2
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos Monitor - Control and monitor the Mandos server
6
# Copyright © 2008-2014 Teddy Hogeborn
7
# Copyright © 2008-2014 Björn Påhlsson
9
# This program is free software: you can redistribute it and/or modify
10
# it under the terms of the GNU General Public License as published by
6
# Copyright © 2008-2018 Teddy Hogeborn
7
# Copyright © 2008-2018 Björn Påhlsson
9
# This file is part of Mandos.
11
# Mandos is free software: you can redistribute it and/or modify it
12
# under the terms of the GNU General Public License as published by
11
13
# the Free Software Foundation, either version 3 of the License, or
12
14
# (at your option) any later version.
14
# This program is distributed in the hope that it will be useful,
15
# but WITHOUT ANY WARRANTY; without even the implied warranty of
16
# Mandos is distributed in the hope that it will be useful, but
17
# WITHOUT ANY WARRANTY; without even the implied warranty of
16
18
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17
19
# GNU General Public License for more details.
19
21
# You should have received a copy of the GNU General Public License
20
# along with this program. If not, see
21
# <http://www.gnu.org/licenses/>.
22
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
23
24
# Contact the authors at <mandos@recompile.se>.
26
27
from __future__ import (division, absolute_import, print_function,
64
66
"ApprovalDelay": "Approval Delay",
65
67
"ApprovalDuration": "Approval Duration",
66
68
"Checker": "Checker",
67
"ExtendedTimeout" : "Extended Timeout"
69
"ExtendedTimeout": "Extended Timeout",
71
"LastCheckerStatus": "Last Checker Status",
69
73
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
70
74
domain = "se.recompile"
71
75
busname = domain + ".Mandos"
73
77
server_interface = domain + ".Mandos"
74
78
client_interface = domain + ".Mandos.Client"
77
def timedelta_to_milliseconds(td):
78
"""Convert a datetime.timedelta object to milliseconds"""
79
return ((td.days * 24 * 60 * 60 * 1000)
81
+ (td.microseconds // 1000))
83
dbus.OBJECT_MANAGER_IFACE
84
except AttributeError:
85
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
83
88
def milliseconds_to_string(ms):
84
89
td = datetime.timedelta(0, 0, 0, ms)
85
90
return ("{days}{hours:02}:{minutes:02}:{seconds:02}"
86
.format(days = "{}T".format(td.days) if td.days else "",
87
hours = td.seconds // 3600,
88
minutes = (td.seconds % 3600) // 60,
89
seconds = td.seconds % 60,
91
.format(days="{}T".format(td.days) if td.days else "",
92
hours=td.seconds // 3600,
93
minutes=(td.seconds % 3600) // 60,
94
seconds=td.seconds % 60))
93
97
def rfc3339_duration_to_delta(duration):
94
98
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
96
100
>>> rfc3339_duration_to_delta("P7D")
97
101
datetime.timedelta(7)
98
102
>>> rfc3339_duration_to_delta("PT60S")
108
112
>>> rfc3339_duration_to_delta("P1DT3M20S")
109
113
datetime.timedelta(1, 200)
112
116
# Parsing an RFC 3339 duration with regular expressions is not
113
117
# possible - there would have to be multiple places for the same
114
118
# values, like seconds. The current code, while more esoteric, is
115
119
# cleaner without depending on a parsing library. If Python had a
116
120
# built-in library for parsing we would use it, but we'd like to
117
121
# avoid excessive use of external libraries.
119
123
# New type for defining tokens, syntax, and semantics all-in-one
120
Token = collections.namedtuple("Token",
121
("regexp", # To match token; if
122
# "value" is not None,
123
# must have a "group"
125
"value", # datetime.timedelta or
127
"followers")) # Tokens valid after
124
Token = collections.namedtuple("Token", (
125
"regexp", # To match token; if "value" is not None, must have
126
# a "group" containing digits
127
"value", # datetime.timedelta or None
128
"followers")) # Tokens valid after this token
129
129
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
130
130
# the "duration" ABNF definition in RFC 3339, Appendix A.
131
131
token_end = Token(re.compile(r"$"), None, frozenset())
132
132
token_second = Token(re.compile(r"(\d+)S"),
133
133
datetime.timedelta(seconds=1),
134
frozenset((token_end,)))
134
frozenset((token_end, )))
135
135
token_minute = Token(re.compile(r"(\d+)M"),
136
136
datetime.timedelta(minutes=1),
137
137
frozenset((token_second, token_end)))
153
153
frozenset((token_month, token_end)))
154
154
token_week = Token(re.compile(r"(\d+)W"),
155
155
datetime.timedelta(weeks=1),
156
frozenset((token_end,)))
156
frozenset((token_end, )))
157
157
token_duration = Token(re.compile(r"P"), None,
158
158
frozenset((token_year, token_month,
159
159
token_day, token_time,
161
# Define starting values
162
value = datetime.timedelta() # Value so far
161
# Define starting values:
163
value = datetime.timedelta()
163
164
found_token = None
164
followers = frozenset((token_duration,)) # Following valid tokens
165
s = duration # String left to parse
165
# Following valid tokens
166
followers = frozenset((token_duration, ))
167
# String left to parse
166
169
# Loop until end token is found
167
170
while found_token is not token_end:
168
171
# Search for any currently valid tokens
186
189
# No currently valid tokens were found
187
raise ValueError("Invalid RFC 3339 duration")
190
raise ValueError("Invalid RFC 3339 duration: {!r}"
188
192
# End token found
192
196
def string_to_delta(interval):
193
197
"""Parse a string and return a datetime.timedelta
195
>>> string_to_delta("7d")
199
>>> string_to_delta('7d')
196
200
datetime.timedelta(7)
197
>>> string_to_delta("60s")
201
>>> string_to_delta('60s')
198
202
datetime.timedelta(0, 60)
199
>>> string_to_delta("60m")
203
>>> string_to_delta('60m')
200
204
datetime.timedelta(0, 3600)
201
>>> string_to_delta("24h")
205
>>> string_to_delta('24h')
202
206
datetime.timedelta(1)
203
>>> string_to_delta("1w")
207
>>> string_to_delta('1w')
204
208
datetime.timedelta(7)
205
>>> string_to_delta("5m 30s")
209
>>> string_to_delta('5m 30s')
206
210
datetime.timedelta(0, 330)
210
214
return rfc3339_duration_to_delta(interval)
211
215
except ValueError:
214
218
value = datetime.timedelta(0)
215
219
regexp = re.compile(r"(\d+)([dsmhw]?)")
217
221
for num, suffix in regexp.findall(interval):
218
222
if suffix == "d":
219
223
value += datetime.timedelta(int(num))
237
242
"ApprovalDuration", "ExtendedTimeout"):
238
243
return milliseconds_to_string(value)
239
244
return str(value)
241
246
# Create format string to print table rows
242
247
format_string = " ".join("{{{key}:{width}}}".format(
243
width = max(len(tablewords[key]),
244
max(len(valuetostring(client[key],
248
key = key) for key in keywords)
248
width=max(len(tablewords[key]),
249
max(len(valuetostring(client[key], key))
250
for client in clients)),
249
253
# Print header line
250
254
print(format_string.format(**tablewords))
251
255
for client in clients:
252
print(format_string.format(**{ key:
253
valuetostring(client[key],
255
for key in keywords }))
257
.format(**{key: valuetostring(client[key], key)
258
for key in keywords}))
257
261
def has_actions(options):
258
262
return any((options.enable,
278
283
parser = argparse.ArgumentParser()
279
284
parser.add_argument("--version", action="version",
280
version = "%(prog)s {}".format(version),
285
version="%(prog)s {}".format(version),
281
286
help="show version number and exit")
282
287
parser.add_argument("-a", "--all", action="store_true",
283
288
help="Select all clients")
284
289
parser.add_argument("-v", "--verbose", action="store_true",
285
290
help="Print all fields")
291
parser.add_argument("-j", "--dump-json", action="store_true",
292
help="Dump client data in JSON format")
286
293
parser.add_argument("-e", "--enable", action="store_true",
287
294
help="Enable client")
288
295
parser.add_argument("-d", "--disable", action="store_true",
327
334
help="Run self-test")
328
335
parser.add_argument("client", nargs="*", help="Client name")
329
336
options = parser.parse_args()
331
338
if has_actions(options) and not (options.client or options.all):
332
339
parser.error("Options require clients names or --all.")
333
340
if options.verbose and has_actions(options):
334
parser.error("--verbose can only be used alone or with"
341
parser.error("--verbose can only be used alone.")
342
if options.dump_json and (options.verbose
343
or has_actions(options)):
344
parser.error("--dump-json can only be used alone.")
336
345
if options.all and not has_actions(options):
337
346
parser.error("--all requires an action.")
339
348
if options.check:
340
350
fail_count, test_count = doctest.testmod()
341
351
sys.exit(os.EX_OK if fail_count == 0 else 1)
344
354
bus = dbus.SystemBus()
345
355
mandos_dbus_objc = bus.get_object(busname, server_path)
346
356
except dbus.exceptions.DBusException:
347
print("Could not connect to Mandos server",
357
print("Could not connect to Mandos server", file=sys.stderr)
351
360
mandos_serv = dbus.Interface(mandos_dbus_objc,
352
dbus_interface = server_interface)
354
#block stderr since dbus library prints to stderr
361
dbus_interface=server_interface)
362
mandos_serv_object_manager = dbus.Interface(
363
mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)
365
# block stderr since dbus library prints to stderr
355
366
null = os.open(os.path.devnull, os.O_RDWR)
356
367
stderrcopy = os.dup(sys.stderr.fileno())
357
368
os.dup2(null, sys.stderr.fileno())
361
mandos_clients = mandos_serv.GetAllClientsWithProperties()
372
mandos_clients = {path: ifs_and_props[client_interface]
373
for path, ifs_and_props in
374
mandos_serv_object_manager
375
.GetManagedObjects().items()
376
if client_interface in ifs_and_props}
364
379
os.dup2(stderrcopy, sys.stderr.fileno())
365
380
os.close(stderrcopy)
366
except dbus.exceptions.DBusException:
367
print("Access denied: Accessing mandos server through dbus.",
381
except dbus.exceptions.DBusException as e:
382
print("Access denied: "
383
"Accessing mandos server through D-Bus: {}".format(e),
371
387
# Compile dict of (clients: properties) to process
374
390
if options.all or not options.client:
375
clients = { bus.get_object(busname, path): properties
376
for path, properties in mandos_clients.items() }
391
clients = {bus.get_object(busname, path): properties
392
for path, properties in mandos_clients.items()}
378
394
for name in options.client:
379
395
for path, client in mandos_clients.items():
385
401
print("Client not found on server: {!r}"
386
402
.format(name), file=sys.stderr)
389
405
if not has_actions(options) and clients:
391
keywords = ("Name", "Enabled", "Timeout",
392
"LastCheckedOK", "Created", "Interval",
393
"Host", "Fingerprint", "CheckerRunning",
406
if options.verbose or options.dump_json:
407
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
408
"Created", "Interval", "Host", "KeyID",
409
"Fingerprint", "CheckerRunning",
394
410
"LastEnabled", "ApprovalPending",
396
"LastApprovalRequest", "ApprovalDelay",
397
"ApprovalDuration", "Checker",
411
"ApprovedByDefault", "LastApprovalRequest",
412
"ApprovalDelay", "ApprovalDuration",
413
"Checker", "ExtendedTimeout", "Expires",
400
416
keywords = defaultkeywords
402
print_clients(clients.values(), keywords)
418
if options.dump_json:
419
json.dump({client["Name"]: {key:
421
if isinstance(client[key],
425
for client in clients.values()},
426
fp=sys.stdout, indent=4,
427
separators=(',', ': '))
430
print_clients(clients.values(), keywords)
404
432
# Process each client in the list by all selected options
405
433
for client in clients:
406
435
def set_client_prop(prop, value):
407
436
"""Set a Client D-Bus property"""
408
437
client.Set(client_interface, prop, value,
409
438
dbus_interface=dbus.PROPERTIES_IFACE)
410
440
def set_client_prop_ms(prop, value):
411
441
"""Set a Client D-Bus property, converted
412
442
from a string to milliseconds."""
413
443
set_client_prop(prop,
414
timedelta_to_milliseconds
415
(string_to_delta(value)))
444
string_to_delta(value).total_seconds()
416
447
if options.remove:
417
448
mandos_serv.RemoveClient(client.__dbus_object_path__)
418
449
if options.enable:
426
457
if options.stop_checker:
427
458
set_client_prop("CheckerRunning", dbus.Boolean(False))
428
459
if options.is_enabled:
429
sys.exit(0 if client.Get(client_interface,
432
dbus.PROPERTIES_IFACE)
460
if client.Get(client_interface, "Enabled",
461
dbus_interface=dbus.PROPERTIES_IFACE):
434
465
if options.checker is not None:
435
466
set_client_prop("Checker", options.checker)
436
467
if options.host is not None: