/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-ctl

  • Committer: Teddy Hogeborn
  • Date: 2008-07-20 06:33:48 UTC
  • Revision ID: teddy@fukt.bsnet.se-20080720063348-jscgy5p0itrgvlo8
* mandos-clients.conf ([foo]): Uncommented.
  ([foo]/secret): New.
  ([foo]/secfile): Commented out.
  ([foo]/checker): Changed to "fping -q -- %%(fqdn)s".
  ([foo]/timeout): New.

* server.py: New modeline for Python and Emacs.  Set a logging format.
  (Client.__init__): Bug fix: Choose either the value from the options
                     object or pass the argument through string_to_delta
                     for both "timeout" and "interval".
  (Client.checker_callback): Bug fix: Do not log spurious "Checker for
                             <foo> failed" messages.
  (Client.start_checker): Moved "Starting checker" log message down to
                          just before actually starting the subprocess.
                          Do not redirect the subprocesses' stdout to a
                          pipe.
  (peer_certificate, fingerprint): Added docstrings.
  (entry_group_state_changed): Call "killme()" instead of
                               "main_loop.quit()".
  (daemon, killme): New functions.
  (exitstatus, main_loop_started): New global variables.
  (__main__): Removed the "--cert", "--key", "--ca", and "--crl"
              options.  Removed the sleep command from the default
              checker.  Add a console logger in debug mode.  Call
              "killme()" instead of "main_loop.quit()" when there are no
              more clients.  Call "daemon()" if not in debug mode.
              Register "cleanup()" to run at exit.  Ignore some
              signals.  Catch DBusException to detect another running
              server and exit cleanly.  Exit with "exitstatus".
  (cleanup): New function.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-ctl
1
 
#!/usr/bin/python
2
 
# -*- mode: python; coding: utf-8 -*-
3
 
# 
4
 
# Mandos Monitor - Control and monitor the Mandos server
5
 
# 
6
 
# Copyright © 2008-2011 Teddy Hogeborn
7
 
# Copyright © 2008-2011 Björn Påhlsson
8
 
# 
9
 
# This program is free software: you can redistribute it and/or modify
10
 
# it under the terms of the GNU General Public License as published by
11
 
# the Free Software Foundation, either version 3 of the License, or
12
 
# (at your option) any later version.
13
 
#
14
 
#     This program is distributed in the hope that it will be useful,
15
 
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
16
 
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17
 
#     GNU General Public License for more details.
18
 
# 
19
 
# You should have received a copy of the GNU General Public License
20
 
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
21
 
# 
22
 
# Contact the authors at <mandos@recompile.se>.
23
 
# 
24
 
 
25
 
from __future__ import (division, absolute_import, print_function,
26
 
                        unicode_literals)
27
 
 
28
 
import sys
29
 
import dbus
30
 
import argparse
31
 
import locale
32
 
import datetime
33
 
import re
34
 
import os
35
 
 
36
 
locale.setlocale(locale.LC_ALL, "")
37
 
 
38
 
tablewords = {
39
 
    "Name": "Name",
40
 
    "Enabled": "Enabled",
41
 
    "Timeout": "Timeout",
42
 
    "LastCheckedOK": "Last Successful Check",
43
 
    "LastApprovalRequest": "Last Approval Request",
44
 
    "Created": "Created",
45
 
    "Interval": "Interval",
46
 
    "Host": "Host",
47
 
    "Fingerprint": "Fingerprint",
48
 
    "CheckerRunning": "Check Is Running",
49
 
    "LastEnabled": "Last Enabled",
50
 
    "ApprovalPending": "Approval Is Pending",
51
 
    "ApprovedByDefault": "Approved By Default",
52
 
    "ApprovalDelay": "Approval Delay",
53
 
    "ApprovalDuration": "Approval Duration",
54
 
    "Checker": "Checker",
55
 
    "ExtendedTimeout" : "Extended Timeout"
56
 
    }
57
 
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
58
 
domain = "se.recompile"
59
 
busname = domain + ".Mandos"
60
 
server_path = "/"
61
 
server_interface = domain + ".Mandos"
62
 
client_interface = domain + ".Mandos.Client"
63
 
version = "1.4.1"
64
 
 
65
 
def timedelta_to_milliseconds(td):
66
 
    """Convert a datetime.timedelta object to milliseconds"""
67
 
    return ((td.days * 24 * 60 * 60 * 1000)
68
 
            + (td.seconds * 1000)
69
 
            + (td.microseconds // 1000))
70
 
 
71
 
def milliseconds_to_string(ms):
72
 
    td = datetime.timedelta(0, 0, 0, ms)
73
 
    return ("%(days)s%(hours)02d:%(minutes)02d:%(seconds)02d"
74
 
            % { "days": "%dT" % td.days if td.days else "",
75
 
                "hours": td.seconds // 3600,
76
 
                "minutes": (td.seconds % 3600) // 60,
77
 
                "seconds": td.seconds % 60,
78
 
                })
79
 
 
80
 
def string_to_delta(interval):
81
 
    """Parse a string and return a datetime.timedelta
82
 
    
83
 
    >>> string_to_delta("7d")
84
 
    datetime.timedelta(7)
85
 
    >>> string_to_delta("60s")
86
 
    datetime.timedelta(0, 60)
87
 
    >>> string_to_delta("60m")
88
 
    datetime.timedelta(0, 3600)
89
 
    >>> string_to_delta("24h")
90
 
    datetime.timedelta(1)
91
 
    >>> string_to_delta("1w")
92
 
    datetime.timedelta(7)
93
 
    >>> string_to_delta("5m 30s")
94
 
    datetime.timedelta(0, 330)
95
 
    """
96
 
    timevalue = datetime.timedelta(0)
97
 
    regexp = re.compile("\d+[dsmhw]")
98
 
    
99
 
    for s in regexp.findall(interval):
100
 
        try:
101
 
            suffix = unicode(s[-1])
102
 
            value = int(s[:-1])
103
 
            if suffix == "d":
104
 
                delta = datetime.timedelta(value)
105
 
            elif suffix == "s":
106
 
                delta = datetime.timedelta(0, value)
107
 
            elif suffix == "m":
108
 
                delta = datetime.timedelta(0, 0, 0, 0, value)
109
 
            elif suffix == "h":
110
 
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
111
 
            elif suffix == "w":
112
 
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
113
 
            else:
114
 
                raise ValueError
115
 
        except (ValueError, IndexError):
116
 
            raise ValueError
117
 
        timevalue += delta
118
 
    return timevalue
119
 
 
120
 
def print_clients(clients, keywords):
121
 
    def valuetostring(value, keyword):
122
 
        if type(value) is dbus.Boolean:
123
 
            return "Yes" if value else "No"
124
 
        if keyword in ("Timeout", "Interval", "ApprovalDelay",
125
 
                       "ApprovalDuration"):
126
 
            return milliseconds_to_string(value)
127
 
        return unicode(value)
128
 
    
129
 
    # Create format string to print table rows
130
 
    format_string = " ".join("%%-%ds" %
131
 
                             max(len(tablewords[key]),
132
 
                                 max(len(valuetostring(client[key],
133
 
                                                       key))
134
 
                                     for client in
135
 
                                     clients))
136
 
                             for key in keywords)
137
 
    # Print header line
138
 
    print(format_string % tuple(tablewords[key] for key in keywords))
139
 
    for client in clients:
140
 
        print(format_string % tuple(valuetostring(client[key], key)
141
 
                                    for key in keywords))
142
 
 
143
 
def has_actions(options):
144
 
    return any((options.enable,
145
 
                options.disable,
146
 
                options.bump_timeout,
147
 
                options.start_checker,
148
 
                options.stop_checker,
149
 
                options.is_enabled,
150
 
                options.remove,
151
 
                options.checker is not None,
152
 
                options.timeout is not None,
153
 
                options.extended_timeout is not None,
154
 
                options.interval is not None,
155
 
                options.approved_by_default is not None,
156
 
                options.approval_delay is not None,
157
 
                options.approval_duration is not None,
158
 
                options.host is not None,
159
 
                options.secret is not None,
160
 
                options.approve,
161
 
                options.deny))
162
 
 
163
 
def main():
164
 
    parser = argparse.ArgumentParser()
165
 
    parser.add_argument("--version", action="version",
166
 
                        version = "%%prog %s" % version,
167
 
                        help="show version number and exit")
168
 
    parser.add_argument("-a", "--all", action="store_true",
169
 
                        help="Select all clients")
170
 
    parser.add_argument("-v", "--verbose", action="store_true",
171
 
                        help="Print all fields")
172
 
    parser.add_argument("-e", "--enable", action="store_true",
173
 
                        help="Enable client")
174
 
    parser.add_argument("-d", "--disable", action="store_true",
175
 
                        help="disable client")
176
 
    parser.add_argument("-b", "--bump-timeout", action="store_true",
177
 
                        help="Bump timeout for client")
178
 
    parser.add_argument("--start-checker", action="store_true",
179
 
                        help="Start checker for client")
180
 
    parser.add_argument("--stop-checker", action="store_true",
181
 
                        help="Stop checker for client")
182
 
    parser.add_argument("-V", "--is-enabled", action="store_true",
183
 
                        help="Check if client is enabled")
184
 
    parser.add_argument("-r", "--remove", action="store_true",
185
 
                        help="Remove client")
186
 
    parser.add_argument("-c", "--checker",
187
 
                        help="Set checker command for client")
188
 
    parser.add_argument("-t", "--timeout",
189
 
                        help="Set timeout for client")
190
 
    parser.add_argument("--extended-timeout",
191
 
                        help="Set extended timeout for client")
192
 
    parser.add_argument("-i", "--interval",
193
 
                        help="Set checker interval for client")
194
 
    parser.add_argument("--approve-by-default", action="store_true",
195
 
                        default=None, dest="approved_by_default",
196
 
                        help="Set client to be approved by default")
197
 
    parser.add_argument("--deny-by-default", action="store_false",
198
 
                        dest="approved_by_default",
199
 
                        help="Set client to be denied by default")
200
 
    parser.add_argument("--approval-delay",
201
 
                        help="Set delay before client approve/deny")
202
 
    parser.add_argument("--approval-duration",
203
 
                        help="Set duration of one client approval")
204
 
    parser.add_argument("-H", "--host", help="Set host for client")
205
 
    parser.add_argument("-s", "--secret", type=file,
206
 
                        help="Set password blob (file) for client")
207
 
    parser.add_argument("-A", "--approve", action="store_true",
208
 
                        help="Approve any current client request")
209
 
    parser.add_argument("-D", "--deny", action="store_true",
210
 
                        help="Deny any current client request")
211
 
    parser.add_argument("client", nargs="*", help="Client name")
212
 
    options = parser.parse_args()
213
 
    
214
 
    if has_actions(options) and not options.client and not options.all:
215
 
        parser.error("Options require clients names or --all.")
216
 
    if options.verbose and has_actions(options):
217
 
        parser.error("--verbose can only be used alone or with"
218
 
                     " --all.")
219
 
    if options.all and not has_actions(options):
220
 
        parser.error("--all requires an action.")
221
 
    
222
 
    try:
223
 
        bus = dbus.SystemBus()
224
 
        mandos_dbus_objc = bus.get_object(busname, server_path)
225
 
    except dbus.exceptions.DBusException:
226
 
        print("Could not connect to Mandos server",
227
 
              file=sys.stderr)
228
 
        sys.exit(1)
229
 
    
230
 
    mandos_serv = dbus.Interface(mandos_dbus_objc,
231
 
                                 dbus_interface = server_interface)
232
 
    
233
 
    #block stderr since dbus library prints to stderr
234
 
    null = os.open(os.path.devnull, os.O_RDWR)
235
 
    stderrcopy = os.dup(sys.stderr.fileno())
236
 
    os.dup2(null, sys.stderr.fileno())
237
 
    os.close(null)
238
 
    try:
239
 
        try:
240
 
            mandos_clients = mandos_serv.GetAllClientsWithProperties()
241
 
        finally:
242
 
            #restore stderr
243
 
            os.dup2(stderrcopy, sys.stderr.fileno())
244
 
            os.close(stderrcopy)
245
 
    except dbus.exceptions.DBusException, e:
246
 
        print("Access denied: Accessing mandos server through dbus.",
247
 
              file=sys.stderr)
248
 
        sys.exit(1)
249
 
    
250
 
    # Compile dict of (clients: properties) to process
251
 
    clients={}
252
 
    
253
 
    if options.all or not options.client:
254
 
        clients = dict((bus.get_object(busname, path), properties)
255
 
                       for path, properties in
256
 
                       mandos_clients.iteritems())
257
 
    else:
258
 
        for name in options.client:
259
 
            for path, client in mandos_clients.iteritems():
260
 
                if client["Name"] == name:
261
 
                    client_objc = bus.get_object(busname, path)
262
 
                    clients[client_objc] = client
263
 
                    break
264
 
            else:
265
 
                print("Client not found on server: %r" % name,
266
 
                      file=sys.stderr)
267
 
                sys.exit(1)
268
 
    
269
 
    if not has_actions(options) and clients:
270
 
        if options.verbose:
271
 
            keywords = ("Name", "Enabled", "Timeout",
272
 
                        "LastCheckedOK", "Created", "Interval",
273
 
                        "Host", "Fingerprint", "CheckerRunning",
274
 
                        "LastEnabled", "ApprovalPending",
275
 
                        "ApprovedByDefault",
276
 
                        "LastApprovalRequest", "ApprovalDelay",
277
 
                        "ApprovalDuration", "Checker",
278
 
                        "ExtendedTimeout")
279
 
        else:
280
 
            keywords = defaultkeywords
281
 
        
282
 
        print_clients(clients.values(), keywords)
283
 
    else:
284
 
        # Process each client in the list by all selected options
285
 
        for client in clients:
286
 
            if options.remove:
287
 
                mandos_serv.RemoveClient(client.__dbus_object_path__)
288
 
            if options.enable:
289
 
                client.Enable(dbus_interface=client_interface)
290
 
            if options.disable:
291
 
                client.Disable(dbus_interface=client_interface)
292
 
            if options.bump_timeout:
293
 
                client.CheckedOK(dbus_interface=client_interface)
294
 
            if options.start_checker:
295
 
                client.StartChecker(dbus_interface=client_interface)
296
 
            if options.stop_checker:
297
 
                client.StopChecker(dbus_interface=client_interface)
298
 
            if options.is_enabled:
299
 
                sys.exit(0 if client.Get(client_interface,
300
 
                                         "Enabled",
301
 
                                         dbus_interface=
302
 
                                         dbus.PROPERTIES_IFACE)
303
 
                         else 1)
304
 
            if options.checker is not None:
305
 
                client.Set(client_interface, "Checker",
306
 
                           options.checker,
307
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
308
 
            if options.host is not None:
309
 
                client.Set(client_interface, "Host", options.host,
310
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
311
 
            if options.interval is not None:
312
 
                client.Set(client_interface, "Interval",
313
 
                           timedelta_to_milliseconds
314
 
                           (string_to_delta(options.interval)),
315
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
316
 
            if options.approval_delay is not None:
317
 
                client.Set(client_interface, "ApprovalDelay",
318
 
                           timedelta_to_milliseconds
319
 
                           (string_to_delta(options.
320
 
                                            approval_delay)),
321
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
322
 
            if options.approval_duration is not None:
323
 
                client.Set(client_interface, "ApprovalDuration",
324
 
                           timedelta_to_milliseconds
325
 
                           (string_to_delta(options.
326
 
                                            approval_duration)),
327
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
328
 
            if options.timeout is not None:
329
 
                client.Set(client_interface, "Timeout",
330
 
                           timedelta_to_milliseconds
331
 
                           (string_to_delta(options.timeout)),
332
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
333
 
            if options.extended_timeout is not None:
334
 
                client.Set(client_interface, "ExtendedTimeout",
335
 
                           timedelta_to_milliseconds
336
 
                           (string_to_delta(options.extended_timeout)),
337
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
338
 
            if options.secret is not None:
339
 
                client.Set(client_interface, "Secret",
340
 
                           dbus.ByteArray(open(options.secret,
341
 
                                               "rb").read()),
342
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
343
 
            if options.approved_by_default is not None:
344
 
                client.Set(client_interface, "ApprovedByDefault",
345
 
                           dbus.Boolean(options
346
 
                                        .approved_by_default),
347
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
348
 
            if options.approve:
349
 
                client.Approve(dbus.Boolean(True),
350
 
                               dbus_interface=client_interface)
351
 
            elif options.deny:
352
 
                client.Approve(dbus.Boolean(False),
353
 
                               dbus_interface=client_interface)
354
 
 
355
 
if __name__ == "__main__":
356
 
    main()