To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1242
- compare with another revision
- download diff
- download tarball
- view history from revision 1242
- Committer: Teddy Hogeborn
- Date: 2021-03-21 19:51:15 UTC
- Revision ID: teddy@recompile.se-20210321195115-qe6g0fyj1kabwlav
Fix theoretical GnuTLS bug
Fix "NameError: global name '_error_code' is not defined" error if
GNUTLS_E_INTERRUPTED or GNUTLS_E_AGAIN was ever returned from
gnutls_record_send().
* mandos (gnutls._retry_on_error): Import "_error_code" from outer
class scope to local function scope via a keyword argument.
Fix "NameError: global name '_error_code' is not defined" error if
GNUTLS_E_INTERRUPTED or GNUTLS_E_AGAIN was ever returned from
gnutls_record_send().
* mandos (gnutls._retry_on_error): Import "_error_code" from outer
class scope to local function scope via a keyword argument.
- files removed:
- debian/po/es.po
- files modified:
- Makefile
added
removed
mandos
1
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
14
# Copyright © 2008-2020 Teddy Hogeborn
15
# Copyright © 2008-2020 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
39
40
except ImportError:
40
41
pass
41
42
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
43
try:
48
44
import SocketServer as socketserver
49
45
except ImportError:
50
46
import socketserver
51
47
import socket
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
import ConfigParser as configparser
56
53
except ImportError:
57
54
import configparser
55
import sys
58
56
import re
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import unittest
80
81
import random
81
82
import shlex
82
83
93
94
if sys.version_info.major == 2:
94
95
__metaclass__ = type
95
96
str = unicode
96
input = raw_input
97
97
98
98
# Add collections.abc.Callable if it does not exist
99
99
try:
146
146
version = "1.8.14"
147
147
stored_state_file = "clients.pickle"
148
148
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
149
logger = logging.getLogger()
150
150
logging.captureWarnings(True) # Show warnings via the logging system
151
151
syslogger = None
152
152
189
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
190
address="/dev/log"))
191
191
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
192
('Mandos [%(process)d]: %(levelname)s:'
193
' %(message)s'))
194
logger.addHandler(syslogger)
195
195
196
196
if debug:
197
197
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
198
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
199
' [%(process)d]:'
200
' %(levelname)s:'
201
' %(message)s'))
202
logger.addHandler(console)
203
logger.setLevel(level)
204
204
205
205
206
206
class PGPError(Exception):
224
224
except OSError as e:
225
225
if e.errno != errno.ENOENT:
226
226
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
227
self.gnupgargs = ['--batch',
228
'--homedir', self.tempdir,
229
'--force-mdc',
230
'--quiet']
231
231
# Only GPG version 1 has the --no-use-agent option.
232
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
233
self.gnupgargs.append("--no-use-agent")
272
272
dir=self.tempdir) as passfile:
273
273
passfile.write(passphrase)
274
274
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
275
proc = subprocess.Popen([self.gpg, '--symmetric',
276
'--passphrase-file',
277
277
passfile.name]
278
278
+ self.gnupgargs,
279
279
stdin=subprocess.PIPE,
290
290
dir=self.tempdir) as passfile:
291
291
passfile.write(passphrase)
292
292
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
293
proc = subprocess.Popen([self.gpg, '--decrypt',
294
'--passphrase-file',
295
295
passfile.name]
296
296
+ self.gnupgargs,
297
297
stdin=subprocess.PIPE,
350
350
Attributes:
351
351
interface: integer; avahi.IF_UNSPEC or an interface index.
352
352
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
353
name: string; Example: 'Mandos'
354
type: string; Example: '_mandos._tcp'.
355
355
See <https://www.iana.org/assignments/service-names-port-numbers>
356
356
port: integer; what port to announce
357
357
TXT: list of strings; TXT record for the service
394
394
def rename(self, remove=True):
395
395
"""Derived from the Avahi example code"""
396
396
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
397
logger.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
400
400
raise AvahiServiceError("Too many renames")
401
401
self.name = str(
402
402
self.server.GetAlternativeServiceName(self.name))
403
403
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
404
logger.info("Changing Zeroconf service name to %r ...",
405
self.name)
406
406
if remove:
407
407
self.remove()
408
408
try:
410
410
except dbus.exceptions.DBusException as error:
411
411
if (error.get_dbus_name()
412
412
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
413
logger.info("Local Zeroconf service name collision.")
414
414
return self.rename(remove=False)
415
415
else:
416
log.critical("D-Bus Exception", exc_info=error)
416
logger.critical("D-Bus Exception", exc_info=error)
417
417
self.cleanup()
418
418
os._exit(1)
419
419
435
435
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
436
self.entry_group_state_changed_match = (
437
437
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
438
'StateChanged', self.entry_group_state_changed))
439
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
441
441
self.group.AddService(
442
442
self.interface,
443
443
self.protocol,
450
450
451
451
def entry_group_state_changed(self, state, error):
452
452
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
453
logger.debug("Avahi entry group state change: %i", state)
454
454
455
455
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
456
logger.debug("Zeroconf service established.")
457
457
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
458
logger.info("Zeroconf service name collision.")
459
459
self.rename()
460
460
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
461
logger.critical("Avahi: Error in group state changed %s",
462
str(error))
463
463
raise AvahiGroupError("State changed: {!s}".format(error))
464
464
465
465
def cleanup(self):
475
475
476
476
def server_state_changed(self, state, error=None):
477
477
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
478
logger.debug("Avahi server state change: %i", state)
479
479
bad_states = {
480
480
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
481
avahi.SERVER_REGISTERING: None,
485
485
if state in bad_states:
486
486
if bad_states[state] is not None:
487
487
if error is None:
488
log.error(bad_states[state])
488
logger.error(bad_states[state])
489
489
else:
490
log.error(bad_states[state] + ": %r", error)
490
logger.error(bad_states[state] + ": %r", error)
491
491
self.cleanup()
492
492
elif state == avahi.SERVER_RUNNING:
493
493
try:
495
495
except dbus.exceptions.DBusException as error:
496
496
if (error.get_dbus_name()
497
497
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
498
logger.info("Local Zeroconf service name"
499
" collision.")
499
500
return self.rename(remove=False)
500
501
else:
501
log.critical("D-Bus Exception", exc_info=error)
502
logger.critical("D-Bus Exception", exc_info=error)
502
503
self.cleanup()
503
504
os._exit(1)
504
505
else:
505
506
if error is None:
506
log.debug("Unknown state: %r", state)
507
logger.debug("Unknown state: %r", state)
507
508
else:
508
log.debug("Unknown state: %r: %r", state, error)
509
logger.debug("Unknown state: %r: %r", state, error)
509
510
510
511
def activate(self):
511
512
"""Derived from the Avahi example code"""
526
527
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
528
**kwargs)
528
529
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
530
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
531
.format(self.name)))
531
532
return ret
532
533
562
563
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
564
564
565
# Types
565
class _session_int(ctypes.Structure):
566
class session_int(ctypes.Structure):
566
567
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
568
session_t = ctypes.POINTER(session_int)
568
569
569
570
class certificate_credentials_st(ctypes.Structure):
570
571
_fields_ = []
573
574
certificate_type_t = ctypes.c_int
574
575
575
576
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
577
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
578
('size', ctypes.c_uint)]
578
579
579
class _openpgp_crt_int(ctypes.Structure):
580
class openpgp_crt_int(ctypes.Structure):
580
581
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
582
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
583
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
584
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
585
credentials_type_t = ctypes.c_int
593
594
# gnutls.strerror()
594
595
self.code = code
595
596
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
597
message = gnutls.strerror(code)
598
598
return super(gnutls.Error, self).__init__(
599
599
message, *args)
600
600
601
601
class CertificateSecurityError(Error):
602
602
pass
603
603
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
604
# Classes
630
class Credentials(With_from_param):
605
class Credentials:
631
606
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
607
self._c_object = gnutls.certificate_credentials_t()
608
gnutls.certificate_allocate_credentials(
609
ctypes.byref(self._c_object))
634
610
self.type = gnutls.CRD_CERTIFICATE
635
611
636
612
def __del__(self):
637
gnutls.certificate_free_credentials(self)
613
gnutls.certificate_free_credentials(self._c_object)
638
614
639
class ClientSession(With_from_param):
615
class ClientSession:
640
616
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
617
self._c_object = gnutls.session_t()
642
618
gnutls_flags = gnutls.CLIENT
643
619
if gnutls.check_version(b"3.5.6"):
644
620
gnutls_flags |= gnutls.NO_TICKETS
645
621
if gnutls.has_rawpk:
646
622
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
623
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
648
624
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
625
gnutls.set_default_priority(self._c_object)
626
gnutls.transport_set_ptr(self._c_object, socket.fileno())
627
gnutls.handshake_set_private_extensions(self._c_object,
628
True)
652
629
self.socket = socket
653
630
if credentials is None:
654
631
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
632
gnutls.credentials_set(self._c_object, credentials.type,
633
ctypes.cast(credentials._c_object,
634
ctypes.c_void_p))
657
635
self.credentials = credentials
658
636
659
637
def __del__(self):
660
gnutls.deinit(self)
638
gnutls.deinit(self._c_object)
661
639
662
640
def handshake(self):
663
return gnutls.handshake(self)
641
return gnutls.handshake(self._c_object)
664
642
665
643
def send(self, data):
666
644
data = bytes(data)
667
645
data_len = len(data)
668
646
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
647
data_len -= gnutls.record_send(self._c_object,
648
data[-data_len:],
670
649
data_len)
671
650
672
651
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
652
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
653
675
654
# Error handling functions
676
655
def _error_code(result):
677
656
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
657
for the 'restype' attribute on ctypes functions"""
658
if result >= 0:
680
659
return result
681
660
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
661
raise gnutls.CertificateSecurityError(code=result)
685
664
def _retry_on_error(result, func, arguments,
686
665
_error_code=_error_code):
687
666
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
667
for the 'errcheck' attribute on ctypes functions"""
668
while result < 0:
690
669
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
670
return _error_code(result)
692
671
result = func(*arguments)
697
676
698
677
# Functions
699
678
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
679
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
680
ctypes.POINTER(ctypes.c_char_p)]
702
681
priority_set_direct.restype = _error_code
703
682
704
683
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
684
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
685
init.restype = _error_code
707
686
708
687
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
688
set_default_priority.argtypes = [session_t]
710
689
set_default_priority.restype = _error_code
711
690
712
691
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
692
record_send.argtypes = [session_t, ctypes.c_void_p,
714
693
ctypes.c_size_t]
715
694
