/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2022-04-23 23:58:39 UTC
  • Revision ID: teddy@recompile.se-20220423235839-cnt9aq1kjveqaydc
Bug fix in mandos-ctl: handle backslashes in password

* mandos-ctl (mode=password): When sending the password to gpg, use
  "printf" instead of "echo -n".  This avoids the behavior of the
  "echo" builtin in "dash", which always interprets backslash escape
  codes.

Reported-By: Jesse Norell <jesse@kci.net>

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
143
143
if sys.version_info < (3, 2):
144
144
    configparser.Configparser = configparser.SafeConfigParser
145
145
 
146
 
version = "1.8.13"
 
146
version = "1.8.14"
147
147
stored_state_file = "clients.pickle"
148
148
 
149
149
logger = logging.getLogger()
189
189
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
190
        address="/dev/log"))
191
191
    syslogger.setFormatter(logging.Formatter
192
 
                           ('Mandos [%(process)d]: %(levelname)s:'
193
 
                            ' %(message)s'))
 
192
                           ("Mandos [%(process)d]: %(levelname)s:"
 
193
                            " %(message)s"))
194
194
    logger.addHandler(syslogger)
195
195
 
196
196
    if debug:
197
197
        console = logging.StreamHandler()
198
 
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
199
 
                                               ' [%(process)d]:'
200
 
                                               ' %(levelname)s:'
201
 
                                               ' %(message)s'))
 
198
        console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
 
199
                                               " [%(process)d]:"
 
200
                                               " %(levelname)s:"
 
201
                                               " %(message)s"))
202
202
        logger.addHandler(console)
203
203
    logger.setLevel(level)
204
204
 
224
224
        except OSError as e:
225
225
            if e.errno != errno.ENOENT:
226
226
                raise
227
 
        self.gnupgargs = ['--batch',
228
 
                          '--homedir', self.tempdir,
229
 
                          '--force-mdc',
230
 
                          '--quiet']
 
227
        self.gnupgargs = ["--batch",
 
228
                          "--homedir", self.tempdir,
 
229
                          "--force-mdc",
 
230
                          "--quiet"]
231
231
        # Only GPG version 1 has the --no-use-agent option.
232
232
        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
233
            self.gnupgargs.append("--no-use-agent")
272
272
                dir=self.tempdir) as passfile:
273
273
            passfile.write(passphrase)
274
274
            passfile.flush()
275
 
            proc = subprocess.Popen([self.gpg, '--symmetric',
276
 
                                     '--passphrase-file',
 
275
            proc = subprocess.Popen([self.gpg, "--symmetric",
 
276
                                     "--passphrase-file",
277
277
                                     passfile.name]
278
278
                                    + self.gnupgargs,
279
279
                                    stdin=subprocess.PIPE,
290
290
                dir=self.tempdir) as passfile:
291
291
            passfile.write(passphrase)
292
292
            passfile.flush()
293
 
            proc = subprocess.Popen([self.gpg, '--decrypt',
294
 
                                     '--passphrase-file',
 
293
            proc = subprocess.Popen([self.gpg, "--decrypt",
 
294
                                     "--passphrase-file",
295
295
                                     passfile.name]
296
296
                                    + self.gnupgargs,
297
297
                                    stdin=subprocess.PIPE,
350
350
    Attributes:
351
351
    interface: integer; avahi.IF_UNSPEC or an interface index.
352
352
               Used to optionally bind to the specified interface.
353
 
    name: string; Example: 'Mandos'
354
 
    type: string; Example: '_mandos._tcp'.
 
353
    name: string; Example: "Mandos"
 
354
    type: string; Example: "_mandos._tcp".
355
355
     See <https://www.iana.org/assignments/service-names-port-numbers>
356
356
    port: integer; what port to announce
357
357
    TXT: list of strings; TXT record for the service
435
435
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
436
        self.entry_group_state_changed_match = (
437
437
            self.group.connect_to_signal(
438
 
                'StateChanged', self.entry_group_state_changed))
 
438
                "StateChanged", self.entry_group_state_changed))
439
439
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
440
                     self.name, self.type)
441
441
        self.group.AddService(
527
527
        ret = super(AvahiServiceToSyslog, self).rename(*args,
528
528
                                                       **kwargs)
529
529
        syslogger.setFormatter(logging.Formatter(
530
 
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
 
530
            "Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
531
531
            .format(self.name)))
532
532
        return ret
533
533
 
563
563
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
564
564
 
565
565
    # Types
566
 
    class session_int(ctypes.Structure):
 
566
    class _session_int(ctypes.Structure):
567
567
        _fields_ = []
568
 
    session_t = ctypes.POINTER(session_int)
 
568
    session_t = ctypes.POINTER(_session_int)
569
569
 
570
570
    class certificate_credentials_st(ctypes.Structure):
571
571
        _fields_ = []
574
574
    certificate_type_t = ctypes.c_int
575
575
 
576
576
    class datum_t(ctypes.Structure):
577
 
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
578
 
                    ('size', ctypes.c_uint)]
 
577
        _fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
 
578
                    ("size", ctypes.c_uint)]
579
579
 
580
 
    class openpgp_crt_int(ctypes.Structure):
 
580
    class _openpgp_crt_int(ctypes.Structure):
581
581
        _fields_ = []
582
 
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
 
582
    openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
583
583
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
584
584
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
585
585
    credentials_type_t = ctypes.c_int
594
594
            # gnutls.strerror()
595
595
            self.code = code
596
596
            if message is None and code is not None:
597
 
                message = gnutls.strerror(code)
 
597
                message = gnutls.strerror(code).decode(
 
598
                    "utf-8", errors="replace")
598
599
            return super(gnutls.Error, self).__init__(
599
600
                message, *args)
600
601
 
601
602
    class CertificateSecurityError(Error):
602
603
        pass
603
604
 
 
605
    class PointerTo:
 
606
        def __init__(self, cls):
 
607
            self.cls = cls
 
608
 
 
609
        def from_param(self, obj):
 
610
            if not isinstance(obj, self.cls):
 
611
                raise TypeError("Not of type {}: {!r}"
 
612
                                .format(self.cls.__name__, obj))
 
613
            return ctypes.byref(obj.from_param(obj))
 
614
 
 
615
    class CastToVoidPointer:
 
616
        def __init__(self, cls):
 
617
            self.cls = cls
 
618
 
 
619
        def from_param(self, obj):
 
620
            if not isinstance(obj, self.cls):
 
621
                raise TypeError("Not of type {}: {!r}"
 
622
                                .format(self.cls.__name__, obj))
 
623
            return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
 
624
 
 
625
    class With_from_param:
 
626
        @classmethod
 
627
        def from_param(cls, obj):
 
628
            return obj._as_parameter_
 
629
 
604
630
    # Classes
605
 
    class Credentials:
 
631
    class Credentials(With_from_param):
606
632
        def __init__(self):
607
 
            self._c_object = gnutls.certificate_credentials_t()
608
 
            gnutls.certificate_allocate_credentials(
609
 
                ctypes.byref(self._c_object))
 
633
            self._as_parameter_ = gnutls.certificate_credentials_t()
 
634
            gnutls.certificate_allocate_credentials(self)
610
635
            self.type = gnutls.CRD_CERTIFICATE
611
636
 
612
637
        def __del__(self):
613
 
            gnutls.certificate_free_credentials(self._c_object)
 
638
            gnutls.certificate_free_credentials(self)
614
639
 
615
 
    class ClientSession:
 
640
    class ClientSession(With_from_param):
616
641
        def __init__(self, socket, credentials=None):
617
 
            self._c_object = gnutls.session_t()
 
642
            self._as_parameter_ = gnutls.session_t()
618
643
            gnutls_flags = gnutls.CLIENT
619
644
            if gnutls.check_version(b"3.5.6"):
620
645
                gnutls_flags |= gnutls.NO_TICKETS
621
646
            if gnutls.has_rawpk:
622
647
                gnutls_flags |= gnutls.ENABLE_RAWPK
623
 
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
 
648
            gnutls.init(self, gnutls_flags)
624
649
            del gnutls_flags
625
 
            gnutls.set_default_priority(self._c_object)
626
 
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
627
 
            gnutls.handshake_set_private_extensions(self._c_object,
628
 
                                                    True)
 
650
            gnutls.set_default_priority(self)
 
651
            gnutls.transport_set_ptr(self, socket.fileno())
 
652
            gnutls.handshake_set_private_extensions(self, True)
629
653
            self.socket = socket
630
654
            if credentials is None:
631
655
                credentials = gnutls.Credentials()
632
 
            gnutls.credentials_set(self._c_object, credentials.type,
633
 
                                   ctypes.cast(credentials._c_object,
634
 
                                               ctypes.c_void_p))
 
656
            gnutls.credentials_set(self, credentials.type,
 
657
                                   credentials)
635
658
            self.credentials = credentials
636
659
 
637
660
        def __del__(self):
638
 
            gnutls.deinit(self._c_object)
 
661
            gnutls.deinit(self)
639
662
 
640
663
        def handshake(self):
641
 
            return gnutls.handshake(self._c_object)
 
664
            return gnutls.handshake(self)
642
665
 
643
666
        def send(self, data):
644
667
            data = bytes(data)
645
668
            data_len = len(data)
646
669
            while data_len > 0:
647
 
                data_len -= gnutls.record_send(self._c_object,
648
 
                                               data[-data_len:],
 
670
                data_len -= gnutls.record_send(self, data[-data_len:],
649
671
                                               data_len)
650
672
 
651
673
        def bye(self):
652
 
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
 
674
            return gnutls.bye(self, gnutls.SHUT_RDWR)
653
675
 
654
676
    # Error handling functions
655
677
    def _error_code(result):
656
678
        """A function to raise exceptions on errors, suitable
657
 
        for the 'restype' attribute on ctypes functions"""
658
 
        if result >= 0:
 
679
        for the "restype" attribute on ctypes functions"""
 
680
        if result >= gnutls.E_SUCCESS:
659
681
            return result
660
682
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
661
683
            raise gnutls.CertificateSecurityError(code=result)
662
684
        raise gnutls.Error(code=result)
663
685
 
664
 
    def _retry_on_error(result, func, arguments):
 
686
    def _retry_on_error(result, func, arguments,
 
687
                        _error_code=_error_code):
665
688
        """A function to retry on some errors, suitable
666
 
        for the 'errcheck' attribute on ctypes functions"""
667
 
        while result < 0:
 
689
        for the "errcheck" attribute on ctypes functions"""
 
690
        while result < gnutls.E_SUCCESS:
668
691
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
669
692
                return _error_code(result)
670
693
            result = func(*arguments)
675
698
 
676
699
    # Functions
677
700
    priority_set_direct = _library.gnutls_priority_set_direct
678
 
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
 
701
    priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
679
702
                                    ctypes.POINTER(ctypes.c_char_p)]
680
703
    priority_set_direct.restype = _error_code
681
704
 
682
705
    init = _library.gnutls_init
683
 
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
 
706
    init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
684
707
    init.restype = _error_code
685
708
 
686
709
    set_default_priority = _library.gnutls_set_default_priority
687
 
    set_default_priority.argtypes = [session_t]
 
710
    set_default_priority.argtypes = [ClientSession]
688
711
    set_default_priority.restype = _error_code
689
712
 
690
713
    record_send = _library.gnutls_record_send
691
 
    record_send.argtypes = [session_t, ctypes.c_void_p,
 
714
    record_send.argtypes = [ClientSession, ctypes.c_void_p,
692
715
                            ctypes.c_size_t]
693
716
    record_send.restype = ctypes.c_ssize_t
694
717
    record_send.errcheck = _retry_on_error
696
719
    certificate_allocate_credentials = (
697
720
        _library.gnutls_certificate_allocate_credentials)
698
721
    certificate_allocate_credentials.argtypes = [
699
 
        ctypes.POINTER(certificate_credentials_t)]
 
722
        PointerTo(Credentials)]
700
723
    certificate_allocate_credentials.restype = _error_code
701
724
 
702
725
    certificate_free_credentials = (
703
726
        _library.gnutls_certificate_free_credentials)
704
 
    certificate_free_credentials.argtypes = [
705
 
        certificate_credentials_t]
 
727
    certificate_free_credentials.argtypes = [Credentials]
706
728
    certificate_free_credentials.restype = None
707
729
 
708
730
    handshake_set_private_extensions = (
709
731
        _library.gnutls_handshake_set_private_extensions)
710
 
    handshake_set_private_extensions.argtypes = [session_t,
 
732
    handshake_set_private_extensions.argtypes = [ClientSession,
711
733
                                                 ctypes.c_int]
712
734
    handshake_set_private_extensions.restype = None
713
735
 
714
736
    credentials_set = _library.gnutls_credentials_set
715
 
    credentials_set.argtypes = [session_t, credentials_type_t,
716
 
                                ctypes.c_void_p]
 
737
    credentials_set.argtypes = [ClientSession, credentials_type_t,
 
738
                                CastToVoidPointer(Credentials)]
717
739
    credentials_set.restype = _error_code
718
740
 
719
741
    strerror = _library.gnutls_strerror
721
743
    strerror.restype = ctypes.c_char_p
722
744
 
723
745
    certificate_type_get = _library.gnutls_certificate_type_get
724
 
    certificate_type_get.argtypes = [session_t]
 
746
    certificate_type_get.argtypes = [ClientSession]
725
747
    certificate_type_get.restype = _error_code
726
748
 
727
749
    certificate_get_peers = _library.gnutls_certificate_get_peers
728
 
    certificate_get_peers.argtypes = [session_t,
 
750
    certificate_get_peers.argtypes = [ClientSession,
729
751
                                      ctypes.POINTER(ctypes.c_uint)]
730
752
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
731
753
 
738
760
    global_set_log_function.restype = None
739
761
 
740
762
    deinit = _library.gnutls_deinit
741
 
    deinit.argtypes = [session_t]
 
763
    deinit.argtypes = [ClientSession]
742
764
    deinit.restype = None
743
765
 
744
766
    handshake = _library.gnutls_handshake
745
 
    handshake.argtypes = [session_t]
746
 
    handshake.restype = _error_code
 
767
    handshake.argtypes = [ClientSession]
 
768
    handshake.restype = ctypes.c_int
747
769
    handshake.errcheck = _retry_on_error
748
770
 
749
771
    transport_set_ptr = _library.gnutls_transport_set_ptr
750
 
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
 
772
    transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
751
773
    transport_set_ptr.restype = None
752
774
 
753
775
    bye = _library.gnutls_bye
754
 
    bye.argtypes = [session_t, close_request_t]
755
 
    bye.restype = _error_code
 
776
    bye.argtypes = [ClientSession, close_request_t]
 
777
    bye.restype = ctypes.c_int
756
778
    bye.errcheck = _retry_on_error
757
779
 
758
780
    check_version = _library.gnutls_check_version
832
854
 
833
855
    if check_version(b"3.6.4"):
834
856
        certificate_type_get2 = _library.gnutls_certificate_type_get2
835
 
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
 
857
        certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
836
858
        certificate_type_get2.restype = _error_code
837
859
 
838
860
    # Remove non-public functions
854
876
    """A representation of a client host served by this server.
855
877
 
856
878
    Attributes:
857
 
    approved:   bool(); 'None' if not yet approved/disapproved
 
879
    approved:   bool(); None if not yet approved/disapproved
858
880
    approval_delay: datetime.timedelta(); Time to wait for approval
859
881
    approval_duration: datetime.timedelta(); Duration of one approval
860
882
    checker: multiprocessing.Process(); a running checker process used
861
 
             to see if the client lives. 'None' if no process is
 
883
             to see if the client lives. None if no process is
862
884
             running.
863
885
    checker_callback_tag: a GLib event source tag, or None
864
886
    checker_command: string; External command which is run to check
1220
1242
        func._dbus_name = func.__name__
1221
1243
        if func._dbus_name.endswith("_dbus_property"):
1222
1244
            func._dbus_name = func._dbus_name[:-14]
1223
 
        func._dbus_get_args_options = {'byte_arrays': byte_arrays}
 
1245
        func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1224
1246
        return func
1225
1247
 
1226
1248
    return decorator
1315
1337
 
1316
1338
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1317
1339
                         out_signature="s",
1318
 
                         path_keyword='object_path',
1319
 
                         connection_keyword='connection')
 
1340
                         path_keyword="object_path",
 
1341
                         connection_keyword="connection")
1320
1342
    def Introspect(self, object_path, connection):
1321
1343
        """Overloading of standard D-Bus method.
1322
1344
 
1475
1497
 
1476
1498
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1477
1499
                         out_signature="s",
1478
 
                         path_keyword='object_path',
1479
 
                         connection_keyword='connection')
 
1500
                         path_keyword="object_path",
 
1501
                         connection_keyword="connection")
1480
1502
    def Introspect(self, object_path, connection):
1481
1503
        """Overloading of standard D-Bus method.
1482
1504
 
1577
1599
 
1578
1600
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1579
1601
                         out_signature="s",
1580
 
                         path_keyword='object_path',
1581
 
                         connection_keyword='connection')
 
1602
                         path_keyword="object_path",
 
1603
                         connection_keyword="connection")
1582
1604
    def Introspect(self, object_path, connection):
1583
1605
        """Overloading of standard D-Bus method.
1584
1606
 
2250
2272
class ProxyClient:
2251
2273
    def __init__(self, child_pipe, key_id, fpr, address):
2252
2274
        self._pipe = child_pipe
2253
 
        self._pipe.send(('init', key_id, fpr, address))
 
2275
        self._pipe.send(("init", key_id, fpr, address))
2254
2276
        if not self._pipe.recv():
2255
2277
            raise KeyError(key_id or fpr)
2256
2278
 
2257
2279
    def __getattribute__(self, name):
2258
 
        if name == '_pipe':
 
2280
        if name == "_pipe":
2259
2281
            return super(ProxyClient, self).__getattribute__(name)
2260
 
        self._pipe.send(('getattr', name))
 
2282
        self._pipe.send(("getattr", name))
2261
2283
        data = self._pipe.recv()
2262
 
        if data[0] == 'data':
 
2284
        if data[0] == "data":
2263
2285
            return data[1]
2264
 
        if data[0] == 'function':
 
2286
        if data[0] == "function":
2265
2287
 
2266
2288
            def func(*args, **kwargs):
2267
 
                self._pipe.send(('funcall', name, args, kwargs))
 
2289
                self._pipe.send(("funcall", name, args, kwargs))
2268
2290
                return self._pipe.recv()[1]
2269
2291
 
2270
2292
            return func
2271
2293
 
2272
2294
    def __setattr__(self, name, value):
2273
 
        if name == '_pipe':
 
2295
        if name == "_pipe":
2274
2296
            return super(ProxyClient, self).__setattr__(name, value)
2275
 
        self._pipe.send(('setattr', name, value))
 
2297
        self._pipe.send(("setattr", name, value))
2276
2298
 
2277
2299
 
2278
2300
class ClientHandler(socketserver.BaseRequestHandler, object):
2290
2312
 
2291
2313
            session = gnutls.ClientSession(self.request)
2292
2314
 
2293
 
            # priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
2315
            # priority = ":".join(("NONE", "+VERS-TLS1.1",
2294
2316
            #                       "+AES-256-CBC", "+SHA1",
2295
2317
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
2296
2318
            #                       "+DHE-DSS"))
2298
2320
            priority = self.server.gnutls_priority
2299
2321
            if priority is None:
2300
2322
                priority = "NORMAL"
2301
 
            gnutls.priority_set_direct(session._c_object,
2302
 
                                       priority.encode("utf-8"),
2303
 
                                       None)
 
2323
            gnutls.priority_set_direct(session,
 
2324
                                       priority.encode("utf-8"), None)
2304
2325
 
2305
2326
            # Start communication using the Mandos protocol
2306
2327
            # Get protocol number
2333
2354
                    except (TypeError, gnutls.Error) as error:
2334
2355
                        logger.warning("Bad certificate: %s", error)
2335
2356
                        return
2336
 
                    logger.debug("Key ID: %s", key_id)
 
2357
                    logger.debug("Key ID: %s",
 
2358
                                 key_id.decode("utf-8",
 
2359
                                               errors="replace"))
2337
2360
 
2338
2361
                else:
2339
2362
                    key_id = b""
2431
2454
    def peer_certificate(session):
2432
2455
        "Return the peer's certificate as a bytestring"
2433
2456
        try:
2434
 
            cert_type = gnutls.certificate_type_get2(session._c_object,
2435
 
                                                     gnutls.CTYPE_PEERS)
 
2457
            cert_type = gnutls.certificate_type_get2(
 
2458
                session, gnutls.CTYPE_PEERS)
2436
2459
        except AttributeError:
2437
 
            cert_type = gnutls.certificate_type_get(session._c_object)
 
2460
            cert_type = gnutls.certificate_type_get(session)
2438
2461
        if gnutls.has_rawpk:
2439
2462
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2440
2463
        else:
2447
2470
            return b""
2448
2471
        list_size = ctypes.c_uint(1)
2449
2472
        cert_list = (gnutls.certificate_get_peers
2450
 
                     (session._c_object, ctypes.byref(list_size)))
 
2473
                     (session, ctypes.byref(list_size)))
2451
2474
        if not bool(cert_list) and list_size.value != 0:
2452
2475
            raise gnutls.Error("error getting peer certificate")
2453
2476
        if list_size.value == 0:
2567
2590
 
2568
2591
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2569
2592
                     socketserver.TCPServer):
2570
 
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
2593
    """IPv6-capable TCP server.  Accepts None as address and/or port
2571
2594
 
2572
2595
    Attributes:
2573
2596
        enabled:        Boolean; whether this server is activated yet
2725
2748
        request = parent_pipe.recv()
2726
2749
        command = request[0]
2727
2750
 
2728
 
        if command == 'init':
 
2751
        if command == "init":
2729
2752
            key_id = request[1].decode("ascii")
2730
2753
            fpr = request[2].decode("ascii")
2731
2754
            address = request[3]
2761
2784
            # remove the old hook in favor of the new above hook on
2762
2785
            # same fileno
2763
2786
            return False
2764
 
        if command == 'funcall':
 
2787
        if command == "funcall":
2765
2788
            funcname = request[1]
2766
2789
            args = request[2]
2767
2790
            kwargs = request[3]
2768
2791
 
2769
 
            parent_pipe.send(('data', getattr(client_object,
 
2792
            parent_pipe.send(("data", getattr(client_object,
2770
2793
                                              funcname)(*args,
2771
2794
                                                        **kwargs)))
2772
2795
 
2773
 
        if command == 'getattr':
 
2796
        if command == "getattr":
2774
2797
            attrname = request[1]
2775
2798
            if isinstance(client_object.__getattribute__(attrname),
2776
2799
                          collections.abc.Callable):
2777
 
                parent_pipe.send(('function', ))
 
2800
                parent_pipe.send(("function", ))
2778
2801
            else:
2779
2802
                parent_pipe.send((
2780
 
                    'data', client_object.__getattribute__(attrname)))
 
2803
                    "data", client_object.__getattribute__(attrname)))
2781
2804
 
2782
 
        if command == 'setattr':
 
2805
        if command == "setattr":
2783
2806
            attrname = request[1]
2784
2807
            value = request[2]
2785
2808
            setattr(client_object, attrname, value)
2891
2914
def string_to_delta(interval):
2892
2915
    """Parse a string and return a datetime.timedelta
2893
2916
 
2894
 
    >>> string_to_delta('7d') == datetime.timedelta(7)
2895
 
    True
2896
 
    >>> string_to_delta('60s') == datetime.timedelta(0, 60)
2897
 
    True
2898
 
    >>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2899
 
    True
2900
 
    >>> string_to_delta('24h') == datetime.timedelta(1)
2901
 
    True
2902
 
    >>> string_to_delta('1w') == datetime.timedelta(7)
2903
 
    True
2904
 
    >>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
 
2917
    >>> string_to_delta("7d") == datetime.timedelta(7)
 
2918
    True
 
2919
    >>> string_to_delta("60s") == datetime.timedelta(0, 60)
 
2920
    True
 
2921
    >>> string_to_delta("60m") == datetime.timedelta(0, 3600)
 
2922
    True
 
2923
    >>> string_to_delta("24h") == datetime.timedelta(1)
 
2924
    True
 
2925
    >>> string_to_delta("1w") == datetime.timedelta(7)
 
2926
    True
 
2927
    >>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2905
2928
    True
2906
2929
    """
2907
2930
 
3111
3134
 
3112
3135
    if server_settings["servicename"] != "Mandos":
3113
3136
        syslogger.setFormatter(
3114
 
            logging.Formatter('Mandos ({}) [%(process)d]:'
3115
 
                              ' %(levelname)s: %(message)s'.format(
 
3137
            logging.Formatter("Mandos ({}) [%(process)d]:"
 
3138
                              " %(levelname)s: %(message)s".format(
3116
3139
                                  server_settings["servicename"])))
3117
3140
 
3118
3141
    # Parse config file with clients
3178
3201
 
3179
3202
        @gnutls.log_func
3180
3203
        def debug_gnutls(level, string):
3181
 
            logger.debug("GnuTLS: %s", string[:-1])
 
3204
            logger.debug("GnuTLS: %s",
 
3205
                         string[:-1].decode("utf-8",
 
3206
                                            errors="replace"))
3182
3207
 
3183
3208
        gnutls.global_set_log_function(debug_gnutls)
3184
3209
 
3559
3584
 
3560
3585
        try:
3561
3586
            with tempfile.NamedTemporaryFile(
3562
 
                    mode='wb',
 
3587
                    mode="wb",
3563
3588
                    suffix=".pickle",
3564
 
                    prefix='clients-',
 
3589
                    prefix="clients-",
3565
3590
                    dir=os.path.dirname(stored_state_path),
3566
3591
                    delete=False) as stored_state:
3567
3592
                pickle.dump((clients, client_settings), stored_state,
3654
3679
 
3655
3680
def should_only_run_tests():
3656
3681
    parser = argparse.ArgumentParser(add_help=False)
3657
 
    parser.add_argument("--check", action='store_true')
 
3682
    parser.add_argument("--check", action="store_true")
3658
3683
    args, unknown_args = parser.parse_known_args()
3659
3684
    run_tests = args.check
3660
3685
    if run_tests:
3668
3693
    tests.addTests(doctest.DocTestSuite())
3669
3694
    return tests
3670
3695
 
3671
 
if __name__ == '__main__':
 
3696
if __name__ == "__main__":
3672
3697
    try:
3673
3698
        if should_only_run_tests():
3674
3699
            # Call using ./mandos --check [--verbose]