/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2022-04-23 23:25:49 UTC
  • Revision ID: teddy@recompile.se-20220423232549-1uul4i3jwhums0ek
Minor text adjustment in mandos(8) manual page

* mandos.xml (DESCRIPTION): Break long line.
  (SEE ALSO/RFC 4291): Fix grammatical mistake.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
 
# Copyright © 2008-2019 Teddy Hogeborn
15
 
# Copyright © 2008-2019 Björn Påhlsson
 
14
# Copyright © 2008-2020 Teddy Hogeborn
 
15
# Copyright © 2008-2020 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
79
79
import codecs
80
80
import unittest
81
81
import random
 
82
import shlex
82
83
 
83
84
import dbus
84
85
import dbus.service
103
104
    collections.abc = abc
104
105
    del abc
105
106
 
 
107
# Add shlex.quote if it does not exist
 
108
try:
 
109
    shlex.quote
 
110
except AttributeError:
 
111
    shlex.quote = re.escape
 
112
 
106
113
# Show warnings by default
107
114
if not sys.warnoptions:
108
115
    import warnings
136
143
if sys.version_info < (3, 2):
137
144
    configparser.Configparser = configparser.SafeConfigParser
138
145
 
139
 
version = "1.8.9"
 
146
version = "1.8.14"
140
147
stored_state_file = "clients.pickle"
141
148
 
142
149
logger = logging.getLogger()
182
189
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
183
190
        address="/dev/log"))
184
191
    syslogger.setFormatter(logging.Formatter
185
 
                           ('Mandos [%(process)d]: %(levelname)s:'
186
 
                            ' %(message)s'))
 
192
                           ("Mandos [%(process)d]: %(levelname)s:"
 
193
                            " %(message)s"))
187
194
    logger.addHandler(syslogger)
188
195
 
189
196
    if debug:
190
197
        console = logging.StreamHandler()
191
 
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
192
 
                                               ' [%(process)d]:'
193
 
                                               ' %(levelname)s:'
194
 
                                               ' %(message)s'))
 
198
        console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
 
199
                                               " [%(process)d]:"
 
200
                                               " %(levelname)s:"
 
201
                                               " %(message)s"))
195
202
        logger.addHandler(console)
196
203
    logger.setLevel(level)
197
204
 
217
224
        except OSError as e:
218
225
            if e.errno != errno.ENOENT:
219
226
                raise
220
 
        self.gnupgargs = ['--batch',
221
 
                          '--homedir', self.tempdir,
222
 
                          '--force-mdc',
223
 
                          '--quiet']
 
227
        self.gnupgargs = ["--batch",
 
228
                          "--homedir", self.tempdir,
 
229
                          "--force-mdc",
 
230
                          "--quiet"]
224
231
        # Only GPG version 1 has the --no-use-agent option.
225
232
        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
226
233
            self.gnupgargs.append("--no-use-agent")
265
272
                dir=self.tempdir) as passfile:
266
273
            passfile.write(passphrase)
267
274
            passfile.flush()
268
 
            proc = subprocess.Popen([self.gpg, '--symmetric',
269
 
                                     '--passphrase-file',
 
275
            proc = subprocess.Popen([self.gpg, "--symmetric",
 
276
                                     "--passphrase-file",
270
277
                                     passfile.name]
271
278
                                    + self.gnupgargs,
272
279
                                    stdin=subprocess.PIPE,
283
290
                dir=self.tempdir) as passfile:
284
291
            passfile.write(passphrase)
285
292
            passfile.flush()
286
 
            proc = subprocess.Popen([self.gpg, '--decrypt',
287
 
                                     '--passphrase-file',
 
293
            proc = subprocess.Popen([self.gpg, "--decrypt",
 
294
                                     "--passphrase-file",
288
295
                                     passfile.name]
289
296
                                    + self.gnupgargs,
290
297
                                    stdin=subprocess.PIPE,
343
350
    Attributes:
344
351
    interface: integer; avahi.IF_UNSPEC or an interface index.
345
352
               Used to optionally bind to the specified interface.
346
 
    name: string; Example: 'Mandos'
347
 
    type: string; Example: '_mandos._tcp'.
 