record_send.restype = ctypes.c_ssize_t
716
695
record_send.errcheck = _retry_on_error
718
697
certificate_allocate_credentials = (
719
698
_library.gnutls_certificate_allocate_credentials)
720
699
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
700
ctypes.POINTER(certificate_credentials_t)]
722
701
certificate_allocate_credentials.restype = _error_code
723
702
724
703
certificate_free_credentials = (
725
704
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
705
certificate_free_credentials.argtypes = [
706
certificate_credentials_t]
727
707
certificate_free_credentials.restype = None
728
708
729
709
handshake_set_private_extensions = (
730
710
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
711
handshake_set_private_extensions.argtypes = [session_t,
732
712
ctypes.c_int]
733
713
handshake_set_private_extensions.restype = None
734
714
735
715
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
716
credentials_set.argtypes = [session_t, credentials_type_t,
717
ctypes.c_void_p]
738
718
credentials_set.restype = _error_code
739
719
740
720
strerror = _library.gnutls_strerror
742
722
strerror.restype = ctypes.c_char_p
743
723
744
724
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
725
certificate_type_get.argtypes = [session_t]
746
726
certificate_type_get.restype = _error_code
747
727
748
728
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
729
certificate_get_peers.argtypes = [session_t,
750
730
ctypes.POINTER(ctypes.c_uint)]
751
731
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
732
759
739
global_set_log_function.restype = None
760
740
761
741
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
742
deinit.argtypes = [session_t]
763
743
deinit.restype = None
764
744
765
745
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
746
handshake.argtypes = [session_t]
747
handshake.restype = _error_code
768
748
handshake.errcheck = _retry_on_error
769
749
770
750
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
751
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
752
transport_set_ptr.restype = None
773
753
774
754
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
755
bye.argtypes = [session_t, close_request_t]
756
bye.restype = _error_code
777
757
bye.errcheck = _retry_on_error
778
758
779
759
check_version = _library.gnutls_check_version
853
833
854
834
if check_version(b"3.6.4"):
855
835
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
836
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
857
837
certificate_type_get2.restype = _error_code
858
838
859
839
# Remove non-public functions
875
855
"""A representation of a client host served by this server.
876
856
877
857
Attributes:
878
approved: bool(); None if not yet approved/disapproved
858
approved: bool(); 'None' if not yet approved/disapproved
879
859
approval_delay: datetime.timedelta(); Time to wait for approval
880
860
approval_duration: datetime.timedelta(); Duration of one approval
881
861
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
862
to see if the client lives. 'None' if no process is
883
863
running.
884
864
checker_callback_tag: a GLib event source tag, or None
885
865
checker_command: string; External command which is run to check
1009
989
self.last_enabled = None
1010
990
self.expires = None
1011
991
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
992
logger.debug("Creating client %r", self.name)
993
logger.debug(" Key ID: %s", self.key_id)
994
logger.debug(" Fingerprint: %s", self.fingerprint)
1015
995
self.created = settings.get("created",
1016
996
datetime.datetime.utcnow())
1017
997
1056
1036
if not getattr(self, "enabled", False):
1057
1037
return False
1058
1038
if not quiet:
1059
log.info("Disabling client %s", self.name)
1039
logger.info("Disabling client %s", self.name)
1060
1040
if getattr(self, "disable_initiator_tag", None) is not None:
1061
1041
GLib.source_remove(self.disable_initiator_tag)
1062
1042
self.disable_initiator_tag = None
1106
1086
self.last_checker_status = returncode
1107
1087
self.last_checker_signal = None
1108
1088
if self.last_checker_status == 0:
1109
log.info("Checker for %(name)s succeeded", vars(self))
1089
logger.info("Checker for %(name)s succeeded",
1090
vars(self))
1110
1091
self.checked_ok()
1111
1092
else:
1112
log.info("Checker for %(name)s failed", vars(self))
1093
logger.info("Checker for %(name)s failed", vars(self))
1113
1094
else:
1114
1095
self.last_checker_status = -1
1115
1096
self.last_checker_signal = -returncode
1116
log.warning("Checker for %(name)s crashed?", vars(self))
1097
logger.warning("Checker for %(name)s crashed?",
1098
vars(self))
1117
1099
return False
1118
1100
1119
1101
def checked_ok(self):
1153
1135
# should be.
1154
1136
1155
1137
if self.checker is not None and not self.checker.is_alive():
1156
log.warning("Checker was not alive; joining")
1138
logger.warning("Checker was not alive; joining")
1157
1139
self.checker.join()
1158
1140
self.checker = None
1159
1141
# Start a new checker if needed
1165
1147
try:
1166
1148
command = self.checker_command % escaped_attrs
1167
1149
except TypeError as error:
1168
log.error('Could not format string "%s"',
1169
self.checker_command, exc_info=error)
1150
logger.error('Could not format string "%s"',
1151
self.checker_command,
1152
exc_info=error)
1170
1153
return True # Try again later
1171
1154
self.current_checker_command = command
1172
log.info("Starting checker %r for %s", command, self.name)
1155
logger.info("Starting checker %r for %s", command,
1156
self.name)
1173
1157
# We don't need to redirect stdout and stderr, since
1174
1158
# in normal mode, that is already done by daemon(),
1175
1159
# and in debug mode we don't want to. (Stdin is
1204
1188
self.checker_callback_tag = None
1205
1189
if getattr(self, "checker", None) is None:
1206
1190
return
1207
log.debug("Stopping checker for %(name)s", vars(self))
1191
logger.debug("Stopping checker for %(name)s", vars(self))
1208
1192
self.checker.terminate()
1209
1193
self.checker = None
1210
1194
1237
1221
func._dbus_name = func.__name__
1238
1222
if func._dbus_name.endswith("_dbus_property"):
1239
1223
func._dbus_name = func._dbus_name[:-14]
1240
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1224
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1241
1225
return func
1242
1226
1243
1227
return decorator
1332
1316
1333
1317
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1334
1318
out_signature="s",
1335
path_keyword="object_path",
1336
connection_keyword="connection")
1319
path_keyword='object_path',
1320
connection_keyword='connection')
1337
1321
def Introspect(self, object_path, connection):
1338
1322
"""Overloading of standard D-Bus method.
