To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos-ctl
- browse files at revision 13
- compare with another revision
- download diff
- download tarball
- view history from revision 13
- Committer: Björn Påhlsson
- Date: 2008-07-20 02:52:20 UTC
- Revision ID: belorn@braxen-20080720025220-r5u0388uy9iu23h6
Added following support:
Pluginbased client handler
rewritten Mandos client
Avahi instead of udp server discovery
openpgp encrypted key support
Passprompt stand alone application for direct console input
Added logging for Mandos server
Pluginbased client handler
rewritten Mandos client
Avahi instead of udp server discovery
openpgp encrypted key support
Passprompt stand alone application for direct console input
Added logging for Mandos server
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- debian/source
- debian/upstream
- network-hooks.d
- plugin-helpers
- files renamed:
- clients.conf => mandos-clients.conf
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos => server.py
- files modified:
- Makefile
added
removed
mandos-ctl
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8; after-save-hook: (lambda () (let ((command (if (and (boundp 'tramp-file-name-structure) (string-match (car tramp-file-name-structure) (buffer-file-name))) (tramp-file-name-localname (tramp-dissect-file-name (buffer-file-name))) (buffer-file-name)))) (if (= (shell-command (format "%s --check" (shell-quote-argument command)) "*Test*") 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)) (kill-buffer "*Test*")) (display-buffer "*Test*")))); -*-
3
#
4
# Mandos Monitor - Control and monitor the Mandos server
5
#
6
# Copyright © 2008-2019 Teddy Hogeborn
7
# Copyright © 2008-2019 Björn Påhlsson
8
#
9
# This file is part of Mandos.
10
#
11
# Mandos is free software: you can redistribute it and/or modify it
12
# under the terms of the GNU General Public License as published by
13
# the Free Software Foundation, either version 3 of the License, or
14
# (at your option) any later version.
15
#
16
# Mandos is distributed in the hope that it will be useful, but
17
# WITHOUT ANY WARRANTY; without even the implied warranty of
18
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19
# GNU General Public License for more details.
20
#
21
# You should have received a copy of the GNU General Public License
22
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
23
#
24
# Contact the authors at <mandos@recompile.se>.
25
#
26
27
from __future__ import (division, absolute_import, print_function,
28
unicode_literals)
29
30
try:
31
from future_builtins import *
32
except ImportError:
33
pass
34
35
import sys
36
import argparse
37
import locale
38
import datetime
39
import re
40
import os
41
import collections
42
import json
43
import unittest
44
import logging
45
46
import dbus
47
48
# Show warnings by default
49
if not sys.warnoptions:
50
import warnings
51
warnings.simplefilter("default")
52
53
log = logging.getLogger(sys.argv[0])
54
logging.basicConfig(level="INFO", # Show info level messages
55
format="%(message)s") # Show basic log messages
56
57
logging.captureWarnings(True) # Show warnings via the logging system
58
59
if sys.version_info.major == 2:
60
str = unicode
61
62
locale.setlocale(locale.LC_ALL, "")
63
64
tablewords = {
65
"Name": "Name",
66
"Enabled": "Enabled",
67
"Timeout": "Timeout",
68
"LastCheckedOK": "Last Successful Check",
69
"LastApprovalRequest": "Last Approval Request",
70
"Created": "Created",
71
"Interval": "Interval",
72
"Host": "Host",
73
"Fingerprint": "Fingerprint",
74
"KeyID": "Key ID",
75
"CheckerRunning": "Check Is Running",
76
"LastEnabled": "Last Enabled",
77
"ApprovalPending": "Approval Is Pending",
78
"ApprovedByDefault": "Approved By Default",
79
"ApprovalDelay": "Approval Delay",
80
"ApprovalDuration": "Approval Duration",
81
"Checker": "Checker",
82
"ExtendedTimeout": "Extended Timeout",
83
"Expires": "Expires",
84
"LastCheckerStatus": "Last Checker Status",
85
}
86
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
87
domain = "se.recompile"
88
busname = domain + ".Mandos"
89
server_path = "/"
90
server_interface = domain + ".Mandos"
91
client_interface = domain + ".Mandos.Client"
92
version = "1.8.3"
93
94
95
try:
96
dbus.OBJECT_MANAGER_IFACE
97
except AttributeError:
98
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
99
100
101
def milliseconds_to_string(ms):
102
td = datetime.timedelta(0, 0, 0, ms)
103
return ("{days}{hours:02}:{minutes:02}:{seconds:02}"
104
.format(days="{}T".format(td.days) if td.days else "",
105
hours=td.seconds // 3600,
106
minutes=(td.seconds % 3600) // 60,
107
seconds=td.seconds % 60))
108
109
110
def rfc3339_duration_to_delta(duration):
111
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
112
113
>>> rfc3339_duration_to_delta("P7D")
114
datetime.timedelta(7)
115
>>> rfc3339_duration_to_delta("PT60S")
116
datetime.timedelta(0, 60)
117
>>> rfc3339_duration_to_delta("PT60M")
118
datetime.timedelta(0, 3600)
119
>>> rfc3339_duration_to_delta("PT24H")
120
datetime.timedelta(1)
121
>>> rfc3339_duration_to_delta("P1W")
122
datetime.timedelta(7)
123
>>> rfc3339_duration_to_delta("PT5M30S")
124
datetime.timedelta(0, 330)
125
>>> rfc3339_duration_to_delta("P1DT3M20S")
126
datetime.timedelta(1, 200)
127
"""
128
129
# Parsing an RFC 3339 duration with regular expressions is not
130
# possible - there would have to be multiple places for the same
131
# values, like seconds. The current code, while more esoteric, is
132
# cleaner without depending on a parsing library. If Python had a
133
# built-in library for parsing we would use it, but we'd like to
134
# avoid excessive use of external libraries.
135
136
# New type for defining tokens, syntax, and semantics all-in-one
137
Token = collections.namedtuple("Token", (
138
"regexp", # To match token; if "value" is not None, must have
139
# a "group" containing digits
140
"value", # datetime.timedelta or None
141
"followers")) # Tokens valid after this token
142
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
143
# the "duration" ABNF definition in RFC 3339, Appendix A.
144
token_end = Token(re.compile(r"$"), None, frozenset())
145
token_second = Token(re.compile(r"(\d+)S"),
146
datetime.timedelta(seconds=1),
147
frozenset((token_end, )))
148
token_minute = Token(re.compile(r"(\d+)M"),
149
datetime.timedelta(minutes=1),
150
frozenset((token_second, token_end)))
151
token_hour = Token(re.compile(r"(\d+)H"),
152
datetime.timedelta(hours=1),
153
frozenset((token_minute, token_end)))
154
token_time = Token(re.compile(r"T"),
155
None,
156
frozenset((token_hour, token_minute,
157
token_second)))
158
token_day = Token(re.compile(r"(\d+)D"),
159
datetime.timedelta(days=1),
160
frozenset((token_time, token_end)))
161
token_month = Token(re.compile(r"(\d+)M"),
162
datetime.timedelta(weeks=4),
163
frozenset((token_day, token_end)))
164
token_year = Token(re.compile(r"(\d+)Y"),
165
datetime.timedelta(weeks=52),
166
frozenset((token_month, token_end)))
167
token_week = Token(re.compile(r"(\d+)W"),
168
datetime.timedelta(weeks=1),
169
frozenset((token_end, )))
170
token_duration = Token(re.compile(r"P"), None,
171
frozenset((token_year, token_month,
172
token_day, token_time,
173
token_week)))
174
# Define starting values:
175
# Value so far
176
value = datetime.timedelta()
177
found_token = None
178
# Following valid tokens
179
followers = frozenset((token_duration, ))
180
# String left to parse
181
s = duration
182
# Loop until end token is found
183
while found_token is not token_end:
184
# Search for any currently valid tokens
185
for token in followers:
186
match = token.regexp.match(s)
187
if match is not None:
188
# Token found
189
if token.value is not None:
190
# Value found, parse digits
191
factor = int(match.group(1), 10)
192
# Add to value so far
193
value += factor * token.value
194
# Strip token from string
195
s = token.regexp.sub("", s, 1)
196
# Go to found token
197
found_token = token
198
# Set valid next tokens
199
followers = found_token.followers
200
break
201
else:
202
# No currently valid tokens were found
203
raise ValueError("Invalid RFC 3339 duration: {!r}"
204
.format(duration))
205
# End token found
206
return value
207
208
209
def string_to_delta(interval):
210
"""Parse a string and return a datetime.timedelta
211
212
>>> string_to_delta('7d')
213
datetime.timedelta(7)
214
>>> string_to_delta('60s')
215
datetime.timedelta(0, 60)
216
>>> string_to_delta('60m')
217
datetime.timedelta(0, 3600)
218
>>> string_to_delta('24h')
219
datetime.timedelta(1)
220
>>> string_to_delta('1w')
221
datetime.timedelta(7)
222
>>> string_to_delta('5m 30s')
223
datetime.timedelta(0, 330)
224
"""
225
226
try:
227
return rfc3339_duration_to_delta(interval)
228
except ValueError:
229
pass
230
231
value = datetime.timedelta(0)
232
regexp = re.compile(r"(\d+)([dsmhw]?)")
233
234
for num, suffix in regexp.findall(interval):
235
if suffix == "d":
236
value += datetime.timedelta(int(num))
237
elif suffix == "s":
238
value += datetime.timedelta(0, int(num))
239
elif suffix == "m":
240
value += datetime.timedelta(0, 0, 0, 0, int(num))
241
elif suffix == "h":
242
value += datetime.timedelta(0, 0, 0, 0, 0, int(num))
243
elif suffix == "w":
244
value += datetime.timedelta(0, 0, 0, 0, 0, 0, int(num))
245
elif suffix == "":
246
value += datetime.timedelta(0, 0, 0, int(num))
247
return value
248
249
250
def print_clients(clients, keywords):
251
def valuetostring(value, keyword):
252
if type(value) is dbus.Boolean:
253
return "Yes" if value else "No"
254
if keyword in ("Timeout", "Interval", "ApprovalDelay",
255
"ApprovalDuration", "ExtendedTimeout"):
256
return milliseconds_to_string(value)
257
return str(value)
258
259
# Create format string to print table rows
260
format_string = " ".join("{{{key}:{width}}}".format(
261
width=max(len(tablewords[key]),
262
max(len(valuetostring(client[key], key))
263
for client in clients)),
264
key=key)
265
for key in keywords)
266
# Print header line
267
print(format_string.format(**tablewords))
268
for client in clients:
269
print(format_string
270
.format(**{key: valuetostring(client[key], key)
271
for key in keywords}))
272
273
274
def has_actions(options):
275
return any((options.enable,
276
options.disable,
277
options.bump_timeout,
278
options.start_checker,
279
options.stop_checker,
280
options.is_enabled,
281
options.remove,
282
options.checker is not None,
283
options.timeout is not None,
284
options.extended_timeout is not None,
285
options.interval is not None,
286
options.approved_by_default is not None,
287
options.approval_delay is not None,
288
options.approval_duration is not None,
289
options.host is not None,
290
options.secret is not None,
291
options.approve,
292
options.deny))
293
294
295
def main():
296
parser = argparse.ArgumentParser()
297
parser.add_argument("--version", action="version",
298
version="%(prog)s {}".format(version),
299
help="show version number and exit")
300
parser.add_argument("-a", "--all", action="store_true",
301
help="Select all clients")
302
parser.add_argument("-v", "--verbose", action="store_true",
303
help="Print all fields")
304
parser.add_argument("-j", "--dump-json", action="store_true",
305
help="Dump client data in JSON format")
306
parser.add_argument("-e", "--enable", action="store_true",
307
help="Enable client")
308
parser.add_argument("-d", "--disable", action="store_true",
309
help="disable client")
310
parser.add_argument("-b", "--bump-timeout", action="store_true",
311
help="Bump timeout for client")
312
parser.add_argument("--start-checker", action="store_true",
313
help="Start checker for client")
314
parser.add_argument("--stop-checker", action="store_true",
315
help="Stop checker for client")
316
parser.add_argument("-V", "--is-enabled", action="store_true",
317
help="Check if client is enabled")
318
parser.add_argument("-r", "--remove", action="store_true",
319
help="Remove client")
320
parser.add_argument("-c", "--checker",
321
help="Set checker command for client")
322
parser.add_argument("-t", "--timeout",
323
help="Set timeout for client")
324
parser.add_argument("--extended-timeout",
325
help="Set extended timeout for client")
326
parser.add_argument("-i", "--interval",
327
help="Set checker interval for client")
328
parser.add_argument("--approve-by-default", action="store_true",
329
default=None, dest="approved_by_default",
330
help="Set client to be approved by default")
331
parser.add_argument("--deny-by-default", action="store_false",
332
dest="approved_by_default",
333
help="Set client to be denied by default")
334
parser.add_argument("--approval-delay",
335
help="Set delay before client approve/deny")
336
parser.add_argument("--approval-duration",
337
help="Set duration of one client approval")
338
parser.add_argument("-H", "--host", help="Set host for client")
339
parser.add_argument("-s", "--secret",
340
type=argparse.FileType(mode="rb"),
341
help="Set password blob (file) for client")
342
parser.add_argument("-A", "--approve", action="store_true",
343
help="Approve any current client request")
344
parser.add_argument("-D", "--deny", action="store_true",
345
help="Deny any current client request")
346
parser.add_argument("--check", action="store_true",
347
help="Run self-test")
348
parser.add_argument("client", nargs="*", help="Client name")
349
options = parser.parse_args()
350
351
if has_actions(options) and not (options.client or options.all):
352
parser.error("Options require clients names or --all.")
353
if options.verbose and has_actions(options):
354
parser.error("--verbose can only be used alone.")
355
if options.dump_json and (options.verbose
356
or has_actions(options)):
357
parser.error("--dump-json can only be used alone.")
358
if options.all and not has_actions(options):
359
parser.error("--all requires an action.")
360
361
try:
362
bus = dbus.SystemBus()
363
mandos_dbus_objc = bus.get_object(busname, server_path)
364
except dbus.exceptions.DBusException:
365
log.critical("Could not connect to Mandos server")
366
sys.exit(1)
367
368
mandos_serv = dbus.Interface(mandos_dbus_objc,
369
dbus_interface=server_interface)
370
mandos_serv_object_manager = dbus.Interface(
371
mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)
372
373
# block stderr since dbus library prints to stderr
374
null = os.open(os.path.devnull, os.O_RDWR)
375
stderrcopy = os.dup(sys.stderr.fileno())
376
os.dup2(null, sys.stderr.fileno())
377
os.close(null)
378
try:
379
try:
380
mandos_clients = {path: ifs_and_props[client_interface]
381
for path, ifs_and_props in
382
mandos_serv_object_manager
383
.GetManagedObjects().items()
384
if client_interface in ifs_and_props}
385
finally:
386
# restore stderr
387
os.dup2(stderrcopy, sys.stderr.fileno())
388
os.close(stderrcopy)
389
except dbus.exceptions.DBusException as e:
390
log.critical("Failed to access Mandos server through D-Bus:"
391
"\n%s", e)
392
sys.exit(1)
393
394
# Compile dict of (clients: properties) to process
395
clients = {}
396
397
if options.all or not options.client:
398
clients = {bus.get_object(busname, path): properties
399
for path, properties in mandos_clients.items()}
400
else:
401
for name in options.client:
402
for path, client in mandos_clients.items():
403
if client["Name"] == name:
404
client_objc = bus.get_object(busname, path)
405
clients[client_objc] = client
406
break
407
else:
408
log.critical("Client not found on server: %r", name)
409
sys.exit(1)
410
411
if not has_actions(options) and clients:
412
if options.verbose or options.dump_json:
413
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
414
"Created", "Interval", "Host", "KeyID",
415
"Fingerprint", "CheckerRunning",
416
"LastEnabled", "ApprovalPending",
417
"ApprovedByDefault", "LastApprovalRequest",
418
"ApprovalDelay", "ApprovalDuration",
419
"Checker", "ExtendedTimeout", "Expires",
420
"LastCheckerStatus")
421
else:
422
keywords = defaultkeywords
423
424
if options.dump_json:
425
json.dump({client["Name"]: {key:
426
bool(client[key])
427
if isinstance(client[key],
428
dbus.Boolean)
429
else client[key]
430
for key in keywords}
431
for client in clients.values()},
432
fp=sys.stdout, indent=4,
433
separators=(',', ': '))
434
print()
435
else:
436
print_clients(clients.values(), keywords)
437
else:
438
# Process each client in the list by all selected options
439
for client in clients:
440
441
def set_client_prop(prop, value):
442
"""Set a Client D-Bus property"""
443
client.Set(client_interface, prop, value,
444
dbus_interface=dbus.PROPERTIES_IFACE)
445
446
def set_client_prop_ms(prop, value):
447
"""Set a Client D-Bus property, converted
448
from a string to milliseconds."""
449
set_client_prop(prop,
450
string_to_delta(value).total_seconds()
451
* 1000)
452
453
if options.remove:
454
mandos_serv.RemoveClient(client.__dbus_object_path__)
455
if options.enable:
456
set_client_prop("Enabled", dbus.Boolean(True))
457
if options.disable:
458
set_client_prop("Enabled", dbus.Boolean(False))
459
if options.bump_timeout:
460
set_client_prop("LastCheckedOK", "")
461
if options.start_checker:
462
set_client_prop("CheckerRunning", dbus.Boolean(True))
463
if options.stop_checker:
464
set_client_prop("CheckerRunning", dbus.Boolean(False))
465
if options.is_enabled:
466
if client.Get(client_interface, "Enabled",
467
dbus_interface=dbus.PROPERTIES_IFACE):
468
sys.exit(0)
469
else:
470
sys.exit(1)
471
if options.checker is not None:
472
set_client_prop("Checker", options.checker)
473
if options.host is not None:
474
set_client_prop("Host", options.host)
475
if options.interval is not None:
476
set_client_prop_ms("Interval", options.interval)
477
if options.approval_delay is not None:
478
set_client_prop_ms("ApprovalDelay",
479
options.approval_delay)
480
if options.approval_duration is not None:
481
set_client_prop_ms("ApprovalDuration",
482
options.approval_duration)
483
if options.timeout is not None:
484
set_client_prop_ms("Timeout", options.timeout)
485
if options.extended_timeout is not None:
486
set_client_prop_ms("ExtendedTimeout",
487
options.extended_timeout)
488
if options.secret is not None:
489
set_client_prop("Secret",
490
dbus.ByteArray(options.secret.read()))
491
if options.approved_by_default is not None:
492
set_client_prop("ApprovedByDefault",
493
dbus.Boolean(options
494
.approved_by_default))
495
if options.approve:
496
client.Approve(dbus.Boolean(True),
497
dbus_interface=client_interface)
498
elif options.deny:
499
client.Approve(dbus.Boolean(False),
500
dbus_interface=client_interface)
501
502
503
class Test_milliseconds_to_string(unittest.TestCase):
504
def test_all(self):
505
self.assertEqual(milliseconds_to_string(93785000),
506
"1T02:03:05")
507
def test_no_days(self):
508
self.assertEqual(milliseconds_to_string(7385000), "02:03:05")
509
def test_all_zero(self):
510
self.assertEqual(milliseconds_to_string(0), "00:00:00")
511
def test_no_fractional_seconds(self):
512
self.assertEqual(milliseconds_to_string(400), "00:00:00")
513
self.assertEqual(milliseconds_to_string(900), "00:00:00")
514
self.assertEqual(milliseconds_to_string(1900), "00:00:01")
515
516
517
def should_only_run_tests():
518
parser = argparse.ArgumentParser(add_help=False)
519
parser.add_argument("--check", action='store_true')
520
args, unknown_args = parser.parse_known_args()
521
run_tests = args.check
522
if run_tests:
523
# Remove --check argument from sys.argv
524
sys.argv[1:] = unknown_args
525
return run_tests
526
527
# Add all tests from doctest strings
528
def load_tests(loader, tests, none):
529
import doctest
530
tests.addTests(doctest.DocTestSuite())
531
return tests
532
533
if __name__ == "__main__":
534
if should_only_run_tests():
535
# Call using ./tdd-python-script --check [--verbose]
536
unittest.main()
537
else:
538
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0