/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2012-05-26 22:21:17 UTC
  • mto: This revision was merged to the branch mainline in revision 591.
  • Revision ID: teddy@recompile.se-20120526222117-2n4oeb3hqyq4rjdh
* mandos: Implement "--socket" option.
  (IPv6_TCPServer.__init__): Take new "socketfd" parameter; use it.
  (MandosServer.__init__): Take new "socketfd" parameter.  Pass it on
                           to IPv6_TCPServer constructor.
  (main): Take new "--socket" option.  Also take "socket" parameter in
          "mandos.conf" configuration file.  If set, pass the value to
          MandosServer constructor.
* mandos-options.xml (socket): Document new "socket" option.
* mandos-conf.xml (OPTIONS): - '' -
* mandos.xml (SYNOPSIS, OPTIONS): Document new "--socket" option.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008-2013 Teddy Hogeborn
15
 
# Copyright © 2008-2013 Björn Påhlsson
 
14
# Copyright © 2008-2012 Teddy Hogeborn
 
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
68
68
import binascii
69
69
import tempfile
70
70
import itertools
71
 
import collections
72
71
 
73
72
import dbus
74
73
import dbus.service
79
78
import ctypes.util
80
79
import xml.dom.minidom
81
80
import inspect
 
81
import GnuPGInterface
82
82
 
83
83
try:
84
84
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
88
88
    except ImportError:
89
89
        SO_BINDTODEVICE = None
90
90
 
91
 
version = "1.6.1"
 
91
version = "1.5.4"
92
92
stored_state_file = "clients.pickle"
93
93
 
94
94
logger = logging.getLogger()
139
139
class PGPEngine(object):
140
140
    """A simple class for OpenPGP symmetric encryption & decryption"""
141
141
    def __init__(self):
 
142
        self.gnupg = GnuPGInterface.GnuPG()
142
143
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
143
 
        self.gnupgargs = ['--batch',
144
 
                          '--home', self.tempdir,
145
 
                          '--force-mdc',
146
 
                          '--quiet',
147
 
                          '--no-use-agent']
 
144
        self.gnupg = GnuPGInterface.GnuPG()
 
145
        self.gnupg.options.meta_interactive = False
 
146
        self.gnupg.options.homedir = self.tempdir
 
147
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
148
                                              '--quiet',
 
149
                                              '--no-use-agent'])
148
150
    
149
151
    def __enter__(self):
150
152
        return self
172
174
    def password_encode(self, password):
173
175
        # Passphrase can not be empty and can not contain newlines or
174
176
        # NUL bytes.  So we prefix it and hex encode it.
175
 
        encoded = b"mandos" + binascii.hexlify(password)
176
 
        if len(encoded) > 2048:
177
 
            # GnuPG can't handle long passwords, so encode differently
178
 
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
179
 
                       .replace(b"\n", b"\\n")
180
 
                       .replace(b"\0", b"\\x00"))
181
 
        return encoded
 
177
        return b"mandos" + binascii.hexlify(password)
182
178
    
183
179
    def encrypt(self, data, password):
184
 
        passphrase = self.password_encode(password)
185
 
        with tempfile.NamedTemporaryFile(dir=self.tempdir
186
 
                                         ) as passfile:
187
 
            passfile.write(passphrase)
188
 
            passfile.flush()
189
 
            proc = subprocess.Popen(['gpg', '--symmetric',
190
 
                                     '--passphrase-file',
191
 
                                     passfile.name]
192
 
                                    + self.gnupgargs,
193
 
                                    stdin = subprocess.PIPE,
194
 
                                    stdout = subprocess.PIPE,
195
 
                                    stderr = subprocess.PIPE)
196
 
            ciphertext, err = proc.communicate(input = data)
197
 
        if proc.returncode != 0:
198
 
            raise PGPError(err)
 
180
        self.gnupg.passphrase = self.password_encode(password)
 
181
        with open(os.devnull, "w") as devnull:
 
182
            try:
 
183
                proc = self.gnupg.run(['--symmetric'],
 
184
                                      create_fhs=['stdin', 'stdout'],
 
185
                                      attach_fhs={'stderr': devnull})
 
186
                with contextlib.closing(proc.handles['stdin']) as f:
 
187
                    f.write(data)
 
188
                with contextlib.closing(proc.handles['stdout']) as f:
 
189
                    ciphertext = f.read()
 
190
                proc.wait()
 
191
            except IOError as e:
 
192
                raise PGPError(e)
 
193
        self.gnupg.passphrase = None
199
194
        return ciphertext
200
195
    
201
196
    def decrypt(self, data, password):
202
 
        passphrase = self.password_encode(password)
203
 
        with tempfile.NamedTemporaryFile(dir = self.tempdir
204
 
                                         ) as passfile:
205
 
            passfile.write(passphrase)
206
 
            passfile.flush()
207
 
            proc = subprocess.Popen(['gpg', '--decrypt',
208
 
                                     '--passphrase-file',
209
 
                                     passfile.name]
210
 
                                    + self.gnupgargs,
211
 
                                    stdin = subprocess.PIPE,
212
 
                                    stdout = subprocess.PIPE,
213
 
                                    stderr = subprocess.PIPE)
214
 
            decrypted_plaintext, err = proc.communicate(input
215
 
                                                        = data)
216
 
        if proc.returncode != 0:
217
 
            raise PGPError(err)
 
197
        self.gnupg.passphrase = self.password_encode(password)
 
198
        with open(os.devnull, "w") as devnull:
 
199
            try:
 
200
                proc = self.gnupg.run(['--decrypt'],
 
201
                                      create_fhs=['stdin', 'stdout'],
 
202
                                      attach_fhs={'stderr': devnull})
 
203
                with contextlib.closing(proc.handles['stdin']) as f:
 
204
                    f.write(data)
 
205
                with contextlib.closing(proc.handles['stdout']) as f:
 
206
                    decrypted_plaintext = f.read()
 
207
                proc.wait()
 
208
            except IOError as e:
 
209
                raise PGPError(e)
 
210
        self.gnupg.passphrase = None
218
211
        return decrypted_plaintext
219
212
 
220
213
 
240
233
               Used to optionally bind to the specified interface.
241
234
    name: string; Example: 'Mandos'
242
235
    type: string; Example: '_mandos._tcp'.
243
 
     See <https://www.iana.org/assignments/service-names-port-numbers>
 
236
                  See <http://www.dns-sd.org/ServiceTypes.html>
244
237
    port: integer; what port to announce
245
238
    TXT: list of strings; TXT record for the service
246
239
    domain: string; Domain to publish on, default to .local if empty.
446
439
    runtime_expansions: Allowed attributes for runtime expansion.
447
440
    expires:    datetime.datetime(); time (UTC) when a client will be
448
441
                disabled, or None
449
 
    server_settings: The server_settings dict from main()
450
442
    """
451
443
    
452
444
    runtime_expansions = ("approval_delay", "approval_duration",
454
446
                          "fingerprint", "host", "interval",
455
447
                          "last_approval_request", "last_checked_ok",
456
448
                          "last_enabled", "name", "timeout")
457
 
    client_defaults = { "timeout": "PT5M",
458
 
                        "extended_timeout": "PT15M",
459
 
                        "interval": "PT2M",
 
449
    client_defaults = { "timeout": "5m",
 
450
                        "extended_timeout": "15m",
 
451
                        "interval": "2m",
460
452
                        "checker": "fping -q -- %%(host)s",
461
453
                        "host": "",
462
 
                        "approval_delay": "PT0S",
463
 
                        "approval_duration": "PT1S",
 
454
                        "approval_delay": "0s",
 
455
                        "approval_duration": "1s",
464
456
                        "approved_by_default": "True",
465
457
                        "enabled": "True",
466
458
                        }
527
519
        
528
520
        return settings
529
521
    
530
 
    def __init__(self, settings, name = None, server_settings=None):
 
522
    def __init__(self, settings, name = None):
531
523
        self.name = name
532
 
        if server_settings is None:
533
 
            server_settings = {}
534
 
        self.server_settings = server_settings
535
524
        # adding all client settings
536
525
        for setting, value in settings.iteritems():
537
526
            setattr(self, setting, value)
721
710
                # in normal mode, that is already done by daemon(),
722
711
                # and in debug mode we don't want to.  (Stdin is
723
712
                # always replaced by /dev/null.)
724
 
                # The exception is when not debugging but nevertheless
725
 
                # running in the foreground; use the previously
726
 
                # created wnull.
727
 
                popen_args = {}
728
 
                if (not self.server_settings["debug"]
729
 
                    and self.server_settings["foreground"]):
730
 
                    popen_args.update({"stdout": wnull,
731
 
                                       "stderr": wnull })
732
713
                self.checker = subprocess.Popen(command,
733
714
                                                close_fds=True,
734
 
                                                shell=True, cwd="/",
735
 
                                                **popen_args)
 
715
                                                shell=True, cwd="/")
736
716
            except OSError as error:
737
717
                logger.error("Failed to start subprocess",
738
718
                             exc_info=error)
739
 
                return True
740
719
            self.checker_callback_tag = (gobject.child_watch_add
741
720
                                         (self.checker.pid,
742
721
                                          self.checker_callback,
743
722
                                          data=command))
744
723
            # The checker may have completed before the gobject
745
724
            # watch was added.  Check for this.
746
 
            try:
747
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
748
 
            except OSError as error:
749
 
                if error.errno == errno.ECHILD:
750
 
                    # This should never happen
751
 
                    logger.error("Child process vanished",
752
 
                                 exc_info=error)
753
 
                    return True
754
 
                raise
 
725
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
755
726
            if pid:
756
727
                gobject.source_remove(self.checker_callback_tag)
757
728
                self.checker_callback(pid, status, command)
1097
1068
                interface_names.add(alt_interface)
1098
1069
                # Is this a D-Bus signal?
1099
1070
                if getattr(attribute, "_dbus_is_signal", False):
1100
 
                    # Extract the original non-method undecorated
1101
 
                    # function by black magic
 
1071
                    # Extract the original non-method function by
 
1072
                    # black magic
1102
1073
                    nonmethod_func = (dict(
1103
1074
                            zip(attribute.func_code.co_freevars,
1104
1075
                                attribute.__closure__))["func"]
1977
1948
                try:
1978
1949
                    self.socket.setsockopt(socket.SOL_SOCKET,
1979
1950
                                           SO_BINDTODEVICE,
1980
 
                                           str(self.interface + '\0'))
 
1951
                                           str(self.interface
 
1952
                                               + '\0'))
1981
1953
                except socket.error as error:
1982
1954
                    if error.errno == errno.EPERM:
1983
 
                        logger.error("No permission to bind to"
1984
 
                                     " interface %s", self.interface)
 
1955
                        logger.error("No permission to"
 
1956
                                     " bind to interface %s",
 
1957
                                     self.interface)
1985
1958
                    elif error.errno == errno.ENOPROTOOPT:
1986
1959
                        logger.error("SO_BINDTODEVICE not available;"
1987
1960
                                     " cannot bind to interface %s",
1988
1961
                                     self.interface)
1989
1962
                    elif error.errno == errno.ENODEV:
1990
 
                        logger.error("Interface %s does not exist,"
1991
 
                                     " cannot bind", self.interface)
 
1963
                        logger.error("Interface %s does not"
 
1964
                                     " exist, cannot bind",
 
1965
                                     self.interface)
1992
1966
                    else:
1993
1967
                        raise
1994
1968
        # Only bind(2) the socket if we really need to.
1997
1971
                if self.address_family == socket.AF_INET6:
1998
1972
                    any_address = "::" # in6addr_any
1999
1973
                else:
2000
 
                    any_address = "0.0.0.0" # INADDR_ANY
 
1974
                    any_address = socket.INADDR_ANY
2001
1975
                self.server_address = (any_address,
2002
1976
                                       self.server_address[1])
2003
1977
            elif not self.server_address[1]:
2119
2093
        return True
2120
2094
 
2121
2095
 
2122
 
def rfc3339_duration_to_delta(duration):
2123
 
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2124
 
    
2125
 
    >>> rfc3339_duration_to_delta("P7D")
2126
 
    datetime.timedelta(7)
2127
 
    >>> rfc3339_duration_to_delta("PT60S")
2128
 
    datetime.timedelta(0, 60)
2129
 
    >>> rfc3339_duration_to_delta("PT60M")
2130
 
    datetime.timedelta(0, 3600)
2131
 
    >>> rfc3339_duration_to_delta("PT24H")
2132
 
    datetime.timedelta(1)
2133
 
    >>> rfc3339_duration_to_delta("P1W")
2134
 
    datetime.timedelta(7)
2135
 
    >>> rfc3339_duration_to_delta("PT5M30S")
2136
 
    datetime.timedelta(0, 330)
2137
 
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2138
 
    datetime.timedelta(1, 200)
2139
 
    """
2140
 
    
2141
 
    # Parsing an RFC 3339 duration with regular expressions is not
2142
 
    # possible - there would have to be multiple places for the same
2143
 
    # values, like seconds.  The current code, while more esoteric, is
2144
 
    # cleaner without depending on a parsing library.  If Python had a
2145
 
    # built-in library for parsing we would use it, but we'd like to
2146
 
    # avoid excessive use of external libraries.
2147
 
    
2148
 
    # New type for defining tokens, syntax, and semantics all-in-one
2149
 
    Token = collections.namedtuple("Token",
2150
 
                                   ("regexp", # To match token; if
2151
 
                                              # "value" is not None,
2152
 
                                              # must have a "group"
2153
 
                                              # containing digits
2154
 
                                    "value",  # datetime.timedelta or
2155
 
                                              # None
2156
 
                                    "followers")) # Tokens valid after
2157
 
                                                  # this token
2158
 
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2159
 
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2160
 
    token_end = Token(re.compile(r"$"), None, frozenset())
2161
 
    token_second = Token(re.compile(r"(\d+)S"),
2162
 
                         datetime.timedelta(seconds=1),
2163
 
                         frozenset((token_end,)))
2164
 
    token_minute = Token(re.compile(r"(\d+)M"),
2165
 
                         datetime.timedelta(minutes=1),
2166
 
                         frozenset((token_second, token_end)))
2167
 
    token_hour = Token(re.compile(r"(\d+)H"),
2168
 
                       datetime.timedelta(hours=1),
2169
 
                       frozenset((token_minute, token_end)))
2170
 
    token_time = Token(re.compile(r"T"),
2171
 
                       None,
2172
 
                       frozenset((token_hour, token_minute,
2173
 
                                  token_second)))
2174
 
    token_day = Token(re.compile(r"(\d+)D"),
2175
 
                      datetime.timedelta(days=1),
2176
 
                      frozenset((token_time, token_end)))
2177
 
    token_month = Token(re.compile(r"(\d+)M"),
2178
 
                        datetime.timedelta(weeks=4),
2179
 
                        frozenset((token_day, token_end)))
2180
 
    token_year = Token(re.compile(r"(\d+)Y"),
2181
 
                       datetime.timedelta(weeks=52),
2182
 
                       frozenset((token_month, token_end)))
2183
 
    token_week = Token(re.compile(r"(\d+)W"),
2184
 
                       datetime.timedelta(weeks=1),
2185
 
                       frozenset((token_end,)))
2186
 
    token_duration = Token(re.compile(r"P"), None,
2187
 
                           frozenset((token_year, token_month,
2188
 
                                      token_day, token_time,
2189
 
                                      token_week))),
2190
 
    # Define starting values
2191
 
    value = datetime.timedelta() # Value so far
2192
 
    found_token = None
2193
 
    followers = frozenset(token_duration,) # Following valid tokens
2194
 
    s = duration                # String left to parse
2195
 
    # Loop until end token is found
2196
 
    while found_token is not token_end:
2197
 
        # Search for any currently valid tokens
2198
 
        for token in followers:
2199
 
            match = token.regexp.match(s)
2200
 
            if match is not None:
2201
 
                # Token found
2202
 
                if token.value is not None:
2203
 
                    # Value found, parse digits
2204
 
                    factor = int(match.group(1), 10)
2205
 
                    # Add to value so far
2206
 
                    value += factor * token.value
2207
 
                # Strip token from string
2208
 
                s = token.regexp.sub("", s, 1)
2209
 
                # Go to found token
2210
 
                found_token = token
2211
 
                # Set valid next tokens
2212
 
                followers = found_token.followers
2213
 
                break
2214
 
        else:
2215
 
            # No currently valid tokens were found
2216
 
            raise ValueError("Invalid RFC 3339 duration")
2217
 
    # End token found
2218
 
    return value
2219
 
 
2220
 
 
2221
2096
def string_to_delta(interval):
2222
2097
    """Parse a string and return a datetime.timedelta
2223
2098
    
2234
2109
    >>> string_to_delta('5m 30s')
2235
2110
    datetime.timedelta(0, 330)
2236
2111
    """
2237
 
    
2238
 
    try:
2239
 
        return rfc3339_duration_to_delta(interval)
2240
 
    except ValueError:
2241
 
        pass
2242
 
    
2243
2112
    timevalue = datetime.timedelta(0)
2244
2113
    for s in interval.split():
2245
2114
        try:
2308
2177
                        help="Run self-test")
2309
2178
    parser.add_argument("--debug", action="store_true",
2310
2179
                        help="Debug mode; run in foreground and log"
2311
 
                        " to terminal", default=None)
 
2180
                        " to terminal")
2312
2181
    parser.add_argument("--debuglevel", metavar="LEVEL",
2313
2182
                        help="Debug level for stdout output")
2314
2183
    parser.add_argument("--priority", help="GnuTLS"
2321
2190
                        " files")
2322
2191
    parser.add_argument("--no-dbus", action="store_false",
2323
2192
                        dest="use_dbus", help="Do not provide D-Bus"
2324
 
                        " system bus interface", default=None)
 
2193
                        " system bus interface")
2325
2194
    parser.add_argument("--no-ipv6", action="store_false",
2326
 
                        dest="use_ipv6", help="Do not use IPv6",
2327
 
                        default=None)
 
2195
                        dest="use_ipv6", help="Do not use IPv6")
2328
2196
    parser.add_argument("--no-restore", action="store_false",
2329
2197
                        dest="restore", help="Do not restore stored"
2330
 
                        " state", default=None)
 
2198
                        " state")
2331
2199
    parser.add_argument("--socket", type=int,
2332
2200
                        help="Specify a file descriptor to a network"
2333
2201
                        " socket to use instead of creating one")
2334
2202
    parser.add_argument("--statedir", metavar="DIR",
2335
2203
                        help="Directory to save/restore state in")
2336
 
    parser.add_argument("--foreground", action="store_true",
2337
 
                        help="Run in foreground", default=None)
2338
2204
    
2339
2205
    options = parser.parse_args()
2340
2206
    
2349
2215
                        "port": "",
2350
2216
                        "debug": "False",
2351
2217
                        "priority":
2352
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
 
2218
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2353
2219
                        "servicename": "Mandos",
2354
2220
                        "use_dbus": "True",
2355
2221
                        "use_ipv6": "True",
2356
2222
                        "debuglevel": "",
2357
2223
                        "restore": "True",
2358
2224
                        "socket": "",
2359
 
                        "statedir": "/var/lib/mandos",
2360
 
                        "foreground": "False",
 
2225
                        "statedir": "/var/lib/mandos"
2361
2226
                        }
2362
2227
    
2363
2228
    # Parse config file for server-global settings
2368
2233
    # Convert the SafeConfigParser object to a dict
2369
2234
    server_settings = server_config.defaults()
2370
2235
    # Use the appropriate methods on the non-string config options
2371
 
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
 
2236
    for option in ("debug", "use_dbus", "use_ipv6"):
2372
2237
        server_settings[option] = server_config.getboolean("DEFAULT",
2373
2238
                                                           option)
2374
2239
    if server_settings["port"]:
2377
2242
    if server_settings["socket"]:
2378
2243
        server_settings["socket"] = server_config.getint("DEFAULT",
2379
2244
                                                         "socket")
2380
 
        # Later, stdin will, and stdout and stderr might, be dup'ed
 
2245
        # Later, stdin will, and stdout, and stderr might, be dup'ed
2381
2246
        # over with an opened os.devnull.  But we don't want this to
2382
2247
        # happen with a supplied network socket.
2383
2248
        if 0 <= server_settings["socket"] <= 2:
2390
2255
    for option in ("interface", "address", "port", "debug",
2391
2256
                   "priority", "servicename", "configdir",
2392
2257
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2393
 
                   "statedir", "socket", "foreground"):
 
2258
                   "statedir", "socket"):
2394
2259
        value = getattr(options, option)
2395
2260
        if value is not None:
2396
2261
            server_settings[option] = value
2399
2264
    for option in server_settings.keys():
2400
2265
        if type(server_settings[option]) is str:
2401
2266
            server_settings[option] = unicode(server_settings[option])
2402
 
    # Force all boolean options to be boolean
2403
 
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
2404
 
                   "foreground"):
2405
 
        server_settings[option] = bool(server_settings[option])
2406
 
    # Debug implies foreground
2407
 
    if server_settings["debug"]:
2408
 
        server_settings["foreground"] = True
2409
2267
    # Now we have our good server settings in "server_settings"
2410
2268
    
2411
2269
    ##################################################################
2417
2275
    use_ipv6 = server_settings["use_ipv6"]
2418
2276
    stored_state_path = os.path.join(server_settings["statedir"],
2419
2277
                                     stored_state_file)
2420
 
    foreground = server_settings["foreground"]
2421
2278
    
2422
2279
    if debug:
2423
2280
        initlogger(debug, logging.DEBUG)
2455
2312
                              use_dbus=use_dbus,
2456
2313
                              socketfd=(server_settings["socket"]
2457
2314
                                        or None))
2458
 
    if not foreground:
2459
 
        pidfilename = "/run/mandos.pid"
2460
 
        pidfile = None
 
2315
    if not debug:
 
2316
        pidfilename = "/var/run/mandos.pid"
2461
2317
        try:
2462
2318
            pidfile = open(pidfilename, "w")
2463
2319
        except IOError as e:
2502
2358
            os.close(null)
2503
2359
    
2504
2360
    # Need to fork before connecting to D-Bus
2505
 
    if not foreground:
 
2361
    if not debug:
2506
2362
        # Close all input and output, do double fork, etc.
2507
2363
        daemon()
2508
2364
    
2509
 
    # multiprocessing will use threads, so before we use gobject we
2510
 
    # need to inform gobject that threads will be used.
2511
2365
    gobject.threads_init()
2512
2366
    
2513
2367
    global main_loop
2548
2402
    old_client_settings = {}
2549
2403
    clients_data = {}
2550
2404
    
2551
 
    # This is used to redirect stdout and stderr for checker processes
2552
 
    global wnull
2553
 
    wnull = open(os.devnull, "w") # A writable /dev/null
2554
 
    # Only used if server is running in foreground but not in debug
2555
 
    # mode
2556
 
    if debug or not foreground:
2557
 
        wnull.close()
2558
 
    
2559
2405
    # Get client data and settings from last running state.
2560
2406
    if server_settings["restore"]:
2561
2407
        try:
2577
2423
    
2578
2424
    with PGPEngine() as pgp:
2579
2425
        for client_name, client in clients_data.iteritems():
2580
 
            # Skip removed clients
2581
 
            if client_name not in client_settings:
2582
 
                continue
2583
 
            
2584
2426
            # Decide which value to use after restoring saved state.
2585
2427
            # We have three different values: Old config file,
2586
2428
            # new config file, and saved state.
2648
2490
    # Create all client objects
2649
2491
    for client_name, client in clients_data.iteritems():
2650
2492
        tcp_server.clients[client_name] = client_class(
2651
 
            name = client_name, settings = client,
2652
 
            server_settings = server_settings)
 
2493
            name = client_name, settings = client)
2653
2494
    
2654
2495
    if not tcp_server.clients:
2655
2496
        logger.warning("No clients defined")
2656
2497
    
2657
 
    if not foreground:
2658
 
        if pidfile is not None:
2659
 
            try:
2660
 
                with pidfile:
2661
 
                    pid = os.getpid()
2662
 
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
2663
 
            except IOError:
2664
 
                logger.error("Could not write to file %r with PID %d",
2665
 
                             pidfilename, pid)
2666
 
        del pidfile
 
2498
    if not debug:
 
2499
        try:
 
2500
            with pidfile:
 
2501
                pid = os.getpid()
 
2502
                pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2503
            del pidfile
 
2504
        except IOError:
 
2505
            logger.error("Could not write to file %r with PID %d",
 
2506
                         pidfilename, pid)
 
2507
        except NameError:
 
2508
            # "pidfile" was never created
 
2509
            pass
2667
2510
        del pidfilename
2668
2511
    
2669
2512
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2738
2581
        service.cleanup()
2739
2582
        
2740
2583
        multiprocessing.active_children()
2741
 
        wnull.close()
2742
2584
        if not (tcp_server.clients or client_settings):
2743
2585
            return
2744
2586
        
2756
2598
                # A list of attributes that can not be pickled
2757
2599
                # + secret.
2758
2600
                exclude = set(("bus", "changedstate", "secret",
2759
 
                               "checker", "server_settings"))
 
2601
                               "checker"))
2760
2602
                for name, typ in (inspect.getmembers
2761
2603
                                  (dbus.service.Object)):
2762
2604
                    exclude.add(name)