/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-monitor

* network-hooks.d/bridge: Use "/usr/sbin/brctl" explicitly.
* plugins.d/mandos-client.c (run_network_hooks): Raise priviliges in
                                                 child process.
  (main): Do not use getuid() to check if running setuid root.  Do not
          raise privileges for run_network_hooks.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-monitor
3
3
# 
4
4
# Mandos Monitor - Control and monitor the Mandos server
5
5
# 
6
 
# Copyright © 2009-2012 Teddy Hogeborn
7
 
# Copyright © 2009-2012 Björn Påhlsson
 
6
# Copyright © 2009-2011 Teddy Hogeborn
 
7
# Copyright © 2009-2011 Björn Påhlsson
8
8
# 
9
9
# This program is free software: you can redistribute it and/or modify
10
10
# it under the terms of the GNU General Public License as published by
17
17
#     GNU General Public License for more details.
18
18
# 
19
19
# You should have received a copy of the GNU General Public License
20
 
# along with this program.  If not, see
21
 
# <http://www.gnu.org/licenses/>.
 
20
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
22
21
# 
23
22
# Contact the authors at <mandos@recompile.se>.
24
23
# 
26
25
from __future__ import (division, absolute_import, print_function,
27
26
                        unicode_literals)
28
27
 
29
 
from future_builtins import *
30
 
 
31
28
import sys
32
29
import os
33
30
import signal
55
52
domain = 'se.recompile'
56
53
server_interface = domain + '.Mandos'
57
54
client_interface = domain + '.Mandos.Client'
58
 
version = "1.5.3"
 
55
version = "1.4.1"
59
56
 
60
57
# Always run in monochrome mode
61
58
urwid.curses_display.curses.has_colors = lambda : False
134
131
        
135
132
        self._update_timer_callback_tag = None
136
133
        self._update_timer_callback_lock = 0
 
134
        self.last_checker_failed = False
137
135
        
138
136
        # The widget shown normally
139
137
        self._text_widget = urwid.Text("")
147
145
        
148
146
        last_checked_ok = isoformat_to_datetime(self.properties
149
147
                                                ["LastCheckedOK"])
 
148
        if last_checked_ok is None:
 
149
            self.last_checker_failed = True
 
150
        else:
 
151
            self.last_checker_failed = ((datetime.datetime.utcnow()
 
152
                                         - last_checked_ok)
 
153
                                        > datetime.timedelta
 
154
                                        (milliseconds=
 
155
                                         self.properties
 
156
                                         ["Interval"]))
150
157
        
151
 
        if self.properties ["LastCheckerStatus"] != 0:
 
158
        if self.last_checker_failed:
152
159
            self.using_timer(True)
153
160
        
154
161
        if self.need_approval:
175
182
                                         self.rejected,
176
183
                                         client_interface,
177
184
                                         byte_arrays=True))
178
 
        #self.logger('Created client {0}'
179
 
        #            .format(self.properties["Name"]))
 
185
        #self.logger('Created client %s' % (self.properties["Name"]))
180
186
    
181
187
    def property_changed(self, property=None, value=None):
182
188
        super(self, MandosClientWidget).property_changed(property,
183
189
                                                         value)
184
190
        if property == "ApprovalPending":
185
191
            using_timer(bool(value))
186
 
        if property == "LastCheckerStatus":
187
 
            using_timer(value != 0)
188
 
            #self.logger('Checker for client {0} (command "{1}") was '
189
 
            #            ' successful'.format(self.properties["Name"],
190
 
            #                                 command))
191
 
    
 
192
        
192
193
    def using_timer(self, flag):
193
194
        """Call this method with True or False when timer should be
194
195
        activated or deactivated.
209
210
    
210
211
    def checker_completed(self, exitstatus, condition, command):
211
212
        if exitstatus == 0:
 
213
            if self.last_checker_failed:
 
214
                self.last_checker_failed = False
 
215
                self.using_timer(False)
 
216
            #self.logger('Checker for client %s (command "%s")'
 
217
            #            ' was successful'
 
218
            #            % (self.properties["Name"], command))
212
219
            self.update()
213
220
            return
214
221
        # Checker failed
 
222
        if not self.last_checker_failed:
 
223
            self.last_checker_failed = True
 
224
            self.using_timer(True)
215
225
        if os.WIFEXITED(condition):
216
 
            self.logger('Checker for client {0} (command "{1}")'
217
 
                        ' failed with exit code {2}'
218
 
                        .format(self.properties["Name"], command,
219
 
                                os.WEXITSTATUS(condition)))
 
226
            self.logger('Checker for client %s (command "%s")'
 
227
                        ' failed with exit code %s'
 
228
                        % (self.properties["Name"], command,
 
229
                           os.WEXITSTATUS(condition)))
220
230
        elif os.WIFSIGNALED(condition):
221
 
            self.logger('Checker for client {0} (command "{1}") was'
222
 
                        ' killed by signal {2}'
223
 
                        .format(self.properties["Name"], command,
224
 
                                os.WTERMSIG(condition)))
 
231
            self.logger('Checker for client %s (command "%s")'
 
232
                        ' was killed by signal %s'
 
233
                        % (self.properties["Name"], command,
 
234
                           os.WTERMSIG(condition)))
225
235
        elif os.WCOREDUMP(condition):
226
 
            self.logger('Checker for client {0} (command "{1}")'
 
236
            self.logger('Checker for client %s (command "%s")'
227
237
                        ' dumped core'
228
 
                        .format(self.properties["Name"], command))
 
238
                        % (self.properties["Name"], command))
229
239
        else:
230
 
            self.logger('Checker for client {0} completed'
231
 
                        ' mysteriously'
232
 
                        .format(self.properties["Name"]))
 
240
            self.logger('Checker for client %s completed'
 
241
                        ' mysteriously')
233
242
        self.update()
234
243
    
235
244
    def checker_started(self, command):
236
 
        """Server signals that a checker started. This could be useful
237
 
           to log in the future. """
238
 
        #self.logger('Client {0} started checker "{1}"'
239
 
        #            .format(self.properties["Name"],
240
 
        #                    unicode(command)))
 
245
        #self.logger('Client %s started checker "%s"'
 
246
        #            % (self.properties["Name"], unicode(command)))
241
247
        pass
242
248
    
243
249
    def got_secret(self):
244
 
        self.logger('Client {0} received its secret'
245
 
                    .format(self.properties["Name"]))
 
250
        self.last_checker_failed = False
 
251
        self.logger('Client %s received its secret'
 
252
                    % self.properties["Name"])
246
253
    
247
254
    def need_approval(self, timeout, default):
248
255
        if not default:
249
 
            message = 'Client {0} needs approval within {1} seconds'
 
256
            message = 'Client %s needs approval within %s seconds'
250
257
        else:
251
 
            message = 'Client {0} will get its secret in {1} seconds'
252
 
        self.logger(message.format(self.properties["Name"],
253
 
                                   timeout/1000))
 
258
            message = 'Client %s will get its secret in %s seconds'
 
259
        self.logger(message
 
260
                    % (self.properties["Name"], timeout/1000))
254
261
        self.using_timer(True)
255
262
    
256
263
    def rejected(self, reason):
257
 
        self.logger('Client {0} was rejected; reason: {1}'
258
 
                    .format(self.properties["Name"], reason))
 
264
        self.logger('Client %s was rejected; reason: %s'
 
265
                    % (self.properties["Name"], reason))
259
266
    
260
267
    def selectable(self):
261
268
        """Make this a "selectable" widget.
287
294
        # Rebuild focus and non-focus widgets using current properties
288
295
 
289
296
        # Base part of a client. Name!
290
 
        base = '{name}: '.format(name=self.properties["Name"])
 
297
        base = ('%(name)s: '
 
298
                      % {"name": self.properties["Name"]})
291
299
        if not self.properties["Enabled"]:
292
300
            message = "DISABLED"
293
301
        elif self.properties["ApprovalPending"]:
302
310
            else:
303
311
                timer = datetime.timedelta()
304
312
            if self.properties["ApprovedByDefault"]:
305
 
                message = "Approval in {0}. (d)eny?"
 
313
                message = "Approval in %s. (d)eny?"
306
314
            else:
307
 
                message = "Denial in {0}. (a)pprove?"
308
 
            message = message.format(unicode(timer).rsplit(".", 1)[0])
309
 
        elif self.properties["LastCheckerStatus"] != 0:
310
 
            # When checker has failed, show timer until client expires
 
315
                message = "Denial in %s. (a)pprove?"
 
316
            message = message % unicode(timer).rsplit(".", 1)[0]
 
317
        elif self.last_checker_failed:
 
318
            # When checker has failed, print a timer until client expires
311
319
            expires = self.properties["Expires"]
312
320
            if expires == "":
313
321
                timer = datetime.timedelta(0)
314
322
            else:
315
 
                expires = (datetime.datetime.strptime
316
 
                           (expires, '%Y-%m-%dT%H:%M:%S.%f'))
 
323
                expires = datetime.datetime.strptime(expires,
 
324
                                                     '%Y-%m-%dT%H:%M:%S.%f')
317
325
                timer = expires - datetime.datetime.utcnow()
318
326
            message = ('A checker has failed! Time until client'
319
 
                       ' gets disabled: {0}'
320
 
                       .format(unicode(timer).rsplit(".", 1)[0]))
 
327
                       ' gets disabled: %s'
 
328
                           % unicode(timer).rsplit(".", 1)[0])
321
329
        else:
322
330
            message = "enabled"
323
 
        self._text = "{0}{1}".format(base, message)
 
331
        self._text = "%s%s" % (base, message)
324
332
            
325
333
        if not urwid.supports_unicode():
326
334
            self._text = self._text.encode("ascii", "replace")
489
497
        
490
498
        self.busname = domain + '.Mandos'
491
499
        self.main_loop = gobject.MainLoop()
 
500
        self.bus = dbus.SystemBus()
 
501
        mandos_dbus_objc = self.bus.get_object(
 
502
            self.busname, "/", follow_name_owner_changes=True)
 
503
        self.mandos_serv = dbus.Interface(mandos_dbus_objc,
 
504
                                          dbus_interface
 
505
                                          = server_interface)
 
506
        try:
 
507
            mandos_clients = (self.mandos_serv
 
508
                              .GetAllClientsWithProperties())
 
509
        except dbus.exceptions.DBusException:
 
510
            mandos_clients = dbus.Dictionary()
 
511
        
 
512
        (self.mandos_serv
 
513
         .connect_to_signal("ClientRemoved",
 
514
                            self.find_and_remove_client,
 
515
                            dbus_interface=server_interface,
 
516
                            byte_arrays=True))
 
517
        (self.mandos_serv
 
518
         .connect_to_signal("ClientAdded",
 
519
                            self.add_new_client,
 
520
                            dbus_interface=server_interface,
 
521
                            byte_arrays=True))
 
522
        (self.mandos_serv
 
523
         .connect_to_signal("ClientNotFound",
 
524
                            self.client_not_found,
 
525
                            dbus_interface=server_interface,
 
526
                            byte_arrays=True))
 
527
        for path, client in mandos_clients.iteritems():
 
528
            client_proxy_object = self.bus.get_object(self.busname,
 
529
                                                      path)
 
530
            self.add_client(MandosClientWidget(server_proxy_object
 
531
                                               =self.mandos_serv,
 
532
                                               proxy_object
 
533
                                               =client_proxy_object,
 
534
                                               properties=client,
 
535
                                               update_hook
 
536
                                               =self.refresh,
 
537
                                               delete_hook
 
538
                                               =self.remove_client,
 
539
                                               logger
 
540
                                               =self.log_message),
 
541
                            path=path)
492
542
    
493
543
    def client_not_found(self, fingerprint, address):
494
 
        self.log_message("Client with address {0} and fingerprint"
495
 
                         " {1} could not be found"
496
 
                         .format(address, fingerprint))
 
544
        self.log_message(("Client with address %s and fingerprint %s"
 
545
                          " could not be found" % (address,
 
546
                                                    fingerprint)))
497
547
    
498
548
    def rebuild(self):
499
549
        """This rebuilds the User Interface.
509
559
                                                     self.divider)))
510
560
        if self.log_visible:
511
561
            self.uilist.append(self.logbox)
 
562
            pass
512
563
        self.topwidget = urwid.Pile(self.uilist)
513
564
    
514
565
    def log_message(self, message):
552
603
            client = self.clients_dict[path]
553
604
        except KeyError:
554
605
            # not found?
555
 
            self.log_message("Unknown client {0!r} ({1!r}) removed"
556
 
                             .format(name, path))
 
606
            self.log_message("Unknown client %r (%r) removed", name,
 
607
                             path)
557
608
            return
558
609
        client.delete()
559
610
    
598
649
    
599
650
    def run(self):
600
651
        """Start the main loop and exit when it's done."""
601
 
        self.bus = dbus.SystemBus()
602
 
        mandos_dbus_objc = self.bus.get_object(
603
 
            self.busname, "/", follow_name_owner_changes=True)
604
 
        self.mandos_serv = dbus.Interface(mandos_dbus_objc,
605
 
                                          dbus_interface
606
 
                                          = server_interface)
607
 
        try:
608
 
            mandos_clients = (self.mandos_serv
609
 
                              .GetAllClientsWithProperties())
610
 
        except dbus.exceptions.DBusException:
611
 
            mandos_clients = dbus.Dictionary()
612
 
        
613
 
        (self.mandos_serv
614
 
         .connect_to_signal("ClientRemoved",
615
 
                            self.find_and_remove_client,
616
 
                            dbus_interface=server_interface,
617
 
                            byte_arrays=True))
618
 
        (self.mandos_serv
619
 
         .connect_to_signal("ClientAdded",
620
 
                            self.add_new_client,
621
 
                            dbus_interface=server_interface,
622
 
                            byte_arrays=True))
623
 
        (self.mandos_serv
624
 
         .connect_to_signal("ClientNotFound",
625
 
                            self.client_not_found,
626
 
                            dbus_interface=server_interface,
627
 
                            byte_arrays=True))
628
 
        for path, client in mandos_clients.iteritems():
629
 
            client_proxy_object = self.bus.get_object(self.busname,
630
 
                                                      path)
631
 
            self.add_client(MandosClientWidget(server_proxy_object
632
 
                                               =self.mandos_serv,
633
 
                                               proxy_object
634
 
                                               =client_proxy_object,
635
 
                                               properties=client,
636
 
                                               update_hook
637
 
                                               =self.refresh,
638
 
                                               delete_hook
639
 
                                               =self.remove_client,
640
 
                                               logger
641
 
                                               =self.log_message),
642
 
                            path=path)
643
 
 
644
652
        self.refresh()
645
653
        self._input_callback_tag = (gobject.io_add_watch
646
654
                                    (sys.stdin.fileno(),