353
    name: string; Example: "Mandos"
 
354
    type: string; Example: "_mandos._tcp".
348
355
     See <https://www.iana.org/assignments/service-names-port-numbers>
349
356
    port: integer; what port to announce
350
357
    TXT: list of strings; TXT record for the service
428
435
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
429
436
        self.entry_group_state_changed_match = (
430
437
            self.group.connect_to_signal(
431
 
                'StateChanged', self.entry_group_state_changed))
 
438
                "StateChanged", self.entry_group_state_changed))
432
439
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
433
440
                     self.name, self.type)
434
441
        self.group.AddService(
517
524
class AvahiServiceToSyslog(AvahiService):
518
525
    def rename(self, *args, **kwargs):
519
526
        """Add the new name to the syslog messages"""
520
 
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
 
527
        ret = super(AvahiServiceToSyslog, self).rename(*args,
 
528
                                                       **kwargs)
521
529
        syslogger.setFormatter(logging.Formatter(
522
 
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
 
530
            "Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
523
531
            .format(self.name)))
524
532
        return ret
525
533
 
555
563
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
556
564
 
557
565
    # Types
558
 
    class session_int(ctypes.Structure):
 
566
    class _session_int(ctypes.Structure):
559
567
        _fields_ = []
560
 
    session_t = ctypes.POINTER(session_int)
 
568
    session_t = ctypes.POINTER(_session_int)
561
569
 
562
570
    class certificate_credentials_st(ctypes.Structure):
563
571
        _fields_ = []
566
574
    certificate_type_t = ctypes.c_int
567
575
 
568
576
    class datum_t(ctypes.Structure):
569
 
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
570
 
                    ('size', ctypes.c_uint)]
 
577
        _fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
 
578
                    ("size", ctypes.c_uint)]
571
579
 
572
 
    class openpgp_crt_int(ctypes.Structure):
 
580
    class _openpgp_crt_int(ctypes.Structure):
573
581
        _fields_ = []
574
 
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
 
582
    openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
575
583
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
576
584
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
577
585
    credentials_type_t = ctypes.c_int
586
594
            # gnutls.strerror()
587
595
            self.code = code
588
596
            if message is None and code is not None:
589
 
                message = gnutls.strerror(code)
 
597
                message = gnutls.strerror(code).decode(
 
598
                    "utf-8", errors="replace")
590
599
            return super(gnutls.Error, self).__init__(
591
600
                message, *args)
592
601
 
593
602
    class CertificateSecurityError(Error):
594
603
        pass
595
604
 
 
605
    class PointerTo:
 
606
        def __init__(self, cls):
 
607
            self.cls = cls
 
608
 
 
609
        def from_param(self, obj):
 
610
            if not isinstance(obj, self.cls):
 
611
                raise TypeError("Not of type {}: {!r}"
 
612
                                .format(self.cls.__name__, obj))
 
613
            return ctypes.byref(obj.from_param(obj))
 
614
 
 
615
    class CastToVoidPointer:
 
616
        def __init__(self, cls):
 
617
            self.cls = cls
 
618
 
 
619
        def from_param(self, obj):
 
620
            if not isinstance(obj, self.cls):
 
621
                raise TypeError("Not of type {}: {!r}"
 
622
                                .format(self.cls.__name__, obj))
 
623
            return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
 
624
 
 
625
    class With_from_param:
 
626
        @classmethod
 
627
        def from_param(cls, obj):
 
628
            return obj._as_parameter_
 
629
 
596
630
    # Classes
597
 
    class Credentials:
 
631
    class Credentials(With_from_param):
598
632
        def __init__(self):
599
 
            self._c_object = gnutls.certificate_credentials_t()
600
 
            gnutls.certificate_allocate_credentials(
601
 
                ctypes.byref(self._c_object))
 
633
            self._as_parameter_ = gnutls.certificate_credentials_t()
 
634
            gnutls.certificate_allocate_credentials(self)
602
635
            self.type = gnutls.CRD_CERTIFICATE
603
636
 
