/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: teddy at recompile
  • Date: 2020-07-04 08:59:37 UTC
  • Revision ID: teddy@recompile.se-20200704085937-r495zb32nfng9lnt
In initramfs-tools boots, only use setsid when available

* initramfs-tools-script: If available, use setsid to start
  mandos-to-cryptroot-unlock.

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
1
#!/usr/bin/python3 -bI
2
 
# -*- coding: utf-8; lexical-binding: t -*-
 
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
 
# Copyright © 2008-2022 Teddy Hogeborn
15
 
# Copyright © 2008-2022 Björn Påhlsson
 
14
# Copyright © 2008-2019 Teddy Hogeborn
 
15
# Copyright © 2008-2019 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
 
34
 
34
35
from __future__ import (division, absolute_import, print_function,
35
36
                        unicode_literals)
36
37
 
39
40
except ImportError:
40
41
    pass
41
42
 
42
 
import sys
43
 
import unittest
44
 
import argparse
45
 
import logging
46
 
import os
47
43
try:
48
44
    import SocketServer as socketserver
49
45
except ImportError:
50
46
    import socketserver
51
47
import socket
 
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
    import ConfigParser as configparser
56
53
except ImportError:
57
54
    import configparser
 
55
import sys
58
56
import re
 
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
 
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
 
80
import unittest
80
81
import random
81
82
import shlex
82
83
 
93
94
if sys.version_info.major == 2:
94
95
    __metaclass__ = type
95
96
    str = unicode
96
 
    input = raw_input
97
97
 
98
98
# Add collections.abc.Callable if it does not exist
99
99
try:
143
143
if sys.version_info < (3, 2):
144
144
    configparser.Configparser = configparser.SafeConfigParser
145
145
 
146
 
version = "1.8.15"
 
146
version = "1.8.11"
147
147
stored_state_file = "clients.pickle"
148
148
 
149
 
log = logging.getLogger(os.path.basename(sys.argv[0]))
 
149
logger = logging.getLogger()
150
150
logging.captureWarnings(True)   # Show warnings via the logging system
151
151
syslogger = None
152
152
 
189
189
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
190
        address="/dev/log"))
191
191
    syslogger.setFormatter(logging.Formatter
192
 
                           ("Mandos [%(process)d]: %(levelname)s:"
193
 
                            " %(message)s"))
194
 
    log.addHandler(syslogger)
 
192
                           ('Mandos [%(process)d]: %(levelname)s:'
 
193
                            ' %(message)s'))
 
194
    logger.addHandler(syslogger)
195
195
 
196
196
    if debug:
197
197
        console = logging.StreamHandler()
198
 
        console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
 
                                               " [%(process)d]:"
200
 
                                               " %(levelname)s:"
201
 
                                               " %(message)s"))
202
 
        log.addHandler(console)
203
 
    log.setLevel(level)
 
198
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
199
                                               ' [%(process)d]:'
 
200
                                               ' %(levelname)s:'
 
201
                                               ' %(message)s'))
 
202
        logger.addHandler(console)
 
203
    logger.setLevel(level)
204
204
 
205
205
 
206
206
class PGPError(Exception):
224
224
        except OSError as e:
225
225
            if e.errno != errno.ENOENT:
226
226
                raise
227
 
        self.gnupgargs = ["--batch",
228
 
                          "--homedir", self.tempdir,
229
 
                          "--force-mdc",
230
 
                          "--quiet"]
 
227
        self.gnupgargs = ['--batch',
 
228
                          '--homedir', self.tempdir,
 
229
                          '--force-mdc',
 
230
                          '--quiet']
231
231
        # Only GPG version 1 has the --no-use-agent option.
232
232
        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
233
            self.gnupgargs.append("--no-use-agent")
272
272
                dir=self.tempdir) as passfile:
273
273
            passfile.write(passphrase)
274
274
            passfile.flush()
275
 
            proc = subprocess.Popen([self.gpg, "--symmetric",
276
 
                                     "--passphrase-file",
 
275
            proc = subprocess.Popen([self.gpg, '--symmetric',
 
276
                                     '--passphrase-file',
277
277
                                     passfile.name]
278
278
                                    + self.gnupgargs,
279
279
                                    stdin=subprocess.PIPE,
290
290
                dir=self.tempdir) as passfile:
291
291
            passfile.write(passphrase)
292
292
            passfile.flush()
293
 
            proc = subprocess.Popen([self.gpg, "--decrypt",
294
 
                                     "--passphrase-file",
 
293
            proc = subprocess.Popen([self.gpg, '--decrypt',
 
294
                                     '--passphrase-file',
295
295
                                     passfile.name]
296
296
                                    + self.gnupgargs,
297
297
                                    stdin=subprocess.PIPE,
350
350
    Attributes:
351
351
    interface: integer; avahi.IF_UNSPEC or an interface index.
352
352
               Used to optionally bind to the specified interface.
353
 
    name: string; Example: "Mandos"
354
 
    type: string; Example: "_mandos._tcp".
 
353
    name: string; Example: 'Mandos'
 
354
    type: string; Example: '_mandos._tcp'.
355
355
     See <https://www.iana.org/assignments/service-names-port-numbers>
356
356
    port: integer; what port to announce
357
357
    TXT: list of strings; TXT record for the service
394
394
    def rename(self, remove=True):
395
395
        """Derived from the Avahi example code"""
396
396
        if self.rename_count >= self.max_renames:
397
 
            log.critical("No suitable Zeroconf service name found"
398
 
                         " after %i retries, exiting.",
399
 
                         self.rename_count)
 
397
            logger.critical("No suitable Zeroconf service name found"
 
398
                            " after %i retries, exiting.",
 
399
                            self.rename_count)
400
400
            raise AvahiServiceError("Too many renames")
401
401
        self.name = str(
402
402
            self.server.GetAlternativeServiceName(self.name))
403
403
        self.rename_count += 1
404
 
        log.info("Changing Zeroconf service name to %r ...",
405
 
                 self.name)
 
404
        logger.info("Changing Zeroconf service name to %r ...",
 
405
                    self.name)
406
406
        if remove:
407
407
            self.remove()
408
408
        try:
410
410
        except dbus.exceptions.DBusException as error:
411
411
            if (error.get_dbus_name()
412
412
                == "org.freedesktop.Avahi.CollisionError"):
413
 
                log.info("Local Zeroconf service name collision.")
 
413
                logger.info("Local Zeroconf service name collision.")
414
414
                return self.rename(remove=False)
415
415
            else:
416
 
                log.critical("D-Bus Exception", exc_info=error)
 
416
                logger.critical("D-Bus Exception", exc_info=error)
417
417
                self.cleanup()
418
418
                os._exit(1)
419
419
 
435
435
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
436
        self.entry_group_state_changed_match = (
437
437
            self.group.connect_to_signal(
438
 
                "StateChanged", self.entry_group_state_changed))
439
 
        log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
 
                  self.name, self.type)
 
438
                'StateChanged', self.entry_group_state_changed))
 
439
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
 
440
                     self.name, self.type)
441
441
        self.group.AddService(
442
442
            self.interface,
443
443
            self.protocol,
450
450
 
451
451
    def entry_group_state_changed(self, state, error):
452
452
        """Derived from the Avahi example code"""
453
 
        log.debug("Avahi entry group state change: %i", state)
 
453
        logger.debug("Avahi entry group state change: %i", state)
454
454
 
455
455
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
 
            log.debug("Zeroconf service established.")
 
456
            logger.debug("Zeroconf service established.")
457
457
        elif state == avahi.ENTRY_GROUP_COLLISION:
458
 
            log.info("Zeroconf service name collision.")
 
458
            logger.info("Zeroconf service name collision.")
459
459
            self.rename()
460
460
        elif state == avahi.ENTRY_GROUP_FAILURE:
461
 
            log.critical("Avahi: Error in group state changed %s",
462
 
                         str(error))
 
461
            logger.critical("Avahi: Error in group state changed %s",
 
462
                            str(error))
463
463
            raise AvahiGroupError("State changed: {!s}".format(error))
464
464
 
465
465
    def cleanup(self):
475
475
 
476
476
    def server_state_changed(self, state, error=None):
477
477
        """Derived from the Avahi example code"""
478
 
        log.debug("Avahi server state change: %i", state)
 
478
        logger.debug("Avahi server state change: %i", state)
479
479
        bad_states = {
480
480
            avahi.SERVER_INVALID: "Zeroconf server invalid",
481
481
            avahi.SERVER_REGISTERING: None,
485
485
        if state in bad_states:
486
486
            if bad_states[state] is not None:
487
487
                if error is None:
488
 
                    log.error(bad_states[state])
 
488
                    logger.error(bad_states[state])
489
489
                else:
490
 
                    log.error(bad_states[state] + ": %r", error)
 
490
                    logger.error(bad_states[state] + ": %r", error)
491
491
            self.cleanup()
492
492
        elif state == avahi.SERVER_RUNNING:
493
493
            try:
495
495
            except dbus.exceptions.DBusException as error:
496
496
                if (error.get_dbus_name()
497
497
                    == "org.freedesktop.Avahi.CollisionError"):
498
 
                    log.info("Local Zeroconf service name collision.")
 
498
                    logger.info("Local Zeroconf service name"
 
499
                                " collision.")
499
500
                    return self.rename(remove=False)
500
501
                else:
501
 
                    log.critical("D-Bus Exception", exc_info=error)
 
502
                    logger.critical("D-Bus Exception", exc_info=error)
502
503
                    self.cleanup()
503
504
                    os._exit(1)
504
505
        else:
505
506
            if error is None:
506
 
                log.debug("Unknown state: %r", state)
 
507
                logger.debug("Unknown state: %r", state)
507
508
            else:
508
 
                log.debug("Unknown state: %r: %r", state, error)
 
509
                logger.debug("Unknown state: %r: %r", state, error)
509
510
 
510
511
    def activate(self):
511
512
        """Derived from the Avahi example code"""
523
524
class AvahiServiceToSyslog(AvahiService):
524
525
    def rename(self, *args, **kwargs):
525
526
        """Add the new name to the syslog messages"""
526
 
        ret = super(AvahiServiceToSyslog, self).rename(*args,
527
 
                                                       **kwargs)
 
527
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
528
528
        syslogger.setFormatter(logging.Formatter(
529
 
            "Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
 
529
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
530
            .format(self.name)))
531
531
        return ret
532
532
 
562
562
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
563
563
 
564
564
    # Types
565
 
    class _session_int(ctypes.Structure):
 
565
    class session_int(ctypes.Structure):
566
566
        _fields_ = []
567
 
    session_t = ctypes.POINTER(_session_int)
 
567
    session_t = ctypes.POINTER(session_int)
568
568
 
569
569
    class certificate_credentials_st(ctypes.Structure):
570
570
        _fields_ = []
573
573
    certificate_type_t = ctypes.c_int
574
574
 
575
575
    class datum_t(ctypes.Structure):
576
 
        _fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
 
                    ("size", ctypes.c_uint)]
 
576
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
 
577
                    ('size', ctypes.c_uint)]
578
578
 
579
 
    class _openpgp_crt_int(ctypes.Structure):
 
579
    class openpgp_crt_int(ctypes.Structure):
580
580
        _fields_ = []
581
 
    openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
 
581
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
582
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
583
583
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
584
    credentials_type_t = ctypes.c_int
593
593
            # gnutls.strerror()
594
594
            self.code = code
595
595
            if message is None and code is not None:
596
 
                message = gnutls.strerror(code).decode(
597
 
                    "utf-8", errors="replace")
 
596
                message = gnutls.strerror(code)
598
597
            return super(gnutls.Error, self).__init__(
599
598
                message, *args)
600
599
 
601
600
    class CertificateSecurityError(Error):
602
601
        pass
603
602
 
604
 
    class PointerTo:
605
 
        def __init__(self, cls):
606
 
            self.cls = cls
607
 
 
608
 
        def from_param(self, obj):
609
 
            if not isinstance(obj, self.cls):
610
 
                raise TypeError("Not of type {}: {!r}"
611
 
                                .format(self.cls.__name__, obj))
612
 
            return ctypes.byref(obj.from_param(obj))
613
 
 
614
 
    class CastToVoidPointer:
615
 
        def __init__(self, cls):
616
 
            self.cls = cls
617
 
 
618
 
        def from_param(self, obj):
619
 
            if not isinstance(obj, self.cls):
620
 
                raise TypeError("Not of type {}: {!r}"
621
 
                                .format(self.cls.__name__, obj))
622
 
            return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
 
 
624
 
    class With_from_param:
625
 
        @classmethod
626
 
        def from_param(cls, obj):
627
 
            return obj._as_parameter_
628
 
 
629
603
    # Classes
630
 
    class Credentials(With_from_param):
 
604
    class Credentials:
631
605
        def __init__(self):
632
 
            self._as_parameter_ = gnutls.certificate_credentials_t()
633
 
            gnutls.certificate_allocate_credentials(self)
 
606
            self._c_object = gnutls.certificate_credentials_t()
 
607
            gnutls.certificate_allocate_credentials(
 
608
                ctypes.byref(self._c_object))
634
609
            self.type = gnutls.CRD_CERTIFICATE
635
610
 
636
611
        def __del__(self):
637
 
            gnutls.certificate_free_credentials(self)
 
612
            gnutls.certificate_free_credentials(self._c_object)
638
613
 
639
 
    class ClientSession(With_from_param):
 
614
    class ClientSession:
640
615
        def __init__(self, socket, credentials=None):
641
 
            self._as_parameter_ = gnutls.session_t()
 
616
            self._c_object = gnutls.session_t()
642
617
            gnutls_flags = gnutls.CLIENT
643
618
            if gnutls.check_version(b"3.5.6"):
644
619
                gnutls_flags |= gnutls.NO_TICKETS
645
620
            if gnutls.has_rawpk:
646
621
                gnutls_flags |= gnutls.ENABLE_RAWPK
647
 
            gnutls.init(self, gnutls_flags)
 
622
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
648
623
            del gnutls_flags
649
 
            gnutls.set_default_priority(self)
650
 
            gnutls.transport_set_ptr(self, socket.fileno())
651
 
            gnutls.handshake_set_private_extensions(self, True)
 
624
            gnutls.set_default_priority(self._c_object)
 
625
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
 
626
            gnutls.handshake_set_private_extensions(self._c_object,
 
627
                                                    True)
652
628
            self.socket = socket
653
629
            if credentials is None:
654
630
                credentials = gnutls.Credentials()
655
 
            gnutls.credentials_set(self, credentials.type,
656
 
                                   credentials)
 
631
            gnutls.credentials_set(self._c_object, credentials.type,
 
632
                                   ctypes.cast(credentials._c_object,
 
633
                                               ctypes.c_void_p))
657
634
            self.credentials = credentials
658
635
 
659
636
        def __del__(self):
660
 
            gnutls.deinit(self)
 
637
            gnutls.deinit(self._c_object)
661
638
 
662
639
        def handshake(self):
663
 
            return gnutls.handshake(self)
 
640
            return gnutls.handshake(self._c_object)
664
641
 
665
642
        def send(self, data):
666
643
            data = bytes(data)
667
644
            data_len = len(data)
668
645
            while data_len > 0:
669
 
                data_len -= gnutls.record_send(self, data[-data_len:],
 
646
                data_len -= gnutls.record_send(self._c_object,
 
647
                                               data[-data_len:],
670
648
                                               data_len)
671
649
 
672
650
        def bye(self):
673
 
            return gnutls.bye(self, gnutls.SHUT_RDWR)
 
651
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
652
 
675
653
    # Error handling functions
676
654
    def _error_code(result):
677
655
        """A function to raise exceptions on errors, suitable
678
 
        for the "restype" attribute on ctypes functions"""
679
 
        if result >= gnutls.E_SUCCESS:
 
656
        for the 'restype' attribute on ctypes functions"""
 
657
        if result >= 0:
680
658
            return result
681
659
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
660
            raise gnutls.CertificateSecurityError(code=result)
683
661
        raise gnutls.Error(code=result)
684
662
 
685
 
    def _retry_on_error(result, func, arguments,
686
 
                        _error_code=_error_code):
 
663
    def _retry_on_error(result, func, arguments):
687
664
        """A function to retry on some errors, suitable
688
 
        for the "errcheck" attribute on ctypes functions"""
689
 
        while result < gnutls.E_SUCCESS:
 
665
        for the 'errcheck' attribute on ctypes functions"""
 
666
        while result < 0:
690
667
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
668
                return _error_code(result)
692
669
            result = func(*arguments)
697
674
 
698
675
    # Functions
699
676
    priority_set_direct = _library.gnutls_priority_set_direct
700
 
    priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
 
677
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
678
                                    ctypes.POINTER(ctypes.c_char_p)]
702
679
    priority_set_direct.restype = _error_code
703
680
 
704
681
    init = _library.gnutls_init
705
 
    init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
 
682
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
683
    init.restype = _error_code
707
684
 
708
685
    set_default_priority = _library.gnutls_set_default_priority
709
 
    set_default_priority.argtypes = [ClientSession]
 
686
    set_default_priority.argtypes = [session_t]
710
687
    set_default_priority.restype = _error_code
711
688
 
712
689
    record_send = _library.gnutls_record_send
713
 
    record_send.argtypes = [ClientSession, ctypes.c_void_p,
 
690
    record_send.argtypes = [session_t, ctypes.c_void_p,
714
691
                            ctypes.c_size_t]
715
692
    record_send.restype = ctypes.c_ssize_t
716
693
    record_send.errcheck = _retry_on_error
718
695
    certificate_allocate_credentials = (
719
696
        _library.gnutls_certificate_allocate_credentials)
720
697
    certificate_allocate_credentials.argtypes = [
721
 
        PointerTo(Credentials)]
 
698
        ctypes.POINTER(certificate_credentials_t)]
722
699
    certificate_allocate_credentials.restype = _error_code
723
700
 
724
701
    certificate_free_credentials = (
725
702
        _library.gnutls_certificate_free_credentials)
726
 
    certificate_free_credentials.argtypes = [Credentials]
 
703
    certificate_free_credentials.argtypes = [
 
704
        certificate_credentials_t]
727
705
    certificate_free_credentials.restype = None
728
706
 
729
707
    handshake_set_private_extensions = (
730
708
        _library.gnutls_handshake_set_private_extensions)
731
 
    handshake_set_private_extensions.argtypes = [ClientSession,
 
709
    handshake_set_private_extensions.argtypes = [session_t,
732
710
                                                 ctypes.c_int]
733
711
    handshake_set_private_extensions.restype = None
734
712
 
735
713
    credentials_set = _library.gnutls_credentials_set
736
 
    credentials_set.argtypes = [ClientSession, credentials_type_t,
737
 
                                CastToVoidPointer(Credentials)]
 
714
    credentials_set.argtypes = [session_t, credentials_type_t,
 
715
                                ctypes.c_void_p]
738
716
    credentials_set.restype = _error_code
739
717
 
740
718
    strerror = _library.gnutls_strerror
742
720
    strerror.restype = ctypes.c_char_p
743
721
 
744
722
    certificate_type_get = _library.gnutls_certificate_type_get
745
 
    certificate_type_get.argtypes = [ClientSession]
 
723
    certificate_type_get.argtypes = [session_t]
746
724
    certificate_type_get.restype = _error_code
747
725
 
748
726
    certificate_get_peers = _library.gnutls_certificate_get_peers
749
 
    certificate_get_peers.argtypes = [ClientSession,
 
727
    certificate_get_peers.argtypes = [session_t,
750
728
                                      ctypes.POINTER(ctypes.c_uint)]
751
729
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
730
 
759
737
    global_set_log_function.restype = None
760
738
 
761
739
    deinit = _library.gnutls_deinit
762
 
    deinit.argtypes = [ClientSession]
 
740
    deinit.argtypes = [session_t]
763
741
    deinit.restype = None
764
742
 
765
743
    handshake = _library.gnutls_handshake
766
 
    handshake.argtypes = [ClientSession]
767
 
    handshake.restype = ctypes.c_int
 
744
    handshake.argtypes = [session_t]
 
745
    handshake.restype = _error_code
768
746
    handshake.errcheck = _retry_on_error
769
747
 
770
748
    transport_set_ptr = _library.gnutls_transport_set_ptr
771
 
    transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
 
749
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
750
    transport_set_ptr.restype = None
773
751
 
774
752
    bye = _library.gnutls_bye
775
 
    bye.argtypes = [ClientSession, close_request_t]
776
 
    bye.restype = ctypes.c_int
 
753
    bye.argtypes = [session_t, close_request_t]
 
754
    bye.restype = _error_code
777
755
    bye.errcheck = _retry_on_error
778
756
 
779
757
    check_version = _library.gnutls_check_version
796
774
 
797
775
        x509_crt_fmt_t = ctypes.c_int
798
776
 
799
 
        # All the function declarations below are from
800
 
        # gnutls/abstract.h
 
777
        # All the function declarations below are from gnutls/abstract.h
801
778
        pubkey_init = _library.gnutls_pubkey_init
802
779
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
780
        pubkey_init.restype = _error_code
817
794
        pubkey_deinit.argtypes = [pubkey_t]
818
795
        pubkey_deinit.restype = None
819
796
    else:
820
 
        # All the function declarations below are from
821
 
        # gnutls/openpgp.h
 
797
        # All the function declarations below are from gnutls/openpgp.h
822
798
 
823
799
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
800
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
830
806
                                       openpgp_crt_fmt_t]
831
807
        openpgp_crt_import.restype = _error_code
832
808
 
833
 
        openpgp_crt_verify_self = \
834
 
            _library.gnutls_openpgp_crt_verify_self
835
 
        openpgp_crt_verify_self.argtypes = [
836
 
            openpgp_crt_t,
837
 
            ctypes.c_uint,
838
 
            ctypes.POINTER(ctypes.c_uint),
839
 
        ]
 
809
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
 
810
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
 
811
                                            ctypes.POINTER(ctypes.c_uint)]
840
812
        openpgp_crt_verify_self.restype = _error_code
841
813
 
842
814
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
853
825
 
854
826
    if check_version(b"3.6.4"):
855
827
        certificate_type_get2 = _library.gnutls_certificate_type_get2
856
 
        certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
 
828
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
857
829
        certificate_type_get2.restype = _error_code
858
830
 
859
831
    # Remove non-public functions
875
847
    """A representation of a client host served by this server.
876
848
 
877
849
    Attributes:
878
 
    approved:   bool(); None if not yet approved/disapproved
 
850
    approved:   bool(); 'None' if not yet approved/disapproved
879
851
    approval_delay: datetime.timedelta(); Time to wait for approval
880
852
    approval_duration: datetime.timedelta(); Duration of one approval
881
853
    checker: multiprocessing.Process(); a running checker process used
882
 
             to see if the client lives. None if no process is
 
854
             to see if the client lives. 'None' if no process is
883
855
             running.
884
856
    checker_callback_tag: a GLib event source tag, or None
885
857
    checker_command: string; External command which is run to check
1009
981
            self.last_enabled = None
1010
982
            self.expires = None
1011
983
 
1012
 
        log.debug("Creating client %r", self.name)
1013
 
        log.debug("  Key ID: %s", self.key_id)
1014
 
        log.debug("  Fingerprint: %s", self.fingerprint)
 
984
        logger.debug("Creating client %r", self.name)
 
985
        logger.debug("  Key ID: %s", self.key_id)
 
986
        logger.debug("  Fingerprint: %s", self.fingerprint)
1015
987
        self.created = settings.get("created",
1016
988
                                    datetime.datetime.utcnow())
1017
989
 
1056
1028
        if not getattr(self, "enabled", False):
1057
1029
            return False
1058
1030
        if not quiet:
1059
 
            log.info("Disabling client %s", self.name)
 
1031
            logger.info("Disabling client %s", self.name)
1060
1032
        if getattr(self, "disable_initiator_tag", None) is not None:
1061
1033
            GLib.source_remove(self.disable_initiator_tag)
1062
1034
            self.disable_initiator_tag = None
1106
1078
            self.last_checker_status = returncode
1107
1079
            self.last_checker_signal = None
1108
1080
            if self.last_checker_status == 0:
1109
 
                log.info("Checker for %(name)s succeeded", vars(self))
 
1081
                logger.info("Checker for %(name)s succeeded",
 
1082
                            vars(self))
1110
1083
                self.checked_ok()
1111
1084
            else:
1112
 
                log.info("Checker for %(name)s failed", vars(self))
 
1085
                logger.info("Checker for %(name)s failed", vars(self))
1113
1086
        else:
1114
1087
            self.last_checker_status = -1
1115
1088
            self.last_checker_signal = -returncode
1116
 
            log.warning("Checker for %(name)s crashed?", vars(self))
 
1089
            logger.warning("Checker for %(name)s crashed?",
 
1090
                           vars(self))
1117
1091
        return False
1118
1092
 
1119
1093
    def checked_ok(self):
1153
1127
        # should be.
1154
1128
 
1155
1129
        if self.checker is not None and not self.checker.is_alive():
1156
 
            log.warning("Checker was not alive; joining")
 
1130
            logger.warning("Checker was not alive; joining")
1157
1131
            self.checker.join()
1158
1132
            self.checker = None
1159
1133
        # Start a new checker if needed
1165
1139
            try:
1166
1140
                command = self.checker_command % escaped_attrs
1167
1141
            except TypeError as error:
1168
 
                log.error('Could not format string "%s"',
1169
 
                          self.checker_command, exc_info=error)
 
1142
                logger.error('Could not format string "%s"',
 
1143
                             self.checker_command,
 
1144
                             exc_info=error)
1170
1145
                return True     # Try again later
1171
1146
            self.current_checker_command = command
1172
 
            log.info("Starting checker %r for %s", command, self.name)
 
1147
            logger.info("Starting checker %r for %s", command,
 
1148
                        self.name)
1173
1149
            # We don't need to redirect stdout and stderr, since
1174
1150
            # in normal mode, that is already done by daemon(),
1175
1151
            # and in debug mode we don't want to.  (Stdin is
1204
1180
            self.checker_callback_tag = None
1205
1181
        if getattr(self, "checker", None) is None:
1206
1182
            return
1207
 
        log.debug("Stopping checker for %(name)s", vars(self))
 
1183
        logger.debug("Stopping checker for %(name)s", vars(self))
1208
1184
        self.checker.terminate()
1209
1185
        self.checker = None
1210
1186
 
1237
1213
        func._dbus_name = func.__name__
1238
1214
        if func._dbus_name.endswith("_dbus_property"):
1239
1215
            func._dbus_name = func._dbus_name[:-14]
1240
 
        func._dbus_get_args_options = {"byte_arrays": byte_arrays}
 
1216
        func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1241
1217
        return func
1242
1218
 
1243
1219
    return decorator
1332
1308
 
1333
1309
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1334
1310
                         out_signature="s",
1335
 
                         path_keyword="object_path",
1336
 
                         connection_keyword="connection")
 
1311
                         path_keyword='object_path',
 
1312
                         connection_keyword='connection')
1337
1313
    def Introspect(self, object_path, connection):
1338
1314
        """Overloading of standard D-Bus method.
1339
1315
 
1388
1364
            document.unlink()
1389
1365
        except (AttributeError, xml.dom.DOMException,
1390
1366
                xml.parsers.expat.ExpatError) as error:
1391
 
            log.error("Failed to override Introspection method",
1392
 
                      exc_info=error)
 
1367
            logger.error("Failed to override Introspection method",
 
1368
                         exc_info=error)
1393
1369
        return xmlstring
1394
1370
 
1395
1371
 
1492
1468
 
1493
1469
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1494
1470
                         out_signature="s",
1495
 
                         path_keyword="object_path",
1496
 
                         connection_keyword="connection")
 
1471
                         path_keyword='object_path',
 
1472
                         connection_keyword='connection')
1497
1473
    def Introspect(self, object_path, connection):
1498
1474
        """Overloading of standard D-Bus method.
1499
1475
 
1555
1531
            document.unlink()
1556
1532
        except (AttributeError, xml.dom.DOMException,
1557
1533
                xml.parsers.expat.ExpatError) as error:
1558
 
            log.error("Failed to override Introspection method",
1559
 
                      exc_info=error)
 
1534
            logger.error("Failed to override Introspection method",
 
1535
                         exc_info=error)
1560
1536
        return xmlstring
1561
1537
 
1562
1538
 
1594
1570
 
1595
1571
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1596
1572
                         out_signature="s",
1597
 
                         path_keyword="object_path",
1598
 
                         connection_keyword="connection")
 
1573
                         path_keyword='object_path',
 
1574
                         connection_keyword='connection')
1599
1575
    def Introspect(self, object_path, connection):
1600
1576
        """Overloading of standard D-Bus method.
1601
1577
 
1626
1602
            document.unlink()
1627
1603
        except (AttributeError, xml.dom.DOMException,
1628
1604
                xml.parsers.expat.ExpatError) as error:
1629
 
            log.error("Failed to override Introspection method",
1630
 
                      exc_info=error)
 
1605
            logger.error("Failed to override Introspection method",
 
1606
                         exc_info=error)
1631
1607
        return xmlstring
1632
1608
 
1633
1609
 
2267
2243
class ProxyClient:
2268
2244
    def __init__(self, child_pipe, key_id, fpr, address):
2269
2245
        self._pipe = child_pipe
2270
 
        self._pipe.send(("init", key_id, fpr, address))
 
2246
        self._pipe.send(('init', key_id, fpr, address))
2271
2247
        if not self._pipe.recv():
2272
2248
            raise KeyError(key_id or fpr)
2273
2249
 
2274
2250
    def __getattribute__(self, name):
2275
 
        if name == "_pipe":
 
2251
        if name == '_pipe':
2276
2252
            return super(ProxyClient, self).__getattribute__(name)
2277
 
        self._pipe.send(("getattr", name))
 
2253
        self._pipe.send(('getattr', name))
2278
2254
        data = self._pipe.recv()
2279
 
        if data[0] == "data":
 
2255
        if data[0] == 'data':
2280
2256
            return data[1]
2281
 
        if data[0] == "function":
 
2257
        if data[0] == 'function':
2282
2258
 
2283
2259
            def func(*args, **kwargs):
2284
 
                self._pipe.send(("funcall", name, args, kwargs))
 
2260
                self._pipe.send(('funcall', name, args, kwargs))
2285
2261
                return self._pipe.recv()[1]
2286
2262
 
2287
2263
            return func
2288
2264
 
2289
2265
    def __setattr__(self, name, value):
2290
 
        if name == "_pipe":
 
2266
        if name == '_pipe':
2291
2267
            return super(ProxyClient, self).__setattr__(name, value)
2292
 
        self._pipe.send(("setattr", name, value))
 
2268
        self._pipe.send(('setattr', name, value))
2293
2269
 
2294
2270
 
2295
2271
class ClientHandler(socketserver.BaseRequestHandler, object):
2300
2276
 
2301
2277
    def handle(self):
2302
2278
        with contextlib.closing(self.server.child_pipe) as child_pipe:
2303
 
            log.info("TCP connection from: %s",
2304
 
                     str(self.client_address))
2305
 
            log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
 
2279
            logger.info("TCP connection from: %s",
 
2280
                        str(self.client_address))
 
2281
            logger.debug("Pipe FD: %d",
 
2282
                         self.server.child_pipe.fileno())
2306
2283
 
2307
2284
            session = gnutls.ClientSession(self.request)
2308
2285
 
2309
 
            # priority = ":".join(("NONE", "+VERS-TLS1.1",
 
2286
            # priority = ':'.join(("NONE", "+VERS-TLS1.1",
2310
2287
            #                       "+AES-256-CBC", "+SHA1",
2311
2288
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
2312
2289
            #                       "+DHE-DSS"))
2314
2291
            priority = self.server.gnutls_priority
2315
2292
            if priority is None:
2316
2293
                priority = "NORMAL"
2317
 
            gnutls.priority_set_direct(session,
2318
 
                                       priority.encode("utf-8"), None)
 
2294
            gnutls.priority_set_direct(session._c_object,
 
2295
                                       priority.encode("utf-8"),
 
2296
                                       None)
2319
2297
 
2320
2298
            # Start communication using the Mandos protocol
2321
2299
            # Get protocol number
2322
2300
            line = self.request.makefile().readline()
2323
 
            log.debug("Protocol version: %r", line)
 
2301
            logger.debug("Protocol version: %r", line)
2324
2302
            try:
2325
2303
                if int(line.strip().split()[0]) > 1:
2326
2304
                    raise RuntimeError(line)
2327
2305
            except (ValueError, IndexError, RuntimeError) as error:
2328
 
                log.error("Unknown protocol version: %s", error)
 
2306
                logger.error("Unknown protocol version: %s", error)
2329
2307
                return
2330
2308
 
2331
2309
            # Start GnuTLS connection
2332
2310
            try:
2333
2311
                session.handshake()
2334
2312
            except gnutls.Error as error:
2335
 
                log.warning("Handshake failed: %s", error)
 
2313
                logger.warning("Handshake failed: %s", error)
2336
2314
                # Do not run session.bye() here: the session is not
2337
2315
                # established.  Just abandon the request.
2338
2316
                return
2339
 
            log.debug("Handshake succeeded")
 
2317
            logger.debug("Handshake succeeded")
2340
2318
 
2341
2319
            approval_required = False
2342
2320
            try:
2346
2324
                        key_id = self.key_id(
2347
2325
                            self.peer_certificate(session))
2348
2326
                    except (TypeError, gnutls.Error) as error:
2349
 
                        log.warning("Bad certificate: %s", error)
 
2327
                        logger.warning("Bad certificate: %s", error)
2350
2328
                        return
2351
 
                    log.debug("Key ID: %s",
2352
 
                              key_id.decode("utf-8",
2353
 
                                            errors="replace"))
 
2329
                    logger.debug("Key ID: %s", key_id)
2354
2330
 
2355
2331
                else:
2356
2332
                    key_id = b""
2358
2334
                        fpr = self.fingerprint(
2359
2335
                            self.peer_certificate(session))
2360
2336
                    except (TypeError, gnutls.Error) as error:
2361
 
                        log.warning("Bad certificate: %s", error)
 
2337
                        logger.warning("Bad certificate: %s", error)
2362
2338
                        return
2363
 
                    log.debug("Fingerprint: %s", fpr)
 
2339
                    logger.debug("Fingerprint: %s", fpr)
2364
2340
 
2365
2341
                try:
2366
2342
                    client = ProxyClient(child_pipe, key_id, fpr,
2375
2351
 
2376
2352
                while True:
2377
2353
                    if not client.enabled:
2378
 
                        log.info("Client %s is disabled", client.name)
 
2354
                        logger.info("Client %s is disabled",
 
2355
                                    client.name)
2379
2356
                        if self.server.use_dbus:
2380
2357
                            # Emit D-Bus signal
2381
2358
                            client.Rejected("Disabled")
2385
2362
                        # We are approved or approval is disabled
2386
2363
                        break
2387
2364
                    elif client.approved is None:
2388
 
                        log.info("Client %s needs approval",
2389
 
                                 client.name)
 
2365
                        logger.info("Client %s needs approval",
 
2366
                                    client.name)
2390
2367
                        if self.server.use_dbus:
2391
2368
                            # Emit D-Bus signal
2392
2369
                            client.NeedApproval(
2393
2370
                                client.approval_delay.total_seconds()
2394
2371
                                * 1000, client.approved_by_default)
2395
2372
                    else:
2396
 
                        log.warning("Client %s was not approved",
2397
 
                                    client.name)
 
2373
                        logger.warning("Client %s was not approved",
 
2374
                                       client.name)
2398
2375
                        if self.server.use_dbus:
2399
2376
                            # Emit D-Bus signal
2400
2377
                            client.Rejected("Denied")
2408
2385
                    time2 = datetime.datetime.now()
2409
2386
                    if (time2 - time) >= delay:
2410
2387
                        if not client.approved_by_default:
2411
 
                            log.warning("Client %s timed out while"
2412
 
                                        " waiting for approval",
2413
 
                                        client.name)
 
2388
                            logger.warning("Client %s timed out while"
 
2389
                                           " waiting for approval",
 
2390
                                           client.name)
2414
2391
                            if self.server.use_dbus:
2415
2392
                                # Emit D-Bus signal
2416
2393
                                client.Rejected("Approval timed out")
2423
2400
                try:
2424
2401
                    session.send(client.secret)
2425
2402
                except gnutls.Error as error:
2426
 
                    log.warning("gnutls send failed", exc_info=error)
 
2403
                    logger.warning("gnutls send failed",
 
2404
                                   exc_info=error)
2427
2405
                    return
2428
2406
 
2429
 
                log.info("Sending secret to %s", client.name)
 
2407
                logger.info("Sending secret to %s", client.name)
2430
2408
                # bump the timeout using extended_timeout
2431
2409
                client.bump_timeout(client.extended_timeout)
2432
2410
                if self.server.use_dbus:
2439
2417
                try:
2440
2418
                    session.bye()
2441
2419
                except gnutls.Error as error:
2442
 
                    log.warning("GnuTLS bye failed", exc_info=error)
 
2420
                    logger.warning("GnuTLS bye failed",
 
2421
                                   exc_info=error)
2443
2422
 
2444
2423
    @staticmethod
2445
2424
    def peer_certificate(session):
2446
2425
        "Return the peer's certificate as a bytestring"
2447
2426
        try:
2448
 
            cert_type = gnutls.certificate_type_get2(
2449
 
                session, gnutls.CTYPE_PEERS)
 
2427
            cert_type = gnutls.certificate_type_get2(session._c_object,
 
2428
                                                     gnutls.CTYPE_PEERS)
2450
2429
        except AttributeError:
2451
 
            cert_type = gnutls.certificate_type_get(session)
 
