/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2022-04-25 18:33:20 UTC
  • mfrom: (1260 trunk)
  • mto: This revision was merged to the branch mainline in revision 1261.
  • Revision ID: teddy@recompile.se-20220425183320-w83scg055sinkow4
Merge from trunk

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
1
#!/usr/bin/python3 -bI
2
 
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
 
2
# -*- coding: utf-8; lexical-binding: t -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
 
# Copyright © 2008-2020 Teddy Hogeborn
15
 
# Copyright © 2008-2020 Björn Påhlsson
 
14
# Copyright © 2008-2022 Teddy Hogeborn
 
15
# Copyright © 2008-2022 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
 
 
35
34
from __future__ import (division, absolute_import, print_function,
36
35
                        unicode_literals)
37
36
 
40
39
except ImportError:
41
40
    pass
42
41
 
 
42
import sys
 
43
import unittest
 
44
import argparse
 
45
import logging
 
46
import os
43
47
try:
44
48
    import SocketServer as socketserver
45
49
except ImportError:
46
50
    import socketserver
47
51
import socket
48
 
import argparse
49
52
import datetime
50
53
import errno
51
54
try:
52
55
    import ConfigParser as configparser
53
56
except ImportError:
54
57
    import configparser
55
 
import sys
56
58
import re
57
 
import os
58
59
import signal
59
60
import subprocess
60
61
import atexit
61
62
import stat
62
 
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
 
import unittest
81
80
import random
82
81
import shlex
83
82
 
94
93
if sys.version_info.major == 2:
95
94
    __metaclass__ = type
96
95
    str = unicode
 
96
    input = raw_input
97
97
 
98
98
# Add collections.abc.Callable if it does not exist
99
99
try:
146
146
version = "1.8.14"
147
147
stored_state_file = "clients.pickle"
148
148
 
149
 
logger = logging.getLogger()
 
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
150
150
logging.captureWarnings(True)   # Show warnings via the logging system
151
151
syslogger = None
152
152
 
189
189
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
190
        address="/dev/log"))
191
191
    syslogger.setFormatter(logging.Formatter
192
 
                           ('Mandos [%(process)d]: %(levelname)s:'
193
 
                            ' %(message)s'))
194
 
    logger.addHandler(syslogger)
 
192
                           ("Mandos [%(process)d]: %(levelname)s:"
 
193
                            " %(message)s"))
 
194
    log.addHandler(syslogger)
195
195
 
196
196
    if debug:
197
197
        console = logging.StreamHandler()
198
 
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
199
 
                                               ' [%(process)d]:'
200
 
                                               ' %(levelname)s:'
201
 
                                               ' %(message)s'))
202
 
        logger.addHandler(console)
203
 
    logger.setLevel(level)
 
198
        console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
 
199
                                               " [%(process)d]:"
 
200
                                               " %(levelname)s:"
 
201
                                               " %(message)s"))
 
202
        log.addHandler(console)
 
203
    log.setLevel(level)
204
204
 
205
205
 
206
206
class PGPError(Exception):
224
224
        except OSError as e:
225
225
            if e.errno != errno.ENOENT:
226
226
                raise
227
 
        self.gnupgargs = ['--batch',
228
 
                          '--homedir', self.tempdir,
229
 
                          '--force-mdc',
230
 
                          '--quiet']
 
227
        self.gnupgargs = ["--batch",
 
228
                          "--homedir", self.tempdir,
 
229
                          "--force-mdc",
 
230
                          "--quiet"]
231
231
        # Only GPG version 1 has the --no-use-agent option.
232
232
        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
233
233
            self.gnupgargs.append("--no-use-agent")
272
272
                dir=self.tempdir) as passfile:
273
273
            passfile.write(passphrase)
274
274
            passfile.flush()
275
 
            proc = subprocess.Popen([self.gpg, '--symmetric',
276
 
                                     '--passphrase-file',
 
275
            proc = subprocess.Popen([self.gpg, "--symmetric",
 
276
                                     "--passphrase-file",
277
277
                                     passfile.name]
278
278
                                    + self.gnupgargs,
279
279
                                    stdin=subprocess.PIPE,
290
290
                dir=self.tempdir) as passfile:
291
291
            passfile.write(passphrase)
292
292
            passfile.flush()
293
 
            proc = subprocess.Popen([self.gpg, '--decrypt',
294
 
                                     '--passphrase-file',
 
293
            proc = subprocess.Popen([self.gpg, "--decrypt",
 
294
                                     "--passphrase-file",
295
295
                                     passfile.name]
296
296
                                    + self.gnupgargs,
297
297
                                    stdin=subprocess.PIPE,
350
350
    Attributes:
351
351
    interface: integer; avahi.IF_UNSPEC or an interface index.
352
352
               Used to optionally bind to the specified interface.
353
 
    name: string; Example: 'Mandos'
354
 
    type: string; Example: '_mandos._tcp'.
 
353
    name: string; Example: "Mandos"
 
354
    type: string; Example: "_mandos._tcp".
355
355
     See <https://www.iana.org/assignments/service-names-port-numbers>
356
356
    port: integer; what port to announce
357
357
    TXT: list of strings; TXT record for the service
394
394
    def rename(self, remove=True):
395
395
        """Derived from the Avahi example code"""
396
396
        if self.rename_count >= self.max_renames:
397
 
            logger.critical("No suitable Zeroconf service name found"
398
 
                            " after %i retries, exiting.",
399
 
                            self.rename_count)
 
397
            log.critical("No suitable Zeroconf service name found"
 
398
                         " after %i retries, exiting.",
 
399
                         self.rename_count)
400
400
            raise AvahiServiceError("Too many renames")
401
401
        self.name = str(
402
402
            self.server.GetAlternativeServiceName(self.name))
403
403
        self.rename_count += 1
404
 
        logger.info("Changing Zeroconf service name to %r ...",
405
 
                    self.name)
 
404
        log.info("Changing Zeroconf service name to %r ...",
 
405
                 self.name)
406
406
        if remove:
407
407
            self.remove()
408
408
        try:
410
410
        except dbus.exceptions.DBusException as error:
411
411
            if (error.get_dbus_name()
412
412
                == "org.freedesktop.Avahi.CollisionError"):
413
 
                logger.info("Local Zeroconf service name collision.")
 
413
                log.info("Local Zeroconf service name collision.")
414
414
                return self.rename(remove=False)
415
415
            else:
416
 
                logger.critical("D-Bus Exception", exc_info=error)
 
416
                log.critical("D-Bus Exception", exc_info=error)
417
417
                self.cleanup()
418
418
                os._exit(1)
419
419
 
435
435
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
436
        self.entry_group_state_changed_match = (
437
437
            self.group.connect_to_signal(
438
 
                'StateChanged', self.entry_group_state_changed))
439
 
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
 
                     self.name, self.type)
 
438
                "StateChanged", self.entry_group_state_changed))
 
439
        log.debug("Adding Zeroconf service '%s' of type '%s' ...",
 
440
                  self.name, self.type)
441
441
        self.group.AddService(
442
442
            self.interface,
443
443
            self.protocol,
450
450
 
451
451
    def entry_group_state_changed(self, state, error):
452
452
        """Derived from the Avahi example code"""
453
 
        logger.debug("Avahi entry group state change: %i", state)
 
453
        log.debug("Avahi entry group state change: %i", state)
454
454
 
455
455
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
 
            logger.debug("Zeroconf service established.")
 
456
            log.debug("Zeroconf service established.")
457
457
        elif state == avahi.ENTRY_GROUP_COLLISION:
458
 
            logger.info("Zeroconf service name collision.")
 
458
            log.info("Zeroconf service name collision.")
459
459
            self.rename()
460
460
        elif state == avahi.ENTRY_GROUP_FAILURE:
461
 
            logger.critical("Avahi: Error in group state changed %s",
462
 
                            str(error))
 
461
            log.critical("Avahi: Error in group state changed %s",
 
462
                         str(error))
463
463
            raise AvahiGroupError("State changed: {!s}".format(error))
464
464
 
465
465
    def cleanup(self):
475
475
 
476
476
    def server_state_changed(self, state, error=None):
477
477
        """Derived from the Avahi example code"""
478
 
        logger.debug("Avahi server state change: %i", state)
 
478
        log.debug("Avahi server state change: %i", state)
479
479
        bad_states = {
480
480
            avahi.SERVER_INVALID: "Zeroconf server invalid",
481
481
            avahi.SERVER_REGISTERING: None,
485
485
        if state in bad_states:
486
486
            if bad_states[state] is not None:
487
487
                if error is None:
488
 
                    logger.error(bad_states[state])
 
488
                    log.error(bad_states[state])
489
489
                else:
490
 
                    logger.error(bad_states[state] + ": %r", error)
 
490
                    log.error(bad_states[state] + ": %r", error)
491
491
            self.cleanup()
492
492
        elif state == avahi.SERVER_RUNNING:
493
493
            try:
495
495
            except dbus.exceptions.DBusException as error:
496
496
                if (error.get_dbus_name()
497
497
                    == "org.freedesktop.Avahi.CollisionError"):
498
 
                    logger.info("Local Zeroconf service name"
499
 
                                " collision.")
 
498
                    log.info("Local Zeroconf service name collision.")
500
499
                    return self.rename(remove=False)
501
500
                else:
502
 
                    logger.critical("D-Bus Exception", exc_info=error)
 
501
                    log.critical("D-Bus Exception", exc_info=error)
503
502
                    self.cleanup()
504
503
                    os._exit(1)
505
504
        else:
506
505
            if error is None:
507
 
                logger.debug("Unknown state: %r", state)
 
506
                log.debug("Unknown state: %r", state)
508
507
            else:
509
 
                logger.debug("Unknown state: %r: %r", state, error)
 
508
                log.debug("Unknown state: %r: %r", state, error)
510
509
 
511
510
    def activate(self):
512
511
        """Derived from the Avahi example code"""
527
526
        ret = super(AvahiServiceToSyslog, self).rename(*args,
528
527
                                                       **kwargs)
529
528
        syslogger.setFormatter(logging.Formatter(
530
 
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
 
529
            "Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
531
530
            .format(self.name)))
532
531
        return ret
533
532
 
563
562
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
564
563
 
565
564
    # Types
566
 
    class session_int(ctypes.Structure):
 
565
    class _session_int(ctypes.Structure):
567
566
        _fields_ = []
568
 
    session_t = ctypes.POINTER(session_int)
 
567
    session_t = ctypes.POINTER(_session_int)
569
568
 
570
569
    class certificate_credentials_st(ctypes.Structure):
571
570
        _fields_ = []
574
573
    certificate_type_t = ctypes.c_int
575
574
 
576
575
    class datum_t(ctypes.Structure):
577
 
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
578
 
                    ('size', ctypes.c_uint)]
 
576
        _fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
 
577
                    ("size", ctypes.c_uint)]
579
578
 
580
 
    class openpgp_crt_int(ctypes.Structure):
 
579
    class _openpgp_crt_int(ctypes.Structure):
581
580
        _fields_ = []
582
 
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
 
581
    openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
583
582
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
584
583
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
585
584
    credentials_type_t = ctypes.c_int
594
593
            # gnutls.strerror()
595
594
            self.code = code
596
595
            if message is None and code is not None:
597
 
                message = gnutls.strerror(code)
 
596
                message = gnutls.strerror(code).decode(
 
597
                    "utf-8", errors="replace")
598
598
            return super(gnutls.Error, self).__init__(
599
599
                message, *args)
600
600
 
601
601
    class CertificateSecurityError(Error):
602
602
        pass
603
603
 
 
604
    class PointerTo:
 
605
        def __init__(self, cls):
 
606
            self.cls = cls
 
607
 
 
608
        def from_param(self, obj):
 
609
            if not isinstance(obj, self.cls):
 
610
                raise TypeError("Not of type {}: {!r}"
 
611
                                .format(self.cls.__name__, obj))
 
612
            return ctypes.byref(obj.from_param(obj))
 
613
 
 
614
    class CastToVoidPointer:
 
615
        def __init__(self, cls):
 
616
            self.cls = cls
 
617
 
 
618
        def from_param(self, obj):
 
619
            if not isinstance(obj, self.cls):
 
620
                raise TypeError("Not of type {}: {!r}"
 
621
                                .format(self.cls.__name__, obj))
 
622
            return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
 
623
 
 
624
    class With_from_param:
 
625
        @classmethod
 
626
        def from_param(cls, obj):
 
627
            return obj._as_parameter_
 
628
 
604
629
    # Classes
605
 
    class Credentials:
 
630
    class Credentials(With_from_param):
606
631
        def __init__(self):
607
 
            self._c_object = gnutls.certificate_credentials_t()
608
 
            gnutls.certificate_allocate_credentials(
609
 
                ctypes.byref(self._c_object))
 
632
            self._as_parameter_ = gnutls.certificate_credentials_t()
 
633
            gnutls.certificate_allocate_credentials(self)
610
634
            self.type = gnutls.CRD_CERTIFICATE
611
635
 
612
636
        def __del__(self):
613
 
            gnutls.certificate_free_credentials(self._c_object)
 
637
            gnutls.certificate_free_credentials(self)
614
638
 
615
 
    class ClientSession:
 
639
    class ClientSession(With_from_param):
616
640
        def __init__(self, socket, credentials=None):
617
 
            self._c_object = gnutls.session_t()
 
641
            self._as_parameter_ = gnutls.session_t()
618
642
            gnutls_flags = gnutls.CLIENT
619
643
            if gnutls.check_version(b"3.5.6"):
620
644
                gnutls_flags |= gnutls.NO_TICKETS
621
645
            if gnutls.has_rawpk:
622
646
                gnutls_flags |= gnutls.ENABLE_RAWPK
623
 
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
 
647
            gnutls.init(self, gnutls_flags)
624
648
            del gnutls_flags
625
 
            gnutls.set_default_priority(self._c_object)
626
 
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
627
 
            gnutls.handshake_set_private_extensions(self._c_object,
628
 
                                                    True)
 
649
            gnutls.set_default_priority(self)
 
650
            gnutls.transport_set_ptr(self, socket.fileno())
 
651
            gnutls.handshake_set_private_extensions(self, True)
629
652
            self.socket = socket
630
653
            if credentials is None:
631
654
                credentials = gnutls.Credentials()
632
 
            gnutls.credentials_set(self._c_object, credentials.type,
633
 
                                   ctypes.cast(credentials._c_object,
634
 
                                               ctypes.c_void_p))
 
655
            gnutls.credentials_set(self, credentials.type,
 
656
                                   credentials)
635
657
            self.credentials = credentials
636
658
 
637
659
        def __del__(self):
638
 
            gnutls.deinit(self._c_object)
 
660
            gnutls.deinit(self)
639
661
 
640
662
        def handshake(self):
641
 
            return gnutls.handshake(self._c_object)
 
663
            return gnutls.handshake(self)
642
664
 
643
665
        def send(self, data):
644
666
            data = bytes(data)
645
667
            data_len = len(data)
646
668
            while data_len > 0:
647
 
                data_len -= gnutls.record_send(self._c_object,
648
 
                                               data[-data_len:],
 
669
                data_len -= gnutls.record_send(self, data[-data_len:],
649
670
                                               data_len)
650
671
 
651
672
        def bye(self):
652
 
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
 
673
            return gnutls.bye(self, gnutls.SHUT_RDWR)
653
674
 
654
675
    # Error handling functions
655
676
    def _error_code(result):
656
677
        """A function to raise exceptions on errors, suitable
657
 
        for the 'restype' attribute on ctypes functions"""
658
 
        if result >= 0:
 
678
        for the "restype" attribute on ctypes functions"""
 
679
        if result >= gnutls.E_SUCCESS:
659
680
            return result
660
681
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
661
682
            raise gnutls.CertificateSecurityError(code=result)
662
683
        raise gnutls.Error(code=result)
663
684
 
664
 
    def _retry_on_error(result, func, arguments):
 
685
    def _retry_on_error(result, func, arguments,
 
686
                        _error_code=_error_code):
665
687
        """A function to retry on some errors, suitable
666
 
        for the 'errcheck' attribute on ctypes functions"""
667
 
        while result < 0:
 
688
        for the "errcheck" attribute on ctypes functions"""
 
689
        while result < gnutls.E_SUCCESS:
668
690
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
669
691
                return _error_code(result)
670
692
            result = func(*arguments)
675
697
 
676
698
    # Functions
677
699
    priority_set_direct = _library.gnutls_priority_set_direct
678
 
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
 
700
    priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
679
701
                                    ctypes.POINTER(ctypes.c_char_p)]
680
702
    priority_set_direct.restype = _error_code
681
703
 
682
704
    init = _library.gnutls_init
683
 
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
 
705
    init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
684
706
    init.restype = _error_code
685
707
 
686
708
    set_default_priority = _library.gnutls_set_default_priority
687
 
    set_default_priority.argtypes = [session_t]
 
709
    set_default_priority.argtypes = [ClientSession]
688
710
    set_default_priority.restype = _error_code
689
711
 
690
712
    record_send = _library.gnutls_record_send
691
 
    record_send.argtypes = [session_t, ctypes.c_void_p,
 
713
    record_send.argtypes = [ClientSession, ctypes.c_void_p,
692
714
                            ctypes.c_size_t]
693
715
    record_send.restype = ctypes.c_ssize_t
694
716
    record_send.errcheck = _retry_on_error
696
718
    certificate_allocate_credentials = (
697
719
        _library.gnutls_certificate_allocate_credentials)
698
720
    certificate_allocate_credentials.argtypes = [
699
 
        ctypes.POINTER(certificate_credentials_t)]
 
721
        PointerTo(Credentials)]
700
722
    certificate_allocate_credentials.restype = _error_code
701
723
 
702
724
    certificate_free_credentials = (
703
725
        _library.gnutls_certificate_free_credentials)
704
 
    certificate_free_credentials.argtypes = [
705
 
        certificate_credentials_t]
 
726
    certificate_free_credentials.argtypes = [Credentials]
706
727
    certificate_free_credentials.restype = None
707
728
 
708
729
    handshake_set_private_extensions = (
709
730
        _library.gnutls_handshake_set_private_extensions)
710
 
    handshake_set_private_extensions.argtypes = [session_t,
 
731
    handshake_set_private_extensions.argtypes = [ClientSession,
711
732
                                                 ctypes.c_int]
712
733
    handshake_set_private_extensions.restype = None
713
734
 
714
735
    credentials_set = _library.gnutls_credentials_set
715
 
    credentials_set.argtypes = [session_t, credentials_type_t,
716
 
                                ctypes.c_void_p]
 
736
    credentials_set.argtypes = [ClientSession, credentials_type_t,
 
737
                                CastToVoidPointer(Credentials)]
717
738
    credentials_set.restype = _error_code
718
739
 
719
740
    strerror = _library.gnutls_strerror
721
742
    strerror.restype = ctypes.c_char_p
722
743
 
723
744
    certificate_type_get = _library.gnutls_certificate_type_get
724
 
    certificate_type_get.argtypes = [session_t]
 
745
    certificate_type_get.argtypes = [ClientSession]
725
746
    certificate_type_get.restype = _error_code
726
747
 
727
748
    certificate_get_peers = _library.gnutls_certificate_get_peers
728
 
    certificate_get_peers.argtypes = [session_t,
 
749
    certificate_get_peers.argtypes = [ClientSession,
729
750
                                      ctypes.POINTER(ctypes.c_uint)]
730
751
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
731
752
 
738
759
    global_set_log_function.restype = None
739
760
 
740
761
    deinit = _library.gnutls_deinit
741
 
    deinit.argtypes = [session_t]
 
762
    deinit.argtypes = [ClientSession]
742
763
    deinit.restype = None
743
764
 
744
765
    handshake = _library.gnutls_handshake
745
 
    handshake.argtypes = [session_t]
746
 
    handshake.restype = _error_code
 
766
    handshake.argtypes = [ClientSession]
 
767
    handshake.restype = ctypes.c_int
747
768
    handshake.errcheck = _retry_on_error
748
769
 
749
770
    transport_set_ptr = _library.gnutls_transport_set_ptr
750
 
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
 
771
    transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
751
772
    transport_set_ptr.restype = None
752
773
 
753
774
    bye = _library.gnutls_bye
754
 
    bye.argtypes = [session_t, close_request_t]
755
 
    bye.restype = _error_code
 
775
    bye.argtypes = [ClientSession, close_request_t]
 
776
    bye.restype = ctypes.c_int
756
777
    bye.errcheck = _retry_on_error
757
778
 
758
779
    check_version = _library.gnutls_check_version
832
853
 
833
854
    if check_version(b"3.6.4"):
834
855
        certificate_type_get2 = _library.gnutls_certificate_type_get2
835
 
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
 
856
        certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
836
857
        certificate_type_get2.restype = _error_code
837
858
 
838
859
    # Remove non-public functions
854
875
    """A representation of a client host served by this server.
855
876
 
856
877
    Attributes:
857
 
    approved:   bool(); 'None' if not yet approved/disapproved
 
878
    approved:   bool(); None if not yet approved/disapproved
858
879
    approval_delay: datetime.timedelta(); Time to wait for approval
859
880
    approval_duration: datetime.timedelta(); Duration of one approval
860
881
    checker: multiprocessing.Process(); a running checker process used
861
 
             to see if the client lives. 'None' if no process is
 
882
             to see if the client lives. None if no process is
862
883
             running.
863
884
    checker_callback_tag: a GLib event source tag, or None
864
885
    checker_command: string; External command which is run to check
988
1009
            self.last_enabled = None
989
1010
            self.expires = None
990
1011
 
991
 
        logger.debug("Creating client %r", self.name)
992
 
        logger.debug("  Key ID: %s", self.key_id)
993
 
        logger.debug("  Fingerprint: %s", self.fingerprint)
 
1012
        log.debug("Creating client %r", self.name)
 
1013
        log.debug("  Key ID: %s", self.key_id)
 
1014
        log.debug("  Fingerprint: %s", self.fingerprint)
994
1015
        self.created = settings.get("created",
995
1016
                                    datetime.datetime.utcnow())
996
1017
 
1035
1056
        if not getattr(self, "enabled", False):
1036
1057
            return False
1037
1058
        if not quiet:
1038
 
            logger.info("Disabling client %s", self.name)
 
1059
            log.info("Disabling client %s", self.name)
1039
1060
        if getattr(self, "disable_initiator_tag", None) is not None:
1040
1061
            GLib.source_remove(self.disable_initiator_tag)
1041
1062
            self.disable_initiator_tag = None
1085
1106
            self.last_checker_status = returncode
1086
1107
            self.last_checker_signal = None
1087
1108
            if self.last_checker_status == 0:
1088
 
                logger.info("Checker for %(name)s succeeded",
1089
 
                            vars(self))
 
1109
                log.info("Checker for %(name)s succeeded", vars(self))
1090
1110
                self.checked_ok()
1091
1111
            else:
1092
 
                logger.info("Checker for %(name)s failed", vars(self))
 
1112
                log.info("Checker for %(name)s failed", vars(self))
1093
1113
        else:
1094
1114
            self.last_checker_status = -1
1095
1115
            self.last_checker_signal = -returncode
1096
 
            logger.warning("Checker for %(name)s crashed?",
1097
 
                           vars(self))
 
1116
            log.warning("Checker for %(name)s crashed?", vars(self))
1098
1117
        return False
1099
1118
 
1100
1119
    def checked_ok(self):
1134
1153
        # should be.
1135
1154
 
1136
1155
        if self.checker is not None and not self.checker.is_alive():
1137
 
            logger.warning("Checker was not alive; joining")
 
1156
            log.warning("Checker was not alive; joining")
1138
1157
            self.checker.join()
1139
1158
            self.checker = None
1140
1159
        # Start a new checker if needed
1146
1165
            try:
1147
1166
                command = self.checker_command % escaped_attrs
1148
1167
            except TypeError as error:
1149
 
                logger.error('Could not format string "%s"',
1150
 
                             self.checker_command,
1151
 
                             exc_info=error)
 
1168
                log.error('Could not format string "%s"',
 
1169
                          self.checker_command, exc_info=error)
1152
1170
                return True     # Try again later
1153
1171
            self.current_checker_command = command
1154
 
            logger.info("Starting checker %r for %s", command,
1155
 
                        self.name)
 
1172
            log.info("Starting checker %r for %s", command, self.name)
1156
1173
            # We don't need to redirect stdout and stderr, since
1157
1174
            # in normal mode, that is already done by daemon(),
1158
1175
            # and in debug mode we don't want to.  (Stdin is
1187
1204
            self.checker_callback_tag = None
1188
1205
        if getattr(self, "checker", None) is None:
1189
1206
            return
1190
 
        logger.debug("Stopping checker for %(name)s", vars(self))
 
1207
        log.debug("Stopping checker for %(name)s", vars(self))
1191
1208
        self.checker.terminate()
1192
1209
        self.checker = None
1193
1210
 
1220
1237
        func._dbus_name = func.__name__
1221
1238
        if func._dbus_name.endswith("_dbus_property"):
1222
1239
            func._dbus_name = func._dbus_name[:-14]
1223
 
        func._dbus_get_args_options = {'byte_arrays': byte_arrays}
 
1240
        func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1224
1241
        return func
1225
1242
 
1226
1243
    return decorator
1315
1332
 
1316
1333
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1317
1334
                         out_signature="s",
1318
 
                         path_keyword='object_path',
1319
 
                         connection_keyword='connection')
 
1335
                         path_keyword="object_path",
 
1336
                         connection_keyword="connection")
1320
1337
    def Introspect(self, object_path, connection):
1321
1338
        """Overloading of standard D-Bus method.
1322
1339
 
1371
1388
            document.unlink()
1372
1389
        except (AttributeError, xml.dom.DOMException,
1373
1390
                xml.parsers.expat.ExpatError) as error:
1374
 
            logger.error("Failed to override Introspection method",
1375
 
                         exc_info=error)
 
1391
            log.error("Failed to override Introspection method",
 
1392
                      exc_info=error)
1376
1393
        return xmlstring
1377
1394
 
1378
1395
 
1475
1492
 
1476
1493
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1477
1494
                         out_signature="s",
1478
 
                         path_keyword='object_path',
1479
 
                         connection_keyword='connection')
 
1495
                         path_keyword="object_path",
 
1496
                         connection_keyword="connection")
1480
1497
    def Introspect(self, object_path, connection):
1481
1498
        """Overloading of standard D-Bus method.
1482
1499
 
1538
1555
            document.unlink()
1539
1556
        except (AttributeError, xml.dom.DOMException,
1540
1557
                xml.parsers.expat.ExpatError) as error:
1541
 
            logger.error("Failed to override Introspection method",
1542
 
                         exc_info=error)
 
1558
            log.error("Failed to override Introspection method",
 
1559
                      exc_info=error)
1543
1560
        return xmlstring
1544
1561
 
1545
1562
 
1577
1594
 
1578
1595
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1579
1596
                         out_signature="s",
1580
 
                         path_keyword='object_path',
1581
 
                         connection_keyword='connection')
 
1597
                         path_keyword="object_path",
 
1598
                         connection_keyword="connection")
1582
1599
    def Introspect(self, object_path, connection):
1583
1600
        """Overloading of standard D-Bus method.
1584
1601
 
1609
1626
            document.unlink()
1610
1627
        except (AttributeError, xml.dom.DOMException,
1611
1628
                xml.parsers.expat.ExpatError) as error:
1612
 
            logger.error("Failed to override Introspection method",
1613
 
                         exc_info=error)
 
1629
            log.error("Failed to override Introspection method",
 
1630
                      exc_info=error)
1614
1631
        return xmlstring
1615
1632
 
1616
1633
 
2250
2267
class ProxyClient:
2251
2268
    def __init__(self, child_pipe, key_id, fpr, address):
2252
2269
        self._pipe = child_pipe
2253
 
        self._pipe.send(('init', key_id, fpr, address))
 
2270
        self._pipe.send(("init", key_id, fpr, address))
2254
2271
        if not self._pipe.recv():
2255
2272
            raise KeyError(key_id or fpr)
2256
2273
 
2257
2274
    def __getattribute__(self, name):
2258
 
        if name == '_pipe':
 
2275
        if name == "_pipe":
2259
2276
            return super(ProxyClient, self).__getattribute__(name)
2260
 
        self._pipe.send(('getattr', name))
 
2277
        self._pipe.send(("getattr", name))
2261
2278
        data = self._pipe.recv()
2262
 
        if data[0] == 'data':
 
2279
        if data[0] == "data":
2263
2280
            return data[1]
2264
 
        if data[0] == 'function':
 
2281
        if data[0] == "function":
2265
2282
 
2266
2283
            def func(*args, **kwargs):
2267
 
                self._pipe.send(('funcall', name, args, kwargs))
 
2284
                self._pipe.send(("funcall", name, args, kwargs))
2268
2285
                return self._pipe.recv()[1]
2269
2286
 
2270
2287
            return func
2271
2288
 
2272
2289
    def __setattr__(self, name, value):
2273
 
        if name == '_pipe':
 
2290
        if name == "_pipe":
2274
2291
            return super(ProxyClient, self).__setattr__(name, value)
2275
 
        self._pipe.send(('setattr', name, value))
 
2292
        self._pipe.send(("setattr", name, value))
2276
2293
 
2277
2294
 
2278
2295
class ClientHandler(socketserver.BaseRequestHandler, object):
2283
2300
 
2284
2301
    def handle(self):
2285
2302
        with contextlib.closing(self.server.child_pipe) as child_pipe:
2286
 
            logger.info("TCP connection from: %s",
2287
 
                        str(self.client_address))
2288
 
            logger.debug("Pipe FD: %d",
2289
 
                         self.server.child_pipe.fileno())
 
2303
            log.info("TCP connection from: %s",
 
2304
                     str(self.client_address))
 
2305
            log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2290
2306
 
2291
2307
            session = gnutls.ClientSession(self.request)
2292
2308
 
2293
 
            # priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
2309
            # priority = ":".join(("NONE", "+VERS-TLS1.1",
2294
2310
            #                       "+AES-256-CBC", "+SHA1",
2295
2311
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
2296
2312
            #                       "+DHE-DSS"))
2298
2314
            priority = self.server.gnutls_priority
2299
2315
            if priority is None:
2300
2316
                priority = "NORMAL"
2301
 
            gnutls.priority_set_direct(session._c_object,
2302
 
                                       priority.encode("utf-8"),
2303
 
                                       None)
 
2317
            gnutls.priority_set_direct(session,
 
2318
                                       priority.encode("utf-8"), None)
2304
2319
 
2305
2320
            # Start communication using the Mandos protocol
2306
2321
            # Get protocol number
2307
2322
            line = self.request.makefile().readline()
2308
 
            logger.debug("Protocol version: %r", line)
 
2323
            log.debug("Protocol version: %r", line)
2309
2324
            try:
2310
2325
                if int(line.strip().split()[0]) > 1:
2311
2326
                    raise RuntimeError(line)
2312
2327
            except (ValueError, IndexError, RuntimeError) as error:
2313
 
                logger.error("Unknown protocol version: %s", error)
 
2328
                log.error("Unknown protocol version: %s", error)
2314
2329
                return
2315
2330
 
2316
2331
            # Start GnuTLS connection
2317
2332
            try:
2318
2333
                session.handshake()
2319
2334
            except gnutls.Error as error:
2320
 
                logger.warning("Handshake failed: %s", error)
 
2335
                log.warning("Handshake failed: %s", error)
2321
2336
                # Do not run session.bye() here: the session is not
2322
2337
                # established.  Just abandon the request.
2323
2338
                return
2324
 
            logger.debug("Handshake succeeded")
 
2339
            log.debug("Handshake succeeded")
2325
2340
 
2326
2341
            approval_required = False
2327
2342
            try:
2331
2346
                        key_id = self.key_id(
2332
2347
                            self.peer_certificate(session))
2333
2348
                    except (TypeError, gnutls.Error) as error:
2334
 
                        logger.warning("Bad certificate: %s", error)
 
2349
                        log.warning("Bad certificate: %s", error)
2335
2350
                        return
2336
 
                    logger.debug("Key ID: %s", key_id)
 
2351
                    log.debug("Key ID: %s",
 
2352
                              key_id.decode("utf-8",
 
2353
                                            errors="replace"))
2337
2354
 
2338
2355
                else:
2339
2356
                    key_id = b""
2341
2358
                        fpr = self.fingerprint(
2342
2359
                            self.peer_certificate(session))
2343
2360
                    except (TypeError, gnutls.Error) as error:
2344
 
                        logger.warning("Bad certificate: %s", error)
 
2361
                        log.warning("Bad certificate: %s", error)
2345
2362
                        return
2346
 
                    logger.debug("Fingerprint: %s", fpr)
 
2363
                    log.debug("Fingerprint: %s", fpr)
2347
2364
 
2348
2365
                try:
2349
2366
                    client = ProxyClient(child_pipe, key_id, fpr,
2358
2375
 
2359
2376
                while True:
2360
2377
                    if not client.enabled:
2361
 
                        logger.info("Client %s is disabled",
2362
 
                                    client.name)
 
2378
                        log.info("Client %s is disabled", client.name)
2363
2379
                        if self.server.use_dbus:
2364
2380
                            # Emit D-Bus signal
2365
2381
                            client.Rejected("Disabled")
2369
2385
                        # We are approved or approval is disabled
2370
2386
                        break
2371
2387
                    elif client.approved is None:
2372
 
                        logger.info("Client %s needs approval",
2373
 
                                    client.name)
 
2388
                        log.info("Client %s needs approval",
 
2389
                                 client.name)
2374
2390
                        if self.server.use_dbus:
2375
2391
                            # Emit D-Bus signal
2376
2392
                            client.NeedApproval(
2377
2393
                                client.approval_delay.total_seconds()
2378
2394
                                * 1000, client.approved_by_default)
2379
2395
                    else:
2380
 
                        logger.warning("Client %s was not approved",
2381
 
                                       client.name)
 
2396
                        log.warning("Client %s was not approved",
 
2397
                                    client.name)
2382
2398
                        if self.server.use_dbus:
2383
2399
                            # Emit D-Bus signal
2384
2400
                            client.Rejected("Denied")
2392
2408
                    time2 = datetime.datetime.now()
2393
2409
                    if (time2 - time) >= delay:
2394
2410
                        if not client.approved_by_default:
2395
 
                            logger.warning("Client %s timed out while"
2396
 
                                           " waiting for approval",
2397
 
                                           client.name)
 
2411
                            log.warning("Client %s timed out while"
 
2412
                                        " waiting for approval",
 
2413
                                        client.name)
2398
2414
                            if self.server.use_dbus:
2399
2415
                                # Emit D-Bus signal
2400
2416
                                client.Rejected("Approval timed out")
2407
2423
                try:
2408
2424
                    session.send(client.secret)
2409
2425
                except gnutls.Error as error:
2410
 
                    logger.warning("gnutls send failed",
2411
 
                                   exc_info=error)
 
2426
                    log.warning("gnutls send failed", exc_info=error)
2412
2427
                    return
2413
2428
 
2414
 
                logger.info("Sending secret to %s", client.name)
 
2429
                log.info("Sending secret to %s", client.name)
2415
2430
                # bump the timeout using extended_timeout
2416
2431
                client.bump_timeout(client.extended_timeout)
2417
2432
                if self.server.use_dbus:
2424
2439
                try:
2425
2440
                    session.bye()
2426
2441
                except gnutls.Error as error:
2427
 
                    logger.warning("GnuTLS bye failed",
2428
 
                                   exc_info=error)
 