1339
1323
1388
1372
document.unlink()
1389
1373
except (AttributeError, xml.dom.DOMException,
1390
1374
xml.parsers.expat.ExpatError) as error:
1391
log.error("Failed to override Introspection method",
1392
exc_info=error)
1375
logger.error("Failed to override Introspection method",
1376
exc_info=error)
1393
1377
return xmlstring
1394
1378
1395
1379
1492
1476
1493
1477
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1494
1478
out_signature="s",
1495
path_keyword="object_path",
1496
connection_keyword="connection")
1479
path_keyword='object_path',
1480
connection_keyword='connection')
1497
1481
def Introspect(self, object_path, connection):
1498
1482
"""Overloading of standard D-Bus method.
1499
1483
1555
1539
document.unlink()
1556
1540
except (AttributeError, xml.dom.DOMException,
1557
1541
xml.parsers.expat.ExpatError) as error:
1558
log.error("Failed to override Introspection method",
1559
exc_info=error)
1542
logger.error("Failed to override Introspection method",
1543
exc_info=error)
1560
1544
return xmlstring
1561
1545
1562
1546
1594
1578
1595
1579
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1596
1580
out_signature="s",
1597
path_keyword="object_path",
1598
connection_keyword="connection")
1581
path_keyword='object_path',
1582
connection_keyword='connection')
1599
1583
def Introspect(self, object_path, connection):
1600
1584
"""Overloading of standard D-Bus method.
1601
1585
1626
1610
document.unlink()
1627
1611
except (AttributeError, xml.dom.DOMException,
1628
1612
xml.parsers.expat.ExpatError) as error:
1629
log.error("Failed to override Introspection method",
1630
exc_info=error)
1613
logger.error("Failed to override Introspection method",
1614
exc_info=error)
1631
1615
return xmlstring
1632
1616
1633
1617
2267
2251
class ProxyClient:
2268
2252
def __init__(self, child_pipe, key_id, fpr, address):
2269
2253
self._pipe = child_pipe
2270
self._pipe.send(("init", key_id, fpr, address))
2254
self._pipe.send(('init', key_id, fpr, address))
2271
2255
if not self._pipe.recv():
2272
2256
raise KeyError(key_id or fpr)
2273
2257
2274
2258
def __getattribute__(self, name):
2275
if name == "_pipe":
2259
if name == '_pipe':
2276
2260
return super(ProxyClient, self).__getattribute__(name)
2277
self._pipe.send(("getattr", name))
2261
self._pipe.send(('getattr', name))
2278
2262
data = self._pipe.recv()
2279
if data[0] == "data":
2263
if data[0] == 'data':
2280
2264
return data[1]
2281
if data[0] == "function":
2265
if data[0] == 'function':
2282
2266
2283
2267
def func(*args, **kwargs):
2284
self._pipe.send(("funcall", name, args, kwargs))
2268
self._pipe.send(('funcall', name, args, kwargs))
2285
2269
return self._pipe.recv()[1]
2286
2270
2287
2271
return func
2288
2272
2289
2273
def __setattr__(self, name, value):
2290
if name == "_pipe":
2274
if name == '_pipe':
2291
2275
return super(ProxyClient, self).__setattr__(name, value)
2292
self._pipe.send(("setattr", name, value))
2276
self._pipe.send(('setattr', name, value))
2293
2277
2294
2278
2295
2279
class ClientHandler(socketserver.BaseRequestHandler, object):
2300
2284
2301
2285
def handle(self):
2302
2286
with contextlib.closing(self.server.child_pipe) as child_pipe:
2303
log.info("TCP connection from: %s",
2304
str(self.client_address))
2305
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2287
logger.info("TCP connection from: %s",
2288
str(self.client_address))
2289
logger.debug("Pipe FD: %d",
2290
self.server.child_pipe.fileno())
2306
2291
2307
2292
session = gnutls.ClientSession(self.request)
2308
2293
2309
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2294
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2310
2295
# "+AES-256-CBC", "+SHA1",
2311
2296
# "+COMP-NULL", "+CTYPE-OPENPGP",
2312
2297
# "+DHE-DSS"))
2314
2299
priority = self.server.gnutls_priority
2315
2300
if priority is None:
2316
2301
priority = "NORMAL"
2317
gnutls.priority_set_direct(session,
2318
priority.encode("utf-8"), None)
2302
gnutls.priority_set_direct(session._c_object,
2303
priority.encode("utf-8"),
2304
None)
2319
2305
2320
2306
# Start communication using the Mandos protocol
2321
2307
# Get protocol number
2322
2308
line = self.request.makefile().readline()
2323
log.debug("Protocol version: %r", line)
2309
logger.debug("Protocol version: %r", line)
2324
2310
try:
2325
2311
if int(line.strip().split()[0]) > 1:
2326
2312
raise RuntimeError(line)
2327
2313
except (ValueError, IndexError, RuntimeError) as error:
2328
log.error("Unknown protocol version: %s", error)
2314
logger.error("Unknown protocol version: %s", error)
2329
2315
return
2330
2316
2331
2317
# Start GnuTLS connection
2332
2318
try:
2333
2319
session.handshake()
2334
2320
except gnutls.Error as error:
2335
log.warning("Handshake failed: %s", error)
2321
logger.warning("Handshake failed: %s", error)
