/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2022-04-23 23:25:49 UTC
  • Revision ID: teddy@recompile.se-20220423232549-1uul4i3jwhums0ek
Minor text adjustment in mandos(8) manual page

* mandos.xml (DESCRIPTION): Break long line.
  (SEE ALSO/RFC 4291): Fix grammatical mistake.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
143
143
if sys.version_info < (3, 2):
144
144
    configparser.Configparser = configparser.SafeConfigParser
145
145
 
146
 
version = "1.8.12"
 
146
version = "1.8.14"
147
147
stored_state_file = "clients.pickle"
148
148
 
149
149
logger = logging.getLogger()
189
189
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
190
        address="/dev/log"))
191
191
    syslogger.setFormatter(logging.Formatter
192
 
                           ('Mandos [%(process)d]: %(levelname)s:'
193
 
                            ' %(message)s'))
 
192
                           ("Mandos [%(process)d]: %(levelname)s:"
 
193
                            " %(message)s"))
194
194
    logger.addHandler(syslogger)
195
195
 
196
196
    if debug:
197
197
        console = logging.StreamHandler()
198
 
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
199
 
                                               ' [%(process)d]:'
200
 
                                               ' %(levelname)s:'
201
 
                                               ' %(message)s'))
 
198
        console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
 
199
                                               " [%(process)d]:"
 
200
                                               " %(levelname)s:"
 
201
                                               " %(message)s"))
202
202
        logger.addHandler(console)
203
203
    logger.setLevel(level)
204
204
 
224
224
        except OSError as e:
225
225
            if e.errno != errno.ENOENT:
226
226
                raise
227
 
        self.gnupgargs = ['--batch',
228
 
                          '--homedir', self.tempdir,
229
 
                          '--force-mdc',
230
 
                          '--quiet']
 
227
        self.gnupgargs = ["--batch",
 
228
                          "--homedir", self.tempdir,
 
229
                          "--force-mdc",
 
230
                          "--quiet"]
231
231
        # Only GPG version 1 has the --no-use-agent option.
232
232
        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
233
            self.gnupgargs.append("--no-use-agent")
272
272
                dir=self.tempdir) as passfile:
273
273
            passfile.write(passphrase)
274
274
            passfile.flush()
275
 
            proc = subprocess.Popen([self.gpg, '--symmetric',
276
 
                                     '--passphrase-file',
 
275
            proc = subprocess.Popen([self.gpg, "--symmetric",
 
276
                                     "--passphrase-file",
277
277
                                     passfile.name]
278
278
                                    + self.gnupgargs,
279
279
                                    stdin=subprocess.PIPE,
290
290
                dir=self.tempdir) as passfile:
291
291
            passfile.write(passphrase)
292
292
            passfile.flush()
293
 
            proc = subprocess.Popen([self.gpg, '--decrypt',
294
 
                                     '--passphrase-file',
 
293
            proc = subprocess.Popen([self.gpg, "--decrypt",
 
294
                                     "--passphrase-file",
295
295
                                     passfile.name]
296
296
                                    + self.gnupgargs,
297
297
                                    stdin=subprocess.PIPE,
350
350
    Attributes:
351
351
    interface: integer; avahi.IF_UNSPEC or an interface index.
352
352
               Used to optionally bind to the specified interface.
353
 
    name: string; Example: 'Mandos'
354
 
    type: string; Example: '_mandos._tcp'.
 
