229
1166
            return
1230
 
        log.debug("Stopping checker for %(name)s", vars(self))
 
1167
        logger.debug("Stopping checker for %(name)s", vars(self))
1231
1168
        self.checker.terminate()
1232
1169
        self.checker = None
1233
1170
 
1260
1197
        func._dbus_name = func.__name__
1261
1198
        if func._dbus_name.endswith("_dbus_property"):
1262
1199
            func._dbus_name = func._dbus_name[:-14]
1263
 
        func._dbus_get_args_options = {"byte_arrays": byte_arrays}
 
1200
        func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1264
1201
        return func
1265
1202
 
1266
1203
    return decorator
1355
1292
 
1356
1293
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1357
1294
                         out_signature="s",
1358
 
                         path_keyword="object_path",
1359
 
                         connection_keyword="connection")
 
1295
                         path_keyword='object_path',
 
1296
                         connection_keyword='connection')
1360
1297
    def Introspect(self, object_path, connection):
1361
1298
        """Overloading of standard D-Bus method.
1362
1299
 
1411
1348
            document.unlink()
1412
1349
        except (AttributeError, xml.dom.DOMException,
1413
1350
                xml.parsers.expat.ExpatError) as error:
1414
 
            log.error("Failed to override Introspection method",
1415
 
                      exc_info=error)
 
1351
            logger.error("Failed to override Introspection method",
 
1352
                         exc_info=error)
1416
1353
        return xmlstring
1417
1354
 
1418
1355
 
1515
1452
 
1516
1453
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1517
1454
                         out_signature="s",
1518
 
                         path_keyword="object_path",
1519
 
                         connection_keyword="connection")
 
1455
                         path_keyword='object_path',
 
1456
                         connection_keyword='connection')
1520
1457
    def Introspect(self, object_path, connection):
1521
1458
        """Overloading of standard D-Bus method.
1522
1459
 
1578
1515
            document.unlink()
1579
1516
        except (AttributeError, xml.dom.DOMException,
1580
1517
                xml.parsers.expat.ExpatError) as error:
1581
 
            log.error("Failed to override Introspection method",
1582
 
                      exc_info=error)
 
1518
            logger.error("Failed to override Introspection method",
 
1519
                         exc_info=error)
1583
1520
        return xmlstring
1584
1521
 
1585
1522
 
1617
1554
 
1618
1555
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1619
1556
                         out_signature="s",
1620
 
                         path_keyword="object_path",
1621
 
                         connection_keyword="connection")
 
1557
                         path_keyword='object_path',
 
1558
                         connection_keyword='connection')
1622
1559
    def Introspect(self, object_path, connection):
1623
1560
        """Overloading of standard D-Bus method.
1624
1561
 
1649
1586
            document.unlink()
1650
1587
        except (AttributeError, xml.dom.DOMException,
1651
1588
                xml.parsers.expat.ExpatError) as error:
1652
 
            log.error("Failed to override Introspection method",
1653
 
                      exc_info=error)
 
1589
            logger.error("Failed to override Introspection method",
 
1590
                         exc_info=error)
1654
1591
        return xmlstring
1655
1592
 
1656
1593
 
2290
2227
class ProxyClient:
2291
2228
    def __init__(self, child_pipe, key_id, fpr, address):
2292
2229
        self._pipe = child_pipe
2293
 
        self._pipe.send(("init", key_id, fpr, address))
 
2230
        self._pipe.send(('init', key_id, fpr, address))
2294
2231
        if not self._pipe.recv():
2295
2232
            raise KeyError(key_id or fpr)
2296
2233
 
2297
2234
    def __getattribute__(self, name):
2298
 
        if name == "_pipe":
 
2235
        if name == '_pipe':
2299
2236
            return super(ProxyClient, self).__getattribute__(name)
2300
 
        self._pipe.send(("getattr", name))
 
2237
        self._pipe.send(('getattr', name))
2301
2238
        data = self._pipe.recv()
2302
 
        if data[0] == "data":
 
2239
        if data[0] == 'data':
2303
2240
            return data[1]
2304
 
        if data[0] == "function":
 
2241
        if data[0] == 'function':
2305
2242
 
2306
2243
            def func(*args, **kwargs):
2307
 
                self._pipe.send(("funcall", name, args, kwargs))
 
2244
                self._pipe.send(('funcall', name, args, kwargs))
2308
2245
                return self._pipe.recv()[1]
2309
2246
 