604
637
        def __del__(self):
605
 
            gnutls.certificate_free_credentials(self._c_object)
 
638
            gnutls.certificate_free_credentials(self)
606
639
 
607
 
    class ClientSession:
 
640
    class ClientSession(With_from_param):
608
641
        def __init__(self, socket, credentials=None):
609
 
            self._c_object = gnutls.session_t()
 
642
            self._as_parameter_ = gnutls.session_t()
610
643
            gnutls_flags = gnutls.CLIENT
611
644
            if gnutls.check_version(b"3.5.6"):
612
645
                gnutls_flags |= gnutls.NO_TICKETS
613
646
            if gnutls.has_rawpk:
614
647
                gnutls_flags |= gnutls.ENABLE_RAWPK
615
 
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
 
648
            gnutls.init(self, gnutls_flags)
616
649
            del gnutls_flags
617
 
            gnutls.set_default_priority(self._c_object)
618
 
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
619
 
            gnutls.handshake_set_private_extensions(self._c_object,
620
 
                                                    True)
 
650
            gnutls.set_default_priority(self)
 
651
            gnutls.transport_set_ptr(self, socket.fileno())
 
652
            gnutls.handshake_set_private_extensions(self, True)
621
653
            self.socket = socket
622
654
            if credentials is None:
623
655
                credentials = gnutls.Credentials()
624
 
            gnutls.credentials_set(self._c_object, credentials.type,
625
 
                                   ctypes.cast(credentials._c_object,
626
 
                                               ctypes.c_void_p))
 
656
            gnutls.credentials_set(self, credentials.type,
 
657
                                   credentials)
627
658
            self.credentials = credentials
628
659
 
629
660
        def __del__(self):
630
 
            gnutls.deinit(self._c_object)
 
661
            gnutls.deinit(self)
631
662
 
632
663
        def handshake(self):
633
 
            return gnutls.handshake(self._c_object)
 
664
            return gnutls.handshake(self)
634
665
 
635
666
        def send(self, data):
636
667
            data = bytes(data)
637
668
            data_len = len(data)
638
669
            while data_len > 0:
639
 
                data_len -= gnutls.record_send(self._c_object,
640
 
                                               data[-data_len:],
 
670
                data_len -= gnutls.record_send(self, data[-data_len:],
641
671
                                               data_len)
642
672
 
643
673
        def bye(self):
644
 
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
 
674
            return gnutls.bye(self, gnutls.SHUT_RDWR)
645
675
 
646
676
    # Error handling functions
647
677
    def _error_code(result):
648
678
        """A function to raise exceptions on errors, suitable
649
 
        for the 'restype' attribute on ctypes functions"""
650
 
        if result >= 0:
 
679
        for the "restype" attribute on ctypes functions"""
 
680
        if result >= gnutls.E_SUCCESS:
651
681
            return result
652
682
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
653
683
            raise gnutls.CertificateSecurityError(code=result)
654
684
        raise gnutls.Error(code=result)
655
685
 
656
 
    def _retry_on_error(result, func, arguments):
 
686
    def _retry_on_error(result, func, arguments,
 
687
                        _error_code=_error_code):
657
688
        """A function to retry on some errors, suitable
658
 
        for the 'errcheck' attribute on ctypes functions"""
659
 
        while result < 0:
 
689
        for the "errcheck" attribute on ctypes functions"""
 
690
        while result < gnutls.E_SUCCESS:
660
691
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
661
692
                return _error_code(result)
662
693
            result = func(*arguments)
667
698
 
668
699
    # Functions
669
700
    priority_set_direct = _library.gnutls_priority_set_direct
670
 
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
 
701
    priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
671
702
                                    ctypes.POINTER(ctypes.c_char_p)]
672
703
    priority_set_direct.restype = _error_code
673
704
 
674
705
    init = _library.gnutls_init
675
 
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
 
706
    init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
676
707
    init.restype = _error_code
677
708
 
678
709
    set_default_priority = _library.gnutls_set_default_priority
679
 
    set_default_priority.argtypes = [session_t]
 
710
    set_default_priority.argtypes = [ClientSession]
680
711
    set_default_priority.restype = _error_code
681
712
 
682
713
    record_send = _library.gnutls_record_send
683
 
    record_send.argtypes = [session_t, ctypes.c_void_p,
 
714
    record_send.argtypes = [ClientSession, ctypes.c_void_p,
684
715
                            ctypes.c_size_t]
685
716
    record_send.restype = ctypes.c_ssize_t
686
717
    record_send.errcheck = _retry_on_error
688
719
    certificate_allocate_credentials = (
689
720
        _library.gnutls_certificate_allocate_credentials)
690
721
    certificate_allocate_credentials.argtypes = [
691
 
        ctypes.POINTER(certificate_credentials_t)]
 
722
        PointerTo(Credentials)]
692
723
    certificate_allocate_credentials.restype = _error_code
693
724
 
694
725
    certificate_free_credentials = (
695
726
        _library.gnutls_certificate_free_credentials)
696
 
    certificate_free_credentials.argtypes = [
697
 
        certificate_credentials_t]
 
727
    certificate_free_credentials.argtypes = [Credentials]
698
728
    certificate_free_credentials.restype = None
699
729
 
700
730
    handshake_set_private_extensions = (
701
731
        _library.gnutls_handshake_set_private_extensions)
702
 
    handshake_set_private_extensions.argtypes = [session_t,
 
732
    handshake_set_private_extensions.argtypes = [ClientSession,
703
733
                                                 ctypes.c_int]
704
734
    handshake_set_private_extensions.restype = None
705
735
 
706
736
    credentials_set = _library.gnutls_credentials_set
707
 
    credentials_set.argtypes = [session_t, credentials_type_t,
708
 
                                ctypes.c_void_p]
 
737
    credentials_set.argtypes = [ClientSession, credentials_type_t,
 
738
                                CastToVoidPointer(Credentials)]
709
739
    credentials_set.restype = _error_code
710
740
 
711
741
    strerror = _library.gnutls_strerror
713
743
    strerror.restype = ctypes.c_char_p
714
744
 
715
745
    certificate_type_get = _library.gnutls_certificate_type_get
716
 
    certificate_type_get.argtypes = [session_t]
 
746
    certificate_type_get.argtypes = [ClientSession]
717
747
    certificate_type_get.restype = _error_code
718
748
 
719
749
    certificate_get_peers = _library.gnutls_certificate_get_peers
720
 
    certificate_get_peers.argtypes = [session_t,
 
750
    certificate_get_peers.argtypes = [ClientSession,
721
751
                                      ctypes.POINTER(ctypes.c_uint)]
722
752
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
723
753
 
730
760
    global_set_log_function.restype = None
731
761
 
732
762
    deinit = _library.gnutls_deinit
733
 
    deinit.argtypes = [session_t]
 
763
    deinit.argtypes = [ClientSession]
734
764
    deinit.restype = None
735
765
 
736
766
    handshake = _library.gnutls_handshake
737
 
    handshake.argtypes = [session_t]
738
 
    handshake.restype = _error_code
 
767
    handshake.argtypes = [ClientSession]
 
768
    handshake.restype = ctypes.c_int
739
769
    handshake.errcheck = _retry_on_error
740
770
 
741
771
    transport_set_ptr = _library.gnutls_transport_set_ptr
742
 
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
 
772
    transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
743
773
    transport_set_ptr.restype = None
744
774
 
745
775
    bye = _library.gnutls_bye
746
 
    bye.argtypes = [session_t, close_request_t]
747
 
    bye.restype = _error_code
 
776
    bye.argtypes = [ClientSession, close_request_t]
 
777
    bye.restype = ctypes.c_int
748
778
    bye.errcheck = _retry_on_error
749
779
 