353
    name: string; Example: "Mandos"
 
354
    type: string; Example: "_mandos._tcp".
355
355
     See <https://www.iana.org/assignments/service-names-port-numbers>
356
356
    port: integer; what port to announce
357
357
    TXT: list of strings; TXT record for the service
435
435
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
436
        self.entry_group_state_changed_match = (
437
437
            self.group.connect_to_signal(
438
 
                'StateChanged', self.entry_group_state_changed))
 
438
                "StateChanged", self.entry_group_state_changed))
439
439
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
440
                     self.name, self.type)
441
441
        self.group.AddService(
524
524
class AvahiServiceToSyslog(AvahiService):
525
525
    def rename(self, *args, **kwargs):
526
526
        """Add the new name to the syslog messages"""
527
 
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
 
527
        ret = super(AvahiServiceToSyslog, self).rename(*args,
 
528
                                                       **kwargs)
528
529
        syslogger.setFormatter(logging.Formatter(
529
 
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
 
530
            "Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
530
531
            .format(self.name)))
531
532
        return ret
532
533
 
562
563
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
563
564
 
564
565
    # Types
565
 
    class session_int(ctypes.Structure):
 
566
    class _session_int(ctypes.Structure):
566
567
        _fields_ = []
567
 
    session_t = ctypes.POINTER(session_int)
 
568
    session_t = ctypes.POINTER(_session_int)
568
569
 
569
570
    class certificate_credentials_st(ctypes.Structure):
570
571
        _fields_ = []
573
574
    certificate_type_t = ctypes.c_int
574
575
 
575
576
    class datum_t(ctypes.Structure):
576
 
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
577
 
                    ('size', ctypes.c_uint)]
 
577
        _fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
 
578
                    ("size", ctypes.c_uint)]
578
579
 
579
 
    class openpgp_crt_int(ctypes.Structure):
 
580
    class _openpgp_crt_int(ctypes.Structure):
580
581
        _fields_ = []
581
 
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
 
582
    openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
582
583
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
583
584
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
585
    credentials_type_t = ctypes.c_int
593
594
            # gnutls.strerror()
594
595
            self.code = code
595
596
            if message is None and code is not None:
596
 
                message = gnutls.strerror(code)
 
597
                message = gnutls.strerror(code).decode(
 
598
                    "utf-8", errors="replace")
597
599
            return super(gnutls.Error, self).__init__(
598
600
                message, *args)
599
601
 
600
602
    class CertificateSecurityError(Error):
601
603
        pass
602
604
 
 
605
    class PointerTo:
 
606
        def __init__(self, cls):
 
607
            self.cls = cls
 
608
 
 
609
        def from_param(self, obj):
 
610
            if not isinstance(obj, self.cls):
 
611
                raise TypeError("Not of type {}: {!r}"
 
612
                                .format(self.cls.__name__, obj))
 
613
            return ctypes.byref(obj.from_param(obj))
 
614
 
 
615
    class CastToVoidPointer:
 
616
        def __init__(self, cls):
 
617
            self.cls = cls
 
618
 
 
619
        def from_param(self, obj):
 
620
            if not isinstance(obj, self.cls):
 
621
                raise TypeError("Not of type {}: {!r}"
 
622
                                .format(self.cls.__name__, obj))
 
623
            return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
 
624
 
 
625
    class With_from_param:
 
626
        @classmethod
 
627
        def from_param(cls, obj):
 
628
            return obj._as_parameter_
 
629
 
603
630
    # Classes
604
 
    class Credentials:
 
631
    class Credentials(With_from_param):
605
632
        def __init__(self):
606
 
            self._c_object = gnutls.certificate_credentials_t()
607
 
            gnutls.certificate_allocate_credentials(
608
 
                ctypes.byref(self._c_object))
 
633
            self._as_parameter_ = gnutls.certificate_credentials_t()
 
634
            gnutls.certificate_allocate_credentials(self)
609
635
            self.type = gnutls.CRD_CERTIFICATE
610
636
 
611
637
        def __del__(self):
612
 
            gnutls.certificate_free_credentials(self._c_object)
 
638
            gnutls.certificate_free_credentials(self)
613
639
 
614
 
    class ClientSession:
 
640
    class ClientSession(With_from_param):
615
641
        def __init__(self, socket, credentials=None):
616
 
            self._c_object = gnutls.session_t()
 
642
            self._as_parameter_ = gnutls.session_t()
617
643
            gnutls_flags = gnutls.CLIENT
618
644
            if gnutls.check_version(b"3.5.6"):
619
645
                gnutls_flags |= gnutls.NO_TICKETS
620
646
            if gnutls.has_rawpk:
621
647
                gnutls_flags |= gnutls.ENABLE_RAWPK
622
 
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
 
648
            gnutls.init(self, gnutls_flags)
623
649
            del gnutls_flags
624
 
            gnutls.set_default_priority(self._c_object)
625
 
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
626
 
            gnutls.handshake_set_private_extensions(self._c_object,
627
 
                                                    True)
 
650
            gnutls.set_default_priority(self)
 
651
            gnutls.transport_set_ptr(self, socket.fileno())
 
652
            gnutls.handshake_set_private_extensions(self, True)
628
653
            self.socket = socket
629
654
            if credentials is None:
630
655
                credentials = gnutls.Credentials()
631
 
            gnutls.credentials_set(self._c_object, credentials.type,
632
 
                                   ctypes.cast(credentials._c_object,
633
 
                                               ctypes.c_void_p))
 
656
            gnutls.credentials_set(self, credentials.type,
 
657
                                   credentials)
634
658
            self.credentials = credentials
635
659
 
636
660
        def __del__(self):
637
 
            gnutls.deinit(self._c_object)
 
661
            gnutls.deinit(self)
638
662
 
639
663
        def handshake(self):
640
 
            return gnutls.handshake(self._c_object)
 
664
            return gnutls.handshake(self)
641
665
 
642
666
        def send(self, data):
643
667
            data = bytes(data)
644
668
            data_len = len(data)
645
669
            while data_len > 0:
646
 
                data_len -= gnutls.record_send(self._c_object,
647
 
                                               data[-data_len:],
 
670
                data_len -= gnutls.record_send(self, data[-data_len:],
648
671
                                               data_len)
649
672
 
650
673
        def bye(self):
651
 
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
 
674
            return gnutls.bye(self, gnutls.SHUT_RDWR)
652
675
 
653
676
    # Error handling functions
654
677
    def _error_code(result):
655
678
        """A function to raise exceptions on errors, suitable
656
 
        for the 'restype' attribute on ctypes functions"""
657
 
        if result >= 0:
 
679
        for the "restype" attribute on ctypes functions"""
 
680
        if result >= gnutls.E_SUCCESS:
658
681
            return result
659
682
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
660
683
            raise gnutls.CertificateSecurityError(code=result)
661
684
        raise gnutls.Error(code=result)
662
685
 
663
 
    def _retry_on_error(result, func, arguments):
 
686
    def _retry_on_error(result, func, arguments,
 
687
                        _error_code=_error_code):
664
688
        """A function to retry on some errors, suitable
665
 
        for the 'errcheck' attribute on ctypes functions"""
666
 
        while result < 0:
 
689
        for the "errcheck" attribute on ctypes functions"""
 
690
        while result < gnutls.E_SUCCESS:
667
691
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
668
692
                return _error_code(result)
669
693
            result = func(*arguments)
674
698
 
675
699
    # Functions
676
700
    priority_set_direct = _library.gnutls_priority_set_direct
677
 
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
 
701
    priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
678
702
                                    ctypes.POINTER(ctypes.c_char_p)]
679
703
    priority_set_direct.restype = _error_code
680
704
 
681
705
    init = _library.gnutls_init
682
 
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
 
706
    init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
683
707
    init.restype = _error_code
684
708
 
685
709
    set_default_priority = _library.gnutls_set_default_priority
686
 
    set_default_priority.argtypes = [session_t]
 
710
    set_default_priority.argtypes = [ClientSession]
687
711
    set_default_priority.restype = _error_code
688
712
 
689
713
    record_send = _library.gnutls_record_send
690
 
    record_send.argtypes = [session_t, ctypes.c_void_p,
 
714
    record_send.argtypes = [ClientSession, ctypes.c_void_p,
691
715
                            ctypes.c_size_t]
692
716
    record_send.restype = ctypes.c_ssize_t
693
717
    record_send.errcheck = _retry_on_error
695
719
    certificate_allocate_credentials = (
696
720
        _library.gnutls_certificate_allocate_credentials)
697
721
    certificate_allocate_credentials.argtypes = [
698
 
        ctypes.POINTER(certificate_credentials_t)]
 
722
        PointerTo(Credentials)]
699
723
    certificate_allocate_credentials.restype = _error_code
700
724
 
701
725
    certificate_free_credentials = (
702
726
        _library.gnutls_certificate_free_credentials)
703
 
    certificate_free_credentials.argtypes = [
704
 
        certificate_credentials_t]
 
727
    certificate_free_credentials.argtypes = [Credentials]
705
728
    certificate_free_credentials.restype = None
706
729
 
707
730
    handshake_set_private_extensions = (
708
731
        _library.gnutls_handshake_set_private_extensions)
709
 
    handshake_set_private_extensions.argtypes = [session_t,
 
732
    handshake_set_private_extensions.argtypes = [ClientSession,
710
733
                                                 ctypes.c_int]
711
734
    handshake_set_private_extensions.restype = None
712
735
 
713
736
    credentials_set = _library.gnutls_credentials_set
714
 
    credentials_set.argtypes = [session_t, credentials_type_t,
715
 
                                ctypes.c_void_p]
 
737
    credentials_set.argtypes = [ClientSession, credentials_type_t,
 
738
                                CastToVoidPointer(Credentials)]
716
739
    credentials_set.restype = _error_code
717
740
 
718
741
    strerror = _library.gnutls_strerror
720
743
    strerror.restype = ctypes.c_char_p
721
744
 
722
745
    certificate_type_get = _library.gnutls_certificate_type_get
723
 
    certificate_type_get.argtypes = [session_t]
 
746
    certificate_type_get.argtypes = [ClientSession]
724
747
    certificate_type_get.restype = _error_code
725
748
 
726
749
    certificate_get_peers = _library.gnutls_certificate_get_peers
727
 
    certificate_get_peers.argtypes = [session_t,
 
750
    certificate_get_peers.argtypes = [ClientSession,
728
751
                                      ctypes.POINTER(ctypes.c_uint)]
729
752
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
730
753
 
737
760
    global_set_log_function.restype = None
738
761
 
739
762
    deinit = _library.gnutls_deinit
740
 
    deinit.argtypes = [session_t]
 
763
    deinit.argtypes = [ClientSession]
741
764
    deinit.restype = None
742
765
 
743
766
    handshake = _library.gnutls_handshake
744
 
    handshake.argtypes = [session_t]
745
 
    handshake.restype = _error_code
 
767
    handshake.argtypes = [ClientSession]
 
768
    handshake.restype = ctypes.c_int
746
769
    handshake.errcheck = _retry_on_error
747
770
 
748
771
    transport_set_ptr = _library.gnutls_transport_set_ptr
749
 
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
 
772
    transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
750
773
    transport_set_ptr.restype = None
751
774
 
752
775
    bye = _library.gnutls_bye
753
 
    bye.argtypes = [session_t, close_request_t]
754
 
    bye.restype = _error_code
 
776
    bye.argtypes = [ClientSession, close_request_t]
 
777
    bye.restype = ctypes.c_int
755
778
    bye.errcheck = _retry_on_error
756
779
 
757
780
    check_version = _library.gnutls_check_version
774
797
 
775
798
        x509_crt_fmt_t = ctypes.c_int
776
799
 
777
 
        # All the function declarations below are from gnutls/abstract.h
 
800
        # All the function declarations below are from
 
801
        # gnutls/abstract.h
778
802
        pubkey_init = _library.gnutls_pubkey_init
779
803
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
780
804
        pubkey_init.restype = _error_code
794
818
        pubkey_deinit.argtypes = [pubkey_t]
795
819
        pubkey_deinit.restype = None
796
820
    else:
797
 
        # All the function declarations below are from gnutls/openpgp.h
 
821
        # All the function declarations below are from
 
822
        # gnutls/openpgp.h
798
823
 
799
824
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
800
825
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
806
831
                                       openpgp_crt_fmt_t]
807
832
        openpgp_crt_import.restype = _error_code
808
833
 
809
 
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
810
 
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
811
 
                                            ctypes.POINTER(ctypes.c_uint)]
 
834
        openpgp_crt_verify_self = \
 
835
            _library.gnutls_openpgp_crt_verify_self
 
836
        openpgp_crt_verify_self.argtypes = [
 
837
            openpgp_crt_t,
 
838
            ctypes.c_uint,
 
839
            ctypes.POINTER(ctypes.c_uint),
 
840
        ]
812
841
        openpgp_crt_verify_self.restype = _error_code
813
842
 
814
843
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
825
854
 
826
855
    if check_version(b"3.6.4"):
827
856
        certificate_type_get2 = _library.gnutls_certificate_type_get2
828
 
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
 
857
        certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
829
858
        certificate_type_get2.restype = _error_code
830
859
 
831
860
    # Remove non-public functions
847
876
    """A representation of a client host served by this server.
848
877
 
849
878
    Attributes:
850
 
    approved:   bool(); 'None' if not yet approved/disapproved
 
879
    approved:   bool(); None if not yet approved/disapproved
851
880
    approval_delay: datetime.timedelta(); Time to wait for approval
852
881
    approval_duration: datetime.timedelta(); Duration of one approval
853
882
    checker: multiprocessing.Process(); a running checker process used
854
 
             to see if the client lives. 'None' if no process is
 
883
             to see if the client lives. None if no process is
855
884
             running.
856
885
    checker_callback_tag: a GLib event source tag, or None
857
886
    checker_command: string; External command which is run to check
1213
1242
        func._dbus_name = func.__name__
1214
1243
        if func._dbus_name.endswith("_dbus_property"):
1215
1244
            func._dbus_name = func._dbus_name[:-14]
1216
 
        func._dbus_get_args_options = {'byte_arrays': byte_arrays}
 
1245
        func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1217
1246
        return func
1218
1247
 
1219
1248
    return decorator
1308
1337
 
1309
1338
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1310
1339
                         out_signature="s",
1311
 
                         path_keyword='object_path',
1312
 
                         connection_keyword='connection')
 
1340
                         path_keyword="object_path",
 
1341
                         connection_keyword="connection")
1313
1342
    def Introspect(self, object_path, connection):
1314
1343
        """Overloading of standard D-Bus method.
1315
1344
 
1468
1497
 
1469
1498
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1470
1499
                         out_signature="s",
1471
 
                         path_keyword='object_path',
1472
 
                         connection_keyword='connection')
 
1500
                         path_keyword="object_path",
 
1501
                         connection_keyword="connection")
1473
1502
    def Introspect(self, object_path, connection):
1474
1503
        """Overloading of standard D-Bus method.
1475
1504
 
1570
1599
 
1571
1600
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1572
1601
                         out_signature="s",
1573
 
                         path_keyword='object_path',
1574
 
                         connection_keyword='connection')
 
1602
                         path_keyword="object_path",
 
1603
                         connection_keyword="connection")
1575
1604
    def Introspect(self, object_path, connection):
1576
1605
        """Overloading of standard D-Bus method.
1577
1606
 
2243
2272
class ProxyClient:
2244
2273
    def __init__(self, child_pipe, key_id, fpr, address):
2245
2274
        self._pipe = child_pipe
2246
 
        self._pipe.send(('init', key_id, fpr, address))
 
2275
        self._pipe.send(("init", key_id, fpr, address))
2247
2276
        if not self._pipe.recv():
2248
2277
            raise KeyError(key_id or fpr)
2249
2278
 
2250
2279
    def __getattribute__(self, name):
2251
 
        if name == '_pipe':
 
2280
        if name == "_pipe":
2252
2281
            return super(ProxyClient, self).__getattribute__(name)
2253
 
        self._pipe.send(('getattr', name))
 
2282
        self._pipe.send(("getattr", name))
2254
2283
        data = self._pipe.recv()
2255
 
        if data[0] == 'data':
 
2284
        if data[0] == "data":
2256
2285
            return data[1]
2257
 
        if data[0] == 'function':
 
2286
        if data[0] == "function":
2258
2287
 
2259
2288
            def func(*args, **kwargs):
2260
 
                self._pipe.send(('funcall', name, args, kwargs))
 
2289
                self._pipe.send(("funcall", name, args, kwargs))
2261
2290
                return self._pipe.recv()[1]
2262
2291
 
2263
2292
            return func
2264
2293
 
2265
2294
    def __setattr__(self, name, value):
2266
 
        if name == '_pipe':
 
2295
        if name == "_pipe":
2267
2296
            return super(ProxyClient, self).__setattr__(name, value)
2268
 
        self._pipe.send(('setattr', name, value))
 
2297
        self._pipe.send(("setattr", name, value))
2269
2298
 
2270
2299
 
2271
2300
class ClientHandler(socketserver.BaseRequestHandler, object):
2283
2312
 
2284
2313
            session = gnutls.ClientSession(self.request)
2285
2314
 
2286
 
            # priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
2315
            # priority = ":".join(("NONE", "+VERS-TLS1.1",
2287
2316
            #                       "+AES-256-CBC", "+SHA1",
2288
2317
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
2289
2318
            #                       "+DHE-DSS"))
2291
2320
            priority = self.server.gnutls_priority
2292
2321
            if priority is None:
2293
2322
                priority = "NORMAL"
2294
 
            gnutls.priority_set_direct(session._c_object,
2295
 
                                       priority.encode("utf-8"),
2296
 
                                       None)
 
2323
            gnutls.priority_set_direct(session,
 
2324
                                       priority.encode("utf-8"), None)
2297
2325
 
2298
2326
            # Start communication using the Mandos protocol
2299
2327
            # Get protocol number
2326
2354
                    except (TypeError, gnutls.Error) as error:
2327
2355
                        logger.warning("Bad certificate: %s", error)
2328
2356
                        return
2329
 
                    logger.debug("Key ID: %s", key_id)
 
2357
                    logger.debug("Key ID: %s",
 
2358
                                 key_id.decode("utf-8",
 
2359
                                               errors="replace"))
2330
2360
 
2331
2361
                else:
2332
2362
                    key_id = b""
2424
2454
    def peer_certificate(session):
2425
2455
        "Return the peer's certificate as a bytestring"
2426
2456
        try:
2427
 
            cert_type = gnutls.certificate_type_get2(session._c_object,
2428
 
                                                     gnutls.CTYPE_PEERS)
 
2457
            cert_type = gnutls.certificate_type_get2(
 
2458
                session, gnutls.CTYPE_PEERS)
2429
2459
        except AttributeError:
2430
 
            cert_type = gnutls.certificate_type_get(session._c_object)
 
2460
            cert_type = gnutls.certificate_type_get(session)
2431
2461
        if gnutls.has_rawpk:
2432
2462
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2433
2463
        else:
2440
2470
            return b""
2441
2471
        list_size = ctypes.c_uint(1)
2442
2472
        cert_list = (gnutls.certificate_get_peers
2443
 
                     (session._c_object, ctypes.byref(list_size)))
 
2473
                     (session, ctypes.byref(list_size)))
2444
2474
        if not bool(cert_list) and list_size.value != 0:
2445
2475
            raise gnutls.Error("error getting peer certificate")
2446
2476
        if list_size.value == 0:
2468
2498
        buf = ctypes.create_string_buffer(32)
2469
2499
        buf_len = ctypes.c_size_t(len(buf))
2470
2500
        # Get the key ID from the raw public key into the buffer
2471
 
        gnutls.pubkey_get_key_id(pubkey,
2472
 
                                 gnutls.KEYID_USE_SHA256,
2473
 
                                 ctypes.cast(ctypes.byref(buf),
2474
 
                                             ctypes.POINTER(ctypes.c_ubyte)),
2475
 
                                 ctypes.byref(buf_len))
 
2501
        gnutls.pubkey_get_key_id(
 
2502
            pubkey,
 
2503
            gnutls.KEYID_USE_SHA256,
 
2504
            ctypes.cast(ctypes.byref(buf),
 
2505
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2506
            ctypes.byref(buf_len))
2476
2507
        # Deinit the certificate
2477
2508
        gnutls.pubkey_deinit(pubkey)
2478
2509
 
2559
2590
 
2560
2591
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2561
2592
                     socketserver.TCPServer):
2562
 
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
2593
    """IPv6-capable TCP server.  Accepts None as address and/or port
2563
2594
 
2564
2595
    Attributes:
2565
2596
        enabled:        Boolean; whether this server is activated yet
2717
2748
        request = parent_pipe.recv()
2718
2749
        command = request[0]
2719
2750
 
2720
 
        if command == 'init':
 
2751
        if command == "init":
2721
2752
            key_id = request[1].decode("ascii")
2722
2753
            fpr = request[2].decode("ascii")
2723
2754
            address = request[3]
2724
2755
 
2725
2756
            for c in self.clients.values():
2726
 
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
 
2757
                if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
 
2758
                              "27AE41E4649B934CA495991B7852B855"):
2727
2759
                    continue
2728
2760
                if key_id and c.key_id == key_id:
2729
2761
                    client = c
2752
2784
            # remove the old hook in favor of the new above hook on
2753
2785
            # same fileno
2754
2786
            return False
2755
 
        if command == 'funcall':
 
2787
        if command == "funcall":
2756
2788
            funcname = request[1]
2757
2789
            args = request[2]
2758
2790
            kwargs = request[3]
2759
2791
 
2760
 
            parent_pipe.send(('data', getattr(client_object,
 
2792
            parent_pipe.send(("data", getattr(client_object,
2761
2793
                                              funcname)(*args,
2762
2794
                                                        **kwargs)))
2763
2795
 
2764
 
        if command == 'getattr':
 
2796
        if command == "getattr":
2765
2797
            attrname = request[1]
2766
2798
            if isinstance(client_object.__getattribute__(attrname),
2767
2799
                          collections.abc.Callable):
2768
 
                parent_pipe.send(('function', ))
 
2800
                parent_pipe.send(("function", ))
2769
2801
            else:
2770
2802
                parent_pipe.send((
2771
 
                    'data', client_object.__getattribute__(attrname)))
 
2803
                    "data", client_object.__getattribute__(attrname)))
2772
2804
 
2773
 
        if command == 'setattr':
 
2805
        if command == "setattr":
2774
2806
            attrname = request[1]
2775
2807
            value = request[2]
2776
2808
            setattr(client_object, attrname, value)
2781
2813
def rfc3339_duration_to_delta(duration):
2782
2814
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2783
2815
 
2784
 
    >>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2785
 
    True
2786
 
    >>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2787
 
    True
2788
 
    >>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2789
 
    True
2790
 
    >>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2791
 
    True
2792
 
    >>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2793
 
    True
2794
 
    >>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2795
 
    True
2796
 
    >>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2797
 
    True
 
2816
    >>> timedelta = datetime.timedelta
 
2817
    >>> rfc3339_duration_to_delta("P7D") == timedelta(7)
 
2818
    True
 
2819
    >>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
 
2820
    True
 
2821
    >>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
 
2822
    True
 
2823
    >>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
 
2824
    True
 
2825
    >>> rfc3339_duration_to_delta("P1W") == timedelta(7)
 
2826
    True
 
2827
    >>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
 
2828
    True
 
2829
    >>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
 
2830
    True
 
2831
    >>> del timedelta
2798
2832
    """
2799
2833
 
2800
2834
    # Parsing an RFC 3339 duration with regular expressions is not
2880
2914
def string_to_delta(interval):
2881
2915
    """Parse a string and return a datetime.timedelta
2882
2916
 
2883
 
    >>> string_to_delta('7d') == datetime.timedelta(7)
2884
 
    True
2885
 
    >>> string_to_delta('60s') == datetime.timedelta(0, 60)
2886
 
    True
2887
 
    >>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2888
 
    True
2889
 
    >>> string_to_delta('24h') == datetime.timedelta(1)
2890
 
    True
2891
 
    >>> string_to_delta('1w') == datetime.timedelta(7)
2892
 
    True
2893
 
    >>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
 
2917
    >>> string_to_delta("7d") == datetime.timedelta(7)
 
2918
    True
 
2919
    >>> string_to_delta("60s") == datetime.timedelta(0, 60)
 
2920
    True
 
2921
    >>> string_to_delta("60m") == datetime.timedelta(0, 3600)
 
2922
    True
 
2923
    >>> string_to_delta("24h") == datetime.timedelta(1)
 
2924
    True
 
2925
    >>> string_to_delta("1w") == datetime.timedelta(7)
 
2926
    True
 
2927
    >>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2894
2928
    True
2895
2929
    """
2896
2930
 
3100
3134
 
3101
3135
    if server_settings["servicename"] != "Mandos":
3102
3136
        syslogger.setFormatter(
3103
 
            logging.Formatter('Mandos ({}) [%(process)d]:'
3104
 
                              ' %(levelname)s: %(message)s'.format(
 
3137
            logging.Formatter("Mandos ({}) [%(process)d]:"
 
3138
                              " %(levelname)s: %(message)s".format(
3105
3139
                                  server_settings["servicename"])))
3106
3140
 
3107
3141
    # Parse config file with clients
3167
3201
 
3168
3202
        @gnutls.log_func
3169
3203
        def debug_gnutls(level, string):
3170
 
            logger.debug("GnuTLS: %s", string[:-1])
 
3204
            logger.debug("GnuTLS: %s",
 
3205
                         string[:-1].decode("utf-8",
 
3206
                                            errors="replace"))
3171
3207
 
3172
3208
        gnutls.global_set_log_function(debug_gnutls)
3173
3209
 
3548
3584
 
3549
3585
        try:
3550
3586
            with tempfile.NamedTemporaryFile(
3551
 
                    mode='wb',
 
3587
                    mode="wb",
3552
3588
                    suffix=".pickle",
3553
 
                    prefix='clients-',
 
3589
                    prefix="clients-",
3554
3590
                    dir=os.path.dirname(stored_state_path),
3555
3591
                    delete=False) as stored_state:
3556
3592
                pickle.dump((clients, client_settings), stored_state,
3643
3679
 
3644
3680
def should_only_run_tests():
3645
3681
    parser = argparse.ArgumentParser(add_help=False)
3646
 
    parser.add_argument("--check", action='store_true')
 
3682
    parser.add_argument("--check", action="store_true")
3647
3683
    args, unknown_args = parser.parse_known_args()
3648
3684
    run_tests = args.check
3649
3685
    if run_tests:
3657
3693
    tests.addTests(doctest.DocTestSuite())
3658
3694
    return tests
3659
3695
 
3660
 
if __name__ == '__main__':
 
3696
if __name__ == "__main__":
3661
3697
    try:
3662
3698
        if should_only_run_tests():
3663
3699
            # Call using ./mandos --check [--verbose]