To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos-monitor
- browse files at revision 731
- compare with another revision
- download diff
- download tarball
- view history from revision 731
- Committer: Teddy Hogeborn
- Date: 2014-08-09 23:37:07 UTC
- Revision ID: teddy@recompile.se-20140809233707-6c5qyievp78lnzf1
askpass-fifo: Lower privileges after opening FIFO.
* plugins.d/askpass-fifo.c (main): Lower privileges after opening FIFO.
* plugins.d/askpass-fifo.c (main): Lower privileges after opening FIFO.
- files added:
- debian/mandos-client.examples
- debian/upstream
- files modified:
- .bzrignore
added
removed
mandos-monitor
3
3
#
4
4
# Mandos Monitor - Control and monitor the Mandos server
5
5
#
6
# Copyright © 2009-2011 Teddy Hogeborn
7
# Copyright © 2009-2011 Björn Påhlsson
6
# Copyright © 2009-2014 Teddy Hogeborn
7
# Copyright © 2009-2014 Björn Påhlsson
8
8
#
9
9
# This program is free software: you can redistribute it and/or modify
10
10
# it under the terms of the GNU General Public License as published by
17
17
# GNU General Public License for more details.
18
18
#
19
19
# You should have received a copy of the GNU General Public License
20
# along with this program. If not, see <http://www.gnu.org/licenses/>.
20
# along with this program. If not, see
21
# <http://www.gnu.org/licenses/>.
21
22
#
22
23
# Contact the authors at <mandos@recompile.se>.
23
24
#
24
25
25
26
from __future__ import (division, absolute_import, print_function,
26
27
unicode_literals)
28
try:
29
from future_builtins import *
30
except ImportError:
31
pass
27
32
28
33
import sys
29
34
import os
30
import signal
31
35
32
36
import datetime
33
37
35
39
import urwid
36
40
37
41
from dbus.mainloop.glib import DBusGMainLoop
38
import gobject
42
try:
43
import gobject
44
except ImportError:
45
from gi.repository import GObject as gobject
39
46
40
47
import dbus
41
48
42
import UserList
43
44
49
import locale
45
50
51
if sys.version_info.major == 2:
52
str = unicode
53
46
54
locale.setlocale(locale.LC_ALL, '')
47
55
48
56
import logging
52
60
domain = 'se.recompile'
53
61
server_interface = domain + '.Mandos'
54
62
client_interface = domain + '.Mandos.Client'
55
version = "1.4.1"
56
57
# Always run in monochrome mode
58
urwid.curses_display.curses.has_colors = lambda : False
59
60
# Urwid doesn't support blinking, but we want it. Since we have no
61
# use for underline on its own, we make underline also always blink.
62
urwid.curses_display.curses.A_UNDERLINE |= (
63
urwid.curses_display.curses.A_BLINK)
63
version = "1.6.8"
64
64
65
65
def isoformat_to_datetime(iso):
66
66
"Parse an ISO 8601 date string to a datetime.datetime()"
83
83
properties and calls a hook function when any of them are
84
84
changed.
85
85
"""
86
def __init__(self, proxy_object=None, *args, **kwargs):
86
def __init__(self, proxy_object=None, properties=None, **kwargs):
87
87
self.proxy = proxy_object # Mandos Client proxy object
88
89
self.properties = dict()
88
self.properties = dict() if properties is None else properties
90
89
self.property_changed_match = (
91
90
self.proxy.connect_to_signal("PropertyChanged",
92
self.property_changed,
91
self._property_changed,
93
92
client_interface,
94
93
byte_arrays=True))
95
94
96
self.properties.update(
97
self.proxy.GetAll(client_interface,
98
dbus_interface = dbus.PROPERTIES_IFACE))
99
100
#XXX This breaks good super behaviour
101
# super(MandosClientPropertyCache, self).__init__(
102
# *args, **kwargs)
95
if properties is None:
96
self.properties.update(
97
self.proxy.GetAll(client_interface,
98
dbus_interface
99
= dbus.PROPERTIES_IFACE))
100
101
super(MandosClientPropertyCache, self).__init__(**kwargs)
102
103
def _property_changed(self, property, value):
104
"""Helper which takes positional arguments"""
105
return self.property_changed(property=property, value=value)
103
106
104
107
def property_changed(self, property=None, value=None):
105
108
"""This is called whenever we get a PropertyChanged signal
108
111
# Update properties dict with new value
109
112
self.properties[property] = value
110
113
111
def delete(self, *args, **kwargs):
114
def delete(self):
112
115
self.property_changed_match.remove()
113
super(MandosClientPropertyCache, self).__init__(
114
*args, **kwargs)
115
116
116
117
117
118
class MandosClientWidget(urwid.FlowWidget, MandosClientPropertyCache):
119
120
"""
120
121
121
122
def __init__(self, server_proxy_object=None, update_hook=None,
122
delete_hook=None, logger=None, *args, **kwargs):
123
delete_hook=None, logger=None, **kwargs):
123
124
# Called on update
124
125
self.update_hook = update_hook
125
126
# Called on delete
130
131
self.logger = logger
131
132
132
133
self._update_timer_callback_tag = None
133
self._update_timer_callback_lock = 0
134
self.last_checker_failed = False
135
134
136
135
# The widget shown normally
137
136
self._text_widget = urwid.Text("")
138
137
# The widget shown when we have focus
139
138
self._focus_text_widget = urwid.Text("")
140
super(MandosClientWidget, self).__init__(
141
update_hook=update_hook, delete_hook=delete_hook,
142
*args, **kwargs)
139
super(MandosClientWidget, self).__init__(**kwargs)
143
140
self.update()
144
141
self.opened = False
145
142
146
last_checked_ok = isoformat_to_datetime(self.properties
147
["LastCheckedOK"])
148
if last_checked_ok is None:
149
self.last_checker_failed = True
150
else:
151
self.last_checker_failed = ((datetime.datetime.utcnow()
152
- last_checked_ok)
153
> datetime.timedelta
154
(milliseconds=
155
self.properties
156
["Interval"]))
157
158
if self.last_checker_failed:
159
self.using_timer(True)
160
161
if self.need_approval:
162
self.using_timer(True)
163
164
143
self.match_objects = (
165
144
self.proxy.connect_to_signal("CheckerCompleted",
166
145
self.checker_completed,
182
161
self.rejected,
183
162
client_interface,
184
163
byte_arrays=True))
185
#self.logger('Created client %s' % (self.properties["Name"]))
164
self.logger('Created client {}'
165
.format(self.properties["Name"]), level=0)
186
166
187
def property_changed(self, property=None, value=None):
188
super(self, MandosClientWidget).property_changed(property,
189
value)
190
if property == "ApprovalPending":
191
using_timer(bool(value))
192
193
167
def using_timer(self, flag):
194
168
"""Call this method with True or False when timer should be
195
169
activated or deactivated.
196
170
"""
197
old = self._update_timer_callback_lock
198
if flag:
199
self._update_timer_callback_lock += 1
200
else:
201
self._update_timer_callback_lock -= 1
202
if old == 0 and self._update_timer_callback_lock:
171
if flag and self._update_timer_callback_tag is None:
203
172
# Will update the shown timer value every second
204
173
self._update_timer_callback_tag = (gobject.timeout_add
205
174
(1000,
206
175
self.update_timer))
207
elif old and self._update_timer_callback_lock == 0:
176
elif not (flag or self._update_timer_callback_tag is None):
208
177
gobject.source_remove(self._update_timer_callback_tag)
209
178
self._update_timer_callback_tag = None
210
179
211
180
def checker_completed(self, exitstatus, condition, command):
212
181
if exitstatus == 0:
213
if self.last_checker_failed:
214
self.last_checker_failed = False
215
self.using_timer(False)
216
#self.logger('Checker for client %s (command "%s")'
217
# ' was successful'
218
# % (self.properties["Name"], command))
182
self.logger('Checker for client {} (command "{}")'
183
' succeeded'.format(self.properties["Name"],
184
command), level=0)
219
185
self.update()
220
186
return
221
187
# Checker failed
222
if not self.last_checker_failed:
223
self.last_checker_failed = True
224
self.using_timer(True)
225
188
if os.WIFEXITED(condition):
226
self.logger('Checker for client %s (command "%s")'
227
' failed with exit code %s'
228
% (self.properties["Name"], command,
229
os.WEXITSTATUS(condition)))
189
self.logger('Checker for client {} (command "{}") failed'
190
' with exit code {}'
191
.format(self.properties["Name"], command,
192
os.WEXITSTATUS(condition)))
230
193
elif os.WIFSIGNALED(condition):
231
self.logger('Checker for client %s (command "%s")'
232
' was killed by signal %s'
233
% (self.properties["Name"], command,
234
os.WTERMSIG(condition)))
194
self.logger('Checker for client {} (command "{}") was'
195
' killed by signal {}'
196
.format(self.properties["Name"], command,
197
os.WTERMSIG(condition)))
235
198
elif os.WCOREDUMP(condition):
236
self.logger('Checker for client %s (command "%s")'
237
' dumped core'
238
% (self.properties["Name"], command))
199
self.logger('Checker for client {} (command "{}") dumped'
200
' core'.format(self.properties["Name"],
201
command))
239
202
else:
240
self.logger('Checker for client %s completed'
241
' mysteriously')
203
self.logger('Checker for client {} completed'
204
' mysteriously'
205
.format(self.properties["Name"]))
242
206
self.update()
243
207
244
208
def checker_started(self, command):
245
#self.logger('Client %s started checker "%s"'
246
# % (self.properties["Name"], unicode(command)))
247
pass
209
"""Server signals that a checker started."""
210
self.logger('Client {} started checker "{}"'
211
.format(self.properties["Name"],
212
command), level=0)
248
213
249
214
def got_secret(self):
250
self.last_checker_failed = False
251
self.logger('Client %s received its secret'
252
% self.properties["Name"])
215
self.logger('Client {} received its secret'
216
.format(self.properties["Name"]))
253
217
254
218
def need_approval(self, timeout, default):
255
219
if not default:
256
message = 'Client %s needs approval within %s seconds'
220
message = 'Client {} needs approval within {} seconds'
257
221
else:
258
message = 'Client %s will get its secret in %s seconds'
259
self.logger(message
260
% (self.properties["Name"], timeout/1000))
261
self.using_timer(True)
222
message = 'Client {} will get its secret in {} seconds'
223
self.logger(message.format(self.properties["Name"],
224
timeout/1000))
262
225
263
226
def rejected(self, reason):
264
self.logger('Client %s was rejected; reason: %s'
265
% (self.properties["Name"], reason))
227
self.logger('Client {} was rejected; reason: {}'
228
.format(self.properties["Name"], reason))
266
229
267
230
def selectable(self):
268
231
"""Make this a "selectable" widget.
290
253
"bold-underline-blink":
291
254
"bold-underline-blink-standout",
292
255
}
293
256
294
257
# Rebuild focus and non-focus widgets using current properties
295
258
296
259
# Base part of a client. Name!
297
base = ('%(name)s: '
298
% {"name": self.properties["Name"]})
260
base = '{name}: '.format(name=self.properties["Name"])
299
261
if not self.properties["Enabled"]:
300
262
message = "DISABLED"
263
self.using_timer(False)
301
264
elif self.properties["ApprovalPending"]:
302
265
timeout = datetime.timedelta(milliseconds
303
266
= self.properties
305
268
last_approval_request = isoformat_to_datetime(
306
269
self.properties["LastApprovalRequest"])
307
270
if last_approval_request is not None:
308
timer = timeout - (datetime.datetime.utcnow()
309
- last_approval_request)
271
timer = max(timeout - (datetime.datetime.utcnow()
272
- last_approval_request),
273
datetime.timedelta())
310
274
else:
311
275
timer = datetime.timedelta()
312
276
if self.properties["ApprovedByDefault"]:
313
message = "Approval in %s. (d)eny?"
277
message = "Approval in {}. (d)eny?"
314
278
else:
315
message = "Denial in %s. (a)pprove?"
316
message = message % unicode(timer).rsplit(".", 1)[0]
317
elif self.last_checker_failed:
318
# When checker has failed, print a timer until client expires
279
message = "Denial in {}. (a)pprove?"
280
message = message.format(str(timer).rsplit(".", 1)[0])
281
self.using_timer(True)
282
elif self.properties["LastCheckerStatus"] != 0:
283
# When checker has failed, show timer until client expires
319
284
expires = self.properties["Expires"]
320
285
if expires == "":
321
286
timer = datetime.timedelta(0)
322
287
else:
323
expires = datetime.datetime.strptime(expires,
324
'%Y-%m-%dT%H:%M:%S.%f')
325
timer = expires - datetime.datetime.utcnow()
288
expires = (datetime.datetime.strptime
289
(expires, '%Y-%m-%dT%H:%M:%S.%f'))
290
timer = max(expires - datetime.datetime.utcnow(),
291
datetime.timedelta())
326
292
message = ('A checker has failed! Time until client'
327
' gets disabled: %s'
328
% unicode(timer).rsplit(".", 1)[0])
293
' gets disabled: {}'
294
.format(str(timer).rsplit(".", 1)[0]))
295
self.using_timer(True)
329
296
else:
330
297
message = "enabled"
331
self._text = "%s%s" % (base, message)
332
298
self.using_timer(False)
299
self._text = "{}{}".format(base, message)
300
333
301
if not urwid.supports_unicode():
334
302
self._text = self._text.encode("ascii", "replace")
335
303
textlist = [("normal", self._text)]
352
320
self.update()
353
321
return True # Keep calling this
354
322
355
def delete(self, *args, **kwargs):
323
def delete(self, **kwargs):
356
324
if self._update_timer_callback_tag is not None:
357
325
gobject.source_remove(self._update_timer_callback_tag)
358
326
self._update_timer_callback_tag = None
361
329
self.match_objects = ()
362
330
if self.delete_hook is not None:
363
331
self.delete_hook(self)
364
return super(MandosClientWidget, self).delete(*args, **kwargs)
332
return super(MandosClientWidget, self).delete(**kwargs)
365
333
366
334
def render(self, maxcolrow, focus=False):
367
335
"""Render differently if we have focus.
409
377
else:
410
378
return key
411
379
412
def property_changed(self, property=None, value=None,
413
*args, **kwargs):
380
def property_changed(self, property=None, **kwargs):
414
381
"""Call self.update() if old value is not new value.
415
382
This overrides the method from MandosClientPropertyCache"""
416
property_name = unicode(property)
383
property_name = str(property)
417
384
old_value = self.properties.get(property_name)
418
385
super(MandosClientWidget, self).property_changed(
419
property=property, value=value, *args, **kwargs)
386
property=property, **kwargs)
420
387
if self.properties.get(property_name) != old_value:
421
388
self.update()
422
389
426
393
"down" key presses, thus not allowing any containing widgets to
427
394
use them as an excuse to shift focus away from this widget.
428
395
"""
429
def keypress(self, maxcolrow, key):
430
ret = super(ConstrainedListBox, self).keypress(maxcolrow, key)
396
def keypress(self, *args, **kwargs):
397
ret = super(ConstrainedListBox, self).keypress(*args, **kwargs)
431
398
if ret in ("up", "down"):
432
399
return
433
400
return ret
437
404
"""This is the entire user interface - the whole screen
438
405
with boxes, lists of client widgets, etc.
439
406
"""
440
def __init__(self, max_log_length=1000):
407
def __init__(self, max_log_length=1000, log_level=1):
441
408
DBusGMainLoop(set_as_default=True)
442
409
443
410
self.screen = urwid.curses_display.Screen()
446
413
("normal",
447
414
"default", "default", None),
448
415
("bold",
449
"default", "default", "bold"),
416
"bold", "default", "bold"),
450
417
("underline-blink",
451
"default", "default", "underline"),
418
"underline,blink", "default", "underline,blink"),
452
419
("standout",
453
"default", "default", "standout"),
420
"standout", "default", "standout"),
454
421
("bold-underline-blink",
455
"default", "default", ("bold", "underline")),
422
"bold,underline,blink", "default", "bold,underline,blink"),
456
423
("bold-standout",
457
"default", "default", ("bold", "standout")),
424
"bold,standout", "default", "bold,standout"),
458
425
("underline-blink-standout",
459
"default", "default", ("underline", "standout")),
426
"underline,blink,standout", "default",
427
"underline,blink,standout"),
460
428
("bold-underline-blink-standout",
461
"default", "default", ("bold", "underline",
462
"standout")),
429
"bold,underline,blink,standout", "default",
430
"bold,underline,blink,standout"),
463
431
))
464
432
465
433
if urwid.supports_unicode():
480
448
self.log = []
481
449
self.max_log_length = max_log_length
482
450
451
self.log_level = log_level
452
483
453
# We keep a reference to the log widget so we can remove it
484
454
# from the ListWalker without it getting destroyed
485
455
self.logbox = ConstrainedListBox(self.log)
497
467
498
468
self.busname = domain + '.Mandos'
499
469
self.main_loop = gobject.MainLoop()
500
self.bus = dbus.SystemBus()
501
mandos_dbus_objc = self.bus.get_object(
502
self.busname, "/", follow_name_owner_changes=True)
503
self.mandos_serv = dbus.Interface(mandos_dbus_objc,
504
dbus_interface
505
= server_interface)
506
try:
507
mandos_clients = (self.mandos_serv
508
.GetAllClientsWithProperties())
509
except dbus.exceptions.DBusException:
510
mandos_clients = dbus.Dictionary()
511
512
(self.mandos_serv
513
.connect_to_signal("ClientRemoved",
514
self.find_and_remove_client,
515
dbus_interface=server_interface,
516
byte_arrays=True))
517
(self.mandos_serv
518
.connect_to_signal("ClientAdded",
519
self.add_new_client,
520
dbus_interface=server_interface,
521
byte_arrays=True))
522
(self.mandos_serv
523
.connect_to_signal("ClientNotFound",
524
self.client_not_found,
525
dbus_interface=server_interface,
526
byte_arrays=True))
527
for path, client in mandos_clients.iteritems():
528
client_proxy_object = self.bus.get_object(self.busname,
529
path)
530
self.add_client(MandosClientWidget(server_proxy_object
531
=self.mandos_serv,
532
proxy_object
533
=client_proxy_object,
534
properties=client,
535
update_hook
536
=self.refresh,
537
delete_hook
538
=self.remove_client,
539
logger
540
=self.log_message),
541
path=path)
542
470
543
471
def client_not_found(self, fingerprint, address):
544
self.log_message(("Client with address %s and fingerprint %s"
545
" could not be found" % (address,
546
fingerprint)))
472
self.log_message("Client with address {} and fingerprint {}"
473
" could not be found"
474
.format(address, fingerprint))
547
475
548
476
def rebuild(self):
549
477
"""This rebuilds the User Interface.
559
487
self.divider)))
560
488
if self.log_visible:
561
489
self.uilist.append(self.logbox)
562
pass
563
490
self.topwidget = urwid.Pile(self.uilist)
564
491
565
def log_message(self, message):
492
def log_message(self, message, level=1):
493
"""Log message formatted with timestamp"""
494
if level < self.log_level:
495
return
566
496
timestamp = datetime.datetime.now().isoformat()
567
self.log_message_raw(timestamp + ": " + message)
497
self.log_message_raw("{}: {}".format(timestamp, message),
498
level=level)
568
499
569
def log_message_raw(self, markup):
500
def log_message_raw(self, markup, level=1):
570
501
"""Add a log message to the log buffer."""
502
if level < self.log_level:
503
return
571
504
self.log.append(urwid.Text(markup, wrap=self.log_wrap))
572
505
if (self.max_log_length
573
506
and len(self.log) > self.max_log_length):
580
513
"""Toggle visibility of the log buffer."""
581
514
self.log_visible = not self.log_visible
582
515
self.rebuild()
583
#self.log_message("Log visibility changed to: "
584
# + unicode(self.log_visible))
516
self.log_message("Log visibility changed to: {}"
517
.format(self.log_visible), level=0)
585
518
586
519
def change_log_display(self):
587
520
"""Change type of log display.
592
525
self.log_wrap = "clip"
593
526
for textwidget in self.log:
594
527
textwidget.set_wrap_mode(self.log_wrap)
595
#self.log_message("Wrap mode: " + self.log_wrap)
528
self.log_message("Wrap mode: {}".format(self.log_wrap),
529
level=0)
596
530
597
531
def find_and_remove_client(self, path, name):
598
532
"""Find a client by its object path and remove it.
603
537
client = self.clients_dict[path]
604
538
except KeyError:
605
539
# not found?
606
self.log_message("Unknown client %r (%r) removed", name,
607
path)
540
self.log_message("Unknown client {!r} ({!r}) removed"
541
.format(name, path))
608
542
return
609
543
client.delete()
610
544
627
561
if path is None:
628
562
path = client.proxy.object_path
629
563
self.clients_dict[path] = client
630
self.clients.sort(None, lambda c: c.properties["Name"])
564
self.clients.sort(key=lambda c: c.properties["Name"])
631
565
self.refresh()
632
566
633
567
def remove_client(self, client, path=None):
635
569
if path is None:
636
570
path = client.proxy.object_path
637
571
del self.clients_dict[path]
638
if not self.clients_dict:
639
# Work around bug in Urwid 0.9.8.3 - if a SimpleListWalker
640
# is completely emptied, we need to recreate it.
641
self.clients = urwid.SimpleListWalker([])
642
self.rebuild()
643
572
self.refresh()
644
573
645
574
def refresh(self):
649
578
650
579
def run(self):
651
580
"""Start the main loop and exit when it's done."""
581
self.bus = dbus.SystemBus()
582
mandos_dbus_objc = self.bus.get_object(
583
self.busname, "/", follow_name_owner_changes=True)
584
self.mandos_serv = dbus.Interface(mandos_dbus_objc,
585
dbus_interface
586
= server_interface)
587
try:
588
mandos_clients = (self.mandos_serv
589
.GetAllClientsWithProperties())
590
if not mandos_clients:
591
self.log_message_raw(("bold", "Note: Server has no clients."))
592
except dbus.exceptions.DBusException:
593
self.log_message_raw(("bold", "Note: No Mandos server running."))
594
mandos_clients = dbus.Dictionary()
595
596
(self.mandos_serv
597
.connect_to_signal("ClientRemoved",
598
self.find_and_remove_client,
599
dbus_interface=server_interface,
600
byte_arrays=True))
601
(self.mandos_serv
602
.connect_to_signal("ClientAdded",
603
self.add_new_client,
604
dbus_interface=server_interface,
605
byte_arrays=True))
606
(self.mandos_serv
607
.connect_to_signal("ClientNotFound",
608
self.client_not_found,
609
dbus_interface=server_interface,
610
byte_arrays=True))
611
for path, client in mandos_clients.items():
612
client_proxy_object = self.bus.get_object(self.busname,
613
path)
614
self.add_client(MandosClientWidget(server_proxy_object
615
=self.mandos_serv,
616
proxy_object
617
=client_proxy_object,
618
properties=client,
619
update_hook
620
=self.refresh,
621
delete_hook
622
=self.remove_client,
623
logger
624
=self.log_message),
625
path=path)
626
652
627
self.refresh()
653
628
self._input_callback_tag = (gobject.io_add_watch
654
629
(sys.stdin.fileno(),
686
661
elif key == "window resize":
687
662
self.size = self.screen.get_cols_rows()
688
663
self.refresh()
689
elif key == "\f": # Ctrl-L
664
elif key == "ctrl l":
665
self.screen.clear()
690
666
self.refresh()
691
667
elif key == "l" or key == "D":
692
668
self.toggle_log_display()
704
680
"?: Help",
705
681
"l: Log window toggle",
706
682
"TAB: Switch window",
707
"w: Wrap (log)"))))
683
"w: Wrap (log lines)",
684
"v: Toggle verbose log",
685
))))
708
686
self.log_message_raw(("bold",
709
687
" "
710
688
.join(("Clients:",
723
701
else:
724
702
self.topwidget.set_focus(self.logbox)
725
703
self.refresh()
704
elif key == "v":
705
if self.log_level == 0:
706
self.log_level = 1
707
self.log_message("Verbose mode: Off")
708
else:
709
self.log_level = 0
710
self.log_message("Verbose mode: On")
726
711
#elif (key == "end" or key == "meta >" or key == "G"
727
712
# or key == ">"):
728
713
# pass # xxx end-of-buffer
751
736
ui.run()
752
737
except KeyboardInterrupt:
753
738
ui.screen.stop()
754
except Exception, e:
755
ui.log_message(unicode(e))
739
except Exception as e:
740
ui.log_message(str(e))
756
741
ui.screen.stop()
757
742
raise
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0