750
780
    check_version = _library.gnutls_check_version
767
797
 
768
798
        x509_crt_fmt_t = ctypes.c_int
769
799
 
770
 
        # All the function declarations below are from gnutls/abstract.h
 
800
        # All the function declarations below are from
 
801
        # gnutls/abstract.h
771
802
        pubkey_init = _library.gnutls_pubkey_init
772
803
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
773
804
        pubkey_init.restype = _error_code
787
818
        pubkey_deinit.argtypes = [pubkey_t]
788
819
        pubkey_deinit.restype = None
789
820
    else:
790
 
        # All the function declarations below are from gnutls/openpgp.h
 
821
        # All the function declarations below are from
 
822
        # gnutls/openpgp.h
791
823
 
792
824
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
793
825
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
799
831
                                       openpgp_crt_fmt_t]
800
832
        openpgp_crt_import.restype = _error_code
801
833
 
802
 
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
803
 
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
804
 
                                            ctypes.POINTER(ctypes.c_uint)]
 
834
        openpgp_crt_verify_self = \
 
835
            _library.gnutls_openpgp_crt_verify_self
 
836
        openpgp_crt_verify_self.argtypes = [
 
837
            openpgp_crt_t,
 
838
            ctypes.c_uint,
 
839
            ctypes.POINTER(ctypes.c_uint),
 
840
        ]
805
841
        openpgp_crt_verify_self.restype = _error_code
806
842
 
807
843
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
818
854
 
819
855
    if check_version(b"3.6.4"):
820
856
        certificate_type_get2 = _library.gnutls_certificate_type_get2
821
 
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
 
857
        certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
822
858
        certificate_type_get2.restype = _error_code
823
859
 
824
860
    # Remove non-public functions
840
876
    """A representation of a client host served by this server.
841
877
 
842
878
    Attributes:
843
 
    approved:   bool(); 'None' if not yet approved/disapproved
 
879
    approved:   bool(); None if not yet approved/disapproved
844
880
    approval_delay: datetime.timedelta(); Time to wait for approval
845
881
    approval_duration: datetime.timedelta(); Duration of one approval
846
882
    checker: multiprocessing.Process(); a running checker process used
847
 
             to see if the client lives. 'None' if no process is
 
883
             to see if the client lives. None if no process is
848
884
             running.
849
885
    checker_callback_tag: a GLib event source tag, or None
850
886
    checker_command: string; External command which is run to check
1127
1163
        if self.checker is None:
1128
1164
            # Escape attributes for the shell
1129
1165
            escaped_attrs = {
1130
 
                attr: re.escape(str(getattr(self, attr)))
 
1166
                attr: shlex.quote(str(getattr(self, attr)))
1131
1167
                for attr in self.runtime_expansions}
1132
1168
            try:
1133
1169
                command = self.checker_command % escaped_attrs
1206
1242
        func._dbus_name = func.__name__
1207
1243
        if func._dbus_name.endswith("_dbus_property"):
1208
1244
            func._dbus_name = func._dbus_name[:-14]
1209
 
        func._dbus_get_args_options = {'byte_arrays': byte_arrays}
 
1245
        func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1210
1246
        return func
1211
1247
 
1212
1248
    return decorator
1301
1337
 
1302
1338
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1303
1339
                         out_signature="s",
1304
 
                         path_keyword='object_path',
1305
 
                         connection_keyword='connection')
 
1340
                         path_keyword="object_path",
 
1341
                         connection_keyword="connection")
1306
1342
    def Introspect(self, object_path, connection):
1307
1343
        """Overloading of standard D-Bus method.
1308
1344
 
1461
1497
 
1462
1498
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1463
1499
                         out_signature="s",
1464
 
                         path_keyword='object_path',
1465
 
                         connection_keyword='connection')
 
1500
                         path_keyword="object_path",
 
1501
                         connection_keyword="connection")
1466
1502
    def Introspect(self, object_path, connection):
1467
1503
        """Overloading of standard D-Bus method.
1468
1504
 
1563
1599
 
1564
1600
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1565
1601
                         out_signature="s",
1566
 
                         path_keyword='object_path',
1567
 
                         connection_keyword='connection')
 
1602
                         path_keyword="object_path",
 
1603
                         connection_keyword="connection")
1568
1604
    def Introspect(self, object_path, connection):
1569
1605
        """Overloading of standard D-Bus method.
1570
1606
 
2236
2272
class ProxyClient:
2237
2273
    def __init__(self, child_pipe, key_id, fpr, address):
2238
2274
        self._pipe = child_pipe
2239
 
        self._pipe.send(('init', key_id, fpr, address))
 
2275
        self._pipe.send(("init", key_id, fpr, address))
2240
2276
        if not self._pipe.recv():
2241
2277
            raise KeyError(key_id or fpr)
2242
2278
 
2243
2279
    def __getattribute__(self, name):
2244
 
        if name == '_pipe':
 
2280
        if name == "_pipe":
2245
2281
            return super(ProxyClient, self).__getattribute__(name)
2246
 
        self._pipe.send(('getattr', name))
 
2282
        self._pipe.send(("getattr", name))
2247
2283
        data = self._pipe.recv()
2248
 
        if data[0] == 'data':
 
2284
        if data[0] == "data":
2249
2285
            return data[1]
2250
 
        if data[0] == 'function':
 
2286
        if data[0] == "function":
2251
2287
 
2252
2288
            def func(*args, **kwargs):
2253
 
                self._pipe.send(('funcall', name, args, kwargs))
 
2289
                self._pipe.send(("funcall", name, args, kwargs))
2254
2290
                return self._pipe.recv()[1]
2255
2291
 
2256
2292
            return func
2257
2293
 
2258
2294
    def __setattr__(self, name, value):
2259
 
        if name == '_pipe':
 
2295
        if name == "_pipe":
2260
2296
            return super(ProxyClient, self).__setattr__(name, value)
2261
 
        self._pipe.send(('setattr', name, value))
 
2297
        self._pipe.send(("setattr", name, value))
2262
2298
 
2263
2299
 
2264
2300
class ClientHandler(socketserver.BaseRequestHandler, object):
2276
2312
 
2277
2313
            session = gnutls.ClientSession(self.request)
2278
2314
 
2279
 
            # priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
2315
            # priority = ":".join(("NONE", "+VERS-TLS1.1",
2280
2316
            #                       "+AES-256-CBC", "+SHA1",
2281
2317
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
2282
2318
            #                       "+DHE-DSS"))
2284
2320
            priority = self.server.gnutls_priority
2285
2321
            if priority is None:
2286
2322
                priority = "NORMAL"
2287
 
            gnutls.priority_set_direct(session._c_object,
2288
 
                                       priority.encode("utf-8"),
2289
 
                                       None)
 
2323
            gnutls.priority_set_direct(session,
 
2324
                                       priority.encode("utf-8"), None)
2290
2325
 
2291
2326
            # Start communication using the Mandos protocol
2292
2327
            # Get protocol number
2319
2354
                    except (TypeError, gnutls.Error) as error:
2320
2355
                        logger.warning("Bad certificate: %s", error)
2321
2356
                        return
2322
 
                    logger.debug("Key ID: %s", key_id)
 
2357
                    logger.debug("Key ID: %s",
 
2358
                                 key_id.decode("utf-8",
 
2359
                                               errors="replace"))
2323
2360
 
2324
2361
                else:
2325
2362
                    key_id = b""
2417
2454
    def peer_certificate(session):
2418
2455
        "Return the peer's certificate as a bytestring"
2419
2456
        try:
2420
 
            cert_type = gnutls.certificate_type_get2(session._c_object,
2421
 
                                                     gnutls.CTYPE_PEERS)
 
2457
            cert_type = gnutls.certificate_type_get2(
 
2458
                session, gnutls.CTYPE_PEERS)
2422
2459
        except AttributeError:
2423
 
            cert_type = gnutls.certificate_type_get(session._c_object)
 
2460
            cert_type = gnutls.certificate_type_get(session)
2424
2461
        if gnutls.has_rawpk:
2425
2462
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2426
2463
        else:
2433
2470
            return b""
2434
2471
        list_size = ctypes.c_uint(1)
2435
2472
        cert_list = (gnutls.certificate_get_peers
2436
 
                     (session._c_object, ctypes.byref(list_size)))
 
2473
                     (session, ctypes.byref(list_size)))
2437
2474
        if not bool(cert_list) and list_size.value != 0:
2438
2475
            raise gnutls.Error("error getting peer certificate")
2439
2476
        if list_size.value == 0:
2461
2498
        buf = ctypes.create_string_buffer(32)
2462
2499
        buf_len = ctypes.c_size_t(len(buf))
2463
2500
        # Get the key ID from the raw public key into the buffer
2464
 
        gnutls.pubkey_get_key_id(pubkey,
2465
 
                                 gnutls.KEYID_USE_SHA256,
2466
 
                                 ctypes.cast(ctypes.byref(buf),
2467
 
                                             ctypes.POINTER(ctypes.c_ubyte)),
2468
 
                                 ctypes.byref(buf_len))
 
2501
        gnutls.pubkey_get_key_id(
 
2502
            pubkey,
 
2503
            gnutls.KEYID_USE_SHA256,
 
2504
            ctypes.cast(ctypes.byref(buf),
 
2505
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2506
            ctypes.byref(buf_len))
2469
2507
        # Deinit the certificate
2470
2508
        gnutls.pubkey_deinit(pubkey)
2471
2509
 
2552
2590
 
2553
2591
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2554
2592
                     socketserver.TCPServer):
2555
 
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
2593
    """IPv6-capable TCP server.  Accepts None as address and/or port
2556
2594
 
2557
2595
    Attributes:
2558
2596
        enabled:        Boolean; whether this server is activated yet
2710
2748
        request = parent_pipe.recv()
2711
2749
        command = request[0]
2712
2750
 
2713
 
        if command == 'init':
 
2751
        if command == "init":
2714
2752
            key_id = request[1].decode("ascii")
2715
2753
            fpr = request[2].decode("ascii")
2716
2754
            address = request[3]
2717
2755
 
2718
2756
            for c in self.clients.values():
2719
 
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
 
2757
                if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
 
2758
                              "27AE41E4649B934CA495991B7852B855"):
2720
2759
                    continue
2721
2760
                if key_id and c.key_id == key_id:
2722
2761
                    client = c
2745
2784
            # remove the old hook in favor of the new above hook on
2746
2785
            # same fileno
2747
2786
            return False
2748
 
        if command == 'funcall':
 
2787
        if command == "funcall":
2749
2788
            funcname = request[1]
2750
2789
            args = request[2]
2751
2790
            kwargs = request[3]
2752
2791
 
2753
 
            parent_pipe.send(('data', getattr(client_object,
 
2792
            parent_pipe.send(("data", getattr(client_object,
2754
2793
                                              funcname)(*args,
2755
2794
                                                        **kwargs)))
2756
2795
 
2757
 
        if command == 'getattr':
 
2796
        if command == "getattr":
2758
2797
            attrname = request[1]
2759
2798
            if isinstance(client_object.__getattribute__(attrname),
2760
2799
                          collections.abc.Callable):
2761
 
                parent_pipe.send(('function', ))
 
2800
                parent_pipe.send(("function", ))
2762
2801
            else:
2763
2802
                parent_pipe.send((
2764
 
                    'data', client_object.__getattribute__(attrname)))
 
2803
                    "data", client_object.__getattribute__(attrname)))
2765
2804
 
2766
 
        if command == 'setattr':
 
2805
        if command == "setattr":
2767
2806
            attrname = request[1]
2768
2807
            value = request[2]
2769
2808
            setattr(client_object, attrname, value)
2774
2813
def rfc3339_duration_to_delta(duration):
2775
2814
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2776
2815
 
2777
 
    >>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2778
 
    True
2779
 
    >>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2780
 
    True
2781
 
    >>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2782
 
    True
2783
 
    >>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2784
 
    True
2785
 
    >>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2786
 
    True
2787
 
    >>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2788
 
    True
2789
 
    >>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2790
 
    True
 
2816
    >>> timedelta = datetime.timedelta
 
2817
    >>> rfc3339_duration_to_delta("P7D") == timedelta(7)
 
2818
    True
 
2819
    >>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
 
2820
    True
 
2821
    >>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
 
2822
    True
 
2823
    >>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
 
2824
    True
 
2825
    >>> rfc3339_duration_to_delta("P1W") == timedelta(7)
 
2826
    True
 
2827
    >>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
 
2828
    True
 
2829
    >>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
 
2830
    True
 
2831
    >>> del timedelta
2791
2832
    """
2792
2833
 
2793
2834
    # Parsing an RFC 3339 duration with regular expressions is not
2873
2914
def string_to_delta(interval):
2874
2915
    """Parse a string and return a datetime.timedelta
2875
2916
 
2876
 
    >>> string_to_delta('7d') == datetime.timedelta(7)
2877
 
    True
2878
 
    >>> string_to_delta('60s') == datetime.timedelta(0, 60)
2879
 
    True
2880
 
    >>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2881
 
    True
2882
 
    >>> string_to_delta('24h') == datetime.timedelta(1)
2883
 
    True
2884
 
    >>> string_to_delta('1w') == datetime.timedelta(7)
2885
 
    True
2886
 
    >>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
 
2917
    >>> string_to_delta("7d") == datetime.timedelta(7)
 
2918
    True
 
2919
    >>> string_to_delta("60s") == datetime.timedelta(0, 60)
 
2920
    True
 
2921
    >>> string_to_delta("60m") == datetime.timedelta(0, 3600)
 
2922
    True
 
2923
    >>> string_to_delta("24h") == datetime.timedelta(1)
 
2924
    True
 
2925
    >>> string_to_delta("1w") == datetime.timedelta(7)
 
2926
    True
 
2927
    >>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2887
2928
    True
2888
2929
    """
2889
2930
 
3093
3134
 
3094
3135
    if server_settings["servicename"] != "Mandos":
3095
3136
        syslogger.setFormatter(
3096
 
            logging.Formatter('Mandos ({}) [%(process)d]:'
3097
 
                              ' %(levelname)s: %(message)s'.format(
 
3137
            logging.Formatter("Mandos ({}) [%(process)d]:"
 
3138
                              " %(levelname)s: %(message)s".format(
3098
3139
                                  server_settings["servicename"])))
3099
3140
 
3100
3141
    # Parse config file with clients
3160
3201
 
3161
3202
        @gnutls.log_func
3162
3203
        def debug_gnutls(level, string):
3163
 
            logger.debug("GnuTLS: %s", string[:-1])
 
3204
            logger.debug("GnuTLS: %s",
 
3205
                         string[:-1].decode("utf-8",
 
3206
                                            errors="replace"))
3164
3207
 
3165
3208
        gnutls.global_set_log_function(debug_gnutls)
3166
3209
 
3541
3584
 
3542
3585
        try:
3543
3586
            with tempfile.NamedTemporaryFile(
3544
 
                    mode='wb',
 
3587
                    mode="wb",
3545
3588
                    suffix=".pickle",
3546
 
                    prefix='clients-',
 
3589
                    prefix="clients-",
3547
3590
                    dir=os.path.dirname(stored_state_path),
3548
3591
                    delete=False) as stored_state:
3549
3592
                pickle.dump((clients, client_settings), stored_state,
3636
3679
 
3637
3680
def should_only_run_tests():
3638
3681
    parser = argparse.ArgumentParser(add_help=False)
3639
 
    parser.add_argument("--check", action='store_true')
 
3682
    parser.add_argument("--check", action="store_true")
3640
3683
    args, unknown_args = parser.parse_known_args()
3641
3684
    run_tests = args.check
3642
3685
    if run_tests:
3650
3693
    tests.addTests(doctest.DocTestSuite())
3651
3694
    return tests
3652
3695
 
3653
 
if __name__ == '__main__':
 
3696
if __name__ == "__main__":
3654
3697
    try:
3655
3698
        if should_only_run_tests():
3656
3699
            # Call using ./mandos --check [--verbose]