/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2019-02-11 05:14:10 UTC
  • Revision ID: teddy@recompile.se-20190211051410-43fmzhy0vlafw2pc
Fix warnings from -Wimplicit-fallthrough

* plugin-runner.c (main/parse_opt): Add __builtin_unreachable() after
                                    calls to argp_state_help().
* plugins.d/askpass-fifo.c (error_plus): Add __builtin_unreachable()
                                         after calls to error().
* plugins.d/mandos-client.c (main/parse_opt) Add
                                             __builtin_unreachable()
                                             after calls to
                                             argp_state_help().
* plugins.d/password-prompt.c: - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
#!/usr/bin/python3 -bI
2
 
# -*- coding: utf-8; lexical-binding: t -*-
 
1
#!/usr/bin/python
 
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
 
# Copyright © 2008-2020 Teddy Hogeborn
15
 
# Copyright © 2008-2020 Björn Påhlsson
 
14
# Copyright © 2008-2019 Teddy Hogeborn
 
15
# Copyright © 2008-2019 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
 
34
 
34
35
from __future__ import (division, absolute_import, print_function,
35
36
                        unicode_literals)
36
37
 
39
40
except ImportError:
40
41
    pass
41
42
 
42
 
import sys
43
 
import unittest
44
 
import argparse
45
 
import logging
46
 
import os
47
43
try:
48
44
    import SocketServer as socketserver
49
45
except ImportError:
50
46
    import socketserver
51
47
import socket
 
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
    import ConfigParser as configparser
56
53
except ImportError:
57
54
    import configparser
 
55
import sys
58
56
import re
 
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
 
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
 
import random
81
 
import shlex
82
80
 
83
81
import dbus
84
82
import dbus.service
85
 
import gi
86
83
from gi.repository import GLib
87
84
from dbus.mainloop.glib import DBusGMainLoop
88
85
import ctypes
90
87
import xml.dom.minidom
91
88
import inspect
92
89
 
93
 
if sys.version_info.major == 2:
94
 
    __metaclass__ = type
95
 
    str = unicode
96
 
    input = raw_input
97
 
 
98
 
# Add collections.abc.Callable if it does not exist
99
 
try:
100
 
    collections.abc.Callable
101
 
except AttributeError:
102
 
    class abc:
103
 
        Callable = collections.Callable
104
 
    collections.abc = abc
105
 
    del abc
106
 
 
107
 
# Add shlex.quote if it does not exist
108
 
try:
109
 
    shlex.quote
110
 
except AttributeError:
111
 
    shlex.quote = re.escape
112
 
 
113
 
# Show warnings by default
114
 
if not sys.warnoptions:
115
 
    import warnings
116
 
    warnings.simplefilter("default")
117
 
 
118
90
# Try to find the value of SO_BINDTODEVICE:
119
91
try:
120
92
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
140
112
            # No value found
141
113
            SO_BINDTODEVICE = None
142
114
 
143
 
if sys.version_info < (3, 2):
144
 
    configparser.Configparser = configparser.SafeConfigParser
 
115
if sys.version_info.major == 2:
 
116
    str = unicode
145
117
 
146
 
version = "1.8.14"
 
118
version = "1.8.2"
147
119
stored_state_file = "clients.pickle"
148
120
 
149
 
log = logging.getLogger(os.path.basename(sys.argv[0]))
150
 
logging.captureWarnings(True)   # Show warnings via the logging system
 
121
logger = logging.getLogger()
151
122
syslogger = None
152
123
 
153
124
try:
189
160
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
161
        address="/dev/log"))
191
162
    syslogger.setFormatter(logging.Formatter
192
 
                           ("Mandos [%(process)d]: %(levelname)s:"
193
 
                            " %(message)s"))
194
 
    log.addHandler(syslogger)
 
163
                           ('Mandos [%(process)d]: %(levelname)s:'
 
164
                            ' %(message)s'))
 
165
    logger.addHandler(syslogger)
195
166
 
196
167
    if debug:
197
168
        console = logging.StreamHandler()
198
 
        console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
 
                                               " [%(process)d]:"
200
 
                                               " %(levelname)s:"
201
 
                                               " %(message)s"))
202
 
        log.addHandler(console)
203
 
    log.setLevel(level)
 
169
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
170
                                               ' [%(process)d]:'
 
171
                                               ' %(levelname)s:'
 
172
                                               ' %(message)s'))
 
173
        logger.addHandler(console)
 
174
    logger.setLevel(level)
204
175
 
205
176
 
206
177
class PGPError(Exception):
208
179
    pass
209
180
 
210
181
 
211
 
class PGPEngine:
 
182
class PGPEngine(object):
212
183
    """A simple class for OpenPGP symmetric encryption & decryption"""
213
184
 
214
185
    def __init__(self):
218
189
            output = subprocess.check_output(["gpgconf"])
219
190
            for line in output.splitlines():
220
191
                name, text, path = line.split(b":")
221
 
                if name == b"gpg":
 
192
                if name == "gpg":
222
193
                    self.gpg = path
223
194
                    break
224
195
        except OSError as e:
225
196
            if e.errno != errno.ENOENT:
226
197
                raise
227
 
        self.gnupgargs = ["--batch",
228
 
                          "--homedir", self.tempdir,
229
 
                          "--force-mdc",
230
 
                          "--quiet"]
 
198
        self.gnupgargs = ['--batch',
 
199
                          '--homedir', self.tempdir,
 
200
                          '--force-mdc',
 
201
                          '--quiet']
231
202
        # Only GPG version 1 has the --no-use-agent option.
232
 
        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
 
203
        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
233
204
            self.gnupgargs.append("--no-use-agent")
234
205
 
235
206
    def __enter__(self):
272
243
                dir=self.tempdir) as passfile:
273
244
            passfile.write(passphrase)
274
245
            passfile.flush()
275
 
            proc = subprocess.Popen([self.gpg, "--symmetric",
276
 
                                     "--passphrase-file",
 
246
            proc = subprocess.Popen([self.gpg, '--symmetric',
 
247
                                     '--passphrase-file',
277
248
                                     passfile.name]
278
249
                                    + self.gnupgargs,
279
250
                                    stdin=subprocess.PIPE,
290
261
                dir=self.tempdir) as passfile:
291
262
            passfile.write(passphrase)
292
263
            passfile.flush()
293
 
            proc = subprocess.Popen([self.gpg, "--decrypt",
294
 
                                     "--passphrase-file",
 
264
            proc = subprocess.Popen([self.gpg, '--decrypt',
 
265
                                     '--passphrase-file',
295
266
                                     passfile.name]
296
267
                                    + self.gnupgargs,
297
268
                                    stdin=subprocess.PIPE,
304
275
 
305
276
 
306
277
# Pretend that we have an Avahi module
307
 
class avahi:
308
 
    """This isn't so much a class as it is a module-like namespace."""
 
278
class Avahi(object):
 
279
    """This isn't so much a class as it is a module-like namespace.
 
280
    It is instantiated once, and simulates having an Avahi module."""
309
281
    IF_UNSPEC = -1               # avahi-common/address.h
310
282
    PROTO_UNSPEC = -1            # avahi-common/address.h
311
283
    PROTO_INET = 0               # avahi-common/address.h
315
287
    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
288
    DBUS_PATH_SERVER = "/"
317
289
 
318
 
    @staticmethod
319
 
    def string_array_to_txt_array(t):
 
290
    def string_array_to_txt_array(self, t):
320
291
        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
292
                           for s in t), signature="ay")
322
293
    ENTRY_GROUP_ESTABLISHED = 2  # avahi-common/defs.h
327
298
    SERVER_RUNNING = 2           # avahi-common/defs.h
328
299
    SERVER_COLLISION = 3         # avahi-common/defs.h
329
300
    SERVER_FAILURE = 4           # avahi-common/defs.h
 
301
avahi = Avahi()
330
302
 
331
303
 
332
304
class AvahiError(Exception):
344
316
    pass
345
317
 
346
318
 
347
 
class AvahiService:
 
319
class AvahiService(object):
348
320
    """An Avahi (Zeroconf) service.
349
321
 
350
322
    Attributes:
351
323
    interface: integer; avahi.IF_UNSPEC or an interface index.
352
324
               Used to optionally bind to the specified interface.
353
 
    name: string; Example: "Mandos"
354
 
    type: string; Example: "_mandos._tcp".
 
325
    name: string; Example: 'Mandos'
 
326
    type: string; Example: '_mandos._tcp'.
355
327
     See <https://www.iana.org/assignments/service-names-port-numbers>
356
328
    port: integer; what port to announce
357
329
    TXT: list of strings; TXT record for the service
394
366
    def rename(self, remove=True):
395
367
        """Derived from the Avahi example code"""
396
368
        if self.rename_count >= self.max_renames:
397
 
            log.critical("No suitable Zeroconf service name found"
398
 
                         " after %i retries, exiting.",
399
 
                         self.rename_count)
 
369
            logger.critical("No suitable Zeroconf service name found"
 
370
                            " after %i retries, exiting.",
 
371
                            self.rename_count)
400
372
            raise AvahiServiceError("Too many renames")
401
373
        self.name = str(
402
374
            self.server.GetAlternativeServiceName(self.name))
403
375
        self.rename_count += 1
404
 
        log.info("Changing Zeroconf service name to %r ...",
405
 
                 self.name)
 
376
        logger.info("Changing Zeroconf service name to %r ...",
 
377
                    self.name)
406
378
        if remove:
407
379
            self.remove()
408
380
        try:
410
382
        except dbus.exceptions.DBusException as error:
411
383
            if (error.get_dbus_name()
412
384
                == "org.freedesktop.Avahi.CollisionError"):
413
 
                log.info("Local Zeroconf service name collision.")
 
385
                logger.info("Local Zeroconf service name collision.")
414
386
                return self.rename(remove=False)
415
387
            else:
416
 
                log.critical("D-Bus Exception", exc_info=error)
 
388
                logger.critical("D-Bus Exception", exc_info=error)
417
389
                self.cleanup()
418
390
                os._exit(1)
419
391
 
435
407
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
408
        self.entry_group_state_changed_match = (
437
409
            self.group.connect_to_signal(
438
 
                "StateChanged", self.entry_group_state_changed))
439
 
        log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
 
                  self.name, self.type)
 
410
                'StateChanged', self.entry_group_state_changed))
 
411
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
 
412
                     self.name, self.type)
441
413
        self.group.AddService(
442
414
            self.interface,
443
415
            self.protocol,
450
422
 
451
423
    def entry_group_state_changed(self, state, error):
452
424
        """Derived from the Avahi example code"""
453
 
        log.debug("Avahi entry group state change: %i", state)
 
425
        logger.debug("Avahi entry group state change: %i", state)
454
426
 
455
427
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
 
            log.debug("Zeroconf service established.")
 
428
            logger.debug("Zeroconf service established.")
457
429
        elif state == avahi.ENTRY_GROUP_COLLISION:
458
 
            log.info("Zeroconf service name collision.")
 
430
            logger.info("Zeroconf service name collision.")
459
431
            self.rename()
460
432
        elif state == avahi.ENTRY_GROUP_FAILURE:
461
 
            log.critical("Avahi: Error in group state changed %s",
462
 
                         str(error))
 
433
            logger.critical("Avahi: Error in group state changed %s",
 
434
                            str(error))
463
435
            raise AvahiGroupError("State changed: {!s}".format(error))
464
436
 
465
437
    def cleanup(self):
475
447
 
476
448
    def server_state_changed(self, state, error=None):
477
449
        """Derived from the Avahi example code"""
478
 
        log.debug("Avahi server state change: %i", state)
 
450
        logger.debug("Avahi server state change: %i", state)
479
451
        bad_states = {
480
452
            avahi.SERVER_INVALID: "Zeroconf server invalid",
481
453
            avahi.SERVER_REGISTERING: None,
485
457
        if state in bad_states:
486
458
            if bad_states[state] is not None:
487
459
                if error is None:
488
 
                    log.error(bad_states[state])
 
460
                    logger.error(bad_states[state])
489
461
                else:
490
 
                    log.error(bad_states[state] + ": %r", error)
 
462
                    logger.error(bad_states[state] + ": %r", error)
491
463
            self.cleanup()
492
464
        elif state == avahi.SERVER_RUNNING:
493
465
            try:
495
467
            except dbus.exceptions.DBusException as error:
496
468
                if (error.get_dbus_name()
497
469
                    == "org.freedesktop.Avahi.CollisionError"):
498
 
                    log.info("Local Zeroconf service name collision.")
 
470
                    logger.info("Local Zeroconf service name"
 
471
                                " collision.")
499
472
                    return self.rename(remove=False)
500
473
                else:
501
 
                    log.critical("D-Bus Exception", exc_info=error)
 
474
                    logger.critical("D-Bus Exception", exc_info=error)
502
475
                    self.cleanup()
503
476
                    os._exit(1)
504
477
        else:
505
478
            if error is None:
506
 
                log.debug("Unknown state: %r", state)
 
479
                logger.debug("Unknown state: %r", state)
507
480
            else:
508
 
                log.debug("Unknown state: %r: %r", state, error)
 
481
                logger.debug("Unknown state: %r: %r", state, error)
509
482
 
510
483
    def activate(self):
511
484
        """Derived from the Avahi example code"""
523
496
class AvahiServiceToSyslog(AvahiService):
524
497
    def rename(self, *args, **kwargs):
525
498
        """Add the new name to the syslog messages"""
526
 
        ret = super(AvahiServiceToSyslog, self).rename(*args,
527
 
                                                       **kwargs)
 
499
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
528
500
        syslogger.setFormatter(logging.Formatter(
529
 
            "Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
 
501
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
502
            .format(self.name)))
531
503
        return ret
532
504
 
533
505
 
534
506
# Pretend that we have a GnuTLS module
535
 
class gnutls:
536
 
    """This isn't so much a class as it is a module-like namespace."""
 
507
class GnuTLS(object):
 
508
    """This isn't so much a class as it is a module-like namespace.
 
509
    It is instantiated once, and simulates having a GnuTLS module."""
537
510
 
538
511
    library = ctypes.util.find_library("gnutls")
539
512
    if library is None:
540
513
        library = ctypes.util.find_library("gnutls-deb0")
541
514
    _library = ctypes.cdll.LoadLibrary(library)
542
515
    del library
 
516
    _need_version = b"3.3.0"
 
517
    _tls_rawpk_version = b"3.6.6"
 
518
 
 
519
    def __init__(self):
 
520
        # Need to use "self" here, since this method is called before
 
521
        # the assignment to the "gnutls" global variable happens.
 
522
        if self.check_version(self._need_version) is None:
 
523
            raise self.Error("Needs GnuTLS {} or later"
 
524
                             .format(self._need_version))
543
525
 
544
526
    # Unless otherwise indicated, the constants and types below are
545
527
    # all from the gnutls/gnutls.h C header file.
562
544
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
563
545
 
564
546
    # Types
565
 
    class _session_int(ctypes.Structure):
 
547
    class session_int(ctypes.Structure):
566
548
        _fields_ = []
567
 
    session_t = ctypes.POINTER(_session_int)
 
549
    session_t = ctypes.POINTER(session_int)
568
550
 
569
551
    class certificate_credentials_st(ctypes.Structure):
570
552
        _fields_ = []
573
555
    certificate_type_t = ctypes.c_int
574
556
 
575
557
    class datum_t(ctypes.Structure):
576
 
        _fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
 
                    ("size", ctypes.c_uint)]
 
558
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
 
559
                    ('size', ctypes.c_uint)]
578
560
 
579
 
    class _openpgp_crt_int(ctypes.Structure):
 
561
    class openpgp_crt_int(ctypes.Structure):
580
562
        _fields_ = []
581
 
    openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
 
563
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
564
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
583
565
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
566
    credentials_type_t = ctypes.c_int
587
569
 
588
570
    # Exceptions
589
571
    class Error(Exception):
 
572
        # We need to use the class name "GnuTLS" here, since this
 
573
        # exception might be raised from within GnuTLS.__init__,
 
574
        # which is called before the assignment to the "gnutls"
 
575
        # global variable has happened.
590
576
        def __init__(self, message=None, code=None, args=()):
591
577
            # Default usage is by a message string, but if a return
592
578
            # code is passed, convert it to a string with
593
579
            # gnutls.strerror()
594
580
            self.code = code
595
581
            if message is None and code is not None:
596
 
                message = gnutls.strerror(code).decode(
597
 
                    "utf-8", errors="replace")
598
 
            return super(gnutls.Error, self).__init__(
 
582
                message = GnuTLS.strerror(code)
 
583
            return super(GnuTLS.Error, self).__init__(
599
584
                message, *args)
600
585
 
601
586
    class CertificateSecurityError(Error):
602
587
        pass
603
588
 
604
 
    class PointerTo:
605
 
        def __init__(self, cls):
606
 
            self.cls = cls
607
 
 
608
 
        def from_param(self, obj):
609
 
            if not isinstance(obj, self.cls):
610
 
                raise TypeError("Not of type {}: {!r}"
611
 
                                .format(self.cls.__name__, obj))
612
 
            return ctypes.byref(obj.from_param(obj))
613
 
 
614
 
    class CastToVoidPointer:
615
 
        def __init__(self, cls):
616
 
            self.cls = cls
617
 
 
618
 
        def from_param(self, obj):
619
 
            if not isinstance(obj, self.cls):
620
 
                raise TypeError("Not of type {}: {!r}"
621
 
                                .format(self.cls.__name__, obj))
622
 
            return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
 
 
624
 
    class With_from_param:
625
 
        @classmethod
626
 
        def from_param(cls, obj):
627
 
            return obj._as_parameter_
628
 
 
629
589
    # Classes
630
 
    class Credentials(With_from_param):
 
590
    class Credentials(object):
631
591
        def __init__(self):
632
 
            self._as_parameter_ = gnutls.certificate_credentials_t()
633
 
            gnutls.certificate_allocate_credentials(self)
 
592
            self._c_object = gnutls.certificate_credentials_t()
 
593
            gnutls.certificate_allocate_credentials(
 
594
                ctypes.byref(self._c_object))
634
595
            self.type = gnutls.CRD_CERTIFICATE
635
596
 
636
597
        def __del__(self):
637
 
            gnutls.certificate_free_credentials(self)
 
598
            gnutls.certificate_free_credentials(self._c_object)
638
599
 
639
 
    class ClientSession(With_from_param):
 
600
    class ClientSession(object):
640
601
        def __init__(self, socket, credentials=None):
641
 
            self._as_parameter_ = gnutls.session_t()
 
602
            self._c_object = gnutls.session_t()
642
603
            gnutls_flags = gnutls.CLIENT
643
 
            if gnutls.check_version(b"3.5.6"):
 
604
            if gnutls.check_version("3.5.6"):
644
605
                gnutls_flags |= gnutls.NO_TICKETS
645
606
            if gnutls.has_rawpk:
646
607
                gnutls_flags |= gnutls.ENABLE_RAWPK
647
 
            gnutls.init(self, gnutls_flags)
 
608
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
648
609
            del gnutls_flags
649
 
            gnutls.set_default_priority(self)
650
 
            gnutls.transport_set_ptr(self, socket.fileno())
651
 
            gnutls.handshake_set_private_extensions(self, True)
 
610
            gnutls.set_default_priority(self._c_object)
 
611
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
 
612
            gnutls.handshake_set_private_extensions(self._c_object,
 
613
                                                    True)
652
614
            self.socket = socket
653
615
            if credentials is None:
654
616
                credentials = gnutls.Credentials()
655
 
            gnutls.credentials_set(self, credentials.type,
656
 
                                   credentials)
 
617
            gnutls.credentials_set(self._c_object, credentials.type,
 
618
                                   ctypes.cast(credentials._c_object,
 
619
                                               ctypes.c_void_p))
657
620
            self.credentials = credentials
658
621
 
659
622
        def __del__(self):
660
 
            gnutls.deinit(self)
 
623
            gnutls.deinit(self._c_object)
661
624
 
662
625
        def handshake(self):
663
 
            return gnutls.handshake(self)
 
626
            return gnutls.handshake(self._c_object)
664
627
 
665
628
        def send(self, data):
666
629
            data = bytes(data)
667
630
            data_len = len(data)
668
631
            while data_len > 0:
669
 
                data_len -= gnutls.record_send(self, data[-data_len:],
 
632
                data_len -= gnutls.record_send(self._c_object,
 
633
                                               data[-data_len:],
670
634
                                               data_len)
671
635
 
672
636
        def bye(self):
673
 
            return gnutls.bye(self, gnutls.SHUT_RDWR)
 
637
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
638
 
675
639
    # Error handling functions
676
640
    def _error_code(result):
677
641
        """A function to raise exceptions on errors, suitable
678
 
        for the "restype" attribute on ctypes functions"""
679
 
        if result >= gnutls.E_SUCCESS:
 
642
        for the 'restype' attribute on ctypes functions"""
 
643
        if result >= 0:
680
644
            return result
681
645
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
646
            raise gnutls.CertificateSecurityError(code=result)
683
647
        raise gnutls.Error(code=result)
684
648
 
685
 
    def _retry_on_error(result, func, arguments,
686
 
                        _error_code=_error_code):
 
649
    def _retry_on_error(result, func, arguments):
687
650
        """A function to retry on some errors, suitable
688
 
        for the "errcheck" attribute on ctypes functions"""
689
 
        while result < gnutls.E_SUCCESS:
 
651
        for the 'errcheck' attribute on ctypes functions"""
 
652
        while result < 0:
690
653
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
654
                return _error_code(result)
692
655
            result = func(*arguments)
697
660
 
698
661
    # Functions
699
662
    priority_set_direct = _library.gnutls_priority_set_direct
700
 
    priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
 
663
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
664
                                    ctypes.POINTER(ctypes.c_char_p)]
702
665
    priority_set_direct.restype = _error_code
703
666
 
704
667
    init = _library.gnutls_init
705
 
    init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
 
668
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
669
    init.restype = _error_code
707
670
 
708
671
    set_default_priority = _library.gnutls_set_default_priority
709
 
    set_default_priority.argtypes = [ClientSession]
 
672
    set_default_priority.argtypes = [session_t]
710
673
    set_default_priority.restype = _error_code
711
674
 
712
675
    record_send = _library.gnutls_record_send
713
 
    record_send.argtypes = [ClientSession, ctypes.c_void_p,
 
676
    record_send.argtypes = [session_t, ctypes.c_void_p,
714
677
                            ctypes.c_size_t]
715
678
    record_send.restype = ctypes.c_ssize_t
716
679
    record_send.errcheck = _retry_on_error
718
681
    certificate_allocate_credentials = (
719
682
        _library.gnutls_certificate_allocate_credentials)
720
683
    certificate_allocate_credentials.argtypes = [
721
 
        PointerTo(Credentials)]
 
684
        ctypes.POINTER(certificate_credentials_t)]
722
685
    certificate_allocate_credentials.restype = _error_code
723
686
 
724
687
    certificate_free_credentials = (
725
688
        _library.gnutls_certificate_free_credentials)
726
 
    certificate_free_credentials.argtypes = [Credentials]
 
689
    certificate_free_credentials.argtypes = [
 
690
        certificate_credentials_t]
727
691
    certificate_free_credentials.restype = None
728
692
 
729
693
    handshake_set_private_extensions = (
730
694
        _library.gnutls_handshake_set_private_extensions)
731
 
    handshake_set_private_extensions.argtypes = [ClientSession,
 
695
    handshake_set_private_extensions.argtypes = [session_t,
732
696
                                                 ctypes.c_int]
733
697
    handshake_set_private_extensions.restype = None
734
698
 
735
699
    credentials_set = _library.gnutls_credentials_set
736
 
    credentials_set.argtypes = [ClientSession, credentials_type_t,
737
 
                                CastToVoidPointer(Credentials)]
 
700
    credentials_set.argtypes = [session_t, credentials_type_t,
 
701
                                ctypes.c_void_p]
738
702
    credentials_set.restype = _error_code
739
703
 
740
704
    strerror = _library.gnutls_strerror
742
706
    strerror.restype = ctypes.c_char_p
743
707
 
744
708
    certificate_type_get = _library.gnutls_certificate_type_get
745
 
    certificate_type_get.argtypes = [ClientSession]
 
709
    certificate_type_get.argtypes = [session_t]
746
710
    certificate_type_get.restype = _error_code
747
711
 
748
712
    certificate_get_peers = _library.gnutls_certificate_get_peers
749
 
    certificate_get_peers.argtypes = [ClientSession,
 
713
    certificate_get_peers.argtypes = [session_t,
750
714
                                      ctypes.POINTER(ctypes.c_uint)]
751
715
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
716
 
759
723
    global_set_log_function.restype = None
760
724
 
761
725
    deinit = _library.gnutls_deinit
762
 
    deinit.argtypes = [ClientSession]
 
726
    deinit.argtypes = [session_t]
763
727
    deinit.restype = None
764
728
 
765
729
    handshake = _library.gnutls_handshake
766
 
    handshake.argtypes = [ClientSession]
767
 
    handshake.restype = ctypes.c_int
 
730
    handshake.argtypes = [session_t]
 
731
    handshake.restype = _error_code
768
732
    handshake.errcheck = _retry_on_error
769
733
 
770
734
    transport_set_ptr = _library.gnutls_transport_set_ptr
771
 
    transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
 
735
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
736
    transport_set_ptr.restype = None
773
737
 
774
738
    bye = _library.gnutls_bye
775
 
    bye.argtypes = [ClientSession, close_request_t]
776
 
    bye.restype = ctypes.c_int
 
739
    bye.argtypes = [session_t, close_request_t]
 
740
    bye.restype = _error_code
777
741
    bye.errcheck = _retry_on_error
778
742
 
779
743
    check_version = _library.gnutls_check_version
780
744
    check_version.argtypes = [ctypes.c_char_p]
781
745
    check_version.restype = ctypes.c_char_p
782
746
 
783
 
    _need_version = b"3.3.0"
784
 
    if check_version(_need_version) is None:
785
 
        raise self.Error("Needs GnuTLS {} or later"
786
 
                         .format(_need_version))
787
 
 
788
 
    _tls_rawpk_version = b"3.6.6"
789
747
    has_rawpk = bool(check_version(_tls_rawpk_version))
790
748
 
791
749
    if has_rawpk:
796
754
 
797
755
        x509_crt_fmt_t = ctypes.c_int
798
756
 
799
 
        # All the function declarations below are from
800
 
        # gnutls/abstract.h
 
757
        # All the function declarations below are from gnutls/abstract.h
801
758
        pubkey_init = _library.gnutls_pubkey_init
802
759
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
760
        pubkey_init.restype = _error_code
817
774
        pubkey_deinit.argtypes = [pubkey_t]
818
775
        pubkey_deinit.restype = None
819
776
    else:
820
 
        # All the function declarations below are from
821
 
        # gnutls/openpgp.h
 
777
        # All the function declarations below are from gnutls/openpgp.h
822
778
 
823
779
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
780
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
830
786
                                       openpgp_crt_fmt_t]
831
787
        openpgp_crt_import.restype = _error_code
832
788
 
833
 
        openpgp_crt_verify_self = \
834
 
            _library.gnutls_openpgp_crt_verify_self
835
 
        openpgp_crt_verify_self.argtypes = [
836
 
            openpgp_crt_t,
837
 
            ctypes.c_uint,
838
 
            ctypes.POINTER(ctypes.c_uint),
839
 
        ]
 
789
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
 
790
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
 
791
                                            ctypes.POINTER(ctypes.c_uint)]
840
792
        openpgp_crt_verify_self.restype = _error_code
841
793
 
842
794
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
851
803
                                                    ctypes.c_size_t)]
852
804
        openpgp_crt_get_fingerprint.restype = _error_code
853
805
 
854
 
    if check_version(b"3.6.4"):
 
806
    if check_version("3.6.4"):
855
807
        certificate_type_get2 = _library.gnutls_certificate_type_get2
856
 
        certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
 
808
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
857
809
        certificate_type_get2.restype = _error_code
858
810
 
859
811
    # Remove non-public functions
860
812
    del _error_code, _retry_on_error
 
813
# Create the global "gnutls" object, simulating a module
 
814
gnutls = GnuTLS()
861
815
 
862
816
 
863
817
def call_pipe(connection,       # : multiprocessing.Connection
871
825
    connection.close()
872
826
 
873
827
 
874
 
class Client:
 
828
class Client(object):
875
829
    """A representation of a client host served by this server.
876
830
 
877
831
    Attributes:
878
 
    approved:   bool(); None if not yet approved/disapproved
 
832
    approved:   bool(); 'None' if not yet approved/disapproved
879
833
    approval_delay: datetime.timedelta(); Time to wait for approval
880
834
    approval_duration: datetime.timedelta(); Duration of one approval
881
 
    checker: multiprocessing.Process(); a running checker process used
882
 
             to see if the client lives. None if no process is
883
 
             running.
 
835
    checker:    subprocess.Popen(); a running checker process used
 
836
                                    to see if the client lives.
 
837
                                    'None' if no process is running.
884
838
    checker_callback_tag: a GLib event source tag, or None
885
839
    checker_command: string; External command which is run to check
886
840
                     if client lives.  %() expansions are done at
1009
963
            self.last_enabled = None
1010
964
            self.expires = None
1011
965
 
1012
 
        log.debug("Creating client %r", self.name)
1013
 
        log.debug("  Key ID: %s", self.key_id)
1014
 
        log.debug("  Fingerprint: %s", self.fingerprint)
 
966
        logger.debug("Creating client %r", self.name)
 
967
        logger.debug("  Key ID: %s", self.key_id)
 
968
        logger.debug("  Fingerprint: %s", self.fingerprint)
1015
969
        self.created = settings.get("created",
1016
970
                                    datetime.datetime.utcnow())
1017
971
 
1056
1010
        if not getattr(self, "enabled", False):
1057
1011
            return False
1058
1012
        if not quiet:
1059
 
            log.info("Disabling client %s", self.name)
 
1013
            logger.info("Disabling client %s", self.name)
1060
1014
        if getattr(self, "disable_initiator_tag", None) is not None:
1061
1015
            GLib.source_remove(self.disable_initiator_tag)
1062
1016
            self.disable_initiator_tag = None
1080
1034
        if self.checker_initiator_tag is not None:
1081
1035
            GLib.source_remove(self.checker_initiator_tag)
1082
1036
        self.checker_initiator_tag = GLib.timeout_add(
1083
 
            random.randrange(int(self.interval.total_seconds() * 1000
1084
 
                                 + 1)),
 
1037
            int(self.interval.total_seconds() * 1000),
1085
1038
            self.start_checker)
1086
1039
        # Schedule a disable() when 'timeout' has passed
1087
1040
        if self.disable_initiator_tag is not None:
1094
1047
    def checker_callback(self, source, condition, connection,
1095
1048
                         command):
1096
1049
        """The checker has completed, so take appropriate actions."""
 
1050
        self.checker_callback_tag = None
 
1051
        self.checker = None
1097
1052
        # Read return code from connection (see call_pipe)
1098
1053
        returncode = connection.recv()
1099
1054
        connection.close()
1100
 
        if self.checker is not None:
1101
 
            self.checker.join()
1102
 
        self.checker_callback_tag = None
1103
 
        self.checker = None
1104
1055
 
1105
1056
        if returncode >= 0:
1106
1057
            self.last_checker_status = returncode
1107
1058
            self.last_checker_signal = None
1108
1059
            if self.last_checker_status == 0:
1109
 
                log.info("Checker for %(name)s succeeded", vars(self))
 
1060
                logger.info("Checker for %(name)s succeeded",
 
1061
                            vars(self))
1110
1062
                self.checked_ok()
1111
1063
            else:
1112
 
                log.info("Checker for %(name)s failed", vars(self))
 
1064
                logger.info("Checker for %(name)s failed", vars(self))
1113
1065
        else:
1114
1066
            self.last_checker_status = -1
1115
1067
            self.last_checker_signal = -returncode
1116
 
            log.warning("Checker for %(name)s crashed?", vars(self))
 
1068
            logger.warning("Checker for %(name)s crashed?",
 
1069
                           vars(self))
1117
1070
        return False
1118
1071
 
1119
1072
    def checked_ok(self):
1153
1106
        # should be.
1154
1107
 
1155
1108
        if self.checker is not None and not self.checker.is_alive():
1156
 
            log.warning("Checker was not alive; joining")
 
1109
            logger.warning("Checker was not alive; joining")
1157
1110
            self.checker.join()
1158
1111
            self.checker = None
1159
1112
        # Start a new checker if needed
1160
1113
        if self.checker is None:
1161
1114
            # Escape attributes for the shell
1162
1115
            escaped_attrs = {
1163
 
                attr: shlex.quote(str(getattr(self, attr)))
 
1116
                attr: re.escape(str(getattr(self, attr)))
1164
1117
                for attr in self.runtime_expansions}
1165
1118
            try:
1166
1119
                command = self.checker_command % escaped_attrs
1167
1120
            except TypeError as error:
1168
 
                log.error('Could not format string "%s"',
1169
 
                          self.checker_command, exc_info=error)
 
1121
                logger.error('Could not format string "%s"',
 
1122
                             self.checker_command,
 
1123
                             exc_info=error)
1170
1124
                return True     # Try again later
1171
1125
            self.current_checker_command = command
1172
 
            log.info("Starting checker %r for %s", command, self.name)
 
1126
            logger.info("Starting checker %r for %s", command,
 
1127
                        self.name)
1173
1128
            # We don't need to redirect stdout and stderr, since
1174
1129
            # in normal mode, that is already done by daemon(),
1175
1130
            # and in debug mode we don't want to.  (Stdin is
1191
1146
                kwargs=popen_args)
1192
1147
            self.checker.start()
1193
1148
            self.checker_callback_tag = GLib.io_add_watch(
1194
 
                GLib.IOChannel.unix_new(pipe[0].fileno()),
1195
 
                GLib.PRIORITY_DEFAULT, GLib.IO_IN,
 
1149
                pipe[0].fileno(), GLib.IO_IN,
1196
1150
                self.checker_callback, pipe[0], command)
1197
1151
        # Re-run this periodically if run by GLib.timeout_add
1198
1152
        return True
1204
1158
            self.checker_callback_tag = None
1205
1159
        if getattr(self, "checker", None) is None:
1206
1160
            return
1207
 
        log.debug("Stopping checker for %(name)s", vars(self))
 
1161
        logger.debug("Stopping checker for %(name)s", vars(self))
1208
1162
        self.checker.terminate()
1209
1163
        self.checker = None
1210
1164
 
1237
1191
        func._dbus_name = func.__name__
1238
1192
        if func._dbus_name.endswith("_dbus_property"):
1239
1193
            func._dbus_name = func._dbus_name[:-14]
1240
 
        func._dbus_get_args_options = {"byte_arrays": byte_arrays}
 
1194
        func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1241
1195
        return func
1242
1196
 
1243
1197
    return decorator
1332
1286
 
1333
1287
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1334
1288
                         out_signature="s",
1335
 
                         path_keyword="object_path",
1336
 
                         connection_keyword="connection")
 
1289
                         path_keyword='object_path',
 
1290
                         connection_keyword='connection')
1337
1291
    def Introspect(self, object_path, connection):
1338
1292
        """Overloading of standard D-Bus method.
1339
1293
 
1388
1342
            document.unlink()
1389
1343
        except (AttributeError, xml.dom.DOMException,
1390
1344
                xml.parsers.expat.ExpatError) as error:
1391
 
            log.error("Failed to override Introspection method",
1392
 
                      exc_info=error)
 
1345
            logger.error("Failed to override Introspection method",
 
1346
                         exc_info=error)
1393
1347
        return xmlstring
1394
1348
 
1395
1349
 
1453
1407
                raise ValueError("Byte arrays not supported for non-"
1454
1408
                                 "'ay' signature {!r}"
1455
1409
                                 .format(prop._dbus_signature))
1456
 
            value = dbus.ByteArray(bytes(value))
 
1410
            value = dbus.ByteArray(b''.join(chr(byte)
 
1411
                                            for byte in value))
1457
1412
        prop(value)
1458
1413
 
1459
1414
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1492
1447
 
1493
1448
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1494
1449
                         out_signature="s",
1495
 
                         path_keyword="object_path",
1496
 
                         connection_keyword="connection")
 
1450
                         path_keyword='object_path',
 
1451
                         connection_keyword='connection')
1497
1452
    def Introspect(self, object_path, connection):
1498
1453
        """Overloading of standard D-Bus method.
1499
1454
 
1555
1510
            document.unlink()
1556
1511
        except (AttributeError, xml.dom.DOMException,
1557
1512
                xml.parsers.expat.ExpatError) as error:
1558
 
            log.error("Failed to override Introspection method",
1559
 
                      exc_info=error)
 
1513
            logger.error("Failed to override Introspection method",
 
1514
                         exc_info=error)
1560
1515
        return xmlstring
1561
1516
 
1562
1517
 
1594
1549
 
1595
1550
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1596
1551
                         out_signature="s",
1597
 
                         path_keyword="object_path",
1598
 
                         connection_keyword="connection")
 
1552
                         path_keyword='object_path',
 
1553
                         connection_keyword='connection')
1599
1554
    def Introspect(self, object_path, connection):
1600
1555
        """Overloading of standard D-Bus method.
1601
1556
 
1626
1581
            document.unlink()
1627
1582
        except (AttributeError, xml.dom.DOMException,
1628
1583
                xml.parsers.expat.ExpatError) as error:
1629
 
            log.error("Failed to override Introspection method",
1630
 
                      exc_info=error)
 
1584
            logger.error("Failed to override Introspection method",
 
1585
                         exc_info=error)
1631
1586
        return xmlstring
1632
1587
 
1633
1588
 
2264
2219
    del _interface
2265
2220
 
2266
2221
 
2267
 
class ProxyClient:
 
2222
class ProxyClient(object):
2268
2223
    def __init__(self, child_pipe, key_id, fpr, address):
2269
2224
        self._pipe = child_pipe
2270
 
        self._pipe.send(("init", key_id, fpr, address))
 
2225
        self._pipe.send(('init', key_id, fpr, address))
2271
2226
        if not self._pipe.recv():
2272
2227
            raise KeyError(key_id or fpr)
2273
2228
 
2274
2229
    def __getattribute__(self, name):
2275
 
        if name == "_pipe":
 
2230
        if name == '_pipe':
2276
2231
            return super(ProxyClient, self).__getattribute__(name)
2277
 
        self._pipe.send(("getattr", name))
 
2232
        self._pipe.send(('getattr', name))
2278
2233
        data = self._pipe.recv()
2279
 
        if data[0] == "data":
 
2234
        if data[0] == 'data':
2280
2235
            return data[1]
2281
 
        if data[0] == "function":
 
2236
        if data[0] == 'function':
2282
2237
 
2283
2238
            def func(*args, **kwargs):
2284
 
                self._pipe.send(("funcall", name, args, kwargs))
 
2239
                self._pipe.send(('funcall', name, args, kwargs))
2285
2240
                return self._pipe.recv()[1]
2286
2241
 
2287
2242
            return func
2288
2243
 
2289
2244
    def __setattr__(self, name, value):
2290
 
        if name == "_pipe":
 
2245
        if name == '_pipe':
2291
2246
            return super(ProxyClient, self).__setattr__(name, value)
2292
 
        self._pipe.send(("setattr", name, value))
 
2247
        self._pipe.send(('setattr', name, value))
2293
2248
 
2294
2249
 
2295
2250
class ClientHandler(socketserver.BaseRequestHandler, object):
2300
2255
 
2301
2256
    def handle(self):
2302
2257
        with contextlib.closing(self.server.child_pipe) as child_pipe:
2303
 
            log.info("TCP connection from: %s",
2304
 
                     str(self.client_address))
2305
 
            log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
 
2258
            logger.info("TCP connection from: %s",
 
2259
                        str(self.client_address))
 
2260
            logger.debug("Pipe FD: %d",
 
2261
                         self.server.child_pipe.fileno())
2306
2262
 
2307
2263
            session = gnutls.ClientSession(self.request)
2308
2264
 
2309
 
            # priority = ":".join(("NONE", "+VERS-TLS1.1",
 
2265
            # priority = ':'.join(("NONE", "+VERS-TLS1.1",
2310
2266
            #                       "+AES-256-CBC", "+SHA1",
2311
2267
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
2312
2268
            #                       "+DHE-DSS"))
2314
2270
            priority = self.server.gnutls_priority
2315
2271
            if priority is None:
2316
2272
                priority = "NORMAL"
2317
 
            gnutls.priority_set_direct(session,
2318
 
                                       priority.encode("utf-8"), None)
 
2273
            gnutls.priority_set_direct(session._c_object,
 
2274
                                       priority.encode("utf-8"),
 
2275
                                       None)
2319
2276
 
2320
2277
            # Start communication using the Mandos protocol
2321
2278
            # Get protocol number
2322
2279
            line = self.request.makefile().readline()
2323
 
            log.debug("Protocol version: %r", line)
 
2280
            logger.debug("Protocol version: %r", line)
2324
2281
            try:
2325
2282
                if int(line.strip().split()[0]) > 1:
2326
2283
                    raise RuntimeError(line)
2327
2284
            except (ValueError, IndexError, RuntimeError) as error:
2328
 
                log.error("Unknown protocol version: %s", error)
 
2285
                logger.error("Unknown protocol version: %s", error)
2329
2286
                return
2330
2287
 
2331
2288
            # Start GnuTLS connection
2332
2289
            try:
2333
2290
                session.handshake()
2334
2291
            except gnutls.Error as error:
2335
 
                log.warning("Handshake failed: %s", error)
 
2292
                logger.warning("Handshake failed: %s", error)
2336
2293
                # Do not run session.bye() here: the session is not
2337
2294
                # established.  Just abandon the request.
2338
2295
                return
2339
 
            log.debug("Handshake succeeded")
 
2296
            logger.debug("Handshake succeeded")
2340
2297
 
2341
2298
            approval_required = False
2342
2299
            try:
2343
2300
                if gnutls.has_rawpk:
2344
 
                    fpr = b""
 
2301
                    fpr = ""
2345
2302
                    try:
2346
2303
                        key_id = self.key_id(
2347
2304
                            self.peer_certificate(session))
2348
2305
                    except (TypeError, gnutls.Error) as error:
2349
 
                        log.warning("Bad certificate: %s", error)
 
2306
                        logger.warning("Bad certificate: %s", error)
2350
2307
                        return
2351
 
                    log.debug("Key ID: %s",
2352
 
                              key_id.decode("utf-8",
2353
 
                                            errors="replace"))
 
2308
                    logger.debug("Key ID: %s", key_id)
2354
2309
 
2355
2310
                else:
2356
 
                    key_id = b""
 
2311
                    key_id = ""
2357
2312
                    try:
2358
2313
                        fpr = self.fingerprint(
2359
2314
                            self.peer_certificate(session))
2360
2315
                    except (TypeError, gnutls.Error) as error:
2361
 
                        log.warning("Bad certificate: %s", error)
 
2316
                        logger.warning("Bad certificate: %s", error)
2362
2317
                        return
2363
 
                    log.debug("Fingerprint: %s", fpr)
 
2318
                    logger.debug("Fingerprint: %s", fpr)
2364
2319
 
2365
2320
                try:
2366
2321
                    client = ProxyClient(child_pipe, key_id, fpr,
2375
2330
 
2376
2331
                while True:
2377
2332
                    if not client.enabled:
2378
 
                        log.info("Client %s is disabled", client.name)
 
2333
                        logger.info("Client %s is disabled",
 
2334
                                    client.name)
2379
2335
                        if self.server.use_dbus:
2380
2336
                            # Emit D-Bus signal
2381
2337
                            client.Rejected("Disabled")
2385
2341
                        # We are approved or approval is disabled
2386
2342
                        break
2387
2343
                    elif client.approved is None:
2388
 
                        log.info("Client %s needs approval",
2389
 
                                 client.name)
 
2344
                        logger.info("Client %s needs approval",
 
2345
                                    client.name)
2390
2346
                        if self.server.use_dbus:
2391
2347
                            # Emit D-Bus signal
2392
2348
                            client.NeedApproval(
2393
2349
                                client.approval_delay.total_seconds()
2394
2350
                                * 1000, client.approved_by_default)
2395
2351
                    else:
2396
 
                        log.warning("Client %s was not approved",
2397
 
                                    client.name)
 
2352
                        logger.warning("Client %s was not approved",
 
2353
                                       client.name)
2398
2354
                        if self.server.use_dbus:
2399
2355
                            # Emit D-Bus signal
2400
2356
                            client.Rejected("Denied")
2408
2364
                    time2 = datetime.datetime.now()
2409
2365
                    if (time2 - time) >= delay:
2410
2366
                        if not client.approved_by_default:
2411
 
                            log.warning("Client %s timed out while"
2412
 
                                        " waiting for approval",
2413
 
                                        client.name)
 
2367
                            logger.warning("Client %s timed out while"
 
2368
                                           " waiting for approval",
 
2369
                                           client.name)
2414
2370
                            if self.server.use_dbus:
2415
2371
                                # Emit D-Bus signal
2416
2372
                                client.Rejected("Approval timed out")
2423
2379
                try:
2424
2380
                    session.send(client.secret)
2425
2381
                except gnutls.Error as error:
2426
 
                    log.warning("gnutls send failed", exc_info=error)
 
2382
                    logger.warning("gnutls send failed",
 
2383
                                   exc_info=error)
2427
2384
                    return
2428
2385
 
2429
 
                log.info("Sending secret to %s", client.name)
 
2386
                logger.info("Sending secret to %s", client.name)
2430
2387
                # bump the timeout using extended_timeout
2431
2388
                client.bump_timeout(client.extended_timeout)
2432
2389
                if self.server.use_dbus:
2439
2396
                try:
2440
2397
                    session.bye()
2441
2398
                except gnutls.Error as error:
2442
 
                    log.warning("GnuTLS bye failed", exc_info=error)
 
2399
                    logger.warning("GnuTLS bye failed",
 
2400
                                   exc_info=error)
2443
2401
 
2444
2402
    @staticmethod
2445
2403
    def peer_certificate(session):
2446
2404
        "Return the peer's certificate as a bytestring"
2447
2405
        try:
2448
 
            cert_type = gnutls.certificate_type_get2(
2449
 
                session, gnutls.CTYPE_PEERS)
 
2406
            cert_type = gnutls.certificate_type_get2(session._c_object,
 
2407
                                                     gnutls.CTYPE_PEERS)
2450
2408
        except AttributeError:
2451
 
            cert_type = gnutls.certificate_type_get(session)
 
2409
            cert_type = gnutls.certificate_type_get(session._c_object)
2452
2410
        if gnutls.has_rawpk:
2453
2411
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2454
2412
        else:
2455
2413
            valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2456
2414
        # If not a valid certificate type...
2457
2415
        if cert_type not in valid_cert_types:
2458
 
            log.info("Cert type %r not in %r", cert_type,
2459
 
                     valid_cert_types)
 
2416
            logger.info("Cert type %r not in %r", cert_type,
 
2417
                        valid_cert_types)
2460
2418
            # ...return invalid data
2461
2419
            return b""
2462
2420
        list_size = ctypes.c_uint(1)
2463
2421
        cert_list = (gnutls.certificate_get_peers
2464
 
                     (session, ctypes.byref(list_size)))
 
2422
                     (session._c_object, ctypes.byref(list_size)))
2465
2423
        if not bool(cert_list) and list_size.value != 0:
2466
2424
            raise gnutls.Error("error getting peer certificate")
2467
2425
        if list_size.value == 0:
2489
2447
        buf = ctypes.create_string_buffer(32)
2490
2448
        buf_len = ctypes.c_size_t(len(buf))
2491
2449
        # Get the key ID from the raw public key into the buffer
2492
 
        gnutls.pubkey_get_key_id(
2493
 
            pubkey,
2494
 
            gnutls.KEYID_USE_SHA256,
2495
 
            ctypes.cast(ctypes.byref(buf),
2496
 
                        ctypes.POINTER(ctypes.c_ubyte)),
2497
 
            ctypes.byref(buf_len))
 
2450
        gnutls.pubkey_get_key_id(pubkey,
 
2451
                                 gnutls.KEYID_USE_SHA256,
 
2452
                                 ctypes.cast(ctypes.byref(buf),
 
2453
                                             ctypes.POINTER(ctypes.c_ubyte)),
 
2454
                                 ctypes.byref(buf_len))
2498
2455
        # Deinit the certificate
2499
2456
        gnutls.pubkey_deinit(pubkey)
2500
2457
 
2541
2498
        return hex_fpr
2542
2499
 
2543
2500
 
2544
 
class MultiprocessingMixIn:
 
2501
class MultiprocessingMixIn(object):
2545
2502
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
2546
2503
 
2547
2504
    def sub_process_main(self, request, address):
2559
2516
        return proc
2560
2517
 
2561
2518
 
2562
 
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
 
2519
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2563
2520
    """ adds a pipe to the MixIn """
2564
2521
 
2565
2522
    def process_request(self, request, client_address):
2580
2537
 
2581
2538
 
2582
2539
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2583
 
                     socketserver.TCPServer):
2584
 
    """IPv6-capable TCP server.  Accepts None as address and/or port
 
2540
                     socketserver.TCPServer, object):
 
2541
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
2585
2542
 
2586
2543
    Attributes:
2587
2544
        enabled:        Boolean; whether this server is activated yet
2638
2595
            if SO_BINDTODEVICE is None:
2639
2596
                # Fall back to a hard-coded value which seems to be
2640
2597
                # common enough.
2641
 
                log.warning("SO_BINDTODEVICE not found, trying 25")
 
2598
                logger.warning("SO_BINDTODEVICE not found, trying 25")
2642
2599
                SO_BINDTODEVICE = 25
2643
2600
            try:
2644
2601
                self.socket.setsockopt(
2646
2603
                    (self.interface + "\0").encode("utf-8"))
2647
2604
            except socket.error as error:
2648
2605
                if error.errno == errno.EPERM:
2649
 
                    log.error("No permission to bind to interface %s",
2650
 
                              self.interface)
 
2606
                    logger.error("No permission to bind to"
 
2607
                                 " interface %s", self.interface)
2651
2608
                elif error.errno == errno.ENOPROTOOPT:
2652
 
                    log.error("SO_BINDTODEVICE not available; cannot"
2653
 
                              " bind to interface %s", self.interface)
 
2609
                    logger.error("SO_BINDTODEVICE not available;"
 
2610
                                 " cannot bind to interface %s",
 
2611
                                 self.interface)
2654
2612
                elif error.errno == errno.ENODEV:
2655
 
                    log.error("Interface %s does not exist, cannot"
2656
 
                              " bind", self.interface)
 
2613
                    logger.error("Interface %s does not exist,"
 
2614
                                 " cannot bind", self.interface)
2657
2615
                else:
2658
2616
                    raise
2659
2617
        # Only bind(2) the socket if we really need to.
2660
2618
        if self.server_address[0] or self.server_address[1]:
2661
 
            if self.server_address[1]:
2662
 
                self.allow_reuse_address = True
2663
2619
            if not self.server_address[0]:
2664
2620
                if self.address_family == socket.AF_INET6:
2665
2621
                    any_address = "::"  # in6addr_any
2718
2674
    def add_pipe(self, parent_pipe, proc):
2719
2675
        # Call "handle_ipc" for both data and EOF events
2720
2676
        GLib.io_add_watch(
2721
 
            GLib.IOChannel.unix_new(parent_pipe.fileno()),
2722
 
            GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
 
2677
            parent_pipe.fileno(),
 
2678
            GLib.IO_IN | GLib.IO_HUP,
2723
2679
            functools.partial(self.handle_ipc,
2724
2680
                              parent_pipe=parent_pipe,
2725
2681
                              proc=proc))
2738
2694
        request = parent_pipe.recv()
2739
2695
        command = request[0]
2740
2696
 
2741
 
        if command == "init":
 
2697
        if command == 'init':
2742
2698
            key_id = request[1].decode("ascii")
2743
2699
            fpr = request[2].decode("ascii")
2744
2700
            address = request[3]
2745
2701
 
2746
2702
            for c in self.clients.values():
2747
 
                if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2748
 
                              "27AE41E4649B934CA495991B7852B855"):
 
2703
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2749
2704
                    continue
2750
2705
                if key_id and c.key_id == key_id:
2751
2706
                    client = c
2754
2709
                    client = c
2755
2710
                    break
2756
2711
            else:
2757
 
                log.info("Client not found for key ID: %s, address:"
2758
 
                         " %s", key_id or fpr, address)
 
2712
                logger.info("Client not found for key ID: %s, address"
 
2713
                            ": %s", key_id or fpr, address)
2759
2714
                if self.use_dbus:
2760
2715
                    # Emit D-Bus signal
2761
2716
                    mandos_dbus_service.ClientNotFound(key_id or fpr,
2764
2719
                return False
2765
2720
 
2766
2721
            GLib.io_add_watch(
2767
 
                GLib.IOChannel.unix_new(parent_pipe.fileno()),
2768
 
                GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
 
2722
                parent_pipe.fileno(),
 
2723
                GLib.IO_IN | GLib.IO_HUP,
2769
2724
                functools.partial(self.handle_ipc,
2770
2725
                                  parent_pipe=parent_pipe,
2771
2726
                                  proc=proc,
2774
2729
            # remove the old hook in favor of the new above hook on
2775
2730
            # same fileno
2776
2731
            return False
2777
 
        if command == "funcall":
 
2732
        if command == 'funcall':
2778
2733
            funcname = request[1]
2779
2734
            args = request[2]
2780
2735
            kwargs = request[3]
2781
2736
 
2782
 
            parent_pipe.send(("data", getattr(client_object,
 
2737
            parent_pipe.send(('data', getattr(client_object,
2783
2738
                                              funcname)(*args,
2784
2739
                                                        **kwargs)))
2785
2740
 
2786
 
        if command == "getattr":
 
2741
        if command == 'getattr':
2787
2742
            attrname = request[1]
2788
2743
            if isinstance(client_object.__getattribute__(attrname),
2789
 
                          collections.abc.Callable):
2790
 
                parent_pipe.send(("function", ))
 
2744
                          collections.Callable):
 
2745
                parent_pipe.send(('function', ))
2791
2746
            else:
2792
2747
                parent_pipe.send((
2793
 
                    "data", client_object.__getattribute__(attrname)))
 
2748
                    'data', client_object.__getattribute__(attrname)))
2794
2749
 
2795
 
        if command == "setattr":
 
2750
        if command == 'setattr':
2796
2751
            attrname = request[1]
2797
2752
            value = request[2]
2798
2753
            setattr(client_object, attrname, value)
2803
2758
def rfc3339_duration_to_delta(duration):
2804
2759
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2805
2760
 
2806
 
    >>> timedelta = datetime.timedelta
2807
 
    >>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2808
 
    True
2809
 
    >>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2810
 
    True
2811
 
    >>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2812
 
    True
2813
 
    >>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2814
 
    True
2815
 
    >>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2816
 
    True
2817
 
    >>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2818
 
    True
2819
 
    >>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2820
 
    True
2821
 
    >>> del timedelta
 
2761
    >>> rfc3339_duration_to_delta("P7D")
 
2762
    datetime.timedelta(7)
 
2763
    >>> rfc3339_duration_to_delta("PT60S")
 
2764
    datetime.timedelta(0, 60)
 
2765
    >>> rfc3339_duration_to_delta("PT60M")
 
2766
    datetime.timedelta(0, 3600)
 
2767
    >>> rfc3339_duration_to_delta("PT24H")
 
2768
    datetime.timedelta(1)
 
2769
    >>> rfc3339_duration_to_delta("P1W")
 
2770
    datetime.timedelta(7)
 
2771
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2772
    datetime.timedelta(0, 330)
 
2773
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2774
    datetime.timedelta(1, 200)
2822
2775
    """
2823
2776
 
2824
2777
    # Parsing an RFC 3339 duration with regular expressions is not
2904
2857
def string_to_delta(interval):
2905
2858
    """Parse a string and return a datetime.timedelta
2906
2859
 
2907
 
    >>> string_to_delta("7d") == datetime.timedelta(7)
2908
 
    True
2909
 
    >>> string_to_delta("60s") == datetime.timedelta(0, 60)
2910
 
    True
2911
 
    >>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2912
 
    True
2913
 
    >>> string_to_delta("24h") == datetime.timedelta(1)
2914
 
    True
2915
 
    >>> string_to_delta("1w") == datetime.timedelta(7)
2916
 
    True
2917
 
    >>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2918
 
    True
 
2860
    >>> string_to_delta('7d')
 
2861
    datetime.timedelta(7)
 
2862
    >>> string_to_delta('60s')
 
2863
    datetime.timedelta(0, 60)
 
2864
    >>> string_to_delta('60m')
 
2865
    datetime.timedelta(0, 3600)
 
2866
    >>> string_to_delta('24h')
 
2867
    datetime.timedelta(1)
 
2868
    >>> string_to_delta('1w')
 
2869
    datetime.timedelta(7)
 
2870
    >>> string_to_delta('5m 30s')
 
2871
    datetime.timedelta(0, 330)
2919
2872
    """
2920
2873
 
2921
2874
    try:
3023
2976
 
3024
2977
    options = parser.parse_args()
3025
2978
 
 
2979
    if options.check:
 
2980
        import doctest
 
2981
        fail_count, test_count = doctest.testmod()
 
2982
        sys.exit(os.EX_OK if fail_count == 0 else 1)
 
2983
 
3026
2984
    # Default values for config file for server-global settings
3027
2985
    if gnutls.has_rawpk:
3028
2986
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3048
3006
    del priority
3049
3007
 
3050
3008
    # Parse config file for server-global settings
3051
 
    server_config = configparser.ConfigParser(server_defaults)
 
3009
    server_config = configparser.SafeConfigParser(server_defaults)
3052
3010
    del server_defaults
3053
3011
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
3054
 
    # Convert the ConfigParser object to a dict
 
3012
    # Convert the SafeConfigParser object to a dict
3055
3013
    server_settings = server_config.defaults()
3056
3014
    # Use the appropriate methods on the non-string config options
3057
3015
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
3124
3082
 
3125
3083
    if server_settings["servicename"] != "Mandos":
3126
3084
        syslogger.setFormatter(
3127
 
            logging.Formatter("Mandos ({}) [%(process)d]:"
3128
 
                              " %(levelname)s: %(message)s".format(
 
3085
            logging.Formatter('Mandos ({}) [%(process)d]:'
 
3086
                              ' %(levelname)s: %(message)s'.format(
3129
3087
                                  server_settings["servicename"])))
3130
3088
 
3131
3089
    # Parse config file with clients
3132
 
    client_config = configparser.ConfigParser(Client.client_defaults)
 
3090
    client_config = configparser.SafeConfigParser(Client
 
3091
                                                  .client_defaults)
3133
3092
    client_config.read(os.path.join(server_settings["configdir"],
3134
3093
                                    "clients.conf"))
3135
3094
 
3155
3114
        try:
3156
3115
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3157
3116
        except IOError as e:
3158
 
            log.error("Could not open file %r", pidfilename,
3159
 
                      exc_info=e)
 
3117
            logger.error("Could not open file %r", pidfilename,
 
3118
                         exc_info=e)
3160
3119
 
3161
3120
    for name, group in (("_mandos", "_mandos"),
3162
3121
                        ("mandos", "mandos"),
3173
3132
    try:
3174
3133
        os.setgid(gid)
3175
3134
        os.setuid(uid)
3176
 
        log.debug("Did setuid/setgid to %s:%s", uid, gid)
 
3135
        if debug:
 
3136
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
 
3137
                                                             gid))
3177
3138
    except OSError as error:
3178
 
        log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3179
 
                    os.strerror(error.errno))
 
3139
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
 
3140
                       .format(uid, gid, os.strerror(error.errno)))
3180
3141
        if error.errno != errno.EPERM:
3181
3142
            raise
3182
3143
 
3189
3150
 
3190
3151
        @gnutls.log_func
3191
3152
        def debug_gnutls(level, string):
3192
 
            log.debug("GnuTLS: %s",
3193
 
                      string[:-1].decode("utf-8", errors="replace"))
 
3153
            logger.debug("GnuTLS: %s", string[:-1])
3194
3154
 
3195
3155
        gnutls.global_set_log_function(debug_gnutls)
3196
3156
 
3205
3165
        # Close all input and output, do double fork, etc.
3206
3166
        daemon()
3207
3167
 
3208
 
    if gi.version_info < (3, 10, 2):
3209
 
        # multiprocessing will use threads, so before we use GLib we
3210
 
        # need to inform GLib that threads will be used.
3211
 
        GLib.threads_init()
 
3168
    # multiprocessing will use threads, so before we use GLib we need
 
3169
    # to inform GLib that threads will be used.
 
3170
    GLib.threads_init()
3212
3171
 
3213
3172
    global main_loop
3214
3173
    # From the Avahi example code
3225
3184
                "se.bsnet.fukt.Mandos", bus,
3226
3185
                do_not_queue=True)
3227
3186
        except dbus.exceptions.DBusException as e:
3228
 
            log.error("Disabling D-Bus:", exc_info=e)
 
3187
            logger.error("Disabling D-Bus:", exc_info=e)
3229
3188
            use_dbus = False
3230
3189
            server_settings["use_dbus"] = False
3231
3190
            tcp_server.use_dbus = False
3290
3249
                             if isinstance(s, bytes)
3291
3250
                             else s) for s in
3292
3251
                            value["client_structure"]]
3293
 
                        # .name, .host, and .checker_command
3294
 
                        for k in ("name", "host", "checker_command"):
 
3252
                        # .name & .host
 
3253
                        for k in ("name", "host"):
3295
3254
                            if isinstance(value[k], bytes):
3296
3255
                                value[k] = value[k].decode("utf-8")
3297
 
                        if "key_id" not in value:
 
3256
                        if not value.has_key("key_id"):
3298
3257
                            value["key_id"] = ""
3299
 
                        elif "fingerprint" not in value:
 
3258
                        elif not value.has_key("fingerprint"):
3300
3259
                            value["fingerprint"] = ""
3301
3260
                    #  old_client_settings
3302
3261
                    # .keys()
3307
3266
                        for key, value in
3308
3267
                        bytes_old_client_settings.items()}
3309
3268
                    del bytes_old_client_settings
3310
 
                    # .host and .checker_command
 
3269
                    # .host
3311
3270
                    for value in old_client_settings.values():
3312
 
                        for attribute in ("host", "checker_command"):
3313
 
                            if isinstance(value[attribute], bytes):
3314
 
                                value[attribute] = (value[attribute]
3315
 
                                                    .decode("utf-8"))
 
3271
                        if isinstance(value["host"], bytes):
 
3272
                            value["host"] = (value["host"]
 
3273
                                             .decode("utf-8"))
3316
3274
            os.remove(stored_state_path)
3317
3275
        except IOError as e:
3318
3276
            if e.errno == errno.ENOENT:
3319
 
                log.warning("Could not load persistent state:"
3320
 
                            " %s", os.strerror(e.errno))
 
3277
                logger.warning("Could not load persistent state:"
 
3278
                               " {}".format(os.strerror(e.errno)))
3321
3279
            else:
3322
 
                log.critical("Could not load persistent state:",
3323
 
                             exc_info=e)
 
3280
                logger.critical("Could not load persistent state:",
 
3281
                                exc_info=e)
3324
3282
                raise
3325
3283
        except EOFError as e:
3326
 
            log.warning("Could not load persistent state: EOFError:",
3327
 
                        exc_info=e)
 
3284
            logger.warning("Could not load persistent state: "
 
3285
                           "EOFError:",
 
3286
                           exc_info=e)
3328
3287
 
3329
3288
    with PGPEngine() as pgp:
3330
3289
        for client_name, client in clients_data.items():
3357
3316
            if client["enabled"]:
3358
3317
                if datetime.datetime.utcnow() >= client["expires"]:
3359
3318
                    if not client["last_checked_ok"]:
3360
 
                        log.warning("disabling client %s - Client"
3361
 
                                    " never performed a successful"
3362
 
                                    " checker", client_name)
 
3319
                        logger.warning(
 
3320
                            "disabling client {} - Client never "
 
3321
                            "performed a successful checker".format(
 
3322
                                client_name))
3363
3323
                        client["enabled"] = False
3364
3324
                    elif client["last_checker_status"] != 0:
3365
 
                        log.warning("disabling client %s - Client"
3366
 
                                    " last checker failed with error"
3367
 
                                    " code %s", client_name,
3368
 
                                    client["last_checker_status"])
 
3325
                        logger.warning(
 
3326
                            "disabling client {} - Client last"
 
3327
                            " checker failed with error code"
 
3328
                            " {}".format(
 
3329
                                client_name,
 
3330
                                client["last_checker_status"]))
3369
3331
                        client["enabled"] = False
3370
3332
                    else:
3371
3333
                        client["expires"] = (
3372
3334
                            datetime.datetime.utcnow()
3373
3335
                            + client["timeout"])
3374
 
                        log.debug("Last checker succeeded, keeping %s"
3375
 
                                  " enabled", client_name)
 
3336
                        logger.debug("Last checker succeeded,"
 
3337
                                     " keeping {} enabled".format(
 
3338
                                         client_name))
3376
3339
            try:
3377
3340
                client["secret"] = pgp.decrypt(
3378
3341
                    client["encrypted_secret"],
3379
3342
                    client_settings[client_name]["secret"])
3380
3343
            except PGPError:
3381
3344
                # If decryption fails, we use secret from new settings
3382
 
                log.debug("Failed to decrypt %s old secret",
3383
 
                          client_name)
 
3345
                logger.debug("Failed to decrypt {} old secret".format(
 
3346
                    client_name))
3384
3347
                client["secret"] = (client_settings[client_name]
3385
3348
                                    ["secret"])
3386
3349
 
3400
3363
            server_settings=server_settings)
3401
3364
 
3402
3365
    if not tcp_server.clients:
3403
 
        log.warning("No clients defined")
 
3366
        logger.warning("No clients defined")
3404
3367
 
3405
3368
    if not foreground:
3406
3369
        if pidfile is not None:
3409
3372
                with pidfile:
3410
3373
                    print(pid, file=pidfile)
3411
3374
            except IOError:
3412
 
                log.error("Could not write to file %r with PID %d",
3413
 
                          pidfilename, pid)
 
3375
                logger.error("Could not write to file %r with PID %d",
 
3376
                             pidfilename, pid)
3414
3377
        del pidfile
3415
3378
        del pidfilename
3416
3379
 
3566
3529
 
3567
3530
        try:
3568
3531
            with tempfile.NamedTemporaryFile(
3569
 
                    mode="wb",
 
3532
                    mode='wb',
3570
3533
                    suffix=".pickle",
3571
 
                    prefix="clients-",
 
3534
                    prefix='clients-',
3572
3535
                    dir=os.path.dirname(stored_state_path),
3573
3536
                    delete=False) as stored_state:
3574
3537
                pickle.dump((clients, client_settings), stored_state,
3582
3545
                except NameError:
3583
3546
                    pass
3584
3547
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3585
 
                log.warning("Could not save persistent state: %s",
3586
 
                            os.strerror(e.errno))
 
3548
                logger.warning("Could not save persistent state: {}"
 
3549
                               .format(os.strerror(e.errno)))
3587
3550
            else:
3588
 
                log.warning("Could not save persistent state:",
3589
 
                            exc_info=e)
 
3551
                logger.warning("Could not save persistent state:",
 
3552
                               exc_info=e)
3590
3553
                raise
3591
3554
 
3592
3555
        # Delete all clients, and settings from config
3618
3581
    if zeroconf:
3619
3582
        service.port = tcp_server.socket.getsockname()[1]
3620
3583
    if use_ipv6:
3621
 
        log.info("Now listening on address %r, port %d, flowinfo %d,"
3622
 
                 " scope_id %d", *tcp_server.socket.getsockname())
 
3584
        logger.info("Now listening on address %r, port %d,"
 
3585
                    " flowinfo %d, scope_id %d",
 
3586
                    *tcp_server.socket.getsockname())
3623
3587
    else:                       # IPv4
3624
 
        log.info("Now listening on address %r, port %d",
3625
 
                 *tcp_server.socket.getsockname())
 
3588
        logger.info("Now listening on address %r, port %d",
 
3589
                    *tcp_server.socket.getsockname())
3626
3590
 
3627
3591
    # service.interface = tcp_server.socket.getsockname()[3]
3628
3592
 
3632
3596
            try:
3633
3597
                service.activate()
3634
3598
            except dbus.exceptions.DBusException as error:
3635
 
                log.critical("D-Bus Exception", exc_info=error)
 
3599
                logger.critical("D-Bus Exception", exc_info=error)
3636
3600
                cleanup()
3637
3601
                sys.exit(1)
3638
3602
            # End of Avahi example code
3639
3603
 
3640
 
        GLib.io_add_watch(
3641
 
            GLib.IOChannel.unix_new(tcp_server.fileno()),
3642
 
            GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3643
 
            lambda *args, **kwargs: (tcp_server.handle_request
3644
 
                                     (*args[2:], **kwargs) or True))
 
3604
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
 
3605
                          lambda *args, **kwargs:
 
3606
                          (tcp_server.handle_request
 
3607
                           (*args[2:], **kwargs) or True))
3645
3608
 
3646
 
        log.debug("Starting main loop")
 
3609
        logger.debug("Starting main loop")
3647
3610
        main_loop.run()
3648
3611
    except AvahiError as error:
3649
 
        log.critical("Avahi Error", exc_info=error)
 
3612
        logger.critical("Avahi Error", exc_info=error)
3650
3613
        cleanup()
3651
3614
        sys.exit(1)
3652
3615
    except KeyboardInterrupt:
3653
3616
        if debug:
3654
3617
            print("", file=sys.stderr)
3655
 
        log.debug("Server received KeyboardInterrupt")
3656
 
    log.debug("Server exiting")
 
3618
        logger.debug("Server received KeyboardInterrupt")
 
3619
    logger.debug("Server exiting")
3657
3620
    # Must run before the D-Bus bus name gets deregistered
3658
3621
    cleanup()
3659
3622
 
3660
 
 
3661
 
def parse_test_args():
3662
 
    # type: () -> argparse.Namespace
3663
 
    parser = argparse.ArgumentParser(add_help=False)
3664
 
    parser.add_argument("--check", action="store_true")
3665
 
    parser.add_argument("--prefix", )
3666
 
    args, unknown_args = parser.parse_known_args()
3667
 
    if args.check:
3668
 
        # Remove test options from sys.argv
3669
 
        sys.argv[1:] = unknown_args
3670
 
    return args
3671
 
 
3672
 
# Add all tests from doctest strings
3673
 
def load_tests(loader, tests, none):
3674
 
    import doctest
3675
 
    tests.addTests(doctest.DocTestSuite())
3676
 
    return tests
3677
 
 
3678
 
if __name__ == "__main__":
3679
 
    options = parse_test_args()
3680
 
    try:
3681
 
        if options.check:
3682
 
            extra_test_prefix = options.prefix
3683
 
            if extra_test_prefix is not None:
3684
 
                if not (unittest.main(argv=[""], exit=False)
3685
 
                        .result.wasSuccessful()):
3686
 
                    sys.exit(1)
3687
 
                class ExtraTestLoader(unittest.TestLoader):
3688
 
                    testMethodPrefix = extra_test_prefix
3689
 
                # Call using ./scriptname --test [--verbose]
3690
 
                unittest.main(argv=[""], testLoader=ExtraTestLoader())
3691
 
            else:
3692
 
                unittest.main(argv=[""])
3693
 
        else:
3694
 
            main()
3695
 
    finally:
3696
 
        logging.shutdown()
3697
 
 
3698
 
# Local Variables:
3699
 
# run-tests:
3700
 
# (lambda (&optional extra)
3701
 
#   (if (not (funcall run-tests-in-test-buffer default-directory
3702
 
#             extra))
3703
 
#       (funcall show-test-buffer-in-test-window)
3704
 
#     (funcall remove-test-window)
3705
 
#     (if extra (message "Extra tests run successfully!"))))
3706
 
# run-tests-in-test-buffer:
3707
 
# (lambda (dir &optional extra)
3708
 
#   (with-current-buffer (get-buffer-create "*Test*")
3709
 
#     (setq buffer-read-only nil
3710
 
#           default-directory dir)
3711
 
#     (erase-buffer)
3712
 
#     (compilation-mode))
3713
 
#   (let ((process-result
3714
 
#          (let ((inhibit-read-only t))
3715
 
#            (process-file-shell-command
3716
 
#             (funcall get-command-line extra) nil "*Test*"))))
3717
 
#     (and (numberp process-result)
3718
 
#          (= process-result 0))))
3719
 
# get-command-line:
3720
 
# (lambda (&optional extra)
3721
 
#   (let ((quoted-script
3722
 
#          (shell-quote-argument (funcall get-script-name))))
3723
 
#     (format
3724
 
#      (concat "%s --check" (if extra " --prefix=atest" ""))
3725
 
#      quoted-script)))
3726
 
# get-script-name:
3727
 
# (lambda ()
3728
 
#   (if (fboundp 'file-local-name)
3729
 
#       (file-local-name (buffer-file-name))
3730
 
#     (or (file-remote-p (buffer-file-name) 'localname)
3731
 
#         (buffer-file-name))))
3732
 
# remove-test-window:
3733
 
# (lambda ()
3734
 
#   (let ((test-window (get-buffer-window "*Test*")))
3735
 
#     (if test-window (delete-window test-window))))
3736
 
# show-test-buffer-in-test-window:
3737
 
# (lambda ()
3738
 
#   (when (not (get-buffer-window-list "*Test*"))
3739
 
#     (setq next-error-last-buffer (get-buffer "*Test*"))
3740
 
#     (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3741
 
#            (display-buffer-overriding-action
3742
 
#             `((display-buffer-in-side-window) (side . ,side)
3743
 
#               (window-height . fit-window-to-buffer)
3744
 
#               (window-width . fit-window-to-buffer))))
3745
 
#       (display-buffer "*Test*"))))
3746
 
# eval:
3747
 
# (progn
3748
 
#   (let* ((run-extra-tests (lambda () (interactive)
3749
 
#                             (funcall run-tests t)))
3750
 
#          (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3751
 
#          (outer-keymap `(keymap (3 . ,inner-keymap))))     ; C-c
3752
 
#     (setq minor-mode-overriding-map-alist
3753
 
#           (cons `(run-tests . ,outer-keymap)
3754
 
#                 minor-mode-overriding-map-alist)))
3755
 
#   (add-hook 'after-save-hook run-tests 90 t))
3756
 
# End:
 
3623
 
 
3624
if __name__ == '__main__':
 
3625
    main()