2430
            cert_type = gnutls.certificate_type_get(session._c_object)
2452
2431
        if gnutls.has_rawpk:
2453
2432
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2454
2433
        else:
2455
2434
            valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2456
2435
        # If not a valid certificate type...
2457
2436
        if cert_type not in valid_cert_types:
2458
 
            log.info("Cert type %r not in %r", cert_type,
2459
 
                     valid_cert_types)
 
2437
            logger.info("Cert type %r not in %r", cert_type,
 
2438
                        valid_cert_types)
2460
2439
            # ...return invalid data
2461
2440
            return b""
2462
2441
        list_size = ctypes.c_uint(1)
2463
2442
        cert_list = (gnutls.certificate_get_peers
2464
 
                     (session, ctypes.byref(list_size)))
 
2443
                     (session._c_object, ctypes.byref(list_size)))
2465
2444
        if not bool(cert_list) and list_size.value != 0:
2466
2445
            raise gnutls.Error("error getting peer certificate")
2467
2446
        if list_size.value == 0:
2489
2468
        buf = ctypes.create_string_buffer(32)
2490
2469
        buf_len = ctypes.c_size_t(len(buf))
2491
2470
        # Get the key ID from the raw public key into the buffer
2492
 
        gnutls.pubkey_get_key_id(
2493
 
            pubkey,
2494
 
            gnutls.KEYID_USE_SHA256,
2495
 
            ctypes.cast(ctypes.byref(buf),
2496
 
                        ctypes.POINTER(ctypes.c_ubyte)),
2497
 
            ctypes.byref(buf_len))
 
2471
        gnutls.pubkey_get_key_id(pubkey,
 
2472
                                 gnutls.KEYID_USE_SHA256,
 
2473
                                 ctypes.cast(ctypes.byref(buf),
 
2474
                                             ctypes.POINTER(ctypes.c_ubyte)),
 
2475
                                 ctypes.byref(buf_len))
2498
2476
        # Deinit the certificate
2499
2477
        gnutls.pubkey_deinit(pubkey)
2500
2478
 
2581
2559
 
2582
2560
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2583
2561
                     socketserver.TCPServer):
2584
 
    """IPv6-capable TCP server.  Accepts None as address and/or port
 
2562
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
2585
2563
 
2586
2564
    Attributes:
2587
2565
        enabled:        Boolean; whether this server is activated yet
2638
2616
            if SO_BINDTODEVICE is None:
2639
2617
                # Fall back to a hard-coded value which seems to be
2640
2618
                # common enough.
2641
 
                log.warning("SO_BINDTODEVICE not found, trying 25")
 
2619
                logger.warning("SO_BINDTODEVICE not found, trying 25")
2642
2620
                SO_BINDTODEVICE = 25
2643
2621
            try:
2644
2622
                self.socket.setsockopt(
2646
2624
                    (self.interface + "\0").encode("utf-8"))
2647
2625
            except socket.error as error:
2648
2626
                if error.errno == errno.EPERM:
2649
 
                    log.error("No permission to bind to interface %s",
2650
 
                              self.interface)
 
2627
                    logger.error("No permission to bind to"
 
2628
                                 " interface %s", self.interface)
2651
2629
                elif error.errno == errno.ENOPROTOOPT:
2652
 
                    log.error("SO_BINDTODEVICE not available; cannot"
2653
 
                              " bind to interface %s", self.interface)
 
2630
                    logger.error("SO_BINDTODEVICE not available;"
 
2631
                                 " cannot bind to interface %s",
 
2632
                                 self.interface)
2654
2633
                elif error.errno == errno.ENODEV:
2655
 
                    log.error("Interface %s does not exist, cannot"
2656
 
                              " bind", self.interface)
 
2634
                    logger.error("Interface %s does not exist,"
 
2635
                                 " cannot bind", self.interface)
2657
2636
                else:
2658
2637
                    raise
2659
2638
        # Only bind(2) the socket if we really need to.
2738
2717
        request = parent_pipe.recv()
2739
2718
        command = request[0]
2740
2719
 
2741
 
        if command == "init":
 
2720
        if command == 'init':
2742
2721
            key_id = request[1].decode("ascii")
2743
2722
            fpr = request[2].decode("ascii")
2744
2723
            address = request[3]
2745
2724
 
2746
2725
            for c in self.clients.values():
2747
 
                if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2748
 
                              "27AE41E4649B934CA495991B7852B855"):
 
2726
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2749
2727
                    continue
2750
2728
                if key_id and c.key_id == key_id:
2751
2729
                    client = c
2754
2732
                    client = c
2755
2733
                    break
2756
2734
            else:
2757
 
                log.info("Client not found for key ID: %s, address:"
2758
 
                         " %s", key_id or fpr, address)
 
2735
                logger.info("Client not found for key ID: %s, address"
 
2736
                            ": %s", key_id or fpr, address)
2759
2737
                if self.use_dbus:
2760
2738
                    # Emit D-Bus signal
2761
2739
                    mandos_dbus_service.ClientNotFound(key_id or fpr,
2774
2752
            # remove the old hook in favor of the new above hook on
2775
2753
            # same fileno
2776
2754
            return False
2777
 
        if command == "funcall":
 
2755
        if command == 'funcall':
2778
2756
            funcname = request[1]
2779
2757
            args = request[2]
2780
2758
            kwargs = request[3]
2781
2759
 
2782
 
            parent_pipe.send(("data", getattr(client_object,
 
2760
            parent_pipe.send(('data', getattr(client_object,
2783
2761
                                              funcname)(*args,
2784
2762
                                                        **kwargs)))
2785
2763
 
2786
 
        if command == "getattr":
 
2764
        if command == 'getattr':
2787
2765
            attrname = request[1]
2788
2766
            if isinstance(client_object.__getattribute__(attrname),
2789
2767
                          collections.abc.Callable):
2790
 
                parent_pipe.send(("function", ))
 
2768
                parent_pipe.send(('function', ))
2791
2769
            else:
2792
2770
                parent_pipe.send((
2793
 
                    "data", client_object.__getattribute__(attrname)))
 
2771
                    'data', client_object.__getattribute__(attrname)))
2794
2772
 
2795
 
        if command == "setattr":
 
2773
        if command == 'setattr':
2796
2774
            attrname = request[1]
2797
2775
            value = request[2]
2798
2776
            setattr(client_object, attrname, value)
2803
2781
def rfc3339_duration_to_delta(duration):
2804
2782
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2805
2783
 
2806
 
    >>> timedelta = datetime.timedelta
2807
 
    >>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2808
 
    True
2809
 
    >>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2810
 
    True
2811
 
    >>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2812
 
    True
2813
 
    >>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2814
 
    True
2815
 
    >>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2816
 
    True
2817
 
    >>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2818
 
    True
2819
 
    >>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2820
 
    True
2821
 
    >>> del timedelta
 
2784
    >>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
 
2785
    True
 
2786
    >>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
 
2787
    True
 
2788
    >>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
 
2789
    True
 
2790
    >>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
 
2791
    True
 
2792
    >>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
 
2793
    True
 
2794
    >>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
 
2795
    True
 
2796
    >>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
 
2797
    True
2822
2798
    """
2823
2799
 
2824
2800
    # Parsing an RFC 3339 duration with regular expressions is not
2904
2880
def string_to_delta(interval):
2905
2881
    """Parse a string and return a datetime.timedelta
2906
2882
 
2907
 
    >>> string_to_delta("7d") == datetime.timedelta(7)
2908
 
    True
2909
 
    >>> string_to_delta("60s") == datetime.timedelta(0, 60)
2910
 
    True
2911
 
    >>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2912
 
    True
2913
 
    >>> string_to_delta("24h") == datetime.timedelta(1)
2914
 
    True
2915
 
    >>> string_to_delta("1w") == datetime.timedelta(7)
2916
 
    True
2917
 
    >>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
 
2883
    >>> string_to_delta('7d') == datetime.timedelta(7)
 
2884
    True
 
2885
    >>> string_to_delta('60s') == datetime.timedelta(0, 60)
 
2886
    True
 
2887
    >>> string_to_delta('60m') == datetime.timedelta(0, 3600)
 
2888
    True
 
2889
    >>> string_to_delta('24h') == datetime.timedelta(1)
 
2890
    True
 
2891
    >>> string_to_delta('1w') == datetime.timedelta(7)
 
2892
    True
 
2893
    >>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2918
2894
    True
2919
2895
    """
2920
2896
 
3124
3100
 
3125
3101
    if server_settings["servicename"] != "Mandos":
3126
3102
        syslogger.setFormatter(
3127
 
            logging.Formatter("Mandos ({}) [%(process)d]:"
3128
 
                              " %(levelname)s: %(message)s".format(
 
3103
            logging.Formatter('Mandos ({}) [%(process)d]:'
 
3104
                              ' %(levelname)s: %(message)s'.format(
3129
3105
                                  server_settings["servicename"])))
3130
3106
 
3131
3107
    # Parse config file with clients
3155
3131
        try:
3156
3132
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3157
3133
        except IOError as e:
3158
 
            log.error("Could not open file %r", pidfilename,
3159
 
                      exc_info=e)
 
3134
            logger.error("Could not open file %r", pidfilename,
 
3135
                         exc_info=e)
3160
3136
 
3161
3137
    for name, group in (("_mandos", "_mandos"),
3162
3138
                        ("mandos", "mandos"),
3173
3149
    try:
3174
3150
        os.setgid(gid)
3175
3151
        os.setuid(uid)
3176
 
        log.debug("Did setuid/setgid to %s:%s", uid, gid)
 
3152
        if debug:
 
3153
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
 
3154
                                                             gid))
3177
3155
    except OSError as error:
3178
 
        log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3179
 
                    os.strerror(error.errno))
 
3156
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
 
3157
                       .format(uid, gid, os.strerror(error.errno)))
3180
3158
        if error.errno != errno.EPERM:
3181
3159
            raise
3182
3160
 
3189
3167
 
3190
3168
        @gnutls.log_func
3191
3169
        def debug_gnutls(level, string):
3192
 
            log.debug("GnuTLS: %s",
3193
 
                      string[:-1].decode("utf-8", errors="replace"))
 
3170
            logger.debug("GnuTLS: %s", string[:-1])
3194
3171
 
3195
3172
        gnutls.global_set_log_function(debug_gnutls)
3196
3173
 
3225
3202
                "se.bsnet.fukt.Mandos", bus,
3226
3203
                do_not_queue=True)
3227
3204
        except dbus.exceptions.DBusException as e:
3228
 
            log.error("Disabling D-Bus:", exc_info=e)
 
3205
            logger.error("Disabling D-Bus:", exc_info=e)
3229
3206
            use_dbus = False
3230
3207
            server_settings["use_dbus"] = False
3231
3208
            tcp_server.use_dbus = False
3316
3293
            os.remove(stored_state_path)
3317
3294
        except IOError as e:
3318
3295
            if e.errno == errno.ENOENT:
3319
 
                log.warning("Could not load persistent state:"
3320
 
                            " %s", os.strerror(e.errno))
 
3296
                logger.warning("Could not load persistent state:"
 
3297
                               " {}".format(os.strerror(e.errno)))
3321
3298
            else:
3322
 
                log.critical("Could not load persistent state:",
3323
 
                             exc_info=e)
 
3299
                logger.critical("Could not load persistent state:",
 
3300
                                exc_info=e)
3324
3301
                raise
3325
3302
        except EOFError as e:
3326
 
            log.warning("Could not load persistent state: EOFError:",
3327
 
                        exc_info=e)
 
3303
            logger.warning("Could not load persistent state: "
 
3304
                           "EOFError:",
 
3305
                           exc_info=e)
3328
3306
 
3329
3307
    with PGPEngine() as pgp:
3330
3308
        for client_name, client in clients_data.items():
3357
3335
            if client["enabled"]:
3358
3336
                if datetime.datetime.utcnow() >= client["expires"]:
3359
3337
                    if not client["last_checked_ok"]:
3360
 
                        log.warning("disabling client %s - Client"
3361
 
                                    " never performed a successful"
3362
 
                                    " checker", client_name)
 
3338
                        logger.warning(
 
3339
                            "disabling client {} - Client never "
 
3340
                            "performed a successful checker".format(
 
3341
                                client_name))
3363
3342
                        client["enabled"] = False
3364
3343
                    elif client["last_checker_status"] != 0:
3365
 
                        log.warning("disabling client %s - Client"
3366
 
                                    " last checker failed with error"
3367
 
                                    " code %s", client_name,
3368
 
                                    client["last_checker_status"])
 
3344
                        logger.warning(
 
3345
                            "disabling client {} - Client last"
 
3346
                            " checker failed with error code"
 
3347
                            " {}".format(
 
3348
                                client_name,
 
3349
                                client["last_checker_status"]))
3369
3350
                        client["enabled"] = False
3370
3351
                    else:
3371
3352
                        client["expires"] = (
3372
3353
                            datetime.datetime.utcnow()
3373
3354
                            + client["timeout"])
3374
 
                        log.debug("Last checker succeeded, keeping %s"
3375
 
                                  " enabled", client_name)
 
3355
                        logger.debug("Last checker succeeded,"
 
3356
                                     " keeping {} enabled".format(
 
3357
                                         client_name))
3376
3358
            try:
3377
3359
                client["secret"] = pgp.decrypt(
3378
3360
                    client["encrypted_secret"],
3379
3361
                    client_settings[client_name]["secret"])
3380
3362
            except PGPError:
3381
3363
                # If decryption fails, we use secret from new settings
3382
 
                log.debug("Failed to decrypt %s old secret",
3383
 
                          client_name)
 
3364
                logger.debug("Failed to decrypt {} old secret".format(
 
3365
                    client_name))
3384
3366
                client["secret"] = (client_settings[client_name]
3385
3367
                                    ["secret"])
3386
3368
 
3400
3382
            server_settings=server_settings)
3401
3383
 
3402
3384
    if not tcp_server.clients:
3403
 
        log.warning("No clients defined")
 
3385
        logger.warning("No clients defined")
3404
3386
 
3405
3387
    if not foreground:
3406
3388
        if pidfile is not None:
3409
3391
                with pidfile:
3410
3392
                    print(pid, file=pidfile)
3411
3393
            except IOError:
3412
 
                log.error("Could not write to file %r with PID %d",
3413
 
                          pidfilename, pid)
 
3394
                logger.error("Could not write to file %r with PID %d",
 
3395
                             pidfilename, pid)
3414
3396
        del pidfile
3415
3397
        del pidfilename
3416
3398
 
3566
3548
 
3567
3549
        try:
3568
3550
            with tempfile.NamedTemporaryFile(
3569
 
                    mode="wb",
 
3551
                    mode='wb',
3570
3552
                    suffix=".pickle",
3571
 
                    prefix="clients-",
 
3553
                    prefix='clients-',
3572
3554
                    dir=os.path.dirname(stored_state_path),
3573
3555
                    delete=False) as stored_state:
3574
3556
                pickle.dump((clients, client_settings), stored_state,
3582
3564
                except NameError:
3583
3565
                    pass
3584
3566
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3585
 
                log.warning("Could not save persistent state: %s",
3586
 
                            os.strerror(e.errno))
 
3567
                logger.warning("Could not save persistent state: {}"
 
3568
                               .format(os.strerror(e.errno)))
3587
3569
            else:
3588
 
                log.warning("Could not save persistent state:",
3589
 
                            exc_info=e)
 
3570
                logger.warning("Could not save persistent state:",
 
3571
                               exc_info=e)
3590
3572
                raise
3591
3573
 
3592
3574
        # Delete all clients, and settings from config
3618
3600
    if zeroconf:
3619
3601
        service.port = tcp_server.socket.getsockname()[1]
3620
3602
    if use_ipv6:
3621
 
        log.info("Now listening on address %r, port %d, flowinfo %d,"
3622
 
                 " scope_id %d", *tcp_server.socket.getsockname())
 
3603
        logger.info("Now listening on address %r, port %d,"
 
3604
                    " flowinfo %d, scope_id %d",
 
3605
                    *tcp_server.socket.getsockname())
3623
3606
    else:                       # IPv4
3624
 
        log.info("Now listening on address %r, port %d",
3625
 
                 *tcp_server.socket.getsockname())
 
3607
        logger.info("Now listening on address %r, port %d",
 
3608
                    *tcp_server.socket.getsockname())
3626
3609
 
3627
3610
    # service.interface = tcp_server.socket.getsockname()[3]
3628
3611
 
3632
3615
            try:
3633
3616
                service.activate()
3634
3617
            except dbus.exceptions.DBusException as error:
3635
 
                log.critical("D-Bus Exception", exc_info=error)
 
3618
                logger.critical("D-Bus Exception", exc_info=error)
3636
3619
                cleanup()
3637
3620
                sys.exit(1)
3638
3621
            # End of Avahi example code
3643
3626
            lambda *args, **kwargs: (tcp_server.handle_request
3644
3627
                                     (*args[2:], **kwargs) or True))
3645
3628
 
3646
 
        log.debug("Starting main loop")
 
3629
        logger.debug("Starting main loop")
3647
3630
        main_loop.run()
3648
3631
    except AvahiError as error:
3649
 
        log.critical("Avahi Error", exc_info=error)
 
3632
        logger.critical("Avahi Error", exc_info=error)
3650
3633
        cleanup()
3651
3634
        sys.exit(1)
3652
3635
    except KeyboardInterrupt:
3653
3636
        if debug:
3654
3637
            print("", file=sys.stderr)
3655
 
        log.debug("Server received KeyboardInterrupt")
3656
 
    log.debug("Server exiting")
 
3638
        logger.debug("Server received KeyboardInterrupt")
 
3639
    logger.debug("Server exiting")
3657
3640
    # Must run before the D-Bus bus name gets deregistered
3658
3641
    cleanup()
3659
3642
 
3660
3643
 
3661
 
def parse_test_args():
3662
 
    # type: () -> argparse.Namespace
 
3644
def should_only_run_tests():
3663
3645
    parser = argparse.ArgumentParser(add_help=False)
3664
 
    parser.add_argument("--check", action="store_true")
3665
 
    parser.add_argument("--prefix", )
 
3646
    parser.add_argument("--check", action='store_true')
3666
3647
    args, unknown_args = parser.parse_known_args()
3667
 
    if args.check:
3668
 
        # Remove test options from sys.argv
 
3648
    run_tests = args.check
 
3649
    if run_tests:
 
3650
        # Remove --check argument from sys.argv
3669
3651
        sys.argv[1:] = unknown_args
3670
 
    return args
 
3652
    return run_tests
3671
3653
 
3672
3654
# Add all tests from doctest strings
3673
3655
def load_tests(loader, tests, none):
3675
3657
    tests.addTests(doctest.DocTestSuite())
3676
3658
    return tests
3677
3659
 
3678
 
if __name__ == "__main__":
3679
 
    options = parse_test_args()
 
3660
if __name__ == '__main__':
3680
3661
    try:
3681
 
        if options.check:
3682
 
            extra_test_prefix = options.prefix
3683
 
            if extra_test_prefix is not None:
3684
 
                if not (unittest.main(argv=[""], exit=False)
3685
 
                        .result.wasSuccessful()):
3686
 
                    sys.exit(1)
3687
 
                class ExtraTestLoader(unittest.TestLoader):
3688
 
                    testMethodPrefix = extra_test_prefix
3689
 
                # Call using ./scriptname --test [--verbose]
3690
 
                unittest.main(argv=[""], testLoader=ExtraTestLoader())
3691
 
            else:
3692
 
                unittest.main(argv=[""])
 
3662
        if should_only_run_tests():
 
3663
            # Call using ./mandos --check [--verbose]
 
3664
            unittest.main()
3693
3665
        else:
3694
3666
            main()
3695
3667
    finally:
3696
3668
        logging.shutdown()
3697
 
 
3698
 
# Local Variables:
3699
 
# run-tests:
3700
 
# (lambda (&optional extra)
3701
 
#   (if (not (funcall run-tests-in-test-buffer default-directory
3702
 
#             extra))
3703
 
#       (funcall show-test-buffer-in-test-window)
3704
 
#     (funcall remove-test-window)
3705
 
#     (if extra (message "Extra tests run successfully!"))))
3706
 
# run-tests-in-test-buffer:
3707
 
# (lambda (dir &optional extra)
3708
 
#   (with-current-buffer (get-buffer-create "*Test*")
3709
 
#     (setq buffer-read-only nil
3710
 
#           default-directory dir)
3711
 
#     (erase-buffer)
3712
 
#     (compilation-mode))
3713
 
#   (let ((process-result
3714
 
#          (let ((inhibit-read-only t))
3715
 
#            (process-file-shell-command
3716
 
#             (funcall get-command-line extra) nil "*Test*"))))
3717
 
#     (and (numberp process-result)
3718
 
#          (= process-result 0))))
3719
 
# get-command-line:
3720
 
# (lambda (&optional extra)
3721
 
#   (let ((quoted-script
3722
 
#          (shell-quote-argument (funcall get-script-name))))
3723
 
#     (format
3724
 
#      (concat "%s --check" (if extra " --prefix=atest" ""))
3725
 
#      quoted-script)))
3726
 
# get-script-name:
3727
 
# (lambda ()
3728
 
#   (if (fboundp 'file-local-name)
3729
 
#       (file-local-name (buffer-file-name))
3730
 
#     (or (file-remote-p (buffer-file-name) 'localname)
3731
 
#         (buffer-file-name))))
3732
 
# remove-test-window:
3733
 
# (lambda ()
3734
 
#   (let ((test-window (get-buffer-window "*Test*")))
3735
 
#     (if test-window (delete-window test-window))))
3736
 
# show-test-buffer-in-test-window:
3737
 
# (lambda ()
3738
 
#   (when (not (get-buffer-window-list "*Test*"))
3739
 
#     (setq next-error-last-buffer (get-buffer "*Test*"))
3740
 
#     (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3741
 
#            (display-buffer-overriding-action
3742
 
#             `((display-buffer-in-side-window) (side . ,side)
3743
 
#               (window-height . fit-window-to-buffer)
3744
 
#               (window-width . fit-window-to-buffer))))
3745
 
#       (display-buffer "*Test*"))))
3746
 
# eval:
3747
 
# (progn
3748
 
#   (let* ((run-extra-tests (lambda () (interactive)
3749
 
#                             (funcall run-tests t)))
3750
 
#          (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3751
 
#          (outer-keymap `(keymap (3 . ,inner-keymap))))     ; C-c
3752
 
#     (setq minor-mode-overriding-map-alist
3753
 
#           (cons `(run-tests . ,outer-keymap)
3754
 
#                 minor-mode-overriding-map-alist)))
3755
 
#   (add-hook 'after-save-hook run-tests 90 t))
3756
 
# End: