/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2016-02-28 14:22:10 UTC
  • Revision ID: teddy@recompile.se-20160228142210-2df89dih7mzxxr0h
Update copyright year.

* DBUS-API: Update copyright year.
* debian/copyright: - '' -
* intro.xml (COPYRIGHT): - '' -
* mandos: - '' -
* mandos-clients.conf.xml (COPYRIGHT): - '' -
* mandos-ctl: - '' -
* mandos-ctl.xml (COPYRIGHT): - '' -
* mandos-keygen: - '' -
* mandos-keygen.xml (COPYRIGHT): - '' -
* mandos-monitor: - '' -
* mandos-monitor.xml (COPYRIGHT): - '' -
* mandos.conf.xml (COPYRIGHT): - '' -
* mandos.xml (COPYRIGHT): - '' -
* plugin-helpers/mandos-client-iprouteadddel.c: - '' -
* plugin-runner.c: - '' -
* plugin-runner.xml (COPYRIGHT): - '' -
* plugins.d/askpass-fifo.c: - '' -
* plugins.d/askpass-fifo.xml (COPYRIGHT): - '' -
* plugins.d/mandos-client.c: - '' -
* plugins.d/mandos-client.xml (COPYRIGHT): - '' -
* plugins.d/password-prompt.c: - '' -
* plugins.d/password-prompt.xml (COPYRIGHT): - ''
* plugins.d/plymouth.c: - '' -
* plugins.d/plymouth.xml (COPYRIGHT): - '' -
* plugins.d/splashy.c: - '' -
* plugins.d/splashy.xml (COPYRIGHT): - '' -
* plugins.d/usplash.c: - '' -
* plugins.d/usplash.xml (COPYRIGHT): - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
1
 
#!/usr/bin/python2.7
 
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
# 
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008-2015 Teddy Hogeborn
15
 
# Copyright © 2008-2015 Björn Påhlsson
 
14
# Copyright © 2008-2016 Teddy Hogeborn
 
15
# Copyright © 2008-2016 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
44
44
import argparse
45
45
import datetime
46
46
import errno
47
 
import gnutls.crypto
48
 
import gnutls.connection
49
 
import gnutls.errors
50
 
import gnutls.library.functions
51
 
import gnutls.library.constants
52
 
import gnutls.library.types
53
47
try:
54
48
    import ConfigParser as configparser
55
49
except ImportError:
104
98
if sys.version_info.major == 2:
105
99
    str = unicode
106
100
 
107
 
version = "1.6.9"
 
101
version = "1.7.1"
108
102
stored_state_file = "clients.pickle"
109
103
 
110
104
logger = logging.getLogger()
157
151
    
158
152
    def __init__(self):
159
153
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
154
        self.gpg = "gpg"
 
155
        try:
 
156
            output = subprocess.check_output(["gpgconf"])
 
157
            for line in output.splitlines():
 
158
                name, text, path = line.split(":")
 
159
                if name == "gpg":
 
160
                    self.gpg = path
 
161
                    break
 
162
        except OSError as e:
 
163
            if e.errno != errno.ENOENT:
 
164
                raise
160
165
        self.gnupgargs = ['--batch',
161
 
                          '--home', self.tempdir,
 
166
                          '--homedir', self.tempdir,
162
167
                          '--force-mdc',
163
168
                          '--quiet',
164
169
                          '--no-use-agent']
203
208
                dir=self.tempdir) as passfile:
204
209
            passfile.write(passphrase)
205
210
            passfile.flush()
206
 
            proc = subprocess.Popen(['gpg', '--symmetric',
 
211
            proc = subprocess.Popen([self.gpg, '--symmetric',
207
212
                                     '--passphrase-file',
208
213
                                     passfile.name]
209
214
                                    + self.gnupgargs,
221
226
                dir = self.tempdir) as passfile:
222
227
            passfile.write(passphrase)
223
228
            passfile.flush()
224
 
            proc = subprocess.Popen(['gpg', '--decrypt',
 
229
            proc = subprocess.Popen([self.gpg, '--decrypt',
225
230
                                     '--passphrase-file',
226
231
                                     passfile.name]
227
232
                                    + self.gnupgargs,
435
440
            .format(self.name)))
436
441
        return ret
437
442
 
 
443
# Pretend that we have a GnuTLS module
 
444
class GnuTLS(object):
 
445
    """This isn't so much a class as it is a module-like namespace.
 
446
    It is instantiated once, and simulates having a GnuTLS module."""
 
447
    
 
448
    _library = ctypes.cdll.LoadLibrary(
 
449
        ctypes.util.find_library("gnutls"))
 
450
    _need_version = "3.3.0"
 
451
    def __init__(self):
 
452
        # Need to use class name "GnuTLS" here, since this method is
 
453
        # called before the assignment to the "gnutls" global variable
 
454
        # happens.
 
455
        if GnuTLS.check_version(self._need_version) is None:
 
456
            raise GnuTLS.Error("Needs GnuTLS {} or later"
 
457
                               .format(self._need_version))
 
458
    
 
459
    # Unless otherwise indicated, the constants and types below are
 
460
    # all from the gnutls/gnutls.h C header file.
 
461
    
 
462
    # Constants
 
463
    E_SUCCESS = 0
 
464
    E_INTERRUPTED = -52
 
465
    E_AGAIN = -28
 
466
    CRT_OPENPGP = 2
 
467
    CLIENT = 2
 
468
    SHUT_RDWR = 0
 
469
    CRD_CERTIFICATE = 1
 
470
    E_NO_CERTIFICATE_FOUND = -49
 
471
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
 
472
    
 
473
    # Types
 
474
    class session_int(ctypes.Structure):
 
475
        _fields_ = []
 
476
    session_t = ctypes.POINTER(session_int)
 
477
    class certificate_credentials_st(ctypes.Structure):
 
478
        _fields_ = []
 
479
    certificate_credentials_t = ctypes.POINTER(
 
480
        certificate_credentials_st)
 
481
    certificate_type_t = ctypes.c_int
 
482
    class datum_t(ctypes.Structure):
 
483
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
 
484
                    ('size', ctypes.c_uint)]
 
485
    class openpgp_crt_int(ctypes.Structure):
 
486
        _fields_ = []
 
487
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
 
488
    openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
 
489
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
 
490
    credentials_type_t = ctypes.c_int # 
 
491
    transport_ptr_t = ctypes.c_void_p
 
492
    close_request_t = ctypes.c_int
 
493
    
 
494
    # Exceptions
 
495
    class Error(Exception):
 
496
        # We need to use the class name "GnuTLS" here, since this
 
497
        # exception might be raised from within GnuTLS.__init__,
 
498
        # which is called before the assignment to the "gnutls"
 
499
        # global variable has happened.
 
500
        def __init__(self, message = None, code = None, args=()):
 
501
            # Default usage is by a message string, but if a return
 
502
            # code is passed, convert it to a string with
 
503
            # gnutls.strerror()
 
504
            self.code = code
 
505
            if message is None and code is not None:
 
506
                message = GnuTLS.strerror(code)
 
507
            return super(GnuTLS.Error, self).__init__(
 
508
                message, *args)
 
509
    
 
510
    class CertificateSecurityError(Error):
 
511
        pass
 
512
    
 
513
    # Classes
 
514
    class Credentials(object):
 
515
        def __init__(self):
 
516
            self._c_object = gnutls.certificate_credentials_t()
 
517
            gnutls.certificate_allocate_credentials(
 
518
                ctypes.byref(self._c_object))
 
519
            self.type = gnutls.CRD_CERTIFICATE
 
520
        
 
521
        def __del__(self):
 
522
            gnutls.certificate_free_credentials(self._c_object)
 
523
    
 
524
    class ClientSession(object):
 
525
        def __init__(self, socket, credentials = None):
 
526
            self._c_object = gnutls.session_t()
 
527
            gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
 
528
            gnutls.set_default_priority(self._c_object)
 
529
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
 
530
            gnutls.handshake_set_private_extensions(self._c_object,
 
531
                                                    True)
 
532
            self.socket = socket
 
533
            if credentials is None:
 
534
                credentials = gnutls.Credentials()
 
535
            gnutls.credentials_set(self._c_object, credentials.type,
 
536
                                   ctypes.cast(credentials._c_object,
 
537
                                               ctypes.c_void_p))
 
538
            self.credentials = credentials
 
539
        
 
540
        def __del__(self):
 
541
            gnutls.deinit(self._c_object)
 
542
        
 
543
        def handshake(self):
 
544
            return gnutls.handshake(self._c_object)
 
545
        
 
546
        def send(self, data):
 
547
            data = bytes(data)
 
548
            data_len = len(data)
 
549
            while data_len > 0:
 
550
                data_len -= gnutls.record_send(self._c_object,
 
551
                                               data[-data_len:],
 
552
                                               data_len)
 
553
        
 
554
        def bye(self):
 
555
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
 
556
    
 
557
    # Error handling functions
 
558
    def _error_code(result):
 
559
        """A function to raise exceptions on errors, suitable
 
560
        for the 'restype' attribute on ctypes functions"""
 
561
        if result >= 0:
 
562
            return result
 
563
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
 
564
            raise gnutls.CertificateSecurityError(code = result)
 
565
        raise gnutls.Error(code = result)
 
566
    
 
567
    def _retry_on_error(result, func, arguments):
 
568
        """A function to retry on some errors, suitable
 
569
        for the 'errcheck' attribute on ctypes functions"""
 
570
        while result < 0:
 
571
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
 
572
                return _error_code(result)
 
573
            result = func(*arguments)
 
574
        return result
 
575
    
 
576
    # Unless otherwise indicated, the function declarations below are
 
577
    # all from the gnutls/gnutls.h C header file.
 
578
    
 
579
    # Functions
 
580
    priority_set_direct = _library.gnutls_priority_set_direct
 
581
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
 
582
                                    ctypes.POINTER(ctypes.c_char_p)]
 
583
    priority_set_direct.restype = _error_code
 
584
    
 
585
    init = _library.gnutls_init
 
586
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
 
587
    init.restype = _error_code
 
588
    
 
589
    set_default_priority = _library.gnutls_set_default_priority
 
590
    set_default_priority.argtypes = [session_t]
 
591
    set_default_priority.restype = _error_code
 
592
    
 
593
    record_send = _library.gnutls_record_send
 
594
    record_send.argtypes = [session_t, ctypes.c_void_p,
 
595
                            ctypes.c_size_t]
 
596
    record_send.restype = ctypes.c_ssize_t
 
597
    record_send.errcheck = _retry_on_error
 
598
    
 
599
    certificate_allocate_credentials = (
 
600
        _library.gnutls_certificate_allocate_credentials)
 
601
    certificate_allocate_credentials.argtypes = [
 
602
        ctypes.POINTER(certificate_credentials_t)]
 
603
    certificate_allocate_credentials.restype = _error_code
 
604
    
 
605
    certificate_free_credentials = (
 
606
        _library.gnutls_certificate_free_credentials)
 
607
    certificate_free_credentials.argtypes = [certificate_credentials_t]
 
608
    certificate_free_credentials.restype = None
 
609
    
 
610
    handshake_set_private_extensions = (
 
611
        _library.gnutls_handshake_set_private_extensions)
 
612
    handshake_set_private_extensions.argtypes = [session_t,
 
613
                                                 ctypes.c_int]
 
614
    handshake_set_private_extensions.restype = None
 
615
    
 
616
    credentials_set = _library.gnutls_credentials_set
 
617
    credentials_set.argtypes = [session_t, credentials_type_t,
 
618
                                ctypes.c_void_p]
 
619
    credentials_set.restype = _error_code
 
620
    
 
621
    strerror = _library.gnutls_strerror
 
622
    strerror.argtypes = [ctypes.c_int]
 
623
    strerror.restype = ctypes.c_char_p
 
624
    
 
625
    certificate_type_get = _library.gnutls_certificate_type_get
 
626
    certificate_type_get.argtypes = [session_t]
 
627
    certificate_type_get.restype = _error_code
 
628
    
 
629
    certificate_get_peers = _library.gnutls_certificate_get_peers
 
630
    certificate_get_peers.argtypes = [session_t,
 
631
                                      ctypes.POINTER(ctypes.c_uint)]
 
632
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
 
633
    
 
634
    global_set_log_level = _library.gnutls_global_set_log_level
 
635
    global_set_log_level.argtypes = [ctypes.c_int]
 
636
    global_set_log_level.restype = None
 
637
    
 
638
    global_set_log_function = _library.gnutls_global_set_log_function
 
639
    global_set_log_function.argtypes = [log_func]
 
640
    global_set_log_function.restype = None
 
641
    
 
642
    deinit = _library.gnutls_deinit
 
643
    deinit.argtypes = [session_t]
 
644
    deinit.restype = None
 
645
    
 
646
    handshake = _library.gnutls_handshake
 
647
    handshake.argtypes = [session_t]
 
648
    handshake.restype = _error_code
 
649
    handshake.errcheck = _retry_on_error
 
650
    
 
651
    transport_set_ptr = _library.gnutls_transport_set_ptr
 
652
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
 
653
    transport_set_ptr.restype = None
 
654
    
 
655
    bye = _library.gnutls_bye
 
656
    bye.argtypes = [session_t, close_request_t]
 
657
    bye.restype = _error_code
 
658
    bye.errcheck = _retry_on_error
 
659
    
 
660
    check_version = _library.gnutls_check_version
 
661
    check_version.argtypes = [ctypes.c_char_p]
 
662
    check_version.restype = ctypes.c_char_p
 
663
    
 
664
    # All the function declarations below are from gnutls/openpgp.h
 
665
    
 
666
    openpgp_crt_init = _library.gnutls_openpgp_crt_init
 
667
    openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
 
668
    openpgp_crt_init.restype = _error_code
 
669
    
 
670
    openpgp_crt_import = _library.gnutls_openpgp_crt_import
 
671
    openpgp_crt_import.argtypes = [openpgp_crt_t,
 
672
                                   ctypes.POINTER(datum_t),
 
673
                                   openpgp_crt_fmt_t]
 
674
    openpgp_crt_import.restype = _error_code
 
675
    
 
676
    openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
 
677
    openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
 
678
                                        ctypes.POINTER(ctypes.c_uint)]
 
679
    openpgp_crt_verify_self.restype = _error_code
 
680
    
 
681
    openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
 
682
    openpgp_crt_deinit.argtypes = [openpgp_crt_t]
 
683
    openpgp_crt_deinit.restype = None
 
684
    
 
685
    openpgp_crt_get_fingerprint = (
 
686
        _library.gnutls_openpgp_crt_get_fingerprint)
 
687
    openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
 
688
                                            ctypes.c_void_p,
 
689
                                            ctypes.POINTER(
 
690
                                                ctypes.c_size_t)]
 
691
    openpgp_crt_get_fingerprint.restype = _error_code
 
692
    
 
693
    # Remove non-public functions
 
694
    del _error_code, _retry_on_error
 
695
# Create the global "gnutls" object, simulating a module
 
696
gnutls = GnuTLS()
 
697
 
438
698
def call_pipe(connection,       # : multiprocessing.Connection
439
699
              func, *args, **kwargs):
440
700
    """This function is meant to be called by multiprocessing.Process
842
1102
                           access="r")
843
1103
    def Property_dbus_property(self):
844
1104
        return dbus.Boolean(False)
 
1105
    
 
1106
    See also the DBusObjectWithAnnotations class.
845
1107
    """
846
1108
    
847
1109
    def decorator(func):
869
1131
    pass
870
1132
 
871
1133
 
872
 
class DBusObjectWithProperties(dbus.service.Object):
873
 
    """A D-Bus object with properties.
 
1134
class DBusObjectWithAnnotations(dbus.service.Object):
 
1135
    """A D-Bus object with annotations.
874
1136
    
875
 
    Classes inheriting from this can use the dbus_service_property
876
 
    decorator to expose methods as D-Bus properties.  It exposes the
877
 
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
1137
    Classes inheriting from this can use the dbus_annotations
 
1138
    decorator to add annotations to methods or signals.
878
1139
    """
879
1140
    
880
1141
    @staticmethod
896
1157
                for name, athing in
897
1158
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
898
1159
    
 
1160
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1161
                         out_signature = "s",
 
1162
                         path_keyword = 'object_path',
 
1163
                         connection_keyword = 'connection')
 
1164
    def Introspect(self, object_path, connection):
 
1165
        """Overloading of standard D-Bus method.
 
1166
        
 
1167
        Inserts annotation tags on methods and signals.
 
1168
        """
 
1169
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
1170
                                                   connection)
 
1171
        try:
 
1172
            document = xml.dom.minidom.parseString(xmlstring)
 
1173
            
 
1174
            for if_tag in document.getElementsByTagName("interface"):
 
1175
                # Add annotation tags
 
1176
                for typ in ("method", "signal"):
 
1177
                    for tag in if_tag.getElementsByTagName(typ):
 
1178
                        annots = dict()
 
1179
                        for name, prop in (self.
 
1180
                                           _get_all_dbus_things(typ)):
 
1181
                            if (name == tag.getAttribute("name")
 
1182
                                and prop._dbus_interface
 
1183
                                == if_tag.getAttribute("name")):
 
1184
                                annots.update(getattr(
 
1185
                                    prop, "_dbus_annotations", {}))
 
1186
                        for name, value in annots.items():
 
1187
                            ann_tag = document.createElement(
 
1188
                                "annotation")
 
1189
                            ann_tag.setAttribute("name", name)
 
1190
                            ann_tag.setAttribute("value", value)
 
1191
                            tag.appendChild(ann_tag)
 
1192
                # Add interface annotation tags
 
1193
                for annotation, value in dict(
 
1194
                    itertools.chain.from_iterable(
 
1195
                        annotations().items()
 
1196
                        for name, annotations
 
1197
                        in self._get_all_dbus_things("interface")
 
1198
                        if name == if_tag.getAttribute("name")
 
1199
                        )).items():
 
1200
                    ann_tag = document.createElement("annotation")
 
1201
                    ann_tag.setAttribute("name", annotation)
 
1202
                    ann_tag.setAttribute("value", value)
 
1203
                    if_tag.appendChild(ann_tag)
 
1204
                # Fix argument name for the Introspect method itself
 
1205
                if (if_tag.getAttribute("name")
 
1206
                                == dbus.INTROSPECTABLE_IFACE):
 
1207
                    for cn in if_tag.getElementsByTagName("method"):
 
1208
                        if cn.getAttribute("name") == "Introspect":
 
1209
                            for arg in cn.getElementsByTagName("arg"):
 
1210
                                if (arg.getAttribute("direction")
 
1211
                                    == "out"):
 
1212
                                    arg.setAttribute("name",
 
1213
                                                     "xml_data")
 
1214
            xmlstring = document.toxml("utf-8")
 
1215
            document.unlink()
 
1216
        except (AttributeError, xml.dom.DOMException,
 
1217
                xml.parsers.expat.ExpatError) as error:
 
1218
            logger.error("Failed to override Introspection method",
 
1219
                         exc_info=error)
 
1220
        return xmlstring
 
1221
 
 
1222
 
 
1223
class DBusObjectWithProperties(DBusObjectWithAnnotations):
 
1224
    """A D-Bus object with properties.
 
1225
    
 
1226
    Classes inheriting from this can use the dbus_service_property
 
1227
    decorator to expose methods as D-Bus properties.  It exposes the
 
1228
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
1229
    """
 
1230
    
899
1231
    def _get_dbus_property(self, interface_name, property_name):
900
1232
        """Returns a bound method if one exists which is a D-Bus
901
1233
        property with the specified name and interface.
911
1243
        raise DBusPropertyNotFound("{}:{}.{}".format(
912
1244
            self.dbus_object_path, interface_name, property_name))
913
1245
    
 
1246
    @classmethod
 
1247
    def _get_all_interface_names(cls):
 
1248
        """Get a sequence of all interfaces supported by an object"""
 
1249
        return (name for name in set(getattr(getattr(x, attr),
 
1250
                                             "_dbus_interface", None)
 
1251
                                     for x in (inspect.getmro(cls))
 
1252
                                     for attr in dir(x))
 
1253
                if name is not None)
 
1254
    
914
1255
    @dbus.service.method(dbus.PROPERTIES_IFACE,
915
1256
                         in_signature="ss",
916
1257
                         out_signature="v")
986
1327
        
987
1328
        Inserts property tags and interface annotation tags.
988
1329
        """
989
 
        xmlstring = dbus.service.Object.Introspect(self, object_path,
990
 
                                                   connection)
 
1330
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1331
                                                         object_path,
 
1332
                                                         connection)
991
1333
        try:
992
1334
            document = xml.dom.minidom.parseString(xmlstring)
993
1335
            
1006
1348
                            if prop._dbus_interface
1007
1349
                            == if_tag.getAttribute("name")):
1008
1350
                    if_tag.appendChild(tag)
1009
 
                # Add annotation tags
1010
 
                for typ in ("method", "signal", "property"):
1011
 
                    for tag in if_tag.getElementsByTagName(typ):
1012
 
                        annots = dict()
1013
 
                        for name, prop in (self.
1014
 
                                           _get_all_dbus_things(typ)):
1015
 
                            if (name == tag.getAttribute("name")
1016
 
                                and prop._dbus_interface
1017
 
                                == if_tag.getAttribute("name")):
1018
 
                                annots.update(getattr(
1019
 
                                    prop, "_dbus_annotations", {}))
1020
 
                        for name, value in annots.items():
1021
 
                            ann_tag = document.createElement(
1022
 
                                "annotation")
1023
 
                            ann_tag.setAttribute("name", name)
1024
 
                            ann_tag.setAttribute("value", value)
1025
 
                            tag.appendChild(ann_tag)
1026
 
                # Add interface annotation tags
1027
 
                for annotation, value in dict(
1028
 
                    itertools.chain.from_iterable(
1029
 
                        annotations().items()
1030
 
                        for name, annotations
1031
 
                        in self._get_all_dbus_things("interface")
1032
 
                        if name == if_tag.getAttribute("name")
1033
 
                        )).items():
1034
 
                    ann_tag = document.createElement("annotation")
1035
 
                    ann_tag.setAttribute("name", annotation)
1036
 
                    ann_tag.setAttribute("value", value)
1037
 
                    if_tag.appendChild(ann_tag)
 
1351
                # Add annotation tags for properties
 
1352
                for tag in if_tag.getElementsByTagName("property"):
 
1353
                    annots = dict()
 
1354
                    for name, prop in self._get_all_dbus_things(
 
1355
                            "property"):
 
1356
                        if (name == tag.getAttribute("name")
 
1357
                            and prop._dbus_interface
 
1358
                            == if_tag.getAttribute("name")):
 
1359
                            annots.update(getattr(
 
1360
                                prop, "_dbus_annotations", {}))
 
1361
                    for name, value in annots.items():
 
1362
                        ann_tag = document.createElement(
 
1363
                            "annotation")
 
1364
                        ann_tag.setAttribute("name", name)
 
1365
                        ann_tag.setAttribute("value", value)
 
1366
                        tag.appendChild(ann_tag)
1038
1367
                # Add the names to the return values for the
1039
1368
                # "org.freedesktop.DBus.Properties" methods
1040
1369
                if (if_tag.getAttribute("name")
1058
1387
                         exc_info=error)
1059
1388
        return xmlstring
1060
1389
 
 
1390
try:
 
1391
    dbus.OBJECT_MANAGER_IFACE
 
1392
except AttributeError:
 
1393
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
 
1394
 
 
1395
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
 
1396
    """A D-Bus object with an ObjectManager.
 
1397
    
 
1398
    Classes inheriting from this exposes the standard
 
1399
    GetManagedObjects call and the InterfacesAdded and
 
1400
    InterfacesRemoved signals on the standard
 
1401
    "org.freedesktop.DBus.ObjectManager" interface.
 
1402
    
 
1403
    Note: No signals are sent automatically; they must be sent
 
1404
    manually.
 
1405
    """
 
1406
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
1407
                         out_signature = "a{oa{sa{sv}}}")
 
1408
    def GetManagedObjects(self):
 
1409
        """This function must be overridden"""
 
1410
        raise NotImplementedError()
 
1411
    
 
1412
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
 
1413
                         signature = "oa{sa{sv}}")
 
1414
    def InterfacesAdded(self, object_path, interfaces_and_properties):
 
1415
        pass
 
1416
    
 
1417
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
 
1418
    def InterfacesRemoved(self, object_path, interfaces):
 
1419
        pass
 
1420
    
 
1421
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1422
                         out_signature = "s",
 
1423
                         path_keyword = 'object_path',
 
1424
                         connection_keyword = 'connection')
 
1425
    def Introspect(self, object_path, connection):
 
1426
        """Overloading of standard D-Bus method.
 
1427
        
 
1428
        Override return argument name of GetManagedObjects to be
 
1429
        "objpath_interfaces_and_properties"
 
1430
        """
 
1431
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1432
                                                         object_path,
 
1433
                                                         connection)
 
1434
        try:
 
1435
            document = xml.dom.minidom.parseString(xmlstring)
 
1436
            
 
1437
            for if_tag in document.getElementsByTagName("interface"):
 
1438
                # Fix argument name for the GetManagedObjects method
 
1439
                if (if_tag.getAttribute("name")
 
1440
                                == dbus.OBJECT_MANAGER_IFACE):
 
1441
                    for cn in if_tag.getElementsByTagName("method"):
 
1442
                        if (cn.getAttribute("name")
 
1443
                            == "GetManagedObjects"):
 
1444
                            for arg in cn.getElementsByTagName("arg"):
 
1445
                                if (arg.getAttribute("direction")
 
1446
                                    == "out"):
 
1447
                                    arg.setAttribute(
 
1448
                                        "name",
 
1449
                                        "objpath_interfaces"
 
1450
                                        "_and_properties")
 
1451
            xmlstring = document.toxml("utf-8")
 
1452
            document.unlink()
 
1453
        except (AttributeError, xml.dom.DOMException,
 
1454
                xml.parsers.expat.ExpatError) as error:
 
1455
            logger.error("Failed to override Introspection method",
 
1456
                         exc_info = error)
 
1457
        return xmlstring
1061
1458
 
1062
1459
def datetime_to_dbus(dt, variant_level=0):
1063
1460
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1154
1551
                        func1 and func2 to the "call_both" function
1155
1552
                        outside of its arguments"""
1156
1553
                        
 
1554
                        @functools.wraps(func2)
1157
1555
                        def call_both(*args, **kwargs):
1158
1556
                            """This function will emit two D-Bus
1159
1557
                            signals by calling func1 and func2"""
1160
1558
                            func1(*args, **kwargs)
1161
1559
                            func2(*args, **kwargs)
 
1560
                        # Make wrapper function look like a D-Bus signal
 
1561
                        for name, attr in inspect.getmembers(func2):
 
1562
                            if name.startswith("_dbus_"):
 
1563
                                setattr(call_both, name, attr)
1162
1564
                        
1163
1565
                        return call_both
1164
1566
                    # Create the "call_both" function and add it to
1376
1778
        if exitstatus >= 0:
1377
1779
            # Emit D-Bus signal
1378
1780
            self.CheckerCompleted(dbus.Int16(exitstatus),
1379
 
                                  dbus.Int64(0),
 
1781
                                  # This is specific to GNU libC
 
1782
                                  dbus.Int64(exitstatus << 8),
1380
1783
                                  dbus.String(command))
1381
1784
        else:
1382
1785
            # Emit D-Bus signal
1383
1786
            self.CheckerCompleted(dbus.Int16(-1),
1384
1787
                                  dbus.Int64(
1385
 
                                      self.last_checker_signal),
 
1788
                                      # This is specific to GNU libC
 
1789
                                      (exitstatus << 8)
 
1790
                                      | self.last_checker_signal),
1386
1791
                                  dbus.String(command))
1387
1792
        return ret
1388
1793
    
1465
1870
        self.checked_ok()
1466
1871
    
1467
1872
    # Enable - method
 
1873
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1468
1874
    @dbus.service.method(_interface)
1469
1875
    def Enable(self):
1470
1876
        "D-Bus method"
1471
1877
        self.enable()
1472
1878
    
1473
1879
    # StartChecker - method
 
1880
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1474
1881
    @dbus.service.method(_interface)
1475
1882
    def StartChecker(self):
1476
1883
        "D-Bus method"
1477
1884
        self.start_checker()
1478
1885
    
1479
1886
    # Disable - method
 
1887
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1480
1888
    @dbus.service.method(_interface)
1481
1889
    def Disable(self):
1482
1890
        "D-Bus method"
1483
1891
        self.disable()
1484
1892
    
1485
1893
    # StopChecker - method
 
1894
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1486
1895
    @dbus.service.method(_interface)
1487
1896
    def StopChecker(self):
1488
1897
        self.stop_checker()
1524
1933
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1525
1934
    
1526
1935
    # Name - property
 
1936
    @dbus_annotations(
 
1937
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1527
1938
    @dbus_service_property(_interface, signature="s", access="read")
1528
1939
    def Name_dbus_property(self):
1529
1940
        return dbus.String(self.name)
1530
1941
    
1531
1942
    # Fingerprint - property
 
1943
    @dbus_annotations(
 
1944
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1532
1945
    @dbus_service_property(_interface, signature="s", access="read")
1533
1946
    def Fingerprint_dbus_property(self):
1534
1947
        return dbus.String(self.fingerprint)
1543
1956
        self.host = str(value)
1544
1957
    
1545
1958
    # Created - property
 
1959
    @dbus_annotations(
 
1960
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1546
1961
    @dbus_service_property(_interface, signature="s", access="read")
1547
1962
    def Created_dbus_property(self):
1548
1963
        return datetime_to_dbus(self.created)
1663
2078
            self.stop_checker()
1664
2079
    
1665
2080
    # ObjectPath - property
 
2081
    @dbus_annotations(
 
2082
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
 
2083
         "org.freedesktop.DBus.Deprecated": "true"})
1666
2084
    @dbus_service_property(_interface, signature="o", access="read")
1667
2085
    def ObjectPath_dbus_property(self):
1668
2086
        return self.dbus_object_path # is already a dbus.ObjectPath
1669
2087
    
1670
2088
    # Secret = property
 
2089
    @dbus_annotations(
 
2090
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
 
2091
         "invalidates"})
1671
2092
    @dbus_service_property(_interface,
1672
2093
                           signature="ay",
1673
2094
                           access="write",
1719
2140
            logger.debug("Pipe FD: %d",
1720
2141
                         self.server.child_pipe.fileno())
1721
2142
            
1722
 
            session = gnutls.connection.ClientSession(
1723
 
                self.request, gnutls.connection .X509Credentials())
1724
 
            
1725
 
            # Note: gnutls.connection.X509Credentials is really a
1726
 
            # generic GnuTLS certificate credentials object so long as
1727
 
            # no X.509 keys are added to it.  Therefore, we can use it
1728
 
            # here despite using OpenPGP certificates.
 
2143
            session = gnutls.ClientSession(self.request)
1729
2144
            
1730
2145
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1731
2146
            #                      "+AES-256-CBC", "+SHA1",
1735
2150
            priority = self.server.gnutls_priority
1736
2151
            if priority is None:
1737
2152
                priority = "NORMAL"
1738
 
            gnutls.library.functions.gnutls_priority_set_direct(
1739
 
                session._c_object, priority, None)
 
2153
            gnutls.priority_set_direct(session._c_object, priority,
 
2154
                                       None)
1740
2155
            
1741
2156
            # Start communication using the Mandos protocol
1742
2157
            # Get protocol number
1752
2167
            # Start GnuTLS connection
1753
2168
            try:
1754
2169
                session.handshake()
1755
 
            except gnutls.errors.GNUTLSError as error:
 
2170
            except gnutls.Error as error:
1756
2171
                logger.warning("Handshake failed: %s", error)
1757
2172
                # Do not run session.bye() here: the session is not
1758
2173
                # established.  Just abandon the request.
1764
2179
                try:
1765
2180
                    fpr = self.fingerprint(
1766
2181
                        self.peer_certificate(session))
1767
 
                except (TypeError,
1768
 
                        gnutls.errors.GNUTLSError) as error:
 
2182
                except (TypeError, gnutls.Error) as error:
1769
2183
                    logger.warning("Bad certificate: %s", error)
1770
2184
                    return
1771
2185
                logger.debug("Fingerprint: %s", fpr)
1829
2243
                    else:
1830
2244
                        delay -= time2 - time
1831
2245
                
1832
 
                sent_size = 0
1833
 
                while sent_size < len(client.secret):
1834
 
                    try:
1835
 
                        sent = session.send(client.secret[sent_size:])
1836
 
                    except gnutls.errors.GNUTLSError as error:
1837
 
                        logger.warning("gnutls send failed",
1838
 
                                       exc_info=error)
1839
 
                        return
1840
 
                    logger.debug("Sent: %d, remaining: %d", sent,
1841
 
                                 len(client.secret) - (sent_size
1842
 
                                                       + sent))
1843
 
                    sent_size += sent
 
2246
                try:
 
2247
                    session.send(client.secret)
 
2248
                except gnutls.Error as error:
 
2249
                    logger.warning("gnutls send failed",
 
2250
                                   exc_info = error)
 
2251
                    return
1844
2252
                
1845
2253
                logger.info("Sending secret to %s", client.name)
1846
2254
                # bump the timeout using extended_timeout
1854
2262
                    client.approvals_pending -= 1
1855
2263
                try:
1856
2264
                    session.bye()
1857
 
                except gnutls.errors.GNUTLSError as error:
 
2265
                except gnutls.Error as error:
1858
2266
                    logger.warning("GnuTLS bye failed",
1859
2267
                                   exc_info=error)
1860
2268
    
1862
2270
    def peer_certificate(session):
1863
2271
        "Return the peer's OpenPGP certificate as a bytestring"
1864
2272
        # If not an OpenPGP certificate...
1865
 
        if (gnutls.library.functions.gnutls_certificate_type_get(
1866
 
                session._c_object)
1867
 
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1868
 
            # ...do the normal thing
1869
 
            return session.peer_certificate
 
2273
        if (gnutls.certificate_type_get(session._c_object)
 
2274
            != gnutls.CRT_OPENPGP):
 
2275
            # ...return invalid data
 
2276
            return b""
1870
2277
        list_size = ctypes.c_uint(1)
1871
 
        cert_list = (gnutls.library.functions
1872
 
                     .gnutls_certificate_get_peers
 
2278
        cert_list = (gnutls.certificate_get_peers
1873
2279
                     (session._c_object, ctypes.byref(list_size)))
1874
2280
        if not bool(cert_list) and list_size.value != 0:
1875
 
            raise gnutls.errors.GNUTLSError("error getting peer"
1876
 
                                            " certificate")
 
2281
            raise gnutls.Error("error getting peer certificate")
1877
2282
        if list_size.value == 0:
1878
2283
            return None
1879
2284
        cert = cert_list[0]
1883
2288
    def fingerprint(openpgp):
1884
2289
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1885
2290
        # New GnuTLS "datum" with the OpenPGP public key
1886
 
        datum = gnutls.library.types.gnutls_datum_t(
 
2291
        datum = gnutls.datum_t(
1887
2292
            ctypes.cast(ctypes.c_char_p(openpgp),
1888
2293
                        ctypes.POINTER(ctypes.c_ubyte)),
1889
2294
            ctypes.c_uint(len(openpgp)))
1890
2295
        # New empty GnuTLS certificate
1891
 
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1892
 
        gnutls.library.functions.gnutls_openpgp_crt_init(
1893
 
            ctypes.byref(crt))
 
2296
        crt = gnutls.openpgp_crt_t()
 
2297
        gnutls.openpgp_crt_init(ctypes.byref(crt))
1894
2298
        # Import the OpenPGP public key into the certificate
1895
 
        gnutls.library.functions.gnutls_openpgp_crt_import(
1896
 
            crt, ctypes.byref(datum),
1897
 
            gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
2299
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
 
2300
                                  gnutls.OPENPGP_FMT_RAW)
1898
2301
        # Verify the self signature in the key
1899
2302
        crtverify = ctypes.c_uint()
1900
 
        gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1901
 
            crt, 0, ctypes.byref(crtverify))
 
2303
        gnutls.openpgp_crt_verify_self(crt, 0,
 
2304
                                       ctypes.byref(crtverify))
1902
2305
        if crtverify.value != 0:
1903
 
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1904
 
            raise gnutls.errors.CertificateSecurityError(
1905
 
                "Verify failed")
 
2306
            gnutls.openpgp_crt_deinit(crt)
 
2307
            raise gnutls.CertificateSecurityError("Verify failed")
1906
2308
        # New buffer for the fingerprint
1907
2309
        buf = ctypes.create_string_buffer(20)
1908
2310
        buf_len = ctypes.c_size_t()
1909
2311
        # Get the fingerprint from the certificate into the buffer
1910
 
        gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1911
 
            crt, ctypes.byref(buf), ctypes.byref(buf_len))
 
2312
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
2313
                                           ctypes.byref(buf_len))
1912
2314
        # Deinit the certificate
1913
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
2315
        gnutls.openpgp_crt_deinit(crt)
1914
2316
        # Convert the buffer to a Python bytestring
1915
2317
        fpr = ctypes.string_at(buf, buf_len.value)
1916
2318
        # Convert the bytestring to hexadecimal notation
2542
2944
        
2543
2945
        # "Use a log level over 10 to enable all debugging options."
2544
2946
        # - GnuTLS manual
2545
 
        gnutls.library.functions.gnutls_global_set_log_level(11)
 
2947
        gnutls.global_set_log_level(11)
2546
2948
        
2547
 
        @gnutls.library.types.gnutls_log_func
 
2949
        @gnutls.log_func
2548
2950
        def debug_gnutls(level, string):
2549
2951
            logger.debug("GnuTLS: %s", string[:-1])
2550
2952
        
2551
 
        gnutls.library.functions.gnutls_global_set_log_function(
2552
 
            debug_gnutls)
 
2953
        gnutls.global_set_log_function(debug_gnutls)
2553
2954
        
2554
2955
        # Redirect stdin so all checkers get /dev/null
2555
2956
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2734
3135
        
2735
3136
        @alternate_dbus_interfaces(
2736
3137
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2737
 
        class MandosDBusService(DBusObjectWithProperties):
 
3138
        class MandosDBusService(DBusObjectWithObjectManager):
2738
3139
            """A D-Bus proxy object"""
2739
3140
            
2740
3141
            def __init__(self):
2742
3143
            
2743
3144
            _interface = "se.recompile.Mandos"
2744
3145
            
2745
 
            @dbus_interface_annotations(_interface)
2746
 
            def _foo(self):
2747
 
                return {
2748
 
                    "org.freedesktop.DBus.Property.EmitsChangedSignal":
2749
 
                    "false" }
2750
 
            
2751
3146
            @dbus.service.signal(_interface, signature="o")
2752
3147
            def ClientAdded(self, objpath):
2753
3148
                "D-Bus signal"
2758
3153
                "D-Bus signal"
2759
3154
                pass
2760
3155
            
 
3156
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3157
                               "true"})
2761
3158
            @dbus.service.signal(_interface, signature="os")
2762
3159
            def ClientRemoved(self, objpath, name):
2763
3160
                "D-Bus signal"
2764
3161
                pass
2765
3162
            
 
3163
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3164
                               "true"})
2766
3165
            @dbus.service.method(_interface, out_signature="ao")
2767
3166
            def GetAllClients(self):
2768
3167
                "D-Bus method"
2769
3168
                return dbus.Array(c.dbus_object_path for c in
2770
3169
                                  tcp_server.clients.itervalues())
2771
3170
            
 
3171
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3172
                               "true"})
2772
3173
            @dbus.service.method(_interface,
2773
3174
                                 out_signature="a{oa{sv}}")
2774
3175
            def GetAllClientsWithProperties(self):
2775
3176
                "D-Bus method"
2776
3177
                return dbus.Dictionary(
2777
 
                    { c.dbus_object_path: c.GetAll("")
 
3178
                    { c.dbus_object_path: c.GetAll(
 
3179
                        "se.recompile.Mandos.Client")
2778
3180
                      for c in tcp_server.clients.itervalues() },
2779
3181
                    signature="oa{sv}")
2780
3182
            
2785
3187
                    if c.dbus_object_path == object_path:
2786
3188
                        del tcp_server.clients[c.name]
2787
3189
                        c.remove_from_connection()
2788
 
                        # Don't signal anything except ClientRemoved
 
3190
                        # Don't signal the disabling
2789
3191
                        c.disable(quiet=True)
2790
 
                        # Emit D-Bus signal
2791
 
                        self.ClientRemoved(object_path, c.name)
 
3192
                        # Emit D-Bus signal for removal
 
3193
                        self.client_removed_signal(c)
2792
3194
                        return
2793
3195
                raise KeyError(object_path)
2794
3196
            
2795
3197
            del _interface
 
3198
            
 
3199
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
3200
                                 out_signature = "a{oa{sa{sv}}}")
 
3201
            def GetManagedObjects(self):
 
3202
                """D-Bus method"""
 
3203
                return dbus.Dictionary(
 
3204
                    { client.dbus_object_path:
 
3205
                      dbus.Dictionary(
 
3206
                          { interface: client.GetAll(interface)
 
3207
                            for interface in
 
3208
                                 client._get_all_interface_names()})
 
3209
                      for client in tcp_server.clients.values()})
 
3210
            
 
3211
            def client_added_signal(self, client):
 
3212
                """Send the new standard signal and the old signal"""
 
3213
                if use_dbus:
 
3214
                    # New standard signal
 
3215
                    self.InterfacesAdded(
 
3216
                        client.dbus_object_path,
 
3217
                        dbus.Dictionary(
 
3218
                            { interface: client.GetAll(interface)
 
3219
                              for interface in
 
3220
                              client._get_all_interface_names()}))
 
3221
                    # Old signal
 
3222
                    self.ClientAdded(client.dbus_object_path)
 
3223
            
 
3224
            def client_removed_signal(self, client):
 
3225
                """Send the new standard signal and the old signal"""
 
3226
                if use_dbus:
 
3227
                    # New standard signal
 
3228
                    self.InterfacesRemoved(
 
3229
                        client.dbus_object_path,
 
3230
                        client._get_all_interface_names())
 
3231
                    # Old signal
 
3232
                    self.ClientRemoved(client.dbus_object_path,
 
3233
                                       client.name)
2796
3234
        
2797
3235
        mandos_dbus_service = MandosDBusService()
2798
3236
    
2863
3301
            name, client = tcp_server.clients.popitem()
2864
3302
            if use_dbus:
2865
3303
                client.remove_from_connection()
2866
 
            # Don't signal anything except ClientRemoved
 
3304
            # Don't signal the disabling
2867
3305
            client.disable(quiet=True)
 
3306
            # Emit D-Bus signal for removal
2868
3307
            if use_dbus:
2869
 
                # Emit D-Bus signal
2870
 
                mandos_dbus_service.ClientRemoved(
2871
 
                    client.dbus_object_path, client.name)
 
3308
                mandos_dbus_service.client_removed_signal(client)
2872
3309
        client_settings.clear()
2873
3310
    
2874
3311
    atexit.register(cleanup)
2875
3312
    
2876
3313
    for client in tcp_server.clients.itervalues():
2877
3314
        if use_dbus:
2878
 
            # Emit D-Bus signal
2879
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
3315
            # Emit D-Bus signal for adding
 
3316
            mandos_dbus_service.client_added_signal(client)
2880
3317
        # Need to initiate checking of clients
2881
3318
        if client.enabled:
2882
3319
            client.init_checker()