/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos-monitor

  • Committer: Teddy Hogeborn
  • Date: 2014-08-09 23:37:07 UTC
  • Revision ID: teddy@recompile.se-20140809233707-6c5qyievp78lnzf1
askpass-fifo: Lower privileges after opening FIFO.

* plugins.d/askpass-fifo.c (main): Lower privileges after opening FIFO.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos-monitor
3
3
# 
4
4
# Mandos Monitor - Control and monitor the Mandos server
5
5
# 
6
 
# Copyright © 2009-2012 Teddy Hogeborn
7
 
# Copyright © 2009-2012 Björn Påhlsson
 
6
# Copyright © 2009-2014 Teddy Hogeborn
 
7
# Copyright © 2009-2014 Björn Påhlsson
8
8
# 
9
9
# This program is free software: you can redistribute it and/or modify
10
10
# it under the terms of the GNU General Public License as published by
17
17
#     GNU General Public License for more details.
18
18
# 
19
19
# You should have received a copy of the GNU General Public License
20
 
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
20
# along with this program.  If not, see
 
21
# <http://www.gnu.org/licenses/>.
21
22
# 
22
23
# Contact the authors at <mandos@recompile.se>.
23
24
# 
24
25
 
25
26
from __future__ import (division, absolute_import, print_function,
26
27
                        unicode_literals)
 
28
try:
 
29
    from future_builtins import *
 
30
except ImportError:
 
31
    pass
27
32
 
28
33
import sys
29
34
import os
30
 
import signal
31
35
 
32
36
import datetime
33
37
 
35
39
import urwid
36
40
 
37
41
from dbus.mainloop.glib import DBusGMainLoop
38
 
import gobject
 
42
try:
 
43
    import gobject
 
44
except ImportError:
 
45
    from gi.repository import GObject as gobject
39
46
 
40
47
import dbus
41
48
 
42
 
import UserList
43
 
 
44
49
import locale
45
50
 
 
51
if sys.version_info.major == 2:
 
52
    str = unicode
 
53
 
46
54
locale.setlocale(locale.LC_ALL, '')
47
55
 
48
56
import logging
52
60
domain = 'se.recompile'
53
61
server_interface = domain + '.Mandos'
54
62
client_interface = domain + '.Mandos.Client'
55
 
version = "1.5.3"
56
 
 
57
 
# Always run in monochrome mode
58
 
urwid.curses_display.curses.has_colors = lambda : False
59
 
 
60
 
# Urwid doesn't support blinking, but we want it.  Since we have no
61
 
# use for underline on its own, we make underline also always blink.
62
 
urwid.curses_display.curses.A_UNDERLINE |= (
63
 
    urwid.curses_display.curses.A_BLINK)
 
63
version = "1.6.8"
64
64
 
65
65
def isoformat_to_datetime(iso):
66
66
    "Parse an ISO 8601 date string to a datetime.datetime()"
83
83
    properties and calls a hook function when any of them are
84
84
    changed.
85
85
    """
86
 
    def __init__(self, proxy_object=None, *args, **kwargs):
 
86
    def __init__(self, proxy_object=None, properties=None, **kwargs):
87
87
        self.proxy = proxy_object # Mandos Client proxy object
88
 
        
89
 
        self.properties = dict()
 
88
        self.properties = dict() if properties is None else properties
90
89
        self.property_changed_match = (
91
90
            self.proxy.connect_to_signal("PropertyChanged",
92
 
                                         self.property_changed,
 
91
                                         self._property_changed,
93
92
                                         client_interface,
94
93
                                         byte_arrays=True))
95
94
        
96
 
        self.properties.update(
97
 
            self.proxy.GetAll(client_interface,
98
 
                              dbus_interface = dbus.PROPERTIES_IFACE))
99
 
 
100
 
        #XXX This breaks good super behaviour
101
 
#        super(MandosClientPropertyCache, self).__init__(
102
 
#            *args, **kwargs)
 
95
        if properties is None:
 
96
            self.properties.update(
 
97
                self.proxy.GetAll(client_interface,
 
98
                                  dbus_interface
 
99
                                  = dbus.PROPERTIES_IFACE))
 
100
        
 
101
        super(MandosClientPropertyCache, self).__init__(**kwargs)
 
102
    
 
103
    def _property_changed(self, property, value):
 
104
        """Helper which takes positional arguments"""
 
105
        return self.property_changed(property=property, value=value)
103
106
    
104
107
    def property_changed(self, property=None, value=None):
105
108
        """This is called whenever we get a PropertyChanged signal
108
111
        # Update properties dict with new value
109
112
        self.properties[property] = value
110
113
    
111
 
    def delete(self, *args, **kwargs):
 
114
    def delete(self):
112
115
        self.property_changed_match.remove()
113
 
        super(MandosClientPropertyCache, self).__init__(
114
 
            *args, **kwargs)
115
116
 
116
117
 
117
118
class MandosClientWidget(urwid.FlowWidget, MandosClientPropertyCache):
119
120
    """
120
121
    
121
122
    def __init__(self, server_proxy_object=None, update_hook=None,
122
 
                 delete_hook=None, logger=None, *args, **kwargs):
 
123
                 delete_hook=None, logger=None, **kwargs):
123
124
        # Called on update
124
125
        self.update_hook = update_hook
125
126
        # Called on delete
130
131
        self.logger = logger
131
132
        
132
133
        self._update_timer_callback_tag = None
133
 
        self._update_timer_callback_lock = 0
134
134
        
135
135
        # The widget shown normally
136
136
        self._text_widget = urwid.Text("")
137
137
        # The widget shown when we have focus
138
138
        self._focus_text_widget = urwid.Text("")
139
 
        super(MandosClientWidget, self).__init__(
140
 
            update_hook=update_hook, delete_hook=delete_hook,
141
 
            *args, **kwargs)
 
139
        super(MandosClientWidget, self).__init__(**kwargs)
142
140
        self.update()
143
141
        self.opened = False
144
142
        
145
 
        last_checked_ok = isoformat_to_datetime(self.properties
146
 
                                                ["LastCheckedOK"])
147
 
        
148
 
        if self.properties ["LastCheckerStatus"] != 0:
149
 
            self.using_timer(True)
150
 
        
151
 
        if self.need_approval:
152
 
            self.using_timer(True)
153
 
        
154
143
        self.match_objects = (
155
144
            self.proxy.connect_to_signal("CheckerCompleted",
156
145
                                         self.checker_completed,
172
161
                                         self.rejected,
173
162
                                         client_interface,
174
163
                                         byte_arrays=True))
175
 
        #self.logger('Created client {0}'
176
 
        #            .format(self.properties["Name"]))
177
 
    
178
 
    def property_changed(self, property=None, value=None):
179
 
        super(self, MandosClientWidget).property_changed(property,
180
 
                                                         value)
181
 
        if property == "ApprovalPending":
182
 
            using_timer(bool(value))
183
 
        if property == "LastCheckerStatus":
184
 
            using_timer(value != 0)
185
 
            #self.logger('Checker for client {0} (command "{1}") was '
186
 
            #            ' successful'.format(self.properties["Name"],
187
 
            #                                 command))
 
164
        self.logger('Created client {}'
 
165
                    .format(self.properties["Name"]), level=0)
188
166
    
189
167
    def using_timer(self, flag):
190
168
        """Call this method with True or False when timer should be
191
169
        activated or deactivated.
192
170
        """
193
 
        old = self._update_timer_callback_lock
194
 
        if flag:
195
 
            self._update_timer_callback_lock += 1
196
 
        else:
197
 
            self._update_timer_callback_lock -= 1
198
 
        if old == 0 and self._update_timer_callback_lock:
 
171
        if flag and self._update_timer_callback_tag is None:
199
172
            # Will update the shown timer value every second
200
173
            self._update_timer_callback_tag = (gobject.timeout_add
201
174
                                               (1000,
202
175
                                                self.update_timer))
203
 
        elif old and self._update_timer_callback_lock == 0:
 
176
        elif not (flag or self._update_timer_callback_tag is None):
204
177
            gobject.source_remove(self._update_timer_callback_tag)
205
178
            self._update_timer_callback_tag = None
206
179
    
207
180
    def checker_completed(self, exitstatus, condition, command):
208
181
        if exitstatus == 0:
 
182
            self.logger('Checker for client {} (command "{}")'
 
183
                        ' succeeded'.format(self.properties["Name"],
 
184
                                            command), level=0)
209
185
            self.update()
210
186
            return
211
187
        # Checker failed
212
188
        if os.WIFEXITED(condition):
213
 
            self.logger('Checker for client {0} (command "{1}")'
214
 
                        ' failed with exit code {2}'
 
189
            self.logger('Checker for client {} (command "{}") failed'
 
190
                        ' with exit code {}'
215
191
                        .format(self.properties["Name"], command,
216
192
                                os.WEXITSTATUS(condition)))
217
193
        elif os.WIFSIGNALED(condition):
218
 
            self.logger('Checker for client {0} (command "{1}") was'
219
 
                        ' killed by signal {2}'
 
194
            self.logger('Checker for client {} (command "{}") was'
 
195
                        ' killed by signal {}'
220
196
                        .format(self.properties["Name"], command,
221
197
                                os.WTERMSIG(condition)))
222
198
        elif os.WCOREDUMP(condition):
223
 
            self.logger('Checker for client {0} (command "{1}")'
224
 
                        ' dumped core'
225
 
                        .format(self.properties["Name"], command))
 
199
            self.logger('Checker for client {} (command "{}") dumped'
 
200
                        ' core'.format(self.properties["Name"],
 
201
                                       command))
226
202
        else:
227
 
            self.logger('Checker for client {0} completed'
 
203
            self.logger('Checker for client {} completed'
228
204
                        ' mysteriously'
229
205
                        .format(self.properties["Name"]))
230
206
        self.update()
231
207
    
232
208
    def checker_started(self, command):
233
 
        """Server signals that a checker started. This could be useful
234
 
           to log in the future. """
235
 
        #self.logger('Client {0} started checker "{1}"'
236
 
        #            .format(self.properties["Name"],
237
 
        #                    unicode(command)))
238
 
        pass
 
209
        """Server signals that a checker started."""
 
210
        self.logger('Client {} started checker "{}"'
 
211
                    .format(self.properties["Name"],
 
212
                            command), level=0)
239
213
    
240
214
    def got_secret(self):
241
 
        self.logger('Client {0} received its secret'
 
215
        self.logger('Client {} received its secret'
242
216
                    .format(self.properties["Name"]))
243
217
    
244
218
    def need_approval(self, timeout, default):
245
219
        if not default:
246
 
            message = 'Client {0} needs approval within {1} seconds'
 
220
            message = 'Client {} needs approval within {} seconds'
247
221
        else:
248
 
            message = 'Client {0} will get its secret in {1} seconds'
 
222
            message = 'Client {} will get its secret in {} seconds'
249
223
        self.logger(message.format(self.properties["Name"],
250
224
                                   timeout/1000))
251
 
        self.using_timer(True)
252
225
    
253
226
    def rejected(self, reason):
254
 
        self.logger('Client {0} was rejected; reason: {1}'
 
227
        self.logger('Client {} was rejected; reason: {}'
255
228
                    .format(self.properties["Name"], reason))
256
229
    
257
230
    def selectable(self):
280
253
                          "bold-underline-blink":
281
254
                              "bold-underline-blink-standout",
282
255
                          }
283
 
 
 
256
        
284
257
        # Rebuild focus and non-focus widgets using current properties
285
 
 
 
258
        
286
259
        # Base part of a client. Name!
287
260
        base = '{name}: '.format(name=self.properties["Name"])
288
261
        if not self.properties["Enabled"]:
289
262
            message = "DISABLED"
 
263
            self.using_timer(False)
290
264
        elif self.properties["ApprovalPending"]:
291
265
            timeout = datetime.timedelta(milliseconds
292
266
                                         = self.properties
294
268
            last_approval_request = isoformat_to_datetime(
295
269
                self.properties["LastApprovalRequest"])
296
270
            if last_approval_request is not None:
297
 
                timer = timeout - (datetime.datetime.utcnow()
298
 
                                   - last_approval_request)
 
271
                timer = max(timeout - (datetime.datetime.utcnow()
 
272
                                       - last_approval_request),
 
273
                            datetime.timedelta())
299
274
            else:
300
275
                timer = datetime.timedelta()
301
276
            if self.properties["ApprovedByDefault"]:
302
 
                message = "Approval in {0}. (d)eny?"
 
277
                message = "Approval in {}. (d)eny?"
303
278
            else:
304
 
                message = "Denial in {0}. (a)pprove?"
305
 
            message = message.format(unicode(timer).rsplit(".", 1)[0])
 
279
                message = "Denial in {}. (a)pprove?"
 
280
            message = message.format(str(timer).rsplit(".", 1)[0])
 
281
            self.using_timer(True)
306
282
        elif self.properties["LastCheckerStatus"] != 0:
307
 
            # When checker has failed, print a timer until client expires
 
283
            # When checker has failed, show timer until client expires
308
284
            expires = self.properties["Expires"]
309
285
            if expires == "":
310
286
                timer = datetime.timedelta(0)
311
287
            else:
312
 
                expires = datetime.datetime.strptime(expires,
313
 
                                                     '%Y-%m-%dT%H:%M:%S.%f')
314
 
                timer = expires - datetime.datetime.utcnow()
 
288
                expires = (datetime.datetime.strptime
 
289
                           (expires, '%Y-%m-%dT%H:%M:%S.%f'))
 
290
                timer = max(expires - datetime.datetime.utcnow(),
 
291
                            datetime.timedelta())
315
292
            message = ('A checker has failed! Time until client'
316
 
                       ' gets disabled: {0}'
317
 
                       .format(unicode(timer).rsplit(".", 1)[0]))
 
293
                       ' gets disabled: {}'
 
294
                       .format(str(timer).rsplit(".", 1)[0]))
 
295
            self.using_timer(True)
318
296
        else:
319
297
            message = "enabled"
320
 
        self._text = "{0}{1}".format(base, message)
321
 
            
 
298
            self.using_timer(False)
 
299
        self._text = "{}{}".format(base, message)
 
300
        
322
301
        if not urwid.supports_unicode():
323
302
            self._text = self._text.encode("ascii", "replace")
324
303
        textlist = [("normal", self._text)]
341
320
        self.update()
342
321
        return True             # Keep calling this
343
322
    
344
 
    def delete(self, *args, **kwargs):
 
323
    def delete(self, **kwargs):
345
324
        if self._update_timer_callback_tag is not None:
346
325
            gobject.source_remove(self._update_timer_callback_tag)
347
326
            self._update_timer_callback_tag = None
350
329
        self.match_objects = ()
351
330
        if self.delete_hook is not None:
352
331
            self.delete_hook(self)
353
 
        return super(MandosClientWidget, self).delete(*args, **kwargs)
 
332
        return super(MandosClientWidget, self).delete(**kwargs)
354
333
    
355
334
    def render(self, maxcolrow, focus=False):
356
335
        """Render differently if we have focus.
398
377
        else:
399
378
            return key
400
379
    
401
 
    def property_changed(self, property=None, value=None,
402
 
                         *args, **kwargs):
 
380
    def property_changed(self, property=None, **kwargs):
403
381
        """Call self.update() if old value is not new value.
404
382
        This overrides the method from MandosClientPropertyCache"""
405
 
        property_name = unicode(property)
 
383
        property_name = str(property)
406
384
        old_value = self.properties.get(property_name)
407
385
        super(MandosClientWidget, self).property_changed(
408
 
            property=property, value=value, *args, **kwargs)
 
386
            property=property, **kwargs)
409
387
        if self.properties.get(property_name) != old_value:
410
388
            self.update()
411
389
 
415
393
    "down" key presses, thus not allowing any containing widgets to
416
394
    use them as an excuse to shift focus away from this widget.
417
395
    """
418
 
    def keypress(self, maxcolrow, key):
419
 
        ret = super(ConstrainedListBox, self).keypress(maxcolrow, key)
 
396
    def keypress(self, *args, **kwargs):
 
397
        ret = super(ConstrainedListBox, self).keypress(*args, **kwargs)
420
398
        if ret in ("up", "down"):
421
399
            return
422
400
        return ret
426
404
    """This is the entire user interface - the whole screen
427
405
    with boxes, lists of client widgets, etc.
428
406
    """
429
 
    def __init__(self, max_log_length=1000):
 
407
    def __init__(self, max_log_length=1000, log_level=1):
430
408
        DBusGMainLoop(set_as_default=True)
431
409
        
432
410
        self.screen = urwid.curses_display.Screen()
435
413
                ("normal",
436
414
                 "default", "default", None),
437
415
                ("bold",
438
 
                 "default", "default", "bold"),
 
416
                 "bold", "default", "bold"),
439
417
                ("underline-blink",
440
 
                 "default", "default", "underline"),
 
418
                 "underline,blink", "default", "underline,blink"),
441
419
                ("standout",
442
 
                 "default", "default", "standout"),
 
420
                 "standout", "default", "standout"),
443
421
                ("bold-underline-blink",
444
 
                 "default", "default", ("bold", "underline")),
 
422
                 "bold,underline,blink", "default", "bold,underline,blink"),
445
423
                ("bold-standout",
446
 
                 "default", "default", ("bold", "standout")),
 
424
                 "bold,standout", "default", "bold,standout"),
447
425
                ("underline-blink-standout",
448
 
                 "default", "default", ("underline", "standout")),
 
426
                 "underline,blink,standout", "default",
 
427
                 "underline,blink,standout"),
449
428
                ("bold-underline-blink-standout",
450
 
                 "default", "default", ("bold", "underline",
451
 
                                          "standout")),
 
429
                 "bold,underline,blink,standout", "default",
 
430
                 "bold,underline,blink,standout"),
452
431
                ))
453
432
        
454
433
        if urwid.supports_unicode():
469
448
        self.log = []
470
449
        self.max_log_length = max_log_length
471
450
        
 
451
        self.log_level = log_level
 
452
        
472
453
        # We keep a reference to the log widget so we can remove it
473
454
        # from the ListWalker without it getting destroyed
474
455
        self.logbox = ConstrainedListBox(self.log)
488
469
        self.main_loop = gobject.MainLoop()
489
470
    
490
471
    def client_not_found(self, fingerprint, address):
491
 
        self.log_message("Client with address {0} and fingerprint"
492
 
                         " {1} could not be found"
 
472
        self.log_message("Client with address {} and fingerprint {}"
 
473
                         " could not be found"
493
474
                         .format(address, fingerprint))
494
475
    
495
476
    def rebuild(self):
508
489
            self.uilist.append(self.logbox)
509
490
        self.topwidget = urwid.Pile(self.uilist)
510
491
    
511
 
    def log_message(self, message):
 
492
    def log_message(self, message, level=1):
 
493
        """Log message formatted with timestamp"""
 
494
        if level < self.log_level:
 
495
            return
512
496
        timestamp = datetime.datetime.now().isoformat()
513
 
        self.log_message_raw(timestamp + ": " + message)
 
497
        self.log_message_raw("{}: {}".format(timestamp, message),
 
498
                             level=level)
514
499
    
515
 
    def log_message_raw(self, markup):
 
500
    def log_message_raw(self, markup, level=1):
516
501
        """Add a log message to the log buffer."""
 
502
        if level < self.log_level:
 
503
            return
517
504
        self.log.append(urwid.Text(markup, wrap=self.log_wrap))
518
505
        if (self.max_log_length
519
506
            and len(self.log) > self.max_log_length):
526
513
        """Toggle visibility of the log buffer."""
527
514
        self.log_visible = not self.log_visible
528
515
        self.rebuild()
529
 
        #self.log_message("Log visibility changed to: "
530
 
        #                 + unicode(self.log_visible))
 
516
        self.log_message("Log visibility changed to: {}"
 
517
                         .format(self.log_visible), level=0)
531
518
    
532
519
    def change_log_display(self):
533
520
        """Change type of log display.
538
525
            self.log_wrap = "clip"
539
526
        for textwidget in self.log:
540
527
            textwidget.set_wrap_mode(self.log_wrap)
541
 
        #self.log_message("Wrap mode: " + self.log_wrap)
 
528
        self.log_message("Wrap mode: {}".format(self.log_wrap),
 
529
                         level=0)
542
530
    
543
531
    def find_and_remove_client(self, path, name):
544
532
        """Find a client by its object path and remove it.
549
537
            client = self.clients_dict[path]
550
538
        except KeyError:
551
539
            # not found?
552
 
            self.log_message("Unknown client {0!r} ({1!r}) removed"
 
540
            self.log_message("Unknown client {!r} ({!r}) removed"
553
541
                             .format(name, path))
554
542
            return
555
543
        client.delete()
573
561
        if path is None:
574
562
            path = client.proxy.object_path
575
563
        self.clients_dict[path] = client
576
 
        self.clients.sort(None, lambda c: c.properties["Name"])
 
564
        self.clients.sort(key=lambda c: c.properties["Name"])
577
565
        self.refresh()
578
566
    
579
567
    def remove_client(self, client, path=None):
581
569
        if path is None:
582
570
            path = client.proxy.object_path
583
571
        del self.clients_dict[path]
584
 
        if not self.clients_dict:
585
 
            # Work around bug in Urwid 0.9.8.3 - if a SimpleListWalker
586
 
            # is completely emptied, we need to recreate it.
587
 
            self.clients = urwid.SimpleListWalker([])
588
 
            self.rebuild()
589
572
        self.refresh()
590
573
    
591
574
    def refresh(self):
604
587
        try:
605
588
            mandos_clients = (self.mandos_serv
606
589
                              .GetAllClientsWithProperties())
 
590
            if not mandos_clients:
 
591
                self.log_message_raw(("bold", "Note: Server has no clients."))
607
592
        except dbus.exceptions.DBusException:
 
593
            self.log_message_raw(("bold", "Note: No Mandos server running."))
608
594
            mandos_clients = dbus.Dictionary()
609
595
        
610
596
        (self.mandos_serv
622
608
                            self.client_not_found,
623
609
                            dbus_interface=server_interface,
624
610
                            byte_arrays=True))
625
 
        for path, client in mandos_clients.iteritems():
 
611
        for path, client in mandos_clients.items():
626
612
            client_proxy_object = self.bus.get_object(self.busname,
627
613
                                                      path)
628
614
            self.add_client(MandosClientWidget(server_proxy_object
637
623
                                               logger
638
624
                                               =self.log_message),
639
625
                            path=path)
640
 
 
 
626
        
641
627
        self.refresh()
642
628
        self._input_callback_tag = (gobject.io_add_watch
643
629
                                    (sys.stdin.fileno(),
675
661
            elif key == "window resize":
676
662
                self.size = self.screen.get_cols_rows()
677
663
                self.refresh()
678
 
            elif key == "\f":  # Ctrl-L
 
664
            elif key == "ctrl l":
 
665
                self.screen.clear()
679
666
                self.refresh()
680
667
            elif key == "l" or key == "D":
681
668
                self.toggle_log_display()
693
680
                                            "?: Help",
694
681
                                            "l: Log window toggle",
695
682
                                            "TAB: Switch window",
696
 
                                            "w: Wrap (log)"))))
 
683
                                            "w: Wrap (log lines)",
 
684
                                            "v: Toggle verbose log",
 
685
                                            ))))
697
686
                self.log_message_raw(("bold",
698
687
                                      "  "
699
688
                                      .join(("Clients:",
712
701
                else:
713
702
                    self.topwidget.set_focus(self.logbox)
714
703
                self.refresh()
 
704
            elif key == "v":
 
705
                if self.log_level == 0:
 
706
                    self.log_level = 1
 
707
                    self.log_message("Verbose mode: Off")
 
708
                else:
 
709
                    self.log_level = 0
 
710
                    self.log_message("Verbose mode: On")
715
711
            #elif (key == "end" or key == "meta >" or key == "G"
716
712
            #      or key == ">"):
717
713
            #    pass            # xxx end-of-buffer
740
736
    ui.run()
741
737
except KeyboardInterrupt:
742
738
    ui.screen.stop()
743
 
except Exception, e:
744
 
    ui.log_message(unicode(e))
 
739
except Exception as e:
 
740
    ui.log_message(str(e))
745
741
    ui.screen.stop()
746
742
    raise