/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release
24.1.116 by Björn Påhlsson
added a mandos list client program
1
#!/usr/bin/python
237.7.533 by Teddy Hogeborn
Make Emacs run tests when mandos-ctl file is saved
2
# -*- mode: python; coding: utf-8; after-save-hook: (lambda () (let ((command (if (and (boundp 'tramp-file-name-structure) (string-match (car tramp-file-name-structure) (buffer-file-name))) (tramp-file-name-localname (tramp-dissect-file-name (buffer-file-name))) (buffer-file-name)))) (if (= (shell-command (format "%s --check" (shell-quote-argument command)) "*Test*") 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)) (kill-buffer "*Test*")) (display-buffer "*Test*")))); -*-
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
3
#
237.2.207 by Teddy Hogeborn
Update copyright year to "2010" wherever appropriate.
4
# Mandos Monitor - Control and monitor the Mandos server
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
5
#
237.7.517 by Teddy Hogeborn
Update copyright year to 2019
6
# Copyright © 2008-2019 Teddy Hogeborn
7
# Copyright © 2008-2019 Björn Påhlsson
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
8
#
237.7.455 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
9
# This file is part of Mandos.
10
#
11
# Mandos is free software: you can redistribute it and/or modify it
12
# under the terms of the GNU General Public License as published by
237.2.207 by Teddy Hogeborn
Update copyright year to "2010" wherever appropriate.
13
# the Free Software Foundation, either version 3 of the License, or
14
# (at your option) any later version.
15
#
237.7.455 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
16
#     Mandos is distributed in the hope that it will be useful, but
17
#     WITHOUT ANY WARRANTY; without even the implied warranty of
237.2.207 by Teddy Hogeborn
Update copyright year to "2010" wherever appropriate.
18
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19
#     GNU General Public License for more details.
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
20
#
237.2.207 by Teddy Hogeborn
Update copyright year to "2010" wherever appropriate.
21
# You should have received a copy of the GNU General Public License
237.7.455 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
22
# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
23
#
237.11.2 by Teddy Hogeborn
Change "fukt.bsnet.se" to "recompile.se" throughout.
24
# Contact the authors at <mandos@recompile.se>.
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
25
#
24.1.116 by Björn Påhlsson
added a mandos list client program
26
237.8.9 by teddy at bsnet
* mandos-ctl: Use print function.
27
from __future__ import (division, absolute_import, print_function,
28
                        unicode_literals)
237.8.8 by teddy at bsnet
* mandos-ctl: Use unicode string literals.
29
237.7.266 by Teddy Hogeborn
mandos-ctl: Make it work in Python 3.
30
try:
31
    from future_builtins import *
32
except ImportError:
33
    pass
237.7.127 by Teddy Hogeborn
* mandos: Use all new builtins.
34
24.1.119 by Björn Påhlsson
Added more method support for mandos clients through mandos-ctl
35
import sys
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
36
import argparse
237.2.3 by Teddy Hogeborn
Merge "mandos-list" from belorn.
37
import locale
24.1.121 by Björn Påhlsson
mandos-ctl: Added support for all client calls
38
import datetime
39
import re
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
40
import os
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
41
import collections
237.7.411 by Teddy Hogeborn
mandos-ctl: Implement --dump-json option
42
import json
237.7.532 by Teddy Hogeborn
Make mandos-ctl use unittest instead of doctest module
43
import unittest
237.7.535 by Teddy Hogeborn
mandos-ctl: Use logging module instead of print() for errors
44
import logging
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
45
46
import dbus
237.2.3 by Teddy Hogeborn
Merge "mandos-list" from belorn.
47
237.7.536 by Teddy Hogeborn
mandos-ctl: Show warnings
48
# Show warnings by default
49
if not sys.warnoptions:
50
    import warnings
51
    warnings.simplefilter("default")
52
237.7.535 by Teddy Hogeborn
mandos-ctl: Use logging module instead of print() for errors
53
log = logging.getLogger(sys.argv[0])
54
logging.basicConfig(level="INFO", # Show info level messages
55
                    format="%(message)s") # Show basic log messages
56
237.7.536 by Teddy Hogeborn
mandos-ctl: Show warnings
57
logging.captureWarnings(True)   # Show warnings via the logging system
58
237.23.7 by Teddy Hogeborn
Use the .major attribute on sys.version_info instead of using "[0]".
59
if sys.version_info.major == 2:
237.7.266 by Teddy Hogeborn
mandos-ctl: Make it work in Python 3.
60
    str = unicode
61
237.8.8 by teddy at bsnet
* mandos-ctl: Use unicode string literals.
62
locale.setlocale(locale.LC_ALL, "")
24.1.116 by Björn Påhlsson
added a mandos list client program
63
64
tablewords = {
237.8.8 by teddy at bsnet
* mandos-ctl: Use unicode string literals.
65
    "Name": "Name",
66
    "Enabled": "Enabled",
67
    "Timeout": "Timeout",
68
    "LastCheckedOK": "Last Successful Check",
69
    "LastApprovalRequest": "Last Approval Request",
70
    "Created": "Created",
71
    "Interval": "Interval",
72
    "Host": "Host",
73
    "Fingerprint": "Fingerprint",
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
74
    "KeyID": "Key ID",
237.8.8 by teddy at bsnet
* mandos-ctl: Use unicode string literals.
75
    "CheckerRunning": "Check Is Running",
76
    "LastEnabled": "Last Enabled",
77
    "ApprovalPending": "Approval Is Pending",
78
    "ApprovedByDefault": "Approved By Default",
79
    "ApprovalDelay": "Approval Delay",
80
    "ApprovalDuration": "Approval Duration",
81
    "Checker": "Checker",
237.7.413 by Teddy Hogeborn
mandos-ctl: Include "Expires" and "LastCheckerStatus" properties
82
    "ExtendedTimeout": "Extended Timeout",
83
    "Expires": "Expires",
84
    "LastCheckerStatus": "Last Checker Status",
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
85
}
237.8.8 by teddy at bsnet
* mandos-ctl: Use unicode string literals.
86
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
24.1.186 by Björn Påhlsson
transitional stuff actually working
87
domain = "se.recompile"
237.8.8 by teddy at bsnet
* mandos-ctl: Use unicode string literals.
88
busname = domain + ".Mandos"
89
server_path = "/"
90
server_interface = domain + ".Mandos"
91
client_interface = domain + ".Mandos.Client"
377 by Teddy Hogeborn
* Makefile (version): Change to 1.8.3.
92
version = "1.8.3"
24.1.118 by Björn Påhlsson
Added enable/disable
93
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
94
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
95
try:
96
    dbus.OBJECT_MANAGER_IFACE
97
except AttributeError:
98
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
99
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
100
24.1.121 by Björn Påhlsson
mandos-ctl: Added support for all client calls
101
def milliseconds_to_string(ms):
102
    td = datetime.timedelta(0, 0, 0, ms)
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
103
    return ("{days}{hours:02}:{minutes:02}:{seconds:02}"
104
            .format(days="{}T".format(td.days) if td.days else "",
105
                    hours=td.seconds // 3600,
106
                    minutes=(td.seconds % 3600) // 60,
107
                    seconds=td.seconds % 60))
24.1.121 by Björn Påhlsson
mandos-ctl: Added support for all client calls
108
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
109
110
def rfc3339_duration_to_delta(duration):
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
111
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
112
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
113
    >>> rfc3339_duration_to_delta("P7D")
114
    datetime.timedelta(7)
115
    >>> rfc3339_duration_to_delta("PT60S")
116
    datetime.timedelta(0, 60)
117
    >>> rfc3339_duration_to_delta("PT60M")
118
    datetime.timedelta(0, 3600)
237.7.538 by Teddy Hogeborn
mandos-ctl (rfc3339_duration_to_delta): Improve tests
119
    >>> rfc3339_duration_to_delta("P60M")
120
    datetime.timedelta(1680)
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
121
    >>> rfc3339_duration_to_delta("PT24H")
122
    datetime.timedelta(1)
123
    >>> rfc3339_duration_to_delta("P1W")
124
    datetime.timedelta(7)
125
    >>> rfc3339_duration_to_delta("PT5M30S")
126
    datetime.timedelta(0, 330)
127
    >>> rfc3339_duration_to_delta("P1DT3M20S")
128
    datetime.timedelta(1, 200)
237.7.538 by Teddy Hogeborn
mandos-ctl (rfc3339_duration_to_delta): Improve tests
129
    >>> # Can not be empty:
130
    >>> rfc3339_duration_to_delta("")
131
    Traceback (most recent call last):
132
    ...
133
    ValueError: Invalid RFC 3339 duration: u''
134
    >>> # Must start with "P":
135
    >>> rfc3339_duration_to_delta("1D")
136
    Traceback (most recent call last):
137
    ...
138
    ValueError: Invalid RFC 3339 duration: u'1D'
139
    >>> # Must use correct order
140
    >>> rfc3339_duration_to_delta("PT1S2M")
141
    Traceback (most recent call last):
142
    ...
143
    ValueError: Invalid RFC 3339 duration: u'PT1S2M'
144
    >>> # Time needs time marker
145
    >>> rfc3339_duration_to_delta("P1H2S")
146
    Traceback (most recent call last):
147
    ...
148
    ValueError: Invalid RFC 3339 duration: u'P1H2S'
149
    >>> # Weeks can not be combined with anything else
150
    >>> rfc3339_duration_to_delta("P1D2W")
151
    Traceback (most recent call last):
152
    ...
153
    ValueError: Invalid RFC 3339 duration: u'P1D2W'
154
    >>> rfc3339_duration_to_delta("P2W2H")
155
    Traceback (most recent call last):
156
    ...
157
    ValueError: Invalid RFC 3339 duration: u'P2W2H'
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
158
    """
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
159
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
160
    # Parsing an RFC 3339 duration with regular expressions is not
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
161
    # possible - there would have to be multiple places for the same
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
162
    # values, like seconds.  The current code, while more esoteric, is
163
    # cleaner without depending on a parsing library.  If Python had a
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
164
    # built-in library for parsing we would use it, but we'd like to
165
    # avoid excessive use of external libraries.
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
166
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
167
    # New type for defining tokens, syntax, and semantics all-in-one
237.7.301 by Teddy Hogeborn
mandos-ctl: Generate better messages in exceptions.
168
    Token = collections.namedtuple("Token", (
169
        "regexp",  # To match token; if "value" is not None, must have
170
                   # a "group" containing digits
171
        "value",   # datetime.timedelta or None
172
        "followers"))           # Tokens valid after this token
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
173
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
174
    # the "duration" ABNF definition in RFC 3339, Appendix A.
175
    token_end = Token(re.compile(r"$"), None, frozenset())
176
    token_second = Token(re.compile(r"(\d+)S"),
177
                         datetime.timedelta(seconds=1),
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
178
                         frozenset((token_end, )))
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
179
    token_minute = Token(re.compile(r"(\d+)M"),
180
                         datetime.timedelta(minutes=1),
181
                         frozenset((token_second, token_end)))
182
    token_hour = Token(re.compile(r"(\d+)H"),
183
                       datetime.timedelta(hours=1),
184
                       frozenset((token_minute, token_end)))
185
    token_time = Token(re.compile(r"T"),
186
                       None,
187
                       frozenset((token_hour, token_minute,
188
                                  token_second)))
189
    token_day = Token(re.compile(r"(\d+)D"),
190
                      datetime.timedelta(days=1),
191
                      frozenset((token_time, token_end)))
192
    token_month = Token(re.compile(r"(\d+)M"),
193
                        datetime.timedelta(weeks=4),
194
                        frozenset((token_day, token_end)))
195
    token_year = Token(re.compile(r"(\d+)Y"),
196
                       datetime.timedelta(weeks=52),
197
                       frozenset((token_month, token_end)))
198
    token_week = Token(re.compile(r"(\d+)W"),
199
                       datetime.timedelta(weeks=1),
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
200
                       frozenset((token_end, )))
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
201
    token_duration = Token(re.compile(r"P"), None,
202
                           frozenset((token_year, token_month,
203
                                      token_day, token_time,
237.7.269 by Teddy Hogeborn
Fix two mutually cancelling bugs.
204
                                      token_week)))
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
205
    # Define starting values:
206
    # Value so far
207
    value = datetime.timedelta()
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
208
    found_token = None
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
209
    # Following valid tokens
210
    followers = frozenset((token_duration, ))
211
    # String left to parse
212
    s = duration
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
213
    # Loop until end token is found
214
    while found_token is not token_end:
215
        # Search for any currently valid tokens
216
        for token in followers:
217
            match = token.regexp.match(s)
218
            if match is not None:
219
                # Token found
220
                if token.value is not None:
221
                    # Value found, parse digits
222
                    factor = int(match.group(1), 10)
223
                    # Add to value so far
224
                    value += factor * token.value
225
                # Strip token from string
226
                s = token.regexp.sub("", s, 1)
227
                # Go to found token
228
                found_token = token
229
                # Set valid next tokens
230
                followers = found_token.followers
231
                break
232
        else:
233
            # No currently valid tokens were found
237.7.301 by Teddy Hogeborn
mandos-ctl: Generate better messages in exceptions.
234
            raise ValueError("Invalid RFC 3339 duration: {!r}"
235
                             .format(duration))
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
236
    # End token found
237
    return value
238
239
24.1.121 by Björn Påhlsson
mandos-ctl: Added support for all client calls
240
def string_to_delta(interval):
241
    """Parse a string and return a datetime.timedelta
242
    """
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
243
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
244
    try:
245
        return rfc3339_duration_to_delta(interval)
237.7.539 by Teddy Hogeborn
mandos-ctl: Refactor and add more tests
246
    except ValueError as e:
247
        log.warning("%s - Parsing as pre-1.6.1 interval instead",
248
                    ' '.join(e.args))
249
    return parse_pre_1_6_1_interval(interval)
250
251
252
def parse_pre_1_6_1_interval(interval):
253
    """Parse an interval string as documented by Mandos before 1.6.1, and
254
    return a datetime.timedelta
255
    >>> parse_pre_1_6_1_interval('7d')
256
    datetime.timedelta(7)
257
    >>> parse_pre_1_6_1_interval('60s')
258
    datetime.timedelta(0, 60)
259
    >>> parse_pre_1_6_1_interval('60m')
260
    datetime.timedelta(0, 3600)
261
    >>> parse_pre_1_6_1_interval('24h')
262
    datetime.timedelta(1)
263
    >>> parse_pre_1_6_1_interval('1w')
264
    datetime.timedelta(7)
265
    >>> parse_pre_1_6_1_interval('5m 30s')
266
    datetime.timedelta(0, 330)
267
    >>> parse_pre_1_6_1_interval('')
268
    datetime.timedelta(0)
269
    >>> # Ignore unknown characters, allow any order and repetitions
270
    >>> parse_pre_1_6_1_interval('2dxy7zz11y3m5m')
271
    datetime.timedelta(2, 480, 18000)
272
273
    """
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
274
237.7.164 by Teddy Hogeborn
* mandos-ctl (string_to_delta): Try to parse RFC 3339 duration before
275
    value = datetime.timedelta(0)
276
    regexp = re.compile(r"(\d+)([dsmhw]?)")
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
277
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
278
    for num, suffix in regexp.findall(interval):
279
        if suffix == "d":
280
            value += datetime.timedelta(int(num))
281
        elif suffix == "s":
282
            value += datetime.timedelta(0, int(num))
283
        elif suffix == "m":
284
            value += datetime.timedelta(0, 0, 0, 0, int(num))
285
        elif suffix == "h":
286
            value += datetime.timedelta(0, 0, 0, 0, 0, int(num))
287
        elif suffix == "w":
288
            value += datetime.timedelta(0, 0, 0, 0, 0, 0, int(num))
289
        elif suffix == "":
290
            value += datetime.timedelta(0, 0, 0, int(num))
291
    return value
24.1.121 by Björn Påhlsson
mandos-ctl: Added support for all client calls
292
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
293
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
294
def print_clients(clients, keywords):
24.1.121 by Björn Påhlsson
mandos-ctl: Added support for all client calls
295
    def valuetostring(value, keyword):
237.7.537 by Teddy Hogeborn
mandos-ctl: Use isinstance(x, X) instead of type(x) is X
296
        if isinstance(value, dbus.Boolean):
237.8.8 by teddy at bsnet
* mandos-ctl: Use unicode string literals.
