To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos-ctl
- browse files at revision 237.4.32
- compare with another revision
- download diff
- download tarball
- view history from revision 237.4.32
- Committer: Teddy Hogeborn
- Date: 2012-06-01 18:39:03 UTC
- mfrom: (237.8.1 release)
- mto: (237.4.33 release)
- mto: This revision was merged to the branch mainline in revision 593.
- Revision ID: teddy@recompile.se-20120601183903-hydodgfmlau5d109
Tags: version-1.5.5-1
* Makefile (version): Changed to "1.5.5".
* NEWS (Version 1.5.5): New entry.
* debian/changelog (1.5.5-1): - '' -
* NEWS (Version 1.5.5): New entry.
* debian/changelog (1.5.5-1): - '' -
added
removed
mandos-ctl
3
3
#
4
4
# Mandos Monitor - Control and monitor the Mandos server
5
5
#
6
# Copyright © 2008-2016 Teddy Hogeborn
7
# Copyright © 2008-2016 Björn Påhlsson
6
# Copyright © 2008-2012 Teddy Hogeborn
7
# Copyright © 2008-2012 Björn Påhlsson
8
8
#
9
9
# This program is free software: you can redistribute it and/or modify
10
10
# it under the terms of the GNU General Public License as published by
26
26
from __future__ import (division, absolute_import, print_function,
27
27
unicode_literals)
28
28
29
try:
30
from future_builtins import *
31
except ImportError:
32
pass
29
from future_builtins import *
33
30
34
31
import sys
32
import dbus
35
33
import argparse
36
34
import locale
37
35
import datetime
38
36
import re
39
37
import os
40
import collections
41
import doctest
42
import json
43
44
import dbus
45
46
if sys.version_info.major == 2:
47
str = unicode
48
38
49
39
locale.setlocale(locale.LC_ALL, "")
50
40
65
55
"ApprovalDelay": "Approval Delay",
66
56
"ApprovalDuration": "Approval Duration",
67
57
"Checker": "Checker",
68
"ExtendedTimeout": "Extended Timeout"
69
}
58
"ExtendedTimeout" : "Extended Timeout"
59
}
70
60
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
71
61
domain = "se.recompile"
72
62
busname = domain + ".Mandos"
73
63
server_path = "/"
74
64
server_interface = domain + ".Mandos"
75
65
client_interface = domain + ".Mandos.Client"
76
version = "1.7.10"
77
78
79
try:
80
dbus.OBJECT_MANAGER_IFACE
81
except AttributeError:
82
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
66
version = "1.5.5"
67
68
def timedelta_to_milliseconds(td):
69
"""Convert a datetime.timedelta object to milliseconds"""
70
return ((td.days * 24 * 60 * 60 * 1000)
71
+ (td.seconds * 1000)
72
+ (td.microseconds // 1000))
83
73
84
74
def milliseconds_to_string(ms):
85
75
td = datetime.timedelta(0, 0, 0, ms)
86
return ("{days}{hours:02}:{minutes:02}:{seconds:02}".format(
87
days = "{}T".format(td.days) if td.days else "",
88
hours = td.seconds // 3600,
89
minutes = (td.seconds % 3600) // 60,
90
seconds = td.seconds % 60))
91
92
93
def rfc3339_duration_to_delta(duration):
94
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
95
96
>>> rfc3339_duration_to_delta("P7D")
97
datetime.timedelta(7)
98
>>> rfc3339_duration_to_delta("PT60S")
99
datetime.timedelta(0, 60)
100
>>> rfc3339_duration_to_delta("PT60M")
101
datetime.timedelta(0, 3600)
102
>>> rfc3339_duration_to_delta("PT24H")
103
datetime.timedelta(1)
104
>>> rfc3339_duration_to_delta("P1W")
105
datetime.timedelta(7)
106
>>> rfc3339_duration_to_delta("PT5M30S")
107
datetime.timedelta(0, 330)
108
>>> rfc3339_duration_to_delta("P1DT3M20S")
109
datetime.timedelta(1, 200)
110
"""
111
112
# Parsing an RFC 3339 duration with regular expressions is not
113
# possible - there would have to be multiple places for the same
114
# values, like seconds. The current code, while more esoteric, is
115
# cleaner without depending on a parsing library. If Python had a
116
# built-in library for parsing we would use it, but we'd like to
117
# avoid excessive use of external libraries.
118
119
# New type for defining tokens, syntax, and semantics all-in-one
120
Token = collections.namedtuple("Token", (
121
"regexp", # To match token; if "value" is not None, must have
122
# a "group" containing digits
123
"value", # datetime.timedelta or None
124
"followers")) # Tokens valid after this token
125
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
126
# the "duration" ABNF definition in RFC 3339, Appendix A.
127
token_end = Token(re.compile(r"$"), None, frozenset())
128
token_second = Token(re.compile(r"(\d+)S"),
129
datetime.timedelta(seconds=1),
130
frozenset((token_end, )))
131
token_minute = Token(re.compile(r"(\d+)M"),
132
datetime.timedelta(minutes=1),
133
frozenset((token_second, token_end)))
134
token_hour = Token(re.compile(r"(\d+)H"),
135
datetime.timedelta(hours=1),
136
frozenset((token_minute, token_end)))
137
token_time = Token(re.compile(r"T"),
138
None,
139
frozenset((token_hour, token_minute,
140
token_second)))
141
token_day = Token(re.compile(r"(\d+)D"),
142
datetime.timedelta(days=1),
143
frozenset((token_time, token_end)))
144
token_month = Token(re.compile(r"(\d+)M"),
145
datetime.timedelta(weeks=4),
146
frozenset((token_day, token_end)))
147
token_year = Token(re.compile(r"(\d+)Y"),
148
datetime.timedelta(weeks=52),
149
frozenset((token_month, token_end)))
150
token_week = Token(re.compile(r"(\d+)W"),
151
datetime.timedelta(weeks=1),
152
frozenset((token_end, )))
153
token_duration = Token(re.compile(r"P"), None,
154
frozenset((token_year, token_month,
155
token_day, token_time,
156
token_week)))
157
# Define starting values
158
value = datetime.timedelta() # Value so far
159
found_token = None
160
followers = frozenset((token_duration, )) # Following valid tokens
161
s = duration # String left to parse
162
# Loop until end token is found
163
while found_token is not token_end:
164
# Search for any currently valid tokens
165
for token in followers:
166
match = token.regexp.match(s)
167
if match is not None:
168
# Token found
169
if token.value is not None:
170
# Value found, parse digits
171
factor = int(match.group(1), 10)
172
# Add to value so far
173
value += factor * token.value
174
# Strip token from string
175
s = token.regexp.sub("", s, 1)
176
# Go to found token
177
found_token = token
178
# Set valid next tokens
179
followers = found_token.followers
180
break
181
else:
182
# No currently valid tokens were found
183
raise ValueError("Invalid RFC 3339 duration: {!r}"
184
.format(duration))
185
# End token found
186
return value
187
76
return ("{days}{hours:02}:{minutes:02}:{seconds:02}"
77
.format(days = "{0}T".format(td.days) if td.days else "",
78
hours = td.seconds // 3600,
79
minutes = (td.seconds % 3600) // 60,
80
seconds = td.seconds % 60,
81
))
188
82
189
83
def string_to_delta(interval):
190
84
"""Parse a string and return a datetime.timedelta
191
85
192
>>> string_to_delta('7d')
86
>>> string_to_delta("7d")
193
87
datetime.timedelta(7)
194
>>> string_to_delta('60s')
88
>>> string_to_delta("60s")
195
89
datetime.timedelta(0, 60)
196
>>> string_to_delta('60m')
90
>>> string_to_delta("60m")
197
91
datetime.timedelta(0, 3600)
198
>>> string_to_delta('24h')
92
>>> string_to_delta("24h")
199
93
datetime.timedelta(1)
200
>>> string_to_delta('1w')
94
>>> string_to_delta("1w")
201
95
datetime.timedelta(7)
202
>>> string_to_delta('5m 30s')
96
>>> string_to_delta("5m 30s")
203
97
datetime.timedelta(0, 330)
204
98
"""
205
206
try:
207
return rfc3339_duration_to_delta(interval)
208
except ValueError:
209
pass
210
211
99
value = datetime.timedelta(0)
212
regexp = re.compile(r"(\d+)([dsmhw]?)")
100
regexp = re.compile("(\d+)([dsmhw]?)")
213
101
214
102
for num, suffix in regexp.findall(interval):
215
103
if suffix == "d":
226
114
value += datetime.timedelta(0, 0, 0, int(num))
227
115
return value
228
116
229
230
117
def print_clients(clients, keywords):
231
118
def valuetostring(value, keyword):
232
119
if type(value) is dbus.Boolean:
234
121
if keyword in ("Timeout", "Interval", "ApprovalDelay",
235
122
"ApprovalDuration", "ExtendedTimeout"):
236
123
return milliseconds_to_string(value)
237
return str(value)
124
return unicode(value)
238
125
239
126
# Create format string to print table rows
240
127
format_string = " ".join("{{{key}:{width}}}".format(
241
width = max(len(tablewords[key]),
242
max(len(valuetostring(client[key], key))
243
for client in clients)),
244
key = key)
245
for key in keywords)
128
width = max(len(tablewords[key]),
129
max(len(valuetostring(client[key],
130
key))
131
for client in
132
clients)),
133
key = key) for key in keywords)
246
134
# Print header line
247
135
print(format_string.format(**tablewords))
248
136
for client in clients:
249
print(format_string.format(**{
250
key: valuetostring(client[key], key)
251
for key in keywords }))
252
137
print(format_string.format(**dict((key,
138
valuetostring(client[key],
139
key))
140
for key in keywords)))
253
141
254
142
def has_actions(options):
255
143
return any((options.enable,
271
159
options.approve,
272
160
options.deny))
273
161
274
275
162
def main():
276
163
parser = argparse.ArgumentParser()
277
164
parser.add_argument("--version", action="version",
278
version = "%(prog)s {}".format(version),
165
version = "%(prog)s {0}".format(version),
279
166
help="show version number and exit")
280
167
parser.add_argument("-a", "--all", action="store_true",
281
168
help="Select all clients")
282
169
parser.add_argument("-v", "--verbose", action="store_true",
283
170
help="Print all fields")
284
parser.add_argument("-j", "--dump-json", action="store_true",
285
help="Dump client data in JSON format")
286
171
parser.add_argument("-e", "--enable", action="store_true",
287
172
help="Enable client")
288
173
parser.add_argument("-d", "--disable", action="store_true",
316
201
parser.add_argument("--approval-duration",
317
202
help="Set duration of one client approval")
318
203
parser.add_argument("-H", "--host", help="Set host for client")
319
parser.add_argument("-s", "--secret",
320
type=argparse.FileType(mode="rb"),
204
parser.add_argument("-s", "--secret", type=file,
321
205
help="Set password blob (file) for client")
322
206
parser.add_argument("-A", "--approve", action="store_true",
323
207
help="Approve any current client request")
324
208
parser.add_argument("-D", "--deny", action="store_true",
325
209
help="Deny any current client request")
326
parser.add_argument("--check", action="store_true",
327
help="Run self-test")
328
210
parser.add_argument("client", nargs="*", help="Client name")
329
211
options = parser.parse_args()
330
212
331
213
if has_actions(options) and not (options.client or options.all):
332
214
parser.error("Options require clients names or --all.")
333
215
if options.verbose and has_actions(options):
334
parser.error("--verbose can only be used alone.")
335
if options.dump_json and (options.verbose or has_actions(options)):
336
parser.error("--dump-json can only be used alone.")
216
parser.error("--verbose can only be used alone or with"
217
" --all.")
337
218
if options.all and not has_actions(options):
338
219
parser.error("--all requires an action.")
339
220
340
if options.check:
341
fail_count, test_count = doctest.testmod()
342
sys.exit(os.EX_OK if fail_count == 0 else 1)
343
344
221
try:
345
222
bus = dbus.SystemBus()
346
223
mandos_dbus_objc = bus.get_object(busname, server_path)
347
224
except dbus.exceptions.DBusException:
348
print("Could not connect to Mandos server", file=sys.stderr)
225
print("Could not connect to Mandos server",
226
file=sys.stderr)
349
227
sys.exit(1)
350
228
351
229
mandos_serv = dbus.Interface(mandos_dbus_objc,
352
230
dbus_interface = server_interface)
353
mandos_serv_object_manager = dbus.Interface(
354
mandos_dbus_objc, dbus_interface = dbus.OBJECT_MANAGER_IFACE)
355
231
356
232
#block stderr since dbus library prints to stderr
357
233
null = os.open(os.path.devnull, os.O_RDWR)
360
236
os.close(null)
361
237
try:
362
238
try:
363
mandos_clients = { path: ifs_and_props[client_interface]
364
for path, ifs_and_props in
365
mandos_serv_object_manager
366
.GetManagedObjects().items()
367
if client_interface in ifs_and_props }
239
mandos_clients = mandos_serv.GetAllClientsWithProperties()
368
240
finally:
369
241
#restore stderr
370
242
os.dup2(stderrcopy, sys.stderr.fileno())
371
243
os.close(stderrcopy)
372
except dbus.exceptions.DBusException as e:
373
print("Access denied: Accessing mandos server through D-Bus: {}"
374
.format(e), file=sys.stderr)
244
except dbus.exceptions.DBusException:
245
print("Access denied: Accessing mandos server through dbus.",
246
file=sys.stderr)
375
247
sys.exit(1)
376
248
377
249
# Compile dict of (clients: properties) to process
378
250
clients={}
379
251
380
252
if options.all or not options.client:
381
clients = { bus.get_object(busname, path): properties
382
for path, properties in mandos_clients.items() }
253
clients = dict((bus.get_object(busname, path), properties)
254
for path, properties in
255
mandos_clients.iteritems())
383
256
else:
384
257
for name in options.client:
385
for path, client in mandos_clients.items():
258
for path, client in mandos_clients.iteritems():
386
259
if client["Name"] == name:
387
260
client_objc = bus.get_object(busname, path)
388
261
clients[client_objc] = client
389
262
break
390
263
else:
391
print("Client not found on server: {!r}"
264
print("Client not found on server: {0!r}"
392
265
.format(name), file=sys.stderr)
393
266
sys.exit(1)
394
267
395
268
if not has_actions(options) and clients:
396
if options.verbose or options.dump_json:
397
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
398
"Created", "Interval", "Host", "Fingerprint",
399
"CheckerRunning", "LastEnabled",
400
"ApprovalPending", "ApprovedByDefault",
269
if options.verbose:
270
keywords = ("Name", "Enabled", "Timeout",
271
"LastCheckedOK", "Created", "Interval",
272
"Host", "Fingerprint", "CheckerRunning",
273
"LastEnabled", "ApprovalPending",
274
"ApprovedByDefault",
401
275
"LastApprovalRequest", "ApprovalDelay",
402
276
"ApprovalDuration", "Checker",
403
277
"ExtendedTimeout")
404
278
else:
405
279
keywords = defaultkeywords
406
280
407
if options.dump_json:
408
json.dump({client["Name"]: {key:
409
bool(client[key])
410
if isinstance(client[key],
411
dbus.Boolean)
412
else client[key]
413
for key in keywords }
414
for client in clients.values() },
415
fp = sys.stdout, indent = 4,
416
separators = (',', ': '))
417
print()
418
else:
419
print_clients(clients.values(), keywords)
281
print_clients(clients.values(), keywords)
420
282
else:
421
283
# Process each client in the list by all selected options
422
284
for client in clients:
423
424
285
def set_client_prop(prop, value):
425
286
"""Set a Client D-Bus property"""
426
287
client.Set(client_interface, prop, value,
427
288
dbus_interface=dbus.PROPERTIES_IFACE)
428
429
289
def set_client_prop_ms(prop, value):
430
290
"""Set a Client D-Bus property, converted
431
291
from a string to milliseconds."""
432
292
set_client_prop(prop,
433
string_to_delta(value).total_seconds()
434
* 1000)
435
293
timedelta_to_milliseconds
294
(string_to_delta(value)))
436
295
if options.remove:
437
296
mandos_serv.RemoveClient(client.__dbus_object_path__)
438
297
if options.enable:
482
341
client.Approve(dbus.Boolean(False),
483
342
dbus_interface=client_interface)
484
343
485
486
344
if __name__ == "__main__":
487
345
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0