To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos-ctl
- browse files at revision 996
- compare with another revision
- download diff
- download tarball
- view history from revision 996
- Committer: Teddy Hogeborn
- Date: 2019-03-02 01:56:35 UTC
- Revision ID: teddy@recompile.se-20190302015635-xgodxd3ivltju7qn
mandos-ctl: Refactor
* mandos-ctl (global tablewords): Refactor into TableOfClients.
(TableOfClients.tablewords): New overrideable class attribute.
* mandos-ctl (global tablewords): Refactor into TableOfClients.
(TableOfClients.tablewords): New overrideable class attribute.
- files modified:
- mandos-ctl
added
removed
mandos-ctl
61
61
62
62
locale.setlocale(locale.LC_ALL, "")
63
63
64
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
64
65
domain = "se.recompile"
65
66
busname = domain + ".Mandos"
66
67
server_path = "/"
215
216
216
217
217
218
def string_to_delta(interval):
218
"""Parse a string and return a datetime.timedelta"""
219
"""Parse a string and return a datetime.timedelta
220
"""
219
221
220
222
try:
221
223
return rfc3339_duration_to_delta(interval)
226
228
227
229
228
230
def parse_pre_1_6_1_interval(interval):
229
"""Parse an interval string as documented by Mandos before 1.6.1,
230
and return a datetime.timedelta
231
231
"""Parse an interval string as documented by Mandos before 1.6.1, and
232
return a datetime.timedelta
232
233
>>> parse_pre_1_6_1_interval('7d')
233
234
datetime.timedelta(7)
234
235
>>> parse_pre_1_6_1_interval('60s')
268
269
return value
269
270
270
271
272
def print_clients(clients, keywords):
273
print('\n'.join(TableOfClients(clients, keywords).rows()))
274
271
275
class TableOfClients(object):
272
tableheaders = {
276
tablewords = {
273
277
"Name": "Name",
274
278
"Enabled": "Enabled",
275
279
"Timeout": "Timeout",
292
296
"LastCheckerStatus": "Last Checker Status",
293
297
}
294
298
295
def __init__(self, clients, keywords, tableheaders=None):
299
def __init__(self, clients, keywords, tablewords=None):
296
300
self.clients = clients
297
301
self.keywords = keywords
298
if tableheaders is not None:
299
self.tableheaders = tableheaders
300
301
def __str__(self):
302
return "\n".join(self.rows())
303
304
if sys.version_info.major == 2:
305
__unicode__ = __str__
306
def __str__(self):
307
return str(self).encode(locale.getpreferredencoding())
308
309
def rows(self):
310
format_string = self.row_formatting_string()
311
rows = [self.header_line(format_string)]
312
rows.extend(self.client_line(client, format_string)
313
for client in self.clients)
314
return rows
315
316
def row_formatting_string(self):
317
"Format string used to format table rows"
318
return " ".join("{{{key}:{width}}}".format(
319
width=max(len(self.tableheaders[key]),
320
*(len(self.string_from_client(client, key))
321
for client in self.clients)),
322
key=key)
323
for key in self.keywords)
324
325
def string_from_client(self, client, key):
326
return self.valuetostring(client[key], key)
302
if tablewords is not None:
303
self.tablewords = tablewords
327
304
328
305
@staticmethod
329
306
def valuetostring(value, keyword):
334
311
return milliseconds_to_string(value)
335
312
return str(value)
336
313
337
def header_line(self, format_string):
338
return format_string.format(**self.tableheaders)
339
340
def client_line(self, client, format_string):
341
return format_string.format(
342
**{key: self.string_from_client(client, key)
343
for key in self.keywords})
344
345
346
## Classes for commands.
347
348
# Abstract classes first
349
class Command(object):
350
"""Abstract class for commands"""
351
def run(self, clients):
352
"""Normal commands should implement run_on_one_client(), but
353
commands which want to operate on all clients at the same time
354
can override this run() method instead."""
355
for client in clients:
356
self.run_on_one_client(client)
357
358
class PrintCmd(Command):
359
"""Abstract class for commands printing client details"""
360
all_keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
361
"Created", "Interval", "Host", "KeyID",
362
"Fingerprint", "CheckerRunning", "LastEnabled",
363
"ApprovalPending", "ApprovedByDefault",
364
"LastApprovalRequest", "ApprovalDelay",
365
"ApprovalDuration", "Checker", "ExtendedTimeout",
366
"Expires", "LastCheckerStatus")
367
def run(self, clients):
368
print(self.output(clients))
369
370
class PropertyCmd(Command):
371
"""Abstract class for Actions for setting one client property"""
372
def run_on_one_client(self, client):
373
"""Set the Client's D-Bus property"""
374
client.Set(client_interface, self.property, self.value_to_set,
375
dbus_interface=dbus.PROPERTIES_IFACE)
376
377
class ValueArgumentMixIn(object):
378
"""Mixin class for commands taking a value as argument"""
379
def __init__(self, value):
380
self.value_to_set = value
381
382
class MillisecondsValueArgumentMixIn(ValueArgumentMixIn):
383
"""Mixin class for commands taking a value argument as
384
milliseconds."""
385
@property
386
def value_to_set(self):
387
return self._vts
388
@value_to_set.setter
389
def value_to_set(self, value):
390
"""When setting, convert value to a datetime.timedelta"""
391
self._vts = string_to_delta(value).total_seconds() * 1000
392
393
# Actual (non-abstract) command classes
394
395
class PrintTableCmd(PrintCmd):
396
def __init__(self, verbose=False):
397
self.verbose = verbose
398
def output(self, clients):
399
if self.verbose:
400
keywords = self.all_keywords
401
else:
402
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
403
return str(TableOfClients(clients.values(), keywords))
404
405
class DumpJSONCmd(PrintCmd):
406
def output(self, clients):
407
data = {client["Name"]:
408
{key: self.dbus_boolean_to_bool(client[key])
409
for key in self.all_keywords}
410
for client in clients.values()}
411
return json.dumps(data, indent=4, separators=(',', ': '))
412
@staticmethod
413
def dbus_boolean_to_bool(value):
414
if isinstance(value, dbus.Boolean):
415
value = bool(value)
416
return value
417
418
class IsEnabledCmd(Command):
419
def run_on_one_client(self, client):
420
if self.is_enabled(client):
421
sys.exit(0)
422
sys.exit(1)
423
def is_enabled(self, client):
424
return client.Get(client_interface, "Enabled",
425
dbus_interface=dbus.PROPERTIES_IFACE)
426
427
class RemoveCmd(Command):
428
def __init__(self, mandos):
429
self.mandos = mandos
430
def run_on_one_client(self, client):
431
self.mandos.RemoveClient(client.__dbus_object_path__)
432
433
class ApproveCmd(Command):
434
def run_on_one_client(self, client):
435
client.Approve(dbus.Boolean(True),
436
dbus_interface=client_interface)
437
438
class DenyCmd(Command):
439
def run_on_one_client(self, client):
440
client.Approve(dbus.Boolean(False),
441
dbus_interface=client_interface)
442
443
class EnableCmd(PropertyCmd):
444
property = "Enabled"
445
value_to_set = dbus.Boolean(True)
446
447
class DisableCmd(PropertyCmd):
448
property = "Enabled"
449
value_to_set = dbus.Boolean(False)
450
451
class BumpTimeoutCmd(PropertyCmd):
452
property = "LastCheckedOK"
453
value_to_set = ""
454
455
class StartCheckerCmd(PropertyCmd):
456
property = "CheckerRunning"
457
value_to_set = dbus.Boolean(True)
458
459
class StopCheckerCmd(PropertyCmd):
460
property = "CheckerRunning"
461
value_to_set = dbus.Boolean(False)
462
463
class ApproveByDefaultCmd(PropertyCmd):
464
property = "ApprovedByDefault"
465
value_to_set = dbus.Boolean(True)
466
467
class DenyByDefaultCmd(PropertyCmd):
468
property = "ApprovedByDefault"
469
value_to_set = dbus.Boolean(False)
470
471
class SetCheckerCmd(PropertyCmd, ValueArgumentMixIn):
472
property = "Checker"
473
474
class SetHostCmd(PropertyCmd, ValueArgumentMixIn):
475
property = "Host"
476
477
class SetSecretCmd(PropertyCmd, ValueArgumentMixIn):
478
property = "Secret"
479
480
class SetTimeoutCmd(PropertyCmd, MillisecondsValueArgumentMixIn):
481
property = "Timeout"
482
483
class SetExtendedTimeoutCmd(PropertyCmd,
484
MillisecondsValueArgumentMixIn):
485
property = "ExtendedTimeout"
486
487
class SetIntervalCmd(PropertyCmd, MillisecondsValueArgumentMixIn):
488
property = "Interval"
489
490
class SetApprovalDelayCmd(PropertyCmd,
491
MillisecondsValueArgumentMixIn):
492
property = "ApprovalDelay"
493
494
class SetApprovalDurationCmd(PropertyCmd,
495
MillisecondsValueArgumentMixIn):
496
property = "ApprovalDuration"
314
def rows(self):
315
# Create format string to format table rows
316
format_string = " ".join("{{{key}:{width}}}".format(
317
width=max(len(self.tablewords[key]),
318
max(len(self.valuetostring(client[key], key))
319
for client in self.clients)),
320
key=key)
321
for key in self.keywords)
322
# Start with header line
323
rows = [format_string.format(**self.tablewords)]
324
for client in self.clients:
325
rows.append(format_string
326
.format(**{key: self.valuetostring(client[key], key)
327
for key in self.keywords}))
328
return rows
329
497
330
498
331
def has_actions(options):
499
332
return any((options.enable,
527
360
help="Print all fields")
528
361
parser.add_argument("-j", "--dump-json", action="store_true",
529
362
help="Dump client data in JSON format")
530
enable_disable = parser.add_mutually_exclusive_group()
531
enable_disable.add_argument("-e", "--enable", action="store_true",
532
help="Enable client")
533
enable_disable.add_argument("-d", "--disable",
534
action="store_true",
535
help="disable client")
363
parser.add_argument("-e", "--enable", action="store_true",
364
help="Enable client")
365
parser.add_argument("-d", "--disable", action="store_true",
366
help="disable client")
536
367
parser.add_argument("-b", "--bump-timeout", action="store_true",
537
368
help="Bump timeout for client")
538
start_stop_checker = parser.add_mutually_exclusive_group()
539
start_stop_checker.add_argument("--start-checker",
540
action="store_true",
541
help="Start checker for client")
542
start_stop_checker.add_argument("--stop-checker",
543
action="store_true",
544
help="Stop checker for client")
369
parser.add_argument("--start-checker", action="store_true",
370
help="Start checker for client")
371
parser.add_argument("--stop-checker", action="store_true",
372
help="Stop checker for client")
545
373
parser.add_argument("-V", "--is-enabled", action="store_true",
546
374
help="Check if client is enabled")
547
375
parser.add_argument("-r", "--remove", action="store_true",
554
382
help="Set extended timeout for client")
555
383
parser.add_argument("-i", "--interval",
556
384
help="Set checker interval for client")
557
approve_deny_default = parser.add_mutually_exclusive_group()
558
approve_deny_default.add_argument(
559
"--approve-by-default", action="store_true",
560
default=None, dest="approved_by_default",
561
help="Set client to be approved by default")
562
approve_deny_default.add_argument(
563
"--deny-by-default", action="store_false",
564
dest="approved_by_default",
565
help="Set client to be denied by default")
385
parser.add_argument("--approve-by-default", action="store_true",
386
default=None, dest="approved_by_default",
387
help="Set client to be approved by default")
388
parser.add_argument("--deny-by-default", action="store_false",
389
dest="approved_by_default",
390
help="Set client to be denied by default")
566
391
parser.add_argument("--approval-delay",
567
392
help="Set delay before client approve/deny")
568
393
parser.add_argument("--approval-duration",
571
396
parser.add_argument("-s", "--secret",
572
397
type=argparse.FileType(mode="rb"),
573
398
help="Set password blob (file) for client")
574
approve_deny = parser.add_mutually_exclusive_group()
575
approve_deny.add_argument(
576
"-A", "--approve", action="store_true",
577
help="Approve any current client request")
578
approve_deny.add_argument("-D", "--deny", action="store_true",
579
help="Deny any current client request")
399
parser.add_argument("-A", "--approve", action="store_true",
400
help="Approve any current client request")
401
parser.add_argument("-D", "--deny", action="store_true",
402
help="Deny any current client request")
580
403
parser.add_argument("--check", action="store_true",
581
404
help="Run self-test")
582
405
parser.add_argument("client", nargs="*", help="Client name")
591
414
parser.error("--dump-json can only be used alone.")
592
415
if options.all and not has_actions(options):
593
416
parser.error("--all requires an action.")
594
if options.is_enabled and len(options.client) > 1:
595
parser.error("--is-enabled requires exactly one client")
596
417
597
418
try:
598
419
bus = dbus.SystemBus()
606
427
mandos_serv_object_manager = dbus.Interface(
607
428
mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)
608
429
609
commands = []
610
611
if options.dump_json:
612
commands.append(DumpJSONCmd())
613
614
if options.enable:
615
commands.append(EnableCmd())
616
617
if options.disable:
618
commands.append(DisableCmd())
619
620
if options.bump_timeout:
621
commands.append(BumpTimeoutCmd(options.bump_timeout))
622
623
if options.start_checker:
624
commands.append(StartCheckerCmd())
625
626
if options.stop_checker:
627
commands.append(StopCheckerCmd())
628
629
if options.is_enabled:
630
commands.append(IsEnabledCmd())
631
632
if options.remove:
633
commands.append(RemoveCmd(mandos_serv))
634
635
if options.checker is not None:
636
commands.append(SetCheckerCmd())
637
638
if options.timeout is not None:
639
commands.append(SetTimeoutCmd(options.timeout))
640
641
if options.extended_timeout:
642
commands.append(
643
SetExtendedTimeoutCmd(options.extended_timeout))
644
645
if options.interval is not None:
646
command.append(SetIntervalCmd(options.interval))
647
648
if options.approved_by_default is not None:
649
if options.approved_by_default:
650
command.append(ApproveByDefaultCmd())
651
else:
652
command.append(DenyByDefaultCmd())
653
654
if options.approval_delay is not None:
655
command.append(SetApprovalDelayCmd(options.approval_delay))
656
657
if options.approval_duration is not None:
658
command.append(
659
SetApprovalDurationCmd(options.approval_duration))
660
661
if options.host is not None:
662
command.append(SetHostCmd(options.host))
663
664
if options.secret is not None:
665
command.append(SetSecretCmd(options.secret))
666
667
if options.approve:
668
commands.append(ApproveCmd())
669
670
if options.deny:
671
commands.append(DenyCmd())
672
673
# If no command option has been given, show table of clients,
674
# optionally verbosely
675
if not commands:
676
commands.append(PrintTableCmd(verbose=options.verbose))
677
678
# Filter out log message from dbus module
679
dbus_logger = logging.getLogger("dbus.proxies")
680
class NullFilter(logging.Filter):
681
def filter(self, record):
682
return False
683
dbus_filter = NullFilter()
684
dbus_logger.addFilter(dbus_filter)
430
# block stderr since dbus library prints to stderr
431
null = os.open(os.path.devnull, os.O_RDWR)
432
stderrcopy = os.dup(sys.stderr.fileno())
433
os.dup2(null, sys.stderr.fileno())
434
os.close(null)
685
435
try:
686
436
try:
687
437
mandos_clients = {path: ifs_and_props[client_interface]
690
440
.GetManagedObjects().items()
691
441
if client_interface in ifs_and_props}
692
442
finally:
693
# restore dbus logger
694
dbus_logger.removeFilter(dbus_filter)
443
# restore stderr
444
os.dup2(stderrcopy, sys.stderr.fileno())
445
os.close(stderrcopy)
695
446
except dbus.exceptions.DBusException as e:
696
447
log.critical("Failed to access Mandos server through D-Bus:"
697
448
"\n%s", e)
714
465
log.critical("Client not found on server: %r", name)
715
466
sys.exit(1)
716
467
717
# Run all commands on clients
718
for command in commands:
719
command.run(clients)
468
if not has_actions(options) and clients:
469
if options.verbose or options.dump_json:
470
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
471
"Created", "Interval", "Host", "KeyID",
472
"Fingerprint", "CheckerRunning",
473
"LastEnabled", "ApprovalPending",
474
"ApprovedByDefault", "LastApprovalRequest",
475
"ApprovalDelay", "ApprovalDuration",
476
"Checker", "ExtendedTimeout", "Expires",
477
"LastCheckerStatus")
478
else:
479
keywords = defaultkeywords
480
481
if options.dump_json:
482
json.dump({client["Name"]: {key:
483
bool(client[key])
484
if isinstance(client[key],
485
dbus.Boolean)
486
else client[key]
487
for key in keywords}
488
for client in clients.values()},
489
fp=sys.stdout, indent=4,
490
separators=(',', ': '))
491
print()
492
else:
493
print_clients(clients.values(), keywords)
494
else:
495
# Process each client in the list by all selected options
496
for client in clients:
497
498
def set_client_prop(prop, value):
499
"""Set a Client D-Bus property"""
500
client.Set(client_interface, prop, value,
501
dbus_interface=dbus.PROPERTIES_IFACE)
502
503
def set_client_prop_ms(prop, value):
504
"""Set a Client D-Bus property, converted
505
from a string to milliseconds."""
506
set_client_prop(prop,
507
string_to_delta(value).total_seconds()
508
* 1000)
509
510
if options.remove:
511
mandos_serv.RemoveClient(client.__dbus_object_path__)
512
if options.enable:
513
set_client_prop("Enabled", dbus.Boolean(True))
514
if options.disable:
515
set_client_prop("Enabled", dbus.Boolean(False))
516
if options.bump_timeout:
517
set_client_prop("LastCheckedOK", "")
518
if options.start_checker:
519
set_client_prop("CheckerRunning", dbus.Boolean(True))
520
if options.stop_checker:
521
set_client_prop("CheckerRunning", dbus.Boolean(False))
522
if options.is_enabled:
523
if client.Get(client_interface, "Enabled",
524
dbus_interface=dbus.PROPERTIES_IFACE):
525
sys.exit(0)
526
else:
527
sys.exit(1)
528
if options.checker is not None:
529
set_client_prop("Checker", options.checker)
530
if options.host is not None:
531
set_client_prop("Host", options.host)
532
if options.interval is not None:
533
set_client_prop_ms("Interval", options.interval)
534
if options.approval_delay is not None:
535
set_client_prop_ms("ApprovalDelay",
536
options.approval_delay)
537
if options.approval_duration is not None:
538
set_client_prop_ms("ApprovalDuration",
539
options.approval_duration)
540
if options.timeout is not None:
541
set_client_prop_ms("Timeout", options.timeout)
542
if options.extended_timeout is not None:
543
set_client_prop_ms("ExtendedTimeout",
544
options.extended_timeout)
545
if options.secret is not None:
546
set_client_prop("Secret",
547
dbus.ByteArray(options.secret.read()))
548
if options.approved_by_default is not None:
549
set_client_prop("ApprovedByDefault",
550
dbus.Boolean(options
551
.approved_by_default))
552
if options.approve:
553
client.Approve(dbus.Boolean(True),
554
dbus_interface=client_interface)
555
elif options.deny:
556
client.Approve(dbus.Boolean(False),
557
dbus_interface=client_interface)
720
558
721
559
722
560
class Test_milliseconds_to_string(unittest.TestCase):
742
580
with self.assertLogs(log, logging.WARNING):
743
581
value = string_to_delta("2h")
744
582
else:
745
class WarningFilter(logging.Filter):
746
"""Don't show, but record the presence of, warnings"""
747
def filter(self, record):
748
is_warning = record.levelno >= logging.WARNING
749
self.found = is_warning or getattr(self, "found",
750
False)
751
return not is_warning
752
warning_filter = WarningFilter()
753
log.addFilter(warning_filter)
754
try:
755
value = string_to_delta("2h")
756
finally:
757
log.removeFilter(warning_filter)
758
self.assertTrue(getattr(warning_filter, "found", False))
583
value = string_to_delta("2h")
759
584
self.assertEqual(value, datetime.timedelta(0, 7200))
760
585
761
586
class Test_TableOfClients(unittest.TestCase):
762
587
def setUp(self):
763
self.tableheaders = {
588
self.tablewords = {
764
589
"Attr1": "X",
765
590
"AttrTwo": "Yy",
766
591
"AttrThree": "Zzz",
806
631
},
807
632
]
808
633
def test_short_header(self):
809
text = str(TableOfClients(self.clients, self.keywords,
810
self.tableheaders))
811
expected_text = """
812
X Yy
813
x1 y1
814
x2 y2
815
"""[1:-1]
816
self.assertEqual(text, expected_text)
634
rows = TableOfClients(self.clients, self.keywords,
635
self.tablewords).rows()
636
expected_rows = [
637
"X Yy",
638
"x1 y1",
639
"x2 y2"]
640
self.assertEqual(rows, expected_rows)
817
641
def test_booleans(self):
818
642
keywords = ["Bool", "NonDbusBoolean"]
819
text = str(TableOfClients(self.clients, keywords,
820
self.tableheaders))
821
expected_text = """
822
A D-BUS Boolean A Non-D-BUS Boolean
823
No False
824
Yes True
825
"""[1:-1]
826
self.assertEqual(text, expected_text)
643
rows = TableOfClients(self.clients, keywords,
644
self.tablewords).rows()
645
expected_rows = [
646
"A D-BUS Boolean A Non-D-BUS Boolean",
647
"No False ",
648
"Yes True ",
649
]
650
self.assertEqual(rows, expected_rows)
827
651
def test_milliseconds_detection(self):
828
652
keywords = ["Integer", "Timeout", "Interval", "ApprovalDelay",
829
653
"ApprovalDuration", "ExtendedTimeout"]
830
text = str(TableOfClients(self.clients, keywords,
831
self.tableheaders))
832
expected_text = """
654
rows = TableOfClients(self.clients, keywords,
655
self.tablewords).rows()
656
expected_rows = ("""
833
657
An Integer Timedelta 1 Timedelta 2 Timedelta 3 Timedelta 4 Timedelta 5
834
658
0 00:00:00 00:00:01 00:00:02 00:00:03 00:00:04
835
659
1 1T02:03:05 1T02:03:06 1T02:03:07 1T02:03:08 1T02:03:09
836
"""[1:-1]
837
self.assertEqual(text, expected_text)
660
"""
661
).splitlines()[1:]
662
self.assertEqual(rows, expected_rows)
838
663
def test_empty_and_long_string_values(self):
839
664
keywords = ["String"]
840
text = str(TableOfClients(self.clients, keywords,
841
self.tableheaders))
842
expected_text = """
665
rows = TableOfClients(self.clients, keywords,
666
self.tablewords).rows()
667
expected_rows = ("""
843
668
A String
844
669
845
670
A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,
846
"""[1:-1]
847
self.assertEqual(text, expected_text)
671
"""
672
).splitlines()[1:]
673
self.assertEqual(rows, expected_rows)
848
674
849
675
850
676
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0