/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2012-06-22 23:33:56 UTC
  • Revision ID: teddy@recompile.se-20120622233356-odoqqt2ki2gssn37
* Makefile (check): Also check mandos-ctl.
* mandos-ctl: All options taking a time interval argument can now take
              an RFC 3339 duration.
  (rfc3339_duration_to_delta): New function.
  (string_to_delta): Try rfc3339_duration_to_delta first.
  (main): New "--check" option.
* mandos-ctl.xml (SYNOPSIS, OPTIONS): Document new "--check" option.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008-2014 Teddy Hogeborn
15
 
# Copyright © 2008-2014 Björn Påhlsson
 
14
# Copyright © 2008-2012 Teddy Hogeborn
 
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
68
68
import binascii
69
69
import tempfile
70
70
import itertools
71
 
import collections
72
71
 
73
72
import dbus
74
73
import dbus.service
79
78
import ctypes.util
80
79
import xml.dom.minidom
81
80
import inspect
 
81
import GnuPGInterface
82
82
 
83
83
try:
84
84
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
88
88
    except ImportError:
89
89
        SO_BINDTODEVICE = None
90
90
 
91
 
version = "1.6.5"
 
91
version = "1.6.0"
92
92
stored_state_file = "clients.pickle"
93
93
 
94
94
logger = logging.getLogger()
95
 
syslogger = None
 
95
syslogger = (logging.handlers.SysLogHandler
 
96
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
97
              address = str("/dev/log")))
96
98
 
97
99
try:
98
100
    if_nametoindex = (ctypes.cdll.LoadLibrary
114
116
def initlogger(debug, level=logging.WARNING):
115
117
    """init logger and add loglevel"""
116
118
    
117
 
    global syslogger
118
 
    syslogger = (logging.handlers.SysLogHandler
119
 
                 (facility =
120
 
                  logging.handlers.SysLogHandler.LOG_DAEMON,
121
 
                  address = str("/dev/log")))
122
119
    syslogger.setFormatter(logging.Formatter
123
120
                           ('Mandos [%(process)d]: %(levelname)s:'
124
121
                            ' %(message)s'))
142
139
class PGPEngine(object):
143
140
    """A simple class for OpenPGP symmetric encryption & decryption"""
144
141
    def __init__(self):
 
142
        self.gnupg = GnuPGInterface.GnuPG()
145
143
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
146
 
        self.gnupgargs = ['--batch',
147
 
                          '--home', self.tempdir,
148
 
                          '--force-mdc',
149
 
                          '--quiet',
150
 
                          '--no-use-agent']
 
144
        self.gnupg = GnuPGInterface.GnuPG()
 
145
        self.gnupg.options.meta_interactive = False
 
146
        self.gnupg.options.homedir = self.tempdir
 
147
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
148
                                              '--quiet',
 
149
                                              '--no-use-agent'])
151
150
    
152
151
    def __enter__(self):
153
152
        return self
175
174
    def password_encode(self, password):
176
175
        # Passphrase can not be empty and can not contain newlines or
177
176
        # NUL bytes.  So we prefix it and hex encode it.
178
 
        encoded = b"mandos" + binascii.hexlify(password)
179
 
        if len(encoded) > 2048:
180
 
            # GnuPG can't handle long passwords, so encode differently
181
 
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
182
 
                       .replace(b"\n", b"\\n")
183
 
                       .replace(b"\0", b"\\x00"))
184
 
        return encoded
 
177
        return b"mandos" + binascii.hexlify(password)
185
178
    
186
179
    def encrypt(self, data, password):
187
 
        passphrase = self.password_encode(password)
188
 
        with tempfile.NamedTemporaryFile(dir=self.tempdir
189
 
                                         ) as passfile:
190
 
            passfile.write(passphrase)
191
 
            passfile.flush()
192
 
            proc = subprocess.Popen(['gpg', '--symmetric',
193
 
                                     '--passphrase-file',
194
 
                                     passfile.name]
195
 
                                    + self.gnupgargs,
196
 
                                    stdin = subprocess.PIPE,
197
 
                                    stdout = subprocess.PIPE,
198
 
                                    stderr = subprocess.PIPE)
199
 
            ciphertext, err = proc.communicate(input = data)
200
 
        if proc.returncode != 0:
201
 
            raise PGPError(err)
 
180
        self.gnupg.passphrase = self.password_encode(password)
 
181
        with open(os.devnull, "w") as devnull:
 
182
            try:
 
183
                proc = self.gnupg.run(['--symmetric'],
 
184
                                      create_fhs=['stdin', 'stdout'],
 
185
                                      attach_fhs={'stderr': devnull})
 
186
                with contextlib.closing(proc.handles['stdin']) as f:
 
187
                    f.write(data)
 
188
                with contextlib.closing(proc.handles['stdout']) as f:
 
189
                    ciphertext = f.read()
 
190
                proc.wait()
 
191
            except IOError as e:
 
192
                raise PGPError(e)
 
193
        self.gnupg.passphrase = None
202
194
        return ciphertext
203
195
    
204
196
    def decrypt(self, data, password):
205
 
        passphrase = self.password_encode(password)
206
 
        with tempfile.NamedTemporaryFile(dir = self.tempdir
207
 
                                         ) as passfile:
208
 
            passfile.write(passphrase)
209
 
            passfile.flush()
210
 
            proc = subprocess.Popen(['gpg', '--decrypt',
211
 
                                     '--passphrase-file',
212
 
                                     passfile.name]
213
 
                                    + self.gnupgargs,
214
 
                                    stdin = subprocess.PIPE,
215
 
                                    stdout = subprocess.PIPE,
216
 
                                    stderr = subprocess.PIPE)
217
 
            decrypted_plaintext, err = proc.communicate(input
218
 
                                                        = data)
219
 
        if proc.returncode != 0:
220
 
            raise PGPError(err)
 
197
        self.gnupg.passphrase = self.password_encode(password)
 
198
        with open(os.devnull, "w") as devnull:
 
199
            try:
 
200
                proc = self.gnupg.run(['--decrypt'],
 
201
                                      create_fhs=['stdin', 'stdout'],
 
202
                                      attach_fhs={'stderr': devnull})
 
203
                with contextlib.closing(proc.handles['stdin']) as f:
 
204
                    f.write(data)
 
205
                with contextlib.closing(proc.handles['stdout']) as f:
 
206
                    decrypted_plaintext = f.read()
 
207
                proc.wait()
 
208
            except IOError as e:
 
209
                raise PGPError(e)
 
210
        self.gnupg.passphrase = None
221
211
        return decrypted_plaintext
222
212
 
223
213
 
243
233
               Used to optionally bind to the specified interface.
244
234
    name: string; Example: 'Mandos'
245
235
    type: string; Example: '_mandos._tcp'.
246
 
     See <https://www.iana.org/assignments/service-names-port-numbers>
 
236
                  See <http://www.dns-sd.org/ServiceTypes.html>
247
237
    port: integer; what port to announce
248
238
    TXT: list of strings; TXT record for the service
249
239
    domain: string; Domain to publish on, default to .local if empty.
449
439
    runtime_expansions: Allowed attributes for runtime expansion.
450
440
    expires:    datetime.datetime(); time (UTC) when a client will be
451
441
                disabled, or None
452
 
    server_settings: The server_settings dict from main()
453
442
    """
454
443
    
455
444
    runtime_expansions = ("approval_delay", "approval_duration",
457
446
                          "fingerprint", "host", "interval",
458
447
                          "last_approval_request", "last_checked_ok",
459
448
                          "last_enabled", "name", "timeout")
460
 
    client_defaults = { "timeout": "PT5M",
461
 
                        "extended_timeout": "PT15M",
462
 
                        "interval": "PT2M",
 
449
    client_defaults = { "timeout": "5m",
 
450
                        "extended_timeout": "15m",
 
451
                        "interval": "2m",
463
452
                        "checker": "fping -q -- %%(host)s",
464
453
                        "host": "",
465
 
                        "approval_delay": "PT0S",
466
 
                        "approval_duration": "PT1S",
 
454
                        "approval_delay": "0s",
 
455
                        "approval_duration": "1s",
467
456
                        "approved_by_default": "True",
468
457
                        "enabled": "True",
469
458
                        }
530
519
        
531
520
        return settings
532
521
    
533
 
    def __init__(self, settings, name = None, server_settings=None):
 
522
    def __init__(self, settings, name = None):
534
523
        self.name = name
535
 
        if server_settings is None:
536
 
            server_settings = {}
537
 
        self.server_settings = server_settings
538
524
        # adding all client settings
539
525
        for setting, value in settings.iteritems():
540
526
            setattr(self, setting, value)
693
679
        # If a checker exists, make sure it is not a zombie
694
680
        try:
695
681
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
696
 
        except AttributeError:
697
 
            pass
698
 
        except OSError as error:
699
 
            if error.errno != errno.ECHILD:
700
 
                raise
 
682
        except (AttributeError, OSError) as error:
 
683
            if (isinstance(error, OSError)
 
684
                and error.errno != errno.ECHILD):
 
685
                raise error
701
686
        else:
702
687
            if pid:
703
688
                logger.warning("Checker was a zombie")
725
710
                # in normal mode, that is already done by daemon(),
726
711
                # and in debug mode we don't want to.  (Stdin is
727
712
                # always replaced by /dev/null.)
728
 
                # The exception is when not debugging but nevertheless
729
 
                # running in the foreground; use the previously
730
 
                # created wnull.
731
 
                popen_args = {}
732
 
                if (not self.server_settings["debug"]
733
 
                    and self.server_settings["foreground"]):
734
 
                    popen_args.update({"stdout": wnull,
735
 
                                       "stderr": wnull })
736
713
                self.checker = subprocess.Popen(command,
737
714
                                                close_fds=True,
738
 
                                                shell=True, cwd="/",
739
 
                                                **popen_args)
 
715
                                                shell=True, cwd="/")
740
716
            except OSError as error:
741
717
                logger.error("Failed to start subprocess",
742
718
                             exc_info=error)
743
 
                return True
744
719
            self.checker_callback_tag = (gobject.child_watch_add
745
720
                                         (self.checker.pid,
746
721
                                          self.checker_callback,
747
722
                                          data=command))
748
723
            # The checker may have completed before the gobject
749
724
            # watch was added.  Check for this.
750
 
            try:
751
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
752
 
            except OSError as error:
753
 
                if error.errno == errno.ECHILD:
754
 
                    # This should never happen
755
 
                    logger.error("Child process vanished",
756
 
                                 exc_info=error)
757
 
                    return True
758
 
                raise
 
725
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
759
726
            if pid:
760
727
                gobject.source_remove(self.checker_callback_tag)
761
728
                self.checker_callback(pid, status, command)
937
904
            # The byte_arrays option is not supported yet on
938
905
            # signatures other than "ay".
939
906
            if prop._dbus_signature != "ay":
940
 
                raise ValueError("Byte arrays not supported for non-"
941
 
                                 "'ay' signature {0!r}"
942
 
                                 .format(prop._dbus_signature))
 
907
                raise ValueError
943
908
            value = dbus.ByteArray(b''.join(chr(byte)
944
909
                                            for byte in value))
945
910
        prop(value)
1103
1068
                interface_names.add(alt_interface)
1104
1069
                # Is this a D-Bus signal?
1105
1070
                if getattr(attribute, "_dbus_is_signal", False):
1106
 
                    # Extract the original non-method undecorated
1107
 
                    # function by black magic
 
1071
                    # Extract the original non-method function by
 
1072
                    # black magic
1108
1073
                    nonmethod_func = (dict(
1109
1074
                            zip(attribute.func_code.co_freevars,
1110
1075
                                attribute.__closure__))["func"]
1353
1318
                                       *args, **kwargs)
1354
1319
    
1355
1320
    def start_checker(self, *args, **kwargs):
1356
 
        old_checker_pid = getattr(self.checker, "pid", None)
 
1321
        old_checker = self.checker
 
1322
        if self.checker is not None:
 
1323
            old_checker_pid = self.checker.pid
 
1324
        else:
 
1325
            old_checker_pid = None
1357
1326
        r = Client.start_checker(self, *args, **kwargs)
1358
1327
        # Only if new checker process was started
1359
1328
        if (self.checker is not None
1704
1673
            logger.debug("Protocol version: %r", line)
1705
1674
            try:
1706
1675
                if int(line.strip().split()[0]) > 1:
1707
 
                    raise RuntimeError(line)
 
1676
                    raise RuntimeError
1708
1677
            except (ValueError, IndexError, RuntimeError) as error:
1709
1678
                logger.error("Unknown protocol version: %s", error)
1710
1679
                return
1917
1886
    
1918
1887
    def add_pipe(self, parent_pipe, proc):
1919
1888
        """Dummy function; override as necessary"""
1920
 
        raise NotImplementedError()
 
1889
        raise NotImplementedError
1921
1890
 
1922
1891
 
1923
1892
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1999
1968
                if self.address_family == socket.AF_INET6:
2000
1969
                    any_address = "::" # in6addr_any
2001
1970
                else:
2002
 
                    any_address = "0.0.0.0" # INADDR_ANY
 
1971
                    any_address = socket.INADDR_ANY
2003
1972
                self.server_address = (any_address,
2004
1973
                                       self.server_address[1])
2005
1974
            elif not self.server_address[1]:
2121
2090
        return True
2122
2091
 
2123
2092
 
2124
 
def rfc3339_duration_to_delta(duration):
2125
 
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2126
 
    
2127
 
    >>> rfc3339_duration_to_delta("P7D")
2128
 
    datetime.timedelta(7)
2129
 
    >>> rfc3339_duration_to_delta("PT60S")
2130
 
    datetime.timedelta(0, 60)
2131
 
    >>> rfc3339_duration_to_delta("PT60M")
2132
 
    datetime.timedelta(0, 3600)
2133
 
    >>> rfc3339_duration_to_delta("PT24H")
2134
 
    datetime.timedelta(1)
2135
 
    >>> rfc3339_duration_to_delta("P1W")
2136
 
    datetime.timedelta(7)
2137
 
    >>> rfc3339_duration_to_delta("PT5M30S")
2138
 
    datetime.timedelta(0, 330)
2139
 
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2140
 
    datetime.timedelta(1, 200)
2141
 
    """
2142
 
    
2143
 
    # Parsing an RFC 3339 duration with regular expressions is not
2144
 
    # possible - there would have to be multiple places for the same
2145
 
    # values, like seconds.  The current code, while more esoteric, is
2146
 
    # cleaner without depending on a parsing library.  If Python had a
2147
 
    # built-in library for parsing we would use it, but we'd like to
2148
 
    # avoid excessive use of external libraries.
2149
 
    
2150
 
    # New type for defining tokens, syntax, and semantics all-in-one
2151
 
    Token = collections.namedtuple("Token",
2152
 
                                   ("regexp", # To match token; if
2153
 
                                              # "value" is not None,
2154
 
                                              # must have a "group"
2155
 
                                              # containing digits
2156
 
                                    "value",  # datetime.timedelta or
2157
 
                                              # None
2158
 
                                    "followers")) # Tokens valid after
2159
 
                                                  # this token
2160
 
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2161
 
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2162
 
    token_end = Token(re.compile(r"$"), None, frozenset())
2163
 
    token_second = Token(re.compile(r"(\d+)S"),
2164
 
                         datetime.timedelta(seconds=1),
2165
 
                         frozenset((token_end,)))
2166
 
    token_minute = Token(re.compile(r"(\d+)M"),
2167
 
                         datetime.timedelta(minutes=1),
2168
 
                         frozenset((token_second, token_end)))
2169
 
    token_hour = Token(re.compile(r"(\d+)H"),
2170
 
                       datetime.timedelta(hours=1),
2171
 
                       frozenset((token_minute, token_end)))
2172
 
    token_time = Token(re.compile(r"T"),
2173
 
                       None,
2174
 
                       frozenset((token_hour, token_minute,
2175
 
                                  token_second)))
2176
 
    token_day = Token(re.compile(r"(\d+)D"),
2177
 
                      datetime.timedelta(days=1),
2178
 
                      frozenset((token_time, token_end)))
2179
 
    token_month = Token(re.compile(r"(\d+)M"),
2180
 
                        datetime.timedelta(weeks=4),
2181
 
                        frozenset((token_day, token_end)))
2182
 
    token_year = Token(re.compile(r"(\d+)Y"),
2183
 
                       datetime.timedelta(weeks=52),
2184
 
                       frozenset((token_month, token_end)))
2185
 
    token_week = Token(re.compile(r"(\d+)W"),
2186
 
                       datetime.timedelta(weeks=1),
2187
 
                       frozenset((token_end,)))
2188
 
    token_duration = Token(re.compile(r"P"), None,
2189
 
                           frozenset((token_year, token_month,
2190
 
                                      token_day, token_time,
2191
 
                                      token_week))),
2192
 
    # Define starting values
2193
 
    value = datetime.timedelta() # Value so far
2194
 
    found_token = None
2195
 
    followers = frozenset(token_duration,) # Following valid tokens
2196
 
    s = duration                # String left to parse
2197
 
    # Loop until end token is found
2198
 
    while found_token is not token_end:
2199
 
        # Search for any currently valid tokens
2200
 
        for token in followers:
2201
 
            match = token.regexp.match(s)
2202
 
            if match is not None:
2203
 
                # Token found
2204
 
                if token.value is not None:
2205
 
                    # Value found, parse digits
2206
 
                    factor = int(match.group(1), 10)
2207
 
                    # Add to value so far
2208
 
                    value += factor * token.value
2209
 
                # Strip token from string
2210
 
                s = token.regexp.sub("", s, 1)
2211
 
                # Go to found token
2212
 
                found_token = token
2213
 
                # Set valid next tokens
2214
 
                followers = found_token.followers
2215
 
                break
2216
 
        else:
2217
 
            # No currently valid tokens were found
2218
 
            raise ValueError("Invalid RFC 3339 duration")
2219
 
    # End token found
2220
 
    return value
2221
 
 
2222
 
 
2223
2093
def string_to_delta(interval):
2224
2094
    """Parse a string and return a datetime.timedelta
2225
2095
    
2236
2106
    >>> string_to_delta('5m 30s')
2237
2107
    datetime.timedelta(0, 330)
2238
2108
    """
2239
 
    
2240
 
    try:
2241
 
        return rfc3339_duration_to_delta(interval)
2242
 
    except ValueError:
2243
 
        pass
2244
 
    
2245
2109
    timevalue = datetime.timedelta(0)
2246
2110
    for s in interval.split():
2247
2111
        try:
2260
2124
            else:
2261
2125
                raise ValueError("Unknown suffix {0!r}"
2262
2126
                                 .format(suffix))
2263
 
        except IndexError as e:
 
2127
        except (ValueError, IndexError) as e:
2264
2128
            raise ValueError(*(e.args))
2265
2129
        timevalue += delta
2266
2130
    return timevalue
2310
2174
                        help="Run self-test")
2311
2175
    parser.add_argument("--debug", action="store_true",
2312
2176
                        help="Debug mode; run in foreground and log"
2313
 
                        " to terminal", default=None)
 
2177
                        " to terminal")
2314
2178
    parser.add_argument("--debuglevel", metavar="LEVEL",
2315
2179
                        help="Debug level for stdout output")
2316
2180
    parser.add_argument("--priority", help="GnuTLS"
2323
2187
                        " files")
2324
2188
    parser.add_argument("--no-dbus", action="store_false",
2325
2189
                        dest="use_dbus", help="Do not provide D-Bus"
2326
 
                        " system bus interface", default=None)
 
2190
                        " system bus interface")
2327
2191
    parser.add_argument("--no-ipv6", action="store_false",
2328
 
                        dest="use_ipv6", help="Do not use IPv6",
2329
 
                        default=None)
 
2192
                        dest="use_ipv6", help="Do not use IPv6")
2330
2193
    parser.add_argument("--no-restore", action="store_false",
2331
2194
                        dest="restore", help="Do not restore stored"
2332
 
                        " state", default=None)
 
2195
                        " state")
2333
2196
    parser.add_argument("--socket", type=int,
2334
2197
                        help="Specify a file descriptor to a network"
2335
2198
                        " socket to use instead of creating one")
2336
2199
    parser.add_argument("--statedir", metavar="DIR",
2337
2200
                        help="Directory to save/restore state in")
2338
2201
    parser.add_argument("--foreground", action="store_true",
2339
 
                        help="Run in foreground", default=None)
2340
 
    parser.add_argument("--no-zeroconf", action="store_false",
2341
 
                        dest="zeroconf", help="Do not use Zeroconf",
2342
 
                        default=None)
 
2202
                        help="Run in foreground")
2343
2203
    
2344
2204
    options = parser.parse_args()
2345
2205
    
2346
2206
    if options.check:
2347
2207
        import doctest
2348
 
        fail_count, test_count = doctest.testmod()
2349
 
        sys.exit(os.EX_OK if fail_count == 0 else 1)
 
2208
        doctest.testmod()
 
2209
        sys.exit()
2350
2210
    
2351
2211
    # Default values for config file for server-global settings
2352
2212
    server_defaults = { "interface": "",
2354
2214
                        "port": "",
2355
2215
                        "debug": "False",
2356
2216
                        "priority":
2357
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
 
2217
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2358
2218
                        "servicename": "Mandos",
2359
2219
                        "use_dbus": "True",
2360
2220
                        "use_ipv6": "True",
2363
2223
                        "socket": "",
2364
2224
                        "statedir": "/var/lib/mandos",
2365
2225
                        "foreground": "False",
2366
 
                        "zeroconf": "True",
2367
2226
                        }
2368
2227
    
2369
2228
    # Parse config file for server-global settings
2396
2255
    for option in ("interface", "address", "port", "debug",
2397
2256
                   "priority", "servicename", "configdir",
2398
2257
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2399
 
                   "statedir", "socket", "foreground", "zeroconf"):
 
2258
                   "statedir", "socket", "foreground"):
2400
2259
        value = getattr(options, option)
2401
2260
        if value is not None:
2402
2261
            server_settings[option] = value
2405
2264
    for option in server_settings.keys():
2406
2265
        if type(server_settings[option]) is str:
2407
2266
            server_settings[option] = unicode(server_settings[option])
2408
 
    # Force all boolean options to be boolean
2409
 
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
2410
 
                   "foreground", "zeroconf"):
2411
 
        server_settings[option] = bool(server_settings[option])
2412
2267
    # Debug implies foreground
2413
2268
    if server_settings["debug"]:
2414
2269
        server_settings["foreground"] = True
2416
2271
    
2417
2272
    ##################################################################
2418
2273
    
2419
 
    if (not server_settings["zeroconf"] and
2420
 
        not (server_settings["port"]
2421
 
             or server_settings["socket"] != "")):
2422
 
            parser.error("Needs port or socket to work without"
2423
 
                         " Zeroconf")
2424
 
    
2425
2274
    # For convenience
2426
2275
    debug = server_settings["debug"]
2427
2276
    debuglevel = server_settings["debuglevel"]
2430
2279
    stored_state_path = os.path.join(server_settings["statedir"],
2431
2280
                                     stored_state_file)
2432
2281
    foreground = server_settings["foreground"]
2433
 
    zeroconf = server_settings["zeroconf"]
2434
2282
    
2435
2283
    if debug:
2436
2284
        initlogger(debug, logging.DEBUG)
2457
2305
    global mandos_dbus_service
2458
2306
    mandos_dbus_service = None
2459
2307
    
2460
 
    socketfd = None
2461
 
    if server_settings["socket"] != "":
2462
 
        socketfd = server_settings["socket"]
2463
2308
    tcp_server = MandosServer((server_settings["address"],
2464
2309
                               server_settings["port"]),
2465
2310
                              ClientHandler,
2469
2314
                              gnutls_priority=
2470
2315
                              server_settings["priority"],
2471
2316
                              use_dbus=use_dbus,
2472
 
                              socketfd=socketfd)
 
2317
                              socketfd=(server_settings["socket"]
 
2318
                                        or None))
2473
2319
    if not foreground:
2474
 
        pidfilename = "/run/mandos.pid"
2475
 
        if not os.path.isdir("/run/."):
2476
 
            pidfilename = "/var/run/mandos.pid"
 
2320
        pidfilename = "/var/run/mandos.pid"
2477
2321
        pidfile = None
2478
2322
        try:
2479
2323
            pidfile = open(pidfilename, "w")
2496
2340
        os.setuid(uid)
2497
2341
    except OSError as error:
2498
2342
        if error.errno != errno.EPERM:
2499
 
            raise
 
2343
            raise error
2500
2344
    
2501
2345
    if debug:
2502
2346
        # Enable all possible GnuTLS debugging
2545
2389
            use_dbus = False
2546
2390
            server_settings["use_dbus"] = False
2547
2391
            tcp_server.use_dbus = False
2548
 
    if zeroconf:
2549
 
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2550
 
        service = AvahiServiceToSyslog(name =
2551
 
                                       server_settings["servicename"],
2552
 
                                       servicetype = "_mandos._tcp",
2553
 
                                       protocol = protocol, bus = bus)
2554
 
        if server_settings["interface"]:
2555
 
            service.interface = (if_nametoindex
2556
 
                                 (str(server_settings["interface"])))
 
2392
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
2393
    service = AvahiServiceToSyslog(name =
 
2394
                                   server_settings["servicename"],
 
2395
                                   servicetype = "_mandos._tcp",
 
2396
                                   protocol = protocol, bus = bus)
 
2397
    if server_settings["interface"]:
 
2398
        service.interface = (if_nametoindex
 
2399
                             (str(server_settings["interface"])))
2557
2400
    
2558
2401
    global multiprocessing_manager
2559
2402
    multiprocessing_manager = multiprocessing.Manager()
2566
2409
    old_client_settings = {}
2567
2410
    clients_data = {}
2568
2411
    
2569
 
    # This is used to redirect stdout and stderr for checker processes
2570
 
    global wnull
2571
 
    wnull = open(os.devnull, "w") # A writable /dev/null
2572
 
    # Only used if server is running in foreground but not in debug
2573
 
    # mode
2574
 
    if debug or not foreground:
2575
 
        wnull.close()
2576
 
    
2577
2412
    # Get client data and settings from last running state.
2578
2413
    if server_settings["restore"]:
2579
2414
        try:
2595
2430
    
2596
2431
    with PGPEngine() as pgp:
2597
2432
        for client_name, client in clients_data.iteritems():
2598
 
            # Skip removed clients
2599
 
            if client_name not in client_settings:
2600
 
                continue
2601
 
            
2602
2433
            # Decide which value to use after restoring saved state.
2603
2434
            # We have three different values: Old config file,
2604
2435
            # new config file, and saved state.
2666
2497
    # Create all client objects
2667
2498
    for client_name, client in clients_data.iteritems():
2668
2499
        tcp_server.clients[client_name] = client_class(
2669
 
            name = client_name, settings = client,
2670
 
            server_settings = server_settings)
 
2500
            name = client_name, settings = client)
2671
2501
    
2672
2502
    if not tcp_server.clients:
2673
2503
        logger.warning("No clients defined")
2753
2583
    
2754
2584
    def cleanup():
2755
2585
        "Cleanup function; run on exit"
2756
 
        if zeroconf:
2757
 
            service.cleanup()
 
2586
        service.cleanup()
2758
2587
        
2759
2588
        multiprocessing.active_children()
2760
 
        wnull.close()
2761
2589
        if not (tcp_server.clients or client_settings):
2762
2590
            return
2763
2591
        
2775
2603
                # A list of attributes that can not be pickled
2776
2604
                # + secret.
2777
2605
                exclude = set(("bus", "changedstate", "secret",
2778
 
                               "checker", "server_settings"))
 
2606
                               "checker"))
2779
2607
                for name, typ in (inspect.getmembers
2780
2608
                                  (dbus.service.Object)):
2781
2609
                    exclude.add(name)
2809
2637
            else:
2810
2638
                logger.warning("Could not save persistent state:",
2811
2639
                               exc_info=e)
2812
 
                raise
 
2640
                raise e
2813
2641
        
2814
2642
        # Delete all clients, and settings from config
2815
2643
        while tcp_server.clients:
2839
2667
    tcp_server.server_activate()
2840
2668
    
2841
2669
    # Find out what port we got
2842
 
    if zeroconf:
2843
 
        service.port = tcp_server.socket.getsockname()[1]
 
2670
    service.port = tcp_server.socket.getsockname()[1]
2844
2671
    if use_ipv6:
2845
2672
        logger.info("Now listening on address %r, port %d,"
2846
2673
                    " flowinfo %d, scope_id %d",
2852
2679
    #service.interface = tcp_server.socket.getsockname()[3]
2853
2680
    
2854
2681
    try:
2855
 
        if zeroconf:
2856
 
            # From the Avahi example code
2857
 
            try:
2858
 
                service.activate()
2859
 
            except dbus.exceptions.DBusException as error:
2860
 
                logger.critical("D-Bus Exception", exc_info=error)
2861
 
                cleanup()
2862
 
                sys.exit(1)
2863
 
            # End of Avahi example code
 
2682
        # From the Avahi example code
 
2683
        try:
 
2684
            service.activate()
 
2685
        except dbus.exceptions.DBusException as error:
 
2686
            logger.critical("D-Bus Exception", exc_info=error)
 
2687
            cleanup()
 
2688
            sys.exit(1)
 
2689
        # End of Avahi example code
2864
2690
        
2865
2691
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2866
2692
                             lambda *args, **kwargs: