To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos-ctl
- browse files at revision 639
- compare with another revision
- download diff
- download tarball
- view history from revision 639
- Committer: Teddy Hogeborn
- Date: 2013-10-27 17:42:23 UTC
- Revision ID: teddy@recompile.se-20131027174223-mq3a1h8xi5jcv9e6
Bug fix: Make sure systemd service file is installed.
* Makefile (install-server): Fix typo causing syntax error.
* debian/mandos.dirs (lib/systemd/system): New.
* Makefile (install-server): Fix typo causing syntax error.
* debian/mandos.dirs (lib/systemd/system): New.
- files added:
- initramfs-tools-hook-conf
- files removed:
- bugs.xml
- debian/upstream
- plugin-helpers
- files modified:
- DBUS-API
added
removed
mandos-ctl
1
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8; after-save-hook: (lambda () (let ((command (if (and (boundp 'tramp-file-name-structure) (string-match (car tramp-file-name-structure) (buffer-file-name))) (tramp-file-name-localname (tramp-dissect-file-name (buffer-file-name))) (buffer-file-name)))) (if (= (shell-command (format "%s --check" (shell-quote-argument command)) "*Test*") 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)) (kill-buffer "*Test*")) (display-buffer "*Test*")))); -*-
3
#
2
# -*- mode: python; coding: utf-8 -*-
3
#
4
4
# Mandos Monitor - Control and monitor the Mandos server
5
#
6
# Copyright © 2008-2019 Teddy Hogeborn
7
# Copyright © 2008-2019 Björn Påhlsson
8
#
9
# This file is part of Mandos.
10
#
11
# Mandos is free software: you can redistribute it and/or modify it
12
# under the terms of the GNU General Public License as published by
5
#
6
# Copyright © 2008-2012 Teddy Hogeborn
7
# Copyright © 2008-2012 Björn Påhlsson
8
#
9
# This program is free software: you can redistribute it and/or modify
10
# it under the terms of the GNU General Public License as published by
13
11
# the Free Software Foundation, either version 3 of the License, or
14
12
# (at your option) any later version.
15
13
#
16
# Mandos is distributed in the hope that it will be useful, but
17
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# This program is distributed in the hope that it will be useful,
15
# but WITHOUT ANY WARRANTY; without even the implied warranty of
18
16
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19
17
# GNU General Public License for more details.
20
#
18
#
21
19
# You should have received a copy of the GNU General Public License
22
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
23
#
20
# along with this program. If not, see
21
# <http://www.gnu.org/licenses/>.
22
#
24
23
# Contact the authors at <mandos@recompile.se>.
25
#
24
#
26
25
27
26
from __future__ import (division, absolute_import, print_function,
28
27
unicode_literals)
29
28
30
try:
31
from future_builtins import *
32
except ImportError:
33
pass
29
from future_builtins import *
34
30
35
31
import sys
36
32
import argparse
39
35
import re
40
36
import os
41
37
import collections
42
import json
43
import unittest
44
import logging
38
import doctest
45
39
46
40
import dbus
47
41
48
# Show warnings by default
49
if not sys.warnoptions:
50
import warnings
51
warnings.simplefilter("default")
52
53
log = logging.getLogger(sys.argv[0])
54
logging.basicConfig(level="INFO", # Show info level messages
55
format="%(message)s") # Show basic log messages
56
57
logging.captureWarnings(True) # Show warnings via the logging system
58
59
if sys.version_info.major == 2:
60
str = unicode
61
62
42
locale.setlocale(locale.LC_ALL, "")
63
43
44
tablewords = {
45
"Name": "Name",
46
"Enabled": "Enabled",
47
"Timeout": "Timeout",
48
"LastCheckedOK": "Last Successful Check",
49
"LastApprovalRequest": "Last Approval Request",
50
"Created": "Created",
51
"Interval": "Interval",
52
"Host": "Host",
53
"Fingerprint": "Fingerprint",
54
"CheckerRunning": "Check Is Running",
55
"LastEnabled": "Last Enabled",
56
"ApprovalPending": "Approval Is Pending",
57
"ApprovedByDefault": "Approved By Default",
58
"ApprovalDelay": "Approval Delay",
59
"ApprovalDuration": "Approval Duration",
60
"Checker": "Checker",
61
"ExtendedTimeout" : "Extended Timeout"
62
}
63
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
64
64
domain = "se.recompile"
65
65
busname = domain + ".Mandos"
66
66
server_path = "/"
67
67
server_interface = domain + ".Mandos"
68
68
client_interface = domain + ".Mandos.Client"
69
version = "1.8.3"
70
71
72
try:
73
dbus.OBJECT_MANAGER_IFACE
74
except AttributeError:
75
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
76
69
version = "1.6.2"
70
71
def timedelta_to_milliseconds(td):
72
"""Convert a datetime.timedelta object to milliseconds"""
73
return ((td.days * 24 * 60 * 60 * 1000)
74
+ (td.seconds * 1000)
75
+ (td.microseconds // 1000))
77
76
78
77
def milliseconds_to_string(ms):
79
78
td = datetime.timedelta(0, 0, 0, ms)
80
79
return ("{days}{hours:02}:{minutes:02}:{seconds:02}"
81
.format(days="{}T".format(td.days) if td.days else "",
82
hours=td.seconds // 3600,
83
minutes=(td.seconds % 3600) // 60,
84
seconds=td.seconds % 60))
80
.format(days = "{0}T".format(td.days) if td.days else "",
81
hours = td.seconds // 3600,
82
minutes = (td.seconds % 3600) // 60,
83
seconds = td.seconds % 60,
84
))
85
85
86
86
87
87
def rfc3339_duration_to_delta(duration):
88
88
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
89
89
90
90
>>> rfc3339_duration_to_delta("P7D")
91
91
datetime.timedelta(7)
92
92
>>> rfc3339_duration_to_delta("PT60S")
93
93
datetime.timedelta(0, 60)
94
94
>>> rfc3339_duration_to_delta("PT60M")
95
95
datetime.timedelta(0, 3600)
96
>>> rfc3339_duration_to_delta("P60M")
97
datetime.timedelta(1680)
98
96
>>> rfc3339_duration_to_delta("PT24H")
99
97
datetime.timedelta(1)
100
98
>>> rfc3339_duration_to_delta("P1W")
103
101
datetime.timedelta(0, 330)
104
102
>>> rfc3339_duration_to_delta("P1DT3M20S")
105
103
datetime.timedelta(1, 200)
106
>>> # Can not be empty:
107
>>> rfc3339_duration_to_delta("")
108
Traceback (most recent call last):
109
...
110
ValueError: Invalid RFC 3339 duration: u''
111
>>> # Must start with "P":
112
>>> rfc3339_duration_to_delta("1D")
113
Traceback (most recent call last):
114
...
115
ValueError: Invalid RFC 3339 duration: u'1D'
116
>>> # Must use correct order
117
>>> rfc3339_duration_to_delta("PT1S2M")
118
Traceback (most recent call last):
119
...
120
ValueError: Invalid RFC 3339 duration: u'PT1S2M'
121
>>> # Time needs time marker
122
>>> rfc3339_duration_to_delta("P1H2S")
123
Traceback (most recent call last):
124
...
125
ValueError: Invalid RFC 3339 duration: u'P1H2S'
126
>>> # Weeks can not be combined with anything else
127
>>> rfc3339_duration_to_delta("P1D2W")
128
Traceback (most recent call last):
129
...
130
ValueError: Invalid RFC 3339 duration: u'P1D2W'
131
>>> rfc3339_duration_to_delta("P2W2H")
132
Traceback (most recent call last):
133
...
134
ValueError: Invalid RFC 3339 duration: u'P2W2H'
135
104
"""
136
105
137
106
# Parsing an RFC 3339 duration with regular expressions is not
138
107
# possible - there would have to be multiple places for the same
139
108
# values, like seconds. The current code, while more esoteric, is
140
109
# cleaner without depending on a parsing library. If Python had a
141
110
# built-in library for parsing we would use it, but we'd like to
142
111
# avoid excessive use of external libraries.
143
112
144
113
# New type for defining tokens, syntax, and semantics all-in-one
145
Token = collections.namedtuple("Token", (
146
"regexp", # To match token; if "value" is not None, must have
147
# a "group" containing digits
148
"value", # datetime.timedelta or None
149
"followers")) # Tokens valid after this token
114
Token = collections.namedtuple("Token",
115
("regexp", # To match token; if
116
# "value" is not None,
117
# must have a "group"
118
# containing digits
119
"value", # datetime.timedelta or
120
# None
121
"followers")) # Tokens valid after
122
# this token
150
123
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
151
124
# the "duration" ABNF definition in RFC 3339, Appendix A.
152
125
token_end = Token(re.compile(r"$"), None, frozenset())
153
126
token_second = Token(re.compile(r"(\d+)S"),
154
127
datetime.timedelta(seconds=1),
155
frozenset((token_end, )))
128
frozenset((token_end,)))
156
129
token_minute = Token(re.compile(r"(\d+)M"),
157
130
datetime.timedelta(minutes=1),
158
131
frozenset((token_second, token_end)))
174
147
frozenset((token_month, token_end)))
175
148
token_week = Token(re.compile(r"(\d+)W"),
176
149
datetime.timedelta(weeks=1),
177
frozenset((token_end, )))
150
frozenset((token_end,)))
178
151
token_duration = Token(re.compile(r"P"), None,
179
152
frozenset((token_year, token_month,
180
153
token_day, token_time,
181
token_week)))
182
# Define starting values:
183
# Value so far
184
value = datetime.timedelta()
154
token_week))),
155
# Define starting values
156
value = datetime.timedelta() # Value so far
185
157
found_token = None
186
# Following valid tokens
187
followers = frozenset((token_duration, ))
188
# String left to parse
189
s = duration
158
followers = frozenset(token_duration,) # Following valid tokens
159
s = duration # String left to parse
190
160
# Loop until end token is found
191
161
while found_token is not token_end:
192
162
# Search for any currently valid tokens
208
178
break
209
179
else:
210
180
# No currently valid tokens were found
211
raise ValueError("Invalid RFC 3339 duration: {!r}"
212
.format(duration))
181
raise ValueError("Invalid RFC 3339 duration")
213
182
# End token found
214
183
return value
215
184
216
185
217
186
def string_to_delta(interval):
218
"""Parse a string and return a datetime.timedelta"""
219
187
"""Parse a string and return a datetime.timedelta
188
189
>>> string_to_delta("7d")
190
datetime.timedelta(7)
191
>>> string_to_delta("60s")
192
datetime.timedelta(0, 60)
193
>>> string_to_delta("60m")
194
datetime.timedelta(0, 3600)
195
>>> string_to_delta("24h")
196
datetime.timedelta(1)
197
>>> string_to_delta("1w")
198
datetime.timedelta(7)
199
>>> string_to_delta("5m 30s")
200
datetime.timedelta(0, 330)
201
"""
202
220
203
try:
221
204
return rfc3339_duration_to_delta(interval)
222
except ValueError as e:
223
log.warning("%s - Parsing as pre-1.6.1 interval instead",
224
' '.join(e.args))
225
return parse_pre_1_6_1_interval(interval)
226
227
228
def parse_pre_1_6_1_interval(interval):
229
"""Parse an interval string as documented by Mandos before 1.6.1,
230
and return a datetime.timedelta
231
232
>>> parse_pre_1_6_1_interval('7d')
233
datetime.timedelta(7)
234
>>> parse_pre_1_6_1_interval('60s')
235
datetime.timedelta(0, 60)
236
>>> parse_pre_1_6_1_interval('60m')
237
datetime.timedelta(0, 3600)
238
>>> parse_pre_1_6_1_interval('24h')
239
datetime.timedelta(1)
240
>>> parse_pre_1_6_1_interval('1w')
241
datetime.timedelta(7)
242
>>> parse_pre_1_6_1_interval('5m 30s')
243
datetime.timedelta(0, 330)
244
>>> parse_pre_1_6_1_interval('')
245
datetime.timedelta(0)
246
>>> # Ignore unknown characters, allow any order and repetitions
247
>>> parse_pre_1_6_1_interval('2dxy7zz11y3m5m')
248
datetime.timedelta(2, 480, 18000)
249
250
"""
251
205
except ValueError:
206
pass
207
252
208
value = datetime.timedelta(0)
253
209
regexp = re.compile(r"(\d+)([dsmhw]?)")
254
210
255
211
for num, suffix in regexp.findall(interval):
256
212
if suffix == "d":
257
213
value += datetime.timedelta(int(num))
267
223
value += datetime.timedelta(0, 0, 0, int(num))
268
224
return value
269
225
270
271
## Classes for commands.
272
273
# Abstract classes first
274
class Command(object):
275
"""Abstract class for commands"""
276
def run(self, mandos, clients):
277
"""Normal commands should implement run_on_one_client(), but
278
commands which want to operate on all clients at the same time
279
can override this run() method instead."""
280
self.mandos = mandos
281
for client in clients:
282
self.run_on_one_client(client)
283
284
class PrintCmd(Command):
285
"""Abstract class for commands printing client details"""
286
all_keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
287
"Created", "Interval", "Host", "KeyID",
288
"Fingerprint", "CheckerRunning", "LastEnabled",
289
"ApprovalPending", "ApprovedByDefault",
290
"LastApprovalRequest", "ApprovalDelay",
291
"ApprovalDuration", "Checker", "ExtendedTimeout",
292
"Expires", "LastCheckerStatus")
293
def run(self, mandos, clients):
294
print(self.output(clients))
295
296
class PropertyCmd(Command):
297
"""Abstract class for Actions for setting one client property"""
298
def run_on_one_client(self, client):
299
"""Set the Client's D-Bus property"""
300
client.Set(client_interface, self.property, self.value_to_set,
301
dbus_interface=dbus.PROPERTIES_IFACE)
302
303
class ValueArgumentMixIn(object):
304
"""Mixin class for commands taking a value as argument"""
305
def __init__(self, value):
306
self.value_to_set = value
307
308
class MillisecondsValueArgumentMixIn(ValueArgumentMixIn):
309
"""Mixin class for commands taking a value argument as
310
milliseconds."""
311
@property
312
def value_to_set(self):
313
return self._vts
314
@value_to_set.setter
315
def value_to_set(self, value):
316
"""When setting, convert value to a datetime.timedelta"""
317
self._vts = string_to_delta(value).total_seconds() * 1000
318
319
# Actual (non-abstract) command classes
320
321
class PrintTableCmd(PrintCmd):
322
def __init__(self, verbose=False):
323
self.verbose = verbose
324
325
def output(self, clients):
326
if self.verbose:
327
keywords = self.all_keywords
328
else:
329
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
330
return str(self.TableOfClients(clients.values(), keywords))
331
332
class TableOfClients(object):
333
tableheaders = {
334
"Name": "Name",
335
"Enabled": "Enabled",
336
"Timeout": "Timeout",
337
"LastCheckedOK": "Last Successful Check",
338
"LastApprovalRequest": "Last Approval Request",
339
"Created": "Created",
340
"Interval": "Interval",
341
"Host": "Host",
342
"Fingerprint": "Fingerprint",
343
"KeyID": "Key ID",
344
"CheckerRunning": "Check Is Running",
345
"LastEnabled": "Last Enabled",
346
"ApprovalPending": "Approval Is Pending",
347
"ApprovedByDefault": "Approved By Default",
348
"ApprovalDelay": "Approval Delay",
349
"ApprovalDuration": "Approval Duration",
350
"Checker": "Checker",
351
"ExtendedTimeout": "Extended Timeout",
352
"Expires": "Expires",
353
"LastCheckerStatus": "Last Checker Status",
354
}
355
356
def __init__(self, clients, keywords, tableheaders=None):
357
self.clients = clients
358
self.keywords = keywords
359
if tableheaders is not None:
360
self.tableheaders = tableheaders
361
362
def __str__(self):
363
return "\n".join(self.rows())
364
365
if sys.version_info.major == 2:
366
__unicode__ = __str__
367
def __str__(self):
368
return str(self).encode(locale.getpreferredencoding())
369
370
def rows(self):
371
format_string = self.row_formatting_string()
372
rows = [self.header_line(format_string)]
373
rows.extend(self.client_line(client, format_string)
374
for client in self.clients)
375
return rows
376
377
def row_formatting_string(self):
378
"Format string used to format table rows"
379
return " ".join("{{{key}:{width}}}".format(
380
width=max(len(self.tableheaders[key]),
381
*(len(self.string_from_client(client, key))
382
for client in self.clients)),
383
key=key)
384
for key in self.keywords)
385
386
def string_from_client(self, client, key):
387
return self.valuetostring(client[key], key)
388
389
@staticmethod
390
def valuetostring(value, keyword):
391
if isinstance(value, dbus.Boolean):
392
return "Yes" if value else "No"
393
if keyword in ("Timeout", "Interval", "ApprovalDelay",
394
"ApprovalDuration", "ExtendedTimeout"):
395
return milliseconds_to_string(value)
396
return str(value)
397
398
def header_line(self, format_string):
399
return format_string.format(**self.tableheaders)
400
401
def client_line(self, client, format_string):
402
return format_string.format(
403
**{key: self.string_from_client(client, key)
404
for key in self.keywords})
405
406
407
408
class DumpJSONCmd(PrintCmd):
409
def output(self, clients):
410
data = {client["Name"]:
411
{key: self.dbus_boolean_to_bool(client[key])
412
for key in self.all_keywords}
413
for client in clients.values()}
414
return json.dumps(data, indent=4, separators=(',', ': '))
415
@staticmethod
416
def dbus_boolean_to_bool(value):
417
if isinstance(value, dbus.Boolean):
418
value = bool(value)
419
return value
420
421
class IsEnabledCmd(Command):
422
def run_on_one_client(self, client):
423
if self.is_enabled(client):
424
sys.exit(0)
425
sys.exit(1)
426
def is_enabled(self, client):
427
return client.Get(client_interface, "Enabled",
428
dbus_interface=dbus.PROPERTIES_IFACE)
429
430
class RemoveCmd(Command):
431
def run_on_one_client(self, client):
432
self.mandos.RemoveClient(client.__dbus_object_path__)
433
434
class ApproveCmd(Command):
435
def run_on_one_client(self, client):
436
client.Approve(dbus.Boolean(True),
437
dbus_interface=client_interface)
438
439
class DenyCmd(Command):
440
def run_on_one_client(self, client):
441
client.Approve(dbus.Boolean(False),
442
dbus_interface=client_interface)
443
444
class EnableCmd(PropertyCmd):
445
property = "Enabled"
446
value_to_set = dbus.Boolean(True)
447
448
class DisableCmd(PropertyCmd):
449
property = "Enabled"
450
value_to_set = dbus.Boolean(False)
451
452
class BumpTimeoutCmd(PropertyCmd):
453
property = "LastCheckedOK"
454
value_to_set = ""
455
456
class StartCheckerCmd(PropertyCmd):
457
property = "CheckerRunning"
458
value_to_set = dbus.Boolean(True)
459
460
class StopCheckerCmd(PropertyCmd):
461
property = "CheckerRunning"
462
value_to_set = dbus.Boolean(False)
463
464
class ApproveByDefaultCmd(PropertyCmd):
465
property = "ApprovedByDefault"
466
value_to_set = dbus.Boolean(True)
467
468
class DenyByDefaultCmd(PropertyCmd):
469
property = "ApprovedByDefault"
470
value_to_set = dbus.Boolean(False)
471
472
class SetCheckerCmd(PropertyCmd, ValueArgumentMixIn):
473
property = "Checker"
474
475
class SetHostCmd(PropertyCmd, ValueArgumentMixIn):
476
property = "Host"
477
478
class SetSecretCmd(PropertyCmd, ValueArgumentMixIn):
479
property = "Secret"
480
481
class SetTimeoutCmd(PropertyCmd, MillisecondsValueArgumentMixIn):
482
property = "Timeout"
483
484
class SetExtendedTimeoutCmd(PropertyCmd,
485
MillisecondsValueArgumentMixIn):
486
property = "ExtendedTimeout"
487
488
class SetIntervalCmd(PropertyCmd, MillisecondsValueArgumentMixIn):
489
property = "Interval"
490
491
class SetApprovalDelayCmd(PropertyCmd,
492
MillisecondsValueArgumentMixIn):
493
property = "ApprovalDelay"
494
495
class SetApprovalDurationCmd(PropertyCmd,
496
MillisecondsValueArgumentMixIn):
497
property = "ApprovalDuration"
226
def print_clients(clients, keywords):
227
def valuetostring(value, keyword):
228
if type(value) is dbus.Boolean:
229
return "Yes" if value else "No"
230
if keyword in ("Timeout", "Interval", "ApprovalDelay",
231
"ApprovalDuration", "ExtendedTimeout"):
232
return milliseconds_to_string(value)
233
return unicode(value)
234
235
# Create format string to print table rows
236
format_string = " ".join("{{{key}:{width}}}".format(
237
width = max(len(tablewords[key]),
238
max(len(valuetostring(client[key],
239
key))
240
for client in
241
clients)),
242
key = key) for key in keywords)
243
# Print header line
244
print(format_string.format(**tablewords))
245
for client in clients:
246
print(format_string.format(**dict((key,
247
valuetostring(client[key],
248
key))
249
for key in keywords)))
498
250
499
251
def has_actions(options):
500
252
return any((options.enable,
516
268
options.approve,
517
269
options.deny))
518
270
519
520
def commands_and_clients_from_options(args=None):
521
if args is None:
522
args=sys.argv[1:]
271
def main():
523
272
parser = argparse.ArgumentParser()
524
273
parser.add_argument("--version", action="version",
525
version="%(prog)s {}".format(version),
274
version = "%(prog)s {0}".format(version),
526
275
help="show version number and exit")
527
276
parser.add_argument("-a", "--all", action="store_true",
528
277
help="Select all clients")
529
278
parser.add_argument("-v", "--verbose", action="store_true",
530
279
help="Print all fields")
531
parser.add_argument("-j", "--dump-json", action="store_true",
532
help="Dump client data in JSON format")
533
enable_disable = parser.add_mutually_exclusive_group()
534
enable_disable.add_argument("-e", "--enable", action="store_true",
535
help="Enable client")
536
enable_disable.add_argument("-d", "--disable",
537
action="store_true",
538
help="disable client")
280
parser.add_argument("-e", "--enable", action="store_true",
281
help="Enable client")
282
parser.add_argument("-d", "--disable", action="store_true",
283
help="disable client")
539
284
parser.add_argument("-b", "--bump-timeout", action="store_true",
540
285
help="Bump timeout for client")
541
start_stop_checker = parser.add_mutually_exclusive_group()
542
start_stop_checker.add_argument("--start-checker",
543
action="store_true",
544
help="Start checker for client")
545
start_stop_checker.add_argument("--stop-checker",
546
action="store_true",
547
help="Stop checker for client")
286
parser.add_argument("--start-checker", action="store_true",
287
help="Start checker for client")
288
parser.add_argument("--stop-checker", action="store_true",
289
help="Stop checker for client")
548
290
parser.add_argument("-V", "--is-enabled", action="store_true",
549
291
help="Check if client is enabled")
550
292
parser.add_argument("-r", "--remove", action="store_true",
557
299
help="Set extended timeout for client")
558
300
parser.add_argument("-i", "--interval",
559
301
help="Set checker interval for client")
560
approve_deny_default = parser.add_mutually_exclusive_group()
561
approve_deny_default.add_argument(
562
"--approve-by-default", action="store_true",
563
default=None, dest="approved_by_default",
564
help="Set client to be approved by default")
565
approve_deny_default.add_argument(
566
"--deny-by-default", action="store_false",
567
dest="approved_by_default",
568
help="Set client to be denied by default")
302
parser.add_argument("--approve-by-default", action="store_true",
303
default=None, dest="approved_by_default",
304
help="Set client to be approved by default")
305
parser.add_argument("--deny-by-default", action="store_false",
306
dest="approved_by_default",
307
help="Set client to be denied by default")
569
308
parser.add_argument("--approval-delay",
570
309
help="Set delay before client approve/deny")
571
310
parser.add_argument("--approval-duration",
572
311
help="Set duration of one client approval")
573
312
parser.add_argument("-H", "--host", help="Set host for client")
574
parser.add_argument("-s", "--secret",
575
type=argparse.FileType(mode="rb"),
313
parser.add_argument("-s", "--secret", type=file,
576
314
help="Set password blob (file) for client")
577
approve_deny = parser.add_mutually_exclusive_group()
578
approve_deny.add_argument(
579
"-A", "--approve", action="store_true",
580
help="Approve any current client request")
581
approve_deny.add_argument("-D", "--deny", action="store_true",
582
help="Deny any current client request")
315
parser.add_argument("-A", "--approve", action="store_true",
316
help="Approve any current client request")
317
parser.add_argument("-D", "--deny", action="store_true",
318
help="Deny any current client request")
583
319
parser.add_argument("--check", action="store_true",
584
320
help="Run self-test")
585
321
parser.add_argument("client", nargs="*", help="Client name")
586
options = parser.parse_args(args=args)
587
322
options = parser.parse_args()
323
588
324
if has_actions(options) and not (options.client or options.all):
589
325
parser.error("Options require clients names or --all.")
590
326
if options.verbose and has_actions(options):
591
parser.error("--verbose can only be used alone.")
592
if options.dump_json and (options.verbose
593
or has_actions(options)):
594
parser.error("--dump-json can only be used alone.")
327
parser.error("--verbose can only be used alone or with"
328
" --all.")
595
329
if options.all and not has_actions(options):
596
330
parser.error("--all requires an action.")
597
if options.is_enabled and len(options.client) > 1:
598
parser.error("--is-enabled requires exactly one client")
599
600
commands = []
601
602
if options.dump_json:
603
commands.append(DumpJSONCmd())
604
605
if options.enable:
606
commands.append(EnableCmd())
607
608
if options.disable:
609
commands.append(DisableCmd())
610
611
if options.bump_timeout:
612
commands.append(BumpTimeoutCmd(options.bump_timeout))
613
614
if options.start_checker:
615
commands.append(StartCheckerCmd())
616
617
if options.stop_checker:
618
commands.append(StopCheckerCmd())
619
620
if options.is_enabled:
621
commands.append(IsEnabledCmd())
622
623
if options.remove:
624
commands.append(RemoveCmd())
625
626
if options.checker is not None:
627
commands.append(SetCheckerCmd())
628
629
if options.timeout is not None:
630
commands.append(SetTimeoutCmd(options.timeout))
631
632
if options.extended_timeout:
633
commands.append(
634
SetExtendedTimeoutCmd(options.extended_timeout))
635
636
if options.interval is not None:
637
command.append(SetIntervalCmd(options.interval))
638
639
if options.approved_by_default is not None:
640
if options.approved_by_default:
641
command.append(ApproveByDefaultCmd())
642
else:
643
command.append(DenyByDefaultCmd())
644
645
if options.approval_delay is not None:
646
command.append(SetApprovalDelayCmd(options.approval_delay))
647
648
if options.approval_duration is not None:
649
command.append(
650
SetApprovalDurationCmd(options.approval_duration))
651
652
if options.host is not None:
653
command.append(SetHostCmd(options.host))
654
655
if options.secret is not None:
656
command.append(SetSecretCmd(options.secret))
657
658
if options.approve:
659
commands.append(ApproveCmd())
660
661
if options.deny:
662
commands.append(DenyCmd())
663
664
# If no command option has been given, show table of clients,
665
# optionally verbosely
666
if not commands:
667
commands.append(PrintTableCmd(verbose=options.verbose))
668
669
return commands, options.client
670
671
672
def main():
673
commands, clientnames = commands_and_clients_from_options()
674
331
332
if options.check:
333
fail_count, test_count = doctest.testmod()
334
sys.exit(0 if fail_count == 0 else 1)
335
675
336
try:
676
337
bus = dbus.SystemBus()
677
338
mandos_dbus_objc = bus.get_object(busname, server_path)
678
339
except dbus.exceptions.DBusException:
679
log.critical("Could not connect to Mandos server")
340
print("Could not connect to Mandos server",
341
file=sys.stderr)
680
342
sys.exit(1)
681
343
682
344
mandos_serv = dbus.Interface(mandos_dbus_objc,
683
dbus_interface=server_interface)
684
mandos_serv_object_manager = dbus.Interface(
685
mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)
686
687
# Filter out log message from dbus module
688
dbus_logger = logging.getLogger("dbus.proxies")
689
class NullFilter(logging.Filter):
690
def filter(self, record):
691
return False
692
dbus_filter = NullFilter()
693
dbus_logger.addFilter(dbus_filter)
345
dbus_interface = server_interface)
346
347
#block stderr since dbus library prints to stderr
348
null = os.open(os.path.devnull, os.O_RDWR)
349
stderrcopy = os.dup(sys.stderr.fileno())
350
os.dup2(null, sys.stderr.fileno())
351
os.close(null)
694
352
try:
695
353
try:
696
mandos_clients = {path: ifs_and_props[client_interface]
697
for path, ifs_and_props in
698
mandos_serv_object_manager
699
.GetManagedObjects().items()
700
if client_interface in ifs_and_props}
354
mandos_clients = mandos_serv.GetAllClientsWithProperties()
701
355
finally:
702
# restore dbus logger
703
dbus_logger.removeFilter(dbus_filter)
704
except dbus.exceptions.DBusException as e:
705
log.critical("Failed to access Mandos server through D-Bus:"
706
"\n%s", e)
356
#restore stderr
357
os.dup2(stderrcopy, sys.stderr.fileno())
358
os.close(stderrcopy)
359
except dbus.exceptions.DBusException:
360
print("Access denied: Accessing mandos server through dbus.",
361
file=sys.stderr)
707
362
sys.exit(1)
708
363
709
364
# Compile dict of (clients: properties) to process
710
clients = {}
711
712
if not clientnames:
713
clients = {bus.get_object(busname, path): properties
714
for path, properties in mandos_clients.items()}
365
clients={}
366
367
if options.all or not options.client:
368
clients = dict((bus.get_object(busname, path), properties)
369
for path, properties in
370
mandos_clients.iteritems())
715
371
else:
716
for name in clientnames:
717
for path, client in mandos_clients.items():
372
for name in options.client:
373
for path, client in mandos_clients.iteritems():
718
374
if client["Name"] == name:
719
375
client_objc = bus.get_object(busname, path)
720
376
clients[client_objc] = client
721
377
break
722
378
else:
723
log.critical("Client not found on server: %r", name)
379
print("Client not found on server: {0!r}"
380
.format(name), file=sys.stderr)
724
381
sys.exit(1)
725
726
# Run all commands on clients
727
for command in commands:
728
command.run(mandos_serv, clients)
729
730
731
class Test_milliseconds_to_string(unittest.TestCase):
732
def test_all(self):
733
self.assertEqual(milliseconds_to_string(93785000),
734
"1T02:03:05")
735
def test_no_days(self):
736
self.assertEqual(milliseconds_to_string(7385000), "02:03:05")
737
def test_all_zero(self):
738
self.assertEqual(milliseconds_to_string(0), "00:00:00")
739
def test_no_fractional_seconds(self):
740
self.assertEqual(milliseconds_to_string(400), "00:00:00")
741
self.assertEqual(milliseconds_to_string(900), "00:00:00")
742
self.assertEqual(milliseconds_to_string(1900), "00:00:01")
743
744
class Test_string_to_delta(unittest.TestCase):
745
def test_handles_basic_rfc3339(self):
746
self.assertEqual(string_to_delta("PT2H"),
747
datetime.timedelta(0, 7200))
748
def test_falls_back_to_pre_1_6_1_with_warning(self):
749
# assertLogs only exists in Python 3.4
750
if hasattr(self, "assertLogs"):
751
with self.assertLogs(log, logging.WARNING):
752
value = string_to_delta("2h")
382
383
if not has_actions(options) and clients:
384
if options.verbose:
385
keywords = ("Name", "Enabled", "Timeout",
386
"LastCheckedOK", "Created", "Interval",
387
"Host", "Fingerprint", "CheckerRunning",
388
"LastEnabled", "ApprovalPending",
389
"ApprovedByDefault",
390
"LastApprovalRequest", "ApprovalDelay",
391
"ApprovalDuration", "Checker",
392
"ExtendedTimeout")
753
393
else:
754
class WarningFilter(logging.Filter):
755
"""Don't show, but record the presence of, warnings"""
756
def filter(self, record):
757
is_warning = record.levelno >= logging.WARNING
758
self.found = is_warning or getattr(self, "found",
759
False)
760
return not is_warning
761
warning_filter = WarningFilter()
762
log.addFilter(warning_filter)
763
try:
764
value = string_to_delta("2h")
765
finally:
766
log.removeFilter(warning_filter)
767
self.assertTrue(getattr(warning_filter, "found", False))
768
self.assertEqual(value, datetime.timedelta(0, 7200))
769
770
771
class TestCmd(unittest.TestCase):
772
"""Abstract class for tests of command classes"""
773
def setUp(self):
774
testcase = self
775
class MockClient(object):
776
def __init__(self, name, **attributes):
777
self.__dbus_object_path__ = "objpath_{}".format(name)
778
self.attributes = attributes
779
self.attributes["Name"] = name
780
def Set(interface, property, value,
781
properties_interface):
782
testcase.assertEqual(interface, client_interface)
783
testcase.assertEqual(properties_interface,
784
dbus.PROPERTIES_IFACE)
785
self.attributes[property] = value
786
def Get(interface, property, properties_interface):
787
testcase.assertEqual(interface, client_interface)
788
testcase.assertEqual(properties_interface,
789
dbus.PROPERTIES_IFACE)
790
return self.attributes[property]
791
def __getitem__(self, key):
792
return self.attributes[key]
793
self.clients = collections.OrderedDict([
794
("foo",
795
MockClient(
796
"foo",
797
KeyID=("92ed150794387c03ce684574b1139a65"
798
"94a34f895daaaf09fd8ea90a27cddb12"),
799
Secret=b"secret",
800
Host="foo.example.org",
801
Enabled=dbus.Boolean(True),
802
Timeout=300000,
803
LastCheckedOK="2019-02-03T00:00:00",
804
Created="2019-01-02T00:00:00",
805
Interval=120000,
806
Fingerprint=("778827225BA7DE539C5A"
807
"7CFA59CFF7CDBD9A5920"),
808
CheckerRunning=dbus.Boolean(False),
809
LastEnabled="2019-01-03T00:00:00",
810
ApprovalPending=dbus.Boolean(False),
811
ApprovedByDefault=dbus.Boolean(True),
812
LastApprovalRequest="",
813
ApprovalDelay=0,
814
ApprovalDuration=1000,
815
Checker="fping -q -- %(host)s",
816
ExtendedTimeout=900000,
817
Expires="2019-02-04T00:00:00",
818
LastCheckerStatus=0)),
819
("barbar",
820
MockClient(
821
"barbar",
822
KeyID=("0558568eedd67d622f5c83b35a115f79"
823
"6ab612cff5ad227247e46c2b020f441c"),
824
Secret=b"secretbar",
825
Host="192.0.2.3",
826
Enabled=dbus.Boolean(True),
827
Timeout=300000,
828
LastCheckedOK="2019-02-04T00:00:00",
829
Created="2019-01-03T00:00:00",
830
Interval=120000,
831
Fingerprint=("3E393AEAEFB84C7E89E2"
832
"F547B3A107558FCA3A27"),
833
CheckerRunning=dbus.Boolean(True),
834
LastEnabled="2019-01-04T00:00:00",
835
ApprovalPending=dbus.Boolean(False),
836
ApprovedByDefault=dbus.Boolean(False),
837
LastApprovalRequest="2019-01-03T00:00:00",
838
ApprovalDelay=30000,
839
ApprovalDuration=1000,
840
Checker=":",
841
ExtendedTimeout=900000,
842
Expires="2019-02-05T00:00:00",
843
LastCheckerStatus=-2)),
844
])
845
846
class TestPrintTableCmd(TestCmd):
847
def test_normal(self):
848
output = PrintTableCmd().output(self.clients)
849
expected_output = """
850
Name Enabled Timeout Last Successful Check
851
foo Yes 00:05:00 2019-02-03T00:00:00
852
barbar Yes 00:05:00 2019-02-04T00:00:00
853
"""[1:-1]
854
self.assertEqual(output, expected_output)
855
def test_verbose(self):
856
output = PrintTableCmd(verbose=True).output(self.clients)
857
expected_output = """
858
Name Enabled Timeout Last Successful Check Created Interval Host Key ID Fingerprint Check Is Running Last Enabled Approval Is Pending Approved By Default Last Approval Request Approval Delay Approval Duration Checker Extended Timeout Expires Last Checker Status
859
foo Yes 00:05:00 2019-02-03T00:00:00 2019-01-02T00:00:00 00:02:00 foo.example.org 92ed150794387c03ce684574b1139a6594a34f895daaaf09fd8ea90a27cddb12 778827225BA7DE539C5A7CFA59CFF7CDBD9A5920 No 2019-01-03T00:00:00 No Yes 00:00:00 00:00:01 fping -q -- %(host)s 00:15:00 2019-02-04T00:00:00 0
860
barbar Yes 00:05:00 2019-02-04T00:00:00 2019-01-03T00:00:00 00:02:00 192.0.2.3 0558568eedd67d622f5c83b35a115f796ab612cff5ad227247e46c2b020f441c 3E393AEAEFB84C7E89E2F547B3A107558FCA3A27 Yes 2019-01-04T00:00:00 No No 2019-01-03T00:00:00 00:00:30 00:00:01 : 00:15:00 2019-02-05T00:00:00 -2
861
"""[1:-1]
862
self.assertEqual(output, expected_output)
863
def test_one_client(self):
864
output = PrintTableCmd().output({"foo": self.clients["foo"]})
865
expected_output = """
866
Name Enabled Timeout Last Successful Check
867
foo Yes 00:05:00 2019-02-03T00:00:00
868
"""[1:-1]
869
self.assertEqual(output, expected_output)
870
871
class TestDumpJSONCmd(TestCmd):
872
def setUp(self):
873
self.expected_json = {
874
"foo": {
875
"Name": "foo",
876
"KeyID": ("92ed150794387c03ce684574b1139a65"
877
"94a34f895daaaf09fd8ea90a27cddb12"),
878
"Host": "foo.example.org",
