To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 956
- compare with another revision
- download diff
- download tarball
- view history from revision 956
- Committer: Teddy Hogeborn
- Date: 2018-08-19 14:58:40 UTC
- Revision ID: teddy@recompile.se-20180819145840-s1a3xar41lyoq4ty
Set executable permissions on new files
* initramfs-tools-script-stop: Did "chmod +x".
* mandos-to-cryptroot-unlock: - '' -
* initramfs-tools-script-stop: Did "chmod +x".
* mandos-to-cryptroot-unlock: - '' -
- files removed:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2020 Teddy Hogeborn
15
# Copyright © 2008-2020 Björn Påhlsson
14
# Copyright © 2008-2018 Teddy Hogeborn
15
# Copyright © 2008-2018 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
39
40
except ImportError:
40
41
pass
41
42
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
43
try:
48
44
import SocketServer as socketserver
49
45
except ImportError:
50
46
import socketserver
51
47
import socket
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
import ConfigParser as configparser
56
53
except ImportError:
57
54
import configparser
55
import sys
58
56
import re
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import random
81
import shlex
82
80
83
81
import dbus
84
82
import dbus.service
85
import gi
86
83
from gi.repository import GLib
87
84
from dbus.mainloop.glib import DBusGMainLoop
88
85
import ctypes
90
87
import xml.dom.minidom
91
88
import inspect
92
89
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
90
# Try to find the value of SO_BINDTODEVICE:
119
91
try:
120
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
140
112
# No value found
141
113
SO_BINDTODEVICE = None
142
114
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
115
if sys.version_info.major == 2:
116
str = unicode
145
117
146
version = "1.8.14"
118
version = "1.7.19"
147
119
stored_state_file = "clients.pickle"
148
120
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
150
logging.captureWarnings(True) # Show warnings via the logging system
121
logger = logging.getLogger()
151
122
syslogger = None
152
123
153
124
try:
189
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
161
address="/dev/log"))
191
162
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
163
('Mandos [%(process)d]: %(levelname)s:'
164
' %(message)s'))
165
logger.addHandler(syslogger)
195
166
196
167
if debug:
197
168
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
169
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
170
' [%(process)d]:'
171
' %(levelname)s:'
172
' %(message)s'))
173
logger.addHandler(console)
174
logger.setLevel(level)
204
175
205
176
206
177
class PGPError(Exception):
208
179
pass
209
180
210
181
211
class PGPEngine:
182
class PGPEngine(object):
212
183
"""A simple class for OpenPGP symmetric encryption & decryption"""
213
184
214
185
def __init__(self):
218
189
output = subprocess.check_output(["gpgconf"])
219
190
for line in output.splitlines():
220
191
name, text, path = line.split(b":")
221
if name == b"gpg":
192
if name == "gpg":
222
193
self.gpg = path
223
194
break
224
195
except OSError as e:
225
196
if e.errno != errno.ENOENT:
226
197
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
198
self.gnupgargs = ['--batch',
199
'--homedir', self.tempdir,
200
'--force-mdc',
201
'--quiet']
231
202
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
203
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
233
204
self.gnupgargs.append("--no-use-agent")
234
205
235
206
def __enter__(self):
272
243
dir=self.tempdir) as passfile:
273
244
passfile.write(passphrase)
274
245
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
246
proc = subprocess.Popen([self.gpg, '--symmetric',
247
'--passphrase-file',
277
248
passfile.name]
278
249
+ self.gnupgargs,
279
250
stdin=subprocess.PIPE,
290
261
dir=self.tempdir) as passfile:
291
262
passfile.write(passphrase)
292
263
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
264
proc = subprocess.Popen([self.gpg, '--decrypt',
265
'--passphrase-file',
295
266
passfile.name]
296
267
+ self.gnupgargs,
297
268
stdin=subprocess.PIPE,
304
275
305
276
306
277
# Pretend that we have an Avahi module
307
class avahi:
308
"""This isn't so much a class as it is a module-like namespace."""
278
class Avahi(object):
279
"""This isn't so much a class as it is a module-like namespace.
280
It is instantiated once, and simulates having an Avahi module."""
309
281
IF_UNSPEC = -1 # avahi-common/address.h
310
282
PROTO_UNSPEC = -1 # avahi-common/address.h
311
283
PROTO_INET = 0 # avahi-common/address.h
315
287
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
288
DBUS_PATH_SERVER = "/"
317
289
318
@staticmethod
319
def string_array_to_txt_array(t):
290
def string_array_to_txt_array(self, t):
320
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
292
for s in t), signature="ay")
322
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
327
298
SERVER_RUNNING = 2 # avahi-common/defs.h
328
299
SERVER_COLLISION = 3 # avahi-common/defs.h
329
300
SERVER_FAILURE = 4 # avahi-common/defs.h
301
avahi = Avahi()
330
302
331
303
332
304
class AvahiError(Exception):
344
316
pass
345
317
346
318
347
class AvahiService:
319
class AvahiService(object):
348
320
"""An Avahi (Zeroconf) service.
349
321
350
322
Attributes:
351
323
interface: integer; avahi.IF_UNSPEC or an interface index.
352
324
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
325
name: string; Example: 'Mandos'
326
type: string; Example: '_mandos._tcp'.
355
327
See <https://www.iana.org/assignments/service-names-port-numbers>
356
328
port: integer; what port to announce
357
329
TXT: list of strings; TXT record for the service
394
366
def rename(self, remove=True):
395
367
"""Derived from the Avahi example code"""
396
368
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
369
logger.critical("No suitable Zeroconf service name found"
370
" after %i retries, exiting.",
371
self.rename_count)
400
372
raise AvahiServiceError("Too many renames")
401
373
self.name = str(
402
374
self.server.GetAlternativeServiceName(self.name))
403
375
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
376
logger.info("Changing Zeroconf service name to %r ...",
377
self.name)
406
378
if remove:
407
379
self.remove()
408
380
try:
410
382
except dbus.exceptions.DBusException as error:
411
383
if (error.get_dbus_name()
412
384
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
385
logger.info("Local Zeroconf service name collision.")
414
386
return self.rename(remove=False)
415
387
else:
416
log.critical("D-Bus Exception", exc_info=error)
388
logger.critical("D-Bus Exception", exc_info=error)
417
389
self.cleanup()
418
390
os._exit(1)
419
391
435
407
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
408
self.entry_group_state_changed_match = (
437
409
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
410
'StateChanged', self.entry_group_state_changed))
411
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
412
self.name, self.type)
441
413
self.group.AddService(
442
414
self.interface,
443
415
self.protocol,
450
422
451
423
def entry_group_state_changed(self, state, error):
452
424
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
425
logger.debug("Avahi entry group state change: %i", state)
454
426
455
427
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
428
logger.debug("Zeroconf service established.")
457
429
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
430
logger.info("Zeroconf service name collision.")
459
431
self.rename()
460
432
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
433
logger.critical("Avahi: Error in group state changed %s",
434
str(error))
463
435
raise AvahiGroupError("State changed: {!s}".format(error))
464
436
465
437
def cleanup(self):
475
447
476
448
def server_state_changed(self, state, error=None):
477
449
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
450
logger.debug("Avahi server state change: %i", state)
479
451
bad_states = {
480
452
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
453
avahi.SERVER_REGISTERING: None,
485
457
if state in bad_states:
486
458
if bad_states[state] is not None:
487
459
if error is None:
488
log.error(bad_states[state])
460
logger.error(bad_states[state])
489
461
else:
490
log.error(bad_states[state] + ": %r", error)
462
logger.error(bad_states[state] + ": %r", error)
491
463
self.cleanup()
492
464
elif state == avahi.SERVER_RUNNING:
493
465
try:
495
467
except dbus.exceptions.DBusException as error:
496
468
if (error.get_dbus_name()
497
469
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
470
logger.info("Local Zeroconf service name"
471
" collision.")
499
472
return self.rename(remove=False)
500
473
else:
501
log.critical("D-Bus Exception", exc_info=error)
474
logger.critical("D-Bus Exception", exc_info=error)
502
475
self.cleanup()
503
476
os._exit(1)
504
477
else:
505
478
if error is None:
506
log.debug("Unknown state: %r", state)
479
logger.debug("Unknown state: %r", state)
507
480
else:
508
log.debug("Unknown state: %r: %r", state, error)
481
logger.debug("Unknown state: %r: %r", state, error)
509
482
510
483
def activate(self):
511
484
"""Derived from the Avahi example code"""
523
496
class AvahiServiceToSyslog(AvahiService):
524
497
def rename(self, *args, **kwargs):
525
498
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
499
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
528
500
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
501
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
502
.format(self.name)))
531
503
return ret
532
504
533
505
534
506
# Pretend that we have a GnuTLS module
535
class gnutls:
536
"""This isn't so much a class as it is a module-like namespace."""
507
class GnuTLS(object):
508
"""This isn't so much a class as it is a module-like namespace.
509
It is instantiated once, and simulates having a GnuTLS module."""
537
510
538
511
library = ctypes.util.find_library("gnutls")
539
512
if library is None:
540
513
library = ctypes.util.find_library("gnutls-deb0")
541
514
_library = ctypes.cdll.LoadLibrary(library)
542
515
del library
516
_need_version = b"3.3.0"
517
518
def __init__(self):
519
# Need to use "self" here, since this method is called before
520
# the assignment to the "gnutls" global variable happens.
521
if self.check_version(self._need_version) is None:
522
raise self.Error("Needs GnuTLS {} or later"
523
.format(self._need_version))
543
524
544
525
# Unless otherwise indicated, the constants and types below are
545
526
# all from the gnutls/gnutls.h C header file.
549
530
E_INTERRUPTED = -52
550
531
E_AGAIN = -28
551
532
CRT_OPENPGP = 2
552
CRT_RAWPK = 3
553
533
CLIENT = 2
554
534
SHUT_RDWR = 0
555
535
CRD_CERTIFICATE = 1
556
536
E_NO_CERTIFICATE_FOUND = -49
557
X509_FMT_DER = 0
558
NO_TICKETS = 1<<10
559
ENABLE_RAWPK = 1<<18
560
CTYPE_PEERS = 3
561
KEYID_USE_SHA256 = 1 # gnutls/x509.h
562
537
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
538
564
539
# Types
565
class _session_int(ctypes.Structure):
540
class session_int(ctypes.Structure):
566
541
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
542
session_t = ctypes.POINTER(session_int)
568
543
569
544
class certificate_credentials_st(ctypes.Structure):
570
545
_fields_ = []
573
548
certificate_type_t = ctypes.c_int
574
549
575
550
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
551
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
552
('size', ctypes.c_uint)]
578
553
579
class _openpgp_crt_int(ctypes.Structure):
554
class openpgp_crt_int(ctypes.Structure):
580
555
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
556
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
557
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
558
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
559
credentials_type_t = ctypes.c_int
587
562
588
563
# Exceptions
589
564
class Error(Exception):
565
# We need to use the class name "GnuTLS" here, since this
566
# exception might be raised from within GnuTLS.__init__,
567
# which is called before the assignment to the "gnutls"
568
# global variable has happened.
590
569
def __init__(self, message=None, code=None, args=()):
591
570
# Default usage is by a message string, but if a return
592
571
# code is passed, convert it to a string with
593
572
# gnutls.strerror()
594
573
self.code = code
595
574
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
598
return super(gnutls.Error, self).__init__(
575
message = GnuTLS.strerror(code)
576
return super(GnuTLS.Error, self).__init__(
599
577
message, *args)
600
578
601
579
class CertificateSecurityError(Error):
602
580
pass
603
581
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
582
# Classes
630
class Credentials(With_from_param):
583
class Credentials(object):
631
584
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
585
self._c_object = gnutls.certificate_credentials_t()
586
gnutls.certificate_allocate_credentials(
587
ctypes.byref(self._c_object))
634
588
self.type = gnutls.CRD_CERTIFICATE
635
589
636
590
def __del__(self):
637
gnutls.certificate_free_credentials(self)
591
gnutls.certificate_free_credentials(self._c_object)
638
592
639
class ClientSession(With_from_param):
593
class ClientSession(object):
640
594
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
642
gnutls_flags = gnutls.CLIENT
643
if gnutls.check_version(b"3.5.6"):
644
gnutls_flags |= gnutls.NO_TICKETS
645
if gnutls.has_rawpk:
646
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
648
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
595
self._c_object = gnutls.session_t()
596
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
597
gnutls.set_default_priority(self._c_object)
598
gnutls.transport_set_ptr(self._c_object, socket.fileno())
599
gnutls.handshake_set_private_extensions(self._c_object,
600
True)
652
601
self.socket = socket
653
602
if credentials is None:
654
603
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
604
gnutls.credentials_set(self._c_object, credentials.type,
605
ctypes.cast(credentials._c_object,
606
ctypes.c_void_p))
657
607
self.credentials = credentials
658
608
659
609
def __del__(self):
660
gnutls.deinit(self)
610
gnutls.deinit(self._c_object)
661
611
662
612
def handshake(self):
663
return gnutls.handshake(self)
613
return gnutls.handshake(self._c_object)
664
614
665
615
def send(self, data):
666
616
data = bytes(data)
667
617
data_len = len(data)
668
618
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
619
data_len -= gnutls.record_send(self._c_object,
620
data[-data_len:],
670
621
data_len)
671
622
672
623
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
624
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
625
675
626
# Error handling functions
676
627
def _error_code(result):
677
628
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
629
for the 'restype' attribute on ctypes functions"""
630
if result >= 0:
680
631
return result
681
632
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
633
raise gnutls.CertificateSecurityError(code=result)
683
634
raise gnutls.Error(code=result)
684
635
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
636
def _retry_on_error(result, func, arguments):
687
637
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
638
for the 'errcheck' attribute on ctypes functions"""
639
while result < 0:
690
640
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
641
return _error_code(result)
692
642
result = func(*arguments)
697
647
698
648
# Functions
699
649
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
650
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
651
ctypes.POINTER(ctypes.c_char_p)]
702
652
priority_set_direct.restype = _error_code
703
653
704
654
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
655
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
656
init.restype = _error_code
707
657
708
658
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
659
set_default_priority.argtypes = [session_t]
710
660
set_default_priority.restype = _error_code
711
661
712
662
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
663
record_send.argtypes = [session_t, ctypes.c_void_p,
714
664
ctypes.c_size_t]
715
665
record_send.restype = ctypes.c_ssize_t
716
666
record_send.errcheck = _retry_on_error
718
668
certificate_allocate_credentials = (
719
669
_library.gnutls_certificate_allocate_credentials)
720
670
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
671
ctypes.POINTER(certificate_credentials_t)]
722
672
certificate_allocate_credentials.restype = _error_code
723
673
724
674
certificate_free_credentials = (
725
675
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
676
certificate_free_credentials.argtypes = [
677
certificate_credentials_t]
727
678
certificate_free_credentials.restype = None
728
679
729
680
handshake_set_private_extensions = (
730
681
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
682
handshake_set_private_extensions.argtypes = [session_t,
732
683
ctypes.c_int]
733
684
handshake_set_private_extensions.restype = None
734
685
735
686
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
687
credentials_set.argtypes = [session_t, credentials_type_t,
688
ctypes.c_void_p]
738
689
credentials_set.restype = _error_code
739
690
740
691
strerror = _library.gnutls_strerror
742
693
strerror.restype = ctypes.c_char_p
743
694
744
695
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
696
certificate_type_get.argtypes = [session_t]
746
697
certificate_type_get.restype = _error_code
747
698
748
699
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
700
certificate_get_peers.argtypes = [session_t,
750
701
ctypes.POINTER(ctypes.c_uint)]
751
702
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
703
759
710
global_set_log_function.restype = None
760
711
761
712
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
713
deinit.argtypes = [session_t]
763
714
deinit.restype = None
764
715
765
716
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
717
handshake.argtypes = [session_t]
718
handshake.restype = _error_code
768
719
handshake.errcheck = _retry_on_error
769
720
770
721
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
722
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
723
transport_set_ptr.restype = None
773
724
774
725
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
726
bye.argtypes = [session_t, close_request_t]
727
bye.restype = _error_code
777
728
bye.errcheck = _retry_on_error
778
729
779
730
check_version = _library.gnutls_check_version
780
731
check_version.argtypes = [ctypes.c_char_p]
781
732
check_version.restype = ctypes.c_char_p
782
733
783
_need_version = b"3.3.0"
784
if check_version(_need_version) is None:
785
raise self.Error("Needs GnuTLS {} or later"
786
.format(_need_version))
787
788
_tls_rawpk_version = b"3.6.6"
789
has_rawpk = bool(check_version(_tls_rawpk_version))
790
791
if has_rawpk:
792
# Types
793
class pubkey_st(ctypes.Structure):
794
_fields = []
795
pubkey_t = ctypes.POINTER(pubkey_st)
796
797
x509_crt_fmt_t = ctypes.c_int
798
799
# All the function declarations below are from
800
# gnutls/abstract.h
801
pubkey_init = _library.gnutls_pubkey_init
802
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
pubkey_init.restype = _error_code
804
805
pubkey_import = _library.gnutls_pubkey_import
806
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
807
x509_crt_fmt_t]
808
pubkey_import.restype = _error_code
809
810
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
811
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
812
ctypes.POINTER(ctypes.c_ubyte),
813
ctypes.POINTER(ctypes.c_size_t)]
814
pubkey_get_key_id.restype = _error_code
815
816
pubkey_deinit = _library.gnutls_pubkey_deinit
817
pubkey_deinit.argtypes = [pubkey_t]
818
pubkey_deinit.restype = None
819
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
822
823
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
825
openpgp_crt_init.restype = _error_code
826
827
openpgp_crt_import = _library.gnutls_openpgp_crt_import
828
openpgp_crt_import.argtypes = [openpgp_crt_t,
829
ctypes.POINTER(datum_t),
830
openpgp_crt_fmt_t]
831
openpgp_crt_import.restype = _error_code
832
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
840
openpgp_crt_verify_self.restype = _error_code
841
842
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
843
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
844
openpgp_crt_deinit.restype = None
845
846
openpgp_crt_get_fingerprint = (
847
_library.gnutls_openpgp_crt_get_fingerprint)
848
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
849
ctypes.c_void_p,
850
ctypes.POINTER(
851
ctypes.c_size_t)]
852
openpgp_crt_get_fingerprint.restype = _error_code
853
854
if check_version(b"3.6.4"):
855
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
857
certificate_type_get2.restype = _error_code
734
# All the function declarations below are from gnutls/openpgp.h
735
736
openpgp_crt_init = _library.gnutls_openpgp_crt_init
737
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
738
openpgp_crt_init.restype = _error_code
739
740
openpgp_crt_import = _library.gnutls_openpgp_crt_import
741
openpgp_crt_import.argtypes = [openpgp_crt_t,
742
ctypes.POINTER(datum_t),
743
openpgp_crt_fmt_t]
744
openpgp_crt_import.restype = _error_code
745
746
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
747
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
748
ctypes.POINTER(ctypes.c_uint)]
749
openpgp_crt_verify_self.restype = _error_code
750
751
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
752
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
753
openpgp_crt_deinit.restype = None
754
755
openpgp_crt_get_fingerprint = (
756
_library.gnutls_openpgp_crt_get_fingerprint)
757
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
758
ctypes.c_void_p,
759
ctypes.POINTER(
760
ctypes.c_size_t)]
761
openpgp_crt_get_fingerprint.restype = _error_code
858
762
859
763
# Remove non-public functions
860
764
del _error_code, _retry_on_error
765
# Create the global "gnutls" object, simulating a module
766
gnutls = GnuTLS()
861
767
862
768
863
769
def call_pipe(connection, # : multiprocessing.Connection
871
777
connection.close()
872
778
873
779
874
class Client:
780
class Client(object):
875
781
"""A representation of a client host served by this server.
876
782
877
783
Attributes:
878
approved: bool(); None if not yet approved/disapproved
784
approved: bool(); 'None' if not yet approved/disapproved
879
785
approval_delay: datetime.timedelta(); Time to wait for approval
880
786
approval_duration: datetime.timedelta(); Duration of one approval
881
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
883
running.
787
checker: subprocess.Popen(); a running checker process used
788
to see if the client lives.
789
'None' if no process is running.
884
790
checker_callback_tag: a GLib event source tag, or None
885
791
checker_command: string; External command which is run to check
886
792
if client lives. %() expansions are done at
894
800
disable_initiator_tag: a GLib event source tag, or None
895
801
enabled: bool()
896
802
fingerprint: string (40 or 32 hexadecimal digits); used to
897
uniquely identify an OpenPGP client
898
key_id: string (64 hexadecimal digits); used to uniquely identify
899
a client using raw public keys
803
uniquely identify the client
900
804
host: string; available for use by the checker command
901
805
interval: datetime.timedelta(); How often to start a new checker
902
806
last_approval_request: datetime.datetime(); (UTC) or None
920
824
"""
921
825
922
826
runtime_expansions = ("approval_delay", "approval_duration",
923
"created", "enabled", "expires", "key_id",
827
"created", "enabled", "expires",
924
828
"fingerprint", "host", "interval",
925
829
"last_approval_request", "last_checked_ok",
926
830
"last_enabled", "name", "timeout")
956
860
client["enabled"] = config.getboolean(client_name,
957
861
"enabled")
958
862
959
# Uppercase and remove spaces from key_id and fingerprint
960
# for later comparison purposes with return value from the
961
# key_id() and fingerprint() functions
962
client["key_id"] = (section.get("key_id", "").upper()
963
.replace(" ", ""))
863
# Uppercase and remove spaces from fingerprint for later
864
# comparison purposes with return value from the
865
# fingerprint() function
964
866
client["fingerprint"] = (section["fingerprint"].upper()
965
867
.replace(" ", ""))
966
868
if "secret" in section:
1009
911
self.last_enabled = None
1010
912
self.expires = None
1011
913
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
914
logger.debug("Creating client %r", self.name)
915
logger.debug(" Fingerprint: %s", self.fingerprint)
1015
916
self.created = settings.get("created",
1016
917
datetime.datetime.utcnow())
1017
918
1056
957
if not getattr(self, "enabled", False):
1057
958
return False
1058
959
if not quiet:
1059
log.info("Disabling client %s", self.name)
960
logger.info("Disabling client %s", self.name)
1060
961
if getattr(self, "disable_initiator_tag", None) is not None:
1061
962
GLib.source_remove(self.disable_initiator_tag)
1062
963
self.disable_initiator_tag = None
1080
981
if self.checker_initiator_tag is not None:
1081
982
GLib.source_remove(self.checker_initiator_tag)
1082
983
self.checker_initiator_tag = GLib.timeout_add(
1083
random.randrange(int(self.interval.total_seconds() * 1000
1084
+ 1)),
984
int(self.interval.total_seconds() * 1000),
1085
985
self.start_checker)
1086
986
# Schedule a disable() when 'timeout' has passed
1087
987
if self.disable_initiator_tag is not None:
1094
994
def checker_callback(self, source, condition, connection,
1095
995
command):
1096
996
"""The checker has completed, so take appropriate actions."""
997
self.checker_callback_tag = None
998
self.checker = None
1097
999
# Read return code from connection (see call_pipe)
1098
1000
returncode = connection.recv()
1099
1001
connection.close()
1100
if self.checker is not None:
1101
self.checker.join()
1102
self.checker_callback_tag = None
1103
self.checker = None
1104
1002
1105
1003
if returncode >= 0:
1106
1004
self.last_checker_status = returncode
1107
1005
self.last_checker_signal = None
1108
1006
if self.last_checker_status == 0:
1109
log.info("Checker for %(name)s succeeded", vars(self))
1007
logger.info("Checker for %(name)s succeeded",
1008
vars(self))
1110
1009
self.checked_ok()
1111
1010
else:
1112
log.info("Checker for %(name)s failed", vars(self))
1011
logger.info("Checker for %(name)s failed", vars(self))
1113
1012
else:
1114
1013
self.last_checker_status = -1
1115
1014
self.last_checker_signal = -returncode
1116
log.warning("Checker for %(name)s crashed?", vars(self))
1015
logger.warning("Checker for %(name)s crashed?",
1016
vars(self))
1117
1017
return False
1118
1018
1119
1019
def checked_ok(self):
1153
1053
# should be.
1154
1054
1155
1055
if self.checker is not None and not self.checker.is_alive():
1156
log.warning("Checker was not alive; joining")
1056
logger.warning("Checker was not alive; joining")
1157
1057
self.checker.join()
1158
1058
self.checker = None
1159
1059
# Start a new checker if needed
1160
1060
if self.checker is None:
1161
1061
# Escape attributes for the shell
1162
1062
escaped_attrs = {
1163
attr: shlex.quote(str(getattr(self, attr)))
1063
attr: re.escape(str(getattr(self, attr)))
1164
1064
for attr in self.runtime_expansions}
1165
1065
try:
1166
1066
command = self.checker_command % escaped_attrs
1167
1067
except TypeError as error:
1168
log.error('Could not format string "%s"',
1169
self.checker_command, exc_info=error)
1068
logger.error('Could not format string "%s"',
1069
self.checker_command,
1070
exc_info=error)
1170
1071
return True # Try again later
1171
1072
self.current_checker_command = command
1172
log.info("Starting checker %r for %s", command, self.name)
1073
logger.info("Starting checker %r for %s", command,
1074
self.name)
1173
1075
# We don't need to redirect stdout and stderr, since
1174
1076
# in normal mode, that is already done by daemon(),
1175
1077
# and in debug mode we don't want to. (Stdin is
1191
1093
kwargs=popen_args)
1192
1094
self.checker.start()
1193
1095
self.checker_callback_tag = GLib.io_add_watch(
1194
GLib.IOChannel.unix_new(pipe[0].fileno()),
1195
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1096
pipe[0].fileno(), GLib.IO_IN,
1196
1097
self.checker_callback, pipe[0], command)
1197
1098
# Re-run this periodically if run by GLib.timeout_add
1198
1099
return True
1204
1105
self.checker_callback_tag = None
1205
1106
if getattr(self, "checker", None) is None:
1206
1107
return
1207
log.debug("Stopping checker for %(name)s", vars(self))
1108
logger.debug("Stopping checker for %(name)s", vars(self))
1208
1109
self.checker.terminate()
1209
1110
self.checker = None
1210
1111
1237
1138
func._dbus_name = func.__name__
1238
1139
if func._dbus_name.endswith("_dbus_property"):
1239
1140
func._dbus_name = func._dbus_name[:-14]
1240
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1141
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1241
1142
return func
1242
1143
1243
1144
return decorator
1332
1233
1333
1234
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1334
1235
out_signature="s",
1335
path_keyword="object_path",
1336
connection_keyword="connection")
1236
path_keyword='object_path',
1237
connection_keyword='connection')
1337
1238
def Introspect(self, object_path, connection):
1338
1239
"""Overloading of standard D-Bus method.
1339
1240
1388
1289
document.unlink()
1389
1290
except (AttributeError, xml.dom.DOMException,
1390
1291
xml.parsers.expat.ExpatError) as error:
1391
log.error("Failed to override Introspection method",
1392
exc_info=error)
1292
logger.error("Failed to override Introspection method",
1293
exc_info=error)
1393
1294
return xmlstring
1394
1295
1395
1296
1453
1354
raise ValueError("Byte arrays not supported for non-"
1454
1355
"'ay' signature {!r}"
1455
1356
.format(prop._dbus_signature))
1456
value = dbus.ByteArray(bytes(value))
1357
value = dbus.ByteArray(b''.join(chr(byte)
1358
for byte in value))
1457
1359
prop(value)
1458
1360
1459
1361
@dbus.service.method(dbus.PROPERTIES_IFACE,
1492
1394
1493
1395
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1494
1396
out_signature="s",
1495
path_keyword="object_path",
1496
connection_keyword="connection")
1397
path_keyword='object_path',
1398
connection_keyword='connection')
1497
1399
def Introspect(self, object_path, connection):
1498
1400
"""Overloading of standard D-Bus method.
1499
1401
1555
1457
document.unlink()
1556
1458
except (AttributeError, xml.dom.DOMException,
1557
1459
xml.parsers.expat.ExpatError) as error:
1558
log.error("Failed to override Introspection method",
1559
exc_info=error)
1460
logger.error("Failed to override Introspection method",
1461
exc_info=error)
1560
1462
return xmlstring
1561
1463
1562
1464
1594
1496
1595
1497
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1596
1498
out_signature="s",
1597
path_keyword="object_path",
1598
connection_keyword="connection")
1499
path_keyword='object_path',
1500
connection_keyword='connection')
1599
1501
def Introspect(self, object_path, connection):
1600
1502
"""Overloading of standard D-Bus method.
1601
1503
1626
1528
document.unlink()
1627
1529
except (AttributeError, xml.dom.DOMException,
1628
1530
xml.parsers.expat.ExpatError) as error:
1629
log.error("Failed to override Introspection method",
1630
exc_info=error)
1531
logger.error("Failed to override Introspection method",
1532
exc_info=error)
1631
1533
return xmlstring
1632
1534
1633
1535
2097
1999
def Name_dbus_property(self):
2098
2000
return dbus.String(self.name)
2099
2001
2100
# KeyID - property
2101
@dbus_annotations(
2102
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2103
@dbus_service_property(_interface, signature="s", access="read")
2104
def KeyID_dbus_property(self):
2105
return dbus.String(self.key_id)
2106
2107
2002
# Fingerprint - property
2108
2003
@dbus_annotations(
2109
2004
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2264
2159
del _interface
2265
2160
2266
2161
2267
class ProxyClient:
2268
def __init__(self, child_pipe, key_id, fpr, address):
2162
class ProxyClient(object):
2163
def __init__(self, child_pipe, fpr, address):
2269
2164
self._pipe = child_pipe
2270
self._pipe.send(("init", key_id, fpr, address))
2165
self._pipe.send(('init', fpr, address))
2271
2166
if not self._pipe.recv():
2272
raise KeyError(key_id or fpr)
2167
raise KeyError(fpr)
2273
2168
2274
2169
def __getattribute__(self, name):
2275
if name == "_pipe":
2170
if name == '_pipe':
2276
2171
return super(ProxyClient, self).__getattribute__(name)
2277
self._pipe.send(("getattr", name))
2172
self._pipe.send(('getattr', name))
2278
2173
data = self._pipe.recv()
2279
if data[0] == "data":
2174
if data[0] == 'data':
2280
2175
return data[1]
2281
if data[0] == "function":
2176
if data[0] == 'function':
2282
2177
2283
2178
def func(*args, **kwargs):
2284
self._pipe.send(("funcall", name, args, kwargs))
2179
self._pipe.send(('funcall', name, args, kwargs))
2285
2180
return self._pipe.recv()[1]
2286
2181
2287
2182
return func
2288
2183
2289
2184
def __setattr__(self, name, value):
2290
if name == "_pipe":
2185
if name == '_pipe':
2291
2186
return super(ProxyClient, self).__setattr__(name, value)
2292
self._pipe.send(("setattr", name, value))
2187
self._pipe.send(('setattr', name, value))
2293
2188
2294
2189
2295
2190
class ClientHandler(socketserver.BaseRequestHandler, object):
2300
2195
2301
2196
def handle(self):
2302
2197
with contextlib.closing(self.server.child_pipe) as child_pipe:
2303
log.info("TCP connection from: %s",
2304
str(self.client_address))
2305
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2198
logger.info("TCP connection from: %s",
2199
str(self.client_address))
2200
logger.debug("Pipe FD: %d",
2201
self.server.child_pipe.fileno())
2306
2202
2307
2203
session = gnutls.ClientSession(self.request)
2308
2204
2309
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2205
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2310
2206
# "+AES-256-CBC", "+SHA1",
2311
2207
# "+COMP-NULL", "+CTYPE-OPENPGP",
2312
2208
# "+DHE-DSS"))
2314
2210
priority = self.server.gnutls_priority
2315
2211
if priority is None:
2316
2212
priority = "NORMAL"
2317
gnutls.priority_set_direct(session,
2318
priority.encode("utf-8"), None)
2213
gnutls.priority_set_direct(session._c_object,
2214
priority.encode("utf-8"),
2215
None)
2319
2216
2320
2217
# Start communication using the Mandos protocol
2321
2218
# Get protocol number
2322
2219
line = self.request.makefile().readline()
2323
log.debug("Protocol version: %r", line)
2220
logger.debug("Protocol version: %r", line)
2324
2221
try:
2325
2222
if int(line.strip().split()[0]) > 1:
2326
2223
raise RuntimeError(line)
2327
2224
except (ValueError, IndexError, RuntimeError) as error:
2328
log.error("Unknown protocol version: %s", error)
2225
logger.error("Unknown protocol version: %s", error)
2329
2226
return
2330
2227
2331
2228
# Start GnuTLS connection
2332
2229
try:
2333
2230
session.handshake()
2334
2231
except gnutls.Error as error:
2335
log.warning("Handshake failed: %s", error)
2232
logger.warning("Handshake failed: %s", error)
2336
2233
# Do not run session.bye() here: the session is not
2337
2234
# established. Just abandon the request.
2338
2235
return
2339
log.debug("Handshake succeeded")
2236
logger.debug("Handshake succeeded")
2340
2237
2341
2238
approval_required = False
2342
2239
try:
2343
if gnutls.has_rawpk:
2344
fpr = b""
2345
try:
2346
key_id = self.key_id(
2347
self.peer_certificate(session))
2348
except (TypeError, gnutls.Error) as error:
2349
log.warning("Bad certificate: %s", error)
2350
return
2351
log.debug("Key ID: %s",
2352
key_id.decode("utf-8",
2353
errors="replace"))
2354
2355
else:
2356
key_id = b""
2357
try:
2358
fpr = self.fingerprint(
2359
self.peer_certificate(session))
2360
except (TypeError, gnutls.Error) as error:
2361
log.warning("Bad certificate: %s", error)
2362
return
2363
log.debug("Fingerprint: %s", fpr)
2364
2365
try:
2366
client = ProxyClient(child_pipe, key_id, fpr,
2240
try:
2241
fpr = self.fingerprint(
2242
self.peer_certificate(session))
2243
except (TypeError, gnutls.Error) as error:
2244
logger.warning("Bad certificate: %s", error)
2245
return
2246
logger.debug("Fingerprint: %s", fpr)
2247
2248
try:
2249
client = ProxyClient(child_pipe, fpr,
2367
2250
self.client_address)
2368
2251
except KeyError:
2369
2252
return
2375
2258
2376
2259
while True:
2377
2260
if not client.enabled:
2378
log.info("Client %s is disabled", client.name)
2261
logger.info("Client %s is disabled",
2262
client.name)
2379
2263
if self.server.use_dbus:
2380
2264
# Emit D-Bus signal
2381
2265
client.Rejected("Disabled")
2385
2269
# We are approved or approval is disabled
2386
2270
break
2387
2271
elif client.approved is None:
2388
log.info("Client %s needs approval",
2389
client.name)
2272
logger.info("Client %s needs approval",
2273
client.name)
2390
2274
if self.server.use_dbus:
2391
2275
# Emit D-Bus signal
2392
2276
client.NeedApproval(
2393
2277
client.approval_delay.total_seconds()
2394
2278
* 1000, client.approved_by_default)
2395
2279
else:
2396
log.warning("Client %s was not approved",
2397
client.name)
2280
logger.warning("Client %s was not approved",
2281
client.name)
2398
2282
if self.server.use_dbus:
2399
2283
# Emit D-Bus signal
2400
2284
client.Rejected("Denied")
2408
2292
time2 = datetime.datetime.now()
2409
2293
if (time2 - time) >= delay:
2410
2294
if not client.approved_by_default:
2411
log.warning("Client %s timed out while"
2412
" waiting for approval",
2413
client.name)
2295
logger.warning("Client %s timed out while"
2296
" waiting for approval",
2297
client.name)
2414
2298
if self.server.use_dbus:
2415
2299
# Emit D-Bus signal
2416
2300
client.Rejected("Approval timed out")
2423
2307
try:
2424
2308
session.send(client.secret)
2425
2309
except gnutls.Error as error:
2426
log.warning("gnutls send failed", exc_info=error)
2310
logger.warning("gnutls send failed",
2311
exc_info=error)
2427
2312
return
2428
2313
2429
log.info("Sending secret to %s", client.name)
2314
logger.info("Sending secret to %s", client.name)
2430
2315
# bump the timeout using extended_timeout
2431
2316
client.bump_timeout(client.extended_timeout)
2432
2317
if self.server.use_dbus:
2439
2324
try:
2440
2325
session.bye()
2441
2326
except gnutls.Error as error:
2442
log.warning("GnuTLS bye failed", exc_info=error)
2327
logger.warning("GnuTLS bye failed",
2328
exc_info=error)
2443
2329
2444
2330
@staticmethod
2445
2331
def peer_certificate(session):
2446
"Return the peer's certificate as a bytestring"
2447
try:
2448
cert_type = gnutls.certificate_type_get2(
2449
session, gnutls.CTYPE_PEERS)
2450
except AttributeError:
2451
cert_type = gnutls.certificate_type_get(session)
2452
if gnutls.has_rawpk:
2453
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2454
else:
2455
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2456
# If not a valid certificate type...
2457
if cert_type not in valid_cert_types:
2458
log.info("Cert type %r not in %r", cert_type,
2459
valid_cert_types)
2332
"Return the peer's OpenPGP certificate as a bytestring"
2333
# If not an OpenPGP certificate...
2334
if (gnutls.certificate_type_get(session._c_object)
2335
!= gnutls.CRT_OPENPGP):
2460
2336
# ...return invalid data
2461
2337
return b""
2462
2338
list_size = ctypes.c_uint(1)
2463
2339
cert_list = (gnutls.certificate_get_peers
2464
(session, ctypes.byref(list_size)))
2340
(session._c_object, ctypes.byref(list_size)))
2465
2341
if not bool(cert_list) and list_size.value != 0:
2466
2342
raise gnutls.Error("error getting peer certificate")
2467
2343
if list_size.value == 0:
2470
2346
return ctypes.string_at(cert.data, cert.size)
2471
2347
2472
2348
@staticmethod
2473
def key_id(certificate):
2474
"Convert a certificate bytestring to a hexdigit key ID"
2475
# New GnuTLS "datum" with the public key
2476
datum = gnutls.datum_t(
2477
ctypes.cast(ctypes.c_char_p(certificate),
2478
ctypes.POINTER(ctypes.c_ubyte)),
2479
ctypes.c_uint(len(certificate)))
2480
# XXX all these need to be created in the gnutls "module"
2481
# New empty GnuTLS certificate
2482
pubkey = gnutls.pubkey_t()
2483
gnutls.pubkey_init(ctypes.byref(pubkey))
2484
# Import the raw public key into the certificate
2485
gnutls.pubkey_import(pubkey,
2486
ctypes.byref(datum),
2487
gnutls.X509_FMT_DER)
2488
# New buffer for the key ID
2489
buf = ctypes.create_string_buffer(32)
2490
buf_len = ctypes.c_size_t(len(buf))
2491
# Get the key ID from the raw public key into the buffer
2492
gnutls.pubkey_get_key_id(
2493
pubkey,
2494
gnutls.KEYID_USE_SHA256,
2495
ctypes.cast(ctypes.byref(buf),
2496
ctypes.POINTER(ctypes.c_ubyte)),
2497
ctypes.byref(buf_len))
2498
# Deinit the certificate
2499
gnutls.pubkey_deinit(pubkey)
2500
2501
# Convert the buffer to a Python bytestring
2502
key_id = ctypes.string_at(buf, buf_len.value)
2503
# Convert the bytestring to hexadecimal notation
2504
hex_key_id = binascii.hexlify(key_id).upper()
2505
return hex_key_id
2506
2507
@staticmethod
2508
2349
def fingerprint(openpgp):
2509
2350
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2510
2351
# New GnuTLS "datum" with the OpenPGP public key
2541
2382
return hex_fpr
2542
2383
2543
2384
2544
class MultiprocessingMixIn:
2385
class MultiprocessingMixIn(object):
2545
2386
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2546
2387
2547
2388
def sub_process_main(self, request, address):
2559
2400
return proc
2560
2401
2561
2402
2562
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2403
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2563
2404
""" adds a pipe to the MixIn """
2564
2405
2565
2406
def process_request(self, request, client_address):
2580
2421
2581
2422
2582
2423
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2583
socketserver.TCPServer):
2584
"""IPv6-capable TCP server. Accepts None as address and/or port
2424
socketserver.TCPServer, object):
2425
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2585
2426
2586
2427
Attributes:
2587
2428
enabled: Boolean; whether this server is activated yet
2638
2479
if SO_BINDTODEVICE is None:
2639
2480
# Fall back to a hard-coded value which seems to be
2640
2481
# common enough.
2641
log.warning("SO_BINDTODEVICE not found, trying 25")
2482
logger.warning("SO_BINDTODEVICE not found, trying 25")
2642
2483
SO_BINDTODEVICE = 25
2643
2484
try:
2644
2485
self.socket.setsockopt(
2646
2487
(self.interface + "\0").encode("utf-8"))
2647
2488
except socket.error as error:
2648
2489
if error.errno == errno.EPERM:
2649
log.error("No permission to bind to interface %s",
2650
self.interface)
2490
logger.error("No permission to bind to"
2491
" interface %s", self.interface)
2651
2492
elif error.errno == errno.ENOPROTOOPT:
2652
log.error("SO_BINDTODEVICE not available; cannot"
2653
" bind to interface %s", self.interface)
2493
logger.error("SO_BINDTODEVICE not available;"
2494
" cannot bind to interface %s",
2495
self.interface)
2654
2496
elif error.errno == errno.ENODEV:
2655
log.error("Interface %s does not exist, cannot"
2656
" bind", self.interface)
2497
logger.error("Interface %s does not exist,"
2498
" cannot bind", self.interface)
2657
2499
else:
2658
2500
raise
2659
2501
# Only bind(2) the socket if we really need to.
2660
2502
if self.server_address[0] or self.server_address[1]:
2661
if self.server_address[1]:
2662
self.allow_reuse_address = True
2663
2503
if not self.server_address[0]:
2664
2504
if self.address_family == socket.AF_INET6:
2665
2505
any_address = "::" # in6addr_any
2718
2558
def add_pipe(self, parent_pipe, proc):
2719
2559
# Call "handle_ipc" for both data and EOF events
2720
2560
GLib.io_add_watch(
2721
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2722
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2561
parent_pipe.fileno(),
2562
GLib.IO_IN | GLib.IO_HUP,
2723
2563
functools.partial(self.handle_ipc,
2724
2564
parent_pipe=parent_pipe,
2725
2565
proc=proc))
2738
2578
request = parent_pipe.recv()
2739
2579
command = request[0]
2740
2580
2741
if command == "init":
2742
key_id = request[1].decode("ascii")
2743
fpr = request[2].decode("ascii")
2744
address = request[3]
2581
if command == 'init':
2582
fpr = request[1].decode("ascii")
2583
address = request[2]
2745
2584
2746
2585
for c in self.clients.values():
2747
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2748
"27AE41E4649B934CA495991B7852B855"):
2749
continue
2750
if key_id and c.key_id == key_id:
2751
client = c
2752
break
2753
if fpr and c.fingerprint == fpr:
2586
if c.fingerprint == fpr:
2754
2587
client = c
2755
2588
break
2756
2589
else:
2757
log.info("Client not found for key ID: %s, address:"
2758
" %s", key_id or fpr, address)
2590
logger.info("Client not found for fingerprint: %s, ad"
2591
"dress: %s", fpr, address)
2759
2592
if self.use_dbus:
2760
2593
# Emit D-Bus signal
2761
mandos_dbus_service.ClientNotFound(key_id or fpr,
2594
mandos_dbus_service.ClientNotFound(fpr,
2762
2595
address[0])
2763
2596
parent_pipe.send(False)
2764
2597
return False
2765
2598
2766
2599
GLib.io_add_watch(
2767
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2768
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2600
parent_pipe.fileno(),
2601
GLib.IO_IN | GLib.IO_HUP,
2769
2602
functools.partial(self.handle_ipc,
2770
2603
parent_pipe=parent_pipe,
2771
2604
proc=proc,
2774
2607
# remove the old hook in favor of the new above hook on
2775
2608
# same fileno
2776
2609
return False
2777
if command == "funcall":
2610
if command == 'funcall':
2778
2611
funcname = request[1]
2779
2612
args = request[2]
2780
2613
kwargs = request[3]
2781
2614
2782
parent_pipe.send(("data", getattr(client_object,
2615
parent_pipe.send(('data', getattr(client_object,
2783
2616
funcname)(*args,
2784
2617
**kwargs)))
2785
2618
2786
if command == "getattr":
2619
if command == 'getattr':
2787
2620
attrname = request[1]
2788
2621
if isinstance(client_object.__getattribute__(attrname),
2789
collections.abc.Callable):
2790
parent_pipe.send(("function", ))
2622
collections.Callable):
2623
parent_pipe.send(('function', ))
2791
2624
else:
2792
2625
parent_pipe.send((
2793
"data", client_object.__getattribute__(attrname)))
2626
'data', client_object.__getattribute__(attrname)))
2794
2627
2795
if command == "setattr":
2628
if command == 'setattr':
2796
2629
attrname = request[1]
2797
2630
value = request[2]
2798
2631
setattr(client_object, attrname, value)
2803
2636
def rfc3339_duration_to_delta(duration):
2804
2637
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2805
2638
2806
>>> timedelta = datetime.timedelta
2807
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2808
True
2809
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2810
True
2811
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2812
True
2813
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2814
True
2815
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2816
True
2817
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2818
True
2819
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2820
True
2821
>>> del timedelta
2639
>>> rfc3339_duration_to_delta("P7D")
2640
datetime.timedelta(7)
2641
>>> rfc3339_duration_to_delta("PT60S")
2642
datetime.timedelta(0, 60)
2643
>>> rfc3339_duration_to_delta("PT60M")
2644
datetime.timedelta(0, 3600)
2645
>>> rfc3339_duration_to_delta("PT24H")
2646
datetime.timedelta(1)
2647
>>> rfc3339_duration_to_delta("P1W")
2648
datetime.timedelta(7)
2649
>>> rfc3339_duration_to_delta("PT5M30S")
2650
datetime.timedelta(0, 330)
2651
>>> rfc3339_duration_to_delta("P1DT3M20S")
2652
datetime.timedelta(1, 200)
2822
2653
"""
2823
2654
2824
2655
# Parsing an RFC 3339 duration with regular expressions is not
2904
2735
def string_to_delta(interval):
2905
2736
"""Parse a string and return a datetime.timedelta
2906
2737
2907
>>> string_to_delta("7d") == datetime.timedelta(7)
2908
True
2909
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2910
True
2911
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2912
True
2913
>>> string_to_delta("24h") == datetime.timedelta(1)
2914
True
2915
>>> string_to_delta("1w") == datetime.timedelta(7)
2916
True
2917
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2918
True
2738
>>> string_to_delta('7d')
2739
datetime.timedelta(7)
2740
>>> string_to_delta('60s')
2741
datetime.timedelta(0, 60)
2742
>>> string_to_delta('60m')
2743
datetime.timedelta(0, 3600)
2744
>>> string_to_delta('24h')
2745
datetime.timedelta(1)
2746
>>> string_to_delta('1w')
2747
datetime.timedelta(7)
2748
>>> string_to_delta('5m 30s')
2749
datetime.timedelta(0, 330)
2919
2750
"""
2920
2751
2921
2752
try:
3023
2854
3024
2855
options = parser.parse_args()
3025
2856
2857
if options.check:
2858
import doctest
2859
fail_count, test_count = doctest.testmod()
2860
sys.exit(os.EX_OK if fail_count == 0 else 1)
2861
3026
2862
# Default values for config file for server-global settings
3027
if gnutls.has_rawpk:
3028
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3029
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3030
else:
3031
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3032
":+SIGN-DSA-SHA256")
3033
2863
