/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-ctl

First version of a somewhat complete D-Bus server interface.  Also
change user/group name to "_mandos".

* debian/mandos.postinst: Rename old "mandos" user and group to
                          "_mandos"; create "_mandos" user and group
                          if none exist.
* debian/mandos-client.postinst: - '' -

* initramfs-tools-hook: Try "_mandos" before "mandos" as user and
                        group name.

* mandos (_datetime_to_dbus_struct): New; was previously local.
  (Client.started): Renamed to "last_started".  All users changed.
  (Client.started): New; boolean.
  (Client.dbus_object_path): New.
  (Client.check_command): Renamed to "checker_command".  All users
                          changed.
  (Client.__init__): Set and use "self.dbus_object_path".  Set
                     "self.started".
  (Client.start): Update "self.started".  Emit "self.PropertyChanged"
                  signals for both "started" and "last_started".
  (Client.stop): Update "self.started".  Emit "self.PropertyChanged"
                 signal for "started".
  (Client.checker_callback): Take additional "command" argument.  All
                             callers changed. Emit
                             "self.PropertyChanged" signal.
  (Client.bump_timeout): Emit "self.PropertyChanged" signal for
                         "last_checked_ok".
  (Client.start_checker): Emit "self.PropertyChanged" signal for
                          "checker_running".
  (Client.stop_checker): Emit "self.PropertyChanged" signal for
                         "checker_running".
  (Client.still_valid): Bug fix: use "getattr(self, started, False)"
                        instead of "self.started" in case this client
                        object is so new that the "started" attribute
                        has not been created yet.
  (Client.IntervalChanged, Client.CheckerIsRunning, Client.GetChecker,
  Client.GetCreated, Client.GetFingerprint, Client.GetHost,
  Client.GetInterval, Client.GetName, Client.GetStarted,
  Client.GetTimeout, Client.StateChanged, Client.TimeoutChanged):
  Removed; all callers changed.
  (Client.CheckerCompleted): Add "condition" and "command" arguments.
                             All callers changed.
  (Client.GetAllProperties, Client.PropertyChanged): New.
  (Client.StillValid): Renamed to "IsStillValid".
  (Client.StartChecker): Changed to its own function to avoid the
                         return value from "Client.start_checker()".
  (Client.Stop): Changed to its own function to avoid the return value
                 from "Client.stop()".
  (main): Try "_mandos" before "mandos" as user and group name.
          Removed inner function "remove_from_clients".  New inner
          class "MandosServer".

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-ctl
1
 
#!/usr/bin/python
2
 
# -*- mode: python; coding: utf-8 -*-
3
 
# 
4
 
# Mandos Monitor - Control and monitor the Mandos server
5
 
# 
6
 
# Copyright © 2008-2010 Teddy Hogeborn
7
 
# Copyright © 2008-2010 Björn Påhlsson
8
 
# 
9
 
# This program is free software: you can redistribute it and/or modify
10
 
# it under the terms of the GNU General Public License as published by
11
 
# the Free Software Foundation, either version 3 of the License, or
12
 
# (at your option) any later version.
13
 
#
14
 
#     This program is distributed in the hope that it will be useful,
15
 
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
16
 
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17
 
#     GNU General Public License for more details.
18
 
# 
19
 
# You should have received a copy of the GNU General Public License
20
 
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
21
 
# 
22
 
# Contact the authors at <mandos@fukt.bsnet.se>.
23
 
# 
24
 
 
25
 
from __future__ import (division, absolute_import, print_function,
26
 
                        unicode_literals)
27
 
 
28
 
import sys
29
 
import dbus
30
 
from optparse import OptionParser
31
 
import locale
32
 
import datetime
33
 
import re
34
 
import os
35
 
 
36
 
locale.setlocale(locale.LC_ALL, "")
37
 
 
38
 
tablewords = {
39
 
    "Name": "Name",
40
 
    "Enabled": "Enabled",
41
 
    "Timeout": "Timeout",
42
 
    "LastCheckedOK": "Last Successful Check",
43
 
    "LastApprovalRequest": "Last Approval Request",
44
 
    "Created": "Created",
45
 
    "Interval": "Interval",
46
 
    "Host": "Host",
47
 
    "Fingerprint": "Fingerprint",
48
 
    "CheckerRunning": "Check Is Running",
49
 
    "LastEnabled": "Last Enabled",
50
 
    "ApprovalPending": "Approval Is Pending",
51
 
    "ApprovedByDefault": "Approved By Default",
52
 
    "ApprovalDelay": "Approval Delay",
53
 
    "ApprovalDuration": "Approval Duration",
54
 
    "Checker": "Checker",
55
 
    }
56
 
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
57
 
domain = "se.bsnet.fukt"
58
 
busname = domain + ".Mandos"
59
 
server_path = "/"
60
 
server_interface = domain + ".Mandos"
61
 
client_interface = domain + ".Mandos.Client"
62
 
version = "1.2.3"
63
 
 
64
 
def timedelta_to_milliseconds(td):
65
 
    """Convert a datetime.timedelta object to milliseconds"""
66
 
    return ((td.days * 24 * 60 * 60 * 1000)
67
 
            + (td.seconds * 1000)
68
 
            + (td.microseconds // 1000))
69
 
 
70
 
def milliseconds_to_string(ms):
71
 
    td = datetime.timedelta(0, 0, 0, ms)
72
 
    return ("%(days)s%(hours)02d:%(minutes)02d:%(seconds)02d"
73
 
            % { "days": "%dT" % td.days if td.days else "",
74
 
                "hours": td.seconds // 3600,
75
 
                "minutes": (td.seconds % 3600) // 60,
76
 
                "seconds": td.seconds % 60,
77
 
                })
78
 
 
79
 
 
80
 
def string_to_delta(interval):
81
 
    """Parse a string and return a datetime.timedelta
82
 
 
83
 
    >>> string_to_delta("7d")
84
 
    datetime.timedelta(7)
85
 
    >>> string_to_delta("60s")
86
 
    datetime.timedelta(0, 60)
87
 
    >>> string_to_delta("60m")
88
 
    datetime.timedelta(0, 3600)
89
 
    >>> string_to_delta("24h")
90
 
    datetime.timedelta(1)
91
 
    >>> string_to_delta("1w")
92
 
    datetime.timedelta(7)
93
 
    >>> string_to_delta("5m 30s")
94
 
    datetime.timedelta(0, 330)
95
 
    """
96
 
    timevalue = datetime.timedelta(0)
97
 
    regexp = re.compile("\d+[dsmhw]")
98
 
    
99
 
    for s in regexp.findall(interval):
100
 
        try:
101
 
            suffix = unicode(s[-1])
102
 
            value = int(s[:-1])
103
 
            if suffix == "d":
104
 
                delta = datetime.timedelta(value)
105
 
            elif suffix == "s":
106
 
                delta = datetime.timedelta(0, value)
107
 
            elif suffix == "m":
108
 
                delta = datetime.timedelta(0, 0, 0, 0, value)
109
 
            elif suffix == "h":
110
 
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
111
 
            elif suffix == "w":
112
 
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
113
 
            else:
114
 
                raise ValueError
115
 
        except (ValueError, IndexError):
116
 
            raise ValueError
117
 
        timevalue += delta
118
 
    return timevalue
119
 
 
120
 
def print_clients(clients, keywords):
121
 
    def valuetostring(value, keyword):
122
 
        if type(value) is dbus.Boolean:
123
 
            return "Yes" if value else "No"
124
 
        if keyword in ("Timeout", "Interval", "ApprovalDelay",
125
 
                       "ApprovalDuration"):
126
 
            return milliseconds_to_string(value)
127
 
        return unicode(value)
128
 
    
129
 
    # Create format string to print table rows
130
 
    format_string = " ".join("%%-%ds" %
131
 
                             max(len(tablewords[key]),
132
 
                                 max(len(valuetostring(client[key],
133
 
                                                       key))
134
 
                                     for client in
135
 
                                     clients))
136
 
                             for key in keywords)
137
 
    # Print header line
138
 
    print(format_string % tuple(tablewords[key] for key in keywords))
139
 
    for client in clients:
140
 
        print(format_string % tuple(valuetostring(client[key], key)
141
 
                                    for key in keywords))
142
 
 
143
 
def has_actions(options):
144
 
    return any((options.enable,
145
 
                options.disable,
146
 
                options.bump_timeout,
147
 
                options.start_checker,
148
 
                options.stop_checker,
149
 
                options.is_enabled,
150
 
                options.remove,
151
 
                options.checker is not None,
152
 
                options.timeout is not None,
153
 
                options.interval is not None,
154
 
                options.approved_by_default is not None,
155
 
                options.approval_delay is not None,
156
 
                options.approval_duration is not None,
157
 
                options.host is not None,
158
 
                options.secret is not None,
159
 
                options.approve,
160
 
                options.deny))
161
 
        
162
 
def main():
163
 
        parser = OptionParser(version = "%%prog %s" % version)
164
 
        parser.add_option("-a", "--all", action="store_true",
165
 
                          help="Select all clients")
166
 
        parser.add_option("-v", "--verbose", action="store_true",
167
 
                          help="Print all fields")
168
 
        parser.add_option("-e", "--enable", action="store_true",
169
 
                          help="Enable client")
170
 
        parser.add_option("-d", "--disable", action="store_true",
171
 
                          help="disable client")
172
 
        parser.add_option("-b", "--bump-timeout", action="store_true",
173
 
                          help="Bump timeout for client")
174
 
        parser.add_option("--start-checker", action="store_true",
175
 
                          help="Start checker for client")
176
 
        parser.add_option("--stop-checker", action="store_true",
177
 
                          help="Stop checker for client")
178
 
        parser.add_option("-V", "--is-enabled", action="store_true",
179
 
                          help="Check if client is enabled")
180
 
        parser.add_option("-r", "--remove", action="store_true",
181
 
                          help="Remove client")
182
 
        parser.add_option("-c", "--checker", type="string",
183
 
                          help="Set checker command for client")
184
 
        parser.add_option("-t", "--timeout", type="string",
185
 
                          help="Set timeout for client")
186
 
        parser.add_option("-i", "--interval", type="string",
187
 
                          help="Set checker interval for client")
188
 
        parser.add_option("--approve-by-default", action="store_true",
189
 
                          dest="approved_by_default",
190
 
                          help="Set client to be approved by default")
191
 
        parser.add_option("--deny-by-default", action="store_false",
192
 
                          dest="approved_by_default",
193
 
                          help="Set client to be denied by default")
194
 
        parser.add_option("--approval-delay", type="string",
195
 
                          help="Set delay before client approve/deny")
196
 
        parser.add_option("--approval-duration", type="string",
197
 
                          help="Set duration of one client approval")
198
 
        parser.add_option("-H", "--host", type="string",
199
 
                          help="Set host for client")
200
 
        parser.add_option("-s", "--secret", type="string",
201
 
                          help="Set password blob (file) for client")
202
 
        parser.add_option("-A", "--approve", action="store_true",
203
 
                          help="Approve any current client request")
204
 
        parser.add_option("-D", "--deny", action="store_true",
205
 
                          help="Deny any current client request")
206
 
        options, client_names = parser.parse_args()
207
 
        
208
 
        if has_actions(options) and not client_names and not options.all:
209
 
            parser.error("Options require clients names or --all.")
210
 
        if options.verbose and has_actions(options):
211
 
            parser.error("--verbose can only be used alone or with"
212
 
                         " --all.")
213
 
        if options.all and not has_actions(options):
214
 
            parser.error("--all requires an action.")
215
 
        
216
 
        try:
217
 
            bus = dbus.SystemBus()
218
 
            mandos_dbus_objc = bus.get_object(busname, server_path)
219
 
        except dbus.exceptions.DBusException:
220
 
            print("Could not connect to Mandos server",
221
 
                  file=sys.stderr)
222
 
            sys.exit(1)
223
 
    
224
 
        mandos_serv = dbus.Interface(mandos_dbus_objc,
225
 
                                     dbus_interface = server_interface)
226
 
 
227
 
        #block stderr since dbus library prints to stderr
228
 
        null = os.open(os.path.devnull, os.O_RDWR)
229
 
        stderrcopy = os.dup(sys.stderr.fileno())
230
 
        os.dup2(null, sys.stderr.fileno())
231
 
        os.close(null)
232
 
        try:
233
 
            try:
234
 
                mandos_clients = mandos_serv.GetAllClientsWithProperties()
235
 
            finally:
236
 
                #restore stderr
237
 
                os.dup2(stderrcopy, sys.stderr.fileno())
238
 
                os.close(stderrcopy)
239
 
        except dbus.exceptions.DBusException, e:
240
 
            print("Access denied: Accessing mandos server through dbus.",
241
 
                  file=sys.stderr)
242
 
            sys.exit(1)
243
 
            
244
 
        # Compile dict of (clients: properties) to process
245
 
        clients={}
246
 
        
247
 
        if options.all or not client_names:
248
 
            clients = dict((bus.get_object(busname, path), properties)
249
 
                           for path, properties in
250
 
                           mandos_clients.iteritems())
251
 
        else:
252
 
            for name in client_names:
253
 
                for path, client in mandos_clients.iteritems():
254
 
                    if client["Name"] == name:
255
 
                        client_objc = bus.get_object(busname, path)
256
 
                        clients[client_objc] = client
257
 
                        break
258
 
                else:
259
 
                    print("Client not found on server: %r" % name,
260
 
                          file=sys.stderr)
261
 
                    sys.exit(1)
262
 
            
263
 
        if not has_actions(options) and clients:
264
 
            if options.verbose:
265
 
                keywords = ("Name", "Enabled", "Timeout",
266
 
                            "LastCheckedOK", "Created", "Interval",
267
 
                            "Host", "Fingerprint", "CheckerRunning",
268
 
                            "LastEnabled", "ApprovalPending",
269
 
                            "ApprovedByDefault",
270
 
                            "LastApprovalRequest", "ApprovalDelay",
271
 
                            "ApprovalDuration", "Checker")
272
 
            else:
273
 
                keywords = defaultkeywords
274
 
            
275
 
            print_clients(clients.values(), keywords)
276
 
        else:
277
 
            # Process each client in the list by all selected options
278
 
            for client in clients:
279
 
                if options.remove:
280
 
                    mandos_serv.RemoveClient(client.__dbus_object_path__)
281
 
                if options.enable:
282
 
                    client.Enable(dbus_interface=client_interface)
283
 
                if options.disable:
284
 
                    client.Disable(dbus_interface=client_interface)
285
 
                if options.bump_timeout:
286
 
                    client.CheckedOK(dbus_interface=client_interface)
287
 
                if options.start_checker:
288
 
                    client.StartChecker(dbus_interface=client_interface)
289
 
                if options.stop_checker:
290
 
                    client.StopChecker(dbus_interface=client_interface)
291
 
                if options.is_enabled:
292
 
                    sys.exit(0 if client.Get(client_interface,
293
 
                                             "Enabled",
294
 
                                             dbus_interface=dbus.PROPERTIES_IFACE)
295
 
                             else 1)
296
 
                if options.checker:
297
 
                    client.Set(client_interface, "Checker", options.checker,
298
 
                               dbus_interface=dbus.PROPERTIES_IFACE)
299
 
                if options.host:
300
 
                    client.Set(client_interface, "Host", options.host,
301
 
                               dbus_interface=dbus.PROPERTIES_IFACE)
302
 
                if options.interval:
303
 
                    client.Set(client_interface, "Interval",
304
 
                               timedelta_to_milliseconds
305
 
                               (string_to_delta(options.interval)),
306
 
                               dbus_interface=dbus.PROPERTIES_IFACE)
307
 
                if options.approval_delay:
308
 
                    client.Set(client_interface, "ApprovalDelay",
309
 
                               timedelta_to_milliseconds
310
 
                               (string_to_delta(options.
311
 
                                                approval_delay)),
312
 
                               dbus_interface=dbus.PROPERTIES_IFACE)
313
 
                if options.approval_duration:
314
 
                    client.Set(client_interface, "ApprovalDuration",
315
 
                               timedelta_to_milliseconds
316
 
                               (string_to_delta(options.
317
 
                                                approval_duration)),
318
 
                               dbus_interface=dbus.PROPERTIES_IFACE)
319
 
                if options.timeout:
320
 
                    client.Set(client_interface, "Timeout",
321
 
                               timedelta_to_milliseconds
322
 
                               (string_to_delta(options.timeout)),
323
 
                               dbus_interface=dbus.PROPERTIES_IFACE)
324
 
                if options.secret:
325
 
                    client.Set(client_interface, "Secret",
326
 
                               dbus.ByteArray(open(options.secret,
327
 
                                                   "rb").read()),
328
 
                               dbus_interface=dbus.PROPERTIES_IFACE)
329
 
                if options.approved_by_default is not None:
330
 
                    client.Set(client_interface, "ApprovedByDefault",
331
 
                               dbus.Boolean(options
332
 
                                            .approved_by_default),
333
 
                               dbus_interface=dbus.PROPERTIES_IFACE)
334
 
                if options.approve:
335
 
                    client.Approve(dbus.Boolean(True),
336
 
                                   dbus_interface=client_interface)
337
 
                elif options.deny:
338
 
                    client.Approve(dbus.Boolean(False),
339
 
                                   dbus_interface=client_interface)
340
 
 
341
 
if __name__ == "__main__":
342
 
    main()