To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos-ctl
- browse files at revision 983
- compare with another revision
- download diff
- download tarball
- view history from revision 983
- Committer: Teddy Hogeborn
- Date: 2019-02-13 08:45:09 UTC
- Revision ID: teddy@recompile.se-20190213084509-bb2uu006vip11v7l
Remove modification of debian/control file
* debian/rules (override_dh_shlibdeps-arch): Commented out.
* debian/rules (override_dh_shlibdeps-arch): Commented out.
- files added:
- bugs.xml
- debian/upstream
- plugin-helpers
- files removed:
- initramfs-tools-hook-conf
- files modified:
- DBUS-API
added
removed
mandos-ctl
1
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
#
3
#
4
4
# Mandos Monitor - Control and monitor the Mandos server
5
#
6
# Copyright © 2008-2012 Teddy Hogeborn
7
# Copyright © 2008-2012 Björn Påhlsson
8
#
9
# This program is free software: you can redistribute it and/or modify
10
# it under the terms of the GNU General Public License as published by
5
#
6
# Copyright © 2008-2019 Teddy Hogeborn
7
# Copyright © 2008-2019 Björn Påhlsson
8
#
9
# This file is part of Mandos.
10
#
11
# Mandos is free software: you can redistribute it and/or modify it
12
# under the terms of the GNU General Public License as published by
11
13
# the Free Software Foundation, either version 3 of the License, or
12
14
# (at your option) any later version.
13
15
#
14
# This program is distributed in the hope that it will be useful,
15
# but WITHOUT ANY WARRANTY; without even the implied warranty of
16
# Mandos is distributed in the hope that it will be useful, but
17
# WITHOUT ANY WARRANTY; without even the implied warranty of
16
18
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17
19
# GNU General Public License for more details.
18
#
20
#
19
21
# You should have received a copy of the GNU General Public License
20
# along with this program. If not, see
21
# <http://www.gnu.org/licenses/>.
22
#
22
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
23
#
23
24
# Contact the authors at <mandos@recompile.se>.
24
#
25
#
25
26
26
27
from __future__ import (division, absolute_import, print_function,
27
28
unicode_literals)
28
29
29
from future_builtins import *
30
try:
31
from future_builtins import *
32
except ImportError:
33
pass
30
34
31
35
import sys
32
36
import argparse
35
39
import re
36
40
import os
37
41
import collections
38
import doctest
42
import json
39
43
40
44
import dbus
41
45
46
if sys.version_info.major == 2:
47
str = unicode
48
42
49
locale.setlocale(locale.LC_ALL, "")
43
50
44
51
tablewords = {
51
58
"Interval": "Interval",
52
59
"Host": "Host",
53
60
"Fingerprint": "Fingerprint",
61
"KeyID": "Key ID",
54
62
"CheckerRunning": "Check Is Running",
55
63
"LastEnabled": "Last Enabled",
56
64
"ApprovalPending": "Approval Is Pending",
58
66
"ApprovalDelay": "Approval Delay",
59
67
"ApprovalDuration": "Approval Duration",
60
68
"Checker": "Checker",
61
"ExtendedTimeout" : "Extended Timeout"
62
}
69
"ExtendedTimeout": "Extended Timeout",
70
"Expires": "Expires",
71
"LastCheckerStatus": "Last Checker Status",
72
}
63
73
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
64
74
domain = "se.recompile"
65
75
busname = domain + ".Mandos"
66
76
server_path = "/"
67
77
server_interface = domain + ".Mandos"
68
78
client_interface = domain + ".Mandos.Client"
69
version = "1.6.0"
70
71
def timedelta_to_milliseconds(td):
72
"""Convert a datetime.timedelta object to milliseconds"""
73
return ((td.days * 24 * 60 * 60 * 1000)
74
+ (td.seconds * 1000)
75
+ (td.microseconds // 1000))
79
version = "1.8.3"
80
81
82
try:
83
dbus.OBJECT_MANAGER_IFACE
84
except AttributeError:
85
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
86
76
87
77
88
def milliseconds_to_string(ms):
78
89
td = datetime.timedelta(0, 0, 0, ms)
79
90
return ("{days}{hours:02}:{minutes:02}:{seconds:02}"
80
.format(days = "{0}T".format(td.days) if td.days else "",
81
hours = td.seconds // 3600,
82
minutes = (td.seconds % 3600) // 60,
83
seconds = td.seconds % 60,
84
))
91
.format(days="{}T".format(td.days) if td.days else "",
92
hours=td.seconds // 3600,
93
minutes=(td.seconds % 3600) // 60,
94
seconds=td.seconds % 60))
85
95
86
96
87
97
def rfc3339_duration_to_delta(duration):
88
"""Parse a RFC 3339 "duration" and return a datetime.timedelta
89
98
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
99
90
100
>>> rfc3339_duration_to_delta("P7D")
91
101
datetime.timedelta(7)
92
102
>>> rfc3339_duration_to_delta("PT60S")
102
112
>>> rfc3339_duration_to_delta("P1DT3M20S")
103
113
datetime.timedelta(1, 200)
104
114
"""
105
106
# Parsing a RFC 3339 duration with regular expressions is not
115
116
# Parsing an RFC 3339 duration with regular expressions is not
107
117
# possible - there would have to be multiple places for the same
108
# values, like seconds. This, while more esoteric, is cleaner
109
# without depending on a parsing library. If Python had a
118
# values, like seconds. The current code, while more esoteric, is
119
# cleaner without depending on a parsing library. If Python had a
110
120
# built-in library for parsing we would use it, but we'd like to
111
121
# avoid excessive use of external libraries.
112
122
113
123
# New type for defining tokens, syntax, and semantics all-in-one
114
Token = collections.namedtuple("Token",
115
("regexp", # To match token; if
116
# "value" is not None,
117
# must have a "group"
118
# containing digits
119
"value", # datetime.timedelta or
120
# None
121
"followers")) # Tokens valid after
122
# this token
124
Token = collections.namedtuple("Token", (
125
"regexp", # To match token; if "value" is not None, must have
126
# a "group" containing digits
127
"value", # datetime.timedelta or None
128
"followers")) # Tokens valid after this token
123
129
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
124
130
# the "duration" ABNF definition in RFC 3339, Appendix A.
125
131
token_end = Token(re.compile(r"$"), None, frozenset())
126
132
token_second = Token(re.compile(r"(\d+)S"),
127
133
datetime.timedelta(seconds=1),
128
frozenset((token_end,)))
134
frozenset((token_end, )))
129
135
token_minute = Token(re.compile(r"(\d+)M"),
130
136
datetime.timedelta(minutes=1),
131
137
frozenset((token_second, token_end)))
147
153
frozenset((token_month, token_end)))
148
154
token_week = Token(re.compile(r"(\d+)W"),
149
155
datetime.timedelta(weeks=1),
150
frozenset((token_end,)))
156
frozenset((token_end, )))
151
157
token_duration = Token(re.compile(r"P"), None,
152
158
frozenset((token_year, token_month,
153
159
token_day, token_time,
154
token_week))),
155
# Define starting values
156
value = datetime.timedelta() # Value so far
160
token_week)))
161
# Define starting values:
162
# Value so far
163
value = datetime.timedelta()
157
164
found_token = None
158
followers = frozenset(token_duration,) # Following valid tokens
159
s = duration # String left to parse
165
# Following valid tokens
166
followers = frozenset((token_duration, ))
167
# String left to parse
168
s = duration
160
169
# Loop until end token is found
161
170
while found_token is not token_end:
162
171
# Search for any currently valid tokens
178
187
break
179
188
else:
180
189
# No currently valid tokens were found
181
raise ValueError("Invalid RFC 3339 duration")
190
raise ValueError("Invalid RFC 3339 duration: {!r}"
191
.format(duration))
182
192
# End token found
183
193
return value
184
194
185
195
186
196
def string_to_delta(interval):
187
197
"""Parse a string and return a datetime.timedelta
188
189
>>> string_to_delta("7d")
198
199
>>> string_to_delta('7d')
190
200
datetime.timedelta(7)
191
>>> string_to_delta("60s")
201
>>> string_to_delta('60s')
192
202
datetime.timedelta(0, 60)
193
>>> string_to_delta("60m")
203
>>> string_to_delta('60m')
194
204
datetime.timedelta(0, 3600)
195
>>> string_to_delta("24h")
205
>>> string_to_delta('24h')
196
206
datetime.timedelta(1)
197
>>> string_to_delta("1w")
207
>>> string_to_delta('1w')
198
208
datetime.timedelta(7)
199
>>> string_to_delta("5m 30s")
209
>>> string_to_delta('5m 30s')
200
210
datetime.timedelta(0, 330)
201
211
"""
202
value = datetime.timedelta(0)
203
regexp = re.compile(r"(\d+)([dsmhw]?)")
204
212
205
213
try:
206
214
return rfc3339_duration_to_delta(interval)
207
215
except ValueError:
208
216
pass
209
217
218
value = datetime.timedelta(0)
219
regexp = re.compile(r"(\d+)([dsmhw]?)")
220
210
221
for num, suffix in regexp.findall(interval):
211
222
if suffix == "d":
212
223
value += datetime.timedelta(int(num))
222
233
value += datetime.timedelta(0, 0, 0, int(num))
223
234
return value
224
235
236
225
237
def print_clients(clients, keywords):
226
238
def valuetostring(value, keyword):
227
239
if type(value) is dbus.Boolean:
229
241
if keyword in ("Timeout", "Interval", "ApprovalDelay",
230
242
"ApprovalDuration", "ExtendedTimeout"):
231
243
return milliseconds_to_string(value)
232
return unicode(value)
233
244
return str(value)
245
234
246
# Create format string to print table rows
235
247
format_string = " ".join("{{{key}:{width}}}".format(
236
width = max(len(tablewords[key]),
237
max(len(valuetostring(client[key],
238
key))
239
for client in
240
clients)),
241
key = key) for key in keywords)
248
width=max(len(tablewords[key]),
249
max(len(valuetostring(client[key], key))
250
for client in clients)),
251
key=key)
252
for key in keywords)
242
253
# Print header line
243
254
print(format_string.format(**tablewords))
244
255
for client in clients:
245
print(format_string.format(**dict((key,
246
valuetostring(client[key],
247
key))
248
for key in keywords)))
256
print(format_string
257
.format(**{key: valuetostring(client[key], key)
258
for key in keywords}))
259
249
260
250
261
def has_actions(options):
251
262
return any((options.enable,
267
278
options.approve,
268
279
options.deny))
269
280
281
270
282
def main():
271
283
parser = argparse.ArgumentParser()
272
284
parser.add_argument("--version", action="version",
273
version = "%(prog)s {0}".format(version),
285
version="%(prog)s {}".format(version),
274
286
help="show version number and exit")
275
287
parser.add_argument("-a", "--all", action="store_true",
276
288
help="Select all clients")
277
289
parser.add_argument("-v", "--verbose", action="store_true",
278
290
help="Print all fields")
291
parser.add_argument("-j", "--dump-json", action="store_true",
292
help="Dump client data in JSON format")
279
293
parser.add_argument("-e", "--enable", action="store_true",
280
294
help="Enable client")
281
295
parser.add_argument("-d", "--disable", action="store_true",
309
323
parser.add_argument("--approval-duration",
310
324
help="Set duration of one client approval")
311
325
parser.add_argument("-H", "--host", help="Set host for client")
312
parser.add_argument("-s", "--secret", type=file,
326
parser.add_argument("-s", "--secret",
327
type=argparse.FileType(mode="rb"),
313
328
help="Set password blob (file) for client")
314
329
parser.add_argument("-A", "--approve", action="store_true",
315
330
help="Approve any current client request")
319
334
help="Run self-test")
320
335
parser.add_argument("client", nargs="*", help="Client name")
321
336
options = parser.parse_args()
322
337
323
338
if has_actions(options) and not (options.client or options.all):
324
339
parser.error("Options require clients names or --all.")
325
340
if options.verbose and has_actions(options):
326
parser.error("--verbose can only be used alone or with"
327
" --all.")
341
parser.error("--verbose can only be used alone.")
342
if options.dump_json and (options.verbose
343
or has_actions(options)):
344
parser.error("--dump-json can only be used alone.")
328
345
if options.all and not has_actions(options):
329
346
parser.error("--all requires an action.")
