/mandos/trunk : revision 237.4.137

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

2

# -*- coding: utf-8; lexical-binding: t -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This file is part of Mandos.

18

#

31

#

32

# Contact the authors at <mandos@recompile.se>.

33

#

34

35

34

from __future__ import (division, absolute_import, print_function,

36

35

unicode_literals)

37

36

40

39

except ImportError:

41

40

pass

42

41

42

import sys

43

import unittest

44

import argparse

45

import logging

46

import os

43

47

try:

44

48

import SocketServer as socketserver

45

49

except ImportError:

46

50

import socketserver

47

51

import socket

48

import argparse

49

52

import datetime

50

53

import errno

51

54

try:

52

55

import ConfigParser as configparser

53

56

except ImportError:

54

57

import configparser

55

import sys

56

58

import re

57

import os

58

59

import signal

59

60

import subprocess

60

61

import atexit

61

62

import stat

62

import logging

63

import logging.handlers

64

import pwd

65

import contextlib

77

import itertools

78

import collections

79

import codecs

80

import unittest

81

80

import random

82

81

import shlex

83

82

94

93

if sys.version_info.major == 2:

95

94

__metaclass__ = type

96

95

str = unicode

96

input = raw_input

97

98

# Add collections.abc.Callable if it does not exist

99

try:

146

version = "1.8.14"

147

stored_state_file = "clients.pickle"

148

149

logger = logging.getLogger()

149

log = logging.getLogger(os.path.basename(sys.argv[0]))

150

logging.captureWarnings(True) # Show warnings via the logging system

151

syslogger = None

152

189

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

190

address="/dev/log"))

191

syslogger.setFormatter(logging.Formatter

192

('Mandos [%(process)d]: %(levelname)s:'

193

' %(message)s'))

194

logger.addHandler(syslogger)

192

("Mandos [%(process)d]: %(levelname)s:"

193

" %(message)s"))

194

log.addHandler(syslogger)

195

196

if debug:

197

console = logging.StreamHandler()

198

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

199

' [%(process)d]:'

200

' %(levelname)s:'

201

' %(message)s'))

202

logger.addHandler(console)

203

logger.setLevel(level)

198

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

199

" [%(process)d]:"

200

" %(levelname)s:"

201

" %(message)s"))

202

log.addHandler(console)

203

log.setLevel(level)

204

205

206

class PGPError(Exception):

224

except OSError as e:

225

if e.errno != errno.ENOENT:

226

raise

227

self.gnupgargs = ['--batch',

228

'--homedir', self.tempdir,

229

'--force-mdc',

230

'--quiet']

227

self.gnupgargs = ["--batch",

228

"--homedir", self.tempdir,

229

"--force-mdc",

230

"--quiet"]

231

# Only GPG version 1 has the --no-use-agent option.

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

233

self.gnupgargs.append("--no-use-agent")

272

dir=self.tempdir) as passfile:

273

passfile.write(passphrase)

274

passfile.flush()

275

proc = subprocess.Popen([self.gpg, '--symmetric',

276

'--passphrase-file',

275

proc = subprocess.Popen([self.gpg, "--symmetric",

276

"--passphrase-file",

277

passfile.name]

278

+ self.gnupgargs,

279

stdin=subprocess.PIPE,

290

dir=self.tempdir) as passfile:

291

passfile.write(passphrase)

292

passfile.flush()

293

proc = subprocess.Popen([self.gpg, '--decrypt',

294

'--passphrase-file',

293

proc = subprocess.Popen([self.gpg, "--decrypt",

294

"--passphrase-file",

295

passfile.name]

296

+ self.gnupgargs,

297

stdin=subprocess.PIPE,

350

Attributes:

351

interface: integer; avahi.IF_UNSPEC or an interface index.

352

Used to optionally bind to the specified interface.

353

name: string; Example: 'Mandos'

354

type: string; Example: '_mandos._tcp'.

353

name: string; Example: "Mandos"

354

type: string; Example: "_mandos._tcp".

355

See <https://www.iana.org/assignments/service-names-port-numbers>

356

port: integer; what port to announce

357

TXT: list of strings; TXT record for the service

394

def rename(self, remove=True):

395

"""Derived from the Avahi example code"""

396

if self.rename_count >= self.max_renames:

397

logger.critical("No suitable Zeroconf service name found"

398

" after %i retries, exiting.",

399

self.rename_count)

397

log.critical("No suitable Zeroconf service name found"

398

" after %i retries, exiting.",

399

self.rename_count)

400

raise AvahiServiceError("Too many renames")

401

self.name = str(

402

self.server.GetAlternativeServiceName(self.name))

403

self.rename_count += 1

404

logger.info("Changing Zeroconf service name to %r ...",

405

self.name)

404

log.info("Changing Zeroconf service name to %r ...",

405

self.name)

406

if remove:

407

self.remove()

408

try:

410

except dbus.exceptions.DBusException as error:

411

if (error.get_dbus_name()

412

== "org.freedesktop.Avahi.CollisionError"):

413

logger.info("Local Zeroconf service name collision.")

413

log.info("Local Zeroconf service name collision.")

414

return self.rename(remove=False)

415

else:

416

logger.critical("D-Bus Exception", exc_info=error)

416

log.critical("D-Bus Exception", exc_info=error)

417

self.cleanup()

418

os._exit(1)

419

435

avahi.DBUS_INTERFACE_ENTRY_GROUP)

436

self.entry_group_state_changed_match = (

437

self.group.connect_to_signal(

438

'StateChanged', self.entry_group_state_changed))

439

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

440

self.name, self.type)

438

"StateChanged", self.entry_group_state_changed))

439

log.debug("Adding Zeroconf service '%s' of type '%s' ...",

440

self.name, self.type)

441

self.group.AddService(

442

self.interface,

443

self.protocol,

450

451

def entry_group_state_changed(self, state, error):

452

"""Derived from the Avahi example code"""

453

logger.debug("Avahi entry group state change: %i", state)

453

log.debug("Avahi entry group state change: %i", state)

454

455

if state == avahi.ENTRY_GROUP_ESTABLISHED:

456

logger.debug("Zeroconf service established.")

456

log.debug("Zeroconf service established.")

457

elif state == avahi.ENTRY_GROUP_COLLISION:

458

logger.info("Zeroconf service name collision.")

458

log.info("Zeroconf service name collision.")

459

self.rename()

460

elif state == avahi.ENTRY_GROUP_FAILURE:

461

logger.critical("Avahi: Error in group state changed %s",

462

str(error))

461

log.critical("Avahi: Error in group state changed %s",

462

str(error))

463

raise AvahiGroupError("State changed: {!s}".format(error))

464

465

def cleanup(self):

475

476

def server_state_changed(self, state, error=None):

477

"""Derived from the Avahi example code"""

478

logger.debug("Avahi server state change: %i", state)

478

log.debug("Avahi server state change: %i", state)

479

bad_states = {

480

avahi.SERVER_INVALID: "Zeroconf server invalid",

481

avahi.SERVER_REGISTERING: None,

485

if state in bad_states:

486

if bad_states[state] is not None:

487

if error is None:

488

logger.error(bad_states[state])

488

log.error(bad_states[state])

489

else:

490

logger.error(bad_states[state] + ": %r", error)

490

log.error(bad_states[state] + ": %r", error)

491

self.cleanup()

492

elif state == avahi.SERVER_RUNNING:

493

try:

495

except dbus.exceptions.DBusException as error:

496

if (error.get_dbus_name()

497

== "org.freedesktop.Avahi.CollisionError"):

498

logger.info("Local Zeroconf service name"

499

" collision.")

498

log.info("Local Zeroconf service name collision.")

500

499

return self.rename(remove=False)

501

500

else:

502

logger.critical("D-Bus Exception", exc_info=error)

501

log.critical("D-Bus Exception", exc_info=error)

503

502

self.cleanup()

504

503

os._exit(1)

505

504

else:

506

505

if error is None:

507

logger.debug("Unknown state: %r", state)

506

log.debug("Unknown state: %r", state)

508

507

else:

509

logger.debug("Unknown state: %r: %r", state, error)

508

log.debug("Unknown state: %r: %r", state, error)

510

509

511

510

def activate(self):

512

511

"""Derived from the Avahi example code"""

527

526

ret = super(AvahiServiceToSyslog, self).rename(*args,

528

527

**kwargs)

529

528

syslogger.setFormatter(logging.Formatter(

530

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

529

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

531

530

.format(self.name)))

532

531

return ret

533

532

563

562

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

564

563

565

564

# Types

566

class session_int(ctypes.Structure):

565

class _session_int(ctypes.Structure):

567

566

_fields_ = []

568

session_t = ctypes.POINTER(session_int)

567

session_t = ctypes.POINTER(_session_int)

569

568

570

569

class certificate_credentials_st(ctypes.Structure):

571

570

_fields_ = []

574

573

certificate_type_t = ctypes.c_int

575

574

576

575

class datum_t(ctypes.Structure):

577

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

578

('size', ctypes.c_uint)]

576

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

577

("size", ctypes.c_uint)]

579

578

580

class openpgp_crt_int(ctypes.Structure):

579

class _openpgp_crt_int(ctypes.Structure):

581

580

_fields_ = []

582

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

581

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

583

582

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

584

583

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

585

584

credentials_type_t = ctypes.c_int

594

593

# gnutls.strerror()

595

594

self.code = code

596

595

if message is None and code is not None:

597

message = gnutls.strerror(code)

596

message = gnutls.strerror(code).decode(

597

"utf-8", errors="replace")

598

return super(gnutls.Error, self).__init__(

599

message, *args)

600

601

class CertificateSecurityError(Error):

602

pass

603

604

class PointerTo:

605

def __init__(self, cls):

606

self.cls = cls

607

608

def from_param(self, obj):

609

if not isinstance(obj, self.cls):

610

raise TypeError("Not of type {}: {!r}"

611

.format(self.cls.__name__, obj))

612

return ctypes.byref(obj.from_param(obj))

613

614

class CastToVoidPointer:

615

def __init__(self, cls):

616

self.cls = cls

617

618

def from_param(self, obj):

619

if not isinstance(obj, self.cls):

620

raise TypeError("Not of type {}: {!r}"

621

.format(self.cls.__name__, obj))

622

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

623

624

class With_from_param:

625

@classmethod

626

def from_param(cls, obj):

627

return obj._as_parameter_

628

604

629

# Classes

605

class Credentials:

630

class Credentials(With_from_param):

606

631

def __init__(self):

607

self._c_object = gnutls.certificate_credentials_t()

608

gnutls.certificate_allocate_credentials(

609

ctypes.byref(self._c_object))

632

self._as_parameter_ = gnutls.certificate_credentials_t()

633

gnutls.certificate_allocate_credentials(self)

610

634

self.type = gnutls.CRD_CERTIFICATE

611

635

612

636

def __del__(self):

613

gnutls.certificate_free_credentials(self._c_object)

637

gnutls.certificate_free_credentials(self)

614

638

615

class ClientSession:

639

class ClientSession(With_from_param):

616

640

def __init__(self, socket, credentials=None):

617

self._c_object = gnutls.session_t()

641

self._as_parameter_ = gnutls.session_t()

618

642

gnutls_flags = gnutls.CLIENT

619

643

if gnutls.check_version(b"3.5.6"):

620

644

gnutls_flags |= gnutls.NO_TICKETS

621

645

if gnutls.has_rawpk:

622

646

gnutls_flags |= gnutls.ENABLE_RAWPK

623

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

647

gnutls.init(self, gnutls_flags)

624

648

del gnutls_flags

625

gnutls.set_default_priority(self._c_object)

626

gnutls.transport_set_ptr(self._c_object, socket.fileno())

627

gnutls.handshake_set_private_extensions(self._c_object,

628

True)

649

gnutls.set_default_priority(self)

650

gnutls.transport_set_ptr(self, socket.fileno())

651

gnutls.handshake_set_private_extensions(self, True)

629

652

self.socket = socket

630

653

if credentials is None:

631

654

credentials = gnutls.Credentials()

632

gnutls.credentials_set(self._c_object, credentials.type,

633

ctypes.cast(credentials._c_object,

634

ctypes.c_void_p))

655

gnutls.credentials_set(self, credentials.type,

656

credentials)

635

657

self.credentials = credentials

636

658

637

659

def __del__(self):

638

gnutls.deinit(self._c_object)

660

gnutls.deinit(self)

639

661

640

662

def handshake(self):

641

return gnutls.handshake(self._c_object)

663

return gnutls.handshake(self)

642

664

643

665

def send(self, data):

644

666

data = bytes(data)

645

667

data_len = len(data)

646

668

while data_len > 0:

647

data_len -= gnutls.record_send(self._c_object,

648

data[-data_len:],

669

data_len -= gnutls.record_send(self, data[-data_len:],

649

670

data_len)

650

671

651

672

def bye(self):

652

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

673

return gnutls.bye(self, gnutls.SHUT_RDWR)

653

674

654

675

# Error handling functions

655

676

def _error_code(result):

656

677

"""A function to raise exceptions on errors, suitable

657

for the 'restype' attribute on ctypes functions"""

658

if result >= 0:

678

for the "restype" attribute on ctypes functions"""

679

if result >= gnutls.E_SUCCESS:

659

680

return result

660

681

if result == gnutls.E_NO_CERTIFICATE_FOUND:

661

682

raise gnutls.CertificateSecurityError(code=result)

662

683

raise gnutls.Error(code=result)

663

684

664

def _retry_on_error(result, func, arguments):

685

def _retry_on_error(result, func, arguments,

686

_error_code=_error_code):

665

687

"""A function to retry on some errors, suitable

666

for the 'errcheck' attribute on ctypes functions"""

667

while result < 0:

688

for the "errcheck" attribute on ctypes functions"""

689

while result < gnutls.E_SUCCESS:

668

690

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

669

691

return _error_code(result)

670

692

result = func(*arguments)

675

697

676

698

# Functions

677

699

priority_set_direct = _library.gnutls_priority_set_direct

678

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

700

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

679

701

ctypes.POINTER(ctypes.c_char_p)]

680

702

priority_set_direct.restype = _error_code

681

703

682

704

init = _library.gnutls_init

683

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

705

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

684

706

init.restype = _error_code

685

707

686

708

set_default_priority = _library.gnutls_set_default_priority

687

set_default_priority.argtypes = [session_t]

709

set_default_priority.argtypes = [ClientSession]

688

710

set_default_priority.restype = _error_code

689

711

690

712

record_send = _library.gnutls_record_send

691

record_send.argtypes = [session_t, ctypes.c_void_p,

713

record_send.argtypes = [ClientSession, ctypes.c_void_p,

692

714

ctypes.c_size_t]

693

715

record_send.restype = ctypes.c_ssize_t

694

716

record_send.errcheck = _retry_on_error

696

718

certificate_allocate_credentials = (

697

719

_library.gnutls_certificate_allocate_credentials)

698

720

certificate_allocate_credentials.argtypes = [

699

ctypes.POINTER(certificate_credentials_t)]

721

PointerTo(Credentials)]

700

722

certificate_allocate_credentials.restype = _error_code

701

723

702

724

certificate_free_credentials = (

703

725

_library.gnutls_certificate_free_credentials)

704

certificate_free_credentials.argtypes = [

705

certificate_credentials_t]

726

certificate_free_credentials.argtypes = [Credentials]

706

727

certificate_free_credentials.restype = None

707

728

708

729

handshake_set_private_extensions = (

709

730

_library.gnutls_handshake_set_private_extensions)

710

handshake_set_private_extensions.argtypes = [session_t,

731

handshake_set_private_extensions.argtypes = [ClientSession,

711

732

ctypes.c_int]

712

733

handshake_set_private_extensions.restype = None

713

734

714

735

credentials_set = _library.gnutls_credentials_set

715

credentials_set.argtypes = [session_t, credentials_type_t,

716

ctypes.c_void_p]

736

credentials_set.argtypes = [ClientSession, credentials_type_t,

737

CastToVoidPointer(Credentials)]

717

738

credentials_set.restype = _error_code

718

739

719

740

strerror = _library.gnutls_strerror

721

742

strerror.restype = ctypes.c_char_p

722

743

723

744

certificate_type_get = _library.gnutls_certificate_type_get

724

certificate_type_get.argtypes = [session_t]

745

certificate_type_get.argtypes = [ClientSession]

725

746

certificate_type_get.restype = _error_code

726

747

727

748

certificate_get_peers = _library.gnutls_certificate_get_peers

728

certificate_get_peers.argtypes = [session_t,

749

certificate_get_peers.argtypes = [ClientSession,

729

750

ctypes.POINTER(ctypes.c_uint)]

730

751

certificate_get_peers.restype = ctypes.POINTER(datum_t)

731

752

738

759

global_set_log_function.restype = None

739

760

740

761

deinit = _library.gnutls_deinit

741

deinit.argtypes = [session_t]

762

deinit.argtypes = [ClientSession]

742

763

deinit.restype = None

743

764

744

765

handshake = _library.gnutls_handshake

745

handshake.argtypes = [session_t]

746

handshake.restype = _error_code

766

handshake.argtypes = [ClientSession]

767

handshake.restype = ctypes.c_int

747

768

handshake.errcheck = _retry_on_error

748

769

749

770

transport_set_ptr = _library.gnutls_transport_set_ptr

750

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

771

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

751

772

transport_set_ptr.restype = None

752

773

753

774

bye = _library.gnutls_bye

754

bye.argtypes = [session_t, close_request_t]

755

bye.restype = _error_code

775

bye.argtypes = [ClientSession, close_request_t]

776

bye.restype = ctypes.c_int

756

777

bye.errcheck = _retry_on_error

757

778

758

779

check_version = _library.gnutls_check_version

832

853

833

854

if check_version(b"3.6.4"):

834

855

certificate_type_get2 = _library.gnutls_certificate_type_get2

835

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

856

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

836

857

certificate_type_get2.restype = _error_code

837

858

838

859

# Remove non-public functions

854

875

"""A representation of a client host served by this server.

855

876

856

877

Attributes:

857

approved: bool(); 'None' if not yet approved/disapproved

878

approved: bool(); None if not yet approved/disapproved

858

879

approval_delay: datetime.timedelta(); Time to wait for approval

859

880

approval_duration: datetime.timedelta(); Duration of one approval

860

881

checker: multiprocessing.Process(); a running checker process used

861

to see if the client lives. 'None' if no process is

882

to see if the client lives. None if no process is

862

883

running.

863

884

checker_callback_tag: a GLib event source tag, or None

864

885

checker_command: string; External command which is run to check

988

1009

self.last_enabled = None

989

1010

self.expires = None

990

1011

991

logger.debug("Creating client %r", self.name)

992

logger.debug(" Key ID: %s", self.key_id)

993

logger.debug(" Fingerprint: %s", self.fingerprint)

1012

log.debug("Creating client %r", self.name)

1013

log.debug(" Key ID: %s", self.key_id)

1014

log.debug(" Fingerprint: %s", self.fingerprint)

994

1015

self.created = settings.get("created",

995

1016

datetime.datetime.utcnow())

996

1017

1035

1056

if not getattr(self, "enabled", False):

1036

1057

return False

1037

1058

if not quiet:

1038

logger.info("Disabling client %s", self.name)

1059

log.info("Disabling client %s", self.name)

1039

1060

if getattr(self, "disable_initiator_tag", None) is not None:

1040

1061

GLib.source_remove(self.disable_initiator_tag)

1041

1062

self.disable_initiator_tag = None

1085

1106

self.last_checker_status = returncode

1086

1107

self.last_checker_signal = None

1087

1108

if self.last_checker_status == 0:

1088

logger.info("Checker for %(name)s succeeded",

1089

vars(self))

1109

log.info("Checker for %(name)s succeeded", vars(self))

1090

1110

self.checked_ok()

1091

1111

else:

1092

logger.info("Checker for %(name)s failed", vars(self))

1112

log.info("Checker for %(name)s failed", vars(self))

1093

1113

else:

1094

1114

self.last_checker_status = -1

1095

1115

self.last_checker_signal = -returncode

1096

logger.warning("Checker for %(name)s crashed?",

1097

vars(self))

1116

log.warning("Checker for %(name)s crashed?", vars(self))

1098

1117

return False

1099

1118

1100

1119

def checked_ok(self):

1134

1153

# should be.

1135

1154

1136

1155

if self.checker is not None and not self.checker.is_alive():

1137

logger.warning("Checker was not alive; joining")

1156

log.warning("Checker was not alive; joining")

1138

1157

self.checker.join()

1139

1158

self.checker = None

1140

1159

# Start a new checker if needed

1146

1165

try:

1147

1166

command = self.checker_command % escaped_attrs

1148

1167

except TypeError as error:

1149

logger.error('Could not format string "%s"',

1150

self.checker_command,

1151

exc_info=error)

1168

log.error('Could not format string "%s"',

1169

self.checker_command, exc_info=error)

1152

1170

return True # Try again later

1153

1171

self.current_checker_command = command

1154

logger.info("Starting checker %r for %s", command,

1155

self.name)

1172

log.info("Starting checker %r for %s", command, self.name)

1156

1173

# We don't need to redirect stdout and stderr, since

1157

1174

# in normal mode, that is already done by daemon(),

1158

1175

# and in debug mode we don't want to. (Stdin is

1187

1204

self.checker_callback_tag = None

1188

1205

if getattr(self, "checker", None) is None:

1189

1206

return

1190

logger.debug("Stopping checker for %(name)s", vars(self))

1207

log.debug("Stopping checker for %(name)s", vars(self))

1191

1208

self.checker.terminate()

1192

1209

self.checker = None

1193

1210

1220

1237

func._dbus_name = func.__name__

1221

1238

if func._dbus_name.endswith("_dbus_property"):

1222

1239

func._dbus_name = func._dbus_name[:-14]

1223

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1240

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

1224

1241

return func

1225

1242

1226

1243

return decorator

1315

1332

1316

1333

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1317

1334

out_signature="s",

1318

path_keyword='object_path',

1319

connection_keyword='connection')

1335

path_keyword="object_path",

1336

connection_keyword="connection")

1320

1337

def Introspect(self, object_path, connection):

1321

1338

"""Overloading of standard D-Bus method.

1322

1339

1371

1388

document.unlink()

1372

1389

except (AttributeError, xml.dom.DOMException,

1373

1390

xml.parsers.expat.ExpatError) as error:

1374

logger.error("Failed to override Introspection method",

1375

exc_info=error)

1391

log.error("Failed to override Introspection method",

1392

exc_info=error)

1376

1393

return xmlstring

1377

1394

1378

1395

1475

1492

1476

1493

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1477

1494

out_signature="s",

1478

path_keyword='object_path',

1479

connection_keyword='connection')

1495

path_keyword="object_path",

1496

connection_keyword="connection")

1480

1497

def Introspect(self, object_path, connection):

1481

1498

"""Overloading of standard D-Bus method.

1482

1499

1538

1555

document.unlink()

1539

1556

except (AttributeError, xml.dom.DOMException,

1540

1557

xml.parsers.expat.ExpatError) as error:

1541

logger.error("Failed to override Introspection method",

1542

exc_info=error)

1558

log.error("Failed to override Introspection method",

1559

exc_info=error)

1543

1560

return xmlstring

1544

1561

1545

1562

1577

1594

1578

1595

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1579

1596

out_signature="s",

1580

path_keyword='object_path',

1581

connection_keyword='connection')

1597

path_keyword="object_path",

1598

connection_keyword="connection")

1582

1599

def Introspect(self, object_path, connection):

1583

1600

"""Overloading of standard D-Bus method.

1584

1601

1609

1626

document.unlink()

1610

1627

except (AttributeError, xml.dom.DOMException,

1611

1628

xml.parsers.expat.ExpatError) as error:

1612

logger.error("Failed to override Introspection method",

1613

exc_info=error)

1629

log.error("Failed to override Introspection method",

1630

exc_info=error)

1614

1631

return xmlstring

1615

1632

1616

1633

2250

2267

class ProxyClient:

2251

2268

def __init__(self, child_pipe, key_id, fpr, address):

2252

2269

self._pipe = child_pipe

2253

self._pipe.send(('init', key_id, fpr, address))

2270

self._pipe.send(("init", key_id, fpr, address))

2254

2271

if not self._pipe.recv():

2255

2272

raise KeyError(key_id or fpr)

2256

2273

2257

2274

def __getattribute__(self, name):

2258

if name == '_pipe':

2275

if name == "_pipe":

2259

2276

return super(ProxyClient, self).__getattribute__(name)

2260

self._pipe.send(('getattr', name))

2277

self._pipe.send(("getattr", name))

2261

2278

data = self._pipe.recv()

2262

if data[0] == 'data':

2279

if data[0] == "data":

2263

2280

return data[1]

2264

if data[0] == 'function':

2281

if data[0] == "function":

2265

2282

2266

2283

def func(*args, **kwargs):

2267

self._pipe.send(('funcall', name, args, kwargs))

2284

self._pipe.send(("funcall", name, args, kwargs))

2268

2285

return self._pipe.recv()[1]

2269

2286

2270

2287

return func

2271

2288

2272

2289

def __setattr__(self, name, value):

2273

if name == '_pipe':

2290

if name == "_pipe":

2274

2291

return super(ProxyClient, self).__setattr__(name, value)

2275

self._pipe.send(('setattr', name, value))

2292

self._pipe.send(("setattr", name, value))

2276

2293

2277

2294

2278

2295

class ClientHandler(socketserver.BaseRequestHandler, object):

2283

2300

2284

2301

def handle(self):

2285

2302

with contextlib.closing(self.server.child_pipe) as child_pipe:

2286

logger.info("TCP connection from: %s",

2287

str(self.client_address))

2288

logger.debug("Pipe FD: %d",

2289

self.server.child_pipe.fileno())

2303

log.info("TCP connection from: %s",

2304

str(self.client_address))

2305

log.debug("Pipe FD: %d", self.server.child_pipe.fileno())

2290

2306

2291

2307

session = gnutls.ClientSession(self.request)

2292

2308

2293

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2309

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2294

2310

# "+AES-256-CBC", "+SHA1",

2295

2311

# "+COMP-NULL", "+CTYPE-OPENPGP",

2296

2312

# "+DHE-DSS"))

2298

2314

priority = self.server.gnutls_priority

2299

2315

if priority is None:

2300

2316

priority = "NORMAL"

2301

gnutls.priority_set_direct(session._c_object,

2302

priority.encode("utf-8"),

2303

None)

2317

gnutls.priority_set_direct(session,

2318

priority.encode("utf-8"), None)

2304

2319

2305

2320

# Start communication using the Mandos protocol

2306

2321

# Get protocol number

2307

2322

line = self.request.makefile().readline()

2308

logger.debug("Protocol version: %r", line)

2323

log.debug("Protocol version: %r", line)

2309

2324

try:

2310

2325

if int(line.strip().split()[0]) > 1:

2311

2326

raise RuntimeError(line)

2312

2327

except (ValueError, IndexError, RuntimeError) as error:

2313

logger.error("Unknown protocol version: %s", error)

2328

log.error("Unknown protocol version: %s", error)

2314

2329

return

2315

2330

2316

2331

# Start GnuTLS connection

2317

2332

try:

2318

2333

session.handshake()

2319

2334

except gnutls.Error as error:

2320

logger.warning("Handshake failed: %s", error)

2335

log.warning("Handshake failed: %s", error)

2321

2336

# Do not run session.bye() here: the session is not

2322

2337

# established. Just abandon the request.

2323

2338

return

2324

logger.debug("Handshake succeeded")

2339

log.debug("Handshake succeeded")

2325

2340

2326

2341

approval_required = False

2327

2342

try:

2331

2346

key_id = self.key_id(

2332

2347

self.peer_certificate(session))

2333

2348

except (TypeError, gnutls.Error) as error:

2334

logger.warning("Bad certificate: %s", error)

2349

log.warning("Bad certificate: %s", error)

2335

2350

return

2336

logger.debug("Key ID: %s", key_id)

2351

log.debug("Key ID: %s",

2352

key_id.decode("utf-8",

2353

errors="replace"))

2337

2354

2338

2355

else:

2339

2356

key_id = b""

2341

2358

fpr = self.fingerprint(

2342

2359

self.peer_certificate(session))

2343

2360

except (TypeError, gnutls.Error) as error:

2344

logger.warning("Bad certificate: %s", error)

2361

log.warning("Bad certificate: %s", error)

2345

2362

return

2346

logger.debug("Fingerprint: %s", fpr)

2363

log.debug("Fingerprint: %s", fpr)

2347

2364

2348

2365

try:

2349

2366

client = ProxyClient(child_pipe, key_id, fpr,

2358

2375

2359

2376

while True:

2360

2377

if not client.enabled:

2361

logger.info("Client %s is disabled",

2362

client.name)

2378

log.info("Client %s is disabled", client.name)

2363

2379

if self.server.use_dbus:

2364

2380

# Emit D-Bus signal

2365

2381

client.Rejected("Disabled")

2369

2385

# We are approved or approval is disabled

2370

2386

break

2371

2387

elif client.approved is None:

2372

logger.info("Client %s needs approval",

2373

client.name)

2388

log.info("Client %s needs approval",

2389

client.name)

2374

2390

if self.server.use_dbus:

2375

2391

# Emit D-Bus signal

2376

2392

client.NeedApproval(

2377

2393

client.approval_delay.total_seconds()

2378

2394

* 1000, client.approved_by_default)

2379

2395

else:

2380

logger.warning("Client %s was not approved",

2381

client.name)

2396

log.warning("Client %s was not approved",

2397

client.name)

2382

2398

if self.server.use_dbus:

2383

2399

# Emit D-Bus signal

2384

2400

client.Rejected("Denied")

2392

2408

time2 = datetime.datetime.now()

2393

2409

if (time2 - time) >= delay:

2394

2410

if not client.approved_by_default:

2395

logger.warning("Client %s timed out while"

2396

" waiting for approval",

2397

client.name)

2411

log.warning("Client %s timed out while"

2412

" waiting for approval",

2413

client.name)

2398

2414

if self.server.use_dbus:

2399

2415

# Emit D-Bus signal

2400

2416

client.Rejected("Approval timed out")

2407

2423

try:

2408

2424

session.send(client.secret)

2409

2425

except gnutls.Error as error:

2410

logger.warning("gnutls send failed",

2411

exc_info=error)

2426

log.warning("gnutls send failed", exc_info=error)

2412

2427

return

2413

2428

2414

logger.info("Sending secret to %s", client.name)

2429

log.info("Sending secret to %s", client.name)

2415

2430

# bump the timeout using extended_timeout

2416

2431

client.bump_timeout(client.extended_timeout)

2417

2432

if self.server.use_dbus:

2424

2439

try:

2425

2440

session.bye()

2426

2441

except gnutls.Error as error:

2427

logger.warning("GnuTLS bye failed",

2428

exc_info=error)

2442

log.warning("GnuTLS bye failed", exc_info=error)

2429

2443

2430

2444

@staticmethod

2431

2445

def peer_certificate(session):

2432

2446

"Return the peer's certificate as a bytestring"

2433

2447

try:

2434

cert_type = gnutls.certificate_type_get2(session._c_object,

2435

gnutls.CTYPE_PEERS)

2448

cert_type = gnutls.certificate_type_get2(

2449

session, gnutls.CTYPE_PEERS)

2436

2450

except AttributeError:

2437

cert_type = gnutls.certificate_type_get(session._c_object)

2451

cert_type = gnutls.certificate_type_get(session)

2438

2452

if gnutls.has_rawpk:

2439

2453

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2440

2454

else:

2441

2455

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2442

2456

# If not a valid certificate type...

2443

2457

if cert_type not in valid_cert_types:

2444

logger.info("Cert type %r not in %r", cert_type,

2445

valid_cert_types)

2458

log.info("Cert type %r not in %r", cert_type,

2459

valid_cert_types)

2446

2460

# ...return invalid data

2447

2461

return b""

2448

2462

list_size = ctypes.c_uint(1)

2449

2463

cert_list = (gnutls.certificate_get_peers

2450

(session._c_object, ctypes.byref(list_size)))

2464

(session, ctypes.byref(list_size)))

2451

2465

if not bool(cert_list) and list_size.value != 0:

2452

2466

raise gnutls.Error("error getting peer certificate")

2453

2467

if list_size.value == 0:

2567

2581

2568

2582

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2569

2583

socketserver.TCPServer):

2570

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2584

"""IPv6-capable TCP server. Accepts None as address and/or port

2571

2585

2572

2586

Attributes:

2573

2587

enabled: Boolean; whether this server is activated yet

2624

2638

if SO_BINDTODEVICE is None:

2625

2639

# Fall back to a hard-coded value which seems to be

2626

2640

# common enough.

2627

logger.warning("SO_BINDTODEVICE not found, trying 25")

2641

log.warning("SO_BINDTODEVICE not found, trying 25")

2628

2642

SO_BINDTODEVICE = 25

2629

2643

try:

2630

2644

self.socket.setsockopt(

2632

2646

(self.interface + "\0").encode("utf-8"))

2633

2647

except socket.error as error:

2634

2648

if error.errno == errno.EPERM:

2635

logger.error("No permission to bind to"

2636

" interface %s", self.interface)

2649

log.error("No permission to bind to interface %s",

2650

self.interface)

2637

2651

elif error.errno == errno.ENOPROTOOPT:

2638

logger.error("SO_BINDTODEVICE not available;"

2639

" cannot bind to interface %s",

2640

self.interface)

2652

log.error("SO_BINDTODEVICE not available; cannot"

2653

" bind to interface %s", self.interface)

2641

2654

elif error.errno == errno.ENODEV:

2642

logger.error("Interface %s does not exist,"

2643

" cannot bind", self.interface)

2655

log.error("Interface %s does not exist, cannot"

2656

" bind", self.interface)

2644

2657

else:

2645

2658

raise

2646

2659

# Only bind(2) the socket if we really need to.

2725

2738

request = parent_pipe.recv()

2726

2739

command = request[0]

2727

2740

2728

if command == 'init':

2741

if command == "init":

2729

2742

key_id = request[1].decode("ascii")

2730

2743

fpr = request[2].decode("ascii")

2731

2744

address = request[3]

2741

2754

client = c

2742

2755

break

2743

2756

else:

2744

logger.info("Client not found for key ID: %s, address"

2745

": %s", key_id or fpr, address)

2757

log.info("Client not found for key ID: %s, address:"

2758

" %s", key_id or fpr, address)

2746

2759

if self.use_dbus:

2747

2760

# Emit D-Bus signal

2748

2761

mandos_dbus_service.ClientNotFound(key_id or fpr,

2761

2774

# remove the old hook in favor of the new above hook on

2762

2775

# same fileno

2763

2776

return False

2764

if command == 'funcall':

2777

if command == "funcall":

2765

2778

funcname = request[1]

2766

2779

args = request[2]

2767

2780

kwargs = request[3]

2768

2781

2769

parent_pipe.send(('data', getattr(client_object,

2782

parent_pipe.send(("data", getattr(client_object,

2770

2783

funcname)(*args,

2771

2784

**kwargs)))

2772

2785

2773

if command == 'getattr':

2786

if command == "getattr":

2774

2787

attrname = request[1]

2775

2788

if isinstance(client_object.__getattribute__(attrname),

2776

2789

collections.abc.Callable):

2777

parent_pipe.send(('function', ))

2790

parent_pipe.send(("function", ))

2778

2791

else:

2779

2792

parent_pipe.send((

2780

'data', client_object.__getattribute__(attrname)))

2793

"data", client_object.__getattribute__(attrname)))

2781

2794

2782

if command == 'setattr':

2795

if command == "setattr":

2783

2796

attrname = request[1]

2784

2797

value = request[2]

2785

2798

setattr(client_object, attrname, value)

2891

2904

def string_to_delta(interval):

2892

2905

"""Parse a string and return a datetime.timedelta

2893

2906

2894

>>> string_to_delta('7d') == datetime.timedelta(7)

2895

True

2896

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2897

True

2898

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2899

True

2900

>>> string_to_delta('24h') == datetime.timedelta(1)

2901

True

2902

>>> string_to_delta('1w') == datetime.timedelta(7)

2903

True

2904

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2907

>>> string_to_delta("7d") == datetime.timedelta(7)

2908

True

2909

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2910

True

2911

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2912

True

2913

>>> string_to_delta("24h") == datetime.timedelta(1)

2914

True

2915

>>> string_to_delta("1w") == datetime.timedelta(7)

2916

True

2917

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2905

2918

True

2906

2919

"""

2907

2920

3111

3124

3112

3125

if server_settings["servicename"] != "Mandos":

3113

3126

syslogger.setFormatter(

3114

logging.Formatter('Mandos ({}) [%(process)d]:'

3115

' %(levelname)s: %(message)s'.format(

3127

logging.Formatter("Mandos ({}) [%(process)d]:"

3128

" %(levelname)s: %(message)s".format(

3116

3129

server_settings["servicename"])))

3117

3130

3118

3131

# Parse config file with clients

3142

3155

try:

3143

3156

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

3144

3157

except IOError as e:

3145

logger.error("Could not open file %r", pidfilename,

3146

exc_info=e)

3158

log.error("Could not open file %r", pidfilename,

3159

exc_info=e)

3147

3160

3148

3161

for name, group in (("_mandos", "_mandos"),

3149

3162

("mandos", "mandos"),

3160

3173

try:

3161

3174

os.setgid(gid)

3162

3175

os.setuid(uid)

3163

if debug:

3164

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3165

gid))

3176

log.debug("Did setuid/setgid to %s:%s", uid, gid)

3166

3177

except OSError as error:

3167

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3168

.format(uid, gid, os.strerror(error.errno)))

3178

log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,

3179

os.strerror(error.errno))

3169

3180

if error.errno != errno.EPERM:

3170

3181

raise

3171

3182

3178

3189

3179

3190

@gnutls.log_func

3180

3191

def debug_gnutls(level, string):

3181

logger.debug("GnuTLS: %s", string[:-1])

3192

log.debug("GnuTLS: %s",

3193

string[:-1].decode("utf-8", errors="replace"))

3182

3194

3183

3195

gnutls.global_set_log_function(debug_gnutls)

3184

3196

3213

3225

"se.bsnet.fukt.Mandos", bus,

3214

3226

do_not_queue=True)

3215

3227

except dbus.exceptions.DBusException as e:

3216

logger.error("Disabling D-Bus:", exc_info=e)

3228

log.error("Disabling D-Bus:", exc_info=e)

3217

3229

use_dbus = False

3218

3230

server_settings["use_dbus"] = False

3219

3231

tcp_server.use_dbus = False

3304

3316

os.remove(stored_state_path)

3305

3317

except IOError as e:

3306

3318

if e.errno == errno.ENOENT:

3307

logger.warning("Could not load persistent state:"

3308

" {}".format(os.strerror(e.errno)))

3319

log.warning("Could not load persistent state:"

3320

" %s", os.strerror(e.errno))

3309

3321

else:

3310

logger.critical("Could not load persistent state:",

3311

exc_info=e)

3322

log.critical("Could not load persistent state:",

3323

exc_info=e)

3312

3324

raise

3313

3325

except EOFError as e:

3314

logger.warning("Could not load persistent state: "

3315

"EOFError:",

3316

exc_info=e)

3326

log.warning("Could not load persistent state: EOFError:",

3327

exc_info=e)

3317

3328

3318

3329

with PGPEngine() as pgp:

3319

3330

for client_name, client in clients_data.items():

3346

3357

if client["enabled"]:

3347

3358

if datetime.datetime.utcnow() >= client["expires"]:

3348

3359

if not client["last_checked_ok"]:

3349

logger.warning(

3350

"disabling client {} - Client never "

3351

"performed a successful checker".format(

3352

client_name))

3360

log.warning("disabling client %s - Client"

3361

" never performed a successful"

3362

" checker", client_name)

3353

3363

client["enabled"] = False

3354

3364

elif client["last_checker_status"] != 0:

3355

logger.warning(

3356

"disabling client {} - Client last"

3357

" checker failed with error code"

3358

" {}".format(

3359

client_name,

3360

client["last_checker_status"]))

3365

log.warning("disabling client %s - Client"

3366

" last checker failed with error"

3367

" code %s", client_name,

3368

client["last_checker_status"])

3361

3369

client["enabled"] = False

3362

3370

else:

3363

3371

client["expires"] = (

3364

3372

datetime.datetime.utcnow()

3365

3373

+ client["timeout"])

3366

logger.debug("Last checker succeeded,"

3367

" keeping {} enabled".format(

3368

client_name))

3374

log.debug("Last checker succeeded, keeping %s"

3375

" enabled", client_name)

3369

3376

try:

3370

3377

client["secret"] = pgp.decrypt(

3371

3378

client["encrypted_secret"],

3372

3379

client_settings[client_name]["secret"])

3373

3380

except PGPError:

3374

3381

# If decryption fails, we use secret from new settings

3375

logger.debug("Failed to decrypt {} old secret".format(

3376

client_name))

3382

log.debug("Failed to decrypt %s old secret",

3383

client_name)

3377

3384

client["secret"] = (client_settings[client_name]

3378

3385

["secret"])

3379

3386

3393

3400

server_settings=server_settings)

3394

3401

3395

3402

if not tcp_server.clients:

3396

logger.warning("No clients defined")

3403

log.warning("No clients defined")

3397

3404

3398

3405

if not foreground:

3399

3406

if pidfile is not None:

3402

3409

with pidfile:

3403

3410

print(pid, file=pidfile)

3404

3411

except IOError:

3405

logger.error("Could not write to file %r with PID %d",

3406

pidfilename, pid)

3412

log.error("Could not write to file %r with PID %d",

3413

pidfilename, pid)

3407

3414

del pidfile

3408

3415

del pidfilename

3409

3416

3559

3566

3560

3567

try:

3561

3568

with tempfile.NamedTemporaryFile(

3562

mode='wb',

3569

mode="wb",

3563

3570

suffix=".pickle",

3564

prefix='clients-',

3571

prefix="clients-",

3565

3572

dir=os.path.dirname(stored_state_path),

3566

3573

delete=False) as stored_state:

3567

3574

pickle.dump((clients, client_settings), stored_state,

3575

3582

except NameError:

3576

3583

pass

3577

3584

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3578

logger.warning("Could not save persistent state: {}"

3579

.format(os.strerror(e.errno)))

3585

log.warning("Could not save persistent state: %s",

3586

os.strerror(e.errno))

3580

3587

else:

3581

logger.warning("Could not save persistent state:",

3582

exc_info=e)

3588

log.warning("Could not save persistent state:",

3589

exc_info=e)

3583

3590

raise

3584

3591

3585

3592

# Delete all clients, and settings from config

3611

3618

if zeroconf:

3612

3619

service.port = tcp_server.socket.getsockname()[1]

3613

3620

if use_ipv6:

3614

logger.info("Now listening on address %r, port %d,"

3615

" flowinfo %d, scope_id %d",

3616

*tcp_server.socket.getsockname())

3621

log.info("Now listening on address %r, port %d, flowinfo %d,"

3622

" scope_id %d", *tcp_server.socket.getsockname())

3617

3623

else: # IPv4

3618

logger.info("Now listening on address %r, port %d",

3619

*tcp_server.socket.getsockname())

3624

log.info("Now listening on address %r, port %d",

3625

*tcp_server.socket.getsockname())

3620

3626

3621

3627

# service.interface = tcp_server.socket.getsockname()[3]

3622

3628

3626

3632

try:

3627

3633

service.activate()

3628

3634

except dbus.exceptions.DBusException as error:

3629

logger.critical("D-Bus Exception", exc_info=error)

3635

log.critical("D-Bus Exception", exc_info=error)

3630

3636

cleanup()

3631

3637

sys.exit(1)

3632

3638

# End of Avahi example code

3637

3643

lambda *args, **kwargs: (tcp_server.handle_request

3638

3644

(*args[2:], **kwargs) or True))

3639

3645

3640

logger.debug("Starting main loop")

3646

log.debug("Starting main loop")

3641

3647

main_loop.run()

3642

3648

except AvahiError as error:

3643

logger.critical("Avahi Error", exc_info=error)

3649

log.critical("Avahi Error", exc_info=error)

3644

3650

cleanup()

3645

3651

sys.exit(1)

3646

3652

except KeyboardInterrupt:

3647

3653

if debug:

3648

3654

print("", file=sys.stderr)

3649

logger.debug("Server received KeyboardInterrupt")

3650

logger.debug("Server exiting")

3655

log.debug("Server received KeyboardInterrupt")

3656

log.debug("Server exiting")

3651

3657

# Must run before the D-Bus bus name gets deregistered

3652

3658

cleanup()

3653

3659

3654

3660

3655

def should_only_run_tests():

3661

def parse_test_args():

3662

# type: () -> argparse.Namespace

3656

3663

parser = argparse.ArgumentParser(add_help=False)

3657

parser.add_argument("--check", action='store_true')

3664

parser.add_argument("--check", action="store_true")

3665

parser.add_argument("--prefix", )

3658

3666

args, unknown_args = parser.parse_known_args()

3659

run_tests = args.check

3660

if run_tests:

3661

# Remove --check argument from sys.argv

3667

if args.check:

3668

# Remove test options from sys.argv

3662

3669

sys.argv[1:] = unknown_args

3663

return run_tests

3670

return args

3664

3671

3665

3672

# Add all tests from doctest strings

3666

3673

def load_tests(loader, tests, none):

3668

3675

tests.addTests(doctest.DocTestSuite())

3669

3676

return tests

3670

3677

3671

if __name__ == '__main__':

3678

if __name__ == "__main__":

3679

options = parse_test_args()

3672

3680

try:

3673

if should_only_run_tests():

3674

# Call using ./mandos --check [--verbose]

3675

unittest.main()

3681

if options.check:

3682

extra_test_prefix = options.prefix

3683

if extra_test_prefix is not None:

3684

if not (unittest.main(argv=[""], exit=False)

3685

.result.wasSuccessful()):

3686

sys.exit(1)

3687

class ExtraTestLoader(unittest.TestLoader):

3688

testMethodPrefix = extra_test_prefix

3689

# Call using ./scriptname --test [--verbose]

3690

unittest.main(argv=[""], testLoader=ExtraTestLoader())

3691

else:

3692

unittest.main(argv=[""])

3676

3693

else:

3677

3694

main()

3678

3695

finally:

3679

3696

logging.shutdown()

3697

3698

# Local Variables:

3699

# run-tests:

3700

# (lambda (&optional extra)

3701

# (if (not (funcall run-tests-in-test-buffer default-directory

3702

# extra))

3703

# (funcall show-test-buffer-in-test-window)

3704

# (funcall remove-test-window)

3705

# (if extra (message "Extra tests run successfully!"))))

3706

# run-tests-in-test-buffer:

3707

# (lambda (dir &optional extra)

3708

# (with-current-buffer (get-buffer-create "*Test*")

3709

# (setq buffer-read-only nil

3710

# default-directory dir)

3711

# (erase-buffer)

3712

# (compilation-mode))

3713

# (let ((process-result

3714

# (let ((inhibit-read-only t))

3715

# (process-file-shell-command

3716

# (funcall get-command-line extra) nil "*Test*"))))

3717

# (and (numberp process-result)

3718

# (= process-result 0))))

3719

# get-command-line:

3720

# (lambda (&optional extra)

3721

# (let ((quoted-script

3722

# (shell-quote-argument (funcall get-script-name))))

3723

# (format

3724

# (concat "%s --check" (if extra " --prefix=atest" ""))

3725

# quoted-script)))

3726

# get-script-name:

3727

# (lambda ()

3728

# (if (fboundp 'file-local-name)

3729

# (file-local-name (buffer-file-name))

3730

# (or (file-remote-p (buffer-file-name) 'localname)

3731

# (buffer-file-name))))

3732

# remove-test-window:

3733

# (lambda ()

3734

# (let ((test-window (get-buffer-window "*Test*")))

3735

# (if test-window (delete-window test-window))))

3736

# show-test-buffer-in-test-window:

3737

# (lambda ()

3738

# (when (not (get-buffer-window-list "*Test*"))

3739

# (setq next-error-last-buffer (get-buffer "*Test*"))

3740

# (let* ((side (if (>= (window-width) 146) 'right 'bottom))

3741

# (display-buffer-overriding-action

3742

# `((display-buffer-in-side-window) (side . ,side)

3743

# (window-height . fit-window-to-buffer)

3744

# (window-width . fit-window-to-buffer))))

3745

# (display-buffer "*Test*"))))

3746

# eval:

3747

# (progn

3748

# (let* ((run-extra-tests (lambda () (interactive)

3749

# (funcall run-tests t)))

3750

# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t

3751

# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c

3752

# (setq minor-mode-overriding-map-alist

3753

# (cons `(run-tests . ,outer-keymap)

3754

# minor-mode-overriding-map-alist)))

3755

# (add-hook 'after-save-hook run-tests 90 t))

3756

# End: