/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2024-09-08 05:08:20 UTC
  • Revision ID: teddy@recompile.se-20240908050820-jpkid6ufjb9n107o
http://bugs.debian.org/1079588
Fix #1079588 by not outputting to stdout in maintainer scripts

From The Debconf Programmer's Tutorial: "Anything your maintainer
scripts output to standard output is passed into the frontend as a
command".  We must make sure to redirect stdout to stderr for every
command in the postinst and postrm scripts which might output to
stdout.

* debian/mandos-client.postinst (update_initramfs): Add "1>&2" to
  invocations of update-initramfs and /etc/kernel/postinst.d/dracut.
  (add_mandos_user): Add "1>&2" to invocations of usermod, groupmod,
  and adduser.
  (create_keys): Add "1>&2" to invocations of mandos-keygen,
  gpg-connect-agent, certtool, and openssl.
  (create_dh_params): Add "1>&2" to invocations of certtool and
  openssl.  Add "--force" option to "rm".
* debian/mandos-client.postrm (update_initramfs): Add "1>&2" to
  invocations of update-initramfs and /etc/kernel/postinst.d/dracut.

Closes: #1079588
Reported-By: Ben Hutchings <ben@decadent.org.uk>

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
1
 
#!/usr/bin/python
2
 
# -*- mode: python; coding: utf-8 -*-
 
1
#!/usr/bin/python3 -bI
 
2
# -*- coding: utf-8; lexical-binding: t -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
 
# Copyright © 2008-2019 Teddy Hogeborn
15
 
# Copyright © 2008-2019 Björn Påhlsson
 
14
# Copyright © 2008-2022 Teddy Hogeborn
 
15
# Copyright © 2008-2022 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
 
 
35
34
from __future__ import (division, absolute_import, print_function,
36
35
                        unicode_literals)
37
36
 
40
39
except ImportError:
41
40
    pass
42
41
 
 
42
import sys
 
43
import unittest
 
44
import argparse
 
45
import logging
 
46
import os
43
47
try:
44
48
    import SocketServer as socketserver
45
49
except ImportError:
46
50
    import socketserver
47
51
import socket
48
 
import argparse
49
52
import datetime
50
53
import errno
51
54
try:
52
55
    import ConfigParser as configparser
53
56
except ImportError:
54
57
    import configparser
55
 
import sys
56
58
import re
57
 
import os
58
59
import signal
59
60
import subprocess
60
61
import atexit
61
62
import stat
62
 
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
 
80
import random
 
81
import shlex
80
82
 
81
83
import dbus
82
84
import dbus.service
88
90
import xml.dom.minidom
89
91
import inspect
90
92
 
 
93
if sys.version_info.major == 2:
 
94
    __metaclass__ = type
 
95
    str = unicode
 
96
    input = raw_input
 
97
 
 
98
# Add collections.abc.Callable if it does not exist
 
99
try:
 
100
    collections.abc.Callable
 
101
except AttributeError:
 
102
    class abc:
 
103
        Callable = collections.Callable
 
104
    collections.abc = abc
 
105
    del abc
 
106
 
 
107
# Add shlex.quote if it does not exist
 
108
try:
 
109
    shlex.quote
 
110
except AttributeError:
 
111
    shlex.quote = re.escape
 
112
 
 
113
# Show warnings by default
 
114
if not sys.warnoptions:
 
115
    import warnings
 
116
    warnings.simplefilter("default")
 
117
 
91
118
# Try to find the value of SO_BINDTODEVICE:
92
119
try:
93
120
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
113
140
            # No value found
114
141
            SO_BINDTODEVICE = None
115
142
 
116
 
if sys.version_info.major == 2:
117
 
    str = unicode
118
 
 
119
143
if sys.version_info < (3, 2):
120
144
    configparser.Configparser = configparser.SafeConfigParser
121
145
 
122
 
version = "1.8.7"
 
146
version = "1.8.16"
123
147
stored_state_file = "clients.pickle"
124
148
 
125
 
logger = logging.getLogger()
 
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
 
150
logging.captureWarnings(True)   # Show warnings via the logging system
126
151
syslogger = None
127
152
 
128
153
try:
164
189
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
165
190
        address="/dev/log"))
166
191
    syslogger.setFormatter(logging.Formatter
167
 
                           ('Mandos [%(process)d]: %(levelname)s:'
168
 
                            ' %(message)s'))
169
 
    logger.addHandler(syslogger)
 
192
                           ("Mandos [%(process)d]: %(levelname)s:"
 
193
                            " %(message)s"))
 
194
    log.addHandler(syslogger)
170
195
 
171
196
    if debug:
172
197
        console = logging.StreamHandler()
173
 
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
174
 
                                               ' [%(process)d]:'
175
 
                                               ' %(levelname)s:'
176
 
                                               ' %(message)s'))
177
 
        logger.addHandler(console)
178
 
    logger.setLevel(level)
 
198
        console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
 
199
                                               " [%(process)d]:"
 
200
                                               " %(levelname)s:"
 
201
                                               " %(message)s"))
 
202
        log.addHandler(console)
 
203
    log.setLevel(level)
179
204
 
180
205
 
181
206
class PGPError(Exception):
183
208
    pass
184
209
 
185
210
 
186
 
class PGPEngine(object):
 
211
class PGPEngine:
187
212
    """A simple class for OpenPGP symmetric encryption & decryption"""
188
213
 
189
214
    def __init__(self):
193
218
            output = subprocess.check_output(["gpgconf"])
194
219
            for line in output.splitlines():
195
220
                name, text, path = line.split(b":")
196
 
                if name == "gpg":
 
221
                if name == b"gpg":
197
222
                    self.gpg = path
198
223
                    break
199
224
        except OSError as e:
200
225
            if e.errno != errno.ENOENT:
201
226
                raise
202
 
        self.gnupgargs = ['--batch',
203
 
                          '--homedir', self.tempdir,
204
 
                          '--force-mdc',
205
 
                          '--quiet']
 
227
        self.gnupgargs = ["--batch",
 
228
                          "--homedir", self.tempdir,
 
229
                          "--force-mdc",
 
230
                          "--quiet"]
206
231
        # Only GPG version 1 has the --no-use-agent option.
207
 
        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
 
232
        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
208
233
            self.gnupgargs.append("--no-use-agent")
209
234
 
210
235
    def __enter__(self):
247
272
                dir=self.tempdir) as passfile:
248
273
            passfile.write(passphrase)
249
274
            passfile.flush()
250
 
            proc = subprocess.Popen([self.gpg, '--symmetric',
251
 
                                     '--passphrase-file',
 
275
            proc = subprocess.Popen([self.gpg, "--symmetric",
 
276
                                     "--passphrase-file",
252
277
                                     passfile.name]
253
278
                                    + self.gnupgargs,
254
279
                                    stdin=subprocess.PIPE,
265
290
                dir=self.tempdir) as passfile:
266
291
            passfile.write(passphrase)
267
292
            passfile.flush()
268
 
            proc = subprocess.Popen([self.gpg, '--decrypt',
269
 
                                     '--passphrase-file',
 
293
            proc = subprocess.Popen([self.gpg, "--decrypt",
 
294
                                     "--passphrase-file",
270
295
                                     passfile.name]
271
296
                                    + self.gnupgargs,
272
297
                                    stdin=subprocess.PIPE,
279
304
 
280
305
 
281
306
# Pretend that we have an Avahi module
282
 
class avahi(object):
 
307
class avahi:
283
308
    """This isn't so much a class as it is a module-like namespace."""
284
309
    IF_UNSPEC = -1               # avahi-common/address.h
285
310
    PROTO_UNSPEC = -1            # avahi-common/address.h
319
344
    pass
320
345
 
321
346
 
322
 
class AvahiService(object):
 
347
class AvahiService:
323
348
    """An Avahi (Zeroconf) service.
324
349
 
325
350
    Attributes:
326
351
    interface: integer; avahi.IF_UNSPEC or an interface index.
327
352
               Used to optionally bind to the specified interface.
328
 
    name: string; Example: 'Mandos'
329
 
    type: string; Example: '_mandos._tcp'.
 
353
    name: string; Example: "Mandos"
 
354
    type: string; Example: "_mandos._tcp".
330
355
     See <https://www.iana.org/assignments/service-names-port-numbers>
331
356
    port: integer; what port to announce
332
357
    TXT: list of strings; TXT record for the service
369
394
    def rename(self, remove=True):
370
395
        """Derived from the Avahi example code"""
371
396
        if self.rename_count >= self.max_renames:
372
 
            logger.critical("No suitable Zeroconf service name found"
373
 
                            " after %i retries, exiting.",
374
 
                            self.rename_count)
 
397
            log.critical("No suitable Zeroconf service name found"
 
398
                         " after %i retries, exiting.",
 
399
                         self.rename_count)
375
400
            raise AvahiServiceError("Too many renames")
376
401
        self.name = str(
377
402
            self.server.GetAlternativeServiceName(self.name))
378
403
        self.rename_count += 1
379
 
        logger.info("Changing Zeroconf service name to %r ...",
380
 
                    self.name)
 
404
        log.info("Changing Zeroconf service name to %r ...",
 
405
                 self.name)
381
406
        if remove:
382
407
            self.remove()
383
408
        try:
385
410
        except dbus.exceptions.DBusException as error:
386
411
            if (error.get_dbus_name()
387
412
                == "org.freedesktop.Avahi.CollisionError"):
388
 
                logger.info("Local Zeroconf service name collision.")
 
413
                log.info("Local Zeroconf service name collision.")
389
414
                return self.rename(remove=False)
390
415
            else:
391
 
                logger.critical("D-Bus Exception", exc_info=error)
 
416
                log.critical("D-Bus Exception", exc_info=error)
392
417
                self.cleanup()
393
418
                os._exit(1)
394
419
 
410
435
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
411
436
        self.entry_group_state_changed_match = (
412
437
            self.group.connect_to_signal(
413
 
                'StateChanged', self.entry_group_state_changed))
414
 
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
415
 
                     self.name, self.type)
 
438
                "StateChanged", self.entry_group_state_changed))
 
439
        log.debug("Adding Zeroconf service '%s' of type '%s' ...",
 
440
                  self.name, self.type)
416
441
        self.group.AddService(
417
442
            self.interface,
418
443
            self.protocol,
425
450
 
426
451
    def entry_group_state_changed(self, state, error):
427
452
        """Derived from the Avahi example code"""
428
 
        logger.debug("Avahi entry group state change: %i", state)
 
453
        log.debug("Avahi entry group state change: %i", state)
429
454
 
430
455
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
431
 
            logger.debug("Zeroconf service established.")
 
456
            log.debug("Zeroconf service established.")
432
457
        elif state == avahi.ENTRY_GROUP_COLLISION:
433
 
            logger.info("Zeroconf service name collision.")
 
458
            log.info("Zeroconf service name collision.")
434
459
            self.rename()
435
460
        elif state == avahi.ENTRY_GROUP_FAILURE:
436
 
            logger.critical("Avahi: Error in group state changed %s",
437
 
                            str(error))
 
461
            log.critical("Avahi: Error in group state changed %s",
 
462
                         str(error))
438
463
            raise AvahiGroupError("State changed: {!s}".format(error))
439
464
 
440
465
    def cleanup(self):
450
475
 
451
476
    def server_state_changed(self, state, error=None):
452
477
        """Derived from the Avahi example code"""
453
 
        logger.debug("Avahi server state change: %i", state)
 
478
        log.debug("Avahi server state change: %i", state)
454
479
        bad_states = {
455
480
            avahi.SERVER_INVALID: "Zeroconf server invalid",
456
481
            avahi.SERVER_REGISTERING: None,
460
485
        if state in bad_states:
461
486
            if bad_states[state] is not None:
462
487
                if error is None:
463
 
                    logger.error(bad_states[state])
 
488
                    log.error(bad_states[state])
464
489
                else:
465
 
                    logger.error(bad_states[state] + ": %r", error)
 
490
                    log.error(bad_states[state] + ": %r", error)
466
491
            self.cleanup()
467
492
        elif state == avahi.SERVER_RUNNING:
468
493
            try:
470
495
            except dbus.exceptions.DBusException as error:
471
496
                if (error.get_dbus_name()
472
497
                    == "org.freedesktop.Avahi.CollisionError"):
473
 
                    logger.info("Local Zeroconf service name"
474
 
                                " collision.")
 
498
                    log.info("Local Zeroconf service name collision.")
475
499
                    return self.rename(remove=False)
476
500
                else:
477
 
                    logger.critical("D-Bus Exception", exc_info=error)
 
501
                    log.critical("D-Bus Exception", exc_info=error)
478
502
                    self.cleanup()
479
503
                    os._exit(1)
480
504
        else:
481
505
            if error is None:
482
 
                logger.debug("Unknown state: %r", state)
 
506
                log.debug("Unknown state: %r", state)
483
507
            else:
484
 
                logger.debug("Unknown state: %r: %r", state, error)
 
508
                log.debug("Unknown state: %r: %r", state, error)
485
509
 
486
510
    def activate(self):
487
511
        """Derived from the Avahi example code"""
499
523
class AvahiServiceToSyslog(AvahiService):
500
524
    def rename(self, *args, **kwargs):
501
525
        """Add the new name to the syslog messages"""
502
 
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
 
526
        ret = super(AvahiServiceToSyslog, self).rename(*args,
 
527
                                                       **kwargs)
503
528
        syslogger.setFormatter(logging.Formatter(
504
 
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
 
529
            "Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
505
530
            .format(self.name)))
506
531
        return ret
507
532
 
508
533
 
509
534
# Pretend that we have a GnuTLS module
510
 
class gnutls(object):
 
535
class gnutls:
511
536
    """This isn't so much a class as it is a module-like namespace."""
512
537
 
513
538
    library = ctypes.util.find_library("gnutls")
537
562
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
538
563
 
539
564
    # Types
540
 
    class session_int(ctypes.Structure):
 
565
    class _session_int(ctypes.Structure):
541
566
        _fields_ = []
542
 
    session_t = ctypes.POINTER(session_int)
 
567
    session_t = ctypes.POINTER(_session_int)
543
568
 
544
569
    class certificate_credentials_st(ctypes.Structure):
545
570
        _fields_ = []
548
573
    certificate_type_t = ctypes.c_int
549
574
 
550
575
    class datum_t(ctypes.Structure):
551
 
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
552
 
                    ('size', ctypes.c_uint)]
 
576
        _fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
 
577
                    ("size", ctypes.c_uint)]
553
578
 
554
 
    class openpgp_crt_int(ctypes.Structure):
 
579
    class _openpgp_crt_int(ctypes.Structure):
555
580
        _fields_ = []
556
 
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
 
581
    openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
557
582
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
558
583
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
559
584
    credentials_type_t = ctypes.c_int
568
593
            # gnutls.strerror()
569
594
            self.code = code
570
595
            if message is None and code is not None:
571
 
                message = gnutls.strerror(code)
 
596
                message = gnutls.strerror(code).decode(
 
597
                    "utf-8", errors="replace")
572
598
            return super(gnutls.Error, self).__init__(
573
599
                message, *args)
574
600
 
575
601
    class CertificateSecurityError(Error):
576
602
        pass
577
603
 
 
604
    class PointerTo:
 
605
        def __init__(self, cls):
 
606
            self.cls = cls
 
607
 
 
608
        def from_param(self, obj):
 
609
            if not isinstance(obj, self.cls):
 
610
                raise TypeError("Not of type {}: {!r}"
 
611
                                .format(self.cls.__name__, obj))
 
612
            return ctypes.byref(obj.from_param(obj))
 
613
 
 
614
    class CastToVoidPointer:
 
615
        def __init__(self, cls):
 
616
            self.cls = cls
 
617
 
 
618
        def from_param(self, obj):
 
619
            if not isinstance(obj, self.cls):
 
620
                raise TypeError("Not of type {}: {!r}"
 
621
                                .format(self.cls.__name__, obj))
 
622
            return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
 
623
 
 
624
    class With_from_param:
 
625
        @classmethod
 
626
        def from_param(cls, obj):
 
627
            return obj._as_parameter_
 
628
 
578
629
    # Classes
579
 
    class Credentials(object):
 
630
    class Credentials(With_from_param):
580
631
        def __init__(self):
581
 
            self._c_object = gnutls.certificate_credentials_t()
582
 
            gnutls.certificate_allocate_credentials(
583
 
                ctypes.byref(self._c_object))
 
632
            self._as_parameter_ = gnutls.certificate_credentials_t()
 
633
            gnutls.certificate_allocate_credentials(self)
584
634
            self.type = gnutls.CRD_CERTIFICATE
585
635
 
586
636
        def __del__(self):
587
 
            gnutls.certificate_free_credentials(self._c_object)
 
637
            gnutls.certificate_free_credentials(self)
588
638
 
589
 
    class ClientSession(object):
 
639
    class ClientSession(With_from_param):
590
640
        def __init__(self, socket, credentials=None):
591
 
            self._c_object = gnutls.session_t()
 
641
            self._as_parameter_ = gnutls.session_t()
592
642
            gnutls_flags = gnutls.CLIENT
593
643
            if gnutls.check_version(b"3.5.6"):
594
644
                gnutls_flags |= gnutls.NO_TICKETS
595
645
            if gnutls.has_rawpk:
596
646
                gnutls_flags |= gnutls.ENABLE_RAWPK
597
 
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
 
647
            gnutls.init(self, gnutls_flags)
598
648
            del gnutls_flags
599
 
            gnutls.set_default_priority(self._c_object)
600
 
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
601
 
            gnutls.handshake_set_private_extensions(self._c_object,
602
 
                                                    True)
 
649
            gnutls.set_default_priority(self)
 
650
            gnutls.transport_set_ptr(self, socket.fileno())
 
651
            gnutls.handshake_set_private_extensions(self, True)
603
652
            self.socket = socket
604
653
            if credentials is None:
605
654
                credentials = gnutls.Credentials()
606
 
            gnutls.credentials_set(self._c_object, credentials.type,
607
 
                                   ctypes.cast(credentials._c_object,
608
 
                                               ctypes.c_void_p))
 
655
            gnutls.credentials_set(self, credentials.type,
 
656
                                   credentials)
609
657
            self.credentials = credentials
610
658
 
611
659
        def __del__(self):
612
 
            gnutls.deinit(self._c_object)
 
660
            gnutls.deinit(self)
613
661
 
614
662
        def handshake(self):
615
 
            return gnutls.handshake(self._c_object)
 
663
            return gnutls.handshake(self)
616
664
 
617
665
        def send(self, data):
618
666
            data = bytes(data)
619
667
            data_len = len(data)
620
668
            while data_len > 0:
621
 
                data_len -= gnutls.record_send(self._c_object,
622
 
                                               data[-data_len:],
 
669
                data_len -= gnutls.record_send(self, data[-data_len:],
623
670
                                               data_len)
624
671
 
625
672
        def bye(self):
626
 
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
 
673
            return gnutls.bye(self, gnutls.SHUT_RDWR)
627
674
 
628
675
    # Error handling functions
629
676
    def _error_code(result):
630
677
        """A function to raise exceptions on errors, suitable
631
 
        for the 'restype' attribute on ctypes functions"""
632
 
        if result >= 0:
 
678
        for the "restype" attribute on ctypes functions"""
 
679
        if result >= gnutls.E_SUCCESS:
633
680
            return result
634
681
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
635
682
            raise gnutls.CertificateSecurityError(code=result)
636
683
        raise gnutls.Error(code=result)
637
684
 
638
 
    def _retry_on_error(result, func, arguments):
 
685
    def _retry_on_error(result, func, arguments,
 
686
                        _error_code=_error_code):
639
687
        """A function to retry on some errors, suitable
640
 
        for the 'errcheck' attribute on ctypes functions"""
641
 
        while result < 0:
 
688
        for the "errcheck" attribute on ctypes functions"""
 
689
        while result < gnutls.E_SUCCESS:
642
690
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
643
691
                return _error_code(result)
644
692
            result = func(*arguments)
649
697
 
650
698
    # Functions
651
699
    priority_set_direct = _library.gnutls_priority_set_direct
652
 
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
 
700
    priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
653
701
                                    ctypes.POINTER(ctypes.c_char_p)]
654
702
    priority_set_direct.restype = _error_code
655
703
 
656
704
    init = _library.gnutls_init
657
 
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
 
705
    init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
658
706
    init.restype = _error_code
659
707
 
660
708
    set_default_priority = _library.gnutls_set_default_priority
661
 
    set_default_priority.argtypes = [session_t]
 
709
    set_default_priority.argtypes = [ClientSession]
662
710
    set_default_priority.restype = _error_code
663
711
 
664
712
    record_send = _library.gnutls_record_send
665
 
    record_send.argtypes = [session_t, ctypes.c_void_p,
 
713
    record_send.argtypes = [ClientSession, ctypes.c_void_p,
666
714
                            ctypes.c_size_t]
667
715
    record_send.restype = ctypes.c_ssize_t
668
716
    record_send.errcheck = _retry_on_error
670
718
    certificate_allocate_credentials = (
671
719
        _library.gnutls_certificate_allocate_credentials)
672
720
    certificate_allocate_credentials.argtypes = [
673
 
        ctypes.POINTER(certificate_credentials_t)]
 
721
        PointerTo(Credentials)]
674
722
    certificate_allocate_credentials.restype = _error_code
675
723
 
676
724
    certificate_free_credentials = (
677
725
        _library.gnutls_certificate_free_credentials)
678
 
    certificate_free_credentials.argtypes = [
679
 
        certificate_credentials_t]
 
726
    certificate_free_credentials.argtypes = [Credentials]
680
727
    certificate_free_credentials.restype = None
681
728
 
682
729
    handshake_set_private_extensions = (
683
730
        _library.gnutls_handshake_set_private_extensions)
684
 
    handshake_set_private_extensions.argtypes = [session_t,
 
731
    handshake_set_private_extensions.argtypes = [ClientSession,
685
732
                                                 ctypes.c_int]
686
733
    handshake_set_private_extensions.restype = None
687
734
 
688
735
    credentials_set = _library.gnutls_credentials_set
689
 
    credentials_set.argtypes = [session_t, credentials_type_t,
690
 
                                ctypes.c_void_p]
 
736
    credentials_set.argtypes = [ClientSession, credentials_type_t,
 
737
                                CastToVoidPointer(Credentials)]
691
738
    credentials_set.restype = _error_code
692
739
 
693
740
    strerror = _library.gnutls_strerror
695
742
    strerror.restype = ctypes.c_char_p
696
743
 
697
744
    certificate_type_get = _library.gnutls_certificate_type_get
698
 
    certificate_type_get.argtypes = [session_t]
 
745
    certificate_type_get.argtypes = [ClientSession]
699
746
    certificate_type_get.restype = _error_code
700
747
 
701
748
    certificate_get_peers = _library.gnutls_certificate_get_peers
702
 
    certificate_get_peers.argtypes = [session_t,
 
749
    certificate_get_peers.argtypes = [ClientSession,
703
750
                                      ctypes.POINTER(ctypes.c_uint)]
704
751
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
705
752
 
712
759
    global_set_log_function.restype = None
713
760
 
714
761
    deinit = _library.gnutls_deinit
715
 
    deinit.argtypes = [session_t]
 
762
    deinit.argtypes = [ClientSession]
716
763
    deinit.restype = None
717
764
 
718
765
    handshake = _library.gnutls_handshake
719
 
    handshake.argtypes = [session_t]
720
 
    handshake.restype = _error_code
 
766
    handshake.argtypes = [ClientSession]
 
767
    handshake.restype = ctypes.c_int
721
768
    handshake.errcheck = _retry_on_error
722
769
 
723
770
    transport_set_ptr = _library.gnutls_transport_set_ptr
724
 
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
 
771
    transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
725
772
    transport_set_ptr.restype = None
726
773
 
727
774
    bye = _library.gnutls_bye
728
 
    bye.argtypes = [session_t, close_request_t]
729
 
    bye.restype = _error_code
 
775
    bye.argtypes = [ClientSession, close_request_t]
 
776
    bye.restype = ctypes.c_int
730
777
    bye.errcheck = _retry_on_error
731
778
 
732
779
    check_version = _library.gnutls_check_version
749
796
 
750
797
        x509_crt_fmt_t = ctypes.c_int
751
798
 
752
 
        # All the function declarations below are from gnutls/abstract.h
 
799
        # All the function declarations below are from
 
800
        # gnutls/abstract.h
753
801
        pubkey_init = _library.gnutls_pubkey_init
754
802
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
755
803
        pubkey_init.restype = _error_code
769
817
        pubkey_deinit.argtypes = [pubkey_t]
770
818
        pubkey_deinit.restype = None
771
819
    else:
772
 
        # All the function declarations below are from gnutls/openpgp.h
 
820
        # All the function declarations below are from
 
821
        # gnutls/openpgp.h
773
822
 
774
823
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
775
824
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
781
830
                                       openpgp_crt_fmt_t]
782
831
        openpgp_crt_import.restype = _error_code
783
832
 
784
 
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
785
 
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
786
 
                                            ctypes.POINTER(ctypes.c_uint)]
 
833
        openpgp_crt_verify_self = \
 
834
            _library.gnutls_openpgp_crt_verify_self
 
835
        openpgp_crt_verify_self.argtypes = [
 
836
            openpgp_crt_t,
 
837
            ctypes.c_uint,
 
838
            ctypes.POINTER(ctypes.c_uint),
 
839
        ]
787
840
        openpgp_crt_verify_self.restype = _error_code
788
841
 
789
842
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
800
853
 
801
854
    if check_version(b"3.6.4"):
802
855
        certificate_type_get2 = _library.gnutls_certificate_type_get2
803
 
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
 
856
        certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
804
857
        certificate_type_get2.restype = _error_code
805
858
 
806
859
    # Remove non-public functions
818
871
    connection.close()
819
872
 
820
873
 
821
 
class Client(object):
 
874
class Client:
822
875
    """A representation of a client host served by this server.
823
876
 
824
877
    Attributes:
825
 
    approved:   bool(); 'None' if not yet approved/disapproved
 
878
    approved:   bool(); None if not yet approved/disapproved
826
879
    approval_delay: datetime.timedelta(); Time to wait for approval
827
880
    approval_duration: datetime.timedelta(); Duration of one approval
828
881
    checker: multiprocessing.Process(); a running checker process used
829
 
             to see if the client lives. 'None' if no process is
 
882
             to see if the client lives. None if no process is
830
883
             running.
831
884
    checker_callback_tag: a GLib event source tag, or None
832
885
    checker_command: string; External command which is run to check
908
961
            # key_id() and fingerprint() functions
909
962
            client["key_id"] = (section.get("key_id", "").upper()
910
963
                                .replace(" ", ""))
911
 
            client["fingerprint"] = (section["fingerprint"].upper()
 
964
            client["fingerprint"] = (section.get("fingerprint",
 
965
                                                 "").upper()
912
966
                                     .replace(" ", ""))
 
967
            if not (client["key_id"] or client["fingerprint"]):
 
968
                log.error("Skipping client %s without key_id or"
 
969
                          " fingerprint", client_name)
 
970
                del settings[client_name]
 
971
                continue
913
972
            if "secret" in section:
914
973
                client["secret"] = codecs.decode(section["secret"]
915
974
                                                 .encode("utf-8"),
956
1015
            self.last_enabled = None
957
1016
            self.expires = None
958
1017
 
959
 
        logger.debug("Creating client %r", self.name)
960
 
        logger.debug("  Key ID: %s", self.key_id)
961
 
        logger.debug("  Fingerprint: %s", self.fingerprint)
 
1018
        log.debug("Creating client %r", self.name)
 
1019
        log.debug("  Key ID: %s", self.key_id)
 
1020
        log.debug("  Fingerprint: %s", self.fingerprint)
962
1021
        self.created = settings.get("created",
963
1022
                                    datetime.datetime.utcnow())
964
1023
 
992
1051
        if getattr(self, "enabled", False):
993
1052
            # Already enabled
994
1053
            return
995
 
        self.expires = datetime.datetime.utcnow() + self.timeout
996
1054
        self.enabled = True
997
1055
        self.last_enabled = datetime.datetime.utcnow()
998
1056
        self.init_checker()
1003
1061
        if not getattr(self, "enabled", False):
1004
1062
            return False
1005
1063
        if not quiet:
1006
 
            logger.info("Disabling client %s", self.name)
 
1064
            log.info("Disabling client %s", self.name)
1007
1065
        if getattr(self, "disable_initiator_tag", None) is not None:
1008
1066
            GLib.source_remove(self.disable_initiator_tag)
1009
1067
            self.disable_initiator_tag = None
1021
1079
    def __del__(self):
1022
1080
        self.disable()
1023
1081
 
1024
 
    def init_checker(self):
1025
 
        # Schedule a new checker to be started an 'interval' from now,
1026
 
        # and every interval from then on.
 
1082
    def init_checker(self, randomize_start=False):
 
1083
        # Schedule a new checker to be started a randomly selected
 
1084
        # time (a fraction of 'interval') from now.  This spreads out
 
1085
        # the startup of checkers over time when the server is
 
1086
        # started.
1027
1087
        if self.checker_initiator_tag is not None:
1028
1088
            GLib.source_remove(self.checker_initiator_tag)
 
1089
        interval_milliseconds = int(self.interval.total_seconds()
 
1090
                                    * 1000)
 
1091
        if randomize_start:
 
1092
            delay_milliseconds = random.randrange(
 
1093
                interval_milliseconds + 1)
 
1094
        else:
 
1095
            delay_milliseconds = interval_milliseconds
1029
1096
        self.checker_initiator_tag = GLib.timeout_add(
1030
 
            int(self.interval.total_seconds() * 1000),
1031
 
            self.start_checker)
1032
 
        # Schedule a disable() when 'timeout' has passed
 
1097
            delay_milliseconds, self.start_checker, randomize_start)
 
1098
        delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
 
1099
        # A checker might take up to an 'interval' of time, so we can
 
1100
        # expire at the soonest one interval after a checker was
 
1101
        # started.  Since the initial checker is delayed, the expire
 
1102
        # time might have to be extended.
 
1103
        now = datetime.datetime.utcnow()
 
1104
        self.expires = now + delay + self.interval
 
1105
        # Schedule a disable() at expire time
1033
1106
        if self.disable_initiator_tag is not None:
1034
1107
            GLib.source_remove(self.disable_initiator_tag)
1035
1108
        self.disable_initiator_tag = GLib.timeout_add(
1036
 
            int(self.timeout.total_seconds() * 1000), self.disable)
1037
 
        # Also start a new checker *right now*.
1038
 
        self.start_checker()
 
1109
            int((self.expires - now).total_seconds() * 1000),
 
1110
            self.disable)
1039
1111
 
1040
1112
    def checker_callback(self, source, condition, connection,
1041
1113
                         command):
1043
1115
        # Read return code from connection (see call_pipe)
1044
1116
        returncode = connection.recv()
1045
1117
        connection.close()
1046
 
        self.checker.join()
 
1118
        if self.checker is not None:
 
1119
            self.checker.join()
1047
1120
        self.checker_callback_tag = None
1048
1121
        self.checker = None
1049
1122
 
1051
1124
            self.last_checker_status = returncode
1052
1125
            self.last_checker_signal = None
1053
1126
            if self.last_checker_status == 0:
1054
 
                logger.info("Checker for %(name)s succeeded",
1055
 
                            vars(self))
 
1127
                log.info("Checker for %(name)s succeeded", vars(self))
1056
1128
                self.checked_ok()
1057
1129
            else:
1058
 
                logger.info("Checker for %(name)s failed", vars(self))
 
1130
                log.info("Checker for %(name)s failed", vars(self))
1059
1131
        else:
1060
1132
            self.last_checker_status = -1
1061
1133
            self.last_checker_signal = -returncode
1062
 
            logger.warning("Checker for %(name)s crashed?",
1063
 
                           vars(self))
 
1134
            log.warning("Checker for %(name)s crashed?", vars(self))
1064
1135
        return False
1065
1136
 
1066
1137
    def checked_ok(self):
1085
1156
    def need_approval(self):
1086
1157
        self.last_approval_request = datetime.datetime.utcnow()
1087
1158
 
1088
 
    def start_checker(self):
 
1159
    def start_checker(self, start_was_randomized=False):
1089
1160
        """Start a new checker subprocess if one is not running.
1090
1161
 
1091
1162
        If a checker already exists, leave it running and do
1100
1171
        # should be.
1101
1172
 
1102
1173
        if self.checker is not None and not self.checker.is_alive():
1103
 
            logger.warning("Checker was not alive; joining")
 
1174
            log.warning("Checker was not alive; joining")
1104
1175
            self.checker.join()
1105
1176
            self.checker = None
1106
1177
        # Start a new checker if needed
1107
1178
        if self.checker is None:
1108
1179
            # Escape attributes for the shell
1109
1180
            escaped_attrs = {
1110
 
                attr: re.escape(str(getattr(self, attr)))
 
1181
                attr: shlex.quote(str(getattr(self, attr)))
1111
1182
                for attr in self.runtime_expansions}
1112
1183
            try:
1113
1184
                command = self.checker_command % escaped_attrs
1114
1185
            except TypeError as error:
1115
 
                logger.error('Could not format string "%s"',
1116
 
                             self.checker_command,
1117
 
                             exc_info=error)
 
1186
                log.error('Could not format string "%s"',
 
1187
                          self.checker_command, exc_info=error)
1118
1188
                return True     # Try again later
1119
1189
            self.current_checker_command = command
1120
 
            logger.info("Starting checker %r for %s", command,
1121
 
                        self.name)
 
1190
            log.info("Starting checker %r for %s", command, self.name)
1122
1191
            # We don't need to redirect stdout and stderr, since
1123
1192
            # in normal mode, that is already done by daemon(),
1124
1193
            # and in debug mode we don't want to.  (Stdin is
1140
1209
                kwargs=popen_args)
1141
1210
            self.checker.start()
1142
1211
            self.checker_callback_tag = GLib.io_add_watch(
1143
 
                pipe[0].fileno(), GLib.IO_IN,
 
1212
                GLib.IOChannel.unix_new(pipe[0].fileno()),
 
1213
                GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1144
1214
                self.checker_callback, pipe[0], command)
 
1215
        if start_was_randomized:
 
1216
            # We were started after a random delay; Schedule a new
 
1217
            # checker to be started an 'interval' from now, and every
 
1218
            # interval from then on.
 
1219
            now = datetime.datetime.utcnow()
 
1220
            self.checker_initiator_tag = GLib.timeout_add(
 
1221
                int(self.interval.total_seconds() * 1000),
 
1222
                self.start_checker)
 
1223
            self.expires = max(self.expires, now + self.interval)
 
1224
            # Don't start a new checker again after same random delay
 
1225
            return False
1145
1226
        # Re-run this periodically if run by GLib.timeout_add
1146
1227
        return True
1147
1228
 
1152
1233
            self.checker_callback_tag = None
1153
1234
        if getattr(self, "checker", None) is None:
1154
1235
            return
1155
 
        logger.debug("Stopping checker for %(name)s", vars(self))
 
1236
        log.debug("Stopping checker for %(name)s", vars(self))
1156
1237
        self.checker.terminate()
1157
1238
        self.checker = None
1158
1239
 
1185
1266
        func._dbus_name = func.__name__
1186
1267
        if func._dbus_name.endswith("_dbus_property"):
1187
1268
            func._dbus_name = func._dbus_name[:-14]
1188
 
        func._dbus_get_args_options = {'byte_arrays': byte_arrays}
 
1269
        func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1189
1270
        return func
1190
1271
 
1191
1272
    return decorator
1280
1361
 
1281
1362
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1282
1363
                         out_signature="s",
1283
 
                         path_keyword='object_path',
1284
 
                         connection_keyword='connection')
 
1364
                         path_keyword="object_path",
 
1365
                         connection_keyword="connection")
1285
1366
    def Introspect(self, object_path, connection):
1286
1367
        """Overloading of standard D-Bus method.
1287
1368
 
1336
1417
            document.unlink()
1337
1418
        except (AttributeError, xml.dom.DOMException,
1338
1419
                xml.parsers.expat.ExpatError) as error:
1339
 
            logger.error("Failed to override Introspection method",
1340
 
                         exc_info=error)
 
1420
            log.error("Failed to override Introspection method",
 
1421
                      exc_info=error)
1341
1422
        return xmlstring
1342
1423
 
1343
1424
 
1401
1482
                raise ValueError("Byte arrays not supported for non-"
1402
1483
                                 "'ay' signature {!r}"
1403
1484
                                 .format(prop._dbus_signature))
1404
 
            value = dbus.ByteArray(b''.join(chr(byte)
1405
 
                                            for byte in value))
 
1485
            value = dbus.ByteArray(bytes(value))
1406
1486
        prop(value)
1407
1487
 
1408
1488
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1441
1521
 
1442
1522
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1443
1523
                         out_signature="s",
1444
 
                         path_keyword='object_path',
1445
 
                         connection_keyword='connection')
 
1524
                         path_keyword="object_path",
 
1525
                         connection_keyword="connection")
1446
1526
    def Introspect(self, object_path, connection):
1447
1527
        """Overloading of standard D-Bus method.
1448
1528
 
1504
1584
            document.unlink()
1505
1585
        except (AttributeError, xml.dom.DOMException,
1506
1586
                xml.parsers.expat.ExpatError) as error:
1507
 
            logger.error("Failed to override Introspection method",
1508
 
                         exc_info=error)
 
1587
            log.error("Failed to override Introspection method",
 
1588
                      exc_info=error)
1509
1589
        return xmlstring
1510
1590
 
1511
1591
 
1543
1623
 
1544
1624
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1545
1625
                         out_signature="s",
1546
 
                         path_keyword='object_path',
1547
 
                         connection_keyword='connection')
 
1626
                         path_keyword="object_path",
 
1627
                         connection_keyword="connection")
1548
1628
    def Introspect(self, object_path, connection):
1549
1629
        """Overloading of standard D-Bus method.
1550
1630
 
1575
1655
            document.unlink()
1576
1656
        except (AttributeError, xml.dom.DOMException,
1577
1657
                xml.parsers.expat.ExpatError) as error:
1578
 
            logger.error("Failed to override Introspection method",
1579
 
                         exc_info=error)
 
1658
            log.error("Failed to override Introspection method",
 
1659
                      exc_info=error)
1580
1660
        return xmlstring
1581
1661
 
1582
1662
 
2213
2293
    del _interface
2214
2294
 
2215
2295
 
2216
 
class ProxyClient(object):
 
2296
class ProxyClient:
2217
2297
    def __init__(self, child_pipe, key_id, fpr, address):
2218
2298
        self._pipe = child_pipe
2219
 
        self._pipe.send(('init', key_id, fpr, address))
 
2299
        self._pipe.send(("init", key_id, fpr, address))
2220
2300
        if not self._pipe.recv():
2221
2301
            raise KeyError(key_id or fpr)
2222
2302
 
2223
2303
    def __getattribute__(self, name):
2224
 
        if name == '_pipe':
 
2304
        if name == "_pipe":
2225
2305
            return super(ProxyClient, self).__getattribute__(name)
2226
 
        self._pipe.send(('getattr', name))
 
2306
        self._pipe.send(("getattr", name))
2227
2307
        data = self._pipe.recv()
2228
 
        if data[0] == 'data':
 
2308
        if data[0] == "data":
2229
2309
            return data[1]
2230
 
        if data[0] == 'function':
 
2310
        if data[0] == "function":
2231
2311
 
2232
2312
            def func(*args, **kwargs):
2233
 
                self._pipe.send(('funcall', name, args, kwargs))
 
2313
                self._pipe.send(("funcall", name, args, kwargs))
2234
2314
                return self._pipe.recv()[1]
2235
2315
 
2236
2316
            return func
2237
2317
 
2238
2318
    def __setattr__(self, name, value):
2239
 
        if name == '_pipe':
 
2319
        if name == "_pipe":
2240
2320
            return super(ProxyClient, self).__setattr__(name, value)
2241
 
        self._pipe.send(('setattr', name, value))
 
2321
        self._pipe.send(("setattr", name, value))
2242
2322
 
2243
2323
 
2244
2324
class ClientHandler(socketserver.BaseRequestHandler, object):
2249
2329
 
2250
2330
    def handle(self):
2251
2331
        with contextlib.closing(self.server.child_pipe) as child_pipe:
2252
 
            logger.info("TCP connection from: %s",
2253
 
                        str(self.client_address))
2254
 
            logger.debug("Pipe FD: %d",
2255
 
                         self.server.child_pipe.fileno())
 
2332
            log.info("TCP connection from: %s",
 
2333
                     str(self.client_address))
 
2334
            log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2256
2335
 
2257
2336
            session = gnutls.ClientSession(self.request)
2258
2337
 
2259
 
            # priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
2338
            # priority = ":".join(("NONE", "+VERS-TLS1.1",
2260
2339
            #                       "+AES-256-CBC", "+SHA1",
2261
2340
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
2262
2341
            #                       "+DHE-DSS"))
2264
2343
            priority = self.server.gnutls_priority
2265
2344
            if priority is None:
2266
2345
                priority = "NORMAL"
2267
 
            gnutls.priority_set_direct(session._c_object,
2268
 
                                       priority.encode("utf-8"),
2269
 
                                       None)
 
2346
            gnutls.priority_set_direct(session,
 
2347
                                       priority.encode("utf-8"), None)
2270
2348
 
2271
2349
            # Start communication using the Mandos protocol
2272
2350
            # Get protocol number
2273
2351
            line = self.request.makefile().readline()
2274
 
            logger.debug("Protocol version: %r", line)
 
2352
            log.debug("Protocol version: %r", line)
2275
2353
            try:
2276
2354
                if int(line.strip().split()[0]) > 1:
2277
2355
                    raise RuntimeError(line)
2278
2356
            except (ValueError, IndexError, RuntimeError) as error:
2279
 
                logger.error("Unknown protocol version: %s", error)
 
2357
                log.error("Unknown protocol version: %s", error)
2280
2358
                return
2281
2359
 
2282
2360
            # Start GnuTLS connection
2283
2361
            try:
2284
2362
                session.handshake()
2285
2363
            except gnutls.Error as error:
2286
 
                logger.warning("Handshake failed: %s", error)
 
2364
                log.warning("Handshake failed: %s", error)
2287
2365
                # Do not run session.bye() here: the session is not
2288
2366
                # established.  Just abandon the request.
2289
2367
                return
2290
 
            logger.debug("Handshake succeeded")
 
2368
            log.debug("Handshake succeeded")
2291
2369
 
2292
2370
            approval_required = False
2293
2371
            try:
2297
2375
                        key_id = self.key_id(
2298
2376
                            self.peer_certificate(session))
2299
2377
                    except (TypeError, gnutls.Error) as error:
2300
 
                        logger.warning("Bad certificate: %s", error)
 
2378
                        log.warning("Bad certificate: %s", error)
2301
2379
                        return
2302
 
                    logger.debug("Key ID: %s", key_id)
 
2380
                    log.debug("Key ID: %s",
 
2381
                              key_id.decode("utf-8",
 
2382
                                            errors="replace"))
2303
2383
 
2304
2384
                else:
2305
2385
                    key_id = b""
2307
2387
                        fpr = self.fingerprint(
2308
2388
                            self.peer_certificate(session))
2309
2389
                    except (TypeError, gnutls.Error) as error:
2310
 
                        logger.warning("Bad certificate: %s", error)
 
2390
                        log.warning("Bad certificate: %s", error)
2311
2391
                        return
2312
 
                    logger.debug("Fingerprint: %s", fpr)
 
2392
                    log.debug("Fingerprint: %s", fpr)
2313
2393
 
2314
2394
                try:
2315
2395
                    client = ProxyClient(child_pipe, key_id, fpr,
2324
2404
 
2325
2405
                while True:
2326
2406
                    if not client.enabled:
2327
 
                        logger.info("Client %s is disabled",
2328
 
                                    client.name)
 
2407
                        log.info("Client %s is disabled", client.name)
2329
2408
                        if self.server.use_dbus:
2330
2409
                            # Emit D-Bus signal
2331
2410
                            client.Rejected("Disabled")
2335
2414
                        # We are approved or approval is disabled
2336
2415
                        break
2337
2416
                    elif client.approved is None:
2338
 
                        logger.info("Client %s needs approval",
2339
 
                                    client.name)
 
2417
                        log.info("Client %s needs approval",
 
2418
                                 client.name)
2340
2419
                        if self.server.use_dbus:
2341
2420
                            # Emit D-Bus signal
2342
2421
                            client.NeedApproval(
2343
2422
                                client.approval_delay.total_seconds()
2344
2423
                                * 1000, client.approved_by_default)
2345
2424
                    else:
2346
 
                        logger.warning("Client %s was not approved",
2347
 
                                       client.name)
 
2425
                        log.warning("Client %s was not approved",
 
2426
                                    client.name)
2348
2427
                        if self.server.use_dbus:
2349
2428
                            # Emit D-Bus signal
2350
2429
                            client.Rejected("Denied")
2358
2437
                    time2 = datetime.datetime.now()
2359
2438
                    if (time2 - time) >= delay:
2360
2439
                        if not client.approved_by_default:
2361
 
                            logger.warning("Client %s timed out while"
2362
 
                                           " waiting for approval",
2363
 
                                           client.name)
 
2440
                            log.warning("Client %s timed out while"
 
2441
                                        " waiting for approval",
 
2442
                                        client.name)
2364
2443
                            if self.server.use_dbus:
2365
2444
                                # Emit D-Bus signal
2366
2445
                                client.Rejected("Approval timed out")
2373
2452
                try:
2374
2453
                    session.send(client.secret)
2375
2454
                except gnutls.Error as error:
2376
 
                    logger.warning("gnutls send failed",
2377
 
                                   exc_info=error)
 
2455
                    log.warning("gnutls send failed", exc_info=error)
2378
2456
                    return
2379
2457
 
2380
 
                logger.info("Sending secret to %s", client.name)
 
2458
                log.info("Sending secret to %s", client.name)
2381
2459
                # bump the timeout using extended_timeout
2382
2460
                client.bump_timeout(client.extended_timeout)
2383
2461
                if self.server.use_dbus:
2390
2468
                try:
2391
2469
                    session.bye()
2392
2470
                except gnutls.Error as error:
2393
 
                    logger.warning("GnuTLS bye failed",
2394
 
                                   exc_info=error)
 
2471
                    log.warning("GnuTLS bye failed", exc_info=error)
2395
2472
 
2396
2473
    @staticmethod
2397
2474
    def peer_certificate(session):
2398
2475
        "Return the peer's certificate as a bytestring"
2399
2476
        try:
2400
 
            cert_type = gnutls.certificate_type_get2(session._c_object,
2401
 
                                                     gnutls.CTYPE_PEERS)
 
2477
            cert_type = gnutls.certificate_type_get2(
 
2478
                session, gnutls.CTYPE_PEERS)
2402
2479
        except AttributeError:
2403
 
            cert_type = gnutls.certificate_type_get(session._c_object)
 
2480
            cert_type = gnutls.certificate_type_get(session)
2404
2481
        if gnutls.has_rawpk:
2405
2482
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2406
2483
        else:
2407
2484
            valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2408
2485
        # If not a valid certificate type...
2409
2486
        if cert_type not in valid_cert_types:
2410
 
            logger.info("Cert type %r not in %r", cert_type,
2411
 
                        valid_cert_types)
 
2487
            log.info("Cert type %r not in %r", cert_type,
 
2488
                     valid_cert_types)
2412
2489
            # ...return invalid data
2413
2490
            return b""
2414
2491
        list_size = ctypes.c_uint(1)
2415
2492
        cert_list = (gnutls.certificate_get_peers
2416
 
                     (session._c_object, ctypes.byref(list_size)))
 
2493
                     (session, ctypes.byref(list_size)))
2417
2494
        if not bool(cert_list) and list_size.value != 0:
2418
2495
            raise gnutls.Error("error getting peer certificate")
2419
2496
        if list_size.value == 0:
2441
2518
        buf = ctypes.create_string_buffer(32)
2442
2519
        buf_len = ctypes.c_size_t(len(buf))
2443
2520
        # Get the key ID from the raw public key into the buffer
2444
 
        gnutls.pubkey_get_key_id(pubkey,
2445
 
                                 gnutls.KEYID_USE_SHA256,
2446
 
                                 ctypes.cast(ctypes.byref(buf),
2447
 
                                             ctypes.POINTER(ctypes.c_ubyte)),
2448
 
                                 ctypes.byref(buf_len))
 
2521
        gnutls.pubkey_get_key_id(
 
2522
            pubkey,
 
2523
            gnutls.KEYID_USE_SHA256,
 
2524
            ctypes.cast(ctypes.byref(buf),
 
2525
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2526
            ctypes.byref(buf_len))
2449
2527
        # Deinit the certificate
2450
2528
        gnutls.pubkey_deinit(pubkey)
2451
2529
 
2492
2570
        return hex_fpr
2493
2571
 
2494
2572
 
2495
 
class MultiprocessingMixIn(object):
 
2573
class MultiprocessingMixIn:
2496
2574
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
2497
2575
 
2498
2576
    def sub_process_main(self, request, address):
2510
2588
        return proc
2511
2589
 
2512
2590
 
2513
 
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
2591
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2514
2592
    """ adds a pipe to the MixIn """
2515
2593
 
2516
2594
    def process_request(self, request, client_address):
2531
2609
 
2532
2610
 
2533
2611
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2534
 
                     socketserver.TCPServer, object):
2535
 
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
2612
                     socketserver.TCPServer):
 
2613
    """IPv6-capable TCP server.  Accepts None as address and/or port
2536
2614
 
2537
2615
    Attributes:
2538
2616
        enabled:        Boolean; whether this server is activated yet
2589
2667
            if SO_BINDTODEVICE is None:
2590
2668
                # Fall back to a hard-coded value which seems to be
2591
2669
                # common enough.
2592
 
                logger.warning("SO_BINDTODEVICE not found, trying 25")
 
2670
                log.warning("SO_BINDTODEVICE not found, trying 25")
2593
2671
                SO_BINDTODEVICE = 25
2594
2672
            try:
2595
2673
                self.socket.setsockopt(
2597
2675
                    (self.interface + "\0").encode("utf-8"))
2598
2676
            except socket.error as error:
2599
2677
                if error.errno == errno.EPERM:
2600
 
                    logger.error("No permission to bind to"
2601
 
                                 " interface %s", self.interface)
 
2678
                    log.error("No permission to bind to interface %s",
 
2679
                              self.interface)
2602
2680
                elif error.errno == errno.ENOPROTOOPT:
2603
 
                    logger.error("SO_BINDTODEVICE not available;"
2604
 
                                 " cannot bind to interface %s",
2605
 
                                 self.interface)
 
2681
                    log.error("SO_BINDTODEVICE not available; cannot"
 
2682
                              " bind to interface %s", self.interface)
2606
2683
                elif error.errno == errno.ENODEV:
2607
 
                    logger.error("Interface %s does not exist,"
2608
 
                                 " cannot bind", self.interface)
 
2684
                    log.error("Interface %s does not exist, cannot"
 
2685
                              " bind", self.interface)
2609
2686
                else:
2610
2687
                    raise
2611
2688
        # Only bind(2) the socket if we really need to.
2670
2747
    def add_pipe(self, parent_pipe, proc):
2671
2748
        # Call "handle_ipc" for both data and EOF events
2672
2749
        GLib.io_add_watch(
2673
 
            parent_pipe.fileno(),
2674
 
            GLib.IO_IN | GLib.IO_HUP,
 
2750
            GLib.IOChannel.unix_new(parent_pipe.fileno()),
 
2751
            GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2675
2752
            functools.partial(self.handle_ipc,
2676
2753
                              parent_pipe=parent_pipe,
2677
2754
                              proc=proc))
2690
2767
        request = parent_pipe.recv()
2691
2768
        command = request[0]
2692
2769
 
2693
 
        if command == 'init':
 
2770
        if command == "init":
2694
2771
            key_id = request[1].decode("ascii")
2695
2772
            fpr = request[2].decode("ascii")
2696
2773
            address = request[3]
2697
2774
 
2698
2775
            for c in self.clients.values():
2699
 
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
 
2776
                if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
 
2777
                              "27AE41E4649B934CA495991B7852B855"):
2700
2778
                    continue
2701
2779
                if key_id and c.key_id == key_id:
2702
2780
                    client = c
2705
2783
                    client = c
2706
2784
                    break
2707
2785
            else:
2708
 
                logger.info("Client not found for key ID: %s, address"
2709
 
                            ": %s", key_id or fpr, address)
 
2786
                log.info("Client not found for key ID: %s, address:"
 
2787
                         " %s", key_id or fpr, address)
2710
2788
                if self.use_dbus:
2711
2789
                    # Emit D-Bus signal
2712
2790
                    mandos_dbus_service.ClientNotFound(key_id or fpr,
2715
2793
                return False
2716
2794
 
2717
2795
            GLib.io_add_watch(
2718
 
                parent_pipe.fileno(),
2719
 
                GLib.IO_IN | GLib.IO_HUP,
 
2796
                GLib.IOChannel.unix_new(parent_pipe.fileno()),
 
2797
                GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2720
2798
                functools.partial(self.handle_ipc,
2721
2799
                                  parent_pipe=parent_pipe,
2722
2800
                                  proc=proc,
2725
2803
            # remove the old hook in favor of the new above hook on
2726
2804
            # same fileno
2727
2805
            return False
2728
 
        if command == 'funcall':
 
2806
        if command == "funcall":
2729
2807
            funcname = request[1]
2730
2808
            args = request[2]
2731
2809
            kwargs = request[3]
2732
2810
 
2733
 
            parent_pipe.send(('data', getattr(client_object,
 
2811
            parent_pipe.send(("data", getattr(client_object,
2734
2812
                                              funcname)(*args,
2735
2813
                                                        **kwargs)))
2736
2814
 
2737
 
        if command == 'getattr':
 
2815
        if command == "getattr":
2738
2816
            attrname = request[1]
2739
2817
            if isinstance(client_object.__getattribute__(attrname),
2740
 
                          collections.Callable):
2741
 
                parent_pipe.send(('function', ))
 
2818
                          collections.abc.Callable):
 
2819
                parent_pipe.send(("function", ))
2742
2820
            else:
2743
2821
                parent_pipe.send((
2744
 
                    'data', client_object.__getattribute__(attrname)))
 
2822
                    "data", client_object.__getattribute__(attrname)))
2745
2823
 
2746
 
        if command == 'setattr':
 
2824
        if command == "setattr":
2747
2825
            attrname = request[1]
2748
2826
            value = request[2]
2749
2827
            setattr(client_object, attrname, value)
2754
2832
def rfc3339_duration_to_delta(duration):
2755
2833
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2756
2834
 
2757
 
    >>> rfc3339_duration_to_delta("P7D")
2758
 
    datetime.timedelta(7)
2759
 
    >>> rfc3339_duration_to_delta("PT60S")
2760
 
    datetime.timedelta(0, 60)
2761
 
    >>> rfc3339_duration_to_delta("PT60M")
2762
 
    datetime.timedelta(0, 3600)
2763
 
    >>> rfc3339_duration_to_delta("PT24H")
2764
 
    datetime.timedelta(1)
2765
 
    >>> rfc3339_duration_to_delta("P1W")
2766
 
    datetime.timedelta(7)
2767
 
    >>> rfc3339_duration_to_delta("PT5M30S")
2768
 
    datetime.timedelta(0, 330)
2769
 
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2770
 
    datetime.timedelta(1, 200)
 
2835
    >>> timedelta = datetime.timedelta
 
2836
    >>> rfc3339_duration_to_delta("P7D") == timedelta(7)
 
2837
    True
 
2838
    >>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
 
2839
    True
 
2840
    >>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
 
2841
    True
 
2842
    >>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
 
2843
    True
 
2844
    >>> rfc3339_duration_to_delta("P1W") == timedelta(7)
 
2845
    True
 
2846
    >>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
 
2847
    True
 
2848
    >>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
 
2849
    True
 
2850
    >>> del timedelta
2771
2851
    """
2772
2852
 
2773
2853
    # Parsing an RFC 3339 duration with regular expressions is not
2853
2933
def string_to_delta(interval):
2854
2934
    """Parse a string and return a datetime.timedelta
2855
2935
 
2856
 
    >>> string_to_delta('7d')
2857
 
    datetime.timedelta(7)
2858
 
    >>> string_to_delta('60s')
2859
 
    datetime.timedelta(0, 60)
2860
 
    >>> string_to_delta('60m')
2861
 
    datetime.timedelta(0, 3600)
2862
 
    >>> string_to_delta('24h')
2863
 
    datetime.timedelta(1)
2864
 
    >>> string_to_delta('1w')
2865
 
    datetime.timedelta(7)
2866
 
    >>> string_to_delta('5m 30s')
2867
 
    datetime.timedelta(0, 330)
 
2936
    >>> string_to_delta("7d") == datetime.timedelta(7)
 
2937
    True
 
2938
    >>> string_to_delta("60s") == datetime.timedelta(0, 60)
 
2939
    True
 
2940
    >>> string_to_delta("60m") == datetime.timedelta(0, 3600)
 
2941
    True
 
2942
    >>> string_to_delta("24h") == datetime.timedelta(1)
 
2943
    True
 
2944
    >>> string_to_delta("1w") == datetime.timedelta(7)
 
2945
    True
 
2946
    >>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
 
2947
    True
2868
2948
    """
2869
2949
 
2870
2950
    try:
2972
3052
 
2973
3053
    options = parser.parse_args()
2974
3054
 
2975
 
    if options.check:
2976
 
        import doctest
2977
 
        fail_count, test_count = doctest.testmod()
2978
 
        sys.exit(os.EX_OK if fail_count == 0 else 1)
2979
 
 
2980
3055
    # Default values for config file for server-global settings
2981
3056
    if gnutls.has_rawpk:
2982
3057
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3078
3153
 
3079
3154
    if server_settings["servicename"] != "Mandos":
3080
3155
        syslogger.setFormatter(
3081
 
            logging.Formatter('Mandos ({}) [%(process)d]:'
3082
 
                              ' %(levelname)s: %(message)s'.format(
 
3156
            logging.Formatter("Mandos ({}) [%(process)d]:"
 
3157
                              " %(levelname)s: %(message)s".format(
3083
3158
                                  server_settings["servicename"])))
3084
3159
 
3085
3160
    # Parse config file with clients
3109
3184
        try:
3110
3185
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3111
3186
        except IOError as e:
3112
 
            logger.error("Could not open file %r", pidfilename,
3113
 
                         exc_info=e)
 
3187
            log.error("Could not open file %r", pidfilename,
 
3188
                      exc_info=e)
3114
3189
 
3115
3190
    for name, group in (("_mandos", "_mandos"),
3116
3191
                        ("mandos", "mandos"),
3127
3202
    try:
3128
3203
        os.setgid(gid)
3129
3204
        os.setuid(uid)
3130
 
        if debug:
3131
 
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
3132
 
                                                             gid))
 
3205
        log.debug("Did setuid/setgid to %s:%s", uid, gid)
3133
3206
    except OSError as error:
3134
 
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
3135
 
                       .format(uid, gid, os.strerror(error.errno)))
 
3207
        log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
 
3208
                    os.strerror(error.errno))
3136
3209
        if error.errno != errno.EPERM:
3137
3210
            raise
3138
3211
 
3145
3218
 
3146
3219
        @gnutls.log_func
3147
3220
        def debug_gnutls(level, string):
3148
 
            logger.debug("GnuTLS: %s", string[:-1])
 
3221
            log.debug("GnuTLS: %s",
 
3222
                      string[:-1].decode("utf-8", errors="replace"))
3149
3223
 
3150
3224
        gnutls.global_set_log_function(debug_gnutls)
3151
3225
 
3180
3254
                "se.bsnet.fukt.Mandos", bus,
3181
3255
                do_not_queue=True)
3182
3256
        except dbus.exceptions.DBusException as e:
3183
 
            logger.error("Disabling D-Bus:", exc_info=e)
 
3257
            log.error("Disabling D-Bus:", exc_info=e)
3184
3258
            use_dbus = False
3185
3259
            server_settings["use_dbus"] = False
3186
3260
            tcp_server.use_dbus = False
3245
3319
                             if isinstance(s, bytes)
3246
3320
                             else s) for s in
3247
3321
                            value["client_structure"]]
3248
 
                        # .name & .host
3249
 
                        for k in ("name", "host"):
 
3322
                        # .name, .host, and .checker_command
 
3323
                        for k in ("name", "host", "checker_command"):
3250
3324
                            if isinstance(value[k], bytes):
3251
3325
                                value[k] = value[k].decode("utf-8")
3252
3326
                        if "key_id" not in value:
3262
3336
                        for key, value in
3263
3337
                        bytes_old_client_settings.items()}
3264
3338
                    del bytes_old_client_settings
3265
 
                    # .host
 
3339
                    # .host and .checker_command
3266
3340
                    for value in old_client_settings.values():
3267
 
                        if isinstance(value["host"], bytes):
3268
 
                            value["host"] = (value["host"]
3269
 
                                             .decode("utf-8"))
 
3341
                        for attribute in ("host", "checker_command"):
 
3342
                            if isinstance(value[attribute], bytes):
 
3343
                                value[attribute] = (value[attribute]
 
3344
                                                    .decode("utf-8"))
3270
3345
            os.remove(stored_state_path)
3271
3346
        except IOError as e:
3272
3347
            if e.errno == errno.ENOENT:
3273
 
                logger.warning("Could not load persistent state:"
3274
 
                               " {}".format(os.strerror(e.errno)))
 
3348
                log.warning("Could not load persistent state:"
 
3349
                            " %s", os.strerror(e.errno))
3275
3350
            else:
3276
 
                logger.critical("Could not load persistent state:",
3277
 
                                exc_info=e)
 
3351
                log.critical("Could not load persistent state:",
 
3352
                             exc_info=e)
3278
3353
                raise
3279
3354
        except EOFError as e:
3280
 
            logger.warning("Could not load persistent state: "
3281
 
                           "EOFError:",
3282
 
                           exc_info=e)
 
3355
            log.warning("Could not load persistent state: EOFError:",
 
3356
                        exc_info=e)
3283
3357
 
3284
3358
    with PGPEngine() as pgp:
3285
3359
        for client_name, client in clients_data.items():
3312
3386
            if client["enabled"]:
3313
3387
                if datetime.datetime.utcnow() >= client["expires"]:
3314
3388
                    if not client["last_checked_ok"]:
3315
 
                        logger.warning(
3316
 
                            "disabling client {} - Client never "
3317
 
                            "performed a successful checker".format(
3318
 
                                client_name))
 
3389
                        log.warning("disabling client %s - Client"
 
3390
                                    " never performed a successful"
 
3391
                                    " checker", client_name)
3319
3392
                        client["enabled"] = False
3320
3393
                    elif client["last_checker_status"] != 0:
3321
 
                        logger.warning(
3322
 
                            "disabling client {} - Client last"
3323
 
                            " checker failed with error code"
3324
 
                            " {}".format(
3325
 
                                client_name,
3326
 
                                client["last_checker_status"]))
 
3394
                        log.warning("disabling client %s - Client"
 
3395
                                    " last checker failed with error"
 
3396
                                    " code %s", client_name,
 
3397
                                    client["last_checker_status"])
3327
3398
                        client["enabled"] = False
3328
3399
                    else:
3329
3400
                        client["expires"] = (
3330
3401
                            datetime.datetime.utcnow()
3331
3402
                            + client["timeout"])
3332
 
                        logger.debug("Last checker succeeded,"
3333
 
                                     " keeping {} enabled".format(
3334
 
                                         client_name))
 
3403
                        log.debug("Last checker succeeded, keeping %s"
 
3404
                                  " enabled", client_name)
3335
3405
            try:
3336
3406
                client["secret"] = pgp.decrypt(
3337
3407
                    client["encrypted_secret"],
3338
3408
                    client_settings[client_name]["secret"])
3339
3409
            except PGPError:
3340
3410
                # If decryption fails, we use secret from new settings
3341
 
                logger.debug("Failed to decrypt {} old secret".format(
3342
 
                    client_name))
 
3411
                log.debug("Failed to decrypt %s old secret",
 
3412
                          client_name)
3343
3413
                client["secret"] = (client_settings[client_name]
3344
3414
                                    ["secret"])
3345
3415
 
3359
3429
            server_settings=server_settings)
3360
3430
 
3361
3431
    if not tcp_server.clients:
3362
 
        logger.warning("No clients defined")
 
3432
        log.warning("No clients defined")
3363
3433
 
3364
3434
    if not foreground:
3365
3435
        if pidfile is not None:
3368
3438
                with pidfile:
3369
3439
                    print(pid, file=pidfile)
3370
3440
            except IOError:
3371
 
                logger.error("Could not write to file %r with PID %d",
3372
 
                             pidfilename, pid)
 
3441
                log.error("Could not write to file %r with PID %d",
 
3442
                          pidfilename, pid)
3373
3443
        del pidfile
3374
3444
        del pidfilename
3375
3445
 
3525
3595
 
3526
3596
        try:
3527
3597
            with tempfile.NamedTemporaryFile(
3528
 
                    mode='wb',
 
3598
                    mode="wb",
3529
3599
                    suffix=".pickle",
3530
 
                    prefix='clients-',
 
3600
                    prefix="clients-",
3531
3601
                    dir=os.path.dirname(stored_state_path),
3532
3602
                    delete=False) as stored_state:
3533
3603
                pickle.dump((clients, client_settings), stored_state,
3541
3611
                except NameError:
3542
3612
                    pass
3543
3613
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3544
 
                logger.warning("Could not save persistent state: {}"
3545
 
                               .format(os.strerror(e.errno)))
 
3614
                log.warning("Could not save persistent state: %s",
 
3615
                            os.strerror(e.errno))
3546
3616
            else:
3547
 
                logger.warning("Could not save persistent state:",
3548
 
                               exc_info=e)
 
3617
                log.warning("Could not save persistent state:",
 
3618
                            exc_info=e)
3549
3619
                raise
3550
3620
 
3551
3621
        # Delete all clients, and settings from config
3568
3638
            mandos_dbus_service.client_added_signal(client)
3569
3639
        # Need to initiate checking of clients
3570
3640
        if client.enabled:
3571
 
            client.init_checker()
 
3641
            client.init_checker(randomize_start=True)
3572
3642
 
3573
3643
    tcp_server.enable()
3574
3644
    tcp_server.server_activate()
3577
3647
    if zeroconf:
3578
3648
        service.port = tcp_server.socket.getsockname()[1]
3579
3649
    if use_ipv6:
3580
 
        logger.info("Now listening on address %r, port %d,"
3581
 
                    " flowinfo %d, scope_id %d",
3582
 
                    *tcp_server.socket.getsockname())
 
3650
        log.info("Now listening on address %r, port %d, flowinfo %d,"
 
3651
                 " scope_id %d", *tcp_server.socket.getsockname())
3583
3652
    else:                       # IPv4
3584
 
        logger.info("Now listening on address %r, port %d",
3585
 
                    *tcp_server.socket.getsockname())
 
3653
        log.info("Now listening on address %r, port %d",
 
3654
                 *tcp_server.socket.getsockname())
3586
3655
 
3587
3656
    # service.interface = tcp_server.socket.getsockname()[3]
3588
3657
 
3592
3661
            try:
3593
3662
                service.activate()
3594
3663
            except dbus.exceptions.DBusException as error:
3595
 
                logger.critical("D-Bus Exception", exc_info=error)
 
3664
                log.critical("D-Bus Exception", exc_info=error)
3596
3665
                cleanup()
3597
3666
                sys.exit(1)
3598
3667
            # End of Avahi example code
3599
3668
 
3600
 
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3601
 
                          lambda *args, **kwargs:
3602
 
                          (tcp_server.handle_request
3603
 
                           (*args[2:], **kwargs) or True))
 
3669
        GLib.io_add_watch(
 
3670
            GLib.IOChannel.unix_new(tcp_server.fileno()),
 
3671
            GLib.PRIORITY_DEFAULT, GLib.IO_IN,
 
3672
            lambda *args, **kwargs: (tcp_server.handle_request
 
3673
                                     (*args[2:], **kwargs) or True))
3604
3674
 
3605
 
        logger.debug("Starting main loop")
 
3675
        log.debug("Starting main loop")
3606
3676
        main_loop.run()
3607
3677
    except AvahiError as error:
3608
 
        logger.critical("Avahi Error", exc_info=error)
 
3678
        log.critical("Avahi Error", exc_info=error)
3609
3679
        cleanup()
3610
3680
        sys.exit(1)
3611
3681
    except KeyboardInterrupt:
3612
3682
        if debug:
3613
3683
            print("", file=sys.stderr)
3614
 
        logger.debug("Server received KeyboardInterrupt")
3615
 
    logger.debug("Server exiting")
 
3684
        log.debug("Server received KeyboardInterrupt")
 
3685
    log.debug("Server exiting")
3616
3686
    # Must run before the D-Bus bus name gets deregistered
3617
3687
    cleanup()
3618
3688
 
3619
 
 
3620
 
if __name__ == '__main__':
3621
 
    main()
 
3689
 
 
3690
def parse_test_args():
 
3691
    # type: () -> argparse.Namespace
 
3692
    parser = argparse.ArgumentParser(add_help=False)
 
3693
    parser.add_argument("--check", action="store_true")
 
3694
    parser.add_argument("--prefix", )
 
3695
    args, unknown_args = parser.parse_known_args()
 
3696
    if args.check:
 
3697
        # Remove test options from sys.argv
 
3698
        sys.argv[1:] = unknown_args
 
3699
    return args
 
3700
 
 
3701
# Add all tests from doctest strings
 
3702
def load_tests(loader, tests, none):
 
3703
    import doctest
 
3704
    tests.addTests(doctest.DocTestSuite())
 
3705
    return tests
 
3706
 
 
3707
if __name__ == "__main__":
 
3708
    options = parse_test_args()
 
3709
    try:
 
3710
        if options.check:
 
3711
            extra_test_prefix = options.prefix
 
3712
            if extra_test_prefix is not None:
 
3713
                if not (unittest.main(argv=[""], exit=False)
 
3714
                        .result.wasSuccessful()):
 
3715
                    sys.exit(1)
 
3716
                class ExtraTestLoader(unittest.TestLoader):
 
3717
                    testMethodPrefix = extra_test_prefix
 
3718
                # Call using ./scriptname --test [--verbose]
 
3719
                unittest.main(argv=[""], testLoader=ExtraTestLoader())
 
3720
            else:
 
3721
                unittest.main(argv=[""])
 
3722
        else:
 
3723
            main()
 
3724
    finally:
 
3725
        logging.shutdown()
 
3726
 
 
3727
# Local Variables:
 
3728
# run-tests:
 
3729
# (lambda (&optional extra)
 
3730
#   (if (not (funcall run-tests-in-test-buffer default-directory
 
3731
#             extra))
 
3732
#       (funcall show-test-buffer-in-test-window)
 
3733
#     (funcall remove-test-window)
 
3734
#     (if extra (message "Extra tests run successfully!"))))
 
3735
# run-tests-in-test-buffer:
 
3736
# (lambda (dir &optional extra)
 
3737
#   (with-current-buffer (get-buffer-create "*Test*")
 
3738
#     (setq buffer-read-only nil
 
3739
#           default-directory dir)
 
3740
#     (erase-buffer)
 
3741
#     (compilation-mode))
 
3742
#   (let ((process-result
 
3743
#          (let ((inhibit-read-only t))
 
3744
#            (process-file-shell-command
 
3745
#             (funcall get-command-line extra) nil "*Test*"))))
 
3746
#     (and (numberp process-result)
 
3747
#          (= process-result 0))))
 
3748
# get-command-line:
 
3749
# (lambda (&optional extra)
 
3750
#   (let ((quoted-script
 
3751
#          (shell-quote-argument (funcall get-script-name))))
 
3752
#     (format
 
3753
#      (concat "%s --check" (if extra " --prefix=atest" ""))
 
3754
#      quoted-script)))
 
3755
# get-script-name:
 
3756
# (lambda ()
 
3757
#   (if (fboundp 'file-local-name)
 
3758
#       (file-local-name (buffer-file-name))
 
3759
#     (or (file-remote-p (buffer-file-name) 'localname)
 
3760
#         (buffer-file-name))))
 
3761
# remove-test-window:
 
3762
# (lambda ()
 
3763
#   (let ((test-window (get-buffer-window "*Test*")))
 
3764
#     (if test-window (delete-window test-window))))
 
3765
# show-test-buffer-in-test-window:
 
3766
# (lambda ()
 
3767
#   (when (not (get-buffer-window-list "*Test*"))
 
3768
#     (setq next-error-last-buffer (get-buffer "*Test*"))
 
3769
#     (let* ((side (if (>= (window-width) 146) 'right 'bottom))
 
3770
#            (display-buffer-overriding-action
 
3771
#             `((display-buffer-in-side-window) (side . ,side)
 
3772
#               (window-height . fit-window-to-buffer)
 
3773
#               (window-width . fit-window-to-buffer))))
 
3774
#       (display-buffer "*Test*"))))
 
3775
# eval:
 
3776
# (progn
 
3777
#   (let* ((run-extra-tests (lambda () (interactive)
 
3778
#                             (funcall run-tests t)))
 
3779
#          (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
 
3780
#          (outer-keymap `(keymap (3 . ,inner-keymap))))     ; C-c
 
3781
#     (setq minor-mode-overriding-map-alist
 
3782
#           (cons `(run-tests . ,outer-keymap)
 
3783
#                 minor-mode-overriding-map-alist)))
 
3784
#   (add-hook 'after-save-hook run-tests 90 t))
 
3785
# End: