/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release
24.1.116 by Björn Påhlsson
added a mandos list client program
1
#!/usr/bin/python
237.7.533 by Teddy Hogeborn
Make Emacs run tests when mandos-ctl file is saved
2
# -*- mode: python; coding: utf-8; after-save-hook: (lambda () (let ((command (if (and (boundp 'tramp-file-name-structure) (string-match (car tramp-file-name-structure) (buffer-file-name))) (tramp-file-name-localname (tramp-dissect-file-name (buffer-file-name))) (buffer-file-name)))) (if (= (shell-command (format "%s --check" (shell-quote-argument command)) "*Test*") 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)) (kill-buffer "*Test*")) (display-buffer "*Test*")))); -*-
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
3
#
237.2.207 by Teddy Hogeborn
Update copyright year to "2010" wherever appropriate.
4
# Mandos Monitor - Control and monitor the Mandos server
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
5
#
237.7.517 by Teddy Hogeborn
Update copyright year to 2019
6
# Copyright © 2008-2019 Teddy Hogeborn
7
# Copyright © 2008-2019 Björn Påhlsson
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
8
#
237.7.455 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
9
# This file is part of Mandos.
10
#
11
# Mandos is free software: you can redistribute it and/or modify it
12
# under the terms of the GNU General Public License as published by
237.2.207 by Teddy Hogeborn
Update copyright year to "2010" wherever appropriate.
13
# the Free Software Foundation, either version 3 of the License, or
14
# (at your option) any later version.
15
#
237.7.455 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
16
#     Mandos is distributed in the hope that it will be useful, but
17
#     WITHOUT ANY WARRANTY; without even the implied warranty of
237.2.207 by Teddy Hogeborn
Update copyright year to "2010" wherever appropriate.
18
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19
#     GNU General Public License for more details.
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
20
#
237.2.207 by Teddy Hogeborn
Update copyright year to "2010" wherever appropriate.
21
# You should have received a copy of the GNU General Public License
237.7.455 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
22
# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
23
#
237.11.2 by Teddy Hogeborn
Change "fukt.bsnet.se" to "recompile.se" throughout.
24
# Contact the authors at <mandos@recompile.se>.
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
25
#
24.1.116 by Björn Påhlsson
added a mandos list client program
26
237.8.9 by teddy at bsnet
* mandos-ctl: Use print function.
27
from __future__ import (division, absolute_import, print_function,
28
                        unicode_literals)
237.8.8 by teddy at bsnet
* mandos-ctl: Use unicode string literals.
29
237.7.266 by Teddy Hogeborn
mandos-ctl: Make it work in Python 3.
30
try:
31
    from future_builtins import *
32
except ImportError:
33
    pass
237.7.127 by Teddy Hogeborn
* mandos: Use all new builtins.
34
24.1.119 by Björn Påhlsson
Added more method support for mandos clients through mandos-ctl
35
import sys
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
36
import argparse
237.2.3 by Teddy Hogeborn
Merge "mandos-list" from belorn.
37
import locale
24.1.121 by Björn Påhlsson
mandos-ctl: Added support for all client calls
38
import datetime
39
import re
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
40
import os
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
41
import collections
237.7.411 by Teddy Hogeborn
mandos-ctl: Implement --dump-json option
42
import json
237.7.532 by Teddy Hogeborn
Make mandos-ctl use unittest instead of doctest module
43
import unittest
237.7.535 by Teddy Hogeborn
mandos-ctl: Use logging module instead of print() for errors
44
import logging
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
45
46
import dbus
237.2.3 by Teddy Hogeborn
Merge "mandos-list" from belorn.
47
237.7.536 by Teddy Hogeborn
mandos-ctl: Show warnings
48
# Show warnings by default
49
if not sys.warnoptions:
50
    import warnings
51
    warnings.simplefilter("default")
52
237.7.535 by Teddy Hogeborn
mandos-ctl: Use logging module instead of print() for errors
53
log = logging.getLogger(sys.argv[0])
54
logging.basicConfig(level="INFO", # Show info level messages
55
                    format="%(message)s") # Show basic log messages
56
237.7.536 by Teddy Hogeborn
mandos-ctl: Show warnings
57
logging.captureWarnings(True)   # Show warnings via the logging system
58
237.23.7 by Teddy Hogeborn
Use the .major attribute on sys.version_info instead of using "[0]".
59
if sys.version_info.major == 2:
237.7.266 by Teddy Hogeborn
mandos-ctl: Make it work in Python 3.
60
    str = unicode
61
237.8.8 by teddy at bsnet
* mandos-ctl: Use unicode string literals.
62
locale.setlocale(locale.LC_ALL, "")
24.1.116 by Björn Påhlsson
added a mandos list client program
63
64
tablewords = {
237.8.8 by teddy at bsnet
* mandos-ctl: Use unicode string literals.
65
    "Name": "Name",
66
    "Enabled": "Enabled",
67
    "Timeout": "Timeout",
68
    "LastCheckedOK": "Last Successful Check",
69
    "LastApprovalRequest": "Last Approval Request",
70
    "Created": "Created",
71
    "Interval": "Interval",
72
    "Host": "Host",
73
    "Fingerprint": "Fingerprint",
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
74
    "KeyID": "Key ID",
237.8.8 by teddy at bsnet
* mandos-ctl: Use unicode string literals.
75
    "CheckerRunning": "Check Is Running",
76
    "LastEnabled": "Last Enabled",
77
    "ApprovalPending": "Approval Is Pending",
78
    "ApprovedByDefault": "Approved By Default",
79
    "ApprovalDelay": "Approval Delay",
80
    "ApprovalDuration": "Approval Duration",
81
    "Checker": "Checker",
237.7.413 by Teddy Hogeborn
mandos-ctl: Include "Expires" and "LastCheckerStatus" properties
82
    "ExtendedTimeout": "Extended Timeout",
83
    "Expires": "Expires",
84
    "LastCheckerStatus": "Last Checker Status",
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
85
}
237.8.8 by teddy at bsnet
* mandos-ctl: Use unicode string literals.
86
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
24.1.186 by Björn Påhlsson
transitional stuff actually working
87
domain = "se.recompile"
237.8.8 by teddy at bsnet
* mandos-ctl: Use unicode string literals.
88
busname = domain + ".Mandos"
89
server_path = "/"
90
server_interface = domain + ".Mandos"
91
client_interface = domain + ".Mandos.Client"
377 by Teddy Hogeborn
* Makefile (version): Change to 1.8.3.
92
version = "1.8.3"
24.1.118 by Björn Påhlsson
Added enable/disable
93
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
94
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
95
try:
96
    dbus.OBJECT_MANAGER_IFACE
97
except AttributeError:
98
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
99
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
100
24.1.121 by Björn Påhlsson
mandos-ctl: Added support for all client calls
101
def milliseconds_to_string(ms):
102
    td = datetime.timedelta(0, 0, 0, ms)
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
103
    return ("{days}{hours:02}:{minutes:02}:{seconds:02}"
104
            .format(days="{}T".format(td.days) if td.days else "",
105
                    hours=td.seconds // 3600,
106
                    minutes=(td.seconds % 3600) // 60,
107
                    seconds=td.seconds % 60))
24.1.121 by Björn Påhlsson
mandos-ctl: Added support for all client calls
108
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
109
110
def rfc3339_duration_to_delta(duration):
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
111
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
112
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
113
    >>> rfc3339_duration_to_delta("P7D")
114
    datetime.timedelta(7)
115
    >>> rfc3339_duration_to_delta("PT60S")
116
    datetime.timedelta(0, 60)
117
    >>> rfc3339_duration_to_delta("PT60M")
118
    datetime.timedelta(0, 3600)
237.7.538 by Teddy Hogeborn
mandos-ctl (rfc3339_duration_to_delta): Improve tests
119
    >>> rfc3339_duration_to_delta("P60M")
120
    datetime.timedelta(1680)
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
121
    >>> rfc3339_duration_to_delta("PT24H")
122
    datetime.timedelta(1)
123
    >>> rfc3339_duration_to_delta("P1W")
124
    datetime.timedelta(7)
125
    >>> rfc3339_duration_to_delta("PT5M30S")
126
    datetime.timedelta(0, 330)
127
    >>> rfc3339_duration_to_delta("P1DT3M20S")
128
    datetime.timedelta(1, 200)
237.7.538 by Teddy Hogeborn
mandos-ctl (rfc3339_duration_to_delta): Improve tests
129
    >>> # Can not be empty:
130
    >>> rfc3339_duration_to_delta("")
131
    Traceback (most recent call last):
132
    ...
133
    ValueError: Invalid RFC 3339 duration: u''
134
    >>> # Must start with "P":
135
    >>> rfc3339_duration_to_delta("1D")
136
    Traceback (most recent call last):
137
    ...
138
    ValueError: Invalid RFC 3339 duration: u'1D'
139
    >>> # Must use correct order
140
    >>> rfc3339_duration_to_delta("PT1S2M")
141
    Traceback (most recent call last):
142
    ...
143
    ValueError: Invalid RFC 3339 duration: u'PT1S2M'
144
    >>> # Time needs time marker
145
    >>> rfc3339_duration_to_delta("P1H2S")
146
    Traceback (most recent call last):
147
    ...
148
    ValueError: Invalid RFC 3339 duration: u'P1H2S'
149
    >>> # Weeks can not be combined with anything else
150
    >>> rfc3339_duration_to_delta("P1D2W")
151
    Traceback (most recent call last):
152
    ...
153
    ValueError: Invalid RFC 3339 duration: u'P1D2W'
154
    >>> rfc3339_duration_to_delta("P2W2H")
155
    Traceback (most recent call last):
156
    ...
157
    ValueError: Invalid RFC 3339 duration: u'P2W2H'
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
158
    """
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
159
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
160
    # Parsing an RFC 3339 duration with regular expressions is not
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
161
    # possible - there would have to be multiple places for the same
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
162
    # values, like seconds.  The current code, while more esoteric, is
163
    # cleaner without depending on a parsing library.  If Python had a
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
164
    # built-in library for parsing we would use it, but we'd like to
165
    # avoid excessive use of external libraries.
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
166
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
167
    # New type for defining tokens, syntax, and semantics all-in-one
237.7.301 by Teddy Hogeborn
mandos-ctl: Generate better messages in exceptions.
168
    Token = collections.namedtuple("Token", (
169
        "regexp",  # To match token; if "value" is not None, must have
170
                   # a "group" containing digits
171
        "value",   # datetime.timedelta or None
172
        "followers"))           # Tokens valid after this token
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
173
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
174
    # the "duration" ABNF definition in RFC 3339, Appendix A.
175
    token_end = Token(re.compile(r"$"), None, frozenset())
176
    token_second = Token(re.compile(r"(\d+)S"),
177
                         datetime.timedelta(seconds=1),
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
178
                         frozenset((token_end, )))
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
179
    token_minute = Token(re.compile(r"(\d+)M"),
180
                         datetime.timedelta(minutes=1),
181
                         frozenset((token_second, token_end)))
182
    token_hour = Token(re.compile(r"(\d+)H"),
183
                       datetime.timedelta(hours=1),
184
                       frozenset((token_minute, token_end)))
185
    token_time = Token(re.compile(r"T"),
186
                       None,
187
                       frozenset((token_hour, token_minute,
188
                                  token_second)))
189
    token_day = Token(re.compile(r"(\d+)D"),
190
                      datetime.timedelta(days=1),
191
                      frozenset((token_time, token_end)))
192
    token_month = Token(re.compile(r"(\d+)M"),
193
                        datetime.timedelta(weeks=4),
194
                        frozenset((token_day, token_end)))
195
    token_year = Token(re.compile(r"(\d+)Y"),
196
                       datetime.timedelta(weeks=52),
197
                       frozenset((token_month, token_end)))
198
    token_week = Token(re.compile(r"(\d+)W"),
199
                       datetime.timedelta(weeks=1),
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
200
                       frozenset((token_end, )))
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
201
    token_duration = Token(re.compile(r"P"), None,
202
                           frozenset((token_year, token_month,
203
                                      token_day, token_time,
237.7.269 by Teddy Hogeborn
Fix two mutually cancelling bugs.
204
                                      token_week)))
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
205
    # Define starting values:
206
    # Value so far
207
    value = datetime.timedelta()
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
208
    found_token = None
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
209
    # Following valid tokens
210
    followers = frozenset((token_duration, ))
211
    # String left to parse
212
    s = duration
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
213
    # Loop until end token is found
214
    while found_token is not token_end:
215
        # Search for any currently valid tokens
216
        for token in followers:
217
            match = token.regexp.match(s)
218
            if match is not None:
219
                # Token found
220
                if token.value is not None:
221
                    # Value found, parse digits
222
                    factor = int(match.group(1), 10)
223
                    # Add to value so far
224
                    value += factor * token.value
225
                # Strip token from string
226
                s = token.regexp.sub("", s, 1)
227
                # Go to found token
228
                found_token = token
229
                # Set valid next tokens
230
                followers = found_token.followers
231
                break
232
        else:
233
            # No currently valid tokens were found
237.7.301 by Teddy Hogeborn
mandos-ctl: Generate better messages in exceptions.
234
            raise ValueError("Invalid RFC 3339 duration: {!r}"
235
                             .format(duration))
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
236
    # End token found
237
    return value
238
239
24.1.121 by Björn Påhlsson
mandos-ctl: Added support for all client calls
240
def string_to_delta(interval):
241
    """Parse a string and return a datetime.timedelta
242
    """
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
243
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
244
    try:
245
        return rfc3339_duration_to_delta(interval)
237.7.539 by Teddy Hogeborn
mandos-ctl: Refactor and add more tests
246
    except ValueError as e:
247
        log.warning("%s - Parsing as pre-1.6.1 interval instead",
248
                    ' '.join(e.args))
249
    return parse_pre_1_6_1_interval(interval)
250
251
252
def parse_pre_1_6_1_interval(interval):
253
    """Parse an interval string as documented by Mandos before 1.6.1, and
254
    return a datetime.timedelta
255
    >>> parse_pre_1_6_1_interval('7d')
256
    datetime.timedelta(7)
257
    >>> parse_pre_1_6_1_interval('60s')
258
    datetime.timedelta(0, 60)
259
    >>> parse_pre_1_6_1_interval('60m')
260
    datetime.timedelta(0, 3600)
261
    >>> parse_pre_1_6_1_interval('24h')
262
    datetime.timedelta(1)
263
    >>> parse_pre_1_6_1_interval('1w')
264
    datetime.timedelta(7)
265
    >>> parse_pre_1_6_1_interval('5m 30s')
266
    datetime.timedelta(0, 330)
267
    >>> parse_pre_1_6_1_interval('')
268
    datetime.timedelta(0)
269
    >>> # Ignore unknown characters, allow any order and repetitions
270
    >>> parse_pre_1_6_1_interval('2dxy7zz11y3m5m')
271
    datetime.timedelta(2, 480, 18000)
272
273
    """
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
274
237.7.164 by Teddy Hogeborn
* mandos-ctl (string_to_delta): Try to parse RFC 3339 duration before
275
    value = datetime.timedelta(0)
276
    regexp = re.compile(r"(\d+)([dsmhw]?)")
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
277
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
278
    for num, suffix in regexp.findall(interval):
279
        if suffix == "d":
280
            value += datetime.timedelta(int(num))
281
        elif suffix == "s":
282
            value += datetime.timedelta(0, int(num))
283
        elif suffix == "m":
284
            value += datetime.timedelta(0, 0, 0, 0, int(num))
285
        elif suffix == "h":
286
            value += datetime.timedelta(0, 0, 0, 0, 0, int(num))
287
        elif suffix == "w":
288
            value += datetime.timedelta(0, 0, 0, 0, 0, 0, int(num))
289
        elif suffix == "":
290
            value += datetime.timedelta(0, 0, 0, int(num))
291
    return value
24.1.121 by Björn Påhlsson
mandos-ctl: Added support for all client calls
292
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
293
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
294
def print_clients(clients, keywords):
237.7.541 by Teddy Hogeborn
mandos-ctl (print_clients): Factor out making strings from printing
295
    print('\n'.join(table_rows_of_clients(clients, keywords)))
296
297
def table_rows_of_clients(clients, keywords):
24.1.121 by Björn Påhlsson
mandos-ctl: Added support for all client calls
298
    def valuetostring(value, keyword):
237.7.537 by Teddy Hogeborn
mandos-ctl: Use isinstance(x, X) instead of type(x) is X
299
        if isinstance(value, dbus.Boolean):
237.8.8 by teddy at bsnet
* mandos-ctl: Use unicode string literals.
300
            return "Yes" if value else "No"
301
        if keyword in ("Timeout", "Interval", "ApprovalDelay",
237.7.119 by Teddy Hogeborn
* mandos-ctl (print_clients): Bug fix: Don't show "Extended Timeout"
302
                       "ApprovalDuration", "ExtendedTimeout"):
24.1.121 by Björn Påhlsson
mandos-ctl: Added support for all client calls
303
            return milliseconds_to_string(value)
237.7.266 by Teddy Hogeborn
mandos-ctl: Make it work in Python 3.
304
        return str(value)
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
305
237.2.145 by Teddy Hogeborn
* mandos-ctl: Made work again after D-Bus API changes.
306
    # Create format string to print table rows
237.7.117 by Teddy Hogeborn
* mandos-ctl: Use new string format method. Bug fix: --version now
307
    format_string = " ".join("{{{key}:{width}}}".format(
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
308
        width=max(len(tablewords[key]),
309
                  max(len(valuetostring(client[key], key))
310
                      for client in clients)),
311
        key=key)
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
312
                             for key in keywords)
237.7.541 by Teddy Hogeborn
mandos-ctl (print_clients): Factor out making strings from printing
313
    # Start with header line
314
    rows = [format_string.format(**tablewords)]
24.1.121 by Björn Påhlsson
mandos-ctl: Added support for all client calls
315
    for client in clients:
237.7.541 by Teddy Hogeborn
mandos-ctl (print_clients): Factor out making strings from printing
316
        rows.append(format_string
317
                    .format(**{key: valuetostring(client[key], key)
318
                               for key in keywords}))
319
    return rows
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
320
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
321
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
322
def has_actions(options):
323
    return any((options.enable,
324
                options.disable,
325
                options.bump_timeout,
326
                options.start_checker,
327
                options.stop_checker,
328
                options.is_enabled,
329
                options.remove,
330
                options.checker is not None,
331
                options.timeout is not None,
24.1.179 by Björn Påhlsson
New feature:
332
                options.extended_timeout is not None,
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
333
                options.interval is not None,
237.2.204 by Teddy Hogeborn
* mandos (ClientDBus.__init__): Bug fix: Translate "-" in client names
334
                options.approved_by_default is not None,
335
                options.approval_delay is not None,
336
                options.approval_duration is not None,
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
337
                options.host is not None,
338
                options.secret is not None,
339
                options.approve,
340
                options.deny))
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
341
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
342
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
343
def main():
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
344
    parser = argparse.ArgumentParser()
345
    parser.add_argument("--version", action="version",
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
346
                        version="%(prog)s {}".format(version),
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
347
                        help="show version number and exit")
348
    parser.add_argument("-a", "--all", action="store_true",
349
                        help="Select all clients")
350
    parser.add_argument("-v", "--verbose", action="store_true",
351
                        help="Print all fields")
237.7.411 by Teddy Hogeborn
mandos-ctl: Implement --dump-json option
352
    parser.add_argument("-j", "--dump-json", action="store_true",
353
                        help="Dump client data in JSON format")
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
354
    parser.add_argument("-e", "--enable", action="store_true",
355
                        help="Enable client")
356
    parser.add_argument("-d", "--disable", action="store_true",
357
                        help="disable client")
358
    parser.add_argument("-b", "--bump-timeout", action="store_true",
359
                        help="Bump timeout for client")
360
    parser.add_argument("--start-checker", action="store_true",
361
                        help="Start checker for client")
362
    parser.add_argument("--stop-checker", action="store_true",
363
                        help="Stop checker for client")
364
    parser.add_argument("-V", "--is-enabled", action="store_true",
365
                        help="Check if client is enabled")
366
    parser.add_argument("-r", "--remove", action="store_true",
367
                        help="Remove client")
368
    parser.add_argument("-c", "--checker",
369
                        help="Set checker command for client")
370
    parser.add_argument("-t", "--timeout",
371
                        help="Set timeout for client")
24.1.179 by Björn Påhlsson
New feature:
372
    parser.add_argument("--extended-timeout",
373
                        help="Set extended timeout for client")
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
374
    parser.add_argument("-i", "--interval",
375
                        help="Set checker interval for client")
376
    parser.add_argument("--approve-by-default", action="store_true",
377
                        default=None, dest="approved_by_default",
378
                        help="Set client to be approved by default")
379
    parser.add_argument("--deny-by-default", action="store_false",
380
                        dest="approved_by_default",
381
                        help="Set client to be denied by default")
382
    parser.add_argument("--approval-delay",
383
                        help="Set delay before client approve/deny")
384
    parser.add_argument("--approval-duration",
385
                        help="Set duration of one client approval")
386
    parser.add_argument("-H", "--host", help="Set host for client")
237.7.266 by Teddy Hogeborn
mandos-ctl: Make it work in Python 3.
387
    parser.add_argument("-s", "--secret",
388
                        type=argparse.FileType(mode="rb"),
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
389
                        help="Set password blob (file) for client")
390
    parser.add_argument("-A", "--approve", action="store_true",
391
                        help="Approve any current client request")
392
    parser.add_argument("-D", "--deny", action="store_true",
393
                        help="Deny any current client request")
237.7.156 by Teddy Hogeborn
* Makefile (check): Also check mandos-ctl.
394
    parser.add_argument("--check", action="store_true",
395
                        help="Run self-test")
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
396
    parser.add_argument("client", nargs="*", help="Client name")
397
    options = parser.parse_args()
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
398
237.7.120 by Teddy Hogeborn
* mandos-ctl: Break long lines.
399
    if has_actions(options) and not (options.client or options.all):
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
400
        parser.error("Options require clients names or --all.")
401
    if options.verbose and has_actions(options):
237.7.411 by Teddy Hogeborn
mandos-ctl: Implement --dump-json option
402
        parser.error("--verbose can only be used alone.")
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
403
    if options.dump_json and (options.verbose
404
                              or has_actions(options)):
237.7.411 by Teddy Hogeborn
mandos-ctl: Implement --dump-json option
405
        parser.error("--dump-json can only be used alone.")
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
406
    if options.all and not has_actions(options):
407
        parser.error("--all requires an action.")
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
408
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
409
    try:
410
        bus = dbus.SystemBus()
411
        mandos_dbus_objc = bus.get_object(busname, server_path)
412
    except dbus.exceptions.DBusException:
237.7.535 by Teddy Hogeborn
mandos-ctl: Use logging module instead of print() for errors
413
        log.critical("Could not connect to Mandos server")
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
414
        sys.exit(1)
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
415
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
416
    mandos_serv = dbus.Interface(mandos_dbus_objc,
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
417
                                 dbus_interface=server_interface)
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
418
    mandos_serv_object_manager = dbus.Interface(
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
419
        mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)
420
421
    # block stderr since dbus library prints to stderr
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
422
    null = os.open(os.path.devnull, os.O_RDWR)
423
    stderrcopy = os.dup(sys.stderr.fileno())
424
    os.dup2(null, sys.stderr.fileno())
425
    os.close(null)
426
    try:
427
        try:
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
428
            mandos_clients = {path: ifs_and_props[client_interface]
429
                              for path, ifs_and_props in
430
                              mandos_serv_object_manager
431
                              .GetManagedObjects().items()
432
                              if client_interface in ifs_and_props}
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
433
        finally:
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
434
            # restore stderr
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
435
            os.dup2(stderrcopy, sys.stderr.fileno())
436
            os.close(stderrcopy)
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
437
    except dbus.exceptions.DBusException as e:
237.7.535 by Teddy Hogeborn
mandos-ctl: Use logging module instead of print() for errors
438
        log.critical("Failed to access Mandos server through D-Bus:"
439
                     "\n%s", e)
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
440
        sys.exit(1)
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
441
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
442
    # Compile dict of (clients: properties) to process
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
443
    clients = {}
444
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
445
    if options.all or not options.client:
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
446
        clients = {bus.get_object(busname, path): properties
447
                   for path, properties in mandos_clients.items()}
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
448
    else:
449
        for name in options.client:
237.23.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
450
            for path, client in mandos_clients.items():
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
451
                if client["Name"] == name:
452
                    client_objc = bus.get_object(busname, path)
453
                    clients[client_objc] = client
454
                    break
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
455
            else:
237.7.535 by Teddy Hogeborn
mandos-ctl: Use logging module instead of print() for errors
456
                log.critical("Client not found on server: %r", name)
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
457
                sys.exit(1)
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
458
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
459
    if not has_actions(options) and clients:
237.7.411 by Teddy Hogeborn
mandos-ctl: Implement --dump-json option
460
        if options.verbose or options.dump_json:
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
461
            keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
462
                        "Created", "Interval", "Host", "KeyID",
463
                        "Fingerprint", "CheckerRunning",
464
                        "LastEnabled", "ApprovalPending",
465
                        "ApprovedByDefault", "LastApprovalRequest",
466
                        "ApprovalDelay", "ApprovalDuration",
467
                        "Checker", "ExtendedTimeout", "Expires",
237.7.413 by Teddy Hogeborn
mandos-ctl: Include "Expires" and "LastCheckerStatus" properties
468
                        "LastCheckerStatus")
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
469
        else:
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
470
            keywords = defaultkeywords
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
471
237.7.411 by Teddy Hogeborn
mandos-ctl: Implement --dump-json option
472
        if options.dump_json:
237.7.412 by Teddy Hogeborn
mandos-ctl: Dump booleans as booleans in --dump-json output.
473
            json.dump({client["Name"]: {key:
474
                                        bool(client[key])
475
                                        if isinstance(client[key],
476
                                                      dbus.Boolean)
477
                                        else client[key]
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
478
                                        for key in keywords}
479
                       for client in clients.values()},
480
                      fp=sys.stdout, indent=4,
481
                      separators=(',', ': '))
237.7.411 by Teddy Hogeborn
mandos-ctl: Implement --dump-json option
482
            print()
483
        else:
484
            print_clients(clients.values(), keywords)
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
485
    else:
486
        # Process each client in the list by all selected options
487
        for client in clients:
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
488
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
489
            def set_client_prop(prop, value):
490
                """Set a Client D-Bus property"""
491
                client.Set(client_interface, prop, value,
492
                           dbus_interface=dbus.PROPERTIES_IFACE)
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
493
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
494
            def set_client_prop_ms(prop, value):
495
                """Set a Client D-Bus property, converted
496
                from a string to milliseconds."""
497
                set_client_prop(prop,
237.23.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
498
                                string_to_delta(value).total_seconds()
499
                                * 1000)
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
500
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
501
            if options.remove:
502
                mandos_serv.RemoveClient(client.__dbus_object_path__)
503
            if options.enable:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
504
                set_client_prop("Enabled", dbus.Boolean(True))
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
505
            if options.disable:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
506
                set_client_prop("Enabled", dbus.Boolean(False))
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
507
            if options.bump_timeout:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
508
                set_client_prop("LastCheckedOK", "")
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
509
            if options.start_checker:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
510
                set_client_prop("CheckerRunning", dbus.Boolean(True))
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
511
            if options.stop_checker:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
512
                set_client_prop("CheckerRunning", dbus.Boolean(False))
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
513
            if options.is_enabled:
237.7.420 by Teddy Hogeborn
PEP8 compliance: mandos-ctl
514
                if client.Get(client_interface, "Enabled",
515
                              dbus_interface=dbus.PROPERTIES_IFACE):
516
                    sys.exit(0)
517
                else:
518
                    sys.exit(1)
237.11.16 by Teddy Hogeborn
* mandos-ctl (main): Bug fix: Handle empty strings correctly.
519
            if options.checker is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
520
                set_client_prop("Checker", options.checker)
237.11.16 by Teddy Hogeborn
* mandos-ctl (main): Bug fix: Handle empty strings correctly.
521
            if options.host is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
522
                set_client_prop("Host", options.host)
237.11.16 by Teddy Hogeborn
* mandos-ctl (main): Bug fix: Handle empty strings correctly.
523
            if options.interval is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
524
                set_client_prop_ms("Interval", options.interval)
237.11.16 by Teddy Hogeborn
* mandos-ctl (main): Bug fix: Handle empty strings correctly.
525
            if options.approval_delay is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
526
                set_client_prop_ms("ApprovalDelay",
527
                                   options.approval_delay)
237.11.16 by Teddy Hogeborn
* mandos-ctl (main): Bug fix: Handle empty strings correctly.
528
            if options.approval_duration is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
529
                set_client_prop_ms("ApprovalDuration",
530
                                   options.approval_duration)
237.11.16 by Teddy Hogeborn
* mandos-ctl (main): Bug fix: Handle empty strings correctly.
531
            if options.timeout is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
532
                set_client_prop_ms("Timeout", options.timeout)
237.11.16 by Teddy Hogeborn
* mandos-ctl (main): Bug fix: Handle empty strings correctly.
533
            if options.extended_timeout is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
534
                set_client_prop_ms("ExtendedTimeout",
535
                                   options.extended_timeout)
237.11.16 by Teddy Hogeborn
* mandos-ctl (main): Bug fix: Handle empty strings correctly.
536
            if options.secret is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
537
                set_client_prop("Secret",
538
                                dbus.ByteArray(options.secret.read()))
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
539
            if options.approved_by_default is not None:
237.20.2 by Teddy Hogeborn
* mandos-ctl (main): Use helper functions to shorten code.
540
                set_client_prop("ApprovedByDefault",
541
                                dbus.Boolean(options
542
                                             .approved_by_default))
237.7.23 by teddy at bsnet
* mandos-ctl: Use the new argparse library instead of optparse.
543
            if options.approve:
544
                client.Approve(dbus.Boolean(True),
545
                               dbus_interface=client_interface)
546
            elif options.deny:
547
                client.Approve(dbus.Boolean(False),
548
                               dbus_interface=client_interface)
24.1.163 by Björn Påhlsson
mandos-client: Added never ending loop for --connect
549
237.7.532 by Teddy Hogeborn
Make mandos-ctl use unittest instead of doctest module
550

237.7.534 by Teddy Hogeborn
Add tests to mandos-ctl's milliseconds_to_string function
551
class Test_milliseconds_to_string(unittest.TestCase):
552
    def test_all(self):
553
        self.assertEqual(milliseconds_to_string(93785000),
554
                         "1T02:03:05")
555
    def test_no_days(self):
556
        self.assertEqual(milliseconds_to_string(7385000), "02:03:05")
557
    def test_all_zero(self):
558
        self.assertEqual(milliseconds_to_string(0), "00:00:00")
559
    def test_no_fractional_seconds(self):
560
        self.assertEqual(milliseconds_to_string(400), "00:00:00")
561
        self.assertEqual(milliseconds_to_string(900), "00:00:00")
562
        self.assertEqual(milliseconds_to_string(1900), "00:00:01")
563
237.7.540 by Teddy Hogeborn
mandos-ctl: Add more tests
564
class Test_string_to_delta(unittest.TestCase):
565
    def test_handles_basic_rfc3339(self):
566
        self.assertEqual(string_to_delta("PT2H"),
567
                         datetime.timedelta(0, 7200))
568
    def test_falls_back_to_pre_1_6_1_with_warning(self):
569
        # assertLogs only exists in Python 3.4
570
        if hasattr(self, "assertLogs"):
571
            with self.assertLogs(log, logging.WARNING):
572
                value = string_to_delta("2h")
573
        else:
574
            value = string_to_delta("2h")
575
        self.assertEqual(value, datetime.timedelta(0, 7200))
576
237.7.534 by Teddy Hogeborn
Add tests to mandos-ctl's milliseconds_to_string function
577

237.7.532 by Teddy Hogeborn
Make mandos-ctl use unittest instead of doctest module
578
def should_only_run_tests():
579
    parser = argparse.ArgumentParser(add_help=False)
580
    parser.add_argument("--check", action='store_true')
581
    args, unknown_args = parser.parse_known_args()
582
    run_tests = args.check
583
    if run_tests:
584
        # Remove --check argument from sys.argv
585
        sys.argv[1:] = unknown_args
586
    return run_tests
587
588
# Add all tests from doctest strings
589
def load_tests(loader, tests, none):
590
    import doctest
591
    tests.addTests(doctest.DocTestSuite())
592
    return tests
237.7.293 by Teddy Hogeborn
mandos-ctl: Do minor formatting and whitespace adjustments.
593
237.8.8 by teddy at bsnet
* mandos-ctl: Use unicode string literals.
594
if __name__ == "__main__":
237.7.532 by Teddy Hogeborn
Make mandos-ctl use unittest instead of doctest module
595
    if should_only_run_tests():
596
        # Call using ./tdd-python-script --check [--verbose]
597
        unittest.main()
598
    else:
599
        main()