/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2013-10-24 20:21:45 UTC
  • Revision ID: teddy@recompile.se-20131024202145-456a9y6x910a2vhb
* debian/control (Build-Depends): Changed debhelper version to (>= 9)
                                  to match debian/compat.
* mandos-options.xml (priority): Changed back to normal priority.
  (priority_compat): New option; for the server which needs to a
                     priority string compatible with old keys.
* mandos-conf.xml (OPTIONS/priority): Include "priority_compat".
* mandos.xml (OPTIONS/priority): - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008-2012 Teddy Hogeborn
15
 
# Copyright © 2008-2012 Björn Påhlsson
 
14
# Copyright © 2008-2013 Teddy Hogeborn
 
15
# Copyright © 2008-2013 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
68
68
import binascii
69
69
import tempfile
70
70
import itertools
 
71
import collections
71
72
 
72
73
import dbus
73
74
import dbus.service
78
79
import ctypes.util
79
80
import xml.dom.minidom
80
81
import inspect
81
 
import GnuPGInterface
82
82
 
83
83
try:
84
84
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
88
88
    except ImportError:
89
89
        SO_BINDTODEVICE = None
90
90
 
91
 
version = "1.5.3"
 
91
version = "1.6.1"
92
92
stored_state_file = "clients.pickle"
93
93
 
94
94
logger = logging.getLogger()
139
139
class PGPEngine(object):
140
140
    """A simple class for OpenPGP symmetric encryption & decryption"""
141
141
    def __init__(self):
142
 
        self.gnupg = GnuPGInterface.GnuPG()
143
142
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
 
        self.gnupg = GnuPGInterface.GnuPG()
145
 
        self.gnupg.options.meta_interactive = False
146
 
        self.gnupg.options.homedir = self.tempdir
147
 
        self.gnupg.options.extra_args.extend(['--force-mdc',
148
 
                                              '--quiet',
149
 
                                              '--no-use-agent'])
 
143
        self.gnupgargs = ['--batch',
 
144
                          '--home', self.tempdir,
 
145
                          '--force-mdc',
 
146
                          '--quiet',
 
147
                          '--no-use-agent']
150
148
    
151
149
    def __enter__(self):
152
150
        return self
153
151
    
154
 
    def __exit__ (self, exc_type, exc_value, traceback):
 
152
    def __exit__(self, exc_type, exc_value, traceback):
155
153
        self._cleanup()
156
154
        return False
157
155
    
174
172
    def password_encode(self, password):
175
173
        # Passphrase can not be empty and can not contain newlines or
176
174
        # NUL bytes.  So we prefix it and hex encode it.
177
 
        return b"mandos" + binascii.hexlify(password)
 
175
        encoded = b"mandos" + binascii.hexlify(password)
 
176
        if len(encoded) > 2048:
 
177
            # GnuPG can't handle long passwords, so encode differently
 
178
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
 
179
                       .replace(b"\n", b"\\n")
 
180
                       .replace(b"\0", b"\\x00"))
 
181
        return encoded
178
182
    
179
183
    def encrypt(self, data, password):
180
 
        self.gnupg.passphrase = self.password_encode(password)
181
 
        with open(os.devnull, "w") as devnull:
182
 
            try:
183
 
                proc = self.gnupg.run(['--symmetric'],
184
 
                                      create_fhs=['stdin', 'stdout'],
185
 
                                      attach_fhs={'stderr': devnull})
186
 
                with contextlib.closing(proc.handles['stdin']) as f:
187
 
                    f.write(data)
188
 
                with contextlib.closing(proc.handles['stdout']) as f:
189
 
                    ciphertext = f.read()
190
 
                proc.wait()
191
 
            except IOError as e:
192
 
                raise PGPError(e)
193
 
        self.gnupg.passphrase = None
 
184
        passphrase = self.password_encode(password)
 
185
        with tempfile.NamedTemporaryFile(dir=self.tempdir
 
186
                                         ) as passfile:
 
187
            passfile.write(passphrase)
 
188
            passfile.flush()
 
189
            proc = subprocess.Popen(['gpg', '--symmetric',
 
190
                                     '--passphrase-file',
 
191
                                     passfile.name]
 
192
                                    + self.gnupgargs,
 
193
                                    stdin = subprocess.PIPE,
 
194
                                    stdout = subprocess.PIPE,
 
195
                                    stderr = subprocess.PIPE)
 
196
            ciphertext, err = proc.communicate(input = data)
 
197
        if proc.returncode != 0:
 
198
            raise PGPError(err)
194
199
        return ciphertext
195
200
    
196
201
    def decrypt(self, data, password):
197
 
        self.gnupg.passphrase = self.password_encode(password)
198
 
        with open(os.devnull, "w") as devnull:
199
 
            try:
200
 
                proc = self.gnupg.run(['--decrypt'],
201
 
                                      create_fhs=['stdin', 'stdout'],
202
 
                                      attach_fhs={'stderr': devnull})
203
 
                with contextlib.closing(proc.handles['stdin']) as f:
204
 
                    f.write(data)
205
 
                with contextlib.closing(proc.handles['stdout']) as f:
206
 
                    decrypted_plaintext = f.read()
207
 
                proc.wait()
208
 
            except IOError as e:
209
 
                raise PGPError(e)
210
 
        self.gnupg.passphrase = None
 
202
        passphrase = self.password_encode(password)
 
203
        with tempfile.NamedTemporaryFile(dir = self.tempdir
 
204
                                         ) as passfile:
 
205
            passfile.write(passphrase)
 
206
            passfile.flush()
 
207
            proc = subprocess.Popen(['gpg', '--decrypt',
 
208
                                     '--passphrase-file',
 
209
                                     passfile.name]
 
210
                                    + self.gnupgargs,
 
211
                                    stdin = subprocess.PIPE,
 
212
                                    stdout = subprocess.PIPE,
 
213
                                    stderr = subprocess.PIPE)
 
214
            decrypted_plaintext, err = proc.communicate(input
 
215
                                                        = data)
 
216
        if proc.returncode != 0:
 
217
            raise PGPError(err)
211
218
        return decrypted_plaintext
212
219
 
213
220
 
233
240
               Used to optionally bind to the specified interface.
234
241
    name: string; Example: 'Mandos'
235
242
    type: string; Example: '_mandos._tcp'.
236
 
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
243
     See <https://www.iana.org/assignments/service-names-port-numbers>
237
244
    port: integer; what port to announce
238
245
    TXT: list of strings; TXT record for the service
239
246
    domain: string; Domain to publish on, default to .local if empty.
439
446
    runtime_expansions: Allowed attributes for runtime expansion.
440
447
    expires:    datetime.datetime(); time (UTC) when a client will be
441
448
                disabled, or None
 
449
    server_settings: The server_settings dict from main()
442
450
    """
443
451
    
444
452
    runtime_expansions = ("approval_delay", "approval_duration",
445
 
                          "created", "enabled", "fingerprint",
446
 
                          "host", "interval", "last_checked_ok",
 
453
                          "created", "enabled", "expires",
 
454
                          "fingerprint", "host", "interval",
 
455
                          "last_approval_request", "last_checked_ok",
447
456
                          "last_enabled", "name", "timeout")
448
 
    client_defaults = { "timeout": "5m",
449
 
                        "extended_timeout": "15m",
450
 
                        "interval": "2m",
 
457
    client_defaults = { "timeout": "PT5M",
 
458
                        "extended_timeout": "PT15M",
 
459
                        "interval": "PT2M",
451
460
                        "checker": "fping -q -- %%(host)s",
452
461
                        "host": "",
453
 
                        "approval_delay": "0s",
454
 
                        "approval_duration": "1s",
 
462
                        "approval_delay": "PT0S",
 
463
                        "approval_duration": "PT1S",
455
464
                        "approved_by_default": "True",
456
465
                        "enabled": "True",
457
466
                        }
518
527
        
519
528
        return settings
520
529
    
521
 
    def __init__(self, settings, name = None):
 
530
    def __init__(self, settings, name = None, server_settings=None):
522
531
        self.name = name
 
532
        if server_settings is None:
 
533
            server_settings = {}
 
534
        self.server_settings = server_settings
523
535
        # adding all client settings
524
536
        for setting, value in settings.iteritems():
525
537
            setattr(self, setting, value)
709
721
                # in normal mode, that is already done by daemon(),
710
722
                # and in debug mode we don't want to.  (Stdin is
711
723
                # always replaced by /dev/null.)
 
724
                # The exception is when not debugging but nevertheless
 
725
                # running in the foreground; use the previously
 
726
                # created wnull.
 
727
                popen_args = {}
 
728
                if (not self.server_settings["debug"]
 
729
                    and self.server_settings["foreground"]):
 
730
                    popen_args.update({"stdout": wnull,
 
731
                                       "stderr": wnull })
712
732
                self.checker = subprocess.Popen(command,
713
733
                                                close_fds=True,
714
 
                                                shell=True, cwd="/")
 
734
                                                shell=True, cwd="/",
 
735
                                                **popen_args)
715
736
            except OSError as error:
716
737
                logger.error("Failed to start subprocess",
717
738
                             exc_info=error)
 
739
                return True
718
740
            self.checker_callback_tag = (gobject.child_watch_add
719
741
                                         (self.checker.pid,
720
742
                                          self.checker_callback,
721
743
                                          data=command))
722
744
            # The checker may have completed before the gobject
723
745
            # watch was added.  Check for this.
724
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
746
            try:
 
747
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
748
            except OSError as error:
 
749
                if error.errno == errno.ECHILD:
 
750
                    # This should never happen
 
751
                    logger.error("Child process vanished",
 
752
                                 exc_info=error)
 
753
                    return True
 
754
                raise
725
755
            if pid:
726
756
                gobject.source_remove(self.checker_callback_tag)
727
757
                self.checker_callback(pid, status, command)
1015
1045
        return xmlstring
1016
1046
 
1017
1047
 
1018
 
def datetime_to_dbus (dt, variant_level=0):
 
1048
def datetime_to_dbus(dt, variant_level=0):
1019
1049
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1020
1050
    if dt is None:
1021
1051
        return dbus.String("", variant_level = variant_level)
1029
1059
    interface names according to the "alt_interface_names" mapping.
1030
1060
    Usage:
1031
1061
    
1032
 
    @alternate_dbus_names({"org.example.Interface":
1033
 
                               "net.example.AlternateInterface"})
 
1062
    @alternate_dbus_interfaces({"org.example.Interface":
 
1063
                                    "net.example.AlternateInterface"})
1034
1064
    class SampleDBusObject(dbus.service.Object):
1035
1065
        @dbus.service.method("org.example.Interface")
1036
1066
        def SampleDBusMethod():
1067
1097
                interface_names.add(alt_interface)
1068
1098
                # Is this a D-Bus signal?
1069
1099
                if getattr(attribute, "_dbus_is_signal", False):
1070
 
                    # Extract the original non-method function by
1071
 
                    # black magic
 
1100
                    # Extract the original non-method undecorated
 
1101
                    # function by black magic
1072
1102
                    nonmethod_func = (dict(
1073
1103
                            zip(attribute.func_code.co_freevars,
1074
1104
                                attribute.__closure__))["func"]
1898
1928
        use_ipv6:       Boolean; to use IPv6 or not
1899
1929
    """
1900
1930
    def __init__(self, server_address, RequestHandlerClass,
1901
 
                 interface=None, use_ipv6=True):
 
1931
                 interface=None, use_ipv6=True, socketfd=None):
 
1932
        """If socketfd is set, use that file descriptor instead of
 
1933
        creating a new one with socket.socket().
 
1934
        """
1902
1935
        self.interface = interface
1903
1936
        if use_ipv6:
1904
1937
            self.address_family = socket.AF_INET6
 
1938
        if socketfd is not None:
 
1939
            # Save the file descriptor
 
1940
            self.socketfd = socketfd
 
1941
            # Save the original socket.socket() function
 
1942
            self.socket_socket = socket.socket
 
1943
            # To implement --socket, we monkey patch socket.socket.
 
1944
            # 
 
1945
            # (When socketserver.TCPServer is a new-style class, we
 
1946
            # could make self.socket into a property instead of monkey
 
1947
            # patching socket.socket.)
 
1948
            # 
 
1949
            # Create a one-time-only replacement for socket.socket()
 
1950
            @functools.wraps(socket.socket)
 
1951
            def socket_wrapper(*args, **kwargs):
 
1952
                # Restore original function so subsequent calls are
 
1953
                # not affected.
 
1954
                socket.socket = self.socket_socket
 
1955
                del self.socket_socket
 
1956
                # This time only, return a new socket object from the
 
1957
                # saved file descriptor.
 
1958
                return socket.fromfd(self.socketfd, *args, **kwargs)
 
1959
            # Replace socket.socket() function with wrapper
 
1960
            socket.socket = socket_wrapper
 
1961
        # The socketserver.TCPServer.__init__ will call
 
1962
        # socket.socket(), which might be our replacement,
 
1963
        # socket_wrapper(), if socketfd was set.
1905
1964
        socketserver.TCPServer.__init__(self, server_address,
1906
1965
                                        RequestHandlerClass)
 
1966
    
1907
1967
    def server_bind(self):
1908
1968
        """This overrides the normal server_bind() function
1909
1969
        to bind to an interface if one was specified, and also NOT to
1917
1977
                try:
1918
1978
                    self.socket.setsockopt(socket.SOL_SOCKET,
1919
1979
                                           SO_BINDTODEVICE,
1920
 
                                           str(self.interface
1921
 
                                               + '\0'))
 
1980
                                           str(self.interface + '\0'))
1922
1981
                except socket.error as error:
1923
1982
                    if error.errno == errno.EPERM:
1924
 
                        logger.error("No permission to"
1925
 
                                     " bind to interface %s",
1926
 
                                     self.interface)
 
1983
                        logger.error("No permission to bind to"
 
1984
                                     " interface %s", self.interface)
1927
1985
                    elif error.errno == errno.ENOPROTOOPT:
1928
1986
                        logger.error("SO_BINDTODEVICE not available;"
1929
1987
                                     " cannot bind to interface %s",
1930
1988
                                     self.interface)
1931
1989
                    elif error.errno == errno.ENODEV:
1932
 
                        logger.error("Interface %s does not"
1933
 
                                     " exist, cannot bind",
1934
 
                                     self.interface)
 
1990
                        logger.error("Interface %s does not exist,"
 
1991
                                     " cannot bind", self.interface)
1935
1992
                    else:
1936
1993
                        raise
1937
1994
        # Only bind(2) the socket if we really need to.
1940
1997
                if self.address_family == socket.AF_INET6:
1941
1998
                    any_address = "::" # in6addr_any
1942
1999
                else:
1943
 
                    any_address = socket.INADDR_ANY
 
2000
                    any_address = "0.0.0.0" # INADDR_ANY
1944
2001
                self.server_address = (any_address,
1945
2002
                                       self.server_address[1])
1946
2003
            elif not self.server_address[1]:
1967
2024
    """
1968
2025
    def __init__(self, server_address, RequestHandlerClass,
1969
2026
                 interface=None, use_ipv6=True, clients=None,
1970
 
                 gnutls_priority=None, use_dbus=True):
 
2027
                 gnutls_priority=None, use_dbus=True, socketfd=None):
1971
2028
        self.enabled = False
1972
2029
        self.clients = clients
1973
2030
        if self.clients is None:
1977
2034
        IPv6_TCPServer.__init__(self, server_address,
1978
2035
                                RequestHandlerClass,
1979
2036
                                interface = interface,
1980
 
                                use_ipv6 = use_ipv6)
 
2037
                                use_ipv6 = use_ipv6,
 
2038
                                socketfd = socketfd)
1981
2039
    def server_activate(self):
1982
2040
        if self.enabled:
1983
2041
            return socketserver.TCPServer.server_activate(self)
2061
2119
        return True
2062
2120
 
2063
2121
 
 
2122
def rfc3339_duration_to_delta(duration):
 
2123
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
 
2124
    
 
2125
    >>> rfc3339_duration_to_delta("P7D")
 
2126
    datetime.timedelta(7)
 
2127
    >>> rfc3339_duration_to_delta("PT60S")
 
2128
    datetime.timedelta(0, 60)
 
2129
    >>> rfc3339_duration_to_delta("PT60M")
 
2130
    datetime.timedelta(0, 3600)
 
2131
    >>> rfc3339_duration_to_delta("PT24H")
 
2132
    datetime.timedelta(1)
 
2133
    >>> rfc3339_duration_to_delta("P1W")
 
2134
    datetime.timedelta(7)
 
2135
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2136
    datetime.timedelta(0, 330)
 
2137
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2138
    datetime.timedelta(1, 200)
 
2139
    """
 
2140
    
 
2141
    # Parsing an RFC 3339 duration with regular expressions is not
 
2142
    # possible - there would have to be multiple places for the same
 
2143
    # values, like seconds.  The current code, while more esoteric, is
 
2144
    # cleaner without depending on a parsing library.  If Python had a
 
2145
    # built-in library for parsing we would use it, but we'd like to
 
2146
    # avoid excessive use of external libraries.
 
2147
    
 
2148
    # New type for defining tokens, syntax, and semantics all-in-one
 
2149
    Token = collections.namedtuple("Token",
 
2150
                                   ("regexp", # To match token; if
 
2151
                                              # "value" is not None,
 
2152
                                              # must have a "group"
 
2153
                                              # containing digits
 
2154
                                    "value",  # datetime.timedelta or
 
2155
                                              # None
 
2156
                                    "followers")) # Tokens valid after
 
2157
                                                  # this token
 
2158
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
 
2159
    # the "duration" ABNF definition in RFC 3339, Appendix A.
 
2160
    token_end = Token(re.compile(r"$"), None, frozenset())
 
2161
    token_second = Token(re.compile(r"(\d+)S"),
 
2162
                         datetime.timedelta(seconds=1),
 
2163
                         frozenset((token_end,)))
 
2164
    token_minute = Token(re.compile(r"(\d+)M"),
 
2165
                         datetime.timedelta(minutes=1),
 
2166
                         frozenset((token_second, token_end)))
 
2167
    token_hour = Token(re.compile(r"(\d+)H"),
 
2168
                       datetime.timedelta(hours=1),
 
2169
                       frozenset((token_minute, token_end)))
 
2170
    token_time = Token(re.compile(r"T"),
 
2171
                       None,
 
2172
                       frozenset((token_hour, token_minute,
 
2173
                                  token_second)))
 
2174
    token_day = Token(re.compile(r"(\d+)D"),
 
2175
                      datetime.timedelta(days=1),
 
2176
                      frozenset((token_time, token_end)))
 
2177
    token_month = Token(re.compile(r"(\d+)M"),
 
2178
                        datetime.timedelta(weeks=4),
 
2179
                        frozenset((token_day, token_end)))
 
2180
    token_year = Token(re.compile(r"(\d+)Y"),
 
2181
                       datetime.timedelta(weeks=52),
 
2182
                       frozenset((token_month, token_end)))
 
2183
    token_week = Token(re.compile(r"(\d+)W"),
 
2184
                       datetime.timedelta(weeks=1),
 
2185
                       frozenset((token_end,)))
 
2186
    token_duration = Token(re.compile(r"P"), None,
 
2187
                           frozenset((token_year, token_month,
 
2188
                                      token_day, token_time,
 
2189
                                      token_week))),
 
2190
    # Define starting values
 
2191
    value = datetime.timedelta() # Value so far
 
2192
    found_token = None
 
2193
    followers = frozenset(token_duration,) # Following valid tokens
 
2194
    s = duration                # String left to parse
 
2195
    # Loop until end token is found
 
2196
    while found_token is not token_end:
 
2197
        # Search for any currently valid tokens
 
2198
        for token in followers:
 
2199
            match = token.regexp.match(s)
 
2200
            if match is not None:
 
2201
                # Token found
 
2202
                if token.value is not None:
 
2203
                    # Value found, parse digits
 
2204
                    factor = int(match.group(1), 10)
 
2205
                    # Add to value so far
 
2206
                    value += factor * token.value
 
2207
                # Strip token from string
 
2208
                s = token.regexp.sub("", s, 1)
 
2209
                # Go to found token
 
2210
                found_token = token
 
2211
                # Set valid next tokens
 
2212
                followers = found_token.followers
 
2213
                break
 
2214
        else:
 
2215
            # No currently valid tokens were found
 
2216
            raise ValueError("Invalid RFC 3339 duration")
 
2217
    # End token found
 
2218
    return value
 
2219
 
 
2220
 
2064
2221
def string_to_delta(interval):
2065
2222
    """Parse a string and return a datetime.timedelta
2066
2223
    
2077
2234
    >>> string_to_delta('5m 30s')
2078
2235
    datetime.timedelta(0, 330)
2079
2236
    """
 
2237
    
 
2238
    try:
 
2239
        return rfc3339_duration_to_delta(interval)
 
2240
    except ValueError:
 
2241
        pass
 
2242
    
2080
2243
    timevalue = datetime.timedelta(0)
2081
2244
    for s in interval.split():
2082
2245
        try:
2145
2308
                        help="Run self-test")
2146
2309
    parser.add_argument("--debug", action="store_true",
2147
2310
                        help="Debug mode; run in foreground and log"
2148
 
                        " to terminal")
 
2311
                        " to terminal", default=None)
2149
2312
    parser.add_argument("--debuglevel", metavar="LEVEL",
2150
2313
                        help="Debug level for stdout output")
2151
2314
    parser.add_argument("--priority", help="GnuTLS"
2158
2321
                        " files")
2159
2322
    parser.add_argument("--no-dbus", action="store_false",
2160
2323
                        dest="use_dbus", help="Do not provide D-Bus"
2161
 
                        " system bus interface")
 
2324
                        " system bus interface", default=None)
2162
2325
    parser.add_argument("--no-ipv6", action="store_false",
2163
 
                        dest="use_ipv6", help="Do not use IPv6")
 
2326
                        dest="use_ipv6", help="Do not use IPv6",
 
2327
                        default=None)
2164
2328
    parser.add_argument("--no-restore", action="store_false",
2165
2329
                        dest="restore", help="Do not restore stored"
2166
 
                        " state")
 
2330
                        " state", default=None)
 
2331
    parser.add_argument("--socket", type=int,
 
2332
                        help="Specify a file descriptor to a network"
 
2333
                        " socket to use instead of creating one")
2167
2334
    parser.add_argument("--statedir", metavar="DIR",
2168
2335
                        help="Directory to save/restore state in")
 
2336
    parser.add_argument("--foreground", action="store_true",
 
2337
                        help="Run in foreground", default=None)
2169
2338
    
2170
2339
    options = parser.parse_args()
2171
2340
    
2180
2349
                        "port": "",
2181
2350
                        "debug": "False",
2182
2351
                        "priority":
2183
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
2352
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2184
2353
                        "servicename": "Mandos",
2185
2354
                        "use_dbus": "True",
2186
2355
                        "use_ipv6": "True",
2187
2356
                        "debuglevel": "",
2188
2357
                        "restore": "True",
2189
 
                        "statedir": "/var/lib/mandos"
 
2358
                        "socket": "",
 
2359
                        "statedir": "/var/lib/mandos",
 
2360
                        "foreground": "False",
2190
2361
                        }
2191
2362
    
2192
2363
    # Parse config file for server-global settings
2197
2368
    # Convert the SafeConfigParser object to a dict
2198
2369
    server_settings = server_config.defaults()
2199
2370
    # Use the appropriate methods on the non-string config options
2200
 
    for option in ("debug", "use_dbus", "use_ipv6"):
 
2371
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2201
2372
        server_settings[option] = server_config.getboolean("DEFAULT",
2202
2373
                                                           option)
2203
2374
    if server_settings["port"]:
2204
2375
        server_settings["port"] = server_config.getint("DEFAULT",
2205
2376
                                                       "port")
 
2377
    if server_settings["socket"]:
 
2378
        server_settings["socket"] = server_config.getint("DEFAULT",
 
2379
                                                         "socket")
 
2380
        # Later, stdin will, and stdout and stderr might, be dup'ed
 
2381
        # over with an opened os.devnull.  But we don't want this to
 
2382
        # happen with a supplied network socket.
 
2383
        if 0 <= server_settings["socket"] <= 2:
 
2384
            server_settings["socket"] = os.dup(server_settings
 
2385
                                               ["socket"])
2206
2386
    del server_config
2207
2387
    
2208
2388
    # Override the settings from the config file with command line
2210
2390
    for option in ("interface", "address", "port", "debug",
2211
2391
                   "priority", "servicename", "configdir",
2212
2392
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2213
 
                   "statedir"):
 
2393
                   "statedir", "socket", "foreground"):
2214
2394
        value = getattr(options, option)
2215
2395
        if value is not None:
2216
2396
            server_settings[option] = value
2219
2399
    for option in server_settings.keys():
2220
2400
        if type(server_settings[option]) is str:
2221
2401
            server_settings[option] = unicode(server_settings[option])
 
2402
    # Force all boolean options to be boolean
 
2403
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
2404
                   "foreground"):
 
2405
        server_settings[option] = bool(server_settings[option])
 
2406
    # Debug implies foreground
 
2407
    if server_settings["debug"]:
 
2408
        server_settings["foreground"] = True
2222
2409
    # Now we have our good server settings in "server_settings"
2223
2410
    
2224
2411
    ##################################################################
2230
2417
    use_ipv6 = server_settings["use_ipv6"]
2231
2418
    stored_state_path = os.path.join(server_settings["statedir"],
2232
2419
                                     stored_state_file)
 
2420
    foreground = server_settings["foreground"]
2233
2421
    
2234
2422
    if debug:
2235
2423
        initlogger(debug, logging.DEBUG)
2264
2452
                              use_ipv6=use_ipv6,
2265
2453
                              gnutls_priority=
2266
2454
                              server_settings["priority"],
2267
 
                              use_dbus=use_dbus)
2268
 
    if not debug:
2269
 
        pidfilename = "/var/run/mandos.pid"
 
2455
                              use_dbus=use_dbus,
 
2456
                              socketfd=(server_settings["socket"]
 
2457
                                        or None))
 
2458
    if not foreground:
 
2459
        pidfilename = "/run/mandos.pid"
 
2460
        pidfile = None
2270
2461
        try:
2271
2462
            pidfile = open(pidfilename, "w")
2272
2463
        except IOError as e:
2311
2502
            os.close(null)
2312
2503
    
2313
2504
    # Need to fork before connecting to D-Bus
2314
 
    if not debug:
 
2505
    if not foreground:
2315
2506
        # Close all input and output, do double fork, etc.
2316
2507
        daemon()
2317
2508
    
 
2509
    # multiprocessing will use threads, so before we use gobject we
 
2510
    # need to inform gobject that threads will be used.
2318
2511
    gobject.threads_init()
2319
2512
    
2320
2513
    global main_loop
2355
2548
    old_client_settings = {}
2356
2549
    clients_data = {}
2357
2550
    
 
2551
    # This is used to redirect stdout and stderr for checker processes
 
2552
    global wnull
 
2553
    wnull = open(os.devnull, "w") # A writable /dev/null
 
2554
    # Only used if server is running in foreground but not in debug
 
2555
    # mode
 
2556
    if debug or not foreground:
 
2557
        wnull.close()
 
2558
    
2358
2559
    # Get client data and settings from last running state.
2359
2560
    if server_settings["restore"]:
2360
2561
        try:
2376
2577
    
2377
2578
    with PGPEngine() as pgp:
2378
2579
        for client_name, client in clients_data.iteritems():
 
2580
            # Skip removed clients
 
2581
            if client_name not in client_settings:
 
2582
                continue
 
2583
            
2379
2584
            # Decide which value to use after restoring saved state.
2380
2585
            # We have three different values: Old config file,
2381
2586
            # new config file, and saved state.
2443
2648
    # Create all client objects
2444
2649
    for client_name, client in clients_data.iteritems():
2445
2650
        tcp_server.clients[client_name] = client_class(
2446
 
            name = client_name, settings = client)
 
2651
            name = client_name, settings = client,
 
2652
            server_settings = server_settings)
2447
2653
    
2448
2654
    if not tcp_server.clients:
2449
2655
        logger.warning("No clients defined")
2450
2656
    
2451
 
    if not debug:
2452
 
        try:
2453
 
            with pidfile:
2454
 
                pid = os.getpid()
2455
 
                pidfile.write(str(pid) + "\n".encode("utf-8"))
2456
 
            del pidfile
2457
 
        except IOError:
2458
 
            logger.error("Could not write to file %r with PID %d",
2459
 
                         pidfilename, pid)
2460
 
        except NameError:
2461
 
            # "pidfile" was never created
2462
 
            pass
 
2657
    if not foreground:
 
2658
        if pidfile is not None:
 
2659
            try:
 
2660
                with pidfile:
 
2661
                    pid = os.getpid()
 
2662
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2663
            except IOError:
 
2664
                logger.error("Could not write to file %r with PID %d",
 
2665
                             pidfilename, pid)
 
2666
        del pidfile
2463
2667
        del pidfilename
2464
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2465
2668
    
2466
2669
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2467
2670
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2535
2738
        service.cleanup()
2536
2739
        
2537
2740
        multiprocessing.active_children()
 
2741
        wnull.close()
2538
2742
        if not (tcp_server.clients or client_settings):
2539
2743
            return
2540
2744
        
2552
2756
                # A list of attributes that can not be pickled
2553
2757
                # + secret.
2554
2758
                exclude = set(("bus", "changedstate", "secret",
2555
 
                               "checker"))
 
2759
                               "checker", "server_settings"))
2556
2760
                for name, typ in (inspect.getmembers
2557
2761
                                  (dbus.service.Object)):
2558
2762
                    exclude.add(name)