879
"Enabled": True,
880
"Timeout": 300000,
881
"LastCheckedOK": "2019-02-03T00:00:00",
882
"Created": "2019-01-02T00:00:00",
883
"Interval": 120000,
884
"Fingerprint": ("778827225BA7DE539C5A"
885
"7CFA59CFF7CDBD9A5920"),
886
"CheckerRunning": False,
887
"LastEnabled": "2019-01-03T00:00:00",
888
"ApprovalPending": False,
889
"ApprovedByDefault": True,
890
"LastApprovalRequest": "",
891
"ApprovalDelay": 0,
892
"ApprovalDuration": 1000,
893
"Checker": "fping -q -- %(host)s",
894
"ExtendedTimeout": 900000,
895
"Expires": "2019-02-04T00:00:00",
896
"LastCheckerStatus": 0,
897
},
898
"barbar": {
899
"Name": "barbar",
900
"KeyID": ("0558568eedd67d622f5c83b35a115f79"
901
"6ab612cff5ad227247e46c2b020f441c"),
902
"Host": "192.0.2.3",
903
"Enabled": True,
904
"Timeout": 300000,
905
"LastCheckedOK": "2019-02-04T00:00:00",
906
"Created": "2019-01-03T00:00:00",
907
"Interval": 120000,
908
"Fingerprint": ("3E393AEAEFB84C7E89E2"
909
"F547B3A107558FCA3A27"),
910
"CheckerRunning": True,
911
"LastEnabled": "2019-01-04T00:00:00",
912
"ApprovalPending": False,
913
"ApprovedByDefault": False,
914
"LastApprovalRequest": "2019-01-03T00:00:00",
915
"ApprovalDelay": 30000,
916
"ApprovalDuration": 1000,
917
"Checker": ":",
918
"ExtendedTimeout": 900000,
919
"Expires": "2019-02-05T00:00:00",
920
"LastCheckerStatus": -2,
921
},
922
}
923
return super(TestDumpJSONCmd, self).setUp()
924
def test_normal(self):
925
json_data = json.loads(DumpJSONCmd().output(self.clients))
926
self.assertDictEqual(json_data, self.expected_json)
927
def test_one_client(self):
928
clients = {"foo": self.clients["foo"]}
929
json_data = json.loads(DumpJSONCmd().output(clients))
930
expected_json = {"foo": self.expected_json["foo"]}
931
self.assertDictEqual(json_data, expected_json)
932
933
934
def should_only_run_tests():
935
parser = argparse.ArgumentParser(add_help=False)
936
parser.add_argument("--check", action='store_true')
937
args, unknown_args = parser.parse_known_args()
938
run_tests = args.check
939
if run_tests:
940
# Remove --check argument from sys.argv
941
sys.argv[1:] = unknown_args
942
return run_tests
943
944
# Add all tests from doctest strings
945
def load_tests(loader, tests, none):
946
import doctest
947
tests.addTests(doctest.DocTestSuite())
948
return tests
394
keywords = defaultkeywords
395
396
print_clients(clients.values(), keywords)
397
else:
398
# Process each client in the list by all selected options
399
for client in clients:
400
def set_client_prop(prop, value):
401
"""Set a Client D-Bus property"""
402
client.Set(client_interface, prop, value,
403
dbus_interface=dbus.PROPERTIES_IFACE)
404
def set_client_prop_ms(prop, value):
405
"""Set a Client D-Bus property, converted
406
from a string to milliseconds."""
407
set_client_prop(prop,
408
timedelta_to_milliseconds
409
(string_to_delta(value)))
410
if options.remove:
411
mandos_serv.RemoveClient(client.__dbus_object_path__)
412
if options.enable:
413
set_client_prop("Enabled", dbus.Boolean(True))
414
if options.disable:
415
set_client_prop("Enabled", dbus.Boolean(False))
416
if options.bump_timeout:
417
set_client_prop("LastCheckedOK", "")
418
if options.start_checker:
419
set_client_prop("CheckerRunning", dbus.Boolean(True))
420
if options.stop_checker:
421
set_client_prop("CheckerRunning", dbus.Boolean(False))
422
if options.is_enabled:
423
sys.exit(0 if client.Get(client_interface,
424
"Enabled",
425
dbus_interface=
426
dbus.PROPERTIES_IFACE)
427
else 1)
428
if options.checker is not None:
429
set_client_prop("Checker", options.checker)
430
if options.host is not None:
431
set_client_prop("Host", options.host)
432
if options.interval is not None:
433
set_client_prop_ms("Interval", options.interval)
434
if options.approval_delay is not None:
435
set_client_prop_ms("ApprovalDelay",
436
options.approval_delay)
437
if options.approval_duration is not None:
438
set_client_prop_ms("ApprovalDuration",
439
options.approval_duration)
440
if options.timeout is not None:
441
set_client_prop_ms("Timeout", options.timeout)
442
if options.extended_timeout is not None:
443
set_client_prop_ms("ExtendedTimeout",
444
options.extended_timeout)
445
if options.secret is not None:
446
set_client_prop("Secret",
447
dbus.ByteArray(options.secret.read()))
448
if options.approved_by_default is not None:
449
set_client_prop("ApprovedByDefault",
450
dbus.Boolean(options
451
.approved_by_default))
452
if options.approve:
453
client.Approve(dbus.Boolean(True),
454
dbus_interface=client_interface)
455
elif options.deny:
456
client.Approve(dbus.Boolean(False),
457
dbus_interface=client_interface)
949
458
950
459
if __name__ == "__main__":
951
if should_only_run_tests():
952
# Call using ./tdd-python-script --check [--verbose]
953
unittest.main()
954
else:
955
main()
460
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0