265
219
.replace(b"\n", b"\\n")
266
220
.replace(b"\0", b"\\x00"))
269
223
def encrypt(self, data, password):
270
224
passphrase = self.password_encode(password)
271
225
with tempfile.NamedTemporaryFile(
272
226
dir=self.tempdir) as passfile:
273
227
passfile.write(passphrase)
275
proc = subprocess.Popen([self.gpg, "--symmetric",
229
proc = subprocess.Popen([self.gpg, '--symmetric',
278
232
+ self.gnupgargs,
279
stdin=subprocess.PIPE,
280
stdout=subprocess.PIPE,
281
stderr=subprocess.PIPE)
282
ciphertext, err = proc.communicate(input=data)
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
ciphertext, err = proc.communicate(input = data)
283
237
if proc.returncode != 0:
284
238
raise PGPError(err)
285
239
return ciphertext
287
241
def decrypt(self, data, password):
288
242
passphrase = self.password_encode(password)
289
243
with tempfile.NamedTemporaryFile(
290
dir=self.tempdir) as passfile:
244
dir = self.tempdir) as passfile:
291
245
passfile.write(passphrase)
293
proc = subprocess.Popen([self.gpg, "--decrypt",
247
proc = subprocess.Popen([self.gpg, '--decrypt',
296
250
+ self.gnupgargs,
297
stdin=subprocess.PIPE,
298
stdout=subprocess.PIPE,
299
stderr=subprocess.PIPE)
300
decrypted_plaintext, err = proc.communicate(input=data)
251
stdin = subprocess.PIPE,
252
stdout = subprocess.PIPE,
253
stderr = subprocess.PIPE)
254
decrypted_plaintext, err = proc.communicate(input = data)
301
255
if proc.returncode != 0:
302
256
raise PGPError(err)
303
257
return decrypted_plaintext
306
259
# Pretend that we have an Avahi module
308
"""This isn't so much a class as it is a module-like namespace."""
309
IF_UNSPEC = -1 # avahi-common/address.h
310
PROTO_UNSPEC = -1 # avahi-common/address.h
311
PROTO_INET = 0 # avahi-common/address.h
312
PROTO_INET6 = 1 # avahi-common/address.h
261
"""This isn't so much a class as it is a module-like namespace.
262
It is instantiated once, and simulates having an Avahi module."""
263
IF_UNSPEC = -1 # avahi-common/address.h
264
PROTO_UNSPEC = -1 # avahi-common/address.h
265
PROTO_INET = 0 # avahi-common/address.h
266
PROTO_INET6 = 1 # avahi-common/address.h
313
267
DBUS_NAME = "org.freedesktop.Avahi"
314
268
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
315
269
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
270
DBUS_PATH_SERVER = "/"
319
def string_array_to_txt_array(t):
271
def string_array_to_txt_array(self, t):
320
272
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
273
for s in t), signature="ay")
322
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
323
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
324
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
325
SERVER_INVALID = 0 # avahi-common/defs.h
326
SERVER_REGISTERING = 1 # avahi-common/defs.h
327
SERVER_RUNNING = 2 # avahi-common/defs.h
328
SERVER_COLLISION = 3 # avahi-common/defs.h
329
SERVER_FAILURE = 4 # avahi-common/defs.h
274
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
275
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
276
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
277
SERVER_INVALID = 0 # avahi-common/defs.h
278
SERVER_REGISTERING = 1 # avahi-common/defs.h
279
SERVER_RUNNING = 2 # avahi-common/defs.h
280
SERVER_COLLISION = 3 # avahi-common/defs.h
281
SERVER_FAILURE = 4 # avahi-common/defs.h
332
284
class AvahiError(Exception):
333
285
def __init__(self, value, *args, **kwargs):
523
476
class AvahiServiceToSyslog(AvahiService):
524
477
def rename(self, *args, **kwargs):
525
478
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
479
ret = AvahiService.rename(self, *args, **kwargs)
528
480
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
481
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
482
.format(self.name)))
534
485
# Pretend that we have a GnuTLS module
536
"""This isn't so much a class as it is a module-like namespace."""
538
library = ctypes.util.find_library("gnutls")
540
library = ctypes.util.find_library("gnutls-deb0")
541
_library = ctypes.cdll.LoadLibrary(library)
486
class GnuTLS(object):
487
"""This isn't so much a class as it is a module-like namespace.
488
It is instantiated once, and simulates having a GnuTLS module."""
490
_library = ctypes.cdll.LoadLibrary(
491
ctypes.util.find_library("gnutls"))
492
_need_version = b"3.3.0"
494
# Need to use class name "GnuTLS" here, since this method is
495
# called before the assignment to the "gnutls" global variable
497
if GnuTLS.check_version(self._need_version) is None:
498
raise GnuTLS.Error("Needs GnuTLS {} or later"
499
.format(self._need_version))
544
501
# Unless otherwise indicated, the constants and types below are
545
502
# all from the gnutls/gnutls.h C header file.
549
506
E_INTERRUPTED = -52
555
511
CRD_CERTIFICATE = 1
556
512
E_NO_CERTIFICATE_FOUND = -49
561
KEYID_USE_SHA256 = 1 # gnutls/x509.h
562
513
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
565
class _session_int(ctypes.Structure):
516
class session_int(ctypes.Structure):
567
session_t = ctypes.POINTER(_session_int)
518
session_t = ctypes.POINTER(session_int)
569
519
class certificate_credentials_st(ctypes.Structure):
571
521
certificate_credentials_t = ctypes.POINTER(
572
522
certificate_credentials_st)
573
523
certificate_type_t = ctypes.c_int
575
524
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
579
class _openpgp_crt_int(ctypes.Structure):
525
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
526
('size', ctypes.c_uint)]
527
class openpgp_crt_int(ctypes.Structure):
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
582
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
529
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
530
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
531
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
532
credentials_type_t = ctypes.c_int
585
533
transport_ptr_t = ctypes.c_void_p
586
534
close_request_t = ctypes.c_int
589
537
class Error(Exception):
590
def __init__(self, message=None, code=None, args=()):
538
# We need to use the class name "GnuTLS" here, since this
539
# exception might be raised from within GnuTLS.__init__,
540
# which is called before the assignment to the "gnutls"
541
# global variable has happened.
542
def __init__(self, message = None, code = None, args=()):
591
543
# Default usage is by a message string, but if a return
592
544
# code is passed, convert it to a string with
593
545
# gnutls.strerror()
595
547
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
598
return super(gnutls.Error, self).__init__(
548
message = GnuTLS.strerror(code)
549
return super(GnuTLS.Error, self).__init__(
601
552
class CertificateSecurityError(Error):
605
def __init__(self, cls):
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
614
class CastToVoidPointer:
615
def __init__(self, cls):
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
624
class With_from_param:
626
def from_param(cls, obj):
627
return obj._as_parameter_
630
class Credentials(With_from_param):
556
class Credentials(object):
631
557
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
558
self._c_object = gnutls.certificate_credentials_t()
559
gnutls.certificate_allocate_credentials(
560
ctypes.byref(self._c_object))
634
561
self.type = gnutls.CRD_CERTIFICATE
636
563
def __del__(self):
637
gnutls.certificate_free_credentials(self)
639
class ClientSession(With_from_param):
640
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
642
gnutls_flags = gnutls.CLIENT
643
if gnutls.check_version(b"3.5.6"):
644
gnutls_flags |= gnutls.NO_TICKETS
646
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
564
gnutls.certificate_free_credentials(self._c_object)
566
class ClientSession(object):
567
def __init__(self, socket, credentials = None):
568
self._c_object = gnutls.session_t()
569
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
570
gnutls.set_default_priority(self._c_object)
571
gnutls.transport_set_ptr(self._c_object, socket.fileno())
572
gnutls.handshake_set_private_extensions(self._c_object,
652
574
self.socket = socket
653
575
if credentials is None:
654
576
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
577
gnutls.credentials_set(self._c_object, credentials.type,
578
ctypes.cast(credentials._c_object,
657
580
self.credentials = credentials
659
582
def __del__(self):
583
gnutls.deinit(self._c_object)
662
585
def handshake(self):
663
return gnutls.handshake(self)
586
return gnutls.handshake(self._c_object)
665
588
def send(self, data):
666
589
data = bytes(data)
667
590
data_len = len(data)
668
591
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
592
data_len -= gnutls.record_send(self._c_object,
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
597
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
675
599
# Error handling functions
676
600
def _error_code(result):
677
601
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
602
for the 'restype' attribute on ctypes functions"""
681
605
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
raise gnutls.CertificateSecurityError(code=result)
683
raise gnutls.Error(code=result)
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
606
raise gnutls.CertificateSecurityError(code = result)
607
raise gnutls.Error(code = result)
609
def _retry_on_error(result, func, arguments):
687
610
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
611
for the 'errcheck' attribute on ctypes functions"""
690
613
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
614
return _error_code(result)
692
615
result = func(*arguments)
695
618
# Unless otherwise indicated, the function declarations below are
696
619
# all from the gnutls/gnutls.h C header file.
699
622
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
623
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
624
ctypes.POINTER(ctypes.c_char_p)]
702
625
priority_set_direct.restype = _error_code
704
627
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
628
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
629
init.restype = _error_code
708
631
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
632
set_default_priority.argtypes = [session_t]
710
633
set_default_priority.restype = _error_code
712
635
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
636
record_send.argtypes = [session_t, ctypes.c_void_p,
715
638
record_send.restype = ctypes.c_ssize_t
716
639
record_send.errcheck = _retry_on_error
718
641
certificate_allocate_credentials = (
719
642
_library.gnutls_certificate_allocate_credentials)
720
643
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
644
ctypes.POINTER(certificate_credentials_t)]
722
645
certificate_allocate_credentials.restype = _error_code
724
647
certificate_free_credentials = (
725
648
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
649
certificate_free_credentials.argtypes = [certificate_credentials_t]
727
650
certificate_free_credentials.restype = None
729
652
handshake_set_private_extensions = (
730
653
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
654
handshake_set_private_extensions.argtypes = [session_t,
733
656
handshake_set_private_extensions.restype = None
735
658
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
659
credentials_set.argtypes = [session_t, credentials_type_t,
738
661
credentials_set.restype = _error_code
740
663
strerror = _library.gnutls_strerror
741
664
strerror.argtypes = [ctypes.c_int]
742
665
strerror.restype = ctypes.c_char_p
744
667
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
668
certificate_type_get.argtypes = [session_t]
746
669
certificate_type_get.restype = _error_code
748
671
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
672
certificate_get_peers.argtypes = [session_t,
750
673
ctypes.POINTER(ctypes.c_uint)]
751
674
certificate_get_peers.restype = ctypes.POINTER(datum_t)
753
676
global_set_log_level = _library.gnutls_global_set_log_level
754
677
global_set_log_level.argtypes = [ctypes.c_int]
755
678
global_set_log_level.restype = None
757
680
global_set_log_function = _library.gnutls_global_set_log_function
758
681
global_set_log_function.argtypes = [log_func]
759
682
global_set_log_function.restype = None
761
684
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
685
deinit.argtypes = [session_t]
763
686
deinit.restype = None
765
688
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
689
handshake.argtypes = [session_t]
690
handshake.restype = _error_code
768
691
handshake.errcheck = _retry_on_error
770
693
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
694
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
695
transport_set_ptr.restype = None
774
697
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
698
bye.argtypes = [session_t, close_request_t]
699
bye.restype = _error_code
777
700
bye.errcheck = _retry_on_error
779
702
check_version = _library.gnutls_check_version
780
703
check_version.argtypes = [ctypes.c_char_p]
781
704
check_version.restype = ctypes.c_char_p
783
_need_version = b"3.3.0"
784
if check_version(_need_version) is None:
785
raise self.Error("Needs GnuTLS {} or later"
786
.format(_need_version))
788
_tls_rawpk_version = b"3.6.6"
789
has_rawpk = bool(check_version(_tls_rawpk_version))
793
class pubkey_st(ctypes.Structure):
795
pubkey_t = ctypes.POINTER(pubkey_st)
797
x509_crt_fmt_t = ctypes.c_int
799
# All the function declarations below are from
801
pubkey_init = _library.gnutls_pubkey_init
802
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
pubkey_init.restype = _error_code
805
pubkey_import = _library.gnutls_pubkey_import
806
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
808
pubkey_import.restype = _error_code
810
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
811
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
812
ctypes.POINTER(ctypes.c_ubyte),
813
ctypes.POINTER(ctypes.c_size_t)]
814
pubkey_get_key_id.restype = _error_code
816
pubkey_deinit = _library.gnutls_pubkey_deinit
817
pubkey_deinit.argtypes = [pubkey_t]
818
pubkey_deinit.restype = None
820
# All the function declarations below are from
823
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
825
openpgp_crt_init.restype = _error_code
827
openpgp_crt_import = _library.gnutls_openpgp_crt_import
828
openpgp_crt_import.argtypes = [openpgp_crt_t,
829
ctypes.POINTER(datum_t),
831
openpgp_crt_import.restype = _error_code
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
838
ctypes.POINTER(ctypes.c_uint),
840
openpgp_crt_verify_self.restype = _error_code
842
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
843
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
844
openpgp_crt_deinit.restype = None
846
openpgp_crt_get_fingerprint = (
847
_library.gnutls_openpgp_crt_get_fingerprint)
848
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
852
openpgp_crt_get_fingerprint.restype = _error_code
854
if check_version(b"3.6.4"):
855
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
857
certificate_type_get2.restype = _error_code
706
# All the function declarations below are from gnutls/openpgp.h
708
openpgp_crt_init = _library.gnutls_openpgp_crt_init
709
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
710
openpgp_crt_init.restype = _error_code
712
openpgp_crt_import = _library.gnutls_openpgp_crt_import
713
openpgp_crt_import.argtypes = [openpgp_crt_t,
714
ctypes.POINTER(datum_t),
716
openpgp_crt_import.restype = _error_code
718
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
719
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
720
ctypes.POINTER(ctypes.c_uint)]
721
openpgp_crt_verify_self.restype = _error_code
723
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
724
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
725
openpgp_crt_deinit.restype = None
727
openpgp_crt_get_fingerprint = (
728
_library.gnutls_openpgp_crt_get_fingerprint)
729
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
733
openpgp_crt_get_fingerprint.restype = _error_code
859
735
# Remove non-public functions
860
736
del _error_code, _retry_on_error
737
# Create the global "gnutls" object, simulating a module
863
740
def call_pipe(connection, # : multiprocessing.Connection
864
741
func, *args, **kwargs):
865
742
"""This function is meant to be called by multiprocessing.Process
867
744
This function runs func(*args, **kwargs), and writes the resulting
868
745
return value on the provided multiprocessing.Connection.
870
747
connection.send(func(*args, **kwargs))
871
748
connection.close()
750
class Client(object):
875
751
"""A representation of a client host served by this server.
878
approved: bool(); None if not yet approved/disapproved
754
approved: bool(); 'None' if not yet approved/disapproved
879
755
approval_delay: datetime.timedelta(); Time to wait for approval
880
756
approval_duration: datetime.timedelta(); Duration of one approval
881
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
884
checker_callback_tag: a GLib event source tag, or None
757
checker: subprocess.Popen(); a running checker process used
758
to see if the client lives.
759
'None' if no process is running.
760
checker_callback_tag: a GObject event source tag, or None
885
761
checker_command: string; External command which is run to check
886
762
if client lives. %() expansions are done at
887
763
runtime with vars(self) as dict, so that for
888
764
instance %(name)s can be used in the command.
889
checker_initiator_tag: a GLib event source tag, or None
765
checker_initiator_tag: a GObject event source tag, or None
890
766
created: datetime.datetime(); (UTC) object creation
891
767
client_structure: Object describing what attributes a client has
892
768
and is used for storing the client at exit
893
769
current_checker_command: string; current running checker_command
894
disable_initiator_tag: a GLib event source tag, or None
770
disable_initiator_tag: a GObject event source tag, or None
896
772
fingerprint: string (40 or 32 hexadecimal digits); used to
897
uniquely identify an OpenPGP client
898
key_id: string (64 hexadecimal digits); used to uniquely identify
899
a client using raw public keys
773
uniquely identify the client
900
774
host: string; available for use by the checker command
901
775
interval: datetime.timedelta(); How often to start a new checker
902
776
last_approval_request: datetime.datetime(); (UTC) or None
1050
921
self.last_enabled = datetime.datetime.utcnow()
1051
922
self.init_checker()
1052
923
self.send_changedstate()
1054
925
def disable(self, quiet=True):
1055
926
"""Disable this client."""
1056
927
if not getattr(self, "enabled", False):
1059
log.info("Disabling client %s", self.name)
930
logger.info("Disabling client %s", self.name)
1060
931
if getattr(self, "disable_initiator_tag", None) is not None:
1061
GLib.source_remove(self.disable_initiator_tag)
932
GObject.source_remove(self.disable_initiator_tag)
1062
933
self.disable_initiator_tag = None
1063
934
self.expires = None
1064
935
if getattr(self, "checker_initiator_tag", None) is not None:
1065
GLib.source_remove(self.checker_initiator_tag)
936
GObject.source_remove(self.checker_initiator_tag)
1066
937
self.checker_initiator_tag = None
1067
938
self.stop_checker()
1068
939
self.enabled = False
1070
941
self.send_changedstate()
1071
# Do not run this again if called by a GLib.timeout_add
942
# Do not run this again if called by a GObject.timeout_add
1074
945
def __del__(self):
1077
948
def init_checker(self):
1078
949
# Schedule a new checker to be started an 'interval' from now,
1079
950
# and every interval from then on.
1080
951
if self.checker_initiator_tag is not None:
1081
GLib.source_remove(self.checker_initiator_tag)
1082
self.checker_initiator_tag = GLib.timeout_add(
1083
random.randrange(int(self.interval.total_seconds() * 1000
952
GObject.source_remove(self.checker_initiator_tag)
953
self.checker_initiator_tag = GObject.timeout_add(
954
int(self.interval.total_seconds() * 1000),
1085
955
self.start_checker)
1086
956
# Schedule a disable() when 'timeout' has passed
1087
957
if self.disable_initiator_tag is not None:
1088
GLib.source_remove(self.disable_initiator_tag)
1089
self.disable_initiator_tag = GLib.timeout_add(
958
GObject.source_remove(self.disable_initiator_tag)
959
self.disable_initiator_tag = GObject.timeout_add(
1090
960
int(self.timeout.total_seconds() * 1000), self.disable)
1091
961
# Also start a new checker *right now*.
1092
962
self.start_checker()
1094
964
def checker_callback(self, source, condition, connection,
1096
966
"""The checker has completed, so take appropriate actions."""
967
self.checker_callback_tag = None
1097
969
# Read return code from connection (see call_pipe)
1098
970
returncode = connection.recv()
1099
971
connection.close()
1100
if self.checker is not None:
1102
self.checker_callback_tag = None
1105
973
if returncode >= 0:
1106
974
self.last_checker_status = returncode
1107
975
self.last_checker_signal = None
1108
976
if self.last_checker_status == 0:
1109
log.info("Checker for %(name)s succeeded", vars(self))
977
logger.info("Checker for %(name)s succeeded",
1110
979
self.checked_ok()
1112
log.info("Checker for %(name)s failed", vars(self))
981
logger.info("Checker for %(name)s failed", vars(self))
1114
983
self.last_checker_status = -1
1115
984
self.last_checker_signal = -returncode
1116
log.warning("Checker for %(name)s crashed?", vars(self))
985
logger.warning("Checker for %(name)s crashed?",
1119
989
def checked_ok(self):
1120
990
"""Assert that the client has been seen, alive and well."""
1121
991
self.last_checked_ok = datetime.datetime.utcnow()
1122
992
self.last_checker_status = 0
1123
993
self.last_checker_signal = None
1124
994
self.bump_timeout()
1126
996
def bump_timeout(self, timeout=None):
1127
997
"""Bump up the timeout for this client."""
1128
998
if timeout is None:
1129
999
timeout = self.timeout
1130
1000
if self.disable_initiator_tag is not None:
1131
GLib.source_remove(self.disable_initiator_tag)
1001
GObject.source_remove(self.disable_initiator_tag)
1132
1002
self.disable_initiator_tag = None
1133
1003
if getattr(self, "enabled", False):
1134
self.disable_initiator_tag = GLib.timeout_add(
1004
self.disable_initiator_tag = GObject.timeout_add(
1135
1005
int(timeout.total_seconds() * 1000), self.disable)
1136
1006
self.expires = datetime.datetime.utcnow() + timeout
1138
1008
def need_approval(self):
1139
1009
self.last_approval_request = datetime.datetime.utcnow()
1141
1011
def start_checker(self):
1142
1012
"""Start a new checker subprocess if one is not running.
1144
1014
If a checker already exists, leave it running and do
1146
1016
# The reason for not killing a running checker is that if we
2260
2120
byte_arrays=True)
2261
2121
def Secret_dbus_property(self, value):
2262
2122
self.secret = bytes(value)
2268
def __init__(self, child_pipe, key_id, fpr, address):
2127
class ProxyClient(object):
2128
def __init__(self, child_pipe, fpr, address):
2269
2129
self._pipe = child_pipe
2270
self._pipe.send(("init", key_id, fpr, address))
2130
self._pipe.send(('init', fpr, address))
2271
2131
if not self._pipe.recv():
2272
raise KeyError(key_id or fpr)
2274
2134
def __getattribute__(self, name):
2276
2136
return super(ProxyClient, self).__getattribute__(name)
2277
self._pipe.send(("getattr", name))
2137
self._pipe.send(('getattr', name))
2278
2138
data = self._pipe.recv()
2279
if data[0] == "data":
2139
if data[0] == 'data':
2281
if data[0] == "function":
2141
if data[0] == 'function':
2283
2143
def func(*args, **kwargs):
2284
self._pipe.send(("funcall", name, args, kwargs))
2144
self._pipe.send(('funcall', name, args, kwargs))
2285
2145
return self._pipe.recv()[1]
2289
2149
def __setattr__(self, name, value):
2291
2151
return super(ProxyClient, self).__setattr__(name, value)
2292
self._pipe.send(("setattr", name, value))
2152
self._pipe.send(('setattr', name, value))
2295
2155
class ClientHandler(socketserver.BaseRequestHandler, object):
2296
2156
"""A class to handle client connections.
2298
2158
Instantiated once for each connection to handle it.
2299
2159
Note: This will run in its own forked process."""
2301
2161
def handle(self):
2302
2162
with contextlib.closing(self.server.child_pipe) as child_pipe:
2303
log.info("TCP connection from: %s",
2304
str(self.client_address))
2305
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2163
logger.info("TCP connection from: %s",
2164
str(self.client_address))
2165
logger.debug("Pipe FD: %d",
2166
self.server.child_pipe.fileno())
2307
2168
session = gnutls.ClientSession(self.request)
2309
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2310
# "+AES-256-CBC", "+SHA1",
2311
# "+COMP-NULL", "+CTYPE-OPENPGP",
2170
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2171
# "+AES-256-CBC", "+SHA1",
2172
# "+COMP-NULL", "+CTYPE-OPENPGP",
2313
2174
# Use a fallback default, since this MUST be set.
2314
2175
priority = self.server.gnutls_priority
2315
2176
if priority is None:
2316
2177
priority = "NORMAL"
2317
gnutls.priority_set_direct(session,
2318
priority.encode("utf-8"), None)
2178
gnutls.priority_set_direct(session._c_object, priority,
2320
2181
# Start communication using the Mandos protocol
2321
2182
# Get protocol number
2322
2183
line = self.request.makefile().readline()
2323
log.debug("Protocol version: %r", line)
2184
logger.debug("Protocol version: %r", line)
2325
2186
if int(line.strip().split()[0]) > 1:
2326
2187
raise RuntimeError(line)
2327
2188
except (ValueError, IndexError, RuntimeError) as error:
2328
log.error("Unknown protocol version: %s", error)
2189
logger.error("Unknown protocol version: %s", error)
2331
2192
# Start GnuTLS connection
2333
2194
session.handshake()
2334
2195
except gnutls.Error as error:
2335
log.warning("Handshake failed: %s", error)
2196
logger.warning("Handshake failed: %s", error)
2336
2197
# Do not run session.bye() here: the session is not
2337
2198
# established. Just abandon the request.
2339
log.debug("Handshake succeeded")
2200
logger.debug("Handshake succeeded")
2341
2202
approval_required = False
2343
if gnutls.has_rawpk:
2346
key_id = self.key_id(
2347
self.peer_certificate(session))
2348
except (TypeError, gnutls.Error) as error:
2349
log.warning("Bad certificate: %s", error)
2351
log.debug("Key ID: %s",
2352
key_id.decode("utf-8",
2358
fpr = self.fingerprint(
2359
self.peer_certificate(session))
2360
except (TypeError, gnutls.Error) as error:
2361
log.warning("Bad certificate: %s", error)
2363
log.debug("Fingerprint: %s", fpr)
2366
client = ProxyClient(child_pipe, key_id, fpr,
2205
fpr = self.fingerprint(
2206
self.peer_certificate(session))
2207
except (TypeError, gnutls.Error) as error:
2208
logger.warning("Bad certificate: %s", error)
2210
logger.debug("Fingerprint: %s", fpr)
2213
client = ProxyClient(child_pipe, fpr,
2367
2214
self.client_address)
2368
2215
except KeyError:
2371
2218
if client.approval_delay:
2372
2219
delay = client.approval_delay
2373
2220
client.approvals_pending += 1
2374
2221
approval_required = True
2377
2224
if not client.enabled:
2378
log.info("Client %s is disabled", client.name)
2225
logger.info("Client %s is disabled",
2379
2227
if self.server.use_dbus:
2380
2228
# Emit D-Bus signal
2381
2229
client.Rejected("Disabled")
2384
2232
if client.approved or not client.approval_delay:
2385
# We are approved or approval is disabled
2233
#We are approved or approval is disabled
2387
2235
elif client.approved is None:
2388
log.info("Client %s needs approval",
2236
logger.info("Client %s needs approval",
2390
2238
if self.server.use_dbus:
2391
2239
# Emit D-Bus signal
2392
2240
client.NeedApproval(
2393
2241
client.approval_delay.total_seconds()
2394
2242
* 1000, client.approved_by_default)
2396
log.warning("Client %s was not approved",
2244
logger.warning("Client %s was not approved",
2398
2246
if self.server.use_dbus:
2399
2247
# Emit D-Bus signal
2400
2248
client.Rejected("Denied")
2403
# wait until timeout or approved
2251
#wait until timeout or approved
2404
2252
time = datetime.datetime.now()
2405
2253
client.changedstate.acquire()
2406
2254
client.changedstate.wait(delay.total_seconds())
2704
2505
self.gnutls_priority = gnutls_priority
2705
2506
IPv6_TCPServer.__init__(self, server_address,
2706
2507
RequestHandlerClass,
2707
interface=interface,
2508
interface = interface,
2509
use_ipv6 = use_ipv6,
2510
socketfd = socketfd)
2711
2512
def server_activate(self):
2712
2513
if self.enabled:
2713
2514
return socketserver.TCPServer.server_activate(self)
2715
2516
def enable(self):
2716
2517
self.enabled = True
2718
2519
def add_pipe(self, parent_pipe, proc):
2719
2520
# Call "handle_ipc" for both data and EOF events
2721
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2722
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2521
GObject.io_add_watch(
2522
parent_pipe.fileno(),
2523
GObject.IO_IN | GObject.IO_HUP,
2723
2524
functools.partial(self.handle_ipc,
2724
parent_pipe=parent_pipe,
2525
parent_pipe = parent_pipe,
2727
2528
def handle_ipc(self, source, condition,
2728
2529
parent_pipe=None,
2730
2531
client_object=None):
2731
2532
# error, or the other end of multiprocessing.Pipe has closed
2732
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2533
if condition & (GObject.IO_ERR | GObject.IO_HUP):
2733
2534
# Wait for other process to exit
2737
2538
# Read a request from the child
2738
2539
request = parent_pipe.recv()
2739
2540
command = request[0]
2741
if command == "init":
2742
key_id = request[1].decode("ascii")
2743
fpr = request[2].decode("ascii")
2744
address = request[3]
2542
if command == 'init':
2544
address = request[2]
2746
2546
for c in self.clients.values():
2747
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2748
"27AE41E4649B934CA495991B7852B855"):
2750
if key_id and c.key_id == key_id:
2753
if fpr and c.fingerprint == fpr:
2547
if c.fingerprint == fpr:
2757
log.info("Client not found for key ID: %s, address:"
2758
" %s", key_id or fpr, address)
2551
logger.info("Client not found for fingerprint: %s, ad"
2552
"dress: %s", fpr, address)
2759
2553
if self.use_dbus:
2760
2554
# Emit D-Bus signal
2761
mandos_dbus_service.ClientNotFound(key_id or fpr,
2555
mandos_dbus_service.ClientNotFound(fpr,
2763
2557
parent_pipe.send(False)
2767
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2768
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2560
GObject.io_add_watch(
2561
parent_pipe.fileno(),
2562
GObject.IO_IN | GObject.IO_HUP,
2769
2563
functools.partial(self.handle_ipc,
2770
parent_pipe=parent_pipe,
2772
client_object=client))
2564
parent_pipe = parent_pipe,
2566
client_object = client))
2773
2567
parent_pipe.send(True)
2774
2568
# remove the old hook in favor of the new above hook on
2777
if command == "funcall":
2571
if command == 'funcall':
2778
2572
funcname = request[1]
2779
2573
args = request[2]
2780
2574
kwargs = request[3]
2782
parent_pipe.send(("data", getattr(client_object,
2576
parent_pipe.send(('data', getattr(client_object,
2783
2577
funcname)(*args,
2786
if command == "getattr":
2580
if command == 'getattr':
2787
2581
attrname = request[1]
2788
2582
if isinstance(client_object.__getattribute__(attrname),
2789
collections.abc.Callable):
2790
parent_pipe.send(("function", ))
2583
collections.Callable):
2584
parent_pipe.send(('function', ))
2792
2586
parent_pipe.send((
2793
"data", client_object.__getattribute__(attrname)))
2795
if command == "setattr":
2587
'data', client_object.__getattribute__(attrname)))
2589
if command == 'setattr':
2796
2590
attrname = request[1]
2797
2591
value = request[2]
2798
2592
setattr(client_object, attrname, value)
2803
2597
def rfc3339_duration_to_delta(duration):
2804
2598
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2806
>>> timedelta = datetime.timedelta
2807
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2809
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2811
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2813
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2815
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2817
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2819
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2600
>>> rfc3339_duration_to_delta("P7D")
2601
datetime.timedelta(7)
2602
>>> rfc3339_duration_to_delta("PT60S")
2603
datetime.timedelta(0, 60)
2604
>>> rfc3339_duration_to_delta("PT60M")
2605
datetime.timedelta(0, 3600)
2606
>>> rfc3339_duration_to_delta("PT24H")
2607
datetime.timedelta(1)
2608
>>> rfc3339_duration_to_delta("P1W")
2609
datetime.timedelta(7)
2610
>>> rfc3339_duration_to_delta("PT5M30S")
2611
datetime.timedelta(0, 330)
2612
>>> rfc3339_duration_to_delta("P1DT3M20S")
2613
datetime.timedelta(1, 200)
2824
2616
# Parsing an RFC 3339 duration with regular expressions is not
2825
2617
# possible - there would have to be multiple places for the same
2826
2618
# values, like seconds. The current code, while more esoteric, is
2827
2619
# cleaner without depending on a parsing library. If Python had a
2828
2620
# built-in library for parsing we would use it, but we'd like to
2829
2621
# avoid excessive use of external libraries.
2831
2623
# New type for defining tokens, syntax, and semantics all-in-one
2832
2624
Token = collections.namedtuple("Token", (
2833
2625
"regexp", # To match token; if "value" is not None, must have
3225
3014
"se.bsnet.fukt.Mandos", bus,
3226
3015
do_not_queue=True)
3227
3016
except dbus.exceptions.DBusException as e:
3228
log.error("Disabling D-Bus:", exc_info=e)
3017
logger.error("Disabling D-Bus:", exc_info=e)
3229
3018
use_dbus = False
3230
3019
server_settings["use_dbus"] = False
3231
3020
tcp_server.use_dbus = False
3233
3022
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3234
3023
service = AvahiServiceToSyslog(
3235
name=server_settings["servicename"],
3236
servicetype="_mandos._tcp",
3024
name = server_settings["servicename"],
3025
servicetype = "_mandos._tcp",
3026
protocol = protocol,
3239
3028
if server_settings["interface"]:
3240
3029
service.interface = if_nametoindex(
3241
3030
server_settings["interface"].encode("utf-8"))
3243
3032
global multiprocessing_manager
3244
3033
multiprocessing_manager = multiprocessing.Manager()
3246
3035
client_class = Client
3248
client_class = functools.partial(ClientDBus, bus=bus)
3037
client_class = functools.partial(ClientDBus, bus = bus)
3250
3039
client_settings = Client.config_parser(client_config)
3251
3040
old_client_settings = {}
3252
3041
clients_data = {}
3254
3043
# This is used to redirect stdout and stderr for checker processes
3256
wnull = open(os.devnull, "w") # A writable /dev/null
3045
wnull = open(os.devnull, "w") # A writable /dev/null
3257
3046
# Only used if server is running in foreground but not in debug
3259
3048
if debug or not foreground:
3262
3051
# Get client data and settings from last running state.
3263
3052
if server_settings["restore"]:
3265
3054
with open(stored_state_path, "rb") as stored_state:
3266
if sys.version_info.major == 2:
3055
if sys.version_info.major == 2:
3267
3056
clients_data, old_client_settings = pickle.load(
3270
3059
bytes_clients_data, bytes_old_client_settings = (
3271
pickle.load(stored_state, encoding="bytes"))
3272
# Fix bytes to strings
3060
pickle.load(stored_state, encoding = "bytes"))
3061
### Fix bytes to strings
3275
clients_data = {(key.decode("utf-8")
3276
if isinstance(key, bytes)
3279
bytes_clients_data.items()}
3064
clients_data = { (key.decode("utf-8")
3065
if isinstance(key, bytes)
3068
bytes_clients_data.items() }
3280
3069
del bytes_clients_data
3281
3070
for key in clients_data:
3282
value = {(k.decode("utf-8")
3283
if isinstance(k, bytes) else k): v
3285
clients_data[key].items()}
3071
value = { (k.decode("utf-8")
3072
if isinstance(k, bytes) else k): v
3074
clients_data[key].items() }
3286
3075
clients_data[key] = value
3287
3076
# .client_structure
3288
3077
value["client_structure"] = [
3289
3078
(s.decode("utf-8")
3290
3079
if isinstance(s, bytes)
3291
3080
else s) for s in
3292
value["client_structure"]]
3293
# .name, .host, and .checker_command
3294
for k in ("name", "host", "checker_command"):
3081
value["client_structure"] ]
3083
for k in ("name", "host"):
3295
3084
if isinstance(value[k], bytes):
3296
3085
value[k] = value[k].decode("utf-8")
3297
if "key_id" not in value:
3298
value["key_id"] = ""
3299
elif "fingerprint" not in value:
3300
value["fingerprint"] = ""
3301
# old_client_settings
3086
## old_client_settings
3303
3088
old_client_settings = {
3304
3089
(key.decode("utf-8")
3305
3090
if isinstance(key, bytes)
3306
3091
else key): value
3307
3092
for key, value in
3308
bytes_old_client_settings.items()}
3093
bytes_old_client_settings.items() }
3309
3094
del bytes_old_client_settings
3310
# .host and .checker_command
3311
3096
for value in old_client_settings.values():
3312
for attribute in ("host", "checker_command"):
3313
if isinstance(value[attribute], bytes):
3314
value[attribute] = (value[attribute]
3097
if isinstance(value["host"], bytes):
3098
value["host"] = (value["host"]
3316
3100
os.remove(stored_state_path)
3317
3101
except IOError as e:
3318
3102
if e.errno == errno.ENOENT:
3319
log.warning("Could not load persistent state:"
3320
" %s", os.strerror(e.errno))
3103
logger.warning("Could not load persistent state:"
3104
" {}".format(os.strerror(e.errno)))
3322
log.critical("Could not load persistent state:",
3106
logger.critical("Could not load persistent state:",
3325
3109
except EOFError as e:
3326
log.warning("Could not load persistent state: EOFError:",
3110
logger.warning("Could not load persistent state: "
3329
3114
with PGPEngine() as pgp:
3330
3115
for client_name, client in clients_data.items():
3331
3116
# Skip removed clients
3332
3117
if client_name not in client_settings:
3335
3120
# Decide which value to use after restoring saved state.
3336
3121
# We have three different values: Old config file,
3337
3122
# new config file, and saved state.
3610
3393
# Need to initiate checking of clients
3611
3394
if client.enabled:
3612
3395
client.init_checker()
3614
3397
tcp_server.enable()
3615
3398
tcp_server.server_activate()
3617
3400
# Find out what port we got
3619
3402
service.port = tcp_server.socket.getsockname()[1]
3621
log.info("Now listening on address %r, port %d, flowinfo %d,"
3622
" scope_id %d", *tcp_server.socket.getsockname())
3404
logger.info("Now listening on address %r, port %d,"
3405
" flowinfo %d, scope_id %d",
3406
*tcp_server.socket.getsockname())
3624
log.info("Now listening on address %r, port %d",
3625
*tcp_server.socket.getsockname())
3627
# service.interface = tcp_server.socket.getsockname()[3]
3408
logger.info("Now listening on address %r, port %d",
3409
*tcp_server.socket.getsockname())
3411
#service.interface = tcp_server.socket.getsockname()[3]
3631
3415
# From the Avahi example code
3633
3417
service.activate()
3634
3418
except dbus.exceptions.DBusException as error:
3635
log.critical("D-Bus Exception", exc_info=error)
3419
logger.critical("D-Bus Exception", exc_info=error)
3638
3422
# End of Avahi example code
3641
GLib.IOChannel.unix_new(tcp_server.fileno()),
3642
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3643
lambda *args, **kwargs: (tcp_server.handle_request
3644
(*args[2:], **kwargs) or True))
3646
log.debug("Starting main loop")
3424
GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,
3425
lambda *args, **kwargs:
3426
(tcp_server.handle_request
3427
(*args[2:], **kwargs) or True))
3429
logger.debug("Starting main loop")
3647
3430
main_loop.run()
3648
3431
except AvahiError as error:
3649
log.critical("Avahi Error", exc_info=error)
3432
logger.critical("Avahi Error", exc_info=error)
3652
3435
except KeyboardInterrupt:
3654
3437
print("", file=sys.stderr)
3655
log.debug("Server received KeyboardInterrupt")
3656
log.debug("Server exiting")
3438
logger.debug("Server received KeyboardInterrupt")
3439
logger.debug("Server exiting")
3657
3440
# Must run before the D-Bus bus name gets deregistered
3661
def parse_test_args():
3662
# type: () -> argparse.Namespace
3663
parser = argparse.ArgumentParser(add_help=False)
3664
parser.add_argument("--check", action="store_true")
3665
parser.add_argument("--prefix", )
3666
args, unknown_args = parser.parse_known_args()
3668
# Remove test options from sys.argv
3669
sys.argv[1:] = unknown_args
3672
# Add all tests from doctest strings
3673
def load_tests(loader, tests, none):
3675
tests.addTests(doctest.DocTestSuite())
3678
if __name__ == "__main__":
3679
options = parse_test_args()
3682
extra_test_prefix = options.prefix
3683
if extra_test_prefix is not None:
3684
if not (unittest.main(argv=[""], exit=False)
3685
.result.wasSuccessful()):
3687
class ExtraTestLoader(unittest.TestLoader):
3688
testMethodPrefix = extra_test_prefix
3689
# Call using ./scriptname --test [--verbose]
3690
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3692
unittest.main(argv=[""])
3700
# (lambda (&optional extra)
3701
# (if (not (funcall run-tests-in-test-buffer default-directory
3703
# (funcall show-test-buffer-in-test-window)
3704
# (funcall remove-test-window)
3705
# (if extra (message "Extra tests run successfully!"))))
3706
# run-tests-in-test-buffer:
3707
# (lambda (dir &optional extra)
3708
# (with-current-buffer (get-buffer-create "*Test*")
3709
# (setq buffer-read-only nil
3710
# default-directory dir)
3712
# (compilation-mode))
3713
# (let ((process-result
3714
# (let ((inhibit-read-only t))
3715
# (process-file-shell-command
3716
# (funcall get-command-line extra) nil "*Test*"))))
3717
# (and (numberp process-result)
3718
# (= process-result 0))))
3720
# (lambda (&optional extra)
3721
# (let ((quoted-script
3722
# (shell-quote-argument (funcall get-script-name))))
3724
# (concat "%s --check" (if extra " --prefix=atest" ""))
3728
# (if (fboundp 'file-local-name)
3729
# (file-local-name (buffer-file-name))
3730
# (or (file-remote-p (buffer-file-name) 'localname)
3731
# (buffer-file-name))))
3732
# remove-test-window:
3734
# (let ((test-window (get-buffer-window "*Test*")))
3735
# (if test-window (delete-window test-window))))
3736
# show-test-buffer-in-test-window:
3738
# (when (not (get-buffer-window-list "*Test*"))
3739
# (setq next-error-last-buffer (get-buffer "*Test*"))
3740
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3741
# (display-buffer-overriding-action
3742
# `((display-buffer-in-side-window) (side . ,side)
3743
# (window-height . fit-window-to-buffer)
3744
# (window-width . fit-window-to-buffer))))
3745
# (display-buffer "*Test*"))))
3748
# (let* ((run-extra-tests (lambda () (interactive)
3749
# (funcall run-tests t)))
3750
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3751
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3752
# (setq minor-mode-overriding-map-alist
3753
# (cons `(run-tests . ,outer-keymap)
3754
# minor-mode-overriding-map-alist)))
3755
# (add-hook 'after-save-hook run-tests 90 t))
3444
if __name__ == '__main__':