/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2012-05-12 15:45:57 UTC
  • Revision ID: teddy@recompile.se-20120512154557-r1yzcb8su8byp4us
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
                    self.send_changedstate() after change, not before.
  (Client.disable): Bug fix: Handle disable_initiator_tag and
                    checker_initiator_tag of 0.
  (Client.init_checker): Bug fix: Remove old checker_initiator_tag and
                         disable_initiator_tag, if any.
  (Client.bump_timeout): Bug fix: Remove old disable_initiator_tag, if
                         any.
  (ClientDBus.Timeout_dbus_property): Bug fix: Use self.expires.
  (ClientHandler.handle): Bug fix: timedelta_to_milliseconds is a
                          global function, not a class method.
* mandos-monitor (MandosClientWidget._update_timer_callback_lock):
  Removed.  All users changed.
  (MandosClientWidget.last_checked_ok): Removed (unused).
  (MandosClientWidget.__init__): Don't call self.using_timer().
  (MandosClientWidget.property_changed): Removed unused version.
  (MandosClientWidget.using_timer): Stop using the counter
                                    self._update_timer_callback_lock;
                                    be strictly boolean.
  (MandosClientWidget.need_approval): Don't call self.using_timer().
  (MandosClientWidget.update): Call self.using_timer() throughout.
                               Bug fix: Never show negative timers.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
68
68
import binascii
69
69
import tempfile
70
70
import itertools
71
 
import collections
72
71
 
73
72
import dbus
74
73
import dbus.service
79
78
import ctypes.util
80
79
import xml.dom.minidom
81
80
import inspect
 
81
import GnuPGInterface
82
82
 
83
83
try:
84
84
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
88
88
    except ImportError:
89
89
        SO_BINDTODEVICE = None
90
90
 
91
 
version = "1.6.0"
 
91
version = "1.5.3"
92
92
stored_state_file = "clients.pickle"
93
93
 
94
94
logger = logging.getLogger()
139
139
class PGPEngine(object):
140
140
    """A simple class for OpenPGP symmetric encryption & decryption"""
141
141
    def __init__(self):
 
142
        self.gnupg = GnuPGInterface.GnuPG()
142
143
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
143
 
        self.gnupgargs = ['--batch',
144
 
                          '--home', self.tempdir,
145
 
                          '--force-mdc',
146
 
                          '--quiet',
147
 
                          '--no-use-agent']
 
144
        self.gnupg = GnuPGInterface.GnuPG()
 
145
        self.gnupg.options.meta_interactive = False
 
146
        self.gnupg.options.homedir = self.tempdir
 
147
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
148
                                              '--quiet',
 
149
                                              '--no-use-agent'])
148
150
    
149
151
    def __enter__(self):
150
152
        return self
151
153
    
152
 
    def __exit__(self, exc_type, exc_value, traceback):
 
154
    def __exit__ (self, exc_type, exc_value, traceback):
153
155
        self._cleanup()
154
156
        return False
155
157
    
175
177
        return b"mandos" + binascii.hexlify(password)
176
178
    
177
179
    def encrypt(self, data, password):
178
 
        passphrase = self.password_encode(password)
179
 
        with tempfile.NamedTemporaryFile(dir=self.tempdir
180
 
                                         ) as passfile:
181
 
            passfile.write(passphrase)
182
 
            passfile.flush()
183
 
            proc = subprocess.Popen(['gpg', '--symmetric',
184
 
                                     '--passphrase-file',
185
 
                                     passfile.name]
186
 
                                    + self.gnupgargs,
187
 
                                    stdin = subprocess.PIPE,
188
 
                                    stdout = subprocess.PIPE,
189
 
                                    stderr = subprocess.PIPE)
190
 
            ciphertext, err = proc.communicate(input = data)
191
 
        if proc.returncode != 0:
192
 
            raise PGPError(err)
 
180
        self.gnupg.passphrase = self.password_encode(password)
 
181
        with open(os.devnull, "w") as devnull:
 
182
            try:
 
183
                proc = self.gnupg.run(['--symmetric'],
 
184
                                      create_fhs=['stdin', 'stdout'],
 
185
                                      attach_fhs={'stderr': devnull})
 
186
                with contextlib.closing(proc.handles['stdin']) as f:
 
187
                    f.write(data)
 
188
                with contextlib.closing(proc.handles['stdout']) as f:
 
189
                    ciphertext = f.read()
 
190
                proc.wait()
 
191
            except IOError as e:
 
192
                raise PGPError(e)
 
193
        self.gnupg.passphrase = None
193
194
        return ciphertext
194
195
    
195
196
    def decrypt(self, data, password):
196
 
        passphrase = self.password_encode(password)
197
 
        with tempfile.NamedTemporaryFile(dir = self.tempdir
198
 
                                         ) as passfile:
199
 
            passfile.write(passphrase)
200
 
            passfile.flush()
201
 
            proc = subprocess.Popen(['gpg', '--decrypt',
202
 
                                     '--passphrase-file',
203
 
                                     passfile.name]
204
 
                                    + self.gnupgargs,
205
 
                                    stdin = subprocess.PIPE,
206
 
                                    stdout = subprocess.PIPE,
207
 
                                    stderr = subprocess.PIPE)
208
 
            decrypted_plaintext, err = proc.communicate(input
209
 
                                                        = data)
210
 
        if proc.returncode != 0:
211
 
            raise PGPError(err)
 
197
        self.gnupg.passphrase = self.password_encode(password)
 
198
        with open(os.devnull, "w") as devnull:
 
199
            try:
 
200
                proc = self.gnupg.run(['--decrypt'],
 
201
                                      create_fhs=['stdin', 'stdout'],
 
202
                                      attach_fhs={'stderr': devnull})
 
203
                with contextlib.closing(proc.handles['stdin']) as f:
 
204
                    f.write(data)
 
205
                with contextlib.closing(proc.handles['stdout']) as f:
 
206
                    decrypted_plaintext = f.read()
 
207
                proc.wait()
 
208
            except IOError as e:
 
209
                raise PGPError(e)
 
210
        self.gnupg.passphrase = None
212
211
        return decrypted_plaintext
213
212
 
214
213
 
234
233
               Used to optionally bind to the specified interface.
235
234
    name: string; Example: 'Mandos'
236
235
    type: string; Example: '_mandos._tcp'.
237
 
     See <https://www.iana.org/assignments/service-names-port-numbers>
 
236
                  See <http://www.dns-sd.org/ServiceTypes.html>
238
237
    port: integer; what port to announce
239
238
    TXT: list of strings; TXT record for the service
240
239
    domain: string; Domain to publish on, default to .local if empty.
380
379
                                 self.server_state_changed)
381
380
        self.server_state_changed(self.server.GetState())
382
381
 
383
 
 
384
382
class AvahiServiceToSyslog(AvahiService):
385
383
    def rename(self):
386
384
        """Add the new name to the syslog messages"""
391
389
                                .format(self.name)))
392
390
        return ret
393
391
 
394
 
 
395
392
def timedelta_to_milliseconds(td):
396
393
    "Convert a datetime.timedelta() to milliseconds"
397
394
    return ((td.days * 24 * 60 * 60 * 1000)
398
395
            + (td.seconds * 1000)
399
396
            + (td.microseconds // 1000))
400
397
 
401
 
 
402
398
class Client(object):
403
399
    """A representation of a client host served by this server.
404
400
    
440
436
    runtime_expansions: Allowed attributes for runtime expansion.
441
437
    expires:    datetime.datetime(); time (UTC) when a client will be
442
438
                disabled, or None
443
 
    server_settings: The server_settings dict from main()
444
439
    """
445
440
    
446
441
    runtime_expansions = ("approval_delay", "approval_duration",
447
 
                          "created", "enabled", "expires",
448
 
                          "fingerprint", "host", "interval",
449
 
                          "last_approval_request", "last_checked_ok",
 
442
                          "created", "enabled", "fingerprint",
 
443
                          "host", "interval", "last_checked_ok",
450
444
                          "last_enabled", "name", "timeout")
451
 
    client_defaults = { "timeout": "PT5M",
452
 
                        "extended_timeout": "PT15M",
453
 
                        "interval": "PT2M",
 
445
    client_defaults = { "timeout": "5m",
 
446
                        "extended_timeout": "15m",
 
447
                        "interval": "2m",
454
448
                        "checker": "fping -q -- %%(host)s",
455
449
                        "host": "",
456
 
                        "approval_delay": "PT0S",
457
 
                        "approval_duration": "PT1S",
 
450
                        "approval_delay": "0s",
 
451
                        "approval_duration": "1s",
458
452
                        "approved_by_default": "True",
459
453
                        "enabled": "True",
460
454
                        }
521
515
        
522
516
        return settings
523
517
    
524
 
    def __init__(self, settings, name = None, server_settings=None):
 
518
    def __init__(self, settings, name = None):
525
519
        self.name = name
526
 
        if server_settings is None:
527
 
            server_settings = {}
528
 
        self.server_settings = server_settings
529
520
        # adding all client settings
530
521
        for setting, value in settings.iteritems():
531
522
            setattr(self, setting, value)
696
687
                                      self.current_checker_command)
697
688
        # Start a new checker if needed
698
689
        if self.checker is None:
699
 
            # Escape attributes for the shell
700
 
            escaped_attrs = dict(
701
 
                (attr, re.escape(unicode(getattr(self, attr))))
702
 
                for attr in
703
 
                self.runtime_expansions)
704
690
            try:
705
 
                command = self.checker_command % escaped_attrs
706
 
            except TypeError as error:
707
 
                logger.error('Could not format string "%s"',
708
 
                             self.checker_command, exc_info=error)
709
 
                return True # Try again later
 
691
                # In case checker_command has exactly one % operator
 
692
                command = self.checker_command % self.host
 
693
            except TypeError:
 
694
                # Escape attributes for the shell
 
695
                escaped_attrs = dict(
 
696
                    (attr,
 
697
                     re.escape(unicode(str(getattr(self, attr, "")),
 
698
                                       errors=
 
699
                                       'replace')))
 
700
                    for attr in
 
701
                    self.runtime_expansions)
 
702
                
 
703
                try:
 
704
                    command = self.checker_command % escaped_attrs
 
705
                except TypeError as error:
 
706
                    logger.error('Could not format string "%s"',
 
707
                                 self.checker_command, exc_info=error)
 
708
                    return True # Try again later
710
709
            self.current_checker_command = command
711
710
            try:
712
711
                logger.info("Starting checker %r for %s",
715
714
                # in normal mode, that is already done by daemon(),
716
715
                # and in debug mode we don't want to.  (Stdin is
717
716
                # always replaced by /dev/null.)
718
 
                # The exception is when not debugging but nevertheless
719
 
                # running in the foreground; use the previously
720
 
                # created wnull.
721
 
                popen_args = {}
722
 
                if (not self.server_settings["debug"]
723
 
                    and self.server_settings["foreground"]):
724
 
                    popen_args.update({"stdout": wnull,
725
 
                                       "stderr": wnull })
726
717
                self.checker = subprocess.Popen(command,
727
718
                                                close_fds=True,
728
 
                                                shell=True, cwd="/",
729
 
                                                **popen_args)
 
719
                                                shell=True, cwd="/")
 
720
                self.checker_callback_tag = (gobject.child_watch_add
 
721
                                             (self.checker.pid,
 
722
                                              self.checker_callback,
 
723
                                              data=command))
 
724
                # The checker may have completed before the gobject
 
725
                # watch was added.  Check for this.
 
726
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
727
                if pid:
 
728
                    gobject.source_remove(self.checker_callback_tag)
 
729
                    self.checker_callback(pid, status, command)
730
730
            except OSError as error:
731
731
                logger.error("Failed to start subprocess",
732
732
                             exc_info=error)
733
 
                return True
734
 
            self.checker_callback_tag = (gobject.child_watch_add
735
 
                                         (self.checker.pid,
736
 
                                          self.checker_callback,
737
 
                                          data=command))
738
 
            # The checker may have completed before the gobject
739
 
            # watch was added.  Check for this.
740
 
            try:
741
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
742
 
            except OSError as error:
743
 
                if error.errno == errno.ECHILD:
744
 
                    # This should never happen
745
 
                    logger.error("Child process vanished",
746
 
                                 exc_info=error)
747
 
                    return True
748
 
                raise
749
 
            if pid:
750
 
                gobject.source_remove(self.checker_callback_tag)
751
 
                self.checker_callback(pid, status, command)
752
733
        # Re-run this periodically if run by gobject.timeout_add
753
734
        return True
754
735
    
1039
1020
        return xmlstring
1040
1021
 
1041
1022
 
1042
 
def datetime_to_dbus(dt, variant_level=0):
 
1023
def datetime_to_dbus (dt, variant_level=0):
1043
1024
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1044
1025
    if dt is None:
1045
1026
        return dbus.String("", variant_level = variant_level)
1053
1034
    interface names according to the "alt_interface_names" mapping.
1054
1035
    Usage:
1055
1036
    
1056
 
    @alternate_dbus_interfaces({"org.example.Interface":
1057
 
                                    "net.example.AlternateInterface"})
 
1037
    @alternate_dbus_names({"org.example.Interface":
 
1038
                               "net.example.AlternateInterface"})
1058
1039
    class SampleDBusObject(dbus.service.Object):
1059
1040
        @dbus.service.method("org.example.Interface")
1060
1041
        def SampleDBusMethod():
1091
1072
                interface_names.add(alt_interface)
1092
1073
                # Is this a D-Bus signal?
1093
1074
                if getattr(attribute, "_dbus_is_signal", False):
1094
 
                    # Extract the original non-method undecorated
1095
 
                    # function by black magic
 
1075
                    # Extract the original non-method function by
 
1076
                    # black magic
1096
1077
                    nonmethod_func = (dict(
1097
1078
                            zip(attribute.func_code.co_freevars,
1098
1079
                                attribute.__closure__))["func"]
1922
1903
        use_ipv6:       Boolean; to use IPv6 or not
1923
1904
    """
1924
1905
    def __init__(self, server_address, RequestHandlerClass,
1925
 
                 interface=None, use_ipv6=True, socketfd=None):
1926
 
        """If socketfd is set, use that file descriptor instead of
1927
 
        creating a new one with socket.socket().
1928
 
        """
 
1906
                 interface=None, use_ipv6=True):
1929
1907
        self.interface = interface
1930
1908
        if use_ipv6:
1931
1909
            self.address_family = socket.AF_INET6
1932
 
        if socketfd is not None:
1933
 
            # Save the file descriptor
1934
 
            self.socketfd = socketfd
1935
 
            # Save the original socket.socket() function
1936
 
            self.socket_socket = socket.socket
1937
 
            # To implement --socket, we monkey patch socket.socket.
1938
 
            # 
1939
 
            # (When socketserver.TCPServer is a new-style class, we
1940
 
            # could make self.socket into a property instead of monkey
1941
 
            # patching socket.socket.)
1942
 
            # 
1943
 
            # Create a one-time-only replacement for socket.socket()
1944
 
            @functools.wraps(socket.socket)
1945
 
            def socket_wrapper(*args, **kwargs):
1946
 
                # Restore original function so subsequent calls are
1947
 
                # not affected.
1948
 
                socket.socket = self.socket_socket
1949
 
                del self.socket_socket
1950
 
                # This time only, return a new socket object from the
1951
 
                # saved file descriptor.
1952
 
                return socket.fromfd(self.socketfd, *args, **kwargs)
1953
 
            # Replace socket.socket() function with wrapper
1954
 
            socket.socket = socket_wrapper
1955
 
        # The socketserver.TCPServer.__init__ will call
1956
 
        # socket.socket(), which might be our replacement,
1957
 
        # socket_wrapper(), if socketfd was set.
1958
1910
        socketserver.TCPServer.__init__(self, server_address,
1959
1911
                                        RequestHandlerClass)
1960
 
    
1961
1912
    def server_bind(self):
1962
1913
        """This overrides the normal server_bind() function
1963
1914
        to bind to an interface if one was specified, and also NOT to
1971
1922
                try:
1972
1923
                    self.socket.setsockopt(socket.SOL_SOCKET,
1973
1924
                                           SO_BINDTODEVICE,
1974
 
                                           str(self.interface + '\0'))
 
1925
                                           str(self.interface
 
1926
                                               + '\0'))
1975
1927
                except socket.error as error:
1976
 
                    if error.errno == errno.EPERM:
1977
 
                        logger.error("No permission to bind to"
1978
 
                                     " interface %s", self.interface)
1979
 
                    elif error.errno == errno.ENOPROTOOPT:
 
1928
                    if error[0] == errno.EPERM:
 
1929
                        logger.error("No permission to"
 
1930
                                     " bind to interface %s",
 
1931
                                     self.interface)
 
1932
                    elif error[0] == errno.ENOPROTOOPT:
1980
1933
                        logger.error("SO_BINDTODEVICE not available;"
1981
1934
                                     " cannot bind to interface %s",
1982
1935
                                     self.interface)
1983
 
                    elif error.errno == errno.ENODEV:
1984
 
                        logger.error("Interface %s does not exist,"
1985
 
                                     " cannot bind", self.interface)
1986
1936
                    else:
1987
1937
                        raise
1988
1938
        # Only bind(2) the socket if we really need to.
1991
1941
                if self.address_family == socket.AF_INET6:
1992
1942
                    any_address = "::" # in6addr_any
1993
1943
                else:
1994
 
                    any_address = "0.0.0.0" # INADDR_ANY
 
1944
                    any_address = socket.INADDR_ANY
1995
1945
                self.server_address = (any_address,
1996
1946
                                       self.server_address[1])
1997
1947
            elif not self.server_address[1]:
2018
1968
    """
2019
1969
    def __init__(self, server_address, RequestHandlerClass,
2020
1970
                 interface=None, use_ipv6=True, clients=None,
2021
 
                 gnutls_priority=None, use_dbus=True, socketfd=None):
 
1971
                 gnutls_priority=None, use_dbus=True):
2022
1972
        self.enabled = False
2023
1973
        self.clients = clients
2024
1974
        if self.clients is None:
2028
1978
        IPv6_TCPServer.__init__(self, server_address,
2029
1979
                                RequestHandlerClass,
2030
1980
                                interface = interface,
2031
 
                                use_ipv6 = use_ipv6,
2032
 
                                socketfd = socketfd)
 
1981
                                use_ipv6 = use_ipv6)
2033
1982
    def server_activate(self):
2034
1983
        if self.enabled:
2035
1984
            return socketserver.TCPServer.server_activate(self)
2113
2062
        return True
2114
2063
 
2115
2064
 
2116
 
def rfc3339_duration_to_delta(duration):
2117
 
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2118
 
    
2119
 
    >>> rfc3339_duration_to_delta("P7D")
2120
 
    datetime.timedelta(7)
2121
 
    >>> rfc3339_duration_to_delta("PT60S")
2122
 
    datetime.timedelta(0, 60)
2123
 
    >>> rfc3339_duration_to_delta("PT60M")
2124
 
    datetime.timedelta(0, 3600)
2125
 
    >>> rfc3339_duration_to_delta("PT24H")
2126
 
    datetime.timedelta(1)
2127
 
    >>> rfc3339_duration_to_delta("P1W")
2128
 
    datetime.timedelta(7)
2129
 
    >>> rfc3339_duration_to_delta("PT5M30S")
2130
 
    datetime.timedelta(0, 330)
2131
 
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2132
 
    datetime.timedelta(1, 200)
2133
 
    """
2134
 
    
2135
 
    # Parsing an RFC 3339 duration with regular expressions is not
2136
 
    # possible - there would have to be multiple places for the same
2137
 
    # values, like seconds.  The current code, while more esoteric, is
2138
 
    # cleaner without depending on a parsing library.  If Python had a
2139
 
    # built-in library for parsing we would use it, but we'd like to
2140
 
    # avoid excessive use of external libraries.
2141
 
    
2142
 
    # New type for defining tokens, syntax, and semantics all-in-one
2143
 
    Token = collections.namedtuple("Token",
2144
 
                                   ("regexp", # To match token; if
2145
 
                                              # "value" is not None,
2146
 
                                              # must have a "group"
2147
 
                                              # containing digits
2148
 
                                    "value",  # datetime.timedelta or
2149
 
                                              # None
2150
 
                                    "followers")) # Tokens valid after
2151
 
                                                  # this token
2152
 
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2153
 
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2154
 
    token_end = Token(re.compile(r"$"), None, frozenset())
2155
 
    token_second = Token(re.compile(r"(\d+)S"),
2156
 
                         datetime.timedelta(seconds=1),
2157
 
                         frozenset((token_end,)))
2158
 
    token_minute = Token(re.compile(r"(\d+)M"),
2159
 
                         datetime.timedelta(minutes=1),
2160
 
                         frozenset((token_second, token_end)))
2161
 
    token_hour = Token(re.compile(r"(\d+)H"),
2162
 
                       datetime.timedelta(hours=1),
2163
 
                       frozenset((token_minute, token_end)))
2164
 
    token_time = Token(re.compile(r"T"),
2165
 
                       None,
2166
 
                       frozenset((token_hour, token_minute,
2167
 
                                  token_second)))
2168
 
    token_day = Token(re.compile(r"(\d+)D"),
2169
 
                      datetime.timedelta(days=1),
2170
 
                      frozenset((token_time, token_end)))
2171
 
    token_month = Token(re.compile(r"(\d+)M"),
2172
 
                        datetime.timedelta(weeks=4),
2173
 
                        frozenset((token_day, token_end)))
2174
 
    token_year = Token(re.compile(r"(\d+)Y"),
2175
 
                       datetime.timedelta(weeks=52),
2176
 
                       frozenset((token_month, token_end)))
2177
 
    token_week = Token(re.compile(r"(\d+)W"),
2178
 
                       datetime.timedelta(weeks=1),
2179
 
                       frozenset((token_end,)))
2180
 
    token_duration = Token(re.compile(r"P"), None,
2181
 
                           frozenset((token_year, token_month,
2182
 
                                      token_day, token_time,
2183
 
                                      token_week))),
2184
 
    # Define starting values
2185
 
    value = datetime.timedelta() # Value so far
2186
 
    found_token = None
2187
 
    followers = frozenset(token_duration,) # Following valid tokens
2188
 
    s = duration                # String left to parse
2189
 
    # Loop until end token is found
2190
 
    while found_token is not token_end:
2191
 
        # Search for any currently valid tokens
2192
 
        for token in followers:
2193
 
            match = token.regexp.match(s)
2194
 
            if match is not None:
2195
 
                # Token found
2196
 
                if token.value is not None:
2197
 
                    # Value found, parse digits
2198
 
                    factor = int(match.group(1), 10)
2199
 
                    # Add to value so far
2200
 
                    value += factor * token.value
2201
 
                # Strip token from string
2202
 
                s = token.regexp.sub("", s, 1)
2203
 
                # Go to found token
2204
 
                found_token = token
2205
 
                # Set valid next tokens
2206
 
                followers = found_token.followers
2207
 
                break
2208
 
        else:
2209
 
            # No currently valid tokens were found
2210
 
            raise ValueError("Invalid RFC 3339 duration")
2211
 
    # End token found
2212
 
    return value
2213
 
 
2214
 
 
2215
2065
def string_to_delta(interval):
2216
2066
    """Parse a string and return a datetime.timedelta
2217
2067
    
2228
2078
    >>> string_to_delta('5m 30s')
2229
2079
    datetime.timedelta(0, 330)
2230
2080
    """
2231
 
    
2232
 
    try:
2233
 
        return rfc3339_duration_to_delta(interval)
2234
 
    except ValueError:
2235
 
        pass
2236
 
    
2237
2081
    timevalue = datetime.timedelta(0)
2238
2082
    for s in interval.split():
2239
2083
        try:
2302
2146
                        help="Run self-test")
2303
2147
    parser.add_argument("--debug", action="store_true",
2304
2148
                        help="Debug mode; run in foreground and log"
2305
 
                        " to terminal", default=None)
 
2149
                        " to terminal")
2306
2150
    parser.add_argument("--debuglevel", metavar="LEVEL",
2307
2151
                        help="Debug level for stdout output")
2308
2152
    parser.add_argument("--priority", help="GnuTLS"
2315
2159
                        " files")
2316
2160
    parser.add_argument("--no-dbus", action="store_false",
2317
2161
                        dest="use_dbus", help="Do not provide D-Bus"
2318
 
                        " system bus interface", default=None)
 
2162
                        " system bus interface")
2319
2163
    parser.add_argument("--no-ipv6", action="store_false",
2320
 
                        dest="use_ipv6", help="Do not use IPv6",
2321
 
                        default=None)
 
2164
                        dest="use_ipv6", help="Do not use IPv6")
2322
2165
    parser.add_argument("--no-restore", action="store_false",
2323
2166
                        dest="restore", help="Do not restore stored"
2324
 
                        " state", default=None)
2325
 
    parser.add_argument("--socket", type=int,
2326
 
                        help="Specify a file descriptor to a network"
2327
 
                        " socket to use instead of creating one")
 
2167
                        " state")
2328
2168
    parser.add_argument("--statedir", metavar="DIR",
2329
2169
                        help="Directory to save/restore state in")
2330
 
    parser.add_argument("--foreground", action="store_true",
2331
 
                        help="Run in foreground", default=None)
2332
2170
    
2333
2171
    options = parser.parse_args()
2334
2172
    
2343
2181
                        "port": "",
2344
2182
                        "debug": "False",
2345
2183
                        "priority":
2346
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224",
 
2184
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2347
2185
                        "servicename": "Mandos",
2348
2186
                        "use_dbus": "True",
2349
2187
                        "use_ipv6": "True",
2350
2188
                        "debuglevel": "",
2351
2189
                        "restore": "True",
2352
 
                        "socket": "",
2353
 
                        "statedir": "/var/lib/mandos",
2354
 
                        "foreground": "False",
 
2190
                        "statedir": "/var/lib/mandos"
2355
2191
                        }
2356
2192
    
2357
2193
    # Parse config file for server-global settings
2362
2198
    # Convert the SafeConfigParser object to a dict
2363
2199
    server_settings = server_config.defaults()
2364
2200
    # Use the appropriate methods on the non-string config options
2365
 
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
 
2201
    for option in ("debug", "use_dbus", "use_ipv6"):
2366
2202
        server_settings[option] = server_config.getboolean("DEFAULT",
2367
2203
                                                           option)
2368
2204
    if server_settings["port"]:
2369
2205
        server_settings["port"] = server_config.getint("DEFAULT",
2370
2206
                                                       "port")
2371
 
    if server_settings["socket"]:
2372
 
        server_settings["socket"] = server_config.getint("DEFAULT",
2373
 
                                                         "socket")
2374
 
        # Later, stdin will, and stdout and stderr might, be dup'ed
2375
 
        # over with an opened os.devnull.  But we don't want this to
2376
 
        # happen with a supplied network socket.
2377
 
        if 0 <= server_settings["socket"] <= 2:
2378
 
            server_settings["socket"] = os.dup(server_settings
2379
 
                                               ["socket"])
2380
2207
    del server_config
2381
2208
    
2382
2209
    # Override the settings from the config file with command line
2384
2211
    for option in ("interface", "address", "port", "debug",
2385
2212
                   "priority", "servicename", "configdir",
2386
2213
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2387
 
                   "statedir", "socket", "foreground"):
 
2214
                   "statedir"):
2388
2215
        value = getattr(options, option)
2389
2216
        if value is not None:
2390
2217
            server_settings[option] = value
2393
2220
    for option in server_settings.keys():
2394
2221
        if type(server_settings[option]) is str:
2395
2222
            server_settings[option] = unicode(server_settings[option])
2396
 
    # Force all boolean options to be boolean
2397
 
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
2398
 
                   "foreground"):
2399
 
        server_settings[option] = bool(server_settings[option])
2400
 
    # Debug implies foreground
2401
 
    if server_settings["debug"]:
2402
 
        server_settings["foreground"] = True
2403
2223
    # Now we have our good server settings in "server_settings"
2404
2224
    
2405
2225
    ##################################################################
2411
2231
    use_ipv6 = server_settings["use_ipv6"]
2412
2232
    stored_state_path = os.path.join(server_settings["statedir"],
2413
2233
                                     stored_state_file)
2414
 
    foreground = server_settings["foreground"]
2415
2234
    
2416
2235
    if debug:
2417
2236
        initlogger(debug, logging.DEBUG)
2446
2265
                              use_ipv6=use_ipv6,
2447
2266
                              gnutls_priority=
2448
2267
                              server_settings["priority"],
2449
 
                              use_dbus=use_dbus,
2450
 
                              socketfd=(server_settings["socket"]
2451
 
                                        or None))
2452
 
    if not foreground:
 
2268
                              use_dbus=use_dbus)
 
2269
    if not debug:
2453
2270
        pidfilename = "/var/run/mandos.pid"
2454
 
        pidfile = None
2455
2271
        try:
2456
2272
            pidfile = open(pidfilename, "w")
2457
2273
        except IOError as e:
2472
2288
        os.setgid(gid)
2473
2289
        os.setuid(uid)
2474
2290
    except OSError as error:
2475
 
        if error.errno != errno.EPERM:
 
2291
        if error[0] != errno.EPERM:
2476
2292
            raise error
2477
2293
    
2478
2294
    if debug:
2496
2312
            os.close(null)
2497
2313
    
2498
2314
    # Need to fork before connecting to D-Bus
2499
 
    if not foreground:
 
2315
    if not debug:
2500
2316
        # Close all input and output, do double fork, etc.
2501
2317
        daemon()
2502
2318
    
2503
 
    # multiprocessing will use threads, so before we use gobject we
2504
 
    # need to inform gobject that threads will be used.
2505
2319
    gobject.threads_init()
2506
2320
    
2507
2321
    global main_loop
2542
2356
    old_client_settings = {}
2543
2357
    clients_data = {}
2544
2358
    
2545
 
    # This is used to redirect stdout and stderr for checker processes
2546
 
    global wnull
2547
 
    wnull = open(os.devnull, "w") # A writable /dev/null
2548
 
    # Only used if server is running in foreground but not in debug
2549
 
    # mode
2550
 
    if debug or not foreground:
2551
 
        wnull.close()
2552
 
    
2553
2359
    # Get client data and settings from last running state.
2554
2360
    if server_settings["restore"]:
2555
2361
        try:
2571
2377
    
2572
2378
    with PGPEngine() as pgp:
2573
2379
        for client_name, client in clients_data.iteritems():
2574
 
            # Skip removed clients
2575
 
            if client_name not in client_settings:
2576
 
                continue
2577
 
            
2578
2380
            # Decide which value to use after restoring saved state.
2579
2381
            # We have three different values: Old config file,
2580
2382
            # new config file, and saved state.
2642
2444
    # Create all client objects
2643
2445
    for client_name, client in clients_data.iteritems():
2644
2446
        tcp_server.clients[client_name] = client_class(
2645
 
            name = client_name, settings = client,
2646
 
            server_settings = server_settings)
 
2447
            name = client_name, settings = client)
2647
2448
    
2648
2449
    if not tcp_server.clients:
2649
2450
        logger.warning("No clients defined")
2650
2451
    
2651
 
    if not foreground:
2652
 
        if pidfile is not None:
2653
 
            try:
2654
 
                with pidfile:
2655
 
                    pid = os.getpid()
2656
 
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
2657
 
            except IOError:
2658
 
                logger.error("Could not write to file %r with PID %d",
2659
 
                             pidfilename, pid)
2660
 
        del pidfile
 
2452
    if not debug:
 
2453
        try:
 
2454
            with pidfile:
 
2455
                pid = os.getpid()
 
2456
                pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2457
            del pidfile
 
2458
        except IOError:
 
2459
            logger.error("Could not write to file %r with PID %d",
 
2460
                         pidfilename, pid)
 
2461
        except NameError:
 
2462
            # "pidfile" was never created
 
2463
            pass
2661
2464
        del pidfilename
 
2465
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2662
2466
    
2663
2467
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2664
2468
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2732
2536
        service.cleanup()
2733
2537
        
2734
2538
        multiprocessing.active_children()
2735
 
        wnull.close()
2736
2539
        if not (tcp_server.clients or client_settings):
2737
2540
            return
2738
2541
        
2750
2553
                # A list of attributes that can not be pickled
2751
2554
                # + secret.
2752
2555
                exclude = set(("bus", "changedstate", "secret",
2753
 
                               "checker", "server_settings"))
 
2556
                               "checker"))
2754
2557
                for name, typ in (inspect.getmembers
2755
2558
                                  (dbus.service.Object)):
2756
2559
                    exclude.add(name)