2336
2322
# Do not run session.bye() here: the session is not
2337
2323
# established. Just abandon the request.
2338
2324
return
2339
log.debug("Handshake succeeded")
2325
logger.debug("Handshake succeeded")
2340
2326
2341
2327
approval_required = False
2342
2328
try:
2346
2332
key_id = self.key_id(
2347
2333
self.peer_certificate(session))
2348
2334
except (TypeError, gnutls.Error) as error:
2349
log.warning("Bad certificate: %s", error)
2335
logger.warning("Bad certificate: %s", error)
2350
2336
return
2351
log.debug("Key ID: %s",
2352
key_id.decode("utf-8",
2353
errors="replace"))
2337
logger.debug("Key ID: %s", key_id)
2354
2338
2355
2339
else:
2356
2340
key_id = b""
2358
2342
fpr = self.fingerprint(
2359
2343
self.peer_certificate(session))
2360
2344
except (TypeError, gnutls.Error) as error:
2361
log.warning("Bad certificate: %s", error)
2345
logger.warning("Bad certificate: %s", error)
2362
2346
return
2363
log.debug("Fingerprint: %s", fpr)
2347
logger.debug("Fingerprint: %s", fpr)
2364
2348
2365
2349
try:
2366
2350
client = ProxyClient(child_pipe, key_id, fpr,
2375
2359
2376
2360
while True:
2377
2361
if not client.enabled:
2378
log.info("Client %s is disabled", client.name)
2362
logger.info("Client %s is disabled",
2363
client.name)
2379
2364
if self.server.use_dbus:
2380
2365
# Emit D-Bus signal
2381
2366
client.Rejected("Disabled")
2385
2370
# We are approved or approval is disabled
2386
2371
break
2387
2372
elif client.approved is None:
2388
log.info("Client %s needs approval",
2389
client.name)
2373
logger.info("Client %s needs approval",
2374
client.name)
2390
2375
if self.server.use_dbus:
2391
2376
# Emit D-Bus signal
2392
2377
client.NeedApproval(
2393
2378
client.approval_delay.total_seconds()
2394
2379
* 1000, client.approved_by_default)
2395
2380
else:
2396
log.warning("Client %s was not approved",
2397
client.name)
2381
logger.warning("Client %s was not approved",
2382
client.name)
2398
2383
if self.server.use_dbus:
2399
2384
# Emit D-Bus signal
2400
2385
client.Rejected("Denied")
2408
2393
time2 = datetime.datetime.now()
2409
2394
if (time2 - time) >= delay:
2410
2395
if not client.approved_by_default:
2411
log.warning("Client %s timed out while"
2412
" waiting for approval",
2413
client.name)
2396
logger.warning("Client %s timed out while"
2397
" waiting for approval",
2398
client.name)
2414
2399
if self.server.use_dbus:
2415
2400
# Emit D-Bus signal
2416
2401
client.Rejected("Approval timed out")
2423
2408
try:
2424
2409
session.send(client.secret)
2425
2410
except gnutls.Error as error:
2426
log.warning("gnutls send failed", exc_info=error)
2411
logger.warning("gnutls send failed",
2412
exc_info=error)
2427
2413
return
2428
2414
2429
log.info("Sending secret to %s", client.name)
2415
logger.info("Sending secret to %s", client.name)
2430
2416
# bump the timeout using extended_timeout
2431
2417
client.bump_timeout(client.extended_timeout)
2432
2418
if self.server.use_dbus:
2439
2425
try:
2440
2426
session.bye()
2441
2427
except gnutls.Error as error:
2442
log.warning("GnuTLS bye failed", exc_info=error)
2428
logger.warning("GnuTLS bye failed",
2429
exc_info=error)
2443
2430
2444
2431
@staticmethod
2445
2432
def peer_certificate(session):
2446
2433
"Return the peer's certificate as a bytestring"
2447
2434
try:
2448
cert_type = gnutls.certificate_type_get2(
2449
session, gnutls.CTYPE_PEERS)
2435
cert_type = gnutls.certificate_type_get2(session._c_object,
2436
gnutls.CTYPE_PEERS)
2450
2437
except AttributeError:
2451
cert_type = gnutls.certificate_type_get(session)
2438
cert_type = gnutls.certificate_type_get(session._c_object)
2452
2439
if gnutls.has_rawpk:
2453
2440
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2454
2441
else:
2455
2442
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2456
2443
# If not a valid certificate type...
2457
2444
if cert_type not in valid_cert_types:
2458
log.info("Cert type %r not in %r", cert_type,
2459
valid_cert_types)
2445
logger.info("Cert type %r not in %r", cert_type,
2446
valid_cert_types)
2460
2447
# ...return invalid data
2461
2448
return b""
2462
2449
list_size = ctypes.c_uint(1)
2463
2450
cert_list = (gnutls.certificate_get_peers
2464
(session, ctypes.byref(list_size)))
2451
(session._c_object, ctypes.byref(list_size)))
2465
2452
if not bool(cert_list) and list_size.value != 0:
2466
2453
raise gnutls.Error("error getting peer certificate")
2467
2454
if list_size.value == 0:
2581
2568
2582
2569
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2583
2570
socketserver.TCPServer):
2584
"""IPv6-capable TCP server. Accepts None as address and/or port
2571
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2585
2572
2586
2573
Attributes:
2587
2574
enabled: Boolean; whether this server is activated yet
2638
2625
if SO_BINDTODEVICE is None:
2639
2626
# Fall back to a hard-coded value which seems to be
2640
2627
# common enough.
2641
log.warning("SO_BINDTODEVICE not found, trying 25")
2628
logger.warning("SO_BINDTODEVICE not found, trying 25")
2642
2629
SO_BINDTODEVICE = 25
2643
2630
try:
2644
2631
self.socket.setsockopt(
2646
2633
(self.interface + "\0").encode("utf-8"))
2647
2634
except socket.error as error:
2648
2635
if error.errno == errno.EPERM:
2649
log.error("No permission to bind to interface %s",
2650
self.interface)
2636
logger.error("No permission to bind to"
2637
" interface %s", self.interface)
2651
2638
elif error.errno == errno.ENOPROTOOPT:
2652
log.error("SO_BINDTODEVICE not available; cannot"
2653
" bind to interface %s", self.interface)
2639
logger.error("SO_BINDTODEVICE not available;"
2640
" cannot bind to interface %s",
2641
self.interface)
2654
2642
elif error.errno == errno.ENODEV:
2655
log.error("Interface %s does not exist, cannot"
2656
" bind", self.interface)
2643
logger.error("Interface %s does not exist,"
2644
" cannot bind", self.interface)
2657
2645
else:
2658
2646
raise
2659
2647
# Only bind(2) the socket if we really need to.
2738
2726
request = parent_pipe.recv()
2739
2727
command = request[0]
2740
2728
2741
if command == "init":
2729
if command == 'init':
2742
2730
key_id = request[1].decode("ascii")
2743
2731
fpr = request[2].decode("ascii")
2744
2732
address = request[3]
2754
2742
client = c
2755
2743
break
2756
2744
else:
2757
log.info("Client not found for key ID: %s, address:"
2758
" %s", key_id or fpr, address)
2745
logger.info("Client not found for key ID: %s, address"
2746
": %s", key_id or fpr, address)
2759
2747
if self.use_dbus:
2760
2748
# Emit D-Bus signal
2761
2749
mandos_dbus_service.ClientNotFound(key_id or fpr,
2774
2762
# remove the old hook in favor of the new above hook on
2775
2763
# same fileno
2776
2764
return False
2777
if command == "funcall":
2765
if command == 'funcall':
2778
2766
funcname = request[1]
2779
2767
args = request[2]
2780
2768
kwargs = request[3]
2781
2769
2782
parent_pipe.send(("data", getattr(client_object,
2770
parent_pipe.send(('data', getattr(client_object,
2783
2771
funcname)(*args,
2784
2772
**kwargs)))
2785
2773
2786
if command == "getattr":
2774
if command == 'getattr':
2787
2775
attrname = request[1]
2788
2776
if isinstance(client_object.__getattribute__(attrname),
2789
2777
collections.abc.Callable):
2790
parent_pipe.send(("function", ))
2778
parent_pipe.send(('function', ))
2791
2779
else:
2792
2780
parent_pipe.send((
2793
"data", client_object.__getattribute__(attrname)))
2781
'data', client_object.__getattribute__(attrname)))
2794
2782
2795
if command == "setattr":
2783
if command == 'setattr':
2796
2784
attrname = request[1]
2797
2785
value = request[2]
2798
2786
setattr(client_object, attrname, value)
2904
2892
def string_to_delta(interval):
2905
2893
"""Parse a string and return a datetime.timedelta
2906
2894
2907
>>> string_to_delta("7d") == datetime.timedelta(7)
2908
True
2909
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2910
True
2911
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2912
True
2913
>>> string_to_delta("24h") == datetime.timedelta(1)
2914
True
2915
>>> string_to_delta("1w") == datetime.timedelta(7)
2916
True
2917
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2895
>>> string_to_delta('7d') == datetime.timedelta(7)
2896
True
2897
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2898
True
2899
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2900
True
2901
>>> string_to_delta('24h') == datetime.timedelta(1)
2902
True
2903
>>> string_to_delta('1w') == datetime.timedelta(7)
2904
True
2905
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2918
2906
True
2919
2907
"""
2920
2908
3124
3112
3125
3113
if server_settings["servicename"] != "Mandos":
3126
3114
syslogger.setFormatter(
3127
logging.Formatter("Mandos ({}) [%(process)d]:"
3128
" %(levelname)s: %(message)s".format(
3115
logging.Formatter('Mandos ({}) [%(process)d]:'
3116
' %(levelname)s: %(message)s'.format(
3129
3117
server_settings["servicename"])))
3130
3118
3131
3119
# Parse config file with clients
3155
3143
try:
3156
3144
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3157
3145
except IOError as e:
3158
log.error("Could not open file %r", pidfilename,
3159
exc_info=e)
3146
logger.error("Could not open file %r", pidfilename,
3147
exc_info=e)
3160
3148
3161
3149
for name, group in (("_mandos", "_mandos"),
3162
3150
("mandos", "mandos"),
3173
3161
try:
3174
3162
os.setgid(gid)
3175
3163
os.setuid(uid)
3176
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3164
if debug:
3165
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3166
gid))
3177
3167
except OSError as error:
3178
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3179
os.strerror(error.errno))
3168
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3169
.format(uid, gid, os.strerror(error.errno)))
3180
3170
if error.errno != errno.EPERM:
3181
3171
raise
3182
3172
3189
3179
3190
3180
@gnutls.log_func
3191
3181
def debug_gnutls(level, string):
3192
log.debug("GnuTLS: %s",
3193
string[:-1].decode("utf-8", errors="replace"))
3182
logger.debug("GnuTLS: %s", string[:-1])
3194
3183
3195
3184
gnutls.global_set_log_function(debug_gnutls)
3196
3185
3225
3214
"se.bsnet.fukt.Mandos", bus,
3226
3215
do_not_queue=True)
3227
3216
except dbus.exceptions.DBusException as e:
3228
log.error("Disabling D-Bus:", exc_info=e)
3217
logger.error("Disabling D-Bus:", exc_info=e)
3229
3218
use_dbus = False
3230
3219
server_settings["use_dbus"] = False
3231
3220
tcp_server.use_dbus = False
3316
3305
os.remove(stored_state_path)
3317
3306
except IOError as e:
3318
3307
if e.errno == errno.ENOENT:
3319
log.warning("Could not load persistent state:"
3320
" %s", os.strerror(e.errno))
3308
logger.warning("Could not load persistent state:"
3309
" {}".format(os.strerror(e.errno)))
3321
3310
else:
3322
log.critical("Could not load persistent state:",
3323
exc_info=e)
3311
logger.critical("Could not load persistent state:",
3312
exc_info=e)
3324
3313
raise
3325
3314
except EOFError as e:
3326
log.warning("Could not load persistent state: EOFError:",
3327
exc_info=e)
3315
logger.warning("Could not load persistent state: "
3316
"EOFError:",
3317
exc_info=e)
3328
3318
3329
3319
with PGPEngine() as pgp:
3330
3320
for client_name, client in clients_data.items():
3357
3347
if client["enabled"]:
3358
3348
if datetime.datetime.utcnow() >= client["expires"]:
3359
3349
if not client["last_checked_ok"]:
3360
log.warning("disabling client %s - Client"
3361
" never performed a successful"
3362
" checker", client_name)
3350
logger.warning(
3351
"disabling client {} - Client never "
3352
"performed a successful checker".format(
3353
client_name))
3363
3354
client["enabled"] = False
3364
3355
elif client["last_checker_status"] != 0:
3365
log.warning("disabling client %s - Client"
3366
" last checker failed with error"
3367
" code %s", client_name,
3368
client["last_checker_status"])
3356
logger.warning(
3357
"disabling client {} - Client last"
3358
" checker failed with error code"
3359
" {}".format(
3360
client_name,
3361
client["last_checker_status"]))
3369
3362
client["enabled"] = False
3370
3363
else:
3371
3364
client["expires"] = (
3372
3365
datetime.datetime.utcnow()
3373
3366
+ client["timeout"])
3374
log.debug("Last checker succeeded, keeping %s"
3375
" enabled", client_name)
3367
logger.debug("Last checker succeeded,"
3368
" keeping {} enabled".format(
3369
client_name))
3376
3370
try:
3377
3371
client["secret"] = pgp.decrypt(
3378
3372
client["encrypted_secret"],
3379
3373
client_settings[client_name]["secret"])
3380
3374
except PGPError:
3381
3375
# If decryption fails, we use secret from new settings
3382
log.debug("Failed to decrypt %s old secret",
3383
client_name)
3376
logger.debug("Failed to decrypt {} old secret".format(
3377
client_name))
3384
3378
client["secret"] = (client_settings[client_name]
3385
3379
["secret"])
3386
3380
3400
3394
server_settings=server_settings)
3401
3395
3402
3396
if not tcp_server.clients:
3403
log.warning("No clients defined")
3397
logger.warning("No clients defined")
3404
3398
3405
3399
if not foreground:
3406
3400
if pidfile is not None:
3409
3403
with pidfile:
3410
3404
print(pid, file=pidfile)
3411
3405
except IOError:
3412
log.error("Could not write to file %r with PID %d",
3413
pidfilename, pid)
3406
logger.error("Could not write to file %r with PID %d",
3407
pidfilename, pid)
3414
3408
del pidfile
3415
3409
del pidfilename
3416
3410
3566
3560
3567
3561
try:
3568
3562
with tempfile.NamedTemporaryFile(
3569
mode="wb",
3563
mode='wb',
3570
3564
suffix=".pickle",
3571
prefix="clients-",
3565
prefix='clients-',
3572
3566
dir=os.path.dirname(stored_state_path),
3573
3567
delete=False) as stored_state:
3574
3568
pickle.dump((clients, client_settings), stored_state,
3582
3576
except NameError:
3583
3577
pass
3584
3578
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3585
log.warning("Could not save persistent state: %s",
3586
os.strerror(e.errno))
3579
logger.warning("Could not save persistent state: {}"
3580
.format(os.strerror(e.errno)))
3587
3581
else:
3588
log.warning("Could not save persistent state:",
3589
exc_info=e)
3582
logger.warning("Could not save persistent state:",
3583
exc_info=e)
3590
3584
raise
3591
3585
3592
3586
# Delete all clients, and settings from config
3618
3612
if zeroconf:
3619
3613
service.port = tcp_server.socket.getsockname()[1]
3620
3614
if use_ipv6:
3621
log.info("Now listening on address %r, port %d, flowinfo %d,"
3622
" scope_id %d", *tcp_server.socket.getsockname())
3615
logger.info("Now listening on address %r, port %d,"
3616
" flowinfo %d, scope_id %d",
3617
*tcp_server.socket.getsockname())
3623
3618
else: # IPv4
3624
log.info("Now listening on address %r, port %d",
3625
*tcp_server.socket.getsockname())
3619
logger.info("Now listening on address %r, port %d",
3620
*tcp_server.socket.getsockname())
3626
3621
3627
3622
# service.interface = tcp_server.socket.getsockname()[3]
3628
3623
3632
3627
try:
3633
3628
service.activate()
3634
3629
except dbus.exceptions.DBusException as error:
3635
log.critical("D-Bus Exception", exc_info=error)
3630
logger.critical("D-Bus Exception", exc_info=error)
3636
3631
cleanup()
3637
3632
sys.exit(1)
3638
3633
# End of Avahi example code
3643
3638
lambda *args, **kwargs: (tcp_server.handle_request
3644
3639
(*args[2:], **kwargs) or True))
3645
3640
3646
log.debug("Starting main loop")
3641
logger.debug("Starting main loop")
3647
3642
main_loop.run()
3648
3643
except AvahiError as error:
3649
log.critical("Avahi Error", exc_info=error)
3644
logger.critical("Avahi Error", exc_info=error)
3650
3645
cleanup()
3651
3646
sys.exit(1)
3652
3647
except KeyboardInterrupt:
3653
3648
if debug:
3654
3649
print("", file=sys.stderr)
3655
log.debug("Server received KeyboardInterrupt")
3656
log.debug("Server exiting")
3650
logger.debug("Server received KeyboardInterrupt")
3651
logger.debug("Server exiting")
3657
3652
# Must run before the D-Bus bus name gets deregistered
3658
3653
cleanup()
3659
3654
3660
3655
3661
def parse_test_args():
3662
# type: () -> argparse.Namespace
3656
def should_only_run_tests():
3663
3657
parser = argparse.ArgumentParser(add_help=False)
3664
parser.add_argument("--check", action="store_true")
3665
parser.add_argument("--prefix", )
3658
parser.add_argument("--check", action='store_true')
3666
3659
args, unknown_args = parser.parse_known_args()
3667
if args.check:
3668
# Remove test options from sys.argv
3660
run_tests = args.check
3661
if run_tests:
3662
# Remove --check argument from sys.argv
3669
3663
sys.argv[1:] = unknown_args
3670
return args
3664
return run_tests
3671
3665
3672
3666
# Add all tests from doctest strings
3673
3667
def load_tests(loader, tests, none):
3675
3669
tests.addTests(doctest.DocTestSuite())
3676
3670
return tests
3677
3671
3678
if __name__ == "__main__":
3679
options = parse_test_args()
3672
if __name__ == '__main__':
3680
3673
try:
3681
if options.check:
3682
extra_test_prefix = options.prefix
3683
if extra_test_prefix is not None:
3684
if not (unittest.main(argv=[""], exit=False)
3685
.result.wasSuccessful()):
3686
sys.exit(1)
3687
class ExtraTestLoader(unittest.TestLoader):
3688
testMethodPrefix = extra_test_prefix
3689
# Call using ./scriptname --test [--verbose]
3690
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3691
else:
3692
unittest.main(argv=[""])
3674
if should_only_run_tests():
3675
# Call using ./mandos --check [--verbose]
3676
unittest.main()
3693
3677
else:
3694
3678
main()
3695
3679
finally:
3696
3680
logging.shutdown()
3697
3698
# Local Variables:
3699
# run-tests:
3700
# (lambda (&optional extra)
3701
# (if (not (funcall run-tests-in-test-buffer default-directory
3702
# extra))
3703
# (funcall show-test-buffer-in-test-window)
3704
# (funcall remove-test-window)
3705
# (if extra (message "Extra tests run successfully!"))))
3706
# run-tests-in-test-buffer:
3707
# (lambda (dir &optional extra)
3708
# (with-current-buffer (get-buffer-create "*Test*")
3709
# (setq buffer-read-only nil
3710
# default-directory dir)
3711
# (erase-buffer)
3712
# (compilation-mode))
3713
# (let ((process-result
3714
# (let ((inhibit-read-only t))
3715
# (process-file-shell-command
3716
# (funcall get-command-line extra) nil "*Test*"))))
3717
# (and (numberp process-result)
3718
# (= process-result 0))))
3719
# get-command-line:
3720
# (lambda (&optional extra)
3721
# (let ((quoted-script
3722
# (shell-quote-argument (funcall get-script-name))))
3723
# (format
3724
# (concat "%s --check" (if extra " --prefix=atest" ""))
3725
# quoted-script)))
3726
# get-script-name:
3727
# (lambda ()
3728
# (if (fboundp 'file-local-name)
3729
# (file-local-name (buffer-file-name))
3730
# (or (file-remote-p (buffer-file-name) 'localname)
3731
# (buffer-file-name))))
3732
# remove-test-window:
3733
# (lambda ()
3734
# (let ((test-window (get-buffer-window "*Test*")))
3735
# (if test-window (delete-window test-window))))
3736
# show-test-buffer-in-test-window:
3737
# (lambda ()
3738
# (when (not (get-buffer-window-list "*Test*"))
3739
# (setq next-error-last-buffer (get-buffer "*Test*"))
3740
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3741
# (display-buffer-overriding-action
3742
# `((display-buffer-in-side-window) (side . ,side)
3743
# (window-height . fit-window-to-buffer)
3744
# (window-width . fit-window-to-buffer))))
3745
# (display-buffer "*Test*"))))
3746
# eval:
3747
# (progn
3748
# (let* ((run-extra-tests (lambda () (interactive)
3749
# (funcall run-tests t)))
3750
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3751
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3752
# (setq minor-mode-overriding-map-alist
3753
# (cons `(run-tests . ,outer-keymap)
3754
# minor-mode-overriding-map-alist)))
3755
# (add-hook 'after-save-hook run-tests 90 t))
3756
# End:
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0