To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos-ctl
- browse files at revision 198
- compare with another revision
- download diff
- download tarball
- view history from revision 198
- Committer: Teddy Hogeborn
- Date: 2008-09-19 23:31:34 UTC
- Revision ID: teddy@fukt.bsnet.se-20080919233134-h56et87wkgisbk85
* mandos-keygen: New "--passfile" option. Confirm entered password.
* mandos-keygen.xml (SYNOPSIS, OPTIONS): New "--passfile" option.
* mandos-keygen.xml (SYNOPSIS, OPTIONS): New "--passfile" option.
- files added:
- initramfs-tools-hook-conf
- files removed:
- DBUS-API
- debian/po
- debian/source
- debian/upstream
- network-hooks.d
- plugin-helpers
- files modified:
- .bzrignore
added
removed
mandos-ctl
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
# Mandos Monitor - Control and monitor the Mandos server
5
#
6
# Copyright © 2008-2019 Teddy Hogeborn
7
# Copyright © 2008-2019 Björn Påhlsson
8
#
9
# This file is part of Mandos.
10
#
11
# Mandos is free software: you can redistribute it and/or modify it
12
# under the terms of the GNU General Public License as published by
13
# the Free Software Foundation, either version 3 of the License, or
14
# (at your option) any later version.
15
#
16
# Mandos is distributed in the hope that it will be useful, but
17
# WITHOUT ANY WARRANTY; without even the implied warranty of
18
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19
# GNU General Public License for more details.
20
#
21
# You should have received a copy of the GNU General Public License
22
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
23
#
24
# Contact the authors at <mandos@recompile.se>.
25
#
26
27
from __future__ import (division, absolute_import, print_function,
28
unicode_literals)
29
30
try:
31
from future_builtins import *
32
except ImportError:
33
pass
34
35
import sys
36
import argparse
37
import locale
38
import datetime
39
import re
40
import os
41
import collections
42
import json
43
import unittest
44
45
import dbus
46
47
if sys.version_info.major == 2:
48
str = unicode
49
50
locale.setlocale(locale.LC_ALL, "")
51
52
tablewords = {
53
"Name": "Name",
54
"Enabled": "Enabled",
55
"Timeout": "Timeout",
56
"LastCheckedOK": "Last Successful Check",
57
"LastApprovalRequest": "Last Approval Request",
58
"Created": "Created",
59
"Interval": "Interval",
60
"Host": "Host",
61
"Fingerprint": "Fingerprint",
62
"KeyID": "Key ID",
63
"CheckerRunning": "Check Is Running",
64
"LastEnabled": "Last Enabled",
65
"ApprovalPending": "Approval Is Pending",
66
"ApprovedByDefault": "Approved By Default",
67
"ApprovalDelay": "Approval Delay",
68
"ApprovalDuration": "Approval Duration",
69
"Checker": "Checker",
70
"ExtendedTimeout": "Extended Timeout",
71
"Expires": "Expires",
72
"LastCheckerStatus": "Last Checker Status",
73
}
74
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
75
domain = "se.recompile"
76
busname = domain + ".Mandos"
77
server_path = "/"
78
server_interface = domain + ".Mandos"
79
client_interface = domain + ".Mandos.Client"
80
version = "1.8.3"
81
82
83
try:
84
dbus.OBJECT_MANAGER_IFACE
85
except AttributeError:
86
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
87
88
89
def milliseconds_to_string(ms):
90
td = datetime.timedelta(0, 0, 0, ms)
91
return ("{days}{hours:02}:{minutes:02}:{seconds:02}"
92
.format(days="{}T".format(td.days) if td.days else "",
93
hours=td.seconds // 3600,
94
minutes=(td.seconds % 3600) // 60,
95
seconds=td.seconds % 60))
96
97
98
def rfc3339_duration_to_delta(duration):
99
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
100
101
>>> rfc3339_duration_to_delta("P7D")
102
datetime.timedelta(7)
103
>>> rfc3339_duration_to_delta("PT60S")
104
datetime.timedelta(0, 60)
105
>>> rfc3339_duration_to_delta("PT60M")
106
datetime.timedelta(0, 3600)
107
>>> rfc3339_duration_to_delta("PT24H")
108
datetime.timedelta(1)
109
>>> rfc3339_duration_to_delta("P1W")
110
datetime.timedelta(7)
111
>>> rfc3339_duration_to_delta("PT5M30S")
112
datetime.timedelta(0, 330)
113
>>> rfc3339_duration_to_delta("P1DT3M20S")
114
datetime.timedelta(1, 200)
115
"""
116
117
# Parsing an RFC 3339 duration with regular expressions is not
118
# possible - there would have to be multiple places for the same
119
# values, like seconds. The current code, while more esoteric, is
120
# cleaner without depending on a parsing library. If Python had a
121
# built-in library for parsing we would use it, but we'd like to
122
# avoid excessive use of external libraries.
123
124
# New type for defining tokens, syntax, and semantics all-in-one
125
Token = collections.namedtuple("Token", (
126
"regexp", # To match token; if "value" is not None, must have
127
# a "group" containing digits
128
"value", # datetime.timedelta or None
129
"followers")) # Tokens valid after this token
130
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
131
# the "duration" ABNF definition in RFC 3339, Appendix A.
132
token_end = Token(re.compile(r"$"), None, frozenset())
133
token_second = Token(re.compile(r"(\d+)S"),
134
datetime.timedelta(seconds=1),
135
frozenset((token_end, )))
136
token_minute = Token(re.compile(r"(\d+)M"),
137
datetime.timedelta(minutes=1),
138
frozenset((token_second, token_end)))
139
token_hour = Token(re.compile(r"(\d+)H"),
140
datetime.timedelta(hours=1),
141
frozenset((token_minute, token_end)))
142
token_time = Token(re.compile(r"T"),
143
None,
144
frozenset((token_hour, token_minute,
145
token_second)))
146
token_day = Token(re.compile(r"(\d+)D"),
147
datetime.timedelta(days=1),
148
frozenset((token_time, token_end)))
149
token_month = Token(re.compile(r"(\d+)M"),
150
datetime.timedelta(weeks=4),
151
frozenset((token_day, token_end)))
152
token_year = Token(re.compile(r"(\d+)Y"),
153
datetime.timedelta(weeks=52),
154
frozenset((token_month, token_end)))
155
token_week = Token(re.compile(r"(\d+)W"),
156
datetime.timedelta(weeks=1),
157
frozenset((token_end, )))
158
token_duration = Token(re.compile(r"P"), None,
159
frozenset((token_year, token_month,
160
token_day, token_time,
161
token_week)))
162
# Define starting values:
163
# Value so far
164
value = datetime.timedelta()
165
found_token = None
166
# Following valid tokens
167
followers = frozenset((token_duration, ))
168
# String left to parse
169
s = duration
170
# Loop until end token is found
171
while found_token is not token_end:
172
# Search for any currently valid tokens
173
for token in followers:
174
match = token.regexp.match(s)
175
if match is not None:
176
# Token found
177
if token.value is not None:
178
# Value found, parse digits
179
factor = int(match.group(1), 10)
180
# Add to value so far
181
value += factor * token.value
182
# Strip token from string
183
s = token.regexp.sub("", s, 1)
184
# Go to found token
185
found_token = token
186
# Set valid next tokens
187
followers = found_token.followers
188
break
189
else:
190
# No currently valid tokens were found
191
raise ValueError("Invalid RFC 3339 duration: {!r}"
192
.format(duration))
193
# End token found
194
return value
195
196
197
def string_to_delta(interval):
198
"""Parse a string and return a datetime.timedelta
199
200
>>> string_to_delta('7d')
201
datetime.timedelta(7)
202
>>> string_to_delta('60s')
203
datetime.timedelta(0, 60)
204
>>> string_to_delta('60m')
205
datetime.timedelta(0, 3600)
206
>>> string_to_delta('24h')
207
datetime.timedelta(1)
208
>>> string_to_delta('1w')
209
datetime.timedelta(7)
210
>>> string_to_delta('5m 30s')
211
datetime.timedelta(0, 330)
212
"""
213
214
try:
215
return rfc3339_duration_to_delta(interval)
216
except ValueError:
217
pass
218
219
value = datetime.timedelta(0)
220
regexp = re.compile(r"(\d+)([dsmhw]?)")
221
222
for num, suffix in regexp.findall(interval):
223
if suffix == "d":
224
value += datetime.timedelta(int(num))
225
elif suffix == "s":
226
value += datetime.timedelta(0, int(num))
227
elif suffix == "m":
228
value += datetime.timedelta(0, 0, 0, 0, int(num))
229
elif suffix == "h":
230
value += datetime.timedelta(0, 0, 0, 0, 0, int(num))
231
elif suffix == "w":
232
value += datetime.timedelta(0, 0, 0, 0, 0, 0, int(num))
233
elif suffix == "":
234
value += datetime.timedelta(0, 0, 0, int(num))
235
return value
236
237
238
def print_clients(clients, keywords):
239
def valuetostring(value, keyword):
240
if type(value) is dbus.Boolean:
241
return "Yes" if value else "No"
242
if keyword in ("Timeout", "Interval", "ApprovalDelay",
243
"ApprovalDuration", "ExtendedTimeout"):
244
return milliseconds_to_string(value)
245
return str(value)
246
247
# Create format string to print table rows
248
format_string = " ".join("{{{key}:{width}}}".format(
249
width=max(len(tablewords[key]),
250
max(len(valuetostring(client[key], key))
251
for client in clients)),
252
key=key)
253
for key in keywords)
254
# Print header line
255
print(format_string.format(**tablewords))
256
for client in clients:
257
print(format_string
258
.format(**{key: valuetostring(client[key], key)
259
for key in keywords}))
260
261
262
def has_actions(options):
263
return any((options.enable,
264
options.disable,
265
options.bump_timeout,
266
options.start_checker,
267
options.stop_checker,
268
options.is_enabled,
269
options.remove,
270
options.checker is not None,
271
options.timeout is not None,
272
options.extended_timeout is not None,
273
options.interval is not None,
274
options.approved_by_default is not None,
275
options.approval_delay is not None,
276
options.approval_duration is not None,
277
options.host is not None,
278
options.secret is not None,
279
options.approve,
280
options.deny))
281
282
283
def main():
284
parser = argparse.ArgumentParser()
285
parser.add_argument("--version", action="version",
286
version="%(prog)s {}".format(version),
287
help="show version number and exit")
288
parser.add_argument("-a", "--all", action="store_true",
289
help="Select all clients")
290
parser.add_argument("-v", "--verbose", action="store_true",
291
help="Print all fields")
292
parser.add_argument("-j", "--dump-json", action="store_true",
293
help="Dump client data in JSON format")
294
parser.add_argument("-e", "--enable", action="store_true",
295
help="Enable client")
296
parser.add_argument("-d", "--disable", action="store_true",
297
help="disable client")
298
parser.add_argument("-b", "--bump-timeout", action="store_true",
299
help="Bump timeout for client")
300
parser.add_argument("--start-checker", action="store_true",
301
help="Start checker for client")
302
parser.add_argument("--stop-checker", action="store_true",
303
help="Stop checker for client")
304
parser.add_argument("-V", "--is-enabled", action="store_true",
305
help="Check if client is enabled")
306
parser.add_argument("-r", "--remove", action="store_true",
307
help="Remove client")
308
parser.add_argument("-c", "--checker",
309
help="Set checker command for client")
310
parser.add_argument("-t", "--timeout",
311
help="Set timeout for client")
312
parser.add_argument("--extended-timeout",
313
help="Set extended timeout for client")
314
parser.add_argument("-i", "--interval",
315
help="Set checker interval for client")
316
parser.add_argument("--approve-by-default", action="store_true",
317
default=None, dest="approved_by_default",
318
help="Set client to be approved by default")
319
parser.add_argument("--deny-by-default", action="store_false",
320
dest="approved_by_default",
321
help="Set client to be denied by default")
322
parser.add_argument("--approval-delay",
323
help="Set delay before client approve/deny")
324
parser.add_argument("--approval-duration",
325
help="Set duration of one client approval")
326
parser.add_argument("-H", "--host", help="Set host for client")
327
parser.add_argument("-s", "--secret",
328
type=argparse.FileType(mode="rb"),
329
help="Set password blob (file) for client")
330
parser.add_argument("-A", "--approve", action="store_true",
331
help="Approve any current client request")
332
parser.add_argument("-D", "--deny", action="store_true",
333
help="Deny any current client request")
334
parser.add_argument("--check", action="store_true",
335
help="Run self-test")
336
parser.add_argument("client", nargs="*", help="Client name")
337
options = parser.parse_args()
338
339
if has_actions(options) and not (options.client or options.all):
340
parser.error("Options require clients names or --all.")
341
if options.verbose and has_actions(options):
342
parser.error("--verbose can only be used alone.")
343
if options.dump_json and (options.verbose
344
or has_actions(options)):
345
parser.error("--dump-json can only be used alone.")
346
if options.all and not has_actions(options):
347
parser.error("--all requires an action.")
348
349
try:
350
bus = dbus.SystemBus()
351
mandos_dbus_objc = bus.get_object(busname, server_path)
352
except dbus.exceptions.DBusException:
353
print("Could not connect to Mandos server", file=sys.stderr)
354
sys.exit(1)
355
356
mandos_serv = dbus.Interface(mandos_dbus_objc,
357
dbus_interface=server_interface)
358
mandos_serv_object_manager = dbus.Interface(
359
mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)
360
361
# block stderr since dbus library prints to stderr
362
null = os.open(os.path.devnull, os.O_RDWR)
363
stderrcopy = os.dup(sys.stderr.fileno())
364
os.dup2(null, sys.stderr.fileno())
365
os.close(null)
366
try:
367
try:
368
mandos_clients = {path: ifs_and_props[client_interface]
369
for path, ifs_and_props in
370
mandos_serv_object_manager
371
.GetManagedObjects().items()
372
if client_interface in ifs_and_props}
373
finally:
374
# restore stderr
375
os.dup2(stderrcopy, sys.stderr.fileno())
376
os.close(stderrcopy)
377
except dbus.exceptions.DBusException as e:
378
print("Access denied: "
379
"Accessing mandos server through D-Bus: {}".format(e),
380
file=sys.stderr)
381
sys.exit(1)
382
383
# Compile dict of (clients: properties) to process
384
clients = {}
385
386
if options.all or not options.client:
387
clients = {bus.get_object(busname, path): properties
388
for path, properties in mandos_clients.items()}
389
else:
390
for name in options.client:
391
for path, client in mandos_clients.items():
392
if client["Name"] == name:
393
client_objc = bus.get_object(busname, path)
394
clients[client_objc] = client
395
break
396
else:
397
print("Client not found on server: {!r}"
398
.format(name), file=sys.stderr)
399
sys.exit(1)
400
401
if not has_actions(options) and clients:
402
if options.verbose or options.dump_json:
403
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
404
"Created", "Interval", "Host", "KeyID",
405
"Fingerprint", "CheckerRunning",
406
"LastEnabled", "ApprovalPending",
407
"ApprovedByDefault", "LastApprovalRequest",
408
"ApprovalDelay", "ApprovalDuration",
409
"Checker", "ExtendedTimeout", "Expires",
410
"LastCheckerStatus")
411
else:
412
keywords = defaultkeywords
413
414
if options.dump_json:
415
json.dump({client["Name"]: {key:
416
bool(client[key])
417
if isinstance(client[key],
418
dbus.Boolean)
419
else client[key]
420
for key in keywords}
421
for client in clients.values()},
422
fp=sys.stdout, indent=4,
423
separators=(',', ': '))
424
print()
425
else:
426
print_clients(clients.values(), keywords)
427
else:
428
# Process each client in the list by all selected options
429
for client in clients:
430
431
def set_client_prop(prop, value):
432
"""Set a Client D-Bus property"""
433
client.Set(client_interface, prop, value,
434
dbus_interface=dbus.PROPERTIES_IFACE)
435
436
def set_client_prop_ms(prop, value):
437
"""Set a Client D-Bus property, converted
438
from a string to milliseconds."""
439
set_client_prop(prop,
440
string_to_delta(value).total_seconds()
441
* 1000)
442
443
if options.remove:
444
mandos_serv.RemoveClient(client.__dbus_object_path__)
445
if options.enable:
446
set_client_prop("Enabled", dbus.Boolean(True))
447
if options.disable:
448
set_client_prop("Enabled", dbus.Boolean(False))
449
if options.bump_timeout:
450
set_client_prop("LastCheckedOK", "")
451
if options.start_checker:
452
set_client_prop("CheckerRunning", dbus.Boolean(True))
453
if options.stop_checker:
454
set_client_prop("CheckerRunning", dbus.Boolean(False))
455
if options.is_enabled:
456
if client.Get(client_interface, "Enabled",
457
dbus_interface=dbus.PROPERTIES_IFACE):
458
sys.exit(0)
459
else:
460
sys.exit(1)
461
if options.checker is not None:
462
set_client_prop("Checker", options.checker)
463
if options.host is not None:
464
set_client_prop("Host", options.host)
465
if options.interval is not None:
466
set_client_prop_ms("Interval", options.interval)
467
if options.approval_delay is not None:
468
set_client_prop_ms("ApprovalDelay",
469
options.approval_delay)
470
if options.approval_duration is not None:
471
set_client_prop_ms("ApprovalDuration",
472
options.approval_duration)
473
if options.timeout is not None:
474
set_client_prop_ms("Timeout", options.timeout)
475
if options.extended_timeout is not None:
476
set_client_prop_ms("ExtendedTimeout",
477
options.extended_timeout)
478
if options.secret is not None:
479
set_client_prop("Secret",
480
dbus.ByteArray(options.secret.read()))
481
if options.approved_by_default is not None:
482
set_client_prop("ApprovedByDefault",
483
dbus.Boolean(options
484
.approved_by_default))
485
if options.approve:
486
client.Approve(dbus.Boolean(True),
487
dbus_interface=client_interface)
488
elif options.deny:
489
client.Approve(dbus.Boolean(False),
490
dbus_interface=client_interface)
491
492
493
def should_only_run_tests():
494
parser = argparse.ArgumentParser(add_help=False)
495
parser.add_argument("--check", action='store_true')
496
args, unknown_args = parser.parse_known_args()
497
run_tests = args.check
498
if run_tests:
499
# Remove --check argument from sys.argv
500
sys.argv[1:] = unknown_args
501
return run_tests
502
503
# Add all tests from doctest strings
504
def load_tests(loader, tests, none):
505
import doctest
506
tests.addTests(doctest.DocTestSuite())
507
return tests
508
509
if __name__ == "__main__":
510
if should_only_run_tests():
511
# Call using ./tdd-python-script --check [--verbose]
512
unittest.main()
513
else:
514
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0