297
            return "Yes" if value else "No"
298
        if keyword in ("Timeout", "Interval", "ApprovalDelay",
237.7.119 by Teddy Hogeborn
* mandos-ctl (print_clients): Bug fix: Don't show "Extended Timeout"
299
                       "ApprovalDuration", "ExtendedTimeout"):
24.1.121 by Björn Påhlsson
mandos-ctl: Added support for all client calls
300
            return milliseconds_to_string(value)
237.7.266 by Teddy Hogeborn
mandos-ctl: Make it work in Python 3.
301
        return str(value)
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
302
237.2.145 by Teddy Hogeborn
* mandos-ctl: Made work again after D-Bus API changes.
303
    # Create format string to print table rows
237.7.117 by Teddy Hogeborn
* mandos-ctl: Use new string format method. Bug fix: --version now
304
    format_string = " ".join("{{{key}:{width}}}".format(
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
305
        width=max(len(tablewords[key]),
306
                  max(len(valuetostring(client[key], key))
307
                      for client in clients)),
308
        key=key)
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
309
                             for key in keywords)
237.2.145 by Teddy Hogeborn
* mandos-ctl: Made work again after D-Bus API changes.
310
    # Print header line
237.7.117 by Teddy Hogeborn
* mandos-ctl: Use new string format method. Bug fix: --version now
311
    print(format_string.format(**tablewords))
24.1.121 by Björn Påhlsson
mandos-ctl: Added support for all client calls
312
    for client in clients:
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
313
        print(format_string
314
              .format(**{key: valuetostring(client[key], key)
315
                         for key in keywords}))
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
316
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
317
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
318
def has_actions(options):
319
    return any((options.enable,
320
                options.disable,
321
                options.bump_timeout,
322
                options.start_checker,
323
                options.stop_checker,
324
                options.is_enabled,
325
                options.remove,
326
                options.checker is not None,
327
                options.timeout is not None,
24.1.179 by Björn Påhlsson
New feature:
328
                options.extended_timeout is not None,
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
329
                options.interval is not None,
237.2.204 by Teddy Hogeborn
* mandos (ClientDBus.__init__): Bug fix: Translate "-" in client names
330
                options.approved_by_default is not None,
331
                options.approval_delay is not None,
332
                options.approval_duration is not None,
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
333
                options.host is not None,
334
                options.secret is not None,
335
                options.approve,
336
                options.deny))
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
337
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
338
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
339
def main():
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
340
    parser = argparse.ArgumentParser()
341
    parser.add_argument("--version", action="version",
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
342
                        version="%(prog)s {}".format(version),
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
343
                        help="show version number and exit")
344
    parser.add_argument("-a", "--all", action="store_true",
345
                        help="Select all clients")
346
    parser.add_argument("-v", "--verbose", action="store_true",
347
                        help="Print all fields")
237.7.411 by Teddy Hogeborn
mandos-ctl: Implement --dump-json option
348
    parser.add_argument("-j", "--dump-json", action="store_true",
349
                        help="Dump client data in JSON format")
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
350
    parser.add_argument("-e", "--enable", action="store_true",
351
                        help="Enable client")
352
    parser.add_argument("-d", "--disable", action="store_true",
353
                        help="disable client")
354
    parser.add_argument("-b", "--bump-timeout", action="store_true",
355
                        help="Bump timeout for client")
356
    parser.add_argument("--start-checker", action="store_true",
357
                        help="Start checker for client")
358
    parser.add_argument("--stop-checker", action="store_true",
359
                        help="Stop checker for client")
360
    parser.add_argument("-V", "--is-enabled", action="store_true",
361
                        help="Check if client is enabled")
362
    parser.add_argument("-r", "--remove", action="store_true",
363
                        help="Remove client")
364
    parser.add_argument("-c", "--checker",
365
                        help="Set checker command for client")
366
    parser.add_argument("-t", "--timeout",
367
                        help="Set timeout for client")
24.1.179 by Björn Påhlsson
New feature:
368
    parser.add_argument("--extended-timeout",
369
                        help="Set extended timeout for client")
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
370
    parser.add_argument("-i", "--interval",
371
                        help="Set checker interval for client")
372
    parser.add_argument("--approve-by-default", action="store_true",
373
                        default=None, dest="approved_by_default",
374
                        help="Set client to be approved by default")
375
    parser.add_argument("--deny-by-default", action="store_false",
376
                        dest="approved_by_default",
377
                        help="Set client to be denied by default")
378
    parser.add_argument("--approval-delay",
379
                        help="Set delay before client approve/deny")
380
    parser.add_argument("--approval-duration",
381
                        help="Set duration of one client approval")
382
    parser.add_argument("-H", "--host", help="Set host for client")
237.7.266 by Teddy Hogeborn
mandos-ctl: Make it work in Python 3.
383
    parser.add_argument("-s", "--secret",
384
                        type=argparse.FileType(mode="rb"),
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
385
                        help="Set password blob (file) for client")
386
    parser.add_argument("-A", "--approve", action="store_true",
387
                        help="Approve any current client request")
388
    parser.add_argument("-D", "--deny", action="store_true",
389
                        help="Deny any current client request")
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
390
    parser.add_argument("--check", action="store_true",
391
                        help="Run self-test")
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
392
    parser.add_argument("client", nargs="*", help="Client name")
393
    options = parser.parse_args()
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
394
237.7.120 by Teddy Hogeborn
* mandos-ctl: Break long lines.
395
    if has_actions(options) and not (options.client or options.all):
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
396
        parser.error("Options require clients names or --all.")
397
    if options.verbose and has_actions(options):
237.7.411 by Teddy Hogeborn
mandos-ctl: Implement --dump-json option
398
        parser.error("--verbose can only be used alone.")
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
399
    if options.dump_json and (options.verbose
400
                              or has_actions(options)):
237.7.411 by Teddy Hogeborn
mandos-ctl: Implement --dump-json option
401
        parser.error("--dump-json can only be used alone.")
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
402
    if options.all and not has_actions(options):
403
        parser.error("--all requires an action.")
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
404
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
405
    try:
406
        bus = dbus.SystemBus()
407
        mandos_dbus_objc = bus.get_object(busname, server_path)
408
    except dbus.exceptions.DBusException:
237.7.535 by Teddy Hogeborn
mandos-ctl: Use logging module instead of print() for errors
409
        log.critical("Could not connect to Mandos server")
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
410
        sys.exit(1)
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
411
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
412
    mandos_serv = dbus.Interface(mandos_dbus_objc,
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
413
                                 dbus_interface=server_interface)
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
414
    mandos_serv_object_manager = dbus.Interface(
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
415
        mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)
416
417
    # block stderr since dbus library prints to stderr
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
418
    null = os.open(os.path.devnull, os.O_RDWR)
419
    stderrcopy = os.dup(sys.stderr.fileno())
420
    os.dup2(null, sys.stderr.fileno())
421
    os.close(null)
422
    try:
423
        try:
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
424
            mandos_clients = {path: ifs_and_props[client_interface]
425
                              for path, ifs_and_props in
426
                              mandos_serv_object_manager
427
                              .GetManagedObjects().items()
428
                              if client_interface in ifs_and_props}
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
429
        finally:
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
430
            # restore stderr
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
431
            os.dup2(stderrcopy, sys.stderr.fileno())
432
            os.close(stderrcopy)
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
433
    except dbus.exceptions.DBusException as e:
237.7.535 by Teddy Hogeborn
mandos-ctl: Use logging module instead of print() for errors
434
        log.critical("Failed to access Mandos server through D-Bus:"
435
                     "\n%s", e)
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
436
        sys.exit(1)
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
437
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
438
    # Compile dict of (clients: properties) to process
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
439
    clients = {}
440
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
441
    if options.all or not options.client:
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
442
        clients = {bus.get_object(busname, path): properties
443
                   for path, properties in mandos_clients.items()}
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
444
    else:
445
        for name in options.client:
237.23.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
446
            for path, client in mandos_clients.items():
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
447
                if client["Name"] == name:
448
                    client_objc = bus.get_object(busname, path)
449
                    clients[client_objc] = client
450
                    break
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
451
            else:
237.7.535 by Teddy Hogeborn
mandos-ctl: Use logging module instead of print() for errors
452
                log.critical("Client not found on server: %r", name)
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
453
                sys.exit(1)
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
454
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
455
    if not has_actions(options) and clients:
237.7.411 by Teddy Hogeborn
mandos-ctl: Implement --dump-json option
456
        if options.verbose or options.dump_json:
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
457
            keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
458
                        "Created", "Interval", "Host", "KeyID",
459
                        "Fingerprint", "CheckerRunning",
460
                        "LastEnabled", "ApprovalPending",
461
                        "ApprovedByDefault", "LastApprovalRequest",
462
                        "ApprovalDelay", "ApprovalDuration",
463
                        "Checker", "ExtendedTimeout", "Expires",
237.7.413 by Teddy Hogeborn
mandos-ctl: Include "Expires" and "LastCheckerStatus" properties
464
                        "LastCheckerStatus")
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
465
        else:
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
466
            keywords = defaultkeywords
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
467
237.7.411 by Teddy Hogeborn
mandos-ctl: Implement --dump-json option
468
        if options.dump_json:
237.7.412 by Teddy Hogeborn
mandos-ctl: Dump booleans as booleans in --dump-json output.
469
            json.dump({client["Name"]: {key:
470
                                        bool(client[key])
471
                                        if isinstance(client[key],
472
                                                      dbus.Boolean)
473
                                        else client[key]
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
474
                                        for key in keywords}
475
                       for client in clients.values()},
476
                      fp=sys.stdout, indent=4,
477
                      separators=(',', ': '))
237.7.411 by Teddy Hogeborn
mandos-ctl: Implement --dump-json option
478
            print()
479
        else:
480
            print_clients(clients.values(), keywords)
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
481
    else:
482
        # Process each client in the list by all selected options
483
        for client in clients:
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
484
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
485
            def set_client_prop(prop, value):
486
                """Set a Client D-Bus property"""
487
                client.Set(client_interface, prop, value,
488
                           dbus_interface=dbus.PROPERTIES_IFACE)
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
489
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
490
            def set_client_prop_ms(prop, value):
491
                """Set a Client D-Bus property, converted
492
                from a string to milliseconds."""
493
                set_client_prop(prop,
237.23.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
494
                                string_to_delta(value).total_seconds()
495
                                * 1000)
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
496
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
497
            if options.remove:
498
                mandos_serv.RemoveClient(client.__dbus_object_path__)
499
            if options.enable:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
500
                set_client_prop("Enabled", dbus.Boolean(True))
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
501
            if options.disable:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
502
                set_client_prop("Enabled", dbus.Boolean(False))
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
503
            if options.bump_timeout:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
504
                set_client_prop("LastCheckedOK", "")
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
505
            if options.start_checker:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
506
                set_client_prop("CheckerRunning", dbus.Boolean(True))
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
507
            if options.stop_checker:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
508
                set_client_prop("CheckerRunning", dbus.Boolean(False))
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
509
            if options.is_enabled:
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
510
                if client.Get(client_interface, "Enabled",
511
                              dbus_interface=dbus.PROPERTIES_IFACE):
512
                    sys.exit(0)
513
                else:
514
                    sys.exit(1)
237.11.16 by Teddy Hogeborn
* mandos-ctl (main): Bug fix: Handle empty strings correctly.
515
            if options.checker is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
516
                set_client_prop("Checker", options.checker)
237.11.16 by Teddy Hogeborn
* mandos-ctl (main): Bug fix: Handle empty strings correctly.
517
            if options.host is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
518
                set_client_prop("Host", options.host)
237.11.16 by Teddy Hogeborn
* mandos-ctl (main): Bug fix: Handle empty strings correctly.
519
            if options.interval is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
520
                set_client_prop_ms("Interval", options.interval)
237.11.16 by Teddy Hogeborn
* mandos-ctl (main): Bug fix: Handle empty strings correctly.
521
            if options.approval_delay is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
522
                set_client_prop_ms("ApprovalDelay",
523
                                   options.approval_delay)
237.11.16 by Teddy Hogeborn
* mandos-ctl (main): Bug fix: Handle empty strings correctly.
524
            if options.approval_duration is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
525
                set_client_prop_ms("ApprovalDuration",
526
                                   options.approval_duration)
237.11.16 by Teddy Hogeborn
* mandos-ctl (main): Bug fix: Handle empty strings correctly.
527
            if options.timeout is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
528
                set_client_prop_ms("Timeout", options.timeout)
237.11.16 by Teddy Hogeborn
* mandos-ctl (main): Bug fix: Handle empty strings correctly.
529
            if options.extended_timeout is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
530
                set_client_prop_ms("ExtendedTimeout",
531
                                   options.extended_timeout)
237.11.16 by Teddy Hogeborn
* mandos-ctl (main): Bug fix: Handle empty strings correctly.
532
            if options.secret is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
533
                set_client_prop("Secret",
534
                                dbus.ByteArray(options.secret.read()))
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
535
            if options.approved_by_default is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
536
                set_client_prop("ApprovedByDefault",
537
                                dbus.Boolean(options
538
                                             .approved_by_default))
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
539
            if options.approve:
540
                client.Approve(dbus.Boolean(True),
541
                               dbus_interface=client_interface)
542
            elif options.deny:
543
                client.Approve(dbus.Boolean(False),
544
                               dbus_interface=client_interface)
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
545
237.7.532 by Teddy Hogeborn
Make mandos-ctl use unittest instead of doctest module
546

237.7.534 by Teddy Hogeborn
Add tests to mandos-ctl's milliseconds_to_string function
547
class Test_milliseconds_to_string(unittest.TestCase):
548
    def test_all(self):
549
        self.assertEqual(milliseconds_to_string(93785000),
550
                         "1T02:03:05")
551
    def test_no_days(self):
552
        self.assertEqual(milliseconds_to_string(7385000), "02:03:05")
553
    def test_all_zero(self):
554
        self.assertEqual(milliseconds_to_string(0), "00:00:00")
555
    def test_no_fractional_seconds(self):
556
        self.assertEqual(milliseconds_to_string(400), "00:00:00")
557
        self.assertEqual(milliseconds_to_string(900), "00:00:00")
558
        self.assertEqual(milliseconds_to_string(1900), "00:00:01")
559
237.7.540 by Teddy Hogeborn
mandos-ctl: Add more tests
560
class Test_string_to_delta(unittest.TestCase):
561
    def test_handles_basic_rfc3339(self):
562
        self.assertEqual(string_to_delta("PT2H"),
563
                         datetime.timedelta(0, 7200))
564
    def test_falls_back_to_pre_1_6_1_with_warning(self):
565
        # assertLogs only exists in Python 3.4
566
        if hasattr(self, "assertLogs"):
567
            with self.assertLogs(log, logging.WARNING):
568
                value = string_to_delta("2h")
569
        else:
570
            value = string_to_delta("2h")
571
        self.assertEqual(value, datetime.timedelta(0, 7200))
572
237.7.534 by Teddy Hogeborn
Add tests to mandos-ctl's milliseconds_to_string function
573

237.7.532 by Teddy Hogeborn
Make mandos-ctl use unittest instead of doctest module
574
def should_only_run_tests():
575
    parser = argparse.ArgumentParser(add_help=False)
576
    parser.add_argument("--check", action='store_true')
577
    args, unknown_args = parser.parse_known_args()
578
    run_tests = args.check
579
    if run_tests:
580
        # Remove --check argument from sys.argv
581
        sys.argv[1:] = unknown_args
582
    return run_tests
583
584
# Add all tests from doctest strings
585
def load_tests(loader, tests, none):
586
    import doctest
587
    tests.addTests(doctest.DocTestSuite())
588
    return tests
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
589
237.8.8 by teddy at bsnet
* mandos-ctl: Use unicode string literals.
590
if __name__ == "__main__":
237.7.532 by Teddy Hogeborn
Make mandos-ctl use unittest instead of doctest module
591
    if should_only_run_tests():
592
        # Call using ./tdd-python-script --check [--verbose]
593
        unittest.main()
594
    else:
595
        main()