To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos-ctl
- browse files at revision 947
- compare with another revision
- download diff
- download tarball
- view history from revision 947
- Committer: Teddy Hogeborn
- Date: 2018-04-01 22:08:50 UTC
- Revision ID: teddy@recompile.se-20180401220850-11kc7596lknn4piy
Check for and report GPGME key import errors
* plugins.d/mandos-client.c (init_gpgme/import_key): After
gpgme_op_import(), call gpgme_op_import_result() to see if it
worked. If not, print all available information.
* plugins.d/mandos-client.c (init_gpgme/import_key): After
gpgme_op_import(), call gpgme_op_import_result() to see if it
worked. If not, print all available information.
- files added:
- initramfs-tools-hook-conf
- files removed:
- debian/mandos-client.templates
- files modified:
- DBUS-API
added
removed
mandos-ctl
1
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8; after-save-hook: (lambda () (let ((command (if (and (boundp 'tramp-file-name-structure) (string-match (car tramp-file-name-structure) (buffer-file-name))) (tramp-file-name-localname (tramp-dissect-file-name (buffer-file-name))) (buffer-file-name)))) (if (= (shell-command (format "%s --check" (shell-quote-argument command)) "*Test*") 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)) (kill-buffer "*Test*")) (display-buffer "*Test*")))); -*-
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos Monitor - Control and monitor the Mandos server
5
5
#
6
# Copyright © 2008-2019 Teddy Hogeborn
7
# Copyright © 2008-2019 Björn Påhlsson
6
# Copyright © 2008-2018 Teddy Hogeborn
7
# Copyright © 2008-2018 Björn Påhlsson
8
8
#
9
9
# This file is part of Mandos.
10
10
#
40
40
import os
41
41
import collections
42
42
import json
43
import unittest
44
import logging
45
43
46
44
import dbus
47
45
48
# Show warnings by default
49
if not sys.warnoptions:
50
import warnings
51
warnings.simplefilter("default")
52
53
log = logging.getLogger(sys.argv[0])
54
logging.basicConfig(level="INFO", # Show info level messages
55
format="%(message)s") # Show basic log messages
56
57
logging.captureWarnings(True) # Show warnings via the logging system
58
59
46
if sys.version_info.major == 2:
60
47
str = unicode
61
48
62
49
locale.setlocale(locale.LC_ALL, "")
63
50
51
tablewords = {
52
"Name": "Name",
53
"Enabled": "Enabled",
54
"Timeout": "Timeout",
55
"LastCheckedOK": "Last Successful Check",
56
"LastApprovalRequest": "Last Approval Request",
57
"Created": "Created",
58
"Interval": "Interval",
59
"Host": "Host",
60
"Fingerprint": "Fingerprint",
61
"CheckerRunning": "Check Is Running",
62
"LastEnabled": "Last Enabled",
63
"ApprovalPending": "Approval Is Pending",
64
"ApprovedByDefault": "Approved By Default",
65
"ApprovalDelay": "Approval Delay",
66
"ApprovalDuration": "Approval Duration",
67
"Checker": "Checker",
68
"ExtendedTimeout": "Extended Timeout",
69
"Expires": "Expires",
70
"LastCheckerStatus": "Last Checker Status",
71
}
64
72
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
65
73
domain = "se.recompile"
66
74
busname = domain + ".Mandos"
67
75
server_path = "/"
68
76
server_interface = domain + ".Mandos"
69
77
client_interface = domain + ".Mandos.Client"
70
version = "1.8.3"
78
version = "1.7.19"
71
79
72
80
73
81
try:
94
102
datetime.timedelta(0, 60)
95
103
>>> rfc3339_duration_to_delta("PT60M")
96
104
datetime.timedelta(0, 3600)
97
>>> rfc3339_duration_to_delta("P60M")
98
datetime.timedelta(1680)
99
105
>>> rfc3339_duration_to_delta("PT24H")
100
106
datetime.timedelta(1)
101
107
>>> rfc3339_duration_to_delta("P1W")
104
110
datetime.timedelta(0, 330)
105
111
>>> rfc3339_duration_to_delta("P1DT3M20S")
106
112
datetime.timedelta(1, 200)
107
>>> # Can not be empty:
108
>>> rfc3339_duration_to_delta("")
109
Traceback (most recent call last):
110
...
111
ValueError: Invalid RFC 3339 duration: u''
112
>>> # Must start with "P":
113
>>> rfc3339_duration_to_delta("1D")
114
Traceback (most recent call last):
115
...
116
ValueError: Invalid RFC 3339 duration: u'1D'
117
>>> # Must use correct order
118
>>> rfc3339_duration_to_delta("PT1S2M")
119
Traceback (most recent call last):
120
...
121
ValueError: Invalid RFC 3339 duration: u'PT1S2M'
122
>>> # Time needs time marker
123
>>> rfc3339_duration_to_delta("P1H2S")
124
Traceback (most recent call last):
125
...
126
ValueError: Invalid RFC 3339 duration: u'P1H2S'
127
>>> # Weeks can not be combined with anything else
128
>>> rfc3339_duration_to_delta("P1D2W")
129
Traceback (most recent call last):
130
...
131
ValueError: Invalid RFC 3339 duration: u'P1D2W'
132
>>> rfc3339_duration_to_delta("P2W2H")
133
Traceback (most recent call last):
134
...
135
ValueError: Invalid RFC 3339 duration: u'P2W2H'
136
113
"""
137
114
138
115
# Parsing an RFC 3339 duration with regular expressions is not
216
193
217
194
218
195
def string_to_delta(interval):
219
"""Parse a string and return a datetime.timedelta"""
196
"""Parse a string and return a datetime.timedelta
197
198
>>> string_to_delta('7d')
199
datetime.timedelta(7)
200
>>> string_to_delta('60s')
201
datetime.timedelta(0, 60)
202
>>> string_to_delta('60m')
203
datetime.timedelta(0, 3600)
204
>>> string_to_delta('24h')
205
datetime.timedelta(1)
206
>>> string_to_delta('1w')
207
datetime.timedelta(7)
208
>>> string_to_delta('5m 30s')
209
datetime.timedelta(0, 330)
210
"""
220
211
221
212
try:
222
213
return rfc3339_duration_to_delta(interval)
223
except ValueError as e:
224
log.warning("%s - Parsing as pre-1.6.1 interval instead",
225
' '.join(e.args))
226
return parse_pre_1_6_1_interval(interval)
227
228
229
def parse_pre_1_6_1_interval(interval):
230
"""Parse an interval string as documented by Mandos before 1.6.1,
231
and return a datetime.timedelta
232
233
>>> parse_pre_1_6_1_interval('7d')
234
datetime.timedelta(7)
235
>>> parse_pre_1_6_1_interval('60s')
236
datetime.timedelta(0, 60)
237
>>> parse_pre_1_6_1_interval('60m')
238
datetime.timedelta(0, 3600)
239
>>> parse_pre_1_6_1_interval('24h')
240
datetime.timedelta(1)
241
>>> parse_pre_1_6_1_interval('1w')
242
datetime.timedelta(7)
243
>>> parse_pre_1_6_1_interval('5m 30s')
244
datetime.timedelta(0, 330)
245
>>> parse_pre_1_6_1_interval('')
246
datetime.timedelta(0)
247
>>> # Ignore unknown characters, allow any order and repetitions
248
>>> parse_pre_1_6_1_interval('2dxy7zz11y3m5m')
249
datetime.timedelta(2, 480, 18000)
250
251
"""
214
except ValueError:
215
pass
252
216
253
217
value = datetime.timedelta(0)
254
218
regexp = re.compile(r"(\d+)([dsmhw]?)")
269
233
return value
270
234
271
235
272
class TableOfClients(object):
273
tablewords = {
274
"Name": "Name",
275
"Enabled": "Enabled",
276
"Timeout": "Timeout",
277
"LastCheckedOK": "Last Successful Check",
278
"LastApprovalRequest": "Last Approval Request",
279
"Created": "Created",
280
"Interval": "Interval",
281
"Host": "Host",
282
"Fingerprint": "Fingerprint",
283
"KeyID": "Key ID",
284
"CheckerRunning": "Check Is Running",
285
"LastEnabled": "Last Enabled",
286
"ApprovalPending": "Approval Is Pending",
287
"ApprovedByDefault": "Approved By Default",
288
"ApprovalDelay": "Approval Delay",
289
"ApprovalDuration": "Approval Duration",
290
"Checker": "Checker",
291
"ExtendedTimeout": "Extended Timeout",
292
"Expires": "Expires",
293
"LastCheckerStatus": "Last Checker Status",
294
}
295
296
def __init__(self, clients, keywords, tablewords=None):
297
self.clients = clients
298
self.keywords = keywords
299
if tablewords is not None:
300
self.tablewords = tablewords
301
302
def __str__(self):
303
return "\n".join(self.rows())
304
305
if sys.version_info.major == 2:
306
__unicode__ = __str__
307
def __str__(self):
308
return str(self).encode(locale.getpreferredencoding())
309
310
def rows(self):
311
format_string = self.row_formatting_string()
312
rows = [self.header_line(format_string)]
313
rows.extend(self.client_line(client, format_string)
314
for client in self.clients)
315
return rows
316
317
def row_formatting_string(self):
318
"Format string used to format table rows"
319
return " ".join("{{{key}:{width}}}".format(
320
width=max(len(self.tablewords[key]),
321
*(len(self.string_from_client(client, key))
322
for client in self.clients)),
323
key=key)
324
for key in self.keywords)
325
326
def string_from_client(self, client, key):
327
return self.valuetostring(client[key], key)
328
329
@staticmethod
236
def print_clients(clients, keywords):
330
237
def valuetostring(value, keyword):
331
if isinstance(value, dbus.Boolean):
238
if type(value) is dbus.Boolean:
332
239
return "Yes" if value else "No"
333
240
if keyword in ("Timeout", "Interval", "ApprovalDelay",
334
241
"ApprovalDuration", "ExtendedTimeout"):
335
242
return milliseconds_to_string(value)
336
243
return str(value)
337
244
338
def header_line(self, format_string):
339
return format_string.format(**self.tablewords)
340
341
def client_line(self, client, format_string):
342
return format_string.format(
343
**{key: self.string_from_client(client, key)
344
for key in self.keywords})
245
# Create format string to print table rows
246
format_string = " ".join("{{{key}:{width}}}".format(
247
width=max(len(tablewords[key]),
248
max(len(valuetostring(client[key], key))
249
for client in clients)),
250
key=key)
251
for key in keywords)
252
# Print header line
253
print(format_string.format(**tablewords))
254
for client in clients:
255
print(format_string
256
.format(**{key: valuetostring(client[key], key)
257
for key in keywords}))
345
258
346
259
347
260
def has_actions(options):
376
289
help="Print all fields")
377
290
parser.add_argument("-j", "--dump-json", action="store_true",
378
291
help="Dump client data in JSON format")
379
enable_disable = parser.add_mutually_exclusive_group()
380
enable_disable.add_argument("-e", "--enable", action="store_true",
381
help="Enable client")
382
enable_disable.add_argument("-d", "--disable",
383
action="store_true",
384
help="disable client")
292
parser.add_argument("-e", "--enable", action="store_true",
293
help="Enable client")
294
parser.add_argument("-d", "--disable", action="store_true",
295
help="disable client")
385
296
parser.add_argument("-b", "--bump-timeout", action="store_true",
386
297
help="Bump timeout for client")
387
start_stop_checker = parser.add_mutually_exclusive_group()
388
start_stop_checker.add_argument("--start-checker",
389
action="store_true",
390
help="Start checker for client")
391
start_stop_checker.add_argument("--stop-checker",
392
action="store_true",
393
help="Stop checker for client")
298
parser.add_argument("--start-checker", action="store_true",
299
help="Start checker for client")
300
parser.add_argument("--stop-checker", action="store_true",
301
help="Stop checker for client")
394
302
parser.add_argument("-V", "--is-enabled", action="store_true",
395
303
help="Check if client is enabled")
396
304
parser.add_argument("-r", "--remove", action="store_true",
403
311
help="Set extended timeout for client")
404
312
parser.add_argument("-i", "--interval",
405
313
help="Set checker interval for client")
406
approve_deny_default = parser.add_mutually_exclusive_group()
407
approve_deny_default.add_argument(
408
"--approve-by-default", action="store_true",
409
default=None, dest="approved_by_default",
410
help="Set client to be approved by default")
411
approve_deny_default.add_argument(
412
"--deny-by-default", action="store_false",
413
dest="approved_by_default",
414
help="Set client to be denied by default")
314
parser.add_argument("--approve-by-default", action="store_true",
315
default=None, dest="approved_by_default",
316
help="Set client to be approved by default")
317
parser.add_argument("--deny-by-default", action="store_false",
318
dest="approved_by_default",
319
help="Set client to be denied by default")
415
320
parser.add_argument("--approval-delay",
416
321
help="Set delay before client approve/deny")
417
322
parser.add_argument("--approval-duration",
420
325
parser.add_argument("-s", "--secret",
421
326
type=argparse.FileType(mode="rb"),
422
327
help="Set password blob (file) for client")
423
approve_deny = parser.add_mutually_exclusive_group()
424
approve_deny.add_argument(
425
"-A", "--approve", action="store_true",
426
help="Approve any current client request")
427
approve_deny.add_argument("-D", "--deny", action="store_true",
428
help="Deny any current client request")
328
parser.add_argument("-A", "--approve", action="store_true",
329
help="Approve any current client request")
330
parser.add_argument("-D", "--deny", action="store_true",
331
help="Deny any current client request")
429
332
parser.add_argument("--check", action="store_true",
430
333
help="Run self-test")
431
334
parser.add_argument("client", nargs="*", help="Client name")
440
343
parser.error("--dump-json can only be used alone.")
