1

import os

     2

#from binascii import hexlify

     3

from runtime.spawn_subprocess import call

     4

     5

restart_stunnel_cmdline = ["/etc/init.d/S50stunnel","restart"]

     6

     7

# stunnel takes no encoding for PSK, so we try to lose minimum entropy 

     8

# by using all possible chars except '\0\n\r' (checked stunnel parser to be sure)

     9

translator = ''.join([(lambda c: '#' if c in '\0\n\r' else c)(chr(i)) for i in xrange(256)])

    10

    11

_PSKpath = None

    12

    13

def PSKgen(ID, PSKpath):

    14

    15

    # 236 bytes is empirical maximum when using :

    16

    #  - stunnel 5.36 on server with openssl 1.0.2k

    17

    #  - python-sslpsk 1.0.0 on client with openssl 1.0.2k

    18

    secret = os.urandom(236) 

    19

    20

    secretstring = secret.translate(translator)

    21

    PSKstring = ID+":"+secretstring

    22

    with open(PSKpath, 'w') as f:

    23

        f.write(PSKstring)

    24

    call(restart_stunnel_cmdline)

    25

    26

def ensurePSK(ID, PSKpath):

    27

    global _PSKpath

    28

    _PSKpath = PSKpath

    29

    # check if already there

    30

    if not os.path.exists(PSKpath):

    31

        # create if needed

    32

        PSKgen(ID, PSKpath)

    33

    34

def getPSKID():

    35

    if _PSKpath is not None :

    36

        if not os.path.exists(_PSKpath):

    37

            confnodesroot.logger.write_error(

    38

                'Error: Pre-Shared-Key Secret in %s is missing!\n' % _PSKpath)

    39

            return None

    40

        ID,_sep,PSK = open(_PSKpath).read().partition(':')

    41

        PSK = PSK.rstrip('\n\r')

    42

        return (ID,PSK)

    43

    return None

    44