2442
                    log.warning("GnuTLS bye failed", exc_info=error)
2429
2443
 
2430
2444
    @staticmethod
2431
2445
    def peer_certificate(session):
2432
2446
        "Return the peer's certificate as a bytestring"
2433
2447
        try:
2434
 
            cert_type = gnutls.certificate_type_get2(session._c_object,
2435
 
                                                     gnutls.CTYPE_PEERS)
 
2448
            cert_type = gnutls.certificate_type_get2(
 
2449
                session, gnutls.CTYPE_PEERS)
2436
2450
        except AttributeError:
2437
 
            cert_type = gnutls.certificate_type_get(session._c_object)
 
2451
            cert_type = gnutls.certificate_type_get(session)
2438
2452
        if gnutls.has_rawpk:
2439
2453
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2440
2454
        else:
2441
2455
            valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2442
2456
        # If not a valid certificate type...
2443
2457
        if cert_type not in valid_cert_types:
2444
 
            logger.info("Cert type %r not in %r", cert_type,
2445
 
                        valid_cert_types)
 
2458
            log.info("Cert type %r not in %r", cert_type,
 
2459
                     valid_cert_types)
2446
2460
            # ...return invalid data
2447
2461
            return b""
2448
2462
        list_size = ctypes.c_uint(1)
2449
2463
        cert_list = (gnutls.certificate_get_peers
2450
 
                     (session._c_object, ctypes.byref(list_size)))
 
2464
                     (session, ctypes.byref(list_size)))
2451
2465
        if not bool(cert_list) and list_size.value != 0:
2452
2466
            raise gnutls.Error("error getting peer certificate")
2453
2467
        if list_size.value == 0:
2567
2581
 
2568
2582
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2569
2583
                     socketserver.TCPServer):
2570
 
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
2584
    """IPv6-capable TCP server.  Accepts None as address and/or port
2571
2585
 
2572
2586
    Attributes:
2573
2587
        enabled:        Boolean; whether this server is activated yet
2624
2638
            if SO_BINDTODEVICE is None:
2625
2639
                # Fall back to a hard-coded value which seems to be
2626
2640
                # common enough.
2627
 
                logger.warning("SO_BINDTODEVICE not found, trying 25")
 
2641
                log.warning("SO_BINDTODEVICE not found, trying 25")
2628
2642
                SO_BINDTODEVICE = 25
2629
2643
            try:
2630
2644
                self.socket.setsockopt(
2632
2646
                    (self.interface + "\0").encode("utf-8"))
2633
2647
            except socket.error as error:
2634
2648
                if error.errno == errno.EPERM:
2635
 
                    logger.error("No permission to bind to"
2636
 
                                 " interface %s", self.interface)
 
2649
                    log.error("No permission to bind to interface %s",
 
2650
                              self.interface)
2637
2651
                elif error.errno == errno.ENOPROTOOPT:
2638
 
                    logger.error("SO_BINDTODEVICE not available;"
2639
 
                                 " cannot bind to interface %s",
2640
 
                                 self.interface)
 
2652
                    log.error("SO_BINDTODEVICE not available; cannot"
 
2653
                              " bind to interface %s", self.interface)
2641
2654
                elif error.errno == errno.ENODEV:
2642
 
                    logger.error("Interface %s does not exist,"
2643
 
                                 " cannot bind", self.interface)
 
2655
                    log.error("Interface %s does not exist, cannot"
 
2656
                              " bind", self.interface)
2644
2657
                else:
2645
2658
                    raise
2646
2659
        # Only bind(2) the socket if we really need to.
2725
2738
        request = parent_pipe.recv()
2726
2739
        command = request[0]
2727
2740
 
2728
 
        if command == 'init':
 
2741
        if command == "init":
2729
2742
            key_id = request[1].decode("ascii")
2730
2743
            fpr = request[2].decode("ascii")
2731
2744
            address = request[3]
2741
2754
                    client = c
2742
2755
                    break
2743
2756
            else:
2744
 
                logger.info("Client not found for key ID: %s, address"
2745
 
                            ": %s", key_id or fpr, address)
 
2757
                log.info("Client not found for key ID: %s, address:"
 
2758
                         " %s", key_id or fpr, address)
2746
2759
                if self.use_dbus:
2747
2760
                    # Emit D-Bus signal
2748
2761
                    mandos_dbus_service.ClientNotFound(key_id or fpr,
2761
2774
            # remove the old hook in favor of the new above hook on
2762
2775
            # same fileno
2763
2776
            return False
2764
 
        if command == 'funcall':
 
2777
        if command == "funcall":
2765
2778
            funcname = request[1]
2766
2779
            args = request[2]
2767
2780
            kwargs = request[3]
2768
2781
 
2769
 
            parent_pipe.send(('data', getattr(client_object,
 
2782
            parent_pipe.send(("data", getattr(client_object,
2770
2783
                                              funcname)(*args,
2771
2784
                                                        **kwargs)))
2772
2785
 
2773
 
        if command == 'getattr':
 
2786
        if command == "getattr":
2774
2787
            attrname = request[1]
2775
2788
            if isinstance(client_object.__getattribute__(attrname),
2776
2789
                          collections.abc.Callable):
2777
 
                parent_pipe.send(('function', ))
 
2790
                parent_pipe.send(("function", ))
2778
2791
            else:
2779
2792
                parent_pipe.send((
2780
 
                    'data', client_object.__getattribute__(attrname)))
 
2793
                    "data", client_object.__getattribute__(attrname)))
2781
2794
 
2782
 
        if command == 'setattr':
 
2795
        if command == "setattr":
2783
2796
            attrname = request[1]
2784
2797
            value = request[2]
2785
2798
            setattr(client_object, attrname, value)
2891
2904
def string_to_delta(interval):
2892
2905
    """Parse a string and return a datetime.timedelta
2893
2906
 
2894
 
    >>> string_to_delta('7d') == datetime.timedelta(7)
2895
 
    True
2896
 
    >>> string_to_delta('60s') == datetime.timedelta(0, 60)
2897
 
    True
2898
 
    >>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2899
 
    True
2900
 
    >>> string_to_delta('24h') == datetime.timedelta(1)
2901
 
    True
2902
 
    >>> string_to_delta('1w') == datetime.timedelta(7)
2903
 
    True
2904
 
    >>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
 
2907
    >>> string_to_delta("7d") == datetime.timedelta(7)
 
2908
    True
 
2909
    >>> string_to_delta("60s") == datetime.timedelta(0, 60)
 
2910
    True
 
2911
    >>> string_to_delta("60m") == datetime.timedelta(0, 3600)
 
2912
    True
 
2913
    >>> string_to_delta("24h") == datetime.timedelta(1)
 
2914
    True
 
2915
    >>> string_to_delta("1w") == datetime.timedelta(7)
 
2916
    True
 
2917
    >>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2905
2918
    True
2906
2919
    """
2907
2920
 
3111
3124
 
3112
3125
    if server_settings["servicename"] != "Mandos":
3113
3126
        syslogger.setFormatter(
3114
 
            logging.Formatter('Mandos ({}) [%(process)d]:'
3115
 
                              ' %(levelname)s: %(message)s'.format(
 
3127
            logging.Formatter("Mandos ({}) [%(process)d]:"
 