server_defaults = {"interface": "",
3034
2864
"address": "",
3035
2865
"port": "",
3036
2866
"debug": "False",
3037
"priority": priority,
2867
"priority":
2868
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2869
":+SIGN-DSA-SHA256",
3038
2870
"servicename": "Mandos",
3039
2871
"use_dbus": "True",
3040
2872
"use_ipv6": "True",
3045
2877
"foreground": "False",
3046
2878
"zeroconf": "True",
3047
2879
}
3048
del priority
3049
2880
3050
2881
# Parse config file for server-global settings
3051
server_config = configparser.ConfigParser(server_defaults)
2882
server_config = configparser.SafeConfigParser(server_defaults)
3052
2883
del server_defaults
3053
2884
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3054
# Convert the ConfigParser object to a dict
2885
# Convert the SafeConfigParser object to a dict
3055
2886
server_settings = server_config.defaults()
3056
2887
# Use the appropriate methods on the non-string config options
3057
2888
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3124
2955
3125
2956
if server_settings["servicename"] != "Mandos":
3126
2957
syslogger.setFormatter(
3127
logging.Formatter("Mandos ({}) [%(process)d]:"
3128
" %(levelname)s: %(message)s".format(
2958
logging.Formatter('Mandos ({}) [%(process)d]:'
2959
' %(levelname)s: %(message)s'.format(
3129
2960
server_settings["servicename"])))
3130
2961
3131
2962
# Parse config file with clients
3132
client_config = configparser.ConfigParser(Client.client_defaults)
2963
client_config = configparser.SafeConfigParser(Client
2964
.client_defaults)
3133
2965
client_config.read(os.path.join(server_settings["configdir"],
3134
2966
"clients.conf"))
3135
2967
3155
2987
try:
3156
2988
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3157
2989
except IOError as e:
3158
log.error("Could not open file %r", pidfilename,
3159
exc_info=e)
2990
logger.error("Could not open file %r", pidfilename,
2991
exc_info=e)
3160
2992
3161
2993
for name, group in (("_mandos", "_mandos"),
3162
2994
("mandos", "mandos"),
3173
3005
try:
3174
3006
os.setgid(gid)
3175
3007
os.setuid(uid)
3176
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3008
if debug:
3009
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3010
gid))
3177
3011
except OSError as error:
3178
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3179
os.strerror(error.errno))
3012
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3013
.format(uid, gid, os.strerror(error.errno)))
3180
3014
if error.errno != errno.EPERM:
3181
3015
raise
3182
3016
3189
3023
3190
3024
@gnutls.log_func
3191
3025
def debug_gnutls(level, string):
3192
log.debug("GnuTLS: %s",
3193
string[:-1].decode("utf-8", errors="replace"))
3026
logger.debug("GnuTLS: %s", string[:-1])
3194
3027
3195
3028
gnutls.global_set_log_function(debug_gnutls)
3196
3029
3205
3038
# Close all input and output, do double fork, etc.
3206
3039
daemon()
3207
3040
3208
if gi.version_info < (3, 10, 2):
3209
# multiprocessing will use threads, so before we use GLib we
3210
# need to inform GLib that threads will be used.
3211
GLib.threads_init()
3041
# multiprocessing will use threads, so before we use GLib we need
3042
# to inform GLib that threads will be used.
3043
GLib.threads_init()
3212
3044
3213
3045
global main_loop
3214
3046
# From the Avahi example code
3225
3057
"se.bsnet.fukt.Mandos", bus,
3226
3058
do_not_queue=True)
3227
3059
except dbus.exceptions.DBusException as e:
3228
log.error("Disabling D-Bus:", exc_info=e)
3060
logger.error("Disabling D-Bus:", exc_info=e)
3229
3061
use_dbus = False
3230
3062
server_settings["use_dbus"] = False
3231
3063
tcp_server.use_dbus = False
3290
3122
if isinstance(s, bytes)
3291
3123
else s) for s in
3292
3124
value["client_structure"]]
3293
# .name, .host, and .checker_command
3294
for k in ("name", "host", "checker_command"):
3125
# .name & .host
3126
for k in ("name", "host"):
3295
3127
if isinstance(value[k], bytes):
3296
3128
value[k] = value[k].decode("utf-8")
3297
if "key_id" not in value:
3298
value["key_id"] = ""
3299
elif "fingerprint" not in value:
3300
value["fingerprint"] = ""
3301
3129
# old_client_settings
3302
3130
# .keys()
3303
3131
old_client_settings = {
3307
3135
for key, value in
3308
3136
bytes_old_client_settings.items()}
3309
3137
del bytes_old_client_settings
3310
# .host and .checker_command
3138
# .host
3311
3139
for value in old_client_settings.values():
3312
for attribute in ("host", "checker_command"):
3313
if isinstance(value[attribute], bytes):
3314
value[attribute] = (value[attribute]
3315
.decode("utf-8"))
3140
if isinstance(value["host"], bytes):
3141
value["host"] = (value["host"]
3142
.decode("utf-8"))
3316
3143
os.remove(stored_state_path)
3317
3144
except IOError as e:
3318
3145
if e.errno == errno.ENOENT:
3319
log.warning("Could not load persistent state:"
3320
" %s", os.strerror(e.errno))
3146
logger.warning("Could not load persistent state:"
3147
" {}".format(os.strerror(e.errno)))
3321
3148
else:
3322
log.critical("Could not load persistent state:",
3323
exc_info=e)
3149
logger.critical("Could not load persistent state:",
3150
exc_info=e)
3324
3151
raise
3325
3152
except EOFError as e:
3326
log.warning("Could not load persistent state: EOFError:",
3327
exc_info=e)
3153
logger.warning("Could not load persistent state: "
3154
"EOFError:",
3155
exc_info=e)
3328
3156
3329
3157
with PGPEngine() as pgp:
3330
3158
for client_name, client in clients_data.items():
3357
3185
if client["enabled"]:
3358
3186
if datetime.datetime.utcnow() >= client["expires"]:
3359
3187
if not client["last_checked_ok"]:
3360
log.warning("disabling client %s - Client"
3361
" never performed a successful"
3362
" checker", client_name)
3188
logger.warning(
3189
"disabling client {} - Client never "
3190
"performed a successful checker".format(
3191
client_name))
3363
3192
client["enabled"] = False
3364
3193
elif client["last_checker_status"] != 0:
3365
log.warning("disabling client %s - Client"
3366
" last checker failed with error"
3367
" code %s", client_name,
3368
client["last_checker_status"])
3194
logger.warning(
3195
"disabling client {} - Client last"
3196
" checker failed with error code"
3197
" {}".format(
3198
client_name,
3199
client["last_checker_status"]))
3369
3200
client["enabled"] = False
3370
3201
else:
3371
3202
client["expires"] = (
3372
3203
datetime.datetime.utcnow()
3373
3204
+ client["timeout"])
3374
log.debug("Last checker succeeded, keeping %s"
3375
" enabled", client_name)
3205
logger.debug("Last checker succeeded,"
3206
" keeping {} enabled".format(
3207
client_name))
3376
3208
try:
3377
3209
client["secret"] = pgp.decrypt(
3378
3210
client["encrypted_secret"],
3379
3211
client_settings[client_name]["secret"])
3380
3212
except PGPError:
3381
3213
# If decryption fails, we use secret from new settings
3382
log.debug("Failed to decrypt %s old secret",
3383
client_name)
3214
logger.debug("Failed to decrypt {} old secret".format(
3215
client_name))
3384
3216
client["secret"] = (client_settings[client_name]
3385
3217
["secret"])
3386
3218
3400
3232
server_settings=server_settings)
3401
3233
3402
3234
if not tcp_server.clients:
3403
log.warning("No clients defined")
3235
logger.warning("No clients defined")
3404
3236
3405
3237
if not foreground:
3406
3238
if pidfile is not None:
3409
3241
with pidfile:
3410
3242
print(pid, file=pidfile)
3411
3243
except IOError:
3412
log.error("Could not write to file %r with PID %d",
3413
pidfilename, pid)
3244
logger.error("Could not write to file %r with PID %d",
3245
pidfilename, pid)
3414
3246
del pidfile
3415
3247
del pidfilename
3416
3248
3436
3268
pass
3437
3269
3438
3270
@dbus.service.signal(_interface, signature="ss")
3439
def ClientNotFound(self, key_id, address):
3271
def ClientNotFound(self, fingerprint, address):
3440
3272
"D-Bus signal"
3441
3273
pass
3442
3274
3566
3398
3567
3399
try:
3568
3400
with tempfile.NamedTemporaryFile(
3569
mode="wb",
3401
mode='wb',
3570
3402
suffix=".pickle",
3571
prefix="clients-",
3403
prefix='clients-',
3572
3404
dir=os.path.dirname(stored_state_path),
3573
3405
delete=False) as stored_state:
3574
3406
pickle.dump((clients, client_settings), stored_state,
3582
3414
except NameError:
3583
3415
pass
3584
3416
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3585
log.warning("Could not save persistent state: %s",
3586
os.strerror(e.errno))
3417
logger.warning("Could not save persistent state: {}"
3418
.format(os.strerror(e.errno)))
3587
3419
else:
3588
log.warning("Could not save persistent state:",
3589
exc_info=e)
3420
logger.warning("Could not save persistent state:",
3421
exc_info=e)
3590
3422
raise
3591
3423
3592
3424
# Delete all clients, and settings from config
3618
3450
if zeroconf:
3619
3451
service.port = tcp_server.socket.getsockname()[1]
3620
3452
if use_ipv6:
3621
log.info("Now listening on address %r, port %d, flowinfo %d,"
3622
" scope_id %d", *tcp_server.socket.getsockname())
3453
logger.info("Now listening on address %r, port %d,"
3454
" flowinfo %d, scope_id %d",
3455
*tcp_server.socket.getsockname())
3623
3456
else: # IPv4
3624
log.info("Now listening on address %r, port %d",
3625
*tcp_server.socket.getsockname())
3457
logger.info("Now listening on address %r, port %d",
3458
*tcp_server.socket.getsockname())
3626
3459
3627
3460
# service.interface = tcp_server.socket.getsockname()[3]
3628
3461
3632
3465
try:
3633
3466
service.activate()
3634
3467
except dbus.exceptions.DBusException as error:
3635
log.critical("D-Bus Exception", exc_info=error)
3468
logger.critical("D-Bus Exception", exc_info=error)
3636
3469
cleanup()
3637
3470
sys.exit(1)
3638
3471
# End of Avahi example code
3639
3472
3640
GLib.io_add_watch(
3641
GLib.IOChannel.unix_new(tcp_server.fileno()),
3642
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3643
lambda *args, **kwargs: (tcp_server.handle_request
3644
(*args[2:], **kwargs) or True))
3473
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3474
lambda *args, **kwargs:
3475
(tcp_server.handle_request
3476
(*args[2:], **kwargs) or True))
3645
3477
3646
log.debug("Starting main loop")
3478
logger.debug("Starting main loop")
3647
3479
main_loop.run()
3648
3480
except AvahiError as error:
3649
log.critical("Avahi Error", exc_info=error)
3481
logger.critical("Avahi Error", exc_info=error)
3650
3482
cleanup()
3651
3483
sys.exit(1)
3652
3484
except KeyboardInterrupt:
3653
3485
if debug:
3654
3486
print("", file=sys.stderr)
3655
log.debug("Server received KeyboardInterrupt")
3656
log.debug("Server exiting")
3487
logger.debug("Server received KeyboardInterrupt")
3488
logger.debug("Server exiting")
3657
3489
# Must run before the D-Bus bus name gets deregistered
3658
3490
cleanup()
3659
3491
3660
3661
def parse_test_args():
3662
# type: () -> argparse.Namespace
3663
parser = argparse.ArgumentParser(add_help=False)
3664
parser.add_argument("--check", action="store_true")
3665
parser.add_argument("--prefix", )
3666
args, unknown_args = parser.parse_known_args()
3667
if args.check:
3668
# Remove test options from sys.argv
3669
sys.argv[1:] = unknown_args
3670
return args
3671
3672
# Add all tests from doctest strings
3673
def load_tests(loader, tests, none):
3674
import doctest
3675
tests.addTests(doctest.DocTestSuite())
3676
return tests
3677
3678
if __name__ == "__main__":
3679
options = parse_test_args()
3680
try:
3681
if options.check:
3682
extra_test_prefix = options.prefix
3683
if extra_test_prefix is not None:
3684
if not (unittest.main(argv=[""], exit=False)
3685
.result.wasSuccessful()):
3686
sys.exit(1)
3687
class ExtraTestLoader(unittest.TestLoader):
3688
testMethodPrefix = extra_test_prefix
3689
# Call using ./scriptname --test [--verbose]
3690
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3691
else:
3692
unittest.main(argv=[""])
3693
else:
3694
main()
3695
finally:
3696
logging.shutdown()
3697
3698
# Local Variables:
3699
# run-tests:
3700
# (lambda (&optional extra)
3701
# (if (not (funcall run-tests-in-test-buffer default-directory
3702
# extra))
3703
# (funcall show-test-buffer-in-test-window)
3704
# (funcall remove-test-window)
3705
# (if extra (message "Extra tests run successfully!"))))
3706
# run-tests-in-test-buffer:
3707
# (lambda (dir &optional extra)
3708
# (with-current-buffer (get-buffer-create "*Test*")
3709
# (setq buffer-read-only nil
3710
# default-directory dir)
3711
# (erase-buffer)
3712
# (compilation-mode))
3713
# (let ((inhibit-read-only t))
3714
# (= (process-file-shell-command
3715
# (funcall get-command-line extra)
3716
# nil "*Test*") 0)))
3717
# get-command-line:
3718
# (lambda (&optional extra)
3719
# (let ((quoted-script
3720
# (shell-quote-argument (funcall get-script-name))))
3721
# (format
3722
# (concat "%s --check" (if extra " --prefix=atest" ""))
3723
# quoted-script)))
3724
# get-script-name:
3725
# (lambda ()
3726
# (if (fboundp 'file-local-name)
3727
# (file-local-name (buffer-file-name))
3728
# (or (file-remote-p (buffer-file-name) 'localname)
3729
# (buffer-file-name))))
3730
# remove-test-window:
3731
# (lambda ()
3732
# (let ((test-window (get-buffer-window "*Test*")))
3733
# (if test-window (delete-window test-window))))
3734
# show-test-buffer-in-test-window:
3735
# (lambda ()
3736
# (when (not (get-buffer-window-list "*Test*"))
3737
# (setq next-error-last-buffer (get-buffer "*Test*"))
3738
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3739
# (display-buffer-overriding-action
3740
# `((display-buffer-in-side-window) (side . ,side)
3741
# (window-height . fit-window-to-buffer)
3742
# (window-width . fit-window-to-buffer))))
3743
# (display-buffer "*Test*"))))
3744
# eval:
3745
# (progn
3746
# (let* ((run-extra-tests (lambda () (interactive)
3747
# (funcall run-tests t)))
3748
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3749
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3750
# (setq minor-mode-overriding-map-alist
3751
# (cons `(run-tests . ,outer-keymap)
3752
# minor-mode-overriding-map-alist)))
3753
# (add-hook 'after-save-hook run-tests 90 t))
3754
# End:
3492
3493
if __name__ == '__main__':
3494
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0