441
344
if options.all and not has_actions(options):
442
345
parser.error("--all requires an action.")
443
if options.is_enabled and len(options.client) > 1:
444
parser.error("--is-enabled requires exactly one client")
346
347
if options.check:
348
import doctest
349
fail_count, test_count = doctest.testmod()
350
sys.exit(os.EX_OK if fail_count == 0 else 1)
445
351
446
352
try:
447
353
bus = dbus.SystemBus()
448
354
mandos_dbus_objc = bus.get_object(busname, server_path)
449
355
except dbus.exceptions.DBusException:
450
log.critical("Could not connect to Mandos server")
356
print("Could not connect to Mandos server", file=sys.stderr)
451
357
sys.exit(1)
452
358
453
359
mandos_serv = dbus.Interface(mandos_dbus_objc,
472
378
os.dup2(stderrcopy, sys.stderr.fileno())
473
379
os.close(stderrcopy)
474
380
except dbus.exceptions.DBusException as e:
475
log.critical("Failed to access Mandos server through D-Bus:"
476
"\n%s", e)
381
print("Access denied: "
382
"Accessing mandos server through D-Bus: {}".format(e),
383
file=sys.stderr)
477
384
sys.exit(1)
478
385
479
386
# Compile dict of (clients: properties) to process
490
397
clients[client_objc] = client
491
398
break
492
399
else:
493
log.critical("Client not found on server: %r", name)
400
print("Client not found on server: {!r}"
401
.format(name), file=sys.stderr)
494
402
sys.exit(1)
495
403
496
404
if not has_actions(options) and clients:
497
405
if options.verbose or options.dump_json:
498
406
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
499
"Created", "Interval", "Host", "KeyID",
500
"Fingerprint", "CheckerRunning",
501
"LastEnabled", "ApprovalPending",
502
"ApprovedByDefault", "LastApprovalRequest",
503
"ApprovalDelay", "ApprovalDuration",
504
"Checker", "ExtendedTimeout", "Expires",
407
"Created", "Interval", "Host", "Fingerprint",
408
"CheckerRunning", "LastEnabled",
409
"ApprovalPending", "ApprovedByDefault",
410
"LastApprovalRequest", "ApprovalDelay",
411
"ApprovalDuration", "Checker",
412
"ExtendedTimeout", "Expires",
505
413
"LastCheckerStatus")
506
414
else:
507
415
keywords = defaultkeywords
518
426
separators=(',', ': '))
519
427
print()
520
428
else:
521
print(TableOfClients(clients.values(), keywords))
429
print_clients(clients.values(), keywords)
522
430
else:
523
431
# Process each client in the list by all selected options
524
432
for client in clients:
584
492
client.Approve(dbus.Boolean(False),
585
493
dbus_interface=client_interface)
586
494
587
588
class Test_milliseconds_to_string(unittest.TestCase):
589
def test_all(self):
590
self.assertEqual(milliseconds_to_string(93785000),
591
"1T02:03:05")
592
def test_no_days(self):
593
self.assertEqual(milliseconds_to_string(7385000), "02:03:05")
594
def test_all_zero(self):
595
self.assertEqual(milliseconds_to_string(0), "00:00:00")
596
def test_no_fractional_seconds(self):
597
self.assertEqual(milliseconds_to_string(400), "00:00:00")
598
self.assertEqual(milliseconds_to_string(900), "00:00:00")
599
self.assertEqual(milliseconds_to_string(1900), "00:00:01")
600
601
class Test_string_to_delta(unittest.TestCase):
602
def test_handles_basic_rfc3339(self):
603
self.assertEqual(string_to_delta("PT2H"),
604
datetime.timedelta(0, 7200))
605
def test_falls_back_to_pre_1_6_1_with_warning(self):
606
# assertLogs only exists in Python 3.4
607
if hasattr(self, "assertLogs"):
608
with self.assertLogs(log, logging.WARNING):
609