3128
                              " %(levelname)s: %(message)s".format(
3116
3129
                                  server_settings["servicename"])))
3117
3130
 
3118
3131
    # Parse config file with clients
3142
3155
        try:
3143
3156
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3144
3157
        except IOError as e:
3145
 
            logger.error("Could not open file %r", pidfilename,
3146
 
                         exc_info=e)
 
3158
            log.error("Could not open file %r", pidfilename,
 
3159
                      exc_info=e)
3147
3160
 
3148
3161
    for name, group in (("_mandos", "_mandos"),
3149
3162
                        ("mandos", "mandos"),
3160
3173
    try:
3161
3174
        os.setgid(gid)
3162
3175
        os.setuid(uid)
3163
 
        if debug:
3164
 
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
3165
 
                                                             gid))
 
3176
        log.debug("Did setuid/setgid to %s:%s", uid, gid)
3166
3177
    except OSError as error:
3167
 
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
3168
 
                       .format(uid, gid, os.strerror(error.errno)))
 
3178
        log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
 
3179
                    os.strerror(error.errno))
3169
3180
        if error.errno != errno.EPERM:
3170
3181
            raise
3171
3182
 
3178
3189
 
3179
3190
        @gnutls.log_func
3180
3191
        def debug_gnutls(level, string):
3181
 
            logger.debug("GnuTLS: %s", string[:-1])
 
3192
            log.debug("GnuTLS: %s",
 
3193
                      string[:-1].decode("utf-8", errors="replace"))
3182
3194
 
3183
3195
        gnutls.global_set_log_function(debug_gnutls)
3184
3196
 
3213
3225
                "se.bsnet.fukt.Mandos", bus,
3214
3226
                do_not_queue=True)
3215
3227
        except dbus.exceptions.DBusException as e:
3216
 
            logger.error("Disabling D-Bus:", exc_info=e)
 
3228
            log.error("Disabling D-Bus:", exc_info=e)
3217
3229
            use_dbus = False
3218
3230
            server_settings["use_dbus"] = False
3219
3231
            tcp_server.use_dbus = False
3304
3316
            os.remove(stored_state_path)
3305
3317
        except IOError as e:
3306
3318
            if e.errno == errno.ENOENT:
3307
 
                logger.warning("Could not load persistent state:"
3308
 
                               " {}".format(os.strerror(e.errno)))
 
3319
                log.warning("Could not load persistent state:"
 
3320
                            " %s", os.strerror(e.errno))
3309
3321
            else:
3310
 
                logger.critical("Could not load persistent state:",
3311
 
                                exc_info=e)
 
3322
                log.critical("Could not load persistent state:",
 
3323
                             exc_info=e)
3312
3324
                raise
3313
3325
        except EOFError as e:
3314
 
            logger.warning("Could not load persistent state: "
3315
 
                           "EOFError:",
3316
 
                           exc_info=e)
 
3326
            log.warning("Could not load persistent state: EOFError:",
 
3327
                        exc_info=e)
3317
3328
 
3318
3329
    with PGPEngine() as pgp:
3319
3330
        for client_name, client in clients_data.items():
3346
3357
            if client["enabled"]:
3347
3358
                if datetime.datetime.utcnow() >= client["expires"]:
3348
3359
                    if not client["last_checked_ok"]:
3349
 
                        logger.warning(
3350
 
                            "disabling client {} - Client never "
3351
 
                            "performed a successful checker".format(
3352
 
                                client_name))
 
3360
                        log.warning("disabling client %s - Client"
 
3361
                                    " never performed a successful"
 
3362
                                    " checker", client_name)
3353
3363
                        client["enabled"] = False
3354
3364
                    elif client["last_checker_status"] != 0:
3355
 
                        logger.warning(
3356
 
                            "disabling client {} - Client last"
3357
 
                            " checker failed with error code"
3358
 
                            " {}".format(
3359
 
                                client_name,
3360
 
                                client["last_checker_status"]))
 
3365
                        log.warning("disabling client %s - Client"
 
3366
                                    " last checker failed with error"
 
3367
                                    " code %s", client_name,
 
3368
                                    client["last_checker_status"])
3361
3369
                        client["enabled"] = False
3362
3370
                    else:
3363
3371
                        client["expires"] = (
3364
3372
                            datetime.datetime.utcnow()
3365
3373
                            + client["timeout"])
3366
 
                        logger.debug("Last checker succeeded,"
3367
 
                                     " keeping {} enabled".format(
3368
 
                                         client_name))
 
3374
                        log.debug("Last checker succeeded, keeping %s"
 
3375
                                  " enabled", client_name)
3369
3376
            try:
3370
3377
                client["secret"] = pgp.decrypt(
3371
3378
                    client["encrypted_secret"],
3372
3379
                    client_settings[client_name]["secret"])
3373
3380
            except PGPError:
3374
3381
                # If decryption fails, we use secret from new settings
3375
 
                logger.debug("Failed to decrypt {} old secret".format(
3376
 
                    client_name))
 
3382
                log.debug("Failed to decrypt %s old secret",
 
3383
                          client_name)
3377
3384
                client["secret"] = (client_settings[client_name]
3378
3385
                                    ["secret"])
3379
3386
 
3393
3400
            server_settings=server_settings)
3394
3401
 
3395
3402
    if not tcp_server.clients:
3396
 
        logger.warning("No clients defined")
 
3403
        log.warning("No clients defined")
3397
3404
 
3398
3405
    if not foreground:
3399
3406
        if pidfile is not None:
3402
3409
                with pidfile:
3403
3410
                    print(pid, file=pidfile)
3404
3411
            except IOError:
3405
 
                logger.error("Could not write to file %r with PID %d",
3406
 
                             pidfilename, pid)
 
3412
                log.error("Could not write to file %r with PID %d",
 
3413
                          pidfilename, pid)
3407
3414
        del pidfile
3408
3415
        del pidfilename
3409
3416
 
3559
3566
 
3560
3567
        try:
3561
3568
            with tempfile.NamedTemporaryFile(
3562
 
                    mode='wb',
 
3569
                    mode="wb",
3563
3570
                    suffix=".pickle",
3564
 
                    prefix='clients-',
 
3571
                    prefix="clients-",
3565
3572
                    dir=os.path.dirname(stored_state_path),
3566
3573
                    delete=False) as stored_state:
3567
3574
                pickle.dump((clients, client_settings), stored_state,
3575
3582
                except NameError:
3576
3583
                    pass
3577
3584
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3578
 
                logger.warning("Could not save persistent state: {}"
3579
 
                               .format(os.strerror(e.errno)))
 
3585
                log.warning("Could not save persistent state: %s",
 
3586
                            os.strerror(e.errno))
3580
3587
            else:
3581
 
                logger.warning("Could not save persistent state:",
3582
 
                               exc_info=e)
 
3588
                log.warning("Could not save persistent state:",
 
3589
                            exc_info=e)
3583
3590
                raise
3584
3591
 
3585
3592
        # Delete all clients, and settings from config
3611
3618
    if zeroconf:
3612
3619
        service.port = tcp_server.socket.getsockname()[1]
3613
3620
    if use_ipv6:
3614
 
        logger.info("Now listening on address %r, port %d,"
3615
 
                    " flowinfo %d, scope_id %d",
3616
 
                    *tcp_server.socket.getsockname())
 
3621
        log.info("Now listening on address %r, port %d, flowinfo %d,"
 
3622
                 " scope_id %d", *tcp_server.socket.getsockname())
3617
3623
    else:                       # IPv4
3618
 
        logger.info("Now listening on address %r, port %d",
3619
 
                    *tcp_server.socket.getsockname())
 
3624
        log.info("Now listening on address %r, port %d",
 
3625
                 *tcp_server.socket.getsockname())
3620
3626
 
3621
3627
    # service.interface = tcp_server.socket.getsockname()[3]
3622
3628
 
3626
3632
            try:
3627
3633
                service.activate()
3628
3634
            except dbus.exceptions.DBusException as error:
3629
 
                logger.critical("D-Bus Exception", exc_info=error)
 
3635
                log.critical("D-Bus Exception", exc_info=error)
3630
3636
                cleanup()
3631
3637
                sys.exit(1)
3632
3638
            # End of Avahi example code
3637
3643
            lambda *args, **kwargs: (tcp_server.handle_request
3638
3644
                                     (*args[2:], **kwargs) or True))
3639
3645
 
3640
 
        logger.debug("Starting main loop")
 
3646
        log.debug("Starting main loop")
3641
3647
        main_loop.run()
3642
3648
    except AvahiError as error:
3643
 
        logger.critical("Avahi Error", exc_info=error)
 
3649
        log.critical("Avahi Error", exc_info=error)
3644
3650
        cleanup()
3645
3651
        sys.exit(1)
3646
3652
    except KeyboardInterrupt:
3647
3653
        if debug:
3648
3654
            print("", file=sys.stderr)
3649
 
        logger.debug("Server received KeyboardInterrupt")
3650
 
    logger.debug("Server exiting")
 
3655
        log.debug("Server received KeyboardInterrupt")
 
3656
    log.debug("Server exiting")
3651
3657
    # Must run before the D-Bus bus name gets deregistered
3652
3658
    cleanup()
3653
3659
 
3654
3660
 
3655
 
def should_only_run_tests():
 
3661
def parse_test_args():
 
3662
    # type: () -> argparse.Namespace
3656
3663
    parser = argparse.ArgumentParser(add_help=False)
3657
 
    parser.add_argument("--check", action='store_true')
 
3664
    parser.add_argument("--check", action="store_true")
 
3665
    parser.add_argument("--prefix", )
3658
3666
    args, unknown_args = parser.parse_known_args()
3659
 
    run_tests = args.check
3660
 
    if run_tests:
3661
 
        # Remove --check argument from sys.argv
 
3667
    if args.check:
 
3668
        # Remove test options from sys.argv
3662
3669
        sys.argv[1:] = unknown_args
3663
 
    return run_tests
 
3670
    return args
3664
3671
 
3665
3672
# Add all tests from doctest strings
3666
3673
def load_tests(loader, tests, none):
3668
3675
    tests.addTests(doctest.DocTestSuite())
3669
3676
    return tests
3670
3677
 
3671
 
if __name__ == '__main__':
 
3678
if __name__ == "__main__":
 
3679
    options = parse_test_args()
3672
3680
    try:
3673
 
        if should_only_run_tests():
3674
 
            # Call using ./mandos --check [--verbose]
3675
 
            unittest.main()
 
3681
        if options.check:
 
3682
            extra_test_prefix = options.prefix
 
3683
            if extra_test_prefix is not None:
 
3684
                if not (unittest.main(argv=[""], exit=False)
 
3685
                        .result.wasSuccessful()):
 
3686
                    sys.exit(1)
 
3687
                class ExtraTestLoader(unittest.TestLoader):
 
3688
                    testMethodPrefix = extra_test_prefix
 
3689
                # Call using ./scriptname --test [--verbose]
 
3690
                unittest.main(argv=[""], testLoader=ExtraTestLoader())
 
3691
            else:
 
3692
                unittest.main(argv=[""])
3676
3693
        else:
3677
3694
            main()
3678
3695
    finally:
3679
3696
        logging.shutdown()
 
3697
 
 
3698
# Local Variables:
 
3699
# run-tests:
 
3700
# (lambda (&optional extra)
 
3701
#   (if (not (funcall run-tests-in-test-buffer default-directory
 
3702
#             extra))
 
3703
#       (funcall show-test-buffer-in-test-window)
 
3704
#     (funcall remove-test-window)
 
3705
#     (if extra (message "Extra tests run successfully!"))))
 
3706
# run-tests-in-test-buffer:
 
3707
# (lambda (dir &optional extra)
 
3708
#   (with-current-buffer (get-buffer-create "*Test*")
 
3709
#     (setq buffer-read-only nil
 
3710
#           default-directory dir)
 
3711
#     (erase-buffer)
 
3712
#     (compilation-mode))
 
3713
#   (let ((process-result
 
3714
#          (let ((inhibit-read-only t))
 
3715
#            (process-file-shell-command
 
3716
#             (funcall get-command-line extra) nil "*Test*"))))
 
3717
#     (and (numberp process-result)
 
3718
#          (= process-result 0))))
 
3719
# get-command-line:
 
3720
# (lambda (&optional extra)
 
3721
#   (let ((quoted-script
 
3722
#          (shell-quote-argument (funcall get-script-name))))
 
3723
#     (format
 
3724
#      (concat "%s --check" (if extra " --prefix=atest" ""))
 
3725
#      quoted-script)))
 
3726
# get-script-name:
 
3727
# (lambda ()
 
3728
#   (if (fboundp 'file-local-name)
 
3729
#       (file-local-name (buffer-file-name))
 
3730
#     (or (file-remote-p (buffer-file-name) 'localname)
 
3731
#         (buffer-file-name))))
 
3732
# remove-test-window:
 
3733
# (lambda ()
 
3734
#   (let ((test-window (get-buffer-window "*Test*")))
 
3735
#     (if test-window (delete-window test-window))))
 
3736
# show-test-buffer-in-test-window:
 
3737
# (lambda ()
 
3738
#   (when (not (get-buffer-window-list "*Test*"))
 
3739
#     (setq next-error-last-buffer (get-buffer "*Test*"))
 
3740
#     (let* ((side (if (>= (window-width) 146) 'right 'bottom))
 
3741
#            (display-buffer-overriding-action
 
3742
#             `((display-buffer-in-side-window) (side . ,side)
 
3743
#               (window-height . fit-window-to-buffer)
 
3744
#               (window-width . fit-window-to-buffer))))
 
3745
#       (display-buffer "*Test*"))))
 
3746
# eval:
 
3747
# (progn
 
3748
#   (let* ((run-extra-tests (lambda () (interactive)
 
3749
#                             (funcall run-tests t)))
 
3750
#          (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
 
3751
#          (outer-keymap `(keymap (3 . ,inner-keymap))))     ; C-c
 
3752
#     (setq minor-mode-overriding-map-alist
 
3753
#           (cons `(run-tests . ,outer-keymap)
 
3754
#                 minor-mode-overriding-map-alist)))
 
3755
#   (add-hook 'after-save-hook run-tests 90 t))
 
3756
# End: