/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2013-10-05 19:34:40 UTC
  • mto: (237.7.272 trunk)
  • mto: This revision was merged to the branch mainline in revision 303.
  • Revision ID: teddy@recompile.se-20131005193440-ldh85msvzxzmwhgr
* debian/control (Build-Depends): Depend on debhelper 8.9.7 for using
  "override-*-arch" and "override-*-indep" targets in debian/rules.
* debian/rules: Completely rewritten to use features from debhelper v7.
* plugins.d/mandos-client.c (fprintf_plus): Cast return value to
  return type; this fixes a warning since TEMP_FAILURE_RETRY seems to
  return a long int, not whatever type its inner expresson returns.
* plugins.d/password-prompt.c (fprintf_plus): - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
68
68
import binascii
69
69
import tempfile
70
70
import itertools
 
71
import collections
71
72
 
72
73
import dbus
73
74
import dbus.service
78
79
import ctypes.util
79
80
import xml.dom.minidom
80
81
import inspect
81
 
import GnuPGInterface
82
82
 
83
83
try:
84
84
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
88
88
    except ImportError:
89
89
        SO_BINDTODEVICE = None
90
90
 
91
 
version = "1.5.3"
 
91
version = "1.6.0"
92
92
stored_state_file = "clients.pickle"
93
93
 
94
94
logger = logging.getLogger()
139
139
class PGPEngine(object):
140
140
    """A simple class for OpenPGP symmetric encryption & decryption"""
141
141
    def __init__(self):
142
 
        self.gnupg = GnuPGInterface.GnuPG()
143
142
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
 
        self.gnupg = GnuPGInterface.GnuPG()
145
 
        self.gnupg.options.meta_interactive = False
146
 
        self.gnupg.options.homedir = self.tempdir
147
 
        self.gnupg.options.extra_args.extend(['--force-mdc',
148
 
                                              '--quiet',
149
 
                                              '--no-use-agent'])
 
143
        self.gnupgargs = ['--batch',
 
144
                          '--home', self.tempdir,
 
145
                          '--force-mdc',
 
146
                          '--quiet',
 
147
                          '--no-use-agent']
150
148
    
151
149
    def __enter__(self):
152
150
        return self
153
151
    
154
 
    def __exit__ (self, exc_type, exc_value, traceback):
 
152
    def __exit__(self, exc_type, exc_value, traceback):
155
153
        self._cleanup()
156
154
        return False
157
155
    
177
175
        return b"mandos" + binascii.hexlify(password)
178
176
    
179
177
    def encrypt(self, data, password):
180
 
        self.gnupg.passphrase = self.password_encode(password)
181
 
        with open(os.devnull, "w") as devnull:
182
 
            try:
183
 
                proc = self.gnupg.run(['--symmetric'],
184
 
                                      create_fhs=['stdin', 'stdout'],
185
 
                                      attach_fhs={'stderr': devnull})
186
 
                with contextlib.closing(proc.handles['stdin']) as f:
187
 
                    f.write(data)
188
 
                with contextlib.closing(proc.handles['stdout']) as f:
189
 
                    ciphertext = f.read()
190
 
                proc.wait()
191
 
            except IOError as e:
192
 
                raise PGPError(e)
193
 
        self.gnupg.passphrase = None
 
178
        passphrase = self.password_encode(password)
 
179
        with tempfile.NamedTemporaryFile(dir=self.tempdir
 
180
                                         ) as passfile:
 
181
            passfile.write(passphrase)
 
182
            passfile.flush()
 
183
            proc = subprocess.Popen(['gpg', '--symmetric',
 
184
                                     '--passphrase-file',
 
185
                                     passfile.name]
 
186
                                    + self.gnupgargs,
 
187
                                    stdin = subprocess.PIPE,
 
188
                                    stdout = subprocess.PIPE,
 
189
                                    stderr = subprocess.PIPE)
 
190
            ciphertext, err = proc.communicate(input = data)
 
191
        if proc.returncode != 0:
 
192
            raise PGPError(err)
194
193
        return ciphertext
195
194
    
196
195
    def decrypt(self, data, password):
197
 
        self.gnupg.passphrase = self.password_encode(password)
198
 
        with open(os.devnull, "w") as devnull:
199
 
            try:
200
 
                proc = self.gnupg.run(['--decrypt'],
201
 
                                      create_fhs=['stdin', 'stdout'],
202
 
                                      attach_fhs={'stderr': devnull})
203
 
                with contextlib.closing(proc.handles['stdin']) as f:
204
 
                    f.write(data)
205
 
                with contextlib.closing(proc.handles['stdout']) as f:
206
 
                    decrypted_plaintext = f.read()
207
 
                proc.wait()
208
 
            except IOError as e:
209
 
                raise PGPError(e)
210
 
        self.gnupg.passphrase = None
 
196
        passphrase = self.password_encode(password)
 
197
        with tempfile.NamedTemporaryFile(dir = self.tempdir
 
198
                                         ) as passfile:
 
199
            passfile.write(passphrase)
 
200
            passfile.flush()
 
201
            proc = subprocess.Popen(['gpg', '--decrypt',
 
202
                                     '--passphrase-file',
 
203
                                     passfile.name]
 
204
                                    + self.gnupgargs,
 
205
                                    stdin = subprocess.PIPE,
 
206
                                    stdout = subprocess.PIPE,
 
207
                                    stderr = subprocess.PIPE)
 
208
            decrypted_plaintext, err = proc.communicate(input
 
209
                                                        = data)
 
210
        if proc.returncode != 0:
 
211
            raise PGPError(err)
211
212
        return decrypted_plaintext
212
213
 
213
214
 
233
234
               Used to optionally bind to the specified interface.
234
235
    name: string; Example: 'Mandos'
235
236
    type: string; Example: '_mandos._tcp'.
236
 
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
237
     See <https://www.iana.org/assignments/service-names-port-numbers>
237
238
    port: integer; what port to announce
238
239
    TXT: list of strings; TXT record for the service
239
240
    domain: string; Domain to publish on, default to .local if empty.
439
440
    runtime_expansions: Allowed attributes for runtime expansion.
440
441
    expires:    datetime.datetime(); time (UTC) when a client will be
441
442
                disabled, or None
 
443
    server_settings: The server_settings dict from main()
442
444
    """
443
445
    
444
446
    runtime_expansions = ("approval_delay", "approval_duration",
445
 
                          "created", "enabled", "fingerprint",
446
 
                          "host", "interval", "last_checked_ok",
 
447
                          "created", "enabled", "expires",
 
448
                          "fingerprint", "host", "interval",
 
449
                          "last_approval_request", "last_checked_ok",
447
450
                          "last_enabled", "name", "timeout")
448
 
    client_defaults = { "timeout": "5m",
449
 
                        "extended_timeout": "15m",
450
 
                        "interval": "2m",
 
451
    client_defaults = { "timeout": "PT5M",
 
452
                        "extended_timeout": "PT15M",
 
453
                        "interval": "PT2M",
451
454
                        "checker": "fping -q -- %%(host)s",
452
455
                        "host": "",
453
 
                        "approval_delay": "0s",
454
 
                        "approval_duration": "1s",
 
456
                        "approval_delay": "PT0S",
 
457
                        "approval_duration": "PT1S",
455
458
                        "approved_by_default": "True",
456
459
                        "enabled": "True",
457
460
                        }
518
521
        
519
522
        return settings
520
523
    
521
 
    def __init__(self, settings, name = None):
 
524
    def __init__(self, settings, name = None, server_settings=None):
522
525
        self.name = name
 
526
        if server_settings is None:
 
527
            server_settings = {}
 
528
        self.server_settings = server_settings
523
529
        # adding all client settings
524
530
        for setting, value in settings.iteritems():
525
531
            setattr(self, setting, value)
690
696
                                      self.current_checker_command)
691
697
        # Start a new checker if needed
692
698
        if self.checker is None:
 
699
            # Escape attributes for the shell
 
700
            escaped_attrs = dict(
 
701
                (attr, re.escape(unicode(getattr(self, attr))))
 
702
                for attr in
 
703
                self.runtime_expansions)
693
704
            try:
694
 
                # In case checker_command has exactly one % operator
695
 
                command = self.checker_command % self.host
696
 
            except TypeError:
697
 
                # Escape attributes for the shell
698
 
                escaped_attrs = dict(
699
 
                    (attr,
700
 
                     re.escape(unicode(str(getattr(self, attr, "")),
701
 
                                       errors=
702
 
                                       'replace')))
703
 
                    for attr in
704
 
                    self.runtime_expansions)
705
 
                
706
 
                try:
707
 
                    command = self.checker_command % escaped_attrs
708
 
                except TypeError as error:
709
 
                    logger.error('Could not format string "%s"',
710
 
                                 self.checker_command, exc_info=error)
711
 
                    return True # Try again later
 
705
                command = self.checker_command % escaped_attrs
 
706
            except TypeError as error:
 
707
                logger.error('Could not format string "%s"',
 
708
                             self.checker_command, exc_info=error)
 
709
                return True # Try again later
712
710
            self.current_checker_command = command
713
711
            try:
714
712
                logger.info("Starting checker %r for %s",
717
715
                # in normal mode, that is already done by daemon(),
718
716
                # and in debug mode we don't want to.  (Stdin is
719
717
                # always replaced by /dev/null.)
 
718
                # The exception is when not debugging but nevertheless
 
719
                # running in the foreground; use the previously
 
720
                # created wnull.
 
721
                popen_args = {}
 
722
                if (not self.server_settings["debug"]
 
723
                    and self.server_settings["foreground"]):
 
724
                    popen_args.update({"stdout": wnull,
 
725
                                       "stderr": wnull })
720
726
                self.checker = subprocess.Popen(command,
721
727
                                                close_fds=True,
722
 
                                                shell=True, cwd="/")
723
 
                self.checker_callback_tag = (gobject.child_watch_add
724
 
                                             (self.checker.pid,
725
 
                                              self.checker_callback,
726
 
                                              data=command))
727
 
                # The checker may have completed before the gobject
728
 
                # watch was added.  Check for this.
729
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
730
 
                if pid:
731
 
                    gobject.source_remove(self.checker_callback_tag)
732
 
                    self.checker_callback(pid, status, command)
 
728
                                                shell=True, cwd="/",
 
729
                                                **popen_args)
733
730
            except OSError as error:
734
731
                logger.error("Failed to start subprocess",
735
732
                             exc_info=error)
 
733
                return True
 
734
            self.checker_callback_tag = (gobject.child_watch_add
 
735
                                         (self.checker.pid,
 
736
                                          self.checker_callback,
 
737
                                          data=command))
 
738
            # The checker may have completed before the gobject
 
739
            # watch was added.  Check for this.
 
740
            try:
 
741
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
742
            except OSError as error:
 
743
                if error.errno == errno.ECHILD:
 
744
                    # This should never happen
 
745
                    logger.error("Child process vanished",
 
746
                                 exc_info=error)
 
747
                    return True
 
748
                raise
 
749
            if pid:
 
750
                gobject.source_remove(self.checker_callback_tag)
 
751
                self.checker_callback(pid, status, command)
736
752
        # Re-run this periodically if run by gobject.timeout_add
737
753
        return True
738
754
    
1023
1039
        return xmlstring
1024
1040
 
1025
1041
 
1026
 
def datetime_to_dbus (dt, variant_level=0):
 
1042
def datetime_to_dbus(dt, variant_level=0):
1027
1043
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1028
1044
    if dt is None:
1029
1045
        return dbus.String("", variant_level = variant_level)
1037
1053
    interface names according to the "alt_interface_names" mapping.
1038
1054
    Usage:
1039
1055
    
1040
 
    @alternate_dbus_names({"org.example.Interface":
1041
 
                               "net.example.AlternateInterface"})
 
1056
    @alternate_dbus_interfaces({"org.example.Interface":
 
1057
                                    "net.example.AlternateInterface"})
1042
1058
    class SampleDBusObject(dbus.service.Object):
1043
1059
        @dbus.service.method("org.example.Interface")
1044
1060
        def SampleDBusMethod():
1075
1091
                interface_names.add(alt_interface)
1076
1092
                # Is this a D-Bus signal?
1077
1093
                if getattr(attribute, "_dbus_is_signal", False):
1078
 
                    # Extract the original non-method function by
1079
 
                    # black magic
 
1094
                    # Extract the original non-method undecorated
 
1095
                    # function by black magic
1080
1096
                    nonmethod_func = (dict(
1081
1097
                            zip(attribute.func_code.co_freevars,
1082
1098
                                attribute.__closure__))["func"]
1906
1922
        use_ipv6:       Boolean; to use IPv6 or not
1907
1923
    """
1908
1924
    def __init__(self, server_address, RequestHandlerClass,
1909
 
                 interface=None, use_ipv6=True):
 
1925
                 interface=None, use_ipv6=True, socketfd=None):
 
1926
        """If socketfd is set, use that file descriptor instead of
 
1927
        creating a new one with socket.socket().
 
1928
        """
1910
1929
        self.interface = interface
1911
1930
        if use_ipv6:
1912
1931
            self.address_family = socket.AF_INET6
 
1932
        if socketfd is not None:
 
1933
            # Save the file descriptor
 
1934
            self.socketfd = socketfd
 
1935
            # Save the original socket.socket() function
 
1936
            self.socket_socket = socket.socket
 
1937
            # To implement --socket, we monkey patch socket.socket.
 
1938
            # 
 
1939
            # (When socketserver.TCPServer is a new-style class, we
 
1940
            # could make self.socket into a property instead of monkey
 
1941
            # patching socket.socket.)
 
1942
            # 
 
1943
            # Create a one-time-only replacement for socket.socket()
 
1944
            @functools.wraps(socket.socket)
 
1945
            def socket_wrapper(*args, **kwargs):
 
1946
                # Restore original function so subsequent calls are
 
1947
                # not affected.
 
1948
                socket.socket = self.socket_socket
 
1949
                del self.socket_socket
 
1950
                # This time only, return a new socket object from the
 
1951
                # saved file descriptor.
 
1952
                return socket.fromfd(self.socketfd, *args, **kwargs)
 
1953
            # Replace socket.socket() function with wrapper
 
1954
            socket.socket = socket_wrapper
 
1955
        # The socketserver.TCPServer.__init__ will call
 
1956
        # socket.socket(), which might be our replacement,
 
1957
        # socket_wrapper(), if socketfd was set.
1913
1958
        socketserver.TCPServer.__init__(self, server_address,
1914
1959
                                        RequestHandlerClass)
 
1960
    
1915
1961
    def server_bind(self):
1916
1962
        """This overrides the normal server_bind() function
1917
1963
        to bind to an interface if one was specified, and also NOT to
1925
1971
                try:
1926
1972
                    self.socket.setsockopt(socket.SOL_SOCKET,
1927
1973
                                           SO_BINDTODEVICE,
1928
 
                                           str(self.interface
1929
 
                                               + '\0'))
 
1974
                                           str(self.interface + '\0'))
1930
1975
                except socket.error as error:
1931
1976
                    if error.errno == errno.EPERM:
1932
 
                        logger.error("No permission to"
1933
 
                                     " bind to interface %s",
1934
 
                                     self.interface)
 
1977
                        logger.error("No permission to bind to"
 
1978
                                     " interface %s", self.interface)
1935
1979
                    elif error.errno == errno.ENOPROTOOPT:
1936
1980
                        logger.error("SO_BINDTODEVICE not available;"
1937
1981
                                     " cannot bind to interface %s",
1938
1982
                                     self.interface)
1939
1983
                    elif error.errno == errno.ENODEV:
1940
 
                        logger.error("Interface %s does not"
1941
 
                                     " exist, cannot bind",
1942
 
                                     self.interface)
 
1984
                        logger.error("Interface %s does not exist,"
 
1985
                                     " cannot bind", self.interface)
1943
1986
                    else:
1944
1987
                        raise
1945
1988
        # Only bind(2) the socket if we really need to.
1948
1991
                if self.address_family == socket.AF_INET6:
1949
1992
                    any_address = "::" # in6addr_any
1950
1993
                else:
1951
 
                    any_address = socket.INADDR_ANY
 
1994
                    any_address = "0.0.0.0" # INADDR_ANY
1952
1995
                self.server_address = (any_address,
1953
1996
                                       self.server_address[1])
1954
1997
            elif not self.server_address[1]:
1975
2018
    """
1976
2019
    def __init__(self, server_address, RequestHandlerClass,
1977
2020
                 interface=None, use_ipv6=True, clients=None,
1978
 
                 gnutls_priority=None, use_dbus=True):
 
2021
                 gnutls_priority=None, use_dbus=True, socketfd=None):
1979
2022
        self.enabled = False
1980
2023
        self.clients = clients
1981
2024
        if self.clients is None:
1985
2028
        IPv6_TCPServer.__init__(self, server_address,
1986
2029
                                RequestHandlerClass,
1987
2030
                                interface = interface,
1988
 
                                use_ipv6 = use_ipv6)
 
2031
                                use_ipv6 = use_ipv6,
 
2032
                                socketfd = socketfd)
1989
2033
    def server_activate(self):
1990
2034
        if self.enabled:
1991
2035
            return socketserver.TCPServer.server_activate(self)
2069
2113
        return True
2070
2114
 
2071
2115
 
 
2116
def rfc3339_duration_to_delta(duration):
 
2117
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
 
2118
    
 
2119
    >>> rfc3339_duration_to_delta("P7D")
 
2120
    datetime.timedelta(7)
 
2121
    >>> rfc3339_duration_to_delta("PT60S")
 
2122
    datetime.timedelta(0, 60)
 
2123
    >>> rfc3339_duration_to_delta("PT60M")
 
2124
    datetime.timedelta(0, 3600)
 
2125
    >>> rfc3339_duration_to_delta("PT24H")
 
2126
    datetime.timedelta(1)
 
2127
    >>> rfc3339_duration_to_delta("P1W")
 
2128
    datetime.timedelta(7)
 
2129
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2130
    datetime.timedelta(0, 330)
 
2131
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2132
    datetime.timedelta(1, 200)
 
2133
    """
 
2134
    
 
2135
    # Parsing an RFC 3339 duration with regular expressions is not
 
2136
    # possible - there would have to be multiple places for the same
 
2137
    # values, like seconds.  The current code, while more esoteric, is
 
2138
    # cleaner without depending on a parsing library.  If Python had a
 
2139
    # built-in library for parsing we would use it, but we'd like to
 
2140
    # avoid excessive use of external libraries.
 
2141
    
 
2142
    # New type for defining tokens, syntax, and semantics all-in-one
 
2143
    Token = collections.namedtuple("Token",
 
2144
                                   ("regexp", # To match token; if
 
2145
                                              # "value" is not None,
 
2146
                                              # must have a "group"
 
2147
                                              # containing digits
 
2148
                                    "value",  # datetime.timedelta or
 
2149
                                              # None
 
2150
                                    "followers")) # Tokens valid after
 
2151
                                                  # this token
 
2152
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
 
2153
    # the "duration" ABNF definition in RFC 3339, Appendix A.
 
2154
    token_end = Token(re.compile(r"$"), None, frozenset())
 
2155
    token_second = Token(re.compile(r"(\d+)S"),
 
2156
                         datetime.timedelta(seconds=1),
 
2157
                         frozenset((token_end,)))
 
2158
    token_minute = Token(re.compile(r"(\d+)M"),
 
2159
                         datetime.timedelta(minutes=1),
 
2160
                         frozenset((token_second, token_end)))
 
2161
    token_hour = Token(re.compile(r"(\d+)H"),
 
2162
                       datetime.timedelta(hours=1),
 
2163
                       frozenset((token_minute, token_end)))
 
2164
    token_time = Token(re.compile(r"T"),
 
2165
                       None,
 
2166
                       frozenset((token_hour, token_minute,
 
2167
                                  token_second)))
 
2168
    token_day = Token(re.compile(r"(\d+)D"),
 
2169
                      datetime.timedelta(days=1),
 
2170
                      frozenset((token_time, token_end)))
 
2171
    token_month = Token(re.compile(r"(\d+)M"),
 
2172
                        datetime.timedelta(weeks=4),
 
2173
                        frozenset((token_day, token_end)))
 
2174
    token_year = Token(re.compile(r"(\d+)Y"),
 
2175
                       datetime.timedelta(weeks=52),
 
2176
                       frozenset((token_month, token_end)))
 
2177
    token_week = Token(re.compile(r"(\d+)W"),
 
2178
                       datetime.timedelta(weeks=1),
 
2179
                       frozenset((token_end,)))
 
2180
    token_duration = Token(re.compile(r"P"), None,
 
2181
                           frozenset((token_year, token_month,
 
2182
                                      token_day, token_time,
 
2183
                                      token_week))),
 
2184
    # Define starting values
 
2185
    value = datetime.timedelta() # Value so far
 
2186
    found_token = None
 
2187
    followers = frozenset(token_duration,) # Following valid tokens
 
2188
    s = duration                # String left to parse
 
2189
    # Loop until end token is found
 
2190
    while found_token is not token_end:
 
2191
        # Search for any currently valid tokens
 
2192
        for token in followers:
 
2193
            match = token.regexp.match(s)
 
2194
            if match is not None:
 
2195
                # Token found
 
2196
                if token.value is not None:
 
2197
                    # Value found, parse digits
 
2198
                    factor = int(match.group(1), 10)
 
2199
                    # Add to value so far
 
2200
                    value += factor * token.value
 
2201
                # Strip token from string
 
2202
                s = token.regexp.sub("", s, 1)
 
2203
                # Go to found token
 
2204
                found_token = token
 
2205
                # Set valid next tokens
 
2206
                followers = found_token.followers
 
2207
                break
 
2208
        else:
 
2209
            # No currently valid tokens were found
 
2210
            raise ValueError("Invalid RFC 3339 duration")
 
2211
    # End token found
 
2212
    return value
 
2213
 
 
2214
 
2072
2215
def string_to_delta(interval):
2073
2216
    """Parse a string and return a datetime.timedelta
2074
2217
    
2085
2228
    >>> string_to_delta('5m 30s')
2086
2229
    datetime.timedelta(0, 330)
2087
2230
    """
 
2231
    
 
2232
    try:
 
2233
        return rfc3339_duration_to_delta(interval)
 
2234
    except ValueError:
 
2235
        pass
 
2236
    
2088
2237
    timevalue = datetime.timedelta(0)
2089
2238
    for s in interval.split():
2090
2239
        try:
2153
2302
                        help="Run self-test")
2154
2303
    parser.add_argument("--debug", action="store_true",
2155
2304
                        help="Debug mode; run in foreground and log"
2156
 
                        " to terminal")
 
2305
                        " to terminal", default=None)
2157
2306
    parser.add_argument("--debuglevel", metavar="LEVEL",
2158
2307
                        help="Debug level for stdout output")
2159
2308
    parser.add_argument("--priority", help="GnuTLS"
2166
2315
                        " files")
2167
2316
    parser.add_argument("--no-dbus", action="store_false",
2168
2317
                        dest="use_dbus", help="Do not provide D-Bus"
2169
 
                        " system bus interface")
 
2318
                        " system bus interface", default=None)
2170
2319
    parser.add_argument("--no-ipv6", action="store_false",
2171
 
                        dest="use_ipv6", help="Do not use IPv6")
 
2320
                        dest="use_ipv6", help="Do not use IPv6",
 
2321
                        default=None)
2172
2322
    parser.add_argument("--no-restore", action="store_false",
2173
2323
                        dest="restore", help="Do not restore stored"
2174
 
                        " state")
 
2324
                        " state", default=None)
 
2325
    parser.add_argument("--socket", type=int,
 
2326
                        help="Specify a file descriptor to a network"
 
2327
                        " socket to use instead of creating one")
2175
2328
    parser.add_argument("--statedir", metavar="DIR",
2176
2329
                        help="Directory to save/restore state in")
 
2330
    parser.add_argument("--foreground", action="store_true",
 
2331
                        help="Run in foreground", default=None)
2177
2332
    
2178
2333
    options = parser.parse_args()
2179
2334
    
2188
2343
                        "port": "",
2189
2344
                        "debug": "False",
2190
2345
                        "priority":
2191
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
2346
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224",
2192
2347
                        "servicename": "Mandos",
2193
2348
                        "use_dbus": "True",
2194
2349
                        "use_ipv6": "True",
2195
2350
                        "debuglevel": "",
2196
2351
                        "restore": "True",
2197
 
                        "statedir": "/var/lib/mandos"
 
2352
                        "socket": "",
 
2353
                        "statedir": "/var/lib/mandos",
 
2354
                        "foreground": "False",
2198
2355
                        }
2199
2356
    
2200
2357
    # Parse config file for server-global settings
2205
2362
    # Convert the SafeConfigParser object to a dict
2206
2363
    server_settings = server_config.defaults()
2207
2364
    # Use the appropriate methods on the non-string config options
2208
 
    for option in ("debug", "use_dbus", "use_ipv6"):
 
2365
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2209
2366
        server_settings[option] = server_config.getboolean("DEFAULT",
2210
2367
                                                           option)
2211
2368
    if server_settings["port"]:
2212
2369
        server_settings["port"] = server_config.getint("DEFAULT",
2213
2370
                                                       "port")
 
2371
    if server_settings["socket"]:
 
2372
        server_settings["socket"] = server_config.getint("DEFAULT",
 
2373
                                                         "socket")
 
2374
        # Later, stdin will, and stdout and stderr might, be dup'ed
 
2375
        # over with an opened os.devnull.  But we don't want this to
 
2376
        # happen with a supplied network socket.
 
2377
        if 0 <= server_settings["socket"] <= 2:
 
2378
            server_settings["socket"] = os.dup(server_settings
 
2379
                                               ["socket"])
2214
2380
    del server_config
2215
2381
    
2216
2382
    # Override the settings from the config file with command line
2218
2384
    for option in ("interface", "address", "port", "debug",
2219
2385
                   "priority", "servicename", "configdir",
2220
2386
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2221
 
                   "statedir"):
 
2387
                   "statedir", "socket", "foreground"):
2222
2388
        value = getattr(options, option)
2223
2389
        if value is not None:
2224
2390
            server_settings[option] = value
2227
2393
    for option in server_settings.keys():
2228
2394
        if type(server_settings[option]) is str:
2229
2395
            server_settings[option] = unicode(server_settings[option])
 
2396
    # Force all boolean options to be boolean
 
2397
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
2398
                   "foreground"):
 
2399
        server_settings[option] = bool(server_settings[option])
 
2400
    # Debug implies foreground
 
2401
    if server_settings["debug"]:
 
2402
        server_settings["foreground"] = True
2230
2403
    # Now we have our good server settings in "server_settings"
2231
2404
    
2232
2405
    ##################################################################
2238
2411
    use_ipv6 = server_settings["use_ipv6"]
2239
2412
    stored_state_path = os.path.join(server_settings["statedir"],
2240
2413
                                     stored_state_file)
 
2414
    foreground = server_settings["foreground"]
2241
2415
    
2242
2416
    if debug:
2243
2417
        initlogger(debug, logging.DEBUG)
2272
2446
                              use_ipv6=use_ipv6,
2273
2447
                              gnutls_priority=
2274
2448
                              server_settings["priority"],
2275
 
                              use_dbus=use_dbus)
2276
 
    if not debug:
 
2449
                              use_dbus=use_dbus,
 
2450
                              socketfd=(server_settings["socket"]
 
2451
                                        or None))
 
2452
    if not foreground:
2277
2453
        pidfilename = "/var/run/mandos.pid"
 
2454
        pidfile = None
2278
2455
        try:
2279
2456
            pidfile = open(pidfilename, "w")
2280
2457
        except IOError as e:
2295
2472
        os.setgid(gid)
2296
2473
        os.setuid(uid)
2297
2474
    except OSError as error:
2298
 
        if error[0] != errno.EPERM:
 
2475
        if error.errno != errno.EPERM:
2299
2476
            raise error
2300
2477
    
2301
2478
    if debug:
2319
2496
            os.close(null)
2320
2497
    
2321
2498
    # Need to fork before connecting to D-Bus
2322
 
    if not debug:
 
2499
    if not foreground:
2323
2500
        # Close all input and output, do double fork, etc.
2324
2501
        daemon()
2325
2502
    
 
2503
    # multiprocessing will use threads, so before we use gobject we
 
2504
    # need to inform gobject that threads will be used.
2326
2505
    gobject.threads_init()
2327
2506
    
2328
2507
    global main_loop
2363
2542
    old_client_settings = {}
2364
2543
    clients_data = {}
2365
2544
    
 
2545
    # This is used to redirect stdout and stderr for checker processes
 
2546
    global wnull
 
2547
    wnull = open(os.devnull, "w") # A writable /dev/null
 
2548
    # Only used if server is running in foreground but not in debug
 
2549
    # mode
 
2550
    if debug or not foreground:
 
2551
        wnull.close()
 
2552
    
2366
2553
    # Get client data and settings from last running state.
2367
2554
    if server_settings["restore"]:
2368
2555
        try:
2384
2571
    
2385
2572
    with PGPEngine() as pgp:
2386
2573
        for client_name, client in clients_data.iteritems():
 
2574
            # Skip removed clients
 
2575
            if client_name not in client_settings:
 
2576
                continue
 
2577
            
2387
2578
            # Decide which value to use after restoring saved state.
2388
2579
            # We have three different values: Old config file,
2389
2580
            # new config file, and saved state.
2451
2642
    # Create all client objects
2452
2643
    for client_name, client in clients_data.iteritems():
2453
2644
        tcp_server.clients[client_name] = client_class(
2454
 
            name = client_name, settings = client)
 
2645
            name = client_name, settings = client,
 
2646
            server_settings = server_settings)
2455
2647
    
2456
2648
    if not tcp_server.clients:
2457
2649
        logger.warning("No clients defined")
2458
2650
    
2459
 
    if not debug:
2460
 
        try:
2461
 
            with pidfile:
2462
 
                pid = os.getpid()
2463
 
                pidfile.write(str(pid) + "\n".encode("utf-8"))
2464
 
            del pidfile
2465
 
        except IOError:
2466
 
            logger.error("Could not write to file %r with PID %d",
2467
 
                         pidfilename, pid)
2468
 
        except NameError:
2469
 
            # "pidfile" was never created
2470
 
            pass
 
2651
    if not foreground:
 
2652
        if pidfile is not None:
 
2653
            try:
 
2654
                with pidfile:
 
2655
                    pid = os.getpid()
 
2656
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2657
            except IOError:
 
2658
                logger.error("Could not write to file %r with PID %d",
 
2659
                             pidfilename, pid)
 
2660
        del pidfile
2471
2661
        del pidfilename
2472
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2473
2662
    
2474
2663
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2475
2664
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2543
2732
        service.cleanup()
2544
2733
        
2545
2734
        multiprocessing.active_children()
 
2735
        wnull.close()
2546
2736
        if not (tcp_server.clients or client_settings):
2547
2737
            return
2548
2738
        
2560
2750
                # A list of attributes that can not be pickled
2561
2751
                # + secret.
2562
2752
                exclude = set(("bus", "changedstate", "secret",
2563
 
                               "checker"))
 
2753
                               "checker", "server_settings"))
2564
2754
                for name, typ in (inspect.getmembers
2565
2755
                                  (dbus.service.Object)):
2566
2756
                    exclude.add(name)