value = string_to_delta("2h")
610
else:
611
value = string_to_delta("2h")
612
self.assertEqual(value, datetime.timedelta(0, 7200))
613
614
class Test_TableOfClients(unittest.TestCase):
615
def setUp(self):
616
self.tablewords = {
617
"Attr1": "X",
618
"AttrTwo": "Yy",
619
"AttrThree": "Zzz",
620
"Bool": "A D-BUS Boolean",
621
"NonDbusBoolean": "A Non-D-BUS Boolean",
622
"Integer": "An Integer",
623
"Timeout": "Timedelta 1",
624
"Interval": "Timedelta 2",
625
"ApprovalDelay": "Timedelta 3",
626
"ApprovalDuration": "Timedelta 4",
627
"ExtendedTimeout": "Timedelta 5",
628
"String": "A String",
629
}
630
self.keywords = ["Attr1", "AttrTwo"]
631
self.clients = [
632
{
633
"Attr1": "x1",
634
"AttrTwo": "y1",
635
"AttrThree": "z1",
636
"Bool": dbus.Boolean(False),
637
"NonDbusBoolean": False,
638
"Integer": 0,
639
"Timeout": 0,
640
"Interval": 1000,
641
"ApprovalDelay": 2000,
642
"ApprovalDuration": 3000,
643
"ExtendedTimeout": 4000,
644
"String": "",
645
},
646
{
647
"Attr1": "x2",
648
"AttrTwo": "y2",
649
"AttrThree": "z2",
650
"Bool": dbus.Boolean(True),
651
"NonDbusBoolean": True,
652
"Integer": 1,
653
"Timeout": 93785000,
654
"Interval": 93786000,
655
"ApprovalDelay": 93787000,
656
"ApprovalDuration": 93788000,
657
"ExtendedTimeout": 93789000,
658
"String": "A huge string which will not fit," * 10,
659
},
660
]
661
def test_short_header(self):
662
text = str(TableOfClients(self.clients, self.keywords,
663
self.tablewords))
664
expected_text = """
665
X Yy
666
x1 y1
667
x2 y2
668
"""[1:-1]
669
self.assertEqual(text, expected_text)
670
def test_booleans(self):
671
keywords = ["Bool", "NonDbusBoolean"]
672
text = str(TableOfClients(self.clients, keywords,
673
self.tablewords))
674
expected_text = """
675
A D-BUS Boolean A Non-D-BUS Boolean
676
No False
677
Yes True
678
"""[1:-1]
679
self.assertEqual(text, expected_text)
680
def test_milliseconds_detection(self):
681
keywords = ["Integer", "Timeout", "Interval", "ApprovalDelay",
682
"ApprovalDuration", "ExtendedTimeout"]
683
text = str(TableOfClients(self.clients, keywords,
684
self.tablewords))
685
expected_text = """
686
An Integer Timedelta 1 Timedelta 2 Timedelta 3 Timedelta 4 Timedelta 5
687
0 00:00:00 00:00:01 00:00:02 00:00:03 00:00:04
688
1 1T02:03:05 1T02:03:06 1T02:03:07 1T02:03:08 1T02:03:09
689
"""[1:-1]
690
self.assertEqual(text, expected_text)
691
def test_empty_and_long_string_values(self):
692
keywords = ["String"]
693
text = str(TableOfClients(self.clients, keywords,
694
self.tablewords))
695
expected_text = """
696
A String
697
698
A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,
699
"""[1:-1]
700
self.assertEqual(text, expected_text)
701
702
703
704
def should_only_run_tests():
705
parser = argparse.ArgumentParser(add_help=False)
706
parser.add_argument("--check", action='store_true')
707
args, unknown_args = parser.parse_known_args()
708
run_tests = args.check
709
if run_tests:
710
# Remove --check argument from sys.argv
711
sys.argv[1:] = unknown_args
712
return run_tests
713
714
# Add all tests from doctest strings
715
def load_tests(loader, tests, none):
716
import doctest
717
tests.addTests(doctest.DocTestSuite())
718
return tests
719
495
720
496
if __name__ == "__main__":
721
if should_only_run_tests():
722
# Call using ./tdd-python-script --check [--verbose]
723
unittest.main()
724
else:
725
main()
497
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0