330
347
331
348
if options.check:
349
import doctest
332
350
fail_count, test_count = doctest.testmod()
333
sys.exit(0 if fail_count == 0 else 1)
334
351
sys.exit(os.EX_OK if fail_count == 0 else 1)
352
335
353
try:
336
354
bus = dbus.SystemBus()
337
355
mandos_dbus_objc = bus.get_object(busname, server_path)
338
356
except dbus.exceptions.DBusException:
339
print("Could not connect to Mandos server",
340
file=sys.stderr)
357
print("Could not connect to Mandos server", file=sys.stderr)
341
358
sys.exit(1)
342
359
343
360
mandos_serv = dbus.Interface(mandos_dbus_objc,
344
dbus_interface = server_interface)
345
346
#block stderr since dbus library prints to stderr
361
dbus_interface=server_interface)
362
mandos_serv_object_manager = dbus.Interface(
363
mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)
364
365
# block stderr since dbus library prints to stderr
347
366
null = os.open(os.path.devnull, os.O_RDWR)
348
367
stderrcopy = os.dup(sys.stderr.fileno())
349
368
os.dup2(null, sys.stderr.fileno())
350
369
os.close(null)
351
370
try:
352
371
try:
353
mandos_clients = mandos_serv.GetAllClientsWithProperties()
372
mandos_clients = {path: ifs_and_props[client_interface]
373
for path, ifs_and_props in
374
mandos_serv_object_manager
375
.GetManagedObjects().items()
376
if client_interface in ifs_and_props}
354
377
finally:
355
#restore stderr
378
# restore stderr
356
379
os.dup2(stderrcopy, sys.stderr.fileno())
357
380
os.close(stderrcopy)
358
except dbus.exceptions.DBusException:
359
print("Access denied: Accessing mandos server through dbus.",
381
except dbus.exceptions.DBusException as e:
382
print("Access denied: "
383
"Accessing mandos server through D-Bus: {}".format(e),
360
384
file=sys.stderr)
361
385
sys.exit(1)
362
386
363
387
# Compile dict of (clients: properties) to process
364
clients={}
365
388
clients = {}
389
366
390
if options.all or not options.client:
367
clients = dict((bus.get_object(busname, path), properties)
368
for path, properties in
369
mandos_clients.iteritems())
391
clients = {bus.get_object(busname, path): properties
392
for path, properties in mandos_clients.items()}
370
393
else:
371
394
for name in options.client:
372
for path, client in mandos_clients.iteritems():
395
for path, client in mandos_clients.items():
373
396
if client["Name"] == name:
374
397
client_objc = bus.get_object(busname, path)
375
398
clients[client_objc] = client
376
399
break
377
400
else:
378
print("Client not found on server: {0!r}"
401
print("Client not found on server: {!r}"
379
402
.format(name), file=sys.stderr)
380
403
sys.exit(1)
381
404
382
405
if not has_actions(options) and clients:
383
if options.verbose:
384
keywords = ("Name", "Enabled", "Timeout",
385
"LastCheckedOK", "Created", "Interval",
386
"Host", "Fingerprint", "CheckerRunning",
406
if options.verbose or options.dump_json:
407
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
408
"Created", "Interval", "Host", "KeyID",
409
"Fingerprint", "CheckerRunning",
387
410
"LastEnabled", "ApprovalPending",
388
"ApprovedByDefault",
389
"LastApprovalRequest", "ApprovalDelay",
390
"ApprovalDuration", "Checker",
391
"ExtendedTimeout")
411
"ApprovedByDefault", "LastApprovalRequest",
412
"ApprovalDelay", "ApprovalDuration",
413
"Checker", "ExtendedTimeout", "Expires",
414
"LastCheckerStatus")
392
415
else:
393
416
keywords = defaultkeywords
394
395
print_clients(clients.values(), keywords)
417
418
if options.dump_json:
419
json.dump({client["Name"]: {key:
420
bool(client[key])
421
if isinstance(client[key],
422
dbus.Boolean)
423
else client[key]
424
for key in keywords}
425
for client in clients.values()},
426
fp=sys.stdout, indent=4,
427
separators=(',', ': '))
428
print()
429
else:
430
print_clients(clients.values(), keywords)
396
431
else:
397
432
# Process each client in the list by all selected options
398
433
for client in clients:
434
399
435
def set_client_prop(prop, value):
400
436
"""Set a Client D-Bus property"""
401
437
client.Set(client_interface, prop, value,
402
438
dbus_interface=dbus.PROPERTIES_IFACE)
439
403
440
def set_client_prop_ms(prop, value):
404
441
"""Set a Client D-Bus property, converted
405
442
from a string to milliseconds."""
406
443
set_client_prop(prop,
407
timedelta_to_milliseconds
408
(string_to_delta(value)))
444
string_to_delta(value).total_seconds()
445
* 1000)
446
409
447
if options.remove:
410
448
mandos_serv.RemoveClient(client.__dbus_object_path__)
411
449
if options.enable:
419
457
if options.stop_checker:
420
458
set_client_prop("CheckerRunning", dbus.Boolean(False))
421
459
if options.is_enabled:
422
sys.exit(0 if client.Get(client_interface,
423
"Enabled",
424
dbus_interface=
425
dbus.PROPERTIES_IFACE)
426
else 1)
460
if client.Get(client_interface, "Enabled",
461
dbus_interface=dbus.PROPERTIES_IFACE):
462
sys.exit(0)
463
else:
464
sys.exit(1)
427
465
if options.checker is not None:
428
466
set_client_prop("Checker", options.checker)
429
467
if options.host is not None:
455
493
client.Approve(dbus.Boolean(False),
456
494
dbus_interface=client_interface)
457
495
496
458
497
if __name__ == "__main__":
459
498
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0