/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2015-07-20 03:03:33 UTC
  • Revision ID: teddy@recompile.se-20150720030333-203m2aeblypcsfte
Bug fix for GnuTLS 3: be compatible with old 2048-bit DSA keys.

The mandos-keygen program in Mandos version 1.6.0 and older generated
2048-bit DSA keys, and when GnuTLS uses these it has trouble
connecting using the Mandos default priority string.  This was
previously fixed in Mandos 1.6.2, but the bug reappeared when using
GnuTLS 3, so the default priority string has to change again; this
time also the Mandos client has to change its default, so now the
server and the client should use the same default priority string:

SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256

* mandos (main/server_defaults): Changed default priority string.
* mandos-options.xml (/section/para[id="priority_compat"]): Removed.
  (/section/para[id="priority"]): Changed default priority string.
* mandos.conf ([DEFAULT]/priority): - '' -
* mandos.conf.xml (OPTIONS/priority): Refer to the id "priority"
                                      instead of "priority_compat".
* mandos.xml (OPTIONS/--priority): - '' -
* plugins.d/mandos-client.c (main): Changed default priority string.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
1
 
#!/usr/bin/python
 
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
# 
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008-2016 Teddy Hogeborn
15
 
# Copyright © 2008-2016 Björn Påhlsson
 
14
# Copyright © 2008-2015 Teddy Hogeborn
 
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
44
44
import argparse
45
45
import datetime
46
46
import errno
 
47
import gnutls.crypto
 
48
import gnutls.connection
 
49
import gnutls.errors
 
50
import gnutls.library.functions
 
51
import gnutls.library.constants
 
52
import gnutls.library.types
47
53
try:
48
54
    import ConfigParser as configparser
49
55
except ImportError:
98
104
if sys.version_info.major == 2:
99
105
    str = unicode
100
106
 
101
 
version = "1.7.1"
 
107
version = "1.6.9"
102
108
stored_state_file = "clients.pickle"
103
109
 
104
110
logger = logging.getLogger()
151
157
    
152
158
    def __init__(self):
153
159
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
154
 
        self.gpg = "gpg"
155
 
        try:
156
 
            output = subprocess.check_output(["gpgconf"])
157
 
            for line in output.splitlines():
158
 
                name, text, path = line.split(":")
159
 
                if name == "gpg":
160
 
                    self.gpg = path
161
 
                    break
162
 
        except OSError as e:
163
 
            if e.errno != errno.ENOENT:
164
 
                raise
165
160
        self.gnupgargs = ['--batch',
166
 
                          '--homedir', self.tempdir,
 
161
                          '--home', self.tempdir,
167
162
                          '--force-mdc',
168
163
                          '--quiet',
169
164
                          '--no-use-agent']
208
203
                dir=self.tempdir) as passfile:
209
204
            passfile.write(passphrase)
210
205
            passfile.flush()
211
 
            proc = subprocess.Popen([self.gpg, '--symmetric',
 
206
            proc = subprocess.Popen(['gpg', '--symmetric',
212
207
                                     '--passphrase-file',
213
208
                                     passfile.name]
214
209
                                    + self.gnupgargs,
226
221
                dir = self.tempdir) as passfile:
227
222
            passfile.write(passphrase)
228
223
            passfile.flush()
229
 
            proc = subprocess.Popen([self.gpg, '--decrypt',
 
224
            proc = subprocess.Popen(['gpg', '--decrypt',
230
225
                                     '--passphrase-file',
231
226
                                     passfile.name]
232
227
                                    + self.gnupgargs,
440
435
            .format(self.name)))
441
436
        return ret
442
437
 
443
 
# Pretend that we have a GnuTLS module
444
 
class GnuTLS(object):
445
 
    """This isn't so much a class as it is a module-like namespace.
446
 
    It is instantiated once, and simulates having a GnuTLS module."""
447
 
    
448
 
    _library = ctypes.cdll.LoadLibrary(
449
 
        ctypes.util.find_library("gnutls"))
450
 
    _need_version = "3.3.0"
451
 
    def __init__(self):
452
 
        # Need to use class name "GnuTLS" here, since this method is
453
 
        # called before the assignment to the "gnutls" global variable
454
 
        # happens.
455
 
        if GnuTLS.check_version(self._need_version) is None:
456
 
            raise GnuTLS.Error("Needs GnuTLS {} or later"
457
 
                               .format(self._need_version))
458
 
    
459
 
    # Unless otherwise indicated, the constants and types below are
460
 
    # all from the gnutls/gnutls.h C header file.
461
 
    
462
 
    # Constants
463
 
    E_SUCCESS = 0
464
 
    E_INTERRUPTED = -52
465
 
    E_AGAIN = -28
466
 
    CRT_OPENPGP = 2
467
 
    CLIENT = 2
468
 
    SHUT_RDWR = 0
469
 
    CRD_CERTIFICATE = 1
470
 
    E_NO_CERTIFICATE_FOUND = -49
471
 
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
472
 
    
473
 
    # Types
474
 
    class session_int(ctypes.Structure):
475
 
        _fields_ = []
476
 
    session_t = ctypes.POINTER(session_int)
477
 
    class certificate_credentials_st(ctypes.Structure):
478
 
        _fields_ = []
479
 
    certificate_credentials_t = ctypes.POINTER(
480
 
        certificate_credentials_st)
481
 
    certificate_type_t = ctypes.c_int
482
 
    class datum_t(ctypes.Structure):
483
 
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
484
 
                    ('size', ctypes.c_uint)]
485
 
    class openpgp_crt_int(ctypes.Structure):
486
 
        _fields_ = []
487
 
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
488
 
    openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
489
 
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
490
 
    credentials_type_t = ctypes.c_int # 
491
 
    transport_ptr_t = ctypes.c_void_p
492
 
    close_request_t = ctypes.c_int
493
 
    
494
 
    # Exceptions
495
 
    class Error(Exception):
496
 
        # We need to use the class name "GnuTLS" here, since this
497
 
        # exception might be raised from within GnuTLS.__init__,
498
 
        # which is called before the assignment to the "gnutls"
499
 
        # global variable has happened.
500
 
        def __init__(self, message = None, code = None, args=()):
501
 
            # Default usage is by a message string, but if a return
502
 
            # code is passed, convert it to a string with
503
 
            # gnutls.strerror()
504
 
            self.code = code
505
 
            if message is None and code is not None:
506
 
                message = GnuTLS.strerror(code)
507
 
            return super(GnuTLS.Error, self).__init__(
508
 
                message, *args)
509
 
    
510
 
    class CertificateSecurityError(Error):
511
 
        pass
512
 
    
513
 
    # Classes
514
 
    class Credentials(object):
515
 
        def __init__(self):
516
 
            self._c_object = gnutls.certificate_credentials_t()
517
 
            gnutls.certificate_allocate_credentials(
518
 
                ctypes.byref(self._c_object))
519
 
            self.type = gnutls.CRD_CERTIFICATE
520
 
        
521
 
        def __del__(self):
522
 
            gnutls.certificate_free_credentials(self._c_object)
523
 
    
524
 
    class ClientSession(object):
525
 
        def __init__(self, socket, credentials = None):
526
 
            self._c_object = gnutls.session_t()
527
 
            gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
528
 
            gnutls.set_default_priority(self._c_object)
529
 
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
530
 
            gnutls.handshake_set_private_extensions(self._c_object,
531
 
                                                    True)
532
 
            self.socket = socket
533
 
            if credentials is None:
534
 
                credentials = gnutls.Credentials()
535
 
            gnutls.credentials_set(self._c_object, credentials.type,
536
 
                                   ctypes.cast(credentials._c_object,
537
 
                                               ctypes.c_void_p))
538
 
            self.credentials = credentials
539
 
        
540
 
        def __del__(self):
541
 
            gnutls.deinit(self._c_object)
542
 
        
543
 
        def handshake(self):
544
 
            return gnutls.handshake(self._c_object)
545
 
        
546
 
        def send(self, data):
547
 
            data = bytes(data)
548
 
            data_len = len(data)
549
 
            while data_len > 0:
550
 
                data_len -= gnutls.record_send(self._c_object,
551
 
                                               data[-data_len:],
552
 
                                               data_len)
553
 
        
554
 
        def bye(self):
555
 
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
556
 
    
557
 
    # Error handling functions
558
 
    def _error_code(result):
559
 
        """A function to raise exceptions on errors, suitable
560
 
        for the 'restype' attribute on ctypes functions"""
561
 
        if result >= 0:
562
 
            return result
563
 
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
564
 
            raise gnutls.CertificateSecurityError(code = result)
565
 
        raise gnutls.Error(code = result)
566
 
    
567
 
    def _retry_on_error(result, func, arguments):
568
 
        """A function to retry on some errors, suitable
569
 
        for the 'errcheck' attribute on ctypes functions"""
570
 
        while result < 0:
571
 
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
572
 
                return _error_code(result)
573
 
            result = func(*arguments)
574
 
        return result
575
 
    
576
 
    # Unless otherwise indicated, the function declarations below are
577
 
    # all from the gnutls/gnutls.h C header file.
578
 
    
579
 
    # Functions
580
 
    priority_set_direct = _library.gnutls_priority_set_direct
581
 
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
582
 
                                    ctypes.POINTER(ctypes.c_char_p)]
583
 
    priority_set_direct.restype = _error_code
584
 
    
585
 
    init = _library.gnutls_init
586
 
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
587
 
    init.restype = _error_code
588
 
    
589
 
    set_default_priority = _library.gnutls_set_default_priority
590
 
    set_default_priority.argtypes = [session_t]
591
 
    set_default_priority.restype = _error_code
592
 
    
593
 
    record_send = _library.gnutls_record_send
594
 
    record_send.argtypes = [session_t, ctypes.c_void_p,
595
 
                            ctypes.c_size_t]
596
 
    record_send.restype = ctypes.c_ssize_t
597
 
    record_send.errcheck = _retry_on_error
598
 
    
599
 
    certificate_allocate_credentials = (
600
 
        _library.gnutls_certificate_allocate_credentials)
601
 
    certificate_allocate_credentials.argtypes = [
602
 
        ctypes.POINTER(certificate_credentials_t)]
603
 
    certificate_allocate_credentials.restype = _error_code
604
 
    
605
 
    certificate_free_credentials = (
606
 
        _library.gnutls_certificate_free_credentials)
607
 
    certificate_free_credentials.argtypes = [certificate_credentials_t]
608
 
    certificate_free_credentials.restype = None
609
 
    
610
 
    handshake_set_private_extensions = (
611
 
        _library.gnutls_handshake_set_private_extensions)
612
 
    handshake_set_private_extensions.argtypes = [session_t,
613
 
                                                 ctypes.c_int]
614
 
    handshake_set_private_extensions.restype = None
615
 
    
616
 
    credentials_set = _library.gnutls_credentials_set
617
 
    credentials_set.argtypes = [session_t, credentials_type_t,
618
 
                                ctypes.c_void_p]
619
 
    credentials_set.restype = _error_code
620
 
    
621
 
    strerror = _library.gnutls_strerror
622
 
    strerror.argtypes = [ctypes.c_int]
623
 
    strerror.restype = ctypes.c_char_p
624
 
    
625
 
    certificate_type_get = _library.gnutls_certificate_type_get
626
 
    certificate_type_get.argtypes = [session_t]
627
 
    certificate_type_get.restype = _error_code
628
 
    
629
 
    certificate_get_peers = _library.gnutls_certificate_get_peers
630
 
    certificate_get_peers.argtypes = [session_t,
631
 
                                      ctypes.POINTER(ctypes.c_uint)]
632
 
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
633
 
    
634
 
    global_set_log_level = _library.gnutls_global_set_log_level
635
 
    global_set_log_level.argtypes = [ctypes.c_int]
636
 
    global_set_log_level.restype = None
637
 
    
638
 
    global_set_log_function = _library.gnutls_global_set_log_function
639
 
    global_set_log_function.argtypes = [log_func]
640
 
    global_set_log_function.restype = None
641
 
    
642
 
    deinit = _library.gnutls_deinit
643
 
    deinit.argtypes = [session_t]
644
 
    deinit.restype = None
645
 
    
646
 
    handshake = _library.gnutls_handshake
647
 
    handshake.argtypes = [session_t]
648
 
    handshake.restype = _error_code
649
 
    handshake.errcheck = _retry_on_error
650
 
    
651
 
    transport_set_ptr = _library.gnutls_transport_set_ptr
652
 
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
653
 
    transport_set_ptr.restype = None
654
 
    
655
 
    bye = _library.gnutls_bye
656
 
    bye.argtypes = [session_t, close_request_t]
657
 
    bye.restype = _error_code
658
 
    bye.errcheck = _retry_on_error
659
 
    
660
 
    check_version = _library.gnutls_check_version
661
 
    check_version.argtypes = [ctypes.c_char_p]
662
 
    check_version.restype = ctypes.c_char_p
663
 
    
664
 
    # All the function declarations below are from gnutls/openpgp.h
665
 
    
666
 
    openpgp_crt_init = _library.gnutls_openpgp_crt_init
667
 
    openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
668
 
    openpgp_crt_init.restype = _error_code
669
 
    
670
 
    openpgp_crt_import = _library.gnutls_openpgp_crt_import
671
 
    openpgp_crt_import.argtypes = [openpgp_crt_t,
672
 
                                   ctypes.POINTER(datum_t),
673
 
                                   openpgp_crt_fmt_t]
674
 
    openpgp_crt_import.restype = _error_code
675
 
    
676
 
    openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
677
 
    openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
678
 
                                        ctypes.POINTER(ctypes.c_uint)]
679
 
    openpgp_crt_verify_self.restype = _error_code
680
 
    
681
 
    openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
682
 
    openpgp_crt_deinit.argtypes = [openpgp_crt_t]
683
 
    openpgp_crt_deinit.restype = None
684
 
    
685
 
    openpgp_crt_get_fingerprint = (
686
 
        _library.gnutls_openpgp_crt_get_fingerprint)
687
 
    openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
688
 
                                            ctypes.c_void_p,
689
 
                                            ctypes.POINTER(
690
 
                                                ctypes.c_size_t)]
691
 
    openpgp_crt_get_fingerprint.restype = _error_code
692
 
    
693
 
    # Remove non-public functions
694
 
    del _error_code, _retry_on_error
695
 
# Create the global "gnutls" object, simulating a module
696
 
gnutls = GnuTLS()
697
 
 
698
438
def call_pipe(connection,       # : multiprocessing.Connection
699
439
              func, *args, **kwargs):
700
440
    """This function is meant to be called by multiprocessing.Process
1102
842
                           access="r")
1103
843
    def Property_dbus_property(self):
1104
844
        return dbus.Boolean(False)
1105
 
    
1106
 
    See also the DBusObjectWithAnnotations class.
1107
845
    """
1108
846
    
1109
847
    def decorator(func):
1131
869
    pass
1132
870
 
1133
871
 
1134
 
class DBusObjectWithAnnotations(dbus.service.Object):
1135
 
    """A D-Bus object with annotations.
 
872
class DBusObjectWithProperties(dbus.service.Object):
 
873
    """A D-Bus object with properties.
1136
874
    
1137
 
    Classes inheriting from this can use the dbus_annotations
1138
 
    decorator to add annotations to methods or signals.
 
875
    Classes inheriting from this can use the dbus_service_property
 
876
    decorator to expose methods as D-Bus properties.  It exposes the
 
877
    standard Get(), Set(), and GetAll() methods on the D-Bus.
1139
878
    """
1140
879
    
1141
880
    @staticmethod
1157
896
                for name, athing in
1158
897
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
1159
898
    
1160
 
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1161
 
                         out_signature = "s",
1162
 
                         path_keyword = 'object_path',
1163
 
                         connection_keyword = 'connection')
1164
 
    def Introspect(self, object_path, connection):
1165
 
        """Overloading of standard D-Bus method.
1166
 
        
1167
 
        Inserts annotation tags on methods and signals.
1168
 
        """
1169
 
        xmlstring = dbus.service.Object.Introspect(self, object_path,
1170
 
                                                   connection)
1171
 
        try:
1172
 
            document = xml.dom.minidom.parseString(xmlstring)
1173
 
            
1174
 
            for if_tag in document.getElementsByTagName("interface"):
1175
 
                # Add annotation tags
1176
 
                for typ in ("method", "signal"):
1177
 
                    for tag in if_tag.getElementsByTagName(typ):
1178
 
                        annots = dict()
1179
 
                        for name, prop in (self.
1180
 
                                           _get_all_dbus_things(typ)):
1181
 
                            if (name == tag.getAttribute("name")
1182
 
                                and prop._dbus_interface
1183
 
                                == if_tag.getAttribute("name")):
1184
 
                                annots.update(getattr(
1185
 
                                    prop, "_dbus_annotations", {}))
1186
 
                        for name, value in annots.items():
1187
 
                            ann_tag = document.createElement(
1188
 
                                "annotation")
1189
 
                            ann_tag.setAttribute("name", name)
1190
 
                            ann_tag.setAttribute("value", value)
1191
 
                            tag.appendChild(ann_tag)
1192
 
                # Add interface annotation tags
1193
 
                for annotation, value in dict(
1194
 
                    itertools.chain.from_iterable(
1195
 
                        annotations().items()
1196
 
                        for name, annotations
1197
 
                        in self._get_all_dbus_things("interface")
1198
 
                        if name == if_tag.getAttribute("name")
1199
 
                        )).items():
1200
 
                    ann_tag = document.createElement("annotation")
1201
 
                    ann_tag.setAttribute("name", annotation)
1202
 
                    ann_tag.setAttribute("value", value)
1203
 
                    if_tag.appendChild(ann_tag)
1204
 
                # Fix argument name for the Introspect method itself
1205
 
                if (if_tag.getAttribute("name")
1206
 
                                == dbus.INTROSPECTABLE_IFACE):
1207
 
                    for cn in if_tag.getElementsByTagName("method"):
1208
 
                        if cn.getAttribute("name") == "Introspect":
1209
 
                            for arg in cn.getElementsByTagName("arg"):
1210
 
                                if (arg.getAttribute("direction")
1211
 
                                    == "out"):
1212
 
                                    arg.setAttribute("name",
1213
 
                                                     "xml_data")
1214
 
            xmlstring = document.toxml("utf-8")
1215
 
            document.unlink()
1216
 
        except (AttributeError, xml.dom.DOMException,
1217
 
                xml.parsers.expat.ExpatError) as error:
1218
 
            logger.error("Failed to override Introspection method",
1219
 
                         exc_info=error)
1220
 
        return xmlstring
1221
 
 
1222
 
 
1223
 
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1224
 
    """A D-Bus object with properties.
1225
 
    
1226
 
    Classes inheriting from this can use the dbus_service_property
1227
 
    decorator to expose methods as D-Bus properties.  It exposes the
1228
 
    standard Get(), Set(), and GetAll() methods on the D-Bus.
1229
 
    """
1230
 
    
1231
899
    def _get_dbus_property(self, interface_name, property_name):
1232
900
        """Returns a bound method if one exists which is a D-Bus
1233
901
        property with the specified name and interface.
1243
911
        raise DBusPropertyNotFound("{}:{}.{}".format(
1244
912
            self.dbus_object_path, interface_name, property_name))
1245
913
    
1246
 
    @classmethod
1247
 
    def _get_all_interface_names(cls):
1248
 
        """Get a sequence of all interfaces supported by an object"""
1249
 
        return (name for name in set(getattr(getattr(x, attr),
1250
 
                                             "_dbus_interface", None)
1251
 
                                     for x in (inspect.getmro(cls))
1252
 
                                     for attr in dir(x))
1253
 
                if name is not None)
1254
 
    
1255
914
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1256
915
                         in_signature="ss",
1257
916
                         out_signature="v")
1327
986
        
1328
987
        Inserts property tags and interface annotation tags.
1329
988
        """
1330
 
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1331
 
                                                         object_path,
1332
 
                                                         connection)
 
989
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
990
                                                   connection)
1333
991
        try:
1334
992
            document = xml.dom.minidom.parseString(xmlstring)
1335
993
            
1348
1006
                            if prop._dbus_interface
1349
1007
                            == if_tag.getAttribute("name")):
1350
1008
                    if_tag.appendChild(tag)
1351
 
                # Add annotation tags for properties
1352
 
                for tag in if_tag.getElementsByTagName("property"):
1353
 
                    annots = dict()
1354
 
                    for name, prop in self._get_all_dbus_things(
1355
 
                            "property"):
1356
 
                        if (name == tag.getAttribute("name")
1357
 
                            and prop._dbus_interface
1358
 
                            == if_tag.getAttribute("name")):
1359
 
                            annots.update(getattr(
1360
 
                                prop, "_dbus_annotations", {}))
1361
 
                    for name, value in annots.items():
1362
 
                        ann_tag = document.createElement(
1363
 
                            "annotation")
1364
 
                        ann_tag.setAttribute("name", name)
1365
 
                        ann_tag.setAttribute("value", value)
1366
 
                        tag.appendChild(ann_tag)
 
1009
                # Add annotation tags
 
1010
                for typ in ("method", "signal", "property"):
 
1011
                    for tag in if_tag.getElementsByTagName(typ):
 
1012
                        annots = dict()
 
1013
                        for name, prop in (self.
 
1014
                                           _get_all_dbus_things(typ)):
 
1015
                            if (name == tag.getAttribute("name")
 
1016
                                and prop._dbus_interface
 
1017
                                == if_tag.getAttribute("name")):
 
1018
                                annots.update(getattr(
 
1019
                                    prop, "_dbus_annotations", {}))
 
1020
                        for name, value in annots.items():
 
1021
                            ann_tag = document.createElement(
 
1022
                                "annotation")
 
1023
                            ann_tag.setAttribute("name", name)
 
1024
                            ann_tag.setAttribute("value", value)
 
1025
                            tag.appendChild(ann_tag)
 
1026
                # Add interface annotation tags
 
1027
                for annotation, value in dict(
 
1028
                    itertools.chain.from_iterable(
 
1029
                        annotations().items()
 
1030
                        for name, annotations
 
1031
                        in self._get_all_dbus_things("interface")
 
1032
                        if name == if_tag.getAttribute("name")
 
1033
                        )).items():
 
1034
                    ann_tag = document.createElement("annotation")
 
1035
                    ann_tag.setAttribute("name", annotation)
 
1036
                    ann_tag.setAttribute("value", value)
 
1037
                    if_tag.appendChild(ann_tag)
1367
1038
                # Add the names to the return values for the
1368
1039
                # "org.freedesktop.DBus.Properties" methods
1369
1040
                if (if_tag.getAttribute("name")
1387
1058
                         exc_info=error)
1388
1059
        return xmlstring
1389
1060
 
1390
 
try:
1391
 
    dbus.OBJECT_MANAGER_IFACE
1392
 
except AttributeError:
1393
 
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1394
 
 
1395
 
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1396
 
    """A D-Bus object with an ObjectManager.
1397
 
    
1398
 
    Classes inheriting from this exposes the standard
1399
 
    GetManagedObjects call and the InterfacesAdded and
1400
 
    InterfacesRemoved signals on the standard
1401
 
    "org.freedesktop.DBus.ObjectManager" interface.
1402
 
    
1403
 
    Note: No signals are sent automatically; they must be sent
1404
 
    manually.
1405
 
    """
1406
 
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1407
 
                         out_signature = "a{oa{sa{sv}}}")
1408
 
    def GetManagedObjects(self):
1409
 
        """This function must be overridden"""
1410
 
        raise NotImplementedError()
1411
 
    
1412
 
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1413
 
                         signature = "oa{sa{sv}}")
1414
 
    def InterfacesAdded(self, object_path, interfaces_and_properties):
1415
 
        pass
1416
 
    
1417
 
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1418
 
    def InterfacesRemoved(self, object_path, interfaces):
1419
 
        pass
1420
 
    
1421
 
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1422
 
                         out_signature = "s",
1423
 
                         path_keyword = 'object_path',
1424
 
                         connection_keyword = 'connection')
1425
 
    def Introspect(self, object_path, connection):
1426
 
        """Overloading of standard D-Bus method.
1427
 
        
1428
 
        Override return argument name of GetManagedObjects to be
1429
 
        "objpath_interfaces_and_properties"
1430
 
        """
1431
 
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1432
 
                                                         object_path,
1433
 
                                                         connection)
1434
 
        try:
1435
 
            document = xml.dom.minidom.parseString(xmlstring)
1436
 
            
1437
 
            for if_tag in document.getElementsByTagName("interface"):
1438
 
                # Fix argument name for the GetManagedObjects method
1439
 
                if (if_tag.getAttribute("name")
1440
 
                                == dbus.OBJECT_MANAGER_IFACE):
1441
 
                    for cn in if_tag.getElementsByTagName("method"):
1442
 
                        if (cn.getAttribute("name")
1443
 
                            == "GetManagedObjects"):
1444
 
                            for arg in cn.getElementsByTagName("arg"):
1445
 
                                if (arg.getAttribute("direction")
1446
 
                                    == "out"):
1447
 
                                    arg.setAttribute(
1448
 
                                        "name",
1449
 
                                        "objpath_interfaces"
1450
 
                                        "_and_properties")
1451
 
            xmlstring = document.toxml("utf-8")
1452
 
            document.unlink()
1453
 
        except (AttributeError, xml.dom.DOMException,
1454
 
                xml.parsers.expat.ExpatError) as error:
1455
 
            logger.error("Failed to override Introspection method",
1456
 
                         exc_info = error)
1457
 
        return xmlstring
1458
1061
 
1459
1062
def datetime_to_dbus(dt, variant_level=0):
1460
1063
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1551
1154
                        func1 and func2 to the "call_both" function
1552
1155
                        outside of its arguments"""
1553
1156
                        
1554
 
                        @functools.wraps(func2)
1555
1157
                        def call_both(*args, **kwargs):
1556
1158
                            """This function will emit two D-Bus
1557
1159
                            signals by calling func1 and func2"""
1558
1160
                            func1(*args, **kwargs)
1559
1161
                            func2(*args, **kwargs)
1560
 
                        # Make wrapper function look like a D-Bus signal
1561
 
                        for name, attr in inspect.getmembers(func2):
1562
 
                            if name.startswith("_dbus_"):
1563
 
                                setattr(call_both, name, attr)
1564
1162
                        
1565
1163
                        return call_both
1566
1164
                    # Create the "call_both" function and add it to
1778
1376
        if exitstatus >= 0:
1779
1377
            # Emit D-Bus signal
1780
1378
            self.CheckerCompleted(dbus.Int16(exitstatus),
1781
 
                                  # This is specific to GNU libC
1782
 
                                  dbus.Int64(exitstatus << 8),
 
1379
                                  dbus.Int64(0),
1783
1380
                                  dbus.String(command))
1784
1381
        else:
1785
1382
            # Emit D-Bus signal
1786
1383
            self.CheckerCompleted(dbus.Int16(-1),
1787
1384
                                  dbus.Int64(
1788
 
                                      # This is specific to GNU libC
1789
 
                                      (exitstatus << 8)
1790
 
                                      | self.last_checker_signal),
 
1385
                                      self.last_checker_signal),
1791
1386
                                  dbus.String(command))
1792
1387
        return ret
1793
1388
    
1870
1465
        self.checked_ok()
1871
1466
    
1872
1467
    # Enable - method
1873
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1874
1468
    @dbus.service.method(_interface)
1875
1469
    def Enable(self):
1876
1470
        "D-Bus method"
1877
1471
        self.enable()
1878
1472
    
1879
1473
    # StartChecker - method
1880
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1881
1474
    @dbus.service.method(_interface)
1882
1475
    def StartChecker(self):
1883
1476
        "D-Bus method"
1884
1477
        self.start_checker()
1885
1478
    
1886
1479
    # Disable - method
1887
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1888
1480
    @dbus.service.method(_interface)
1889
1481
    def Disable(self):
1890
1482
        "D-Bus method"
1891
1483
        self.disable()
1892
1484
    
1893
1485
    # StopChecker - method
1894
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1895
1486
    @dbus.service.method(_interface)
1896
1487
    def StopChecker(self):
1897
1488
        self.stop_checker()
1933
1524
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1934
1525
    
1935
1526
    # Name - property
1936
 
    @dbus_annotations(
1937
 
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1938
1527
    @dbus_service_property(_interface, signature="s", access="read")
1939
1528
    def Name_dbus_property(self):
1940
1529
        return dbus.String(self.name)
1941
1530
    
1942
1531
    # Fingerprint - property
1943
 
    @dbus_annotations(
1944
 
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1945
1532
    @dbus_service_property(_interface, signature="s", access="read")
1946
1533
    def Fingerprint_dbus_property(self):
1947
1534
        return dbus.String(self.fingerprint)
1956
1543
        self.host = str(value)
1957
1544
    
1958
1545
    # Created - property
1959
 
    @dbus_annotations(
1960
 
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1961
1546
    @dbus_service_property(_interface, signature="s", access="read")
1962
1547
    def Created_dbus_property(self):
1963
1548
        return datetime_to_dbus(self.created)
2078
1663
            self.stop_checker()
2079
1664
    
2080
1665
    # ObjectPath - property
2081
 
    @dbus_annotations(
2082
 
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2083
 
         "org.freedesktop.DBus.Deprecated": "true"})
2084
1666
    @dbus_service_property(_interface, signature="o", access="read")
2085
1667
    def ObjectPath_dbus_property(self):
2086
1668
        return self.dbus_object_path # is already a dbus.ObjectPath
2087
1669
    
2088
1670
    # Secret = property
2089
 
    @dbus_annotations(
2090
 
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
2091
 
         "invalidates"})
2092
1671
    @dbus_service_property(_interface,
2093
1672
                           signature="ay",
2094
1673
                           access="write",
2140
1719
            logger.debug("Pipe FD: %d",
2141
1720
                         self.server.child_pipe.fileno())
2142
1721
            
2143
 
            session = gnutls.ClientSession(self.request)
 
1722
            session = gnutls.connection.ClientSession(
 
1723
                self.request, gnutls.connection .X509Credentials())
 
1724
            
 
1725
            # Note: gnutls.connection.X509Credentials is really a
 
1726
            # generic GnuTLS certificate credentials object so long as
 
1727
            # no X.509 keys are added to it.  Therefore, we can use it
 
1728
            # here despite using OpenPGP certificates.
2144
1729
            
2145
1730
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
2146
1731
            #                      "+AES-256-CBC", "+SHA1",
2150
1735
            priority = self.server.gnutls_priority
2151
1736
            if priority is None:
2152
1737
                priority = "NORMAL"
2153
 
            gnutls.priority_set_direct(session._c_object, priority,
2154
 
                                       None)
 
1738
            gnutls.library.functions.gnutls_priority_set_direct(
 
1739
                session._c_object, priority, None)
2155
1740
            
2156
1741
            # Start communication using the Mandos protocol
2157
1742
            # Get protocol number
2167
1752
            # Start GnuTLS connection
2168
1753
            try:
2169
1754
                session.handshake()
2170
 
            except gnutls.Error as error:
 
1755
            except gnutls.errors.GNUTLSError as error:
2171
1756
                logger.warning("Handshake failed: %s", error)
2172
1757
                # Do not run session.bye() here: the session is not
2173
1758
                # established.  Just abandon the request.
2179
1764
                try:
2180
1765
                    fpr = self.fingerprint(
2181
1766
                        self.peer_certificate(session))
2182
 
                except (TypeError, gnutls.Error) as error:
 
1767
                except (TypeError,
 
1768
                        gnutls.errors.GNUTLSError) as error:
2183
1769
                    logger.warning("Bad certificate: %s", error)
2184
1770
                    return
2185
1771
                logger.debug("Fingerprint: %s", fpr)
2243
1829
                    else:
2244
1830
                        delay -= time2 - time
2245
1831
                
2246
 
                try:
2247
 
                    session.send(client.secret)
2248
 
                except gnutls.Error as error:
2249
 
                    logger.warning("gnutls send failed",
2250
 
                                   exc_info = error)
2251
 
                    return
 
1832
                sent_size = 0
 
1833
                while sent_size < len(client.secret):
 
1834
                    try:
 
1835
                        sent = session.send(client.secret[sent_size:])
 
1836
                    except gnutls.errors.GNUTLSError as error:
 
1837
                        logger.warning("gnutls send failed",
 
1838
                                       exc_info=error)
 
1839
                        return
 
1840
                    logger.debug("Sent: %d, remaining: %d", sent,
 
1841
                                 len(client.secret) - (sent_size
 
1842
                                                       + sent))
 
1843
                    sent_size += sent
2252
1844
                
2253
1845
                logger.info("Sending secret to %s", client.name)
2254
1846
                # bump the timeout using extended_timeout
2262
1854
                    client.approvals_pending -= 1
2263
1855
                try:
2264
1856
                    session.bye()
2265
 
                except gnutls.Error as error:
 
1857
                except gnutls.errors.GNUTLSError as error:
2266
1858
                    logger.warning("GnuTLS bye failed",
2267
1859
                                   exc_info=error)
2268
1860
    
2270
1862
    def peer_certificate(session):
2271
1863
        "Return the peer's OpenPGP certificate as a bytestring"
2272
1864
        # If not an OpenPGP certificate...
2273
 
        if (gnutls.certificate_type_get(session._c_object)
2274
 
            != gnutls.CRT_OPENPGP):
2275
 
            # ...return invalid data
2276
 
            return b""
 
1865
        if (gnutls.library.functions.gnutls_certificate_type_get(
 
1866
                session._c_object)
 
1867
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
1868
            # ...do the normal thing
 
1869
            return session.peer_certificate
2277
1870
        list_size = ctypes.c_uint(1)
2278
 
        cert_list = (gnutls.certificate_get_peers
 
1871
        cert_list = (gnutls.library.functions
 
1872
                     .gnutls_certificate_get_peers
2279
1873
                     (session._c_object, ctypes.byref(list_size)))
2280
1874
        if not bool(cert_list) and list_size.value != 0:
2281
 
            raise gnutls.Error("error getting peer certificate")
 
1875
            raise gnutls.errors.GNUTLSError("error getting peer"
 
1876
                                            " certificate")
2282
1877
        if list_size.value == 0:
2283
1878
            return None
2284
1879
        cert = cert_list[0]
2288
1883
    def fingerprint(openpgp):
2289
1884
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
2290
1885
        # New GnuTLS "datum" with the OpenPGP public key
2291
 
        datum = gnutls.datum_t(
 
1886
        datum = gnutls.library.types.gnutls_datum_t(
2292
1887
            ctypes.cast(ctypes.c_char_p(openpgp),
2293
1888
                        ctypes.POINTER(ctypes.c_ubyte)),
2294
1889
            ctypes.c_uint(len(openpgp)))
2295
1890
        # New empty GnuTLS certificate
2296
 
        crt = gnutls.openpgp_crt_t()
2297
 
        gnutls.openpgp_crt_init(ctypes.byref(crt))
 
1891
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
1892
        gnutls.library.functions.gnutls_openpgp_crt_init(
 
1893
            ctypes.byref(crt))
2298
1894
        # Import the OpenPGP public key into the certificate
2299
 
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2300
 
                                  gnutls.OPENPGP_FMT_RAW)
 
1895
        gnutls.library.functions.gnutls_openpgp_crt_import(
 
1896
            crt, ctypes.byref(datum),
 
1897
            gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2301
1898
        # Verify the self signature in the key
2302
1899
        crtverify = ctypes.c_uint()
2303
 
        gnutls.openpgp_crt_verify_self(crt, 0,
2304
 
                                       ctypes.byref(crtverify))
 
1900
        gnutls.library.functions.gnutls_openpgp_crt_verify_self(
 
1901
            crt, 0, ctypes.byref(crtverify))
2305
1902
        if crtverify.value != 0:
2306
 
            gnutls.openpgp_crt_deinit(crt)
2307
 
            raise gnutls.CertificateSecurityError("Verify failed")
 
1903
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1904
            raise gnutls.errors.CertificateSecurityError(
 
1905
                "Verify failed")
2308
1906
        # New buffer for the fingerprint
2309
1907
        buf = ctypes.create_string_buffer(20)
2310
1908
        buf_len = ctypes.c_size_t()
2311
1909
        # Get the fingerprint from the certificate into the buffer
2312
 
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2313
 
                                           ctypes.byref(buf_len))
 
1910
        gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
 
1911
            crt, ctypes.byref(buf), ctypes.byref(buf_len))
2314
1912
        # Deinit the certificate
2315
 
        gnutls.openpgp_crt_deinit(crt)
 
1913
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2316
1914
        # Convert the buffer to a Python bytestring
2317
1915
        fpr = ctypes.string_at(buf, buf_len.value)
2318
1916
        # Convert the bytestring to hexadecimal notation
2944
2542
        
2945
2543
        # "Use a log level over 10 to enable all debugging options."
2946
2544
        # - GnuTLS manual
2947
 
        gnutls.global_set_log_level(11)
 
2545
        gnutls.library.functions.gnutls_global_set_log_level(11)
2948
2546
        
2949
 
        @gnutls.log_func
 
2547
        @gnutls.library.types.gnutls_log_func
2950
2548
        def debug_gnutls(level, string):
2951
2549
            logger.debug("GnuTLS: %s", string[:-1])
2952
2550
        
2953
 
        gnutls.global_set_log_function(debug_gnutls)
 
2551
        gnutls.library.functions.gnutls_global_set_log_function(
 
2552
            debug_gnutls)
2954
2553
        
2955
2554
        # Redirect stdin so all checkers get /dev/null
2956
2555
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3135
2734
        
3136
2735
        @alternate_dbus_interfaces(
3137
2736
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3138
 
        class MandosDBusService(DBusObjectWithObjectManager):
 
2737
        class MandosDBusService(DBusObjectWithProperties):
3139
2738
            """A D-Bus proxy object"""
3140
2739
            
3141
2740
            def __init__(self):
3143
2742
            
3144
2743
            _interface = "se.recompile.Mandos"
3145
2744
            
 
2745
            @dbus_interface_annotations(_interface)
 
2746
            def _foo(self):
 
2747
                return {
 
2748
                    "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
2749
                    "false" }
 
2750
            
3146
2751
            @dbus.service.signal(_interface, signature="o")
3147
2752
            def ClientAdded(self, objpath):
3148
2753
                "D-Bus signal"
3153
2758
                "D-Bus signal"
3154
2759
                pass
3155
2760
            
3156
 
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3157
 
                               "true"})
3158
2761
            @dbus.service.signal(_interface, signature="os")
3159
2762
            def ClientRemoved(self, objpath, name):
3160
2763
                "D-Bus signal"
3161
2764
                pass
3162
2765
            
3163
 
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3164
 
                               "true"})
3165
2766
            @dbus.service.method(_interface, out_signature="ao")
3166
2767
            def GetAllClients(self):
3167
2768
                "D-Bus method"
3168
2769
                return dbus.Array(c.dbus_object_path for c in
3169
2770
                                  tcp_server.clients.itervalues())
3170
2771
            
3171
 
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3172
 
                               "true"})
3173
2772
            @dbus.service.method(_interface,
3174
2773
                                 out_signature="a{oa{sv}}")
3175
2774
            def GetAllClientsWithProperties(self):
3176
2775
                "D-Bus method"
3177
2776
                return dbus.Dictionary(
3178
 
                    { c.dbus_object_path: c.GetAll(
3179
 
                        "se.recompile.Mandos.Client")
 
2777
                    { c.dbus_object_path: c.GetAll("")
3180
2778
                      for c in tcp_server.clients.itervalues() },
3181
2779
                    signature="oa{sv}")
3182
2780
            
3187
2785
                    if c.dbus_object_path == object_path:
3188
2786
                        del tcp_server.clients[c.name]
3189
2787
                        c.remove_from_connection()
3190
 
                        # Don't signal the disabling
 
2788
                        # Don't signal anything except ClientRemoved
3191
2789
                        c.disable(quiet=True)
3192
 
                        # Emit D-Bus signal for removal
3193
 
                        self.client_removed_signal(c)
 
2790
                        # Emit D-Bus signal
 
2791
                        self.ClientRemoved(object_path, c.name)
3194
2792
                        return
3195
2793
                raise KeyError(object_path)
3196
2794
            
3197
2795
            del _interface
3198
 
            
3199
 
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3200
 
                                 out_signature = "a{oa{sa{sv}}}")
3201
 
            def GetManagedObjects(self):
3202
 
                """D-Bus method"""
3203
 
                return dbus.Dictionary(
3204
 
                    { client.dbus_object_path:
3205
 
                      dbus.Dictionary(
3206
 
                          { interface: client.GetAll(interface)
3207
 
                            for interface in
3208
 
                                 client._get_all_interface_names()})
3209
 
                      for client in tcp_server.clients.values()})
3210
 
            
3211
 
            def client_added_signal(self, client):
3212
 
                """Send the new standard signal and the old signal"""
3213
 
                if use_dbus:
3214
 
                    # New standard signal
3215
 
                    self.InterfacesAdded(
3216
 
                        client.dbus_object_path,
3217
 
                        dbus.Dictionary(
3218
 
                            { interface: client.GetAll(interface)
3219
 
                              for interface in
3220
 
                              client._get_all_interface_names()}))
3221
 
                    # Old signal
3222
 
                    self.ClientAdded(client.dbus_object_path)
3223
 
            
3224
 
            def client_removed_signal(self, client):
3225
 
                """Send the new standard signal and the old signal"""
3226
 
                if use_dbus:
3227
 
                    # New standard signal
3228
 
                    self.InterfacesRemoved(
3229
 
                        client.dbus_object_path,
3230
 
                        client._get_all_interface_names())
3231
 
                    # Old signal
3232
 
                    self.ClientRemoved(client.dbus_object_path,
3233
 
                                       client.name)
3234
2796
        
3235
2797
        mandos_dbus_service = MandosDBusService()
3236
2798
    
3301
2863
            name, client = tcp_server.clients.popitem()
3302
2864
            if use_dbus:
3303
2865
                client.remove_from_connection()
3304
 
            # Don't signal the disabling
 
2866
            # Don't signal anything except ClientRemoved
3305
2867
            client.disable(quiet=True)
3306
 
            # Emit D-Bus signal for removal
3307
2868
            if use_dbus:
3308
 
                mandos_dbus_service.client_removed_signal(client)
 
2869
                # Emit D-Bus signal
 
2870
                mandos_dbus_service.ClientRemoved(
 
2871
                    client.dbus_object_path, client.name)
3309
2872
        client_settings.clear()
3310
2873
    
3311
2874
    atexit.register(cleanup)
3312
2875
    
3313
2876
    for client in tcp_server.clients.itervalues():
3314
2877
        if use_dbus:
3315
 
            # Emit D-Bus signal for adding
3316
 
            mandos_dbus_service.client_added_signal(client)
 
2878
            # Emit D-Bus signal
 
2879
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
3317
2880
        # Need to initiate checking of clients
3318
2881
        if client.enabled:
3319
2882
            client.init_checker()