To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 977
- compare with another revision
- download diff
- download tarball
- view history from revision 977
- Committer: Teddy Hogeborn
- Date: 2019-02-11 06:14:29 UTC
- Revision ID: teddy@recompile.se-20190211061429-n6n5zk29iatshlb3
Fix Debian package dependencies
* debian/control (Build-Depends): Changed GnuTLS dependencies to
"libgnutls30 (>= 3.3.0),
libgnutls28-dev (>= 3.6.6) |
libgnutls28-dev (<< 3.6.0)". (We
can't depend on the virtual package
"gnutls-dev", since we need the
version restrictions.)
(Package: mandos/Depends): Remove dependency on libgnutls28-dev
package.
(Package: mandos/Suggests): New; set to "libc6-dev,
c-compiler". (Used to find value of
"SO_BINDTODEVICE").
(Package: mandos-client/Depends): Don't depend on openssl anymore;
instead depend on either a
gnutls-bin (>= 3.6.6) (in which
case TLS key generation will
work), or on libgnutls30 (<<
3.6.0) (in which case TLS key
generation will not be needed).
* debian/control (Build-Depends): Changed GnuTLS dependencies to
"libgnutls30 (>= 3.3.0),
libgnutls28-dev (>= 3.6.6) |
libgnutls28-dev (<< 3.6.0)". (We
can't depend on the virtual package
"gnutls-dev", since we need the
version restrictions.)
(Package: mandos/Depends): Remove dependency on libgnutls28-dev
package.
(Package: mandos/Suggests): New; set to "libc6-dev,
c-compiler". (Used to find value of
"SO_BINDTODEVICE").
(Package: mandos-client/Depends): Don't depend on openssl anymore;
instead depend on either a
gnutls-bin (>= 3.6.6) (in which
case TLS key generation will
work), or on libgnutls30 (<<
3.6.0) (in which case TLS key
generation will not be needed).
- files removed:
- debian/po/POTFILES.in
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- coding: utf-8; lexical-binding: t -*-
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
31
31
#
32
32
# Contact the authors at <mandos@recompile.se>.
33
33
#
34
34
35
from __future__ import (division, absolute_import, print_function,
35
36
unicode_literals)
36
37
39
40
except ImportError:
40
41
pass
41
42
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
47
43
try:
48
44
import SocketServer as socketserver
49
45
except ImportError:
50
46
import socketserver
51
47
import socket
48
import argparse
52
49
import datetime
53
50
import errno
54
51
try:
55
52
import ConfigParser as configparser
56
53
except ImportError:
57
54
import configparser
55
import sys
58
56
import re
57
import os
59
58
import signal
60
59
import subprocess
61
60
import atexit
62
61
import stat
62
import logging
63
63
import logging.handlers
64
64
import pwd
65
65
import contextlib
77
77
import itertools
78
78
import collections
79
79
import codecs
80
import random
81
import shlex
82
80
83
81
import dbus
84
82
import dbus.service
85
import gi
86
83
from gi.repository import GLib
87
84
from dbus.mainloop.glib import DBusGMainLoop
88
85
import ctypes
90
87
import xml.dom.minidom
91
88
import inspect
92
89
93
if sys.version_info.major == 2:
94
__metaclass__ = type
95
str = unicode
96
input = raw_input
97
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
# Show warnings by default
114
if not sys.warnoptions:
115
import warnings
116
warnings.simplefilter("default")
117
118
90
# Try to find the value of SO_BINDTODEVICE:
119
91
try:
120
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
140
112
# No value found
141
113
SO_BINDTODEVICE = None
142
114
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
115
if sys.version_info.major == 2:
116
str = unicode
145
117
146
version = "1.8.15"
118
version = "1.8.2"
147
119
stored_state_file = "clients.pickle"
148
120
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
150
logging.captureWarnings(True) # Show warnings via the logging system
121
logger = logging.getLogger()
151
122
syslogger = None
152
123
153
124
try:
189
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
161
address="/dev/log"))
191
162
syslogger.setFormatter(logging.Formatter
192
("Mandos [%(process)d]: %(levelname)s:"
193
" %(message)s"))
194
log.addHandler(syslogger)
163
('Mandos [%(process)d]: %(levelname)s:'
164
' %(message)s'))
165
logger.addHandler(syslogger)
195
166
196
167
if debug:
197
168
console = logging.StreamHandler()
198
console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
" [%(process)d]:"
200
" %(levelname)s:"
201
" %(message)s"))
202
log.addHandler(console)
203
log.setLevel(level)
169
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
170
' [%(process)d]:'
171
' %(levelname)s:'
172
' %(message)s'))
173
logger.addHandler(console)
174
logger.setLevel(level)
204
175
205
176
206
177
class PGPError(Exception):
208
179
pass
209
180
210
181
211
class PGPEngine:
182
class PGPEngine(object):
212
183
"""A simple class for OpenPGP symmetric encryption & decryption"""
213
184
214
185
def __init__(self):
218
189
output = subprocess.check_output(["gpgconf"])
219
190
for line in output.splitlines():
220
191
name, text, path = line.split(b":")
221
if name == b"gpg":
192
if name == "gpg":
222
193
self.gpg = path
223
194
break
224
195
except OSError as e:
225
196
if e.errno != errno.ENOENT:
226
197
raise
227
self.gnupgargs = ["--batch",
228
"--homedir", self.tempdir,
229
"--force-mdc",
230
"--quiet"]
198
self.gnupgargs = ['--batch',
199
'--homedir', self.tempdir,
200
'--force-mdc',
201
'--quiet']
231
202
# Only GPG version 1 has the --no-use-agent option.
232
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
203
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
233
204
self.gnupgargs.append("--no-use-agent")
234
205
235
206
def __enter__(self):
272
243
dir=self.tempdir) as passfile:
273
244
passfile.write(passphrase)
274
245
passfile.flush()
275
proc = subprocess.Popen([self.gpg, "--symmetric",
276
"--passphrase-file",
246
proc = subprocess.Popen([self.gpg, '--symmetric',
247
'--passphrase-file',
277
248
passfile.name]
278
249
+ self.gnupgargs,
279
250
stdin=subprocess.PIPE,
290
261
dir=self.tempdir) as passfile:
291
262
passfile.write(passphrase)
292
263
passfile.flush()
293
proc = subprocess.Popen([self.gpg, "--decrypt",
294
"--passphrase-file",
264
proc = subprocess.Popen([self.gpg, '--decrypt',
265
'--passphrase-file',
295
266
passfile.name]
296
267
+ self.gnupgargs,
297
268
stdin=subprocess.PIPE,
304
275
305
276
306
277
# Pretend that we have an Avahi module
307
class avahi:
308
"""This isn't so much a class as it is a module-like namespace."""
278
class Avahi(object):
279
"""This isn't so much a class as it is a module-like namespace.
280
It is instantiated once, and simulates having an Avahi module."""
309
281
IF_UNSPEC = -1 # avahi-common/address.h
310
282
PROTO_UNSPEC = -1 # avahi-common/address.h
311
283
PROTO_INET = 0 # avahi-common/address.h
315
287
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
288
DBUS_PATH_SERVER = "/"
317
289
318
@staticmethod
319
def string_array_to_txt_array(t):
290
def string_array_to_txt_array(self, t):
320
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
292
for s in t), signature="ay")
322
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
327
298
SERVER_RUNNING = 2 # avahi-common/defs.h
328
299
SERVER_COLLISION = 3 # avahi-common/defs.h
329
300
SERVER_FAILURE = 4 # avahi-common/defs.h
301
avahi = Avahi()
330
302
331
303
332
304
class AvahiError(Exception):
344
316
pass
345
317
346
318
347
class AvahiService:
319
class AvahiService(object):
348
320
"""An Avahi (Zeroconf) service.
349
321
350
322
Attributes:
351
323
interface: integer; avahi.IF_UNSPEC or an interface index.
352
324
Used to optionally bind to the specified interface.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
325
name: string; Example: 'Mandos'
326
type: string; Example: '_mandos._tcp'.
355
327
See <https://www.iana.org/assignments/service-names-port-numbers>
356
328
port: integer; what port to announce
357
329
TXT: list of strings; TXT record for the service
394
366
def rename(self, remove=True):
395
367
"""Derived from the Avahi example code"""
396
368
if self.rename_count >= self.max_renames:
397
log.critical("No suitable Zeroconf service name found"
398
" after %i retries, exiting.",
399
self.rename_count)
369
logger.critical("No suitable Zeroconf service name found"
370
" after %i retries, exiting.",
371
self.rename_count)
400
372
raise AvahiServiceError("Too many renames")
401
373
self.name = str(
402
374
self.server.GetAlternativeServiceName(self.name))
403
375
self.rename_count += 1
404
log.info("Changing Zeroconf service name to %r ...",
405
self.name)
376
logger.info("Changing Zeroconf service name to %r ...",
377
self.name)
406
378
if remove:
407
379
self.remove()
408
380
try:
410
382
except dbus.exceptions.DBusException as error:
411
383
if (error.get_dbus_name()
412
384
== "org.freedesktop.Avahi.CollisionError"):
413
log.info("Local Zeroconf service name collision.")
385
logger.info("Local Zeroconf service name collision.")
414
386
return self.rename(remove=False)
415
387
else:
416
log.critical("D-Bus Exception", exc_info=error)
388
logger.critical("D-Bus Exception", exc_info=error)
417
389
self.cleanup()
418
390
os._exit(1)
419
391
435
407
avahi.DBUS_INTERFACE_ENTRY_GROUP)
436
408
self.entry_group_state_changed_match = (
437
409
self.group.connect_to_signal(
438
"StateChanged", self.entry_group_state_changed))
439
log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
self.name, self.type)
410
'StateChanged', self.entry_group_state_changed))
411
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
412
self.name, self.type)
441
413
self.group.AddService(
442
414
self.interface,
443
415
self.protocol,
450
422
451
423
def entry_group_state_changed(self, state, error):
452
424
"""Derived from the Avahi example code"""
453
log.debug("Avahi entry group state change: %i", state)
425
logger.debug("Avahi entry group state change: %i", state)
454
426
455
427
if state == avahi.ENTRY_GROUP_ESTABLISHED:
456
log.debug("Zeroconf service established.")
428
logger.debug("Zeroconf service established.")
457
429
elif state == avahi.ENTRY_GROUP_COLLISION:
458
log.info("Zeroconf service name collision.")
430
logger.info("Zeroconf service name collision.")
459
431
self.rename()
460
432
elif state == avahi.ENTRY_GROUP_FAILURE:
461
log.critical("Avahi: Error in group state changed %s",
462
str(error))
433
logger.critical("Avahi: Error in group state changed %s",
434
str(error))
463
435
raise AvahiGroupError("State changed: {!s}".format(error))
464
436
465
437
def cleanup(self):
475
447
476
448
def server_state_changed(self, state, error=None):
477
449
"""Derived from the Avahi example code"""
478
log.debug("Avahi server state change: %i", state)
450
logger.debug("Avahi server state change: %i", state)
479
451
bad_states = {
480
452
avahi.SERVER_INVALID: "Zeroconf server invalid",
481
453
avahi.SERVER_REGISTERING: None,
485
457
if state in bad_states:
486
458
if bad_states[state] is not None:
487
459
if error is None:
488
log.error(bad_states[state])
460
logger.error(bad_states[state])
489
461
else:
490
log.error(bad_states[state] + ": %r", error)
462
logger.error(bad_states[state] + ": %r", error)
491
463
self.cleanup()
492
464
elif state == avahi.SERVER_RUNNING:
493
465
try:
495
467
except dbus.exceptions.DBusException as error:
496
468
if (error.get_dbus_name()
497
469
== "org.freedesktop.Avahi.CollisionError"):
498
log.info("Local Zeroconf service name collision.")
470
logger.info("Local Zeroconf service name"
471
" collision.")
499
472
return self.rename(remove=False)
500
473
else:
501
log.critical("D-Bus Exception", exc_info=error)
474
logger.critical("D-Bus Exception", exc_info=error)
502
475
self.cleanup()
503
476
os._exit(1)
504
477
else:
505
478
if error is None:
506
log.debug("Unknown state: %r", state)
479
logger.debug("Unknown state: %r", state)
507
480
else:
508
log.debug("Unknown state: %r: %r", state, error)
481
logger.debug("Unknown state: %r: %r", state, error)
509
482
510
483
def activate(self):
511
484
"""Derived from the Avahi example code"""
523
496
class AvahiServiceToSyslog(AvahiService):
524
497
def rename(self, *args, **kwargs):
525
498
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
527
**kwargs)
499
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
528
500
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
501
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
502
.format(self.name)))
531
503
return ret
532
504
533
505
534
506
# Pretend that we have a GnuTLS module
535
class gnutls:
536
"""This isn't so much a class as it is a module-like namespace."""
507
class GnuTLS(object):
508
"""This isn't so much a class as it is a module-like namespace.
509
It is instantiated once, and simulates having a GnuTLS module."""
537
510
538
511
library = ctypes.util.find_library("gnutls")
539
512
if library is None:
540
513
library = ctypes.util.find_library("gnutls-deb0")
541
514
_library = ctypes.cdll.LoadLibrary(library)
542
515
del library
516
_need_version = b"3.3.0"
517
_tls_rawpk_version = b"3.6.6"
518
519
def __init__(self):
520
# Need to use "self" here, since this method is called before
521
# the assignment to the "gnutls" global variable happens.
522
if self.check_version(self._need_version) is None:
523
raise self.Error("Needs GnuTLS {} or later"
524
.format(self._need_version))
543
525
544
526
# Unless otherwise indicated, the constants and types below are
545
527
# all from the gnutls/gnutls.h C header file.
562
544
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
563
545
564
546
# Types
565
class _session_int(ctypes.Structure):
547
class session_int(ctypes.Structure):
566
548
_fields_ = []
567
session_t = ctypes.POINTER(_session_int)
549
session_t = ctypes.POINTER(session_int)
568
550
569
551
class certificate_credentials_st(ctypes.Structure):
570
552
_fields_ = []
573
555
certificate_type_t = ctypes.c_int
574
556
575
557
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
558
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
559
('size', ctypes.c_uint)]
578
560
579
class _openpgp_crt_int(ctypes.Structure):
561
class openpgp_crt_int(ctypes.Structure):
580
562
_fields_ = []
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
563
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
582
564
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
565
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
566
credentials_type_t = ctypes.c_int
587
569
588
570
# Exceptions
589
571
class Error(Exception):
572
# We need to use the class name "GnuTLS" here, since this
573
# exception might be raised from within GnuTLS.__init__,
574
# which is called before the assignment to the "gnutls"
575
# global variable has happened.
590
576
def __init__(self, message=None, code=None, args=()):
591
577
# Default usage is by a message string, but if a return
592
578
# code is passed, convert it to a string with
593
579
# gnutls.strerror()
594
580
self.code = code
595
581
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
598
return super(gnutls.Error, self).__init__(
582
message = GnuTLS.strerror(code)
583
return super(GnuTLS.Error, self).__init__(
599
584
message, *args)
600
585
601
586
class CertificateSecurityError(Error):
602
587
pass
603
588
604
class PointerTo:
605
def __init__(self, cls):
606
self.cls = cls
607
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
613
614
class CastToVoidPointer:
615
def __init__(self, cls):
616
self.cls = cls
617
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
class With_from_param:
625
@classmethod
626
def from_param(cls, obj):
627
return obj._as_parameter_
628
629
589
# Classes
630
class Credentials(With_from_param):
590
class Credentials(object):
631
591
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
592
self._c_object = gnutls.certificate_credentials_t()
593
gnutls.certificate_allocate_credentials(
594
ctypes.byref(self._c_object))
634
595
self.type = gnutls.CRD_CERTIFICATE
635
596
636
597
def __del__(self):
637
gnutls.certificate_free_credentials(self)
598
gnutls.certificate_free_credentials(self._c_object)
638
599
639
class ClientSession(With_from_param):
600
class ClientSession(object):
640
601
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
602
self._c_object = gnutls.session_t()
642
603
gnutls_flags = gnutls.CLIENT
643
if gnutls.check_version(b"3.5.6"):
604
if gnutls.check_version("3.5.6"):
644
605
gnutls_flags |= gnutls.NO_TICKETS
645
606
if gnutls.has_rawpk:
646
607
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
608
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
648
609
del gnutls_flags
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
610
gnutls.set_default_priority(self._c_object)
611
gnutls.transport_set_ptr(self._c_object, socket.fileno())
612
gnutls.handshake_set_private_extensions(self._c_object,
613
True)
652
614
self.socket = socket
653
615
if credentials is None:
654
616
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
656
credentials)
617
gnutls.credentials_set(self._c_object, credentials.type,
618
ctypes.cast(credentials._c_object,
619
ctypes.c_void_p))
657
620
self.credentials = credentials
658
621
659
622
def __del__(self):
660
gnutls.deinit(self)
623
gnutls.deinit(self._c_object)
661
624
662
625
def handshake(self):
663
return gnutls.handshake(self)
626
return gnutls.handshake(self._c_object)
664
627
665
628
def send(self, data):
666
629
data = bytes(data)
667
630
data_len = len(data)
668
631
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
632
data_len -= gnutls.record_send(self._c_object,
633
data[-data_len:],
670
634
data_len)
671
635
672
636
def bye(self):
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
637
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
674
638
675
639
# Error handling functions
676
640
def _error_code(result):
677
641
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
642
for the 'restype' attribute on ctypes functions"""
643
if result >= 0:
680
644
return result
681
645
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
646
raise gnutls.CertificateSecurityError(code=result)
683
647
raise gnutls.Error(code=result)
684
648
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
649
def _retry_on_error(result, func, arguments):
687
650
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
651
for the 'errcheck' attribute on ctypes functions"""
652
while result < 0:
690
653
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
654
return _error_code(result)
692
655
result = func(*arguments)
697
660
698
661
# Functions
699
662
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
663
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
664
ctypes.POINTER(ctypes.c_char_p)]
702
665
priority_set_direct.restype = _error_code
703
666
704
667
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
668
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
669
init.restype = _error_code
707
670
708
671
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
672
set_default_priority.argtypes = [session_t]
710
673
set_default_priority.restype = _error_code
711
674
712
675
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
676
record_send.argtypes = [session_t, ctypes.c_void_p,
714
677
ctypes.c_size_t]
715
678
record_send.restype = ctypes.c_ssize_t
716
679
record_send.errcheck = _retry_on_error
718
681
certificate_allocate_credentials = (
719
682
_library.gnutls_certificate_allocate_credentials)
720
683
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
684
ctypes.POINTER(certificate_credentials_t)]
722
685
certificate_allocate_credentials.restype = _error_code
723
686
724
687
certificate_free_credentials = (
725
688
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
689
certificate_free_credentials.argtypes = [
690
certificate_credentials_t]
727
691
certificate_free_credentials.restype = None
728
692
729
693
handshake_set_private_extensions = (
730
694
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
695
handshake_set_private_extensions.argtypes = [session_t,
732
696
ctypes.c_int]
733
697
handshake_set_private_extensions.restype = None
734
698
735
699
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
700
credentials_set.argtypes = [session_t, credentials_type_t,
701
ctypes.c_void_p]
738
702
credentials_set.restype = _error_code
739
703
740
704
strerror = _library.gnutls_strerror
742
706
strerror.restype = ctypes.c_char_p
743
707
744
708
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
709
certificate_type_get.argtypes = [session_t]
746
710
certificate_type_get.restype = _error_code
747
711
748
712
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
713
certificate_get_peers.argtypes = [session_t,
750
714
ctypes.POINTER(ctypes.c_uint)]
751
715
certificate_get_peers.restype = ctypes.POINTER(datum_t)
752
716
759
723
global_set_log_function.restype = None
760
724
761
725
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
726
deinit.argtypes = [session_t]
763
727
deinit.restype = None
764
728
765
729
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
730
handshake.argtypes = [session_t]
731
handshake.restype = _error_code
768
732
handshake.errcheck = _retry_on_error
769
733
770
734
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
735
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
736
transport_set_ptr.restype = None
773
737
774
738
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
739
bye.argtypes = [session_t, close_request_t]
740
bye.restype = _error_code
777
741
bye.errcheck = _retry_on_error
778
742
779
743
check_version = _library.gnutls_check_version
780
744
check_version.argtypes = [ctypes.c_char_p]
781
745
check_version.restype = ctypes.c_char_p
782
746
783
_need_version = b"3.3.0"
784
if check_version(_need_version) is None:
785
raise self.Error("Needs GnuTLS {} or later"
786
.format(_need_version))
787
788
_tls_rawpk_version = b"3.6.6"
789
747
has_rawpk = bool(check_version(_tls_rawpk_version))
790
748
791
749
if has_rawpk:
796
754
797
755
x509_crt_fmt_t = ctypes.c_int
798
756
799
# All the function declarations below are from
800
# gnutls/abstract.h
757
# All the function declarations below are from gnutls/abstract.h
801
758
pubkey_init = _library.gnutls_pubkey_init
802
759
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
760
pubkey_init.restype = _error_code
817
774
pubkey_deinit.argtypes = [pubkey_t]
818
775
pubkey_deinit.restype = None
819
776
else:
820
# All the function declarations below are from
821
# gnutls/openpgp.h
777
# All the function declarations below are from gnutls/openpgp.h
822
778
823
779
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
780
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
830
786
openpgp_crt_fmt_t]
831
787
openpgp_crt_import.restype = _error_code
832
788
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
836
openpgp_crt_t,
837
ctypes.c_uint,
838
ctypes.POINTER(ctypes.c_uint),
839
]
789
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
790
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
791
ctypes.POINTER(ctypes.c_uint)]
840
792
openpgp_crt_verify_self.restype = _error_code
841
793
842
794
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
851
803
ctypes.c_size_t)]
852
804
openpgp_crt_get_fingerprint.restype = _error_code
853
805
854
if check_version(b"3.6.4"):
806
if check_version("3.6.4"):
855
807
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
808
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
857
809
certificate_type_get2.restype = _error_code
858
810
859
811
# Remove non-public functions
860
812
del _error_code, _retry_on_error
813
# Create the global "gnutls" object, simulating a module
814
gnutls = GnuTLS()
861
815
862
816
863
817
def call_pipe(connection, # : multiprocessing.Connection
871
825
connection.close()
872
826
873
827
874
class Client:
828
class Client(object):
875
829
"""A representation of a client host served by this server.
876
830
877
831
Attributes:
878
approved: bool(); None if not yet approved/disapproved
832
approved: bool(); 'None' if not yet approved/disapproved
879
833
approval_delay: datetime.timedelta(); Time to wait for approval
880
834
approval_duration: datetime.timedelta(); Duration of one approval
881
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
883
running.
835
checker: subprocess.Popen(); a running checker process used
836
to see if the client lives.
837
'None' if no process is running.
884
838
checker_callback_tag: a GLib event source tag, or None
885
839
checker_command: string; External command which is run to check
886
840
if client lives. %() expansions are done at
1009
963
self.last_enabled = None
1010
964
self.expires = None
1011
965
1012
log.debug("Creating client %r", self.name)
1013
log.debug(" Key ID: %s", self.key_id)
1014
log.debug(" Fingerprint: %s", self.fingerprint)
966
logger.debug("Creating client %r", self.name)
967
logger.debug(" Key ID: %s", self.key_id)
968
logger.debug(" Fingerprint: %s", self.fingerprint)
1015
969
self.created = settings.get("created",
1016
970
datetime.datetime.utcnow())
1017
971
1045
999
if getattr(self, "enabled", False):
1046
1000
# Already enabled
1047
1001
return
1002
self.expires = datetime.datetime.utcnow() + self.timeout
1048
1003
self.enabled = True
1049
1004
self.last_enabled = datetime.datetime.utcnow()
1050
1005
self.init_checker()
1055
1010
if not getattr(self, "enabled", False):
1056
1011
return False
1057
1012
if not quiet:
1058
log.info("Disabling client %s", self.name)
1013
logger.info("Disabling client %s", self.name)
1059
1014
if getattr(self, "disable_initiator_tag", None) is not None:
1060
1015
GLib.source_remove(self.disable_initiator_tag)
1061
1016
self.disable_initiator_tag = None
1073
1028
def __del__(self):
1074
1029
self.disable()
1075
1030
1076
def init_checker(self, randomize_start=False):
1077
# Schedule a new checker to be started a randomly selected
1078
# time (a fraction of 'interval') from now. This spreads out
1079
# the startup of checkers over time when the server is
1080
# started.
1031
def init_checker(self):
1032
# Schedule a new checker to be started an 'interval' from now,
1033
# and every interval from then on.
1081
1034
if self.checker_initiator_tag is not None:
1082
1035
GLib.source_remove(self.checker_initiator_tag)
1083
interval_milliseconds = int(self.interval.total_seconds()
1084
* 1000)
1085
if randomize_start:
1086
delay_milliseconds = random.randrange(
1087
interval_milliseconds + 1)
1088
else:
1089
delay_milliseconds = interval_milliseconds
1090
1036
self.checker_initiator_tag = GLib.timeout_add(
1091
delay_milliseconds, self.start_checker, randomize_start)
1092
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1093
# A checker might take up to an 'interval' of time, so we can
1094
# expire at the soonest one interval after a checker was
1095
# started. Since the initial checker is delayed, the expire
1096
# time might have to be extended.
1097
now = datetime.datetime.utcnow()
1098
self.expires = now + delay + self.interval
1099
# Schedule a disable() at expire time
1037
int(self.interval.total_seconds() * 1000),
1038
self.start_checker)
1039
# Schedule a disable() when 'timeout' has passed
1100
1040
if self.disable_initiator_tag is not None:
1101
1041
GLib.source_remove(self.disable_initiator_tag)
1102
1042
self.disable_initiator_tag = GLib.timeout_add(
1103
int((self.expires - now).total_seconds() * 1000),
1104
self.disable)
1043
int(self.timeout.total_seconds() * 1000), self.disable)
1044
# Also start a new checker *right now*.
1045
self.start_checker()
1105
1046
1106
1047
def checker_callback(self, source, condition, connection,
1107
1048
command):
1108
1049
"""The checker has completed, so take appropriate actions."""
1050
self.checker_callback_tag = None
1051
self.checker = None
1109
1052
# Read return code from connection (see call_pipe)
1110
1053
returncode = connection.recv()
1111
1054
connection.close()
1112
if self.checker is not None:
1113
self.checker.join()
1114
self.checker_callback_tag = None
1115
self.checker = None
1116
1055
1117
1056
if returncode >= 0:
1118
1057
self.last_checker_status = returncode
1119
1058
self.last_checker_signal = None
1120
1059
if self.last_checker_status == 0:
1121
log.info("Checker for %(name)s succeeded", vars(self))
1060
logger.info("Checker for %(name)s succeeded",
1061
vars(self))
1122
1062
self.checked_ok()
1123
1063
else:
1124
log.info("Checker for %(name)s failed", vars(self))
1064
logger.info("Checker for %(name)s failed", vars(self))
1125
1065
else:
1126
1066
self.last_checker_status = -1
1127
1067
self.last_checker_signal = -returncode
1128
log.warning("Checker for %(name)s crashed?", vars(self))
1068
logger.warning("Checker for %(name)s crashed?",
1069
vars(self))
1129
1070
return False
1130
1071
1131
1072
def checked_ok(self):
1150
1091
def need_approval(self):
1151
1092
self.last_approval_request = datetime.datetime.utcnow()
1152
1093
1153
def start_checker(self, start_was_randomized=False):
1094
def start_checker(self):
1154
1095
"""Start a new checker subprocess if one is not running.
1155
1096
1156
1097
If a checker already exists, leave it running and do
1165
1106
# should be.
1166
1107
1167
1108
if self.checker is not None and not self.checker.is_alive():
1168
log.warning("Checker was not alive; joining")
1109
logger.warning("Checker was not alive; joining")
1169
1110
self.checker.join()
1170
1111
self.checker = None
1171
1112
# Start a new checker if needed
1172
1113
if self.checker is None:
1173
1114
# Escape attributes for the shell
1174
1115
escaped_attrs = {
1175
attr: shlex.quote(str(getattr(self, attr)))
1116
attr: re.escape(str(getattr(self, attr)))
1176
1117
for attr in self.runtime_expansions}
1177
1118
try:
1178
1119
command = self.checker_command % escaped_attrs
1179
1120
except TypeError as error:
1180
log.error('Could not format string "%s"',
1181
self.checker_command, exc_info=error)
1121
logger.error('Could not format string "%s"',
1122
self.checker_command,
1123
exc_info=error)
1182
1124
return True # Try again later
1183
1125
self.current_checker_command = command
1184
log.info("Starting checker %r for %s", command, self.name)
1126
logger.info("Starting checker %r for %s", command,
1127
self.name)
1185
1128
# We don't need to redirect stdout and stderr, since
1186
1129
# in normal mode, that is already done by daemon(),
1187
1130
# and in debug mode we don't want to. (Stdin is
1203
1146
kwargs=popen_args)
1204
1147
self.checker.start()
1205
1148
self.checker_callback_tag = GLib.io_add_watch(
1206
GLib.IOChannel.unix_new(pipe[0].fileno()),
1207
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1149
pipe[0].fileno(), GLib.IO_IN,
1208
1150
self.checker_callback, pipe[0], command)
1209
if start_was_randomized:
1210
# We were started after a random delay; Schedule a new
1211
# checker to be started an 'interval' from now, and every
1212
# interval from then on.
1213
now = datetime.datetime.utcnow()
1214
self.checker_initiator_tag = GLib.timeout_add(
1215
int(self.interval.total_seconds() * 1000),
1216
self.start_checker)
1217
self.expires = max(self.expires, now + self.interval)
1218
# Don't start a new checker again after same random delay
1219
return False
1220
1151
# Re-run this periodically if run by GLib.timeout_add
1221
1152
return True
1222
1153
1227
1158
self.checker_callback_tag = None
1228
1159
if getattr(self, "checker", None) is None:
1229
1160
return
1230
log.debug("Stopping checker for %(name)s", vars(self))
1161
logger.debug("Stopping checker for %(name)s", vars(self))
1231
1162
self.checker.terminate()
1232
1163
self.checker = None
1233
1164
1260
1191
func._dbus_name = func.__name__
1261
1192
if func._dbus_name.endswith("_dbus_property"):
1262
1193
func._dbus_name = func._dbus_name[:-14]
1263
func._dbus_get_args_options = {"byte_arrays": byte_arrays}
1194
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1264
1195
return func
1265
1196
1266
1197
return decorator
1355
1286
1356
1287
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1357
1288
out_signature="s",
1358
path_keyword="object_path",
1359
connection_keyword="connection")
1289
path_keyword='object_path',
1290
connection_keyword='connection')
1360
1291
def Introspect(self, object_path, connection):
1361
1292
"""Overloading of standard D-Bus method.
1362
1293
1411
1342
document.unlink()
1412
1343
except (AttributeError, xml.dom.DOMException,
1413
1344
xml.parsers.expat.ExpatError) as error:
1414
log.error("Failed to override Introspection method",
1415
exc_info=error)
1345
logger.error("Failed to override Introspection method",
1346
exc_info=error)
1416
1347
return xmlstring
1417
1348
1418
1349
1476
1407
raise ValueError("Byte arrays not supported for non-"
1477
1408
"'ay' signature {!r}"
1478
1409
.format(prop._dbus_signature))
1479
value = dbus.ByteArray(bytes(value))
1410
value = dbus.ByteArray(b''.join(chr(byte)
1411
for byte in value))
1480
1412
prop(value)
1481
1413
1482
1414
@dbus.service.method(dbus.PROPERTIES_IFACE,
1515
1447
1516
1448
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1517
1449
out_signature="s",
1518
path_keyword="object_path",
1519
connection_keyword="connection")
1450
path_keyword='object_path',
1451
connection_keyword='connection')
1520
1452
def Introspect(self, object_path, connection):
1521
1453
"""Overloading of standard D-Bus method.
1522
1454
1578
1510
document.unlink()
1579
1511
except (AttributeError, xml.dom.DOMException,
1580
1512
xml.parsers.expat.ExpatError) as error:
1581
log.error("Failed to override Introspection method",
1582
exc_info=error)
1513
logger.error("Failed to override Introspection method",
1514
exc_info=error)
1583
1515
return xmlstring
1584
1516
1585
1517
1617
1549
1618
1550
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1619
1551
out_signature="s",
1620
path_keyword="object_path",
1621
connection_keyword="connection")
1552
path_keyword='object_path',
1553
connection_keyword='connection')
1622
1554
def Introspect(self, object_path, connection):
1623
1555
"""Overloading of standard D-Bus method.
1624
1556
1649
1581
document.unlink()
1650
1582
except (AttributeError, xml.dom.DOMException,
1651
1583
xml.parsers.expat.ExpatError) as error:
1652
log.error("Failed to override Introspection method",
1653
exc_info=error)
1584
logger.error("Failed to override Introspection method",
1585
exc_info=error)
1654
1586
return xmlstring
1655
1587
1656
1588
2287
2219
del _interface
2288
2220
2289
2221
2290
class ProxyClient:
2222
class ProxyClient(object):
2291
2223
def __init__(self, child_pipe, key_id, fpr, address):
2292
2224
self._pipe = child_pipe
2293
self._pipe.send(("init", key_id, fpr, address))
2225
self._pipe.send(('init', key_id, fpr, address))
2294
2226
if not self._pipe.recv():
2295
2227
raise KeyError(key_id or fpr)
2296
2228
2297
2229
def __getattribute__(self, name):
2298
if name == "_pipe":
2230
if name == '_pipe':
2299
2231
return super(ProxyClient, self).__getattribute__(name)
2300
self._pipe.send(("getattr", name))
2232
self._pipe.send(('getattr', name))
2301
2233
data = self._pipe.recv()
2302
if data[0] == "data":
2234
if data[0] == 'data':
2303
2235
return data[1]
2304
if data[0] == "function":
2236
if data[0] == 'function':
2305
2237
2306
2238
def func(*args, **kwargs):
2307
self._pipe.send(("funcall", name, args, kwargs))
2239
self._pipe.send(('funcall', name, args, kwargs))
2308
2240
return self._pipe.recv()[1]
2309
2241
2310
2242
return func
2311
2243
2312
2244
def __setattr__(self, name, value):
2313
if name == "_pipe":
2245
if name == '_pipe':
2314
2246
return super(ProxyClient, self).__setattr__(name, value)
2315
self._pipe.send(("setattr", name, value))
2247
self._pipe.send(('setattr', name, value))
2316
2248
2317
2249
2318
2250
class ClientHandler(socketserver.BaseRequestHandler, object):
2323
2255
2324
2256
def handle(self):
2325
2257
with contextlib.closing(self.server.child_pipe) as child_pipe:
2326
log.info("TCP connection from: %s",
2327
str(self.client_address))
2328
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2258
logger.info("TCP connection from: %s",
2259
str(self.client_address))
2260
logger.debug("Pipe FD: %d",
2261
self.server.child_pipe.fileno())
2329
2262
2330
2263
session = gnutls.ClientSession(self.request)
2331
2264
2332
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2265
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2333
2266
# "+AES-256-CBC", "+SHA1",
2334
2267
# "+COMP-NULL", "+CTYPE-OPENPGP",
2335
2268
# "+DHE-DSS"))
2337
2270
priority = self.server.gnutls_priority
2338
2271
if priority is None:
2339
2272
priority = "NORMAL"
2340
gnutls.priority_set_direct(session,
2341
priority.encode("utf-8"), None)
2273
gnutls.priority_set_direct(session._c_object,
2274
priority.encode("utf-8"),
2275
None)
2342
2276
2343
2277
# Start communication using the Mandos protocol
2344
2278
# Get protocol number
2345
2279
line = self.request.makefile().readline()
2346
log.debug("Protocol version: %r", line)
2280
logger.debug("Protocol version: %r", line)
2347
2281
try:
2348
2282
if int(line.strip().split()[0]) > 1:
2349
2283
raise RuntimeError(line)
2350
2284
except (ValueError, IndexError, RuntimeError) as error:
2351
log.error("Unknown protocol version: %s", error)
2285
logger.error("Unknown protocol version: %s", error)
2352
2286
return
2353
2287
2354
2288
# Start GnuTLS connection
2355
2289
try:
2356
2290
session.handshake()
2357
2291
except gnutls.Error as error:
2358
log.warning("Handshake failed: %s", error)
2292
logger.warning("Handshake failed: %s", error)
2359
2293
# Do not run session.bye() here: the session is not
2360
2294
# established. Just abandon the request.
2361
2295
return
2362
log.debug("Handshake succeeded")
2296
logger.debug("Handshake succeeded")
2363
2297
2364
2298
approval_required = False
2365
2299
try:
2366
2300
if gnutls.has_rawpk:
2367
fpr = b""
2301
fpr = ""
2368
2302
try:
2369
2303
key_id = self.key_id(
2370
2304
self.peer_certificate(session))
2371
2305
except (TypeError, gnutls.Error) as error:
2372
log.warning("Bad certificate: %s", error)
2306
logger.warning("Bad certificate: %s", error)
2373
2307
return
2374
log.debug("Key ID: %s",
2375
key_id.decode("utf-8",
2376
errors="replace"))
2308
logger.debug("Key ID: %s", key_id)
2377
2309
2378
2310
else:
2379
key_id = b""
2311
key_id = ""
2380
2312
try:
2381
2313
fpr = self.fingerprint(
2382
2314
self.peer_certificate(session))
2383
2315
except (TypeError, gnutls.Error) as error:
2384
log.warning("Bad certificate: %s", error)
2316
logger.warning("Bad certificate: %s", error)
2385
2317
return
2386
log.debug("Fingerprint: %s", fpr)
2318
logger.debug("Fingerprint: %s", fpr)
2387
2319
2388
2320
try:
2389
2321
client = ProxyClient(child_pipe, key_id, fpr,
2398
2330
2399
2331
while True:
2400
2332
if not client.enabled:
2401
log.info("Client %s is disabled", client.name)
2333
logger.info("Client %s is disabled",
2334
client.name)
2402
2335
if self.server.use_dbus:
2403
2336
# Emit D-Bus signal
2404
2337
client.Rejected("Disabled")
2408
2341
# We are approved or approval is disabled
2409
2342
break
2410
2343
elif client.approved is None:
2411
log.info("Client %s needs approval",
2412
client.name)
2344
logger.info("Client %s needs approval",
2345
client.name)
2413
2346
if self.server.use_dbus:
2414
2347
# Emit D-Bus signal
2415
2348
client.NeedApproval(
2416
2349
client.approval_delay.total_seconds()
2417
2350
* 1000, client.approved_by_default)
2418
2351
else:
2419
log.warning("Client %s was not approved",
2420
client.name)
2352
logger.warning("Client %s was not approved",
2353
client.name)
2421
2354
if self.server.use_dbus:
2422
2355
# Emit D-Bus signal
2423
2356
client.Rejected("Denied")
2431
2364
time2 = datetime.datetime.now()
2432
2365
if (time2 - time) >= delay:
2433
2366
if not client.approved_by_default:
2434
log.warning("Client %s timed out while"
2435
" waiting for approval",
2436
client.name)
2367
logger.warning("Client %s timed out while"
2368
" waiting for approval",
2369
client.name)
2437
2370
if self.server.use_dbus:
2438
2371
# Emit D-Bus signal
2439
2372
client.Rejected("Approval timed out")
2446
2379
try:
2447
2380
session.send(client.secret)
2448
2381
except gnutls.Error as error:
2449
log.warning("gnutls send failed", exc_info=error)
2382
logger.warning("gnutls send failed",
2383
exc_info=error)
2450
2384
return
2451
2385
2452
log.info("Sending secret to %s", client.name)
2386
logger.info("Sending secret to %s", client.name)
2453
2387
# bump the timeout using extended_timeout
2454
2388
client.bump_timeout(client.extended_timeout)
2455
2389
if self.server.use_dbus:
2462
2396
try:
2463
2397
session.bye()
2464
2398
except gnutls.Error as error:
2465
log.warning("GnuTLS bye failed", exc_info=error)
2399
logger.warning("GnuTLS bye failed",
2400
exc_info=error)
2466
2401
2467
2402
@staticmethod
2468
2403
def peer_certificate(session):
2469
2404
"Return the peer's certificate as a bytestring"
2470
2405
try:
2471
cert_type = gnutls.certificate_type_get2(
2472
session, gnutls.CTYPE_PEERS)
2406
cert_type = gnutls.certificate_type_get2(session._c_object,
2407
gnutls.CTYPE_PEERS)
2473
2408
except AttributeError:
2474
cert_type = gnutls.certificate_type_get(session)
2409
cert_type = gnutls.certificate_type_get(session._c_object)
2475
2410
if gnutls.has_rawpk:
2476
2411
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2477
2412
else:
2478
2413
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2479
2414
# If not a valid certificate type...
2480
2415
if cert_type not in valid_cert_types:
2481
log.info("Cert type %r not in %r", cert_type,
2482
valid_cert_types)
2416
logger.info("Cert type %r not in %r", cert_type,
2417
valid_cert_types)
2483
2418
# ...return invalid data
2484
2419
return b""
2485
2420
list_size = ctypes.c_uint(1)
2486
2421
cert_list = (gnutls.certificate_get_peers
2487
(session, ctypes.byref(list_size)))
2422
(session._c_object, ctypes.byref(list_size)))
2488
2423
if not bool(cert_list) and list_size.value != 0:
2489
2424
raise gnutls.Error("error getting peer certificate")
2490
2425
if list_size.value == 0:
2512
2447
buf = ctypes.create_string_buffer(32)
2513
2448
buf_len = ctypes.c_size_t(len(buf))
2514
2449
# Get the key ID from the raw public key into the buffer
2515
gnutls.pubkey_get_key_id(
2516
pubkey,
2517
gnutls.KEYID_USE_SHA256,
2518
ctypes.cast(ctypes.byref(buf),
2519
ctypes.POINTER(ctypes.c_ubyte)),
2520
ctypes.byref(buf_len))
2450
gnutls.pubkey_get_key_id(pubkey,
2451
gnutls.KEYID_USE_SHA256,
2452
ctypes.cast(ctypes.byref(buf),
2453
ctypes.POINTER(ctypes.c_ubyte)),
2454
ctypes.byref(buf_len))
2521
2455
# Deinit the certificate
2522
2456
gnutls.pubkey_deinit(pubkey)
2523
2457
2564
2498
return hex_fpr
2565
2499
2566
2500
2567
class MultiprocessingMixIn:
2501
class MultiprocessingMixIn(object):
2568
2502
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2569
2503
2570
2504
def sub_process_main(self, request, address):
2582
2516
return proc
2583
2517
2584
2518
2585
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2519
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2586
2520
""" adds a pipe to the MixIn """
2587
2521
2588
2522
def process_request(self, request, client_address):
2603
2537
2604
2538
2605
2539
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2606
socketserver.TCPServer):
2607
"""IPv6-capable TCP server. Accepts None as address and/or port
2540
socketserver.TCPServer, object):
2541
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2608
2542
2609
2543
Attributes:
2610
2544
enabled: Boolean; whether this server is activated yet
2661
2595
if SO_BINDTODEVICE is None:
2662
2596
# Fall back to a hard-coded value which seems to be
2663
2597
# common enough.
2664
log.warning("SO_BINDTODEVICE not found, trying 25")
2598
logger.warning("SO_BINDTODEVICE not found, trying 25")
2665
2599
SO_BINDTODEVICE = 25
2666
2600
try:
2667
2601
self.socket.setsockopt(
2669
2603
(self.interface + "\0").encode("utf-8"))
2670
2604
except socket.error as error:
2671
2605
if error.errno == errno.EPERM:
2672
log.error("No permission to bind to interface %s",
2673
self.interface)
2606
logger.error("No permission to bind to"
2607
" interface %s", self.interface)
2674
2608
elif error.errno == errno.ENOPROTOOPT:
2675
log.error("SO_BINDTODEVICE not available; cannot"
2676
" bind to interface %s", self.interface)
2609
logger.error("SO_BINDTODEVICE not available;"
2610
" cannot bind to interface %s",
2611
self.interface)
2677
2612
elif error.errno == errno.ENODEV:
2678
log.error("Interface %s does not exist, cannot"
2679
" bind", self.interface)
2613
logger.error("Interface %s does not exist,"
2614
" cannot bind", self.interface)
2680
2615
else:
2681
2616
raise
2682
2617
# Only bind(2) the socket if we really need to.
2683
2618
if self.server_address[0] or self.server_address[1]:
2684
if self.server_address[1]:
2685
self.allow_reuse_address = True
2686
2619
if not self.server_address[0]:
2687
2620
if self.address_family == socket.AF_INET6:
2688
2621
any_address = "::" # in6addr_any
2741
2674
def add_pipe(self, parent_pipe, proc):
2742
2675
# Call "handle_ipc" for both data and EOF events
2743
2676
GLib.io_add_watch(
2744
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2745
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2677
parent_pipe.fileno(),
2678
GLib.IO_IN | GLib.IO_HUP,
2746
2679
functools.partial(self.handle_ipc,
2747
2680
parent_pipe=parent_pipe,
2748
2681
proc=proc))
2761
2694
request = parent_pipe.recv()
2762
2695
command = request[0]
2763
2696
2764
if command == "init":
2697
if command == 'init':
2765
2698
key_id = request[1].decode("ascii")
2766
2699
fpr = request[2].decode("ascii")
2767
2700
address = request[3]
2768
2701
2769
2702
for c in self.clients.values():
2770
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2771
"27AE41E4649B934CA495991B7852B855"):
2703
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2772
2704
continue
2773
2705
if key_id and c.key_id == key_id:
2774
2706
client = c
2777
2709
client = c
2778
2710
break
2779
2711
else:
2780
log.info("Client not found for key ID: %s, address:"
2781
" %s", key_id or fpr, address)
2712
logger.info("Client not found for key ID: %s, address"
2713
": %s", key_id or fpr, address)
2782
2714
if self.use_dbus:
2783
2715
# Emit D-Bus signal
2784
2716
mandos_dbus_service.ClientNotFound(key_id or fpr,
2787
2719
return False
2788
2720
2789
2721
GLib.io_add_watch(
2790
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2791
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2722
parent_pipe.fileno(),
2723
GLib.IO_IN | GLib.IO_HUP,
2792
2724
functools.partial(self.handle_ipc,
2793
2725
parent_pipe=parent_pipe,
2794
2726
proc=proc,
2797
2729
# remove the old hook in favor of the new above hook on
2798
2730
# same fileno
2799
2731
return False
2800
if command == "funcall":
2732
if command == 'funcall':
2801
2733
funcname = request[1]
2802
2734
args = request[2]
2803
2735
kwargs = request[3]
2804
2736
2805
parent_pipe.send(("data", getattr(client_object,
2737
parent_pipe.send(('data', getattr(client_object,
2806
2738
funcname)(*args,
2807
2739
**kwargs)))
2808
2740
2809
if command == "getattr":
2741
if command == 'getattr':
2810
2742
attrname = request[1]
2811
2743
if isinstance(client_object.__getattribute__(attrname),
2812
collections.abc.Callable):
2813
parent_pipe.send(("function", ))
2744
collections.Callable):
2745
parent_pipe.send(('function', ))
2814
2746
else:
2815
2747
parent_pipe.send((
2816
"data", client_object.__getattribute__(attrname)))
2748
'data', client_object.__getattribute__(attrname)))
2817
2749
2818
if command == "setattr":
2750
if command == 'setattr':
2819
2751
attrname = request[1]
2820
2752
value = request[2]
2821
2753
setattr(client_object, attrname, value)
2826
2758
def rfc3339_duration_to_delta(duration):
2827
2759
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2828
2760
2829
>>> timedelta = datetime.timedelta
2830
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2831
True
2832
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2833
True
2834
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2835
True
2836
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2837
True
2838
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2839
True
2840
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2841
True
2842
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2843
True
2844
>>> del timedelta
2761
>>> rfc3339_duration_to_delta("P7D")
2762
datetime.timedelta(7)
2763
>>> rfc3339_duration_to_delta("PT60S")
2764
datetime.timedelta(0, 60)
2765
>>> rfc3339_duration_to_delta("PT60M")
2766
datetime.timedelta(0, 3600)
2767
>>> rfc3339_duration_to_delta("PT24H")
2768
datetime.timedelta(1)
2769
>>> rfc3339_duration_to_delta("P1W")
2770
datetime.timedelta(7)
2771
>>> rfc3339_duration_to_delta("PT5M30S")
2772
datetime.timedelta(0, 330)
2773
>>> rfc3339_duration_to_delta("P1DT3M20S")
2774
datetime.timedelta(1, 200)
2845
2775
"""
2846
2776
2847
2777
# Parsing an RFC 3339 duration with regular expressions is not
2927
2857
def string_to_delta(interval):
2928
2858
"""Parse a string and return a datetime.timedelta
2929
2859
2930
>>> string_to_delta("7d") == datetime.timedelta(7)
2931
True
2932
>>> string_to_delta("60s") == datetime.timedelta(0, 60)
2933
True
2934
>>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2935
True
2936
>>> string_to_delta("24h") == datetime.timedelta(1)
2937
True
2938
>>> string_to_delta("1w") == datetime.timedelta(7)
2939
True
2940
>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
2941
True
2860
>>> string_to_delta('7d')
2861
datetime.timedelta(7)
2862
>>> string_to_delta('60s')
2863
datetime.timedelta(0, 60)
2864
>>> string_to_delta('60m')
2865
datetime.timedelta(0, 3600)
2866
>>> string_to_delta('24h')
2867
datetime.timedelta(1)
2868
>>> string_to_delta('1w')
2869
datetime.timedelta(7)
2870
>>> string_to_delta('5m 30s')
2871
datetime.timedelta(0, 330)
2942
2872
"""
2943
2873
2944
2874
try:
3046
2976
3047
2977
options = parser.parse_args()
3048
2978
2979
if options.check:
2980
import doctest
2981
fail_count, test_count = doctest.testmod()
2982
sys.exit(os.EX_OK if fail_count == 0 else 1)
2983
3049
2984
# Default values for config file for server-global settings
3050
2985
if gnutls.has_rawpk:
3051
2986
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3071
3006
del priority
3072
3007
3073
3008
# Parse config file for server-global settings
3074
server_config = configparser.ConfigParser(server_defaults)
3009
server_config = configparser.SafeConfigParser(server_defaults)
3075
3010
del server_defaults
3076
3011
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3077
# Convert the ConfigParser object to a dict
3012
# Convert the SafeConfigParser object to a dict
3078
3013
server_settings = server_config.defaults()
3079
3014
# Use the appropriate methods on the non-string config options
3080
3015
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3147
3082
3148
3083
if server_settings["servicename"] != "Mandos":
3149
3084
syslogger.setFormatter(
3150
logging.Formatter("Mandos ({}) [%(process)d]:"
3151
" %(levelname)s: %(message)s".format(
3085
logging.Formatter('Mandos ({}) [%(process)d]:'
3086
' %(levelname)s: %(message)s'.format(
3152
3087
server_settings["servicename"])))
3153
3088
3154
3089
# Parse config file with clients
3155
client_config = configparser.ConfigParser(Client.client_defaults)
3090
client_config = configparser.SafeConfigParser(Client
3091
.client_defaults)
3156
3092
client_config.read(os.path.join(server_settings["configdir"],
3157
3093
"clients.conf"))
3158
3094
3178
3114
try:
3179
3115
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3180
3116
except IOError as e:
3181
log.error("Could not open file %r", pidfilename,
3182
exc_info=e)
3117
logger.error("Could not open file %r", pidfilename,
3118
exc_info=e)
3183
3119
3184
3120
for name, group in (("_mandos", "_mandos"),
3185
3121
("mandos", "mandos"),
3196
3132
try:
3197
3133
os.setgid(gid)
3198
3134
os.setuid(uid)
3199
log.debug("Did setuid/setgid to %s:%s", uid, gid)
3135
if debug:
3136
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3137
gid))
3200
3138
except OSError as error:
3201
log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3202
os.strerror(error.errno))
3139
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3140
.format(uid, gid, os.strerror(error.errno)))
3203
3141
if error.errno != errno.EPERM:
3204
3142
raise
3205
3143
3212
3150
3213
3151
@gnutls.log_func
3214
3152
def debug_gnutls(level, string):
3215
log.debug("GnuTLS: %s",
3216
string[:-1].decode("utf-8", errors="replace"))
3153
logger.debug("GnuTLS: %s", string[:-1])
3217
3154
3218
3155
gnutls.global_set_log_function(debug_gnutls)
3219
3156
3228
3165
# Close all input and output, do double fork, etc.
3229
3166
daemon()
3230
3167
3231
if gi.version_info < (3, 10, 2):
3232
# multiprocessing will use threads, so before we use GLib we
3233
# need to inform GLib that threads will be used.
3234
GLib.threads_init()
3168
# multiprocessing will use threads, so before we use GLib we need
3169
# to inform GLib that threads will be used.
3170
GLib.threads_init()
3235
3171
3236
3172
global main_loop
3237
3173
# From the Avahi example code
3248
3184
"se.bsnet.fukt.Mandos", bus,
3249
3185
do_not_queue=True)
3250
3186
except dbus.exceptions.DBusException as e:
3251
log.error("Disabling D-Bus:", exc_info=e)
3187
logger.error("Disabling D-Bus:", exc_info=e)
3252
3188
use_dbus = False
3253
3189
server_settings["use_dbus"] = False
3254
3190
tcp_server.use_dbus = False
3313
3249
if isinstance(s, bytes)
3314
3250
else s) for s in
3315
3251
value["client_structure"]]
3316
# .name, .host, and .checker_command
3317
for k in ("name", "host", "checker_command"):
3252
# .name & .host
3253
for k in ("name", "host"):
3318
3254
if isinstance(value[k], bytes):
3319
3255
value[k] = value[k].decode("utf-8")
3320
if "key_id" not in value:
3256
if not value.has_key("key_id"):
3321
3257
value["key_id"] = ""
3322
elif "fingerprint" not in value:
3258
elif not value.has_key("fingerprint"):
3323
3259
value["fingerprint"] = ""
3324
3260
# old_client_settings
3325
3261
# .keys()
3330
3266
for key, value in
3331
3267
bytes_old_client_settings.items()}
3332
3268
del bytes_old_client_settings
3333
# .host and .checker_command
3269
# .host
3334
3270
for value in old_client_settings.values():
3335
for attribute in ("host", "checker_command"):
3336
if isinstance(value[attribute], bytes):
3337
value[attribute] = (value[attribute]
3338
.decode("utf-8"))
3271
if isinstance(value["host"], bytes):
3272
value["host"] = (value["host"]
3273
.decode("utf-8"))
3339
3274
os.remove(stored_state_path)
3340
3275
except IOError as e:
3341
3276
if e.errno == errno.ENOENT:
3342
log.warning("Could not load persistent state:"
3343
" %s", os.strerror(e.errno))
3277
logger.warning("Could not load persistent state:"
3278
" {}".format(os.strerror(e.errno)))
3344
3279
else:
3345
log.critical("Could not load persistent state:",
3346
exc_info=e)
3280
logger.critical("Could not load persistent state:",
3281
exc_info=e)
3347
3282
raise
3348
3283
except EOFError as e:
3349
log.warning("Could not load persistent state: EOFError:",
3350
exc_info=e)
3284
logger.warning("Could not load persistent state: "
3285
"EOFError:",
3286
exc_info=e)
3351
3287
3352
3288
with PGPEngine() as pgp:
3353
3289
for client_name, client in clients_data.items():
3380
3316
if client["enabled"]:
3381
3317
if datetime.datetime.utcnow() >= client["expires"]:
3382
3318
if not client["last_checked_ok"]:
3383
log.warning("disabling client %s - Client"
3384
" never performed a successful"
3385
" checker", client_name)
3319
logger.warning(
3320
"disabling client {} - Client never "
3321
"performed a successful checker".format(
3322
client_name))
3386
3323
client["enabled"] = False
3387
3324
elif client["last_checker_status"] != 0:
3388
log.warning("disabling client %s - Client"
3389
" last checker failed with error"
3390
" code %s", client_name,
3391
client["last_checker_status"])
3325
logger.warning(
3326
"disabling client {} - Client last"
3327
" checker failed with error code"
3328
" {}".format(
3329
client_name,
3330
client["last_checker_status"]))
3392
3331
client["enabled"] = False
3393
3332
else:
3394
3333
client["expires"] = (
3395
3334
datetime.datetime.utcnow()
3396
3335
+ client["timeout"])
3397
log.debug("Last checker succeeded, keeping %s"
3398
" enabled", client_name)
3336
logger.debug("Last checker succeeded,"
3337
" keeping {} enabled".format(
3338
client_name))
3399
3339
try:
3400
3340
client["secret"] = pgp.decrypt(
3401
3341
client["encrypted_secret"],
3402
3342
client_settings[client_name]["secret"])
3403
3343
except PGPError:
3404
3344
# If decryption fails, we use secret from new settings
3405
log.debug("Failed to decrypt %s old secret",
3406
client_name)
3345
logger.debug("Failed to decrypt {} old secret".format(
3346
client_name))
3407
3347
client["secret"] = (client_settings[client_name]
3408
3348
["secret"])
3409
3349
3423
3363
server_settings=server_settings)
3424
3364
3425
3365
if not tcp_server.clients:
3426
log.warning("No clients defined")
3366
logger.warning("No clients defined")
3427
3367
3428
3368
if not foreground:
3429
3369
if pidfile is not None:
3432
3372
with pidfile:
3433
3373
print(pid, file=pidfile)
3434
3374
except IOError:
3435
log.error("Could not write to file %r with PID %d",
3436
pidfilename, pid)
3375
logger.error("Could not write to file %r with PID %d",
3376
pidfilename, pid)
3437
3377
del pidfile
3438
3378
del pidfilename
3439
3379
3589
3529
3590
3530
try:
3591
3531
with tempfile.NamedTemporaryFile(
3592
mode="wb",
3532
mode='wb',
3593
3533
suffix=".pickle",
3594
prefix="clients-",
3534
prefix='clients-',
3595
3535
dir=os.path.dirname(stored_state_path),
3596
3536
delete=False) as stored_state:
3597
3537
pickle.dump((clients, client_settings), stored_state,
3605
3545
except NameError:
3606
3546
pass
3607
3547
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3608
log.warning("Could not save persistent state: %s",
3609
os.strerror(e.errno))
3548
logger.warning("Could not save persistent state: {}"
3549
.format(os.strerror(e.errno)))
3610
3550
else:
3611
log.warning("Could not save persistent state:",
3612
exc_info=e)
3551
logger.warning("Could not save persistent state:",
3552
exc_info=e)
3613
3553
raise
3614
3554
3615
3555
# Delete all clients, and settings from config
3632
3572
mandos_dbus_service.client_added_signal(client)
3633
3573
# Need to initiate checking of clients
3634
3574
if client.enabled:
3635
client.init_checker(randomize_start=True)
3575
client.init_checker()
3636
3576
3637
3577
tcp_server.enable()
3638
3578
tcp_server.server_activate()
3641
3581
if zeroconf:
3642
3582
service.port = tcp_server.socket.getsockname()[1]
3643
3583
if use_ipv6:
3644
log.info("Now listening on address %r, port %d, flowinfo %d,"
3645
" scope_id %d", *tcp_server.socket.getsockname())
3584
logger.info("Now listening on address %r, port %d,"
3585
" flowinfo %d, scope_id %d",
3586
*tcp_server.socket.getsockname())
3646
3587
else: # IPv4
3647
log.info("Now listening on address %r, port %d",
3648
*tcp_server.socket.getsockname())
3588
logger.info("Now listening on address %r, port %d",
3589
*tcp_server.socket.getsockname())
3649
3590
3650
3591
# service.interface = tcp_server.socket.getsockname()[3]
3651
3592
3655
3596
try:
3656
3597
service.activate()
3657
3598
except dbus.exceptions.DBusException as error:
3658
log.critical("D-Bus Exception", exc_info=error)
3599
logger.critical("D-Bus Exception", exc_info=error)
3659
3600
cleanup()
3660
3601
sys.exit(1)
3661
3602
# End of Avahi example code
3662
3603
3663
GLib.io_add_watch(
3664
GLib.IOChannel.unix_new(tcp_server.fileno()),
3665
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3666
lambda *args, **kwargs: (tcp_server.handle_request
3667
(*args[2:], **kwargs) or True))
3604
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3605
lambda *args, **kwargs:
3606
(tcp_server.handle_request
3607
(*args[2:], **kwargs) or True))
3668
3608
3669
log.debug("Starting main loop")
3609
logger.debug("Starting main loop")
3670
3610
main_loop.run()
3671
3611
except AvahiError as error:
3672
log.critical("Avahi Error", exc_info=error)
3612
logger.critical("Avahi Error", exc_info=error)
3673
3613
cleanup()
3674
3614
sys.exit(1)
3675
3615
except KeyboardInterrupt:
3676
3616
if debug:
3677
3617
print("", file=sys.stderr)
3678
log.debug("Server received KeyboardInterrupt")
3679
log.debug("Server exiting")
3618
logger.debug("Server received KeyboardInterrupt")
3619
logger.debug("Server exiting")
3680
3620
# Must run before the D-Bus bus name gets deregistered
3681
3621
cleanup()
3682
3622
3683
3684
def parse_test_args():
3685
# type: () -> argparse.Namespace
3686
parser = argparse.ArgumentParser(add_help=False)
3687
parser.add_argument("--check", action="store_true")
3688
parser.add_argument("--prefix", )
3689
args, unknown_args = parser.parse_known_args()
3690
if args.check:
3691
# Remove test options from sys.argv
3692
sys.argv[1:] = unknown_args
3693
return args
3694
3695
# Add all tests from doctest strings
3696
def load_tests(loader, tests, none):
3697
import doctest
3698
tests.addTests(doctest.DocTestSuite())
3699
return tests
3700
3701
if __name__ == "__main__":
3702
options = parse_test_args()
3703
try:
3704
if options.check:
3705
extra_test_prefix = options.prefix
3706
if extra_test_prefix is not None:
3707
if not (unittest.main(argv=[""], exit=False)
3708
.result.wasSuccessful()):
3709
sys.exit(1)
3710
class ExtraTestLoader(unittest.TestLoader):
3711
testMethodPrefix = extra_test_prefix
3712
# Call using ./scriptname --test [--verbose]
3713
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3714
else:
3715
unittest.main(argv=[""])
3716
else:
3717
main()
3718
finally:
3719
logging.shutdown()
3720
3721
# Local Variables:
3722
# run-tests:
3723
# (lambda (&optional extra)
3724
# (if (not (funcall run-tests-in-test-buffer default-directory
3725
# extra))
3726
# (funcall show-test-buffer-in-test-window)
3727
# (funcall remove-test-window)
3728
# (if extra (message "Extra tests run successfully!"))))
3729
# run-tests-in-test-buffer:
3730
# (lambda (dir &optional extra)
3731
# (with-current-buffer (get-buffer-create "*Test*")
3732
# (setq buffer-read-only nil
3733
# default-directory dir)
3734
# (erase-buffer)
3735
# (compilation-mode))
3736
# (let ((process-result
3737
# (let ((inhibit-read-only t))
3738
# (process-file-shell-command
3739
# (funcall get-command-line extra) nil "*Test*"))))
3740
# (and (numberp process-result)
3741
# (= process-result 0))))
3742
# get-command-line:
3743
# (lambda (&optional extra)
3744
# (let ((quoted-script
3745
# (shell-quote-argument (funcall get-script-name))))
3746
# (format
3747
# (concat "%s --check" (if extra " --prefix=atest" ""))
3748
# quoted-script)))
3749
# get-script-name:
3750
# (lambda ()
3751
# (if (fboundp 'file-local-name)
3752
# (file-local-name (buffer-file-name))
3753
# (or (file-remote-p (buffer-file-name) 'localname)
3754
# (buffer-file-name))))
3755
# remove-test-window:
3756
# (lambda ()
3757
# (let ((test-window (get-buffer-window "*Test*")))
3758
# (if test-window (delete-window test-window))))
3759
# show-test-buffer-in-test-window:
3760
# (lambda ()
3761
# (when (not (get-buffer-window-list "*Test*"))
3762
# (setq next-error-last-buffer (get-buffer "*Test*"))
3763
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3764
# (display-buffer-overriding-action
3765
# `((display-buffer-in-side-window) (side . ,side)
3766
# (window-height . fit-window-to-buffer)
3767
# (window-width . fit-window-to-buffer))))
3768
# (display-buffer "*Test*"))))
3769
# eval:
3770
# (progn
3771
# (let* ((run-extra-tests (lambda () (interactive)
3772
# (funcall run-tests t)))
3773
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3774
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3775
# (setq minor-mode-overriding-map-alist
3776
# (cons `(run-tests . ,outer-keymap)
3777
# minor-mode-overriding-map-alist)))
3778
# (add-hook 'after-save-hook run-tests 90 t))
3779
# End:
3623
3624
if __name__ == '__main__':
3625
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0