2310
2247
            return func
2311
2248
 
2312
2249
    def __setattr__(self, name, value):
2313
 
        if name == "_pipe":
 
2250
        if name == '_pipe':
2314
2251
            return super(ProxyClient, self).__setattr__(name, value)
2315
 
        self._pipe.send(("setattr", name, value))
 
2252
        self._pipe.send(('setattr', name, value))
2316
2253
 
2317
2254
 
2318
2255
class ClientHandler(socketserver.BaseRequestHandler, object):
2323
2260
 
2324
2261
    def handle(self):
2325
2262
        with contextlib.closing(self.server.child_pipe) as child_pipe:
2326
 
            log.info("TCP connection from: %s",
2327
 
                     str(self.client_address))
2328
 
            log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
 
2263
            logger.info("TCP connection from: %s",
 
2264
                        str(self.client_address))
 
2265
            logger.debug("Pipe FD: %d",
 
2266
                         self.server.child_pipe.fileno())
2329
2267
 
2330
2268
            session = gnutls.ClientSession(self.request)
2331
2269
 
2332
 
            # priority = ":".join(("NONE", "+VERS-TLS1.1",
 
2270
            # priority = ':'.join(("NONE", "+VERS-TLS1.1",
2333
2271
            #                       "+AES-256-CBC", "+SHA1",
2334
2272
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
2335
2273
            #                       "+DHE-DSS"))
2337
2275
            priority = self.server.gnutls_priority
2338
2276
            if priority is None:
2339
2277
                priority = "NORMAL"
2340
 
            gnutls.priority_set_direct(session,
2341
 
                                       priority.encode("utf-8"), None)
 
2278
            gnutls.priority_set_direct(session._c_object,
 
2279
                                       priority.encode("utf-8"),
 
2280
                                       None)
2342
2281
 
2343
2282
            # Start communication using the Mandos protocol
2344
2283
            # Get protocol number
2345
2284
            line = self.request.makefile().readline()
2346
 
            log.debug("Protocol version: %r", line)
 
2285
            logger.debug("Protocol version: %r", line)
2347
2286
            try:
2348
2287
                if int(line.strip().split()[0]) > 1:
2349
2288
                    raise RuntimeError(line)
2350
2289
            except (ValueError, IndexError, RuntimeError) as error:
2351
 
                log.error("Unknown protocol version: %s", error)
 
2290
                logger.error("Unknown protocol version: %s", error)
2352
2291
                return
2353
2292
 
2354
2293
            # Start GnuTLS connection
2355
2294
            try:
2356
2295
                session.handshake()
2357
2296
            except gnutls.Error as error:
2358
 
                log.warning("Handshake failed: %s", error)
 
2297
                logger.warning("Handshake failed: %s", error)
2359
2298
                # Do not run session.bye() here: the session is not
2360
2299
                # established.  Just abandon the request.
2361
2300
                return
2362
 
            log.debug("Handshake succeeded")
 
2301
            logger.debug("Handshake succeeded")
2363
2302
 
2364
2303
            approval_required = False
2365
2304
            try:
2369
2308
                        key_id = self.key_id(
2370
2309
                            self.peer_certificate(session))
2371
2310
                    except (TypeError, gnutls.Error) as error:
2372
 
                        log.warning("Bad certificate: %s", error)
 
2311
                        logger.warning("Bad certificate: %s", error)
2373
2312
                        return
2374
 
                    log.debug("Key ID: %s",
2375
 
                              key_id.decode("utf-8",
2376
 
                                            errors="replace"))
 
2313
                    logger.debug("Key ID: %s", key_id)
2377
2314
 
2378
2315
                else:
2379
2316
                    key_id = b""
2381
2318
                        fpr = self.fingerprint(
2382
2319
                            self.peer_certificate(session))
2383
2320
                    except (TypeError, gnutls.Error) as error:
2384
 
                        log.warning("Bad certificate: %s", error)
 
2321
                        logger.warning("Bad certificate: %s", error)
2385
2322
                        return
2386
 
                    log.debug("Fingerprint: %s", fpr)
 
2323
                    logger.debug("Fingerprint: %s", fpr)
2387
2324
 
2388
2325
                try:
2389
2326
                    client = ProxyClient(child_pipe, key_id, fpr,
2398
2335
 
2399
2336
                while True:
2400
2337
                    if not client.enabled:
2401
 
                        log.info("Client %s is disabled", client.name)
 
2338
                        logger.info("Client %s is disabled",
 
2339
                                    client.name)
2402
2340
                        if self.server.use_dbus:
2403
2341
                            # Emit D-Bus signal
2404
2342
                            client.Rejected("Disabled")
2408
2346
                        # We are approved or approval is disabled
2409
2347
                        break
2410
2348
                    elif client.approved is None:
2411
 
                        log.info("Client %s needs approval",
2412
 
                                 client.name)
 
2349
                        logger.info("Client %s needs approval",
 
2350
                                    client.name)
2413
2351
                        if self.server.use_dbus:
2414
2352
                            # Emit D-Bus signal
2415
2353
                            client.NeedApproval(
2416
2354
                                client.approval_delay.total_seconds()
2417
2355
                                * 1000, client.approved_by_default)
2418
2356
                    else:
2419
 
                        log.warning("Client %s was not approved",
2420
 
                                    client.name)
 
2357
                        logger.warning("Client %s was not approved",
 
2358
                                       client.name)
2421
2359
                        if self.server.use_dbus:
2422
2360
                            # Emit D-Bus signal
2423
2361
                            client.Rejected("Denied")
2431
2369
                    time2 = datetime.datetime.now()
2432
2370
                    if (time2 - time) >= delay:
2433
2371
                        if not client.approved_by_default:
2434
 
                            log.warning("Client %s timed out while"
2435
 
                                        " waiting for approval",
2436
 
                                        client.name)
 
2372
                            logger.warning("Client %s timed out while"
 
2373
                                           " waiting for approval",
 
2374
                                           client.name)
2437
2375
                            if self.server.use_dbus:
2438
2376
                                # Emit D-Bus signal
2439
2377
                                client.Rejected("Approval timed out")
2446
2384
                try:
2447
2385
                    session.send(client.secret)
2448
2386
                except gnutls.Error as error:
2449
 
                    log.warning("gnutls send failed", exc_info=error)
 
2387
                    logger.warning("gnutls send failed",
 
2388
                                   exc_info=error)
2450
2389
                    return
2451
2390
 
2452
 
                log.info("Sending secret to %s", client.name)
 
2391
                logger.info("Sending secret to %s", client.name)
2453
2392
                # bump the timeout using extended_timeout
2454
2393
                client.bump_timeout(client.extended_timeout)
2455
2394
                if self.server.use_dbus:
2462
2401
                try:
2463
2402
                    session.bye()
2464
2403
                except gnutls.Error as error:
2465
 
                    log.warning("GnuTLS bye failed", exc_info=error)
 
2404
                    logger.warning("GnuTLS bye failed",
 
2405
                                   exc_info=error)
2466
2406
 
2467
2407
    @staticmethod
2468
2408
    def peer_certificate(session):
2469
2409
        "Return the peer's certificate as a bytestring"
2470
2410
        try:
2471
 
            cert_type = gnutls.certificate_type_get2(
2472
 
                session, gnutls.CTYPE_PEERS)
 
2411
            cert_type = gnutls.certificate_type_get2(session._c_object,
 
2412
                                                     gnutls.CTYPE_PEERS)
2473
2413
        except AttributeError:
2474
 
            cert_type = gnutls.certificate_type_get(session)
 
2414
            cert_type = gnutls.certificate_type_get(session._c_object)
2475
2415
        if gnutls.has_rawpk:
2476
2416
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2477
2417
        else:
2478
2418
            valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2479
2419
        # If not a valid certificate type...
2480
2420
        if cert_type not in valid_cert_types:
2481
 
            log.info("Cert type %r not in %r", cert_type,
2482
 
                     valid_cert_types)
 
2421
            logger.info("Cert type %r not in %r", cert_type,
 
2422
                        valid_cert_types)
2483
2423
            # ...return invalid data
2484
2424
            return b""
2485
2425
        list_size = ctypes.c_uint(1)
2486
2426
        cert_list = (gnutls.certificate_get_peers
2487
 
                     (session, ctypes.byref(list_size)))
 
2427
                     (session._c_object, ctypes.byref(list_size)))
2488
2428
        if not bool(cert_list) and list_size.value != 0:
2489
2429
            raise gnutls.Error("error getting peer certificate")
2490
2430
        if list_size.value == 0:
2512
2452
        buf = ctypes.create_string_buffer(32)
2513
2453
        buf_len = ctypes.c_size_t(len(buf))
2514
2454
        # Get the key ID from the raw public key into the buffer
2515
 
        gnutls.pubkey_get_key_id(
2516
 
            pubkey,
2517
 
            gnutls.KEYID_USE_SHA256,
2518
 
            ctypes.cast(ctypes.byref(buf),
2519
 
                        ctypes.POINTER(ctypes.c_ubyte)),
2520
 
            ctypes.byref(buf_len))
 
2455
        gnutls.pubkey_get_key_id(pubkey,
 
2456
                                 gnutls.KEYID_USE_SHA256,
 
2457
                                 ctypes.cast(ctypes.byref(buf),
 
2458
                                             ctypes.POINTER(ctypes.c_ubyte)),
 
2459
                                 ctypes.byref(buf_len))
2521
2460
        # Deinit the certificate
2522
2461
        gnutls.pubkey_deinit(pubkey)
2523
2462
 
2604
2543
 
2605
2544
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2606
2545
                     socketserver.TCPServer):
2607
 
    """IPv6-capable TCP server.  Accepts None as address and/or port
 
2546
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
2608
2547
 
2609
2548
    Attributes:
2610
2549
        enabled:        Boolean; whether this server is activated yet
2661
2600
            if SO_BINDTODEVICE is None:
2662
2601
                # Fall back to a hard-coded value which seems to be
2663
2602
                # common enough.
2664
 
                log.warning("SO_BINDTODEVICE not found, trying 25")
 
2603
                logger.warning("SO_BINDTODEVICE not found, trying 25")
2665
2604
                SO_BINDTODEVICE = 25
2666
2605
            try:
2667
2606
                self.socket.setsockopt(
2669
2608
                    (self.interface + "\0").encode("utf-8"))
2670
2609
            except socket.error as error:
2671
2610
                if error.errno == errno.EPERM:
2672
 
                    log.error("No permission to bind to interface %s",
2673
 
                              self.interface)
 
2611
                    logger.error("No permission to bind to"
 
2612
                                 " interface %s", self.interface)
2674
2613
                elif error.errno == errno.ENOPROTOOPT:
2675
 
                    log.error("SO_BINDTODEVICE not available; cannot"
2676
 
                              " bind to interface %s", self.interface)
 
2614
                    logger.error("SO_BINDTODEVICE not available;"
 
2615
                                 " cannot bind to interface %s",
 
2616
                                 self.interface)
2677
2617
                elif error.errno == errno.ENODEV:
2678
 
                    log.error("Interface %s does not exist, cannot"
2679
 
                              " bind", self.interface)
 
2618
                    logger.error("Interface %s does not exist,"
 
2619
                                 " cannot bind", self.interface)
2680
2620
                else:
2681
2621
                    raise
2682
2622
        # Only bind(2) the socket if we really need to.
2761
2701
        request = parent_pipe.recv()
2762
2702
        command = request[0]
2763
2703
 
2764
 
        if command == "init":
 
2704
        if command == 'init':
2765
2705
            key_id = request[1].decode("ascii")
2766
2706
            fpr = request[2].decode("ascii")
2767
2707
            address = request[3]
2768
2708
 
2769
2709
            for c in self.clients.values():
2770
 
                if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2771
 
                              "27AE41E4649B934CA495991B7852B855"):
 
2710
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2772
2711
                    continue
2773
2712
                if key_id and c.key_id == key_id:
2774
2713
                    client = c
2777
2716
                    client = c
2778
2717
                    break
2779
2718
            else:
2780
 
                log.info("Client not found for key ID: %s, address:"
2781
 
                         " %s", key_id or fpr, address)
 
2719
                logger.info("Client not found for key ID: %s, address"
 
2720
                            ": %s", key_id or fpr, address)
2782
2721
                if self.use_dbus:
2783
2722
                    # Emit D-Bus signal
2784
2723
                    mandos_dbus_service.ClientNotFound(key_id or fpr,
2797
2736
            # remove the old hook in favor of the new above hook on
2798
2737
            # same fileno
2799
2738
            return False
2800
 
        if command == "funcall":
 
2739
        if command == 'funcall':
2801
2740
            funcname = request[1]
2802
2741
            args = request[2]
2803
2742
            kwargs = request[3]
2804
2743
 
2805
 
            parent_pipe.send(("data", getattr(client_object,
 
2744
            parent_pipe.send(('data', getattr(client_object,
2806
2745
                                              funcname)(*args,
2807
2746
                                                        **kwargs)))
2808
2747
 
2809
 
        if command == "getattr":
 
2748
        if command == 'getattr':
2810
2749
            attrname = request[1]
2811
2750
            if isinstance(client_object.__getattribute__(attrname),
2812
 
                          collections.abc.Callable):
2813
 
                parent_pipe.send(("function", ))
 
2751
                          collections.Callable):
 
2752
                parent_pipe.send(('function', ))
2814
2753
            else:
2815
2754
                parent_pipe.send((
2816
 
                    "data", client_object.__getattribute__(attrname)))
 
2755
                    'data', client_object.__getattribute__(attrname)))
2817
2756
 
2818
 
        if command == "setattr":
 
2757
        if command == 'setattr':
2819
2758
            attrname = request[1]
2820
2759
            value = request[2]
2821
2760
            setattr(client_object, attrname, value)
2826
2765
def rfc3339_duration_to_delta(duration):
2827
2766
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2828
2767
 
2829
 
    >>> timedelta = datetime.timedelta
2830
 
    >>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2831
 
    True
2832
 
    >>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2833
 
    True
2834
 
    >>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2835
 
    True
2836
 
    >>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2837
 
    True
2838
 
    >>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2839
 
    True
2840
 
    >>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2841
 
    True
2842
 
    >>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2843
 
    True
2844
 
    >>> del timedelta
 
2768
    >>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
 
2769
    True
 
2770
    >>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
 
2771
    True
 
2772
    >>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
 
2773
    True
 
2774
    >>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
 
2775
    True
 
2776
    >>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
 
2777
    True
 
2778
    >>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
 
2779
    True
 
2780
    >>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
 
2781
    True
2845
2782
    """
2846
2783
 
2847
2784
    # Parsing an RFC 3339 duration with regular expressions is not
2927
2864
def string_to_delta(interval):
2928
2865
    """Parse a string and return a datetime.timedelta
2929
2866
 
2930
 
    >>> string_to_delta("7d") == datetime.timedelta(7)
2931
 
    True
2932
 
    >>> string_to_delta("60s") == datetime.timedelta(0, 60)
2933
 
    True
2934
 
    >>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2935
 
    True
2936
 
    >>> string_to_delta("24h") == datetime.timedelta(1)
2937
 
    True
2938
 
    >>> string_to_delta("1w") == datetime.timedelta(7)
2939
 
    True
2940
 
    >>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
 
2867
    >>> string_to_delta('7d') == datetime.timedelta(7)
 
2868
    True
 
2869
    >>> string_to_delta('60s') == datetime.timedelta(0, 60)
 
2870
    True
 
2871
    >>> string_to_delta('60m') == datetime.timedelta(0, 3600)
 
2872
    True
 
2873
    >>> string_to_delta('24h') == datetime.timedelta(1)
 
2874
    True
 
2875
    >>> string_to_delta('1w') == datetime.timedelta(7)
 
2876
    True
 
2877
    >>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2941
2878
    True
2942
2879
    """
2943
2880
 
3147
3084
 
3148
3085
    if server_settings["servicename"] != "Mandos":
3149
3086
        syslogger.setFormatter(
3150
 
            logging.Formatter("Mandos ({}) [%(process)d]:"
3151
 
                              " %(levelname)s: %(message)s".format(
 
3087
            logging.Formatter('Mandos ({}) [%(process)d]:'
 
3088
                              ' %(levelname)s: %(message)s'.format(
3152
3089
                                  server_settings["servicename"])))
3153
3090
 
3154
3091
    # Parse config file with clients
3178
3115
        try:
3179
3116
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3180
3117
        except IOError as e:
3181
 
            log.error("Could not open file %r", pidfilename,
3182
 
                      exc_info=e)
 
3118
            logger.error("Could not open file %r", pidfilename,
 
3119
                         exc_info=e)
3183
3120
 
3184
3121
    for name, group in (("_mandos", "_mandos"),
3185
3122
                        ("mandos", "mandos"),
3196
3133
    try:
3197
3134
        os.setgid(gid)
3198
3135
        os.setuid(uid)
3199
 
        log.debug("Did setuid/setgid to %s:%s", uid, gid)
 
3136
        if debug:
 
3137
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
 
3138
                                                             gid))
3200
3139
    except OSError as error:
3201
 
        log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3202
 
                    os.strerror(error.errno))
 
3140
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
 
3141
                       .format(uid, gid, os.strerror(error.errno)))
3203
3142
        if error.errno != errno.EPERM:
3204
3143
            raise
3205
3144
 
3212
3151
 
3213
3152
        @gnutls.log_func
3214
3153
        def debug_gnutls(level, string):
3215
 
            log.debug("GnuTLS: %s",
3216
 
                      string[:-1].decode("utf-8", errors="replace"))
 
3154
            logger.debug("GnuTLS: %s", string[:-1])
3217
3155
 
3218
3156
        gnutls.global_set_log_function(debug_gnutls)
3219
3157
 
3248
3186
                "se.bsnet.fukt.Mandos", bus,
3249
3187
                do_not_queue=True)
3250
3188
        except dbus.exceptions.DBusException as e:
3251
 
            log.error("Disabling D-Bus:", exc_info=e)
 
3189
            logger.error("Disabling D-Bus:", exc_info=e)
3252
3190
            use_dbus = False
3253
3191
            server_settings["use_dbus"] = False
3254
3192
            tcp_server.use_dbus = False
3339
3277
            os.remove(stored_state_path)
3340
3278
        except IOError as e:
3341
3279
            if e.errno == errno.ENOENT:
3342
 
                log.warning("Could not load persistent state:"
3343
 
                            " %s", os.strerror(e.errno))
 
3280
                logger.warning("Could not load persistent state:"
 
3281
                               " {}".format(os.strerror(e.errno)))
3344
3282
            else:
3345
 
                log.critical("Could not load persistent state:",
3346
 
                             exc_info=e)
 
3283
                logger.critical("Could not load persistent state:",
 
3284
                                exc_info=e)
3347
3285
                raise
3348
3286
        except EOFError as e:
3349
 
            log.warning("Could not load persistent state: EOFError:",
3350
 
                        exc_info=e)
 
3287
            logger.warning("Could not load persistent state: "
 
3288
                           "EOFError:",
 
3289
                           exc_info=e)
3351
3290
 
3352
3291
    with PGPEngine() as pgp:
3353
3292
        for client_name, client in clients_data.items():
3380
3319
            if client["enabled"]:
3381
3320
                if datetime.datetime.utcnow() >= client["expires"]:
3382
3321
                    if not client["last_checked_ok"]:
3383
 
                        log.warning("disabling client %s - Client"
3384
 
                                    " never performed a successful"
3385
 
                                    " checker", client_name)
 
3322
                        logger.warning(
 
3323
                            "disabling client {} - Client never "
 
3324
                            "performed a successful checker".format(
 
3325
                                client_name))
3386
3326
                        client["enabled"] = False
3387
3327
                    elif client["last_checker_status"] != 0:
3388
 
                        log.warning("disabling client %s - Client"
3389
 
                                    " last checker failed with error"
3390
 
                                    " code %s", client_name,
3391
 
                                    client["last_checker_status"])
 
3328
                        logger.warning(
 
3329
                            "disabling client {} - Client last"
 
3330
                            " checker failed with error code"
 
3331
                            " {}".format(
 
3332
                                client_name,
 
3333
                                client["last_checker_status"]))
3392
3334
                        client["enabled"] = False
3393
3335
                    else:
3394
3336
                        client["expires"] = (
3395
3337
                            datetime.datetime.utcnow()
3396
3338
                            + client["timeout"])
3397
 
                        log.debug("Last checker succeeded, keeping %s"
3398
 
                                  " enabled", client_name)
 
3339
                        logger.debug("Last checker succeeded,"
 
3340
                                     " keeping {} enabled".format(
 
3341
                                         client_name))
3399
3342
            try:
3400
3343
                client["secret"] = pgp.decrypt(
3401
3344
                    client["encrypted_secret"],
3402
3345
                    client_settings[client_name]["secret"])
3403
3346
            except PGPError:
3404
3347
                # If decryption fails, we use secret from new settings
3405
 
                log.debug("Failed to decrypt %s old secret",
3406
 
                          client_name)
 
3348
                logger.debug("Failed to decrypt {} old secret".format(
 
3349
                    client_name))
3407
3350
                client["secret"] = (client_settings[client_name]
3408
3351
                                    ["secret"])
3409
3352
 
3423
3366
            server_settings=server_settings)
3424
3367
 
3425
3368
    if not tcp_server.clients:
3426
 
        log.warning("No clients defined")
 
3369
        logger.warning("No clients defined")
3427
3370
 
3428
3371
    if not foreground:
3429
3372
        if pidfile is not None:
3432
3375
                with pidfile:
3433
3376
                    print(pid, file=pidfile)
3434
3377
            except IOError:
3435
 
                log.error("Could not write to file %r with PID %d",
3436
 
                          pidfilename, pid)
 
3378
                logger.error("Could not write to file %r with PID %d",
 
3379
                             pidfilename, pid)
3437
3380
        del pidfile
3438
3381
        del pidfilename
3439
3382
 
3589
3532
 
3590
3533
        try:
3591
3534
            with tempfile.NamedTemporaryFile(
3592
 
                    mode="wb",
 
3535
                    mode='wb',
3593
3536
                    suffix=".pickle",
3594
 
                    prefix="clients-",
 
3537
                    prefix='clients-',
3595
3538
                    dir=os.path.dirname(stored_state_path),
3596
3539
                    delete=False) as stored_state:
3597
3540
                pickle.dump((clients, client_settings), stored_state,
3605
3548
                except NameError:
3606
3549
                    pass
3607
3550
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3608
 
                log.warning("Could not save persistent state: %s",
3609
 
                            os.strerror(e.errno))
 
3551
                logger.warning("Could not save persistent state: {}"
 
3552
                               .format(os.strerror(e.errno)))
3610
3553
            else:
3611
 
                log.warning("Could not save persistent state:",
3612
 
                            exc_info=e)
 
3554
                logger.warning("Could not save persistent state:",
 
3555
                               exc_info=e)
3613
3556
                raise
3614
3557
 
3615
3558
        # Delete all clients, and settings from config
3632
3575
            mandos_dbus_service.client_added_signal(client)
3633
3576
        # Need to initiate checking of clients
3634
3577
        if client.enabled:
3635
 
            client.init_checker(randomize_start=True)
 
3578
            client.init_checker()
3636
3579
 
3637
3580
    tcp_server.enable()
3638
3581
    tcp_server.server_activate()
3641
3584
    if zeroconf:
3642
3585
        service.port = tcp_server.socket.getsockname()[1]
3643
3586
    if use_ipv6:
3644
 
        log.info("Now listening on address %r, port %d, flowinfo %d,"
3645
 
                 " scope_id %d", *tcp_server.socket.getsockname())
 
3587
        logger.info("Now listening on address %r, port %d,"
 
3588
                    " flowinfo %d, scope_id %d",
 
3589
                    *tcp_server.socket.getsockname())
3646
3590
    else:                       # IPv4
3647
 
        log.info("Now listening on address %r, port %d",
3648
 
                 *tcp_server.socket.getsockname())
 
3591
        logger.info("Now listening on address %r, port %d",
 
3592
                    *tcp_server.socket.getsockname())
3649
3593
 
3650
3594
    # service.interface = tcp_server.socket.getsockname()[3]
3651
3595
 
3655
3599
            try:
3656
3600
                service.activate()
3657
3601
            except dbus.exceptions.DBusException as error:
3658
 
                log.critical("D-Bus Exception", exc_info=error)
 
3602
                logger.critical("D-Bus Exception", exc_info=error)
3659
3603
                cleanup()
3660
3604
                sys.exit(1)
3661
3605
            # End of Avahi example code
3666
3610
            lambda *args, **kwargs: (tcp_server.handle_request
3667
3611
                                     (*args[2:], **kwargs) or True))
3668
3612
 
3669
 
        log.debug("Starting main loop")
 
3613
        logger.debug("Starting main loop")
3670
3614
        main_loop.run()
3671
3615
    except AvahiError as error:
3672
 
        log.critical("Avahi Error", exc_info=error)
 
3616
        logger.critical("Avahi Error", exc_info=error)
3673
3617
        cleanup()
3674
3618
        sys.exit(1)
3675
3619
    except KeyboardInterrupt:
3676
3620
        if debug:
3677
3621
            print("", file=sys.stderr)
3678
 
        log.debug("Server received KeyboardInterrupt")
3679
 
    log.debug("Server exiting")
 
3622
        logger.debug("Server received KeyboardInterrupt")
 
3623
    logger.debug("Server exiting")
3680
3624
    # Must run before the D-Bus bus name gets deregistered
3681
3625
    cleanup()
3682
3626
 
3683
3627
 
3684
 
def parse_test_args():
3685
 
    # type: () -> argparse.Namespace
 
3628
def should_only_run_tests():
3686
3629
    parser = argparse.ArgumentParser(add_help=False)
3687
 
    parser.add_argument("--check", action="store_true")
3688
 
    parser.add_argument("--prefix", )
 
3630
    parser.add_argument("--check", action='store_true')
3689
3631
    args, unknown_args = parser.parse_known_args()
3690
 
    if args.check:
3691
 
        # Remove test options from sys.argv
 
3632
    run_tests = args.check
 
3633
    if run_tests:
 
3634
        # Remove --check argument from sys.argv
3692
3635
        sys.argv[1:] = unknown_args
3693
 
    return args
 
3636
    return run_tests
3694
3637
 
3695
3638
# Add all tests from doctest strings
3696
3639
def load_tests(loader, tests, none):
3698
3641
    tests.addTests(doctest.DocTestSuite())
3699
3642
    return tests
3700
3643
 
3701
 
if __name__ == "__main__":
3702
 
    options = parse_test_args()
 
3644
if __name__ == '__main__':
3703
3645
    try:
3704
 
        if options.check:
3705
 
            extra_test_prefix = options.prefix
3706
 
            if extra_test_prefix is not None:
3707
 
                if not (unittest.main(argv=[""], exit=False)
3708
 
                        .result.wasSuccessful()):
3709
 
                    sys.exit(1)
3710
 
                class ExtraTestLoader(unittest.TestLoader):
3711
 
                    testMethodPrefix = extra_test_prefix
3712
 
                # Call using ./scriptname --test [--verbose]
3713
 
                unittest.main(argv=[""], testLoader=ExtraTestLoader())
3714
 
            else:
3715
 
                unittest.main(argv=[""])
 
3646
        if should_only_run_tests():
 
3647
            # Call using ./mandos --check [--verbose]
 
3648
            unittest.main()
3716
3649
        else:
3717
3650
            main()
3718
3651
    finally:
3719
3652
        logging.shutdown()
3720
 
 
3721
 
# Local Variables:
3722
 
# run-tests:
3723
 
# (lambda (&optional extra)
3724
 
#   (if (not (funcall run-tests-in-test-buffer default-directory
3725
 
#             extra))
3726
 
#       (funcall show-test-buffer-in-test-window)
3727
 
#     (funcall remove-test-window)
3728
 
#     (if extra (message "Extra tests run successfully!"))))
3729
 
# run-tests-in-test-buffer:
3730
 
# (lambda (dir &optional extra)
3731
 
#   (with-current-buffer (get-buffer-create "*Test*")
3732
 
#     (setq buffer-read-only nil
3733
 
#           default-directory dir)
3734
 
#     (erase-buffer)
3735
 
#     (compilation-mode))
3736
 
#   (let ((process-result
3737
 
#          (let ((inhibit-read-only t))
3738
 
#            (process-file-shell-command
3739
 
#             (funcall get-command-line extra) nil "*Test*"))))
3740
 
#     (and (numberp process-result)
3741
 
#          (= process-result 0))))
3742
 
# get-command-line:
3743
 
# (lambda (&optional extra)
3744
 
#   (let ((quoted-script
3745
 
#          (shell-quote-argument (funcall get-script-name))))
3746
 
#     (format
3747
 
#      (concat "%s --check" (if extra " --prefix=atest" ""))
3748
 
#      quoted-script)))
3749
 
# get-script-name:
3750
 
# (lambda ()
3751
 
#   (if (fboundp 'file-local-name)
3752
 
#       (file-local-name (buffer-file-name))
3753
 
#     (or (file-remote-p (buffer-file-name) 'localname)
3754
 
#         (buffer-file-name))))
3755
 
# remove-test-window:
3756
 
# (lambda ()
3757
 
#   (let ((test-window (get-buffer-window "*Test*")))
3758
 
#     (if test-window (delete-window test-window))))
3759
 
# show-test-buffer-in-test-window:
3760
 
# (lambda ()
3761
 
#   (when (not (get-buffer-window-list "*Test*"))
3762
 
#     (setq next-error-last-buffer (get-buffer "*Test*"))
3763
 
#     (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3764
 
#            (display-buffer-overriding-action
3765
 
#             `((display-buffer-in-side-window) (side . ,side)
3766
 
#               (window-height . fit-window-to-buffer)
3767
 
#               (window-width . fit-window-to-buffer))))
3768
 
#       (display-buffer "*Test*"))))
3769
 
# eval:
3770
 
# (progn
3771
 
#   (let* ((run-extra-tests (lambda () (interactive)
3772
 
#                             (funcall run-tests t)))
3773
 
#          (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3774
 
#          (outer-keymap `(keymap (3 . ,inner-keymap))))     ; C-c
3775
 
#     (setq minor-mode-overriding-map-alist
3776
 
#           (cons `(run-tests . ,outer-keymap)
3777
 
#                 minor-mode-overriding-map-alist)))
3778
 
#   (add-hook 'after-save-hook run-tests 90 t))
3779
 
# End: