/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2015-08-10 09:00:23 UTC
  • mto: (237.7.594 trunk)
  • mto: This revision was merged to the branch mainline in revision 325.
  • Revision ID: teddy@recompile.se-20150810090023-fz6vjqr7zf33e2tf
Support the standard org.freedesktop.DBus.ObjectManager interface.

Now that the D-Bus standard has an interface to keep track of new and
removed objects, use that instead of our own methods.  This deprecates
our D-Bus methods "GetAllClients" and "GetAllClientsWithProperties"
and the signals "ClientAdded" and "ClientRemoved", all on the server
interface "se.recompile.Mandos".

* DBUS-API: Removed references to deprecated methods and signals;
  insert reference to the org.freedesktop.DBus.ObjectManager
  interface.
* mandos (DBusObjectWithProperties._get_all_interface_names): New.
  (dbus.OBJECT_MANAGER_IFACE): If not present, monkey patch.
  (DBusObjectWithObjectManager): New.
  (main/MandosDBusService): Inherit from DBusObjectWithObjectManager.
  (main/MandosDBusService.ClientRemoved): Annotate as deprecated.
  (main/MandosDBusService.GetAllClients): - '' -
  (main/MandosDBusService.GetAllClientsWithProperties): Annotate as
                                                        deprecated.
                                                        Also only
                                                        return
                                                        properties on
                                                        client
                                                        interface.
  (main/MandosDBusService.RemoveClient): Call client_removed_signal
                                         instead of ClientRemoved.
  (main/MandosDBusService.GetManagedObjects): New.
  (main/MandosDBusService.client_added_signal): New.
  (main/MandosDBusService.client_removed_signal): - '' -
  (main/cleanup): Call "client_removed_signal" instead of sending
                  "ClientRemoved" signal directly.
  (main): Call "client_added_signal" instead of sending "ClientAdded"
          signal directly.
* mandos-ctl: Use GetManagedObjects instead of
              GetAllClientsWithProperties.  Also, show better error
              message in case of failure to connect to the D-Bus

* mandos-monitor (MandosClientPropertyCache.properties_changed):
  Bug fix; only update properties on client interface.
  (UserInterface.find_and_remove_client): Change to accept arguments
                                          from InterfacesRemoved
                                          signal.  Also, bug fix:
                                          working error message when
                                          removing unknown client.
  (UserInterface.add_new_client): Change to accept arguments from
                                  InterfacesRemoved signal.  Pass
                                  properties to MandosClientWidget
                                  constructor.
  (UserInterface.run): Connect find_and_remove_client method to
                       InterfacesRemoved signal and the add_new_client
                       method to the InterfacesAdded signal.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
1
 
#!/usr/bin/python
 
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
# 
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008-2016 Teddy Hogeborn
15
 
# Copyright © 2008-2016 Björn Påhlsson
 
14
# Copyright © 2008-2015 Teddy Hogeborn
 
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
44
44
import argparse
45
45
import datetime
46
46
import errno
 
47
import gnutls.crypto
 
48
import gnutls.connection
 
49
import gnutls.errors
 
50
import gnutls.library.functions
 
51
import gnutls.library.constants
 
52
import gnutls.library.types
47
53
try:
48
54
    import ConfigParser as configparser
49
55
except ImportError:
98
104
if sys.version_info.major == 2:
99
105
    str = unicode
100
106
 
101
 
version = "1.7.3"
 
107
version = "1.6.9"
102
108
stored_state_file = "clients.pickle"
103
109
 
104
110
logger = logging.getLogger()
151
157
    
152
158
    def __init__(self):
153
159
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
154
 
        self.gpg = "gpg"
155
 
        try:
156
 
            output = subprocess.check_output(["gpgconf"])
157
 
            for line in output.splitlines():
158
 
                name, text, path = line.split(":")
159
 
                if name == "gpg":
160
 
                    self.gpg = path
161
 
                    break
162
 
        except OSError as e:
163
 
            if e.errno != errno.ENOENT:
164
 
                raise
165
160
        self.gnupgargs = ['--batch',
166
 
                          '--homedir', self.tempdir,
 
161
                          '--home', self.tempdir,
167
162
                          '--force-mdc',
168
163
                          '--quiet',
169
164
                          '--no-use-agent']
208
203
                dir=self.tempdir) as passfile:
209
204
            passfile.write(passphrase)
210
205
            passfile.flush()
211
 
            proc = subprocess.Popen([self.gpg, '--symmetric',
 
206
            proc = subprocess.Popen(['gpg', '--symmetric',
212
207
                                     '--passphrase-file',
213
208
                                     passfile.name]
214
209
                                    + self.gnupgargs,
226
221
                dir = self.tempdir) as passfile:
227
222
            passfile.write(passphrase)
228
223
            passfile.flush()
229
 
            proc = subprocess.Popen([self.gpg, '--decrypt',
 
224
            proc = subprocess.Popen(['gpg', '--decrypt',
230
225
                                     '--passphrase-file',
231
226
                                     passfile.name]
232
227
                                    + self.gnupgargs,
440
435
            .format(self.name)))
441
436
        return ret
442
437
 
443
 
# Pretend that we have a GnuTLS module
444
 
class GnuTLS(object):
445
 
    """This isn't so much a class as it is a module-like namespace.
446
 
    It is instantiated once, and simulates having a GnuTLS module."""
447
 
    
448
 
    _library = ctypes.cdll.LoadLibrary(
449
 
        ctypes.util.find_library("gnutls"))
450
 
    _need_version = "3.3.0"
451
 
    def __init__(self):
452
 
        # Need to use class name "GnuTLS" here, since this method is
453
 
        # called before the assignment to the "gnutls" global variable
454
 
        # happens.
455
 
        if GnuTLS.check_version(self._need_version) is None:
456
 
            raise GnuTLS.Error("Needs GnuTLS {} or later"
457
 
                               .format(self._need_version))
458
 
    
459
 
    # Unless otherwise indicated, the constants and types below are
460
 
    # all from the gnutls/gnutls.h C header file.
461
 
    
462
 
    # Constants
463
 
    E_SUCCESS = 0
464
 
    E_INTERRUPTED = -52
465
 
    E_AGAIN = -28
466
 
    CRT_OPENPGP = 2
467
 
    CLIENT = 2
468
 
    SHUT_RDWR = 0
469
 
    CRD_CERTIFICATE = 1
470
 
    E_NO_CERTIFICATE_FOUND = -49
471
 
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
472
 
    
473
 
    # Types
474
 
    class session_int(ctypes.Structure):
475
 
        _fields_ = []
476
 
    session_t = ctypes.POINTER(session_int)
477
 
    class certificate_credentials_st(ctypes.Structure):
478
 
        _fields_ = []
479
 
    certificate_credentials_t = ctypes.POINTER(
480
 
        certificate_credentials_st)
481
 
    certificate_type_t = ctypes.c_int
482
 
    class datum_t(ctypes.Structure):
483
 
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
484
 
                    ('size', ctypes.c_uint)]
485
 
    class openpgp_crt_int(ctypes.Structure):
486
 
        _fields_ = []
487
 
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
488
 
    openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
489
 
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
490
 
    credentials_type_t = ctypes.c_int # 
491
 
    transport_ptr_t = ctypes.c_void_p
492
 
    close_request_t = ctypes.c_int
493
 
    
494
 
    # Exceptions
495
 
    class Error(Exception):
496
 
        # We need to use the class name "GnuTLS" here, since this
497
 
        # exception might be raised from within GnuTLS.__init__,
498
 
        # which is called before the assignment to the "gnutls"
499
 
        # global variable has happened.
500
 
        def __init__(self, message = None, code = None, args=()):
501
 
            # Default usage is by a message string, but if a return
502
 
            # code is passed, convert it to a string with
503
 
            # gnutls.strerror()
504
 
            self.code = code
505
 
            if message is None and code is not None:
506
 
                message = GnuTLS.strerror(code)
507
 
            return super(GnuTLS.Error, self).__init__(
508
 
                message, *args)
509
 
    
510
 
    class CertificateSecurityError(Error):
511
 
        pass
512
 
    
513
 
    # Classes
514
 
    class Credentials(object):
515
 
        def __init__(self):
516
 
            self._c_object = gnutls.certificate_credentials_t()
517
 
            gnutls.certificate_allocate_credentials(
518
 
                ctypes.byref(self._c_object))
519
 
            self.type = gnutls.CRD_CERTIFICATE
520
 
        
521
 
        def __del__(self):
522
 
            gnutls.certificate_free_credentials(self._c_object)
523
 
    
524
 
    class ClientSession(object):
525
 
        def __init__(self, socket, credentials = None):
526
 
            self._c_object = gnutls.session_t()
527
 
            gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
528
 
            gnutls.set_default_priority(self._c_object)
529
 
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
530
 
            gnutls.handshake_set_private_extensions(self._c_object,
531
 
                                                    True)
532
 
            self.socket = socket
533
 
            if credentials is None:
534
 
                credentials = gnutls.Credentials()
535
 
            gnutls.credentials_set(self._c_object, credentials.type,
536
 
                                   ctypes.cast(credentials._c_object,
537
 
                                               ctypes.c_void_p))
538
 
            self.credentials = credentials
539
 
        
540
 
        def __del__(self):
541
 
            gnutls.deinit(self._c_object)
542
 
        
543
 
        def handshake(self):
544
 
            return gnutls.handshake(self._c_object)
545
 
        
546
 
        def send(self, data):
547
 
            data = bytes(data)
548
 
            data_len = len(data)
549
 
            while data_len > 0:
550
 
                data_len -= gnutls.record_send(self._c_object,
551
 
                                               data[-data_len:],
552
 
                                               data_len)
553
 
        
554
 
        def bye(self):
555
 
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
556
 
    
557
 
    # Error handling functions
558
 
    def _error_code(result):
559
 
        """A function to raise exceptions on errors, suitable
560
 
        for the 'restype' attribute on ctypes functions"""
561
 
        if result >= 0:
562
 
            return result
563
 
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
564
 
            raise gnutls.CertificateSecurityError(code = result)
565
 
        raise gnutls.Error(code = result)
566
 
    
567
 
    def _retry_on_error(result, func, arguments):
568
 
        """A function to retry on some errors, suitable
569
 
        for the 'errcheck' attribute on ctypes functions"""
570
 
        while result < 0:
571
 
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
572
 
                return _error_code(result)
573
 
            result = func(*arguments)
574
 
        return result
575
 
    
576
 
    # Unless otherwise indicated, the function declarations below are
577
 
    # all from the gnutls/gnutls.h C header file.
578
 
    
579
 
    # Functions
580
 
    priority_set_direct = _library.gnutls_priority_set_direct
581
 
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
582
 
                                    ctypes.POINTER(ctypes.c_char_p)]
583
 
    priority_set_direct.restype = _error_code
584
 
    
585
 
    init = _library.gnutls_init
586
 
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
587
 
    init.restype = _error_code
588
 
    
589
 
    set_default_priority = _library.gnutls_set_default_priority
590
 
    set_default_priority.argtypes = [session_t]
591
 
    set_default_priority.restype = _error_code
592
 
    
593
 
    record_send = _library.gnutls_record_send
594
 
    record_send.argtypes = [session_t, ctypes.c_void_p,
595
 
                            ctypes.c_size_t]
596
 
    record_send.restype = ctypes.c_ssize_t
597
 
    record_send.errcheck = _retry_on_error
598
 
    
599
 
    certificate_allocate_credentials = (
600
 
        _library.gnutls_certificate_allocate_credentials)
601
 
    certificate_allocate_credentials.argtypes = [
602
 
        ctypes.POINTER(certificate_credentials_t)]
603
 
    certificate_allocate_credentials.restype = _error_code
604
 
    
605
 
    certificate_free_credentials = (
606
 
        _library.gnutls_certificate_free_credentials)
607
 
    certificate_free_credentials.argtypes = [certificate_credentials_t]
608
 
    certificate_free_credentials.restype = None
609
 
    
610
 
    handshake_set_private_extensions = (
611
 
        _library.gnutls_handshake_set_private_extensions)
612
 
    handshake_set_private_extensions.argtypes = [session_t,
613
 
                                                 ctypes.c_int]
614
 
    handshake_set_private_extensions.restype = None
615
 
    
616
 
    credentials_set = _library.gnutls_credentials_set
617
 
    credentials_set.argtypes = [session_t, credentials_type_t,
618
 
                                ctypes.c_void_p]
619
 
    credentials_set.restype = _error_code
620
 
    
621
 
    strerror = _library.gnutls_strerror
622
 
    strerror.argtypes = [ctypes.c_int]
623
 
    strerror.restype = ctypes.c_char_p
624
 
    
625
 
    certificate_type_get = _library.gnutls_certificate_type_get
626
 
    certificate_type_get.argtypes = [session_t]
627
 
    certificate_type_get.restype = _error_code
628
 
    
629
 
    certificate_get_peers = _library.gnutls_certificate_get_peers
630
 
    certificate_get_peers.argtypes = [session_t,
631
 
                                      ctypes.POINTER(ctypes.c_uint)]
632
 
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
633
 
    
634
 
    global_set_log_level = _library.gnutls_global_set_log_level
635
 
    global_set_log_level.argtypes = [ctypes.c_int]
636
 
    global_set_log_level.restype = None
637
 
    
638
 
    global_set_log_function = _library.gnutls_global_set_log_function
639
 
    global_set_log_function.argtypes = [log_func]
640
 
    global_set_log_function.restype = None
641
 
    
642
 
    deinit = _library.gnutls_deinit
643
 
    deinit.argtypes = [session_t]
644
 
    deinit.restype = None
645
 
    
646
 
    handshake = _library.gnutls_handshake
647
 
    handshake.argtypes = [session_t]
648
 
    handshake.restype = _error_code
649
 
    handshake.errcheck = _retry_on_error
650
 
    
651
 
    transport_set_ptr = _library.gnutls_transport_set_ptr
652
 
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
653
 
    transport_set_ptr.restype = None
654
 
    
655
 
    bye = _library.gnutls_bye
656
 
    bye.argtypes = [session_t, close_request_t]
657
 
    bye.restype = _error_code
658
 
    bye.errcheck = _retry_on_error
659
 
    
660
 
    check_version = _library.gnutls_check_version
661
 
    check_version.argtypes = [ctypes.c_char_p]
662
 
    check_version.restype = ctypes.c_char_p
663
 
    
664
 
    # All the function declarations below are from gnutls/openpgp.h
665
 
    
666
 
    openpgp_crt_init = _library.gnutls_openpgp_crt_init
667
 
    openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
668
 
    openpgp_crt_init.restype = _error_code
669
 
    
670
 
    openpgp_crt_import = _library.gnutls_openpgp_crt_import
671
 
    openpgp_crt_import.argtypes = [openpgp_crt_t,
672
 
                                   ctypes.POINTER(datum_t),
673
 
                                   openpgp_crt_fmt_t]
674
 
    openpgp_crt_import.restype = _error_code
675
 
    
676
 
    openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
677
 
    openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
678
 
                                        ctypes.POINTER(ctypes.c_uint)]
679
 
    openpgp_crt_verify_self.restype = _error_code
680
 
    
681
 
    openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
682
 
    openpgp_crt_deinit.argtypes = [openpgp_crt_t]
683
 
    openpgp_crt_deinit.restype = None
684
 
    
685
 
    openpgp_crt_get_fingerprint = (
686
 
        _library.gnutls_openpgp_crt_get_fingerprint)
687
 
    openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
688
 
                                            ctypes.c_void_p,
689
 
                                            ctypes.POINTER(
690
 
                                                ctypes.c_size_t)]
691
 
    openpgp_crt_get_fingerprint.restype = _error_code
692
 
    
693
 
    # Remove non-public functions
694
 
    del _error_code, _retry_on_error
695
 
# Create the global "gnutls" object, simulating a module
696
 
gnutls = GnuTLS()
697
 
 
698
438
def call_pipe(connection,       # : multiprocessing.Connection
699
439
              func, *args, **kwargs):
700
440
    """This function is meant to be called by multiprocessing.Process
1414
1154
    def InterfacesAdded(self, object_path, interfaces_and_properties):
1415
1155
        pass
1416
1156
    
1417
 
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
 
1157
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
 
1158
                         signature = "oas")
1418
1159
    def InterfacesRemoved(self, object_path, interfaces):
1419
1160
        pass
1420
1161
    
1428
1169
        Override return argument name of GetManagedObjects to be
1429
1170
        "objpath_interfaces_and_properties"
1430
1171
        """
1431
 
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1432
 
                                                         object_path,
1433
 
                                                         connection)
 
1172
        xmlstring = DBusObjectWithAnnotations(self, object_path,
 
1173
                                              connection)
1434
1174
        try:
1435
1175
            document = xml.dom.minidom.parseString(xmlstring)
1436
1176
            
1551
1291
                        func1 and func2 to the "call_both" function
1552
1292
                        outside of its arguments"""
1553
1293
                        
1554
 
                        @functools.wraps(func2)
1555
1294
                        def call_both(*args, **kwargs):
1556
1295
                            """This function will emit two D-Bus
1557
1296
                            signals by calling func1 and func2"""
1558
1297
                            func1(*args, **kwargs)
1559
1298
                            func2(*args, **kwargs)
1560
 
                        # Make wrapper function look like a D-Bus signal
1561
 
                        for name, attr in inspect.getmembers(func2):
1562
 
                            if name.startswith("_dbus_"):
1563
 
                                setattr(call_both, name, attr)
1564
1299
                        
1565
1300
                        return call_both
1566
1301
                    # Create the "call_both" function and add it to
2140
1875
            logger.debug("Pipe FD: %d",
2141
1876
                         self.server.child_pipe.fileno())
2142
1877
            
2143
 
            session = gnutls.ClientSession(self.request)
 
1878
            session = gnutls.connection.ClientSession(
 
1879
                self.request, gnutls.connection .X509Credentials())
 
1880
            
 
1881
            # Note: gnutls.connection.X509Credentials is really a
 
1882
            # generic GnuTLS certificate credentials object so long as
 
1883
            # no X.509 keys are added to it.  Therefore, we can use it
 
1884
            # here despite using OpenPGP certificates.
2144
1885
            
2145
1886
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
2146
1887
            #                      "+AES-256-CBC", "+SHA1",
2150
1891
            priority = self.server.gnutls_priority
2151
1892
            if priority is None:
2152
1893
                priority = "NORMAL"
2153
 
            gnutls.priority_set_direct(session._c_object, priority,
2154
 
                                       None)
 
1894
            gnutls.library.functions.gnutls_priority_set_direct(
 
1895
                session._c_object, priority, None)
2155
1896
            
2156
1897
            # Start communication using the Mandos protocol
2157
1898
            # Get protocol number
2167
1908
            # Start GnuTLS connection
2168
1909
            try:
2169
1910
                session.handshake()
2170
 
            except gnutls.Error as error:
 
1911
            except gnutls.errors.GNUTLSError as error:
2171
1912
                logger.warning("Handshake failed: %s", error)
2172
1913
                # Do not run session.bye() here: the session is not
2173
1914
                # established.  Just abandon the request.
2179
1920
                try:
2180
1921
                    fpr = self.fingerprint(
2181
1922
                        self.peer_certificate(session))
2182
 
                except (TypeError, gnutls.Error) as error:
 
1923
                except (TypeError,
 
1924
                        gnutls.errors.GNUTLSError) as error:
2183
1925
                    logger.warning("Bad certificate: %s", error)
2184
1926
                    return
2185
1927
                logger.debug("Fingerprint: %s", fpr)
2243
1985
                    else:
2244
1986
                        delay -= time2 - time
2245
1987
                
2246
 
                try:
2247
 
                    session.send(client.secret)
2248
 
                except gnutls.Error as error:
2249
 
                    logger.warning("gnutls send failed",
2250
 
                                   exc_info = error)
2251
 
                    return
 
1988
                sent_size = 0
 
1989
                while sent_size < len(client.secret):
 
1990
                    try:
 
1991
                        sent = session.send(client.secret[sent_size:])
 
1992
                    except gnutls.errors.GNUTLSError as error:
 
1993
                        logger.warning("gnutls send failed",
 
1994
                                       exc_info=error)
 
1995
                        return
 
1996
                    logger.debug("Sent: %d, remaining: %d", sent,
 
1997
                                 len(client.secret) - (sent_size
 
1998
                                                       + sent))
 
1999
                    sent_size += sent
2252
2000
                
2253
2001
                logger.info("Sending secret to %s", client.name)
2254
2002
                # bump the timeout using extended_timeout
2262
2010
                    client.approvals_pending -= 1
2263
2011
                try:
2264
2012
                    session.bye()
2265
 
                except gnutls.Error as error:
 
2013
                except gnutls.errors.GNUTLSError as error:
2266
2014
                    logger.warning("GnuTLS bye failed",
2267
2015
                                   exc_info=error)
2268
2016
    
2270
2018
    def peer_certificate(session):
2271
2019
        "Return the peer's OpenPGP certificate as a bytestring"
2272
2020
        # If not an OpenPGP certificate...
2273
 
        if (gnutls.certificate_type_get(session._c_object)
2274
 
            != gnutls.CRT_OPENPGP):
2275
 
            # ...return invalid data
2276
 
            return b""
 
2021
        if (gnutls.library.functions.gnutls_certificate_type_get(
 
2022
                session._c_object)
 
2023
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
2024
            # ...do the normal thing
 
2025
            return session.peer_certificate
2277
2026
        list_size = ctypes.c_uint(1)
2278
 
        cert_list = (gnutls.certificate_get_peers
 
2027
        cert_list = (gnutls.library.functions
 
2028
                     .gnutls_certificate_get_peers
2279
2029
                     (session._c_object, ctypes.byref(list_size)))
2280
2030
        if not bool(cert_list) and list_size.value != 0:
2281
 
            raise gnutls.Error("error getting peer certificate")
 
2031
            raise gnutls.errors.GNUTLSError("error getting peer"
 
2032
                                            " certificate")
2282
2033
        if list_size.value == 0:
2283
2034
            return None
2284
2035
        cert = cert_list[0]
2288
2039
    def fingerprint(openpgp):
2289
2040
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
2290
2041
        # New GnuTLS "datum" with the OpenPGP public key
2291
 
        datum = gnutls.datum_t(
 
2042
        datum = gnutls.library.types.gnutls_datum_t(
2292
2043
            ctypes.cast(ctypes.c_char_p(openpgp),
2293
2044
                        ctypes.POINTER(ctypes.c_ubyte)),
2294
2045
            ctypes.c_uint(len(openpgp)))
2295
2046
        # New empty GnuTLS certificate
2296
 
        crt = gnutls.openpgp_crt_t()
2297
 
        gnutls.openpgp_crt_init(ctypes.byref(crt))
 
2047
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
2048
        gnutls.library.functions.gnutls_openpgp_crt_init(
 
2049
            ctypes.byref(crt))
2298
2050
        # Import the OpenPGP public key into the certificate
2299
 
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2300
 
                                  gnutls.OPENPGP_FMT_RAW)
 
2051
        gnutls.library.functions.gnutls_openpgp_crt_import(
 
2052
            crt, ctypes.byref(datum),
 
2053
            gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2301
2054
        # Verify the self signature in the key
2302
2055
        crtverify = ctypes.c_uint()
2303
 
        gnutls.openpgp_crt_verify_self(crt, 0,
2304
 
                                       ctypes.byref(crtverify))
 
2056
        gnutls.library.functions.gnutls_openpgp_crt_verify_self(
 
2057
            crt, 0, ctypes.byref(crtverify))
2305
2058
        if crtverify.value != 0:
2306
 
            gnutls.openpgp_crt_deinit(crt)
2307
 
            raise gnutls.CertificateSecurityError("Verify failed")
 
2059
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
2060
            raise gnutls.errors.CertificateSecurityError(
 
2061
                "Verify failed")
2308
2062
        # New buffer for the fingerprint
2309
2063
        buf = ctypes.create_string_buffer(20)
2310
2064
        buf_len = ctypes.c_size_t()
2311
2065
        # Get the fingerprint from the certificate into the buffer
2312
 
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2313
 
                                           ctypes.byref(buf_len))
 
2066
        gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
 
2067
            crt, ctypes.byref(buf), ctypes.byref(buf_len))
2314
2068
        # Deinit the certificate
2315
 
        gnutls.openpgp_crt_deinit(crt)
 
2069
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2316
2070
        # Convert the buffer to a Python bytestring
2317
2071
        fpr = ctypes.string_at(buf, buf_len.value)
2318
2072
        # Convert the bytestring to hexadecimal notation
2944
2698
        
2945
2699
        # "Use a log level over 10 to enable all debugging options."
2946
2700
        # - GnuTLS manual
2947
 
        gnutls.global_set_log_level(11)
 
2701
        gnutls.library.functions.gnutls_global_set_log_level(11)
2948
2702
        
2949
 
        @gnutls.log_func
 
2703
        @gnutls.library.types.gnutls_log_func
2950
2704
        def debug_gnutls(level, string):
2951
2705
            logger.debug("GnuTLS: %s", string[:-1])
2952
2706
        
2953
 
        gnutls.global_set_log_function(debug_gnutls)
 
2707
        gnutls.library.functions.gnutls_global_set_log_function(
 
2708
            debug_gnutls)
2954
2709
        
2955
2710
        # Redirect stdin so all checkers get /dev/null
2956
2711
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3304
3059
            # Don't signal the disabling
3305
3060
            client.disable(quiet=True)
3306
3061
            # Emit D-Bus signal for removal
3307
 
            if use_dbus:
3308
 
                mandos_dbus_service.client_removed_signal(client)
 
3062
            mandos_dbus_service.client_removed_signal(client)
3309
3063
        client_settings.clear()
3310
3064
    
3311
3065
    atexit.register(cleanup)