To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos-ctl
- browse files at revision 734
- compare with another revision
- download diff
- download tarball
- view history from revision 734
- Committer: Teddy Hogeborn
- Date: 2014-10-05 19:39:25 UTC
- Revision ID: teddy@recompile.se-20141005193925-jjqx2n2dt3icy28u
* mandos.service ([Unit]/Documentation): New.
added
removed
mandos-ctl
1
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos Monitor - Control and monitor the Mandos server
5
#
6
# Copyright © 2008-2018 Teddy Hogeborn
7
# Copyright © 2008-2018 Björn Påhlsson
8
#
9
# This file is part of Mandos.
10
#
11
# Mandos is free software: you can redistribute it and/or modify it
12
# under the terms of the GNU General Public License as published by
5
#
6
# Copyright © 2008-2014 Teddy Hogeborn
7
# Copyright © 2008-2014 Björn Påhlsson
8
#
9
# This program is free software: you can redistribute it and/or modify
10
# it under the terms of the GNU General Public License as published by
13
11
# the Free Software Foundation, either version 3 of the License, or
14
12
# (at your option) any later version.
15
13
#
16
# Mandos is distributed in the hope that it will be useful, but
17
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# This program is distributed in the hope that it will be useful,
15
# but WITHOUT ANY WARRANTY; without even the implied warranty of
18
16
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19
17
# GNU General Public License for more details.
20
#
18
#
21
19
# You should have received a copy of the GNU General Public License
22
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
23
#
20
# along with this program. If not, see
21
# <http://www.gnu.org/licenses/>.
22
#
24
23
# Contact the authors at <mandos@recompile.se>.
25
#
24
#
26
25
27
26
from __future__ import (division, absolute_import, print_function,
28
27
unicode_literals)
39
38
import re
40
39
import os
41
40
import collections
42
import json
41
import doctest
43
42
44
43
import dbus
45
44
65
64
"ApprovalDelay": "Approval Delay",
66
65
"ApprovalDuration": "Approval Duration",
67
66
"Checker": "Checker",
68
"ExtendedTimeout": "Extended Timeout",
69
"Expires": "Expires",
70
"LastCheckerStatus": "Last Checker Status",
71
}
67
"ExtendedTimeout" : "Extended Timeout"
68
}
72
69
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
73
70
domain = "se.recompile"
74
71
busname = domain + ".Mandos"
75
72
server_path = "/"
76
73
server_interface = domain + ".Mandos"
77
74
client_interface = domain + ".Mandos.Client"
78
version = "1.7.16"
79
80
81
try:
82
dbus.OBJECT_MANAGER_IFACE
83
except AttributeError:
84
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
85
75
version = "1.6.8"
86
76
87
77
def milliseconds_to_string(ms):
88
78
td = datetime.timedelta(0, 0, 0, ms)
89
79
return ("{days}{hours:02}:{minutes:02}:{seconds:02}"
90
.format(days="{}T".format(td.days) if td.days else "",
91
hours=td.seconds // 3600,
92
minutes=(td.seconds % 3600) // 60,
93
seconds=td.seconds % 60))
80
.format(days = "{}T".format(td.days) if td.days else "",
81
hours = td.seconds // 3600,
82
minutes = (td.seconds % 3600) // 60,
83
seconds = td.seconds % 60,
84
))
94
85
95
86
96
87
def rfc3339_duration_to_delta(duration):
97
88
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
98
89
99
90
>>> rfc3339_duration_to_delta("P7D")
100
91
datetime.timedelta(7)
101
92
>>> rfc3339_duration_to_delta("PT60S")
111
102
>>> rfc3339_duration_to_delta("P1DT3M20S")
112
103
datetime.timedelta(1, 200)
113
104
"""
114
105
115
106
# Parsing an RFC 3339 duration with regular expressions is not
116
107
# possible - there would have to be multiple places for the same
117
108
# values, like seconds. The current code, while more esoteric, is
118
109
# cleaner without depending on a parsing library. If Python had a
119
110
# built-in library for parsing we would use it, but we'd like to
120
111
# avoid excessive use of external libraries.
121
112
122
113
# New type for defining tokens, syntax, and semantics all-in-one
123
Token = collections.namedtuple("Token", (
124
"regexp", # To match token; if "value" is not None, must have
125
# a "group" containing digits
126
"value", # datetime.timedelta or None
127
"followers")) # Tokens valid after this token
114
Token = collections.namedtuple("Token",
115
("regexp", # To match token; if
116
# "value" is not None,
117
# must have a "group"
118
# containing digits
119
"value", # datetime.timedelta or
120
# None
121
"followers")) # Tokens valid after
122
# this token
128
123
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
129
124
# the "duration" ABNF definition in RFC 3339, Appendix A.
130
125
token_end = Token(re.compile(r"$"), None, frozenset())
131
126
token_second = Token(re.compile(r"(\d+)S"),
132
127
datetime.timedelta(seconds=1),
133
frozenset((token_end, )))
128
frozenset((token_end,)))
134
129
token_minute = Token(re.compile(r"(\d+)M"),
135
130
datetime.timedelta(minutes=1),
136
131
frozenset((token_second, token_end)))
152
147
frozenset((token_month, token_end)))
153
148
token_week = Token(re.compile(r"(\d+)W"),
154
149
datetime.timedelta(weeks=1),
155
frozenset((token_end, )))
150
frozenset((token_end,)))
156
151
token_duration = Token(re.compile(r"P"), None,
157
152
frozenset((token_year, token_month,
158
153
token_day, token_time,
159
154
token_week)))
160
# Define starting values:
161
# Value so far
162
value = datetime.timedelta()
155
# Define starting values
156
value = datetime.timedelta() # Value so far
163
157
found_token = None
164
# Following valid tokens
165
followers = frozenset((token_duration, ))
166
# String left to parse
167
s = duration
158
followers = frozenset((token_duration,)) # Following valid tokens
159
s = duration # String left to parse
168
160
# Loop until end token is found
169
161
while found_token is not token_end:
170
162
# Search for any currently valid tokens
186
178
break
187
179
else:
188
180
# No currently valid tokens were found
189
raise ValueError("Invalid RFC 3339 duration: {!r}"
190
.format(duration))
181
raise ValueError("Invalid RFC 3339 duration")
191
182
# End token found
192
183
return value
193
184
194
185
195
186
def string_to_delta(interval):
196
187
"""Parse a string and return a datetime.timedelta
197
198
>>> string_to_delta('7d')
188
189
>>> string_to_delta("7d")
199
190
datetime.timedelta(7)
200
>>> string_to_delta('60s')
191
>>> string_to_delta("60s")
201
192
datetime.timedelta(0, 60)
202
>>> string_to_delta('60m')
193
>>> string_to_delta("60m")
203
194
datetime.timedelta(0, 3600)
204
>>> string_to_delta('24h')
195
>>> string_to_delta("24h")
205
196
datetime.timedelta(1)
206
>>> string_to_delta('1w')
197
>>> string_to_delta("1w")
207
198
datetime.timedelta(7)
208
>>> string_to_delta('5m 30s')
199
>>> string_to_delta("5m 30s")
209
200
datetime.timedelta(0, 330)
210
201
"""
211
202
212
203
try:
213
204
return rfc3339_duration_to_delta(interval)
214
205
except ValueError:
215
206
pass
216
207
217
208
value = datetime.timedelta(0)
218
209
regexp = re.compile(r"(\d+)([dsmhw]?)")
219
210
220
211
for num, suffix in regexp.findall(interval):
221
212
if suffix == "d":
222
213
value += datetime.timedelta(int(num))
232
223
value += datetime.timedelta(0, 0, 0, int(num))
233
224
return value
234
225
235
236
226
def print_clients(clients, keywords):
237
227
def valuetostring(value, keyword):
238
228
if type(value) is dbus.Boolean:
241
231
"ApprovalDuration", "ExtendedTimeout"):
242
232
return milliseconds_to_string(value)
243
233
return str(value)
244
234
245
235
# Create format string to print table rows
246
236
format_string = " ".join("{{{key}:{width}}}".format(
247
width=max(len(tablewords[key]),
248
max(len(valuetostring(client[key], key))
249
for client in clients)),
250
key=key)
251
for key in keywords)
237
width = max(len(tablewords[key]),
238
max(len(valuetostring(client[key],
239
key))
240
for client in
241
clients)),
242
key = key) for key in keywords)
252
243
# Print header line
253
244
print(format_string.format(**tablewords))
254
245
for client in clients:
255
print(format_string
256
.format(**{key: valuetostring(client[key], key)
257
for key in keywords}))
258
246
print(format_string.format(**{ key:
247
valuetostring(client[key],
248
key)
249
for key in keywords }))
259
250
260
251
def has_actions(options):
261
252
return any((options.enable,
277
268
options.approve,
278
269
options.deny))
279
270
280
281
271
def main():
282
272
parser = argparse.ArgumentParser()
283
273
parser.add_argument("--version", action="version",
284
version="%(prog)s {}".format(version),
274
version = "%(prog)s {}".format(version),
285
275
help="show version number and exit")
286
276
parser.add_argument("-a", "--all", action="store_true",
287
277
help="Select all clients")
288
278
parser.add_argument("-v", "--verbose", action="store_true",
289
279
help="Print all fields")
290
parser.add_argument("-j", "--dump-json", action="store_true",
291
help="Dump client data in JSON format")
292
280
parser.add_argument("-e", "--enable", action="store_true",
293
281
help="Enable client")
294
282
parser.add_argument("-d", "--disable", action="store_true",
333
321
help="Run self-test")
334
322
parser.add_argument("client", nargs="*", help="Client name")
335
323
options = parser.parse_args()
336
324
337
325
if has_actions(options) and not (options.client or options.all):
338
326
parser.error("Options require clients names or --all.")
339
327
if options.verbose and has_actions(options):
340
parser.error("--verbose can only be used alone.")
341
if options.dump_json and (options.verbose
342
or has_actions(options)):
343
parser.error("--dump-json can only be used alone.")
328
parser.error("--verbose can only be used alone or with"
329
" --all.")
344
330
if options.all and not has_actions(options):
345
331
parser.error("--all requires an action.")
346
332
347
333
if options.check:
348
import doctest
349
334
fail_count, test_count = doctest.testmod()
350
335
sys.exit(os.EX_OK if fail_count == 0 else 1)
351
336
352
337
try:
353
338
bus = dbus.SystemBus()
354
339
mandos_dbus_objc = bus.get_object(busname, server_path)
355
340
except dbus.exceptions.DBusException:
356
print("Could not connect to Mandos server", file=sys.stderr)
341
print("Could not connect to Mandos server",
342
file=sys.stderr)
357
343
sys.exit(1)
358
344
359
345
mandos_serv = dbus.Interface(mandos_dbus_objc,
360
dbus_interface=server_interface)
361
mandos_serv_object_manager = dbus.Interface(
362
mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)
363
364
# block stderr since dbus library prints to stderr
346
dbus_interface = server_interface)
347
348
#block stderr since dbus library prints to stderr
365
349
null = os.open(os.path.devnull, os.O_RDWR)
366
350
stderrcopy = os.dup(sys.stderr.fileno())
367
351
os.dup2(null, sys.stderr.fileno())
368
352
os.close(null)
369
353
try:
370
354
try:
371
mandos_clients = {path: ifs_and_props[client_interface]
372
for path, ifs_and_props in
373
mandos_serv_object_manager
374
.GetManagedObjects().items()
375
if client_interface in ifs_and_props}
355
mandos_clients = mandos_serv.GetAllClientsWithProperties()
376
356
finally:
377
# restore stderr
357
#restore stderr
378
358
os.dup2(stderrcopy, sys.stderr.fileno())
379
359
os.close(stderrcopy)
380
except dbus.exceptions.DBusException as e:
381
print("Access denied: "
382
"Accessing mandos server through D-Bus: {}".format(e),
360
except dbus.exceptions.DBusException:
361
print("Access denied: Accessing mandos server through dbus.",
383
362
file=sys.stderr)
384
363
sys.exit(1)
385
364
386
365
# Compile dict of (clients: properties) to process
387
clients = {}
388
366
clients={}
367
389
368
if options.all or not options.client:
390
clients = {bus.get_object(busname, path): properties
391
for path, properties in mandos_clients.items()}
369
clients = { bus.get_object(busname, path): properties
370
for path, properties in mandos_clients.items() }
392
371
else:
393
372
for name in options.client:
394
373
for path, client in mandos_clients.items():
400
379
print("Client not found on server: {!r}"
401
380
.format(name), file=sys.stderr)
402
381
sys.exit(1)
403
382
404
383
if not has_actions(options) and clients:
405
if options.verbose or options.dump_json:
406
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
407
"Created", "Interval", "Host", "Fingerprint",
408
"CheckerRunning", "LastEnabled",
409
"ApprovalPending", "ApprovedByDefault",
384
if options.verbose:
385
keywords = ("Name", "Enabled", "Timeout",
386
"LastCheckedOK", "Created", "Interval",
387
"Host", "Fingerprint", "CheckerRunning",
388
"LastEnabled", "ApprovalPending",
389
"ApprovedByDefault",
410
390
"LastApprovalRequest", "ApprovalDelay",
411
391
"ApprovalDuration", "Checker",
412
"ExtendedTimeout", "Expires",
413
"LastCheckerStatus")
392
"ExtendedTimeout")
414
393
else:
415
394
keywords = defaultkeywords
416
417
if options.dump_json:
418
json.dump({client["Name"]: {key:
419
bool(client[key])
420
if isinstance(client[key],
421
dbus.Boolean)
422
else client[key]
423
for key in keywords}
424
for client in clients.values()},
425
fp=sys.stdout, indent=4,
426
separators=(',', ': '))
427
print()
428
else:
429
print_clients(clients.values(), keywords)
395
396
print_clients(clients.values(), keywords)
430
397
else:
431
398
# Process each client in the list by all selected options
432
399
for client in clients:
433
434
400
def set_client_prop(prop, value):
435
401
"""Set a Client D-Bus property"""
436
402
client.Set(client_interface, prop, value,
437
403
dbus_interface=dbus.PROPERTIES_IFACE)
438
439
404
def set_client_prop_ms(prop, value):
440
405
"""Set a Client D-Bus property, converted
441
406
from a string to milliseconds."""
442
407
set_client_prop(prop,
443
408
string_to_delta(value).total_seconds()
444
409
* 1000)
445
446
410
if options.remove:
447
411
mandos_serv.RemoveClient(client.__dbus_object_path__)
448
412
if options.enable:
456
420
if options.stop_checker:
457
421
set_client_prop("CheckerRunning", dbus.Boolean(False))
458
422
if options.is_enabled:
459
if client.Get(client_interface, "Enabled",
460
dbus_interface=dbus.PROPERTIES_IFACE):
461
sys.exit(0)
462
else:
463
sys.exit(1)
423
sys.exit(0 if client.Get(client_interface,
424
"Enabled",
425
dbus_interface=
426
dbus.PROPERTIES_IFACE)
427
else 1)
464
428
if options.checker is not None:
465
429
set_client_prop("Checker", options.checker)
466
430
if options.host is not None:
492
456
client.Approve(dbus.Boolean(False),
493
457
dbus_interface=client_interface)
494
458
495
496
459
if __name__ == "__main__":
497
460
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0