/mandos/release

#!/usr/bin/python

# -*- mode: python; coding: utf-8; after-save-hook: (lambda () (let ((command (if (and (boundp 'tramp-file-name-structure) (string-match (car tramp-file-name-structure) (buffer-file-name))) (tramp-file-name-localname (tramp-dissect-file-name (buffer-file-name))) (buffer-file-name)))) (if (= (shell-command (format "%s --check" (shell-quote-argument command)) "*Test*") 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)) (kill-buffer "*Test*")) (display-buffer "*Test*")))); -*-

#

# Mandos Monitor - Control and monitor the Mandos server

#

# Copyright © 2008-2019 Teddy Hogeborn

# Copyright © 2008-2019 Björn Påhlsson

#

# This file is part of Mandos.

#

# Mandos is free software: you can redistribute it and/or modify it

# under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

#     Mandos is distributed in the hope that it will be useful, but

#     WITHOUT ANY WARRANTY; without even the implied warranty of

#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

#     GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.

#

# Contact the authors at <mandos@recompile.se>.

#

from __future__ import (division, absolute_import, print_function,

                        unicode_literals)

try:

    from future_builtins import *

except ImportError:

    pass

import sys

import argparse

import locale

import datetime

import re

import os

import collections

import json

import unittest

import logging

import io

import tempfile

import contextlib

import dbus

# Show warnings by default

if not sys.warnoptions:

    import warnings

    warnings.simplefilter("default")

log = logging.getLogger(sys.argv[0])

logging.basicConfig(level="INFO", # Show info level messages

                    format="%(message)s") # Show basic log messages

logging.captureWarnings(True)   # Show warnings via the logging system

if sys.version_info.major == 2:

    str = unicode

    import StringIO

    io.StringIO = StringIO.StringIO

locale.setlocale(locale.LC_ALL, "")

dbus_busname_domain = "se.recompile"

dbus_busname = dbus_busname_domain + ".Mandos"

server_dbus_path = "/"

server_dbus_interface = dbus_busname_domain + ".Mandos"

client_dbus_interface = dbus_busname_domain + ".Mandos.Client"

del dbus_busname_domain

version = "1.8.3"

try:

    dbus.OBJECT_MANAGER_IFACE

except AttributeError:

    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

def main():

    parser = argparse.ArgumentParser()

    add_command_line_options(parser)

    options = parser.parse_args()

    check_option_syntax(parser, options)

    clientnames = options.client

    if options.debug:

        log.setLevel(logging.DEBUG)

    bus = dbus.SystemBus()

    mandos_dbus_object = get_mandos_dbus_object(bus)

    mandos_serv = dbus.Interface(

        mandos_dbus_object, dbus_interface=server_dbus_interface)

    mandos_serv_object_manager = dbus.Interface(

        mandos_dbus_object, dbus_interface=dbus.OBJECT_MANAGER_IFACE)

    managed_objects = get_managed_objects(mandos_serv_object_manager)

    all_clients = {}

    for path, ifs_and_props in managed_objects.items():

        try:

            all_clients[path] = ifs_and_props[client_dbus_interface]

        except KeyError:

            pass

    # Compile dict of (clientpath: properties) to process

    if not clientnames:

        clients = all_clients

    else:

        clients = {}

        for name in clientnames:

            for objpath, properties in all_clients.items():

                if properties["Name"] == name:

                    clients[objpath] = properties

                    break

            else:

                log.critical("Client not found on server: %r", name)

                sys.exit(1)

    commands = commands_from_options(options)

    for command in commands:

        command.run(clients, bus, mandos_serv)

def add_command_line_options(parser):

    parser.add_argument("--version", action="version",

                        version="%(prog)s {}".format(version),

                        help="show version number and exit")

    parser.add_argument("-a", "--all", action="store_true",

                        help="Select all clients")

    parser.add_argument("-v", "--verbose", action="store_true",

                        help="Print all fields")

    parser.add_argument("-j", "--dump-json", action="store_true",

                        help="Dump client data in JSON format")

    enable_disable = parser.add_mutually_exclusive_group()

    enable_disable.add_argument("-e", "--enable", action="store_true",

                                help="Enable client")

    enable_disable.add_argument("-d", "--disable",

                                action="store_true",

                                help="disable client")

    parser.add_argument("-b", "--bump-timeout", action="store_true",

                        help="Bump timeout for client")

    start_stop_checker = parser.add_mutually_exclusive_group()

    start_stop_checker.add_argument("--start-checker",

                                    action="store_true",

                                    help="Start checker for client")

    start_stop_checker.add_argument("--stop-checker",

                                    action="store_true",

                                    help="Stop checker for client")

    parser.add_argument("-V", "--is-enabled", action="store_true",

                        help="Check if client is enabled")

    parser.add_argument("-r", "--remove", action="store_true",

                        help="Remove client")

    parser.add_argument("-c", "--checker",

                        help="Set checker command for client")

    parser.add_argument("-t", "--timeout", type=string_to_delta,

                        help="Set timeout for client")

    parser.add_argument("--extended-timeout", type=string_to_delta,

                        help="Set extended timeout for client")

    parser.add_argument("-i", "--interval", type=string_to_delta,

                        help="Set checker interval for client")

    approve_deny_default = parser.add_mutually_exclusive_group()

    approve_deny_default.add_argument(

        "--approve-by-default", action="store_true",

        default=None, dest="approved_by_default",

        help="Set client to be approved by default")

    approve_deny_default.add_argument(

        "--deny-by-default", action="store_false",

        dest="approved_by_default",

        help="Set client to be denied by default")

    parser.add_argument("--approval-delay", type=string_to_delta,

                        help="Set delay before client approve/deny")

    parser.add_argument("--approval-duration", type=string_to_delta,

                        help="Set duration of one client approval")

    parser.add_argument("-H", "--host", help="Set host for client")

    parser.add_argument("-s", "--secret",

                        type=argparse.FileType(mode="rb"),

                        help="Set password blob (file) for client")

    approve_deny = parser.add_mutually_exclusive_group()

    approve_deny.add_argument(

        "-A", "--approve", action="store_true",

        help="Approve any current client request")

    approve_deny.add_argument("-D", "--deny", action="store_true",

                              help="Deny any current client request")

    parser.add_argument("--debug", action="store_true",

                        help="Debug mode (show D-Bus commands)")

    parser.add_argument("--check", action="store_true",

                        help="Run self-test")

    parser.add_argument("client", nargs="*", help="Client name")

def string_to_delta(interval):

    """Parse a string and return a datetime.timedelta"""

    try:

        return rfc3339_duration_to_delta(interval)

    except ValueError as e:

        log.warning("%s - Parsing as pre-1.6.1 interval instead",

                    ' '.join(e.args))

    return parse_pre_1_6_1_interval(interval)

def rfc3339_duration_to_delta(duration):

    """Parse an RFC 3339 "duration" and return a datetime.timedelta

    >>> rfc3339_duration_to_delta("P7D")

    datetime.timedelta(7)

    >>> rfc3339_duration_to_delta("PT60S")

    datetime.timedelta(0, 60)

    >>> rfc3339_duration_to_delta("PT60M")

    datetime.timedelta(0, 3600)

    >>> rfc3339_duration_to_delta("P60M")

    datetime.timedelta(1680)

    >>> rfc3339_duration_to_delta("PT24H")

    datetime.timedelta(1)

    >>> rfc3339_duration_to_delta("P1W")

    datetime.timedelta(7)

    >>> rfc3339_duration_to_delta("PT5M30S")

    datetime.timedelta(0, 330)

    >>> rfc3339_duration_to_delta("P1DT3M20S")

    datetime.timedelta(1, 200)

    >>> # Can not be empty:

    >>> rfc3339_duration_to_delta("")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: ""

    >>> # Must start with "P":

    >>> rfc3339_duration_to_delta("1D")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: "1D"

    >>> # Must use correct order

    >>> rfc3339_duration_to_delta("PT1S2M")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: "PT1S2M"

    >>> # Time needs time marker

    >>> rfc3339_duration_to_delta("P1H2S")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: "P1H2S"

    >>> # Weeks can not be combined with anything else

    >>> rfc3339_duration_to_delta("P1D2W")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: "P1D2W"

    >>> rfc3339_duration_to_delta("P2W2H")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: "P2W2H"

    """

    # Parsing an RFC 3339 duration with regular expressions is not

    # possible - there would have to be multiple places for the same

    # values, like seconds.  The current code, while more esoteric, is

    # cleaner without depending on a parsing library.  If Python had a

    # built-in library for parsing we would use it, but we'd like to

    # avoid excessive use of external libraries.

    # New type for defining tokens, syntax, and semantics all-in-one

    Token = collections.namedtuple("Token", (

        "regexp",  # To match token; if "value" is not None, must have

                   # a "group" containing digits

        "value",   # datetime.timedelta or None

        "followers"))           # Tokens valid after this token

    # RFC 3339 "duration" tokens, syntax, and semantics; taken from

    # the "duration" ABNF definition in RFC 3339, Appendix A.

    token_end = Token(re.compile(r"$"), None, frozenset())

    token_second = Token(re.compile(r"(\d+)S"),

                         datetime.timedelta(seconds=1),

                         frozenset((token_end, )))

    token_minute = Token(re.compile(r"(\d+)M"),

                         datetime.timedelta(minutes=1),

                         frozenset((token_second, token_end)))

    token_hour = Token(re.compile(r"(\d+)H"),

                       datetime.timedelta(hours=1),

                       frozenset((token_minute, token_end)))

    token_time = Token(re.compile(r"T"),

                       None,

                       frozenset((token_hour, token_minute,

                                  token_second)))

    token_day = Token(re.compile(r"(\d+)D"),

                      datetime.timedelta(days=1),

                      frozenset((token_time, token_end)))

    token_month = Token(re.compile(r"(\d+)M"),

                        datetime.timedelta(weeks=4),

                        frozenset((token_day, token_end)))

    token_year = Token(re.compile(r"(\d+)Y"),

                       datetime.timedelta(weeks=52),

                       frozenset((token_month, token_end)))

    token_week = Token(re.compile(r"(\d+)W"),

                       datetime.timedelta(weeks=1),

                       frozenset((token_end, )))

    token_duration = Token(re.compile(r"P"), None,

                           frozenset((token_year, token_month,

                                      token_day, token_time,

                                      token_week)))

    # Define starting values:

    # Value so far

    value = datetime.timedelta()

    found_token = None

    # Following valid tokens

    followers = frozenset((token_duration, ))

    # String left to parse

    s = duration

    # Loop until end token is found

    while found_token is not token_end:

        # Search for any currently valid tokens

        for token in followers:

            match = token.regexp.match(s)

            if match is not None:

                # Token found

                if token.value is not None:

                    # Value found, parse digits

                    factor = int(match.group(1), 10)

                    # Add to value so far

                    value += factor * token.value

                # Strip token from string

                s = token.regexp.sub("", s, 1)

                # Go to found token

                found_token = token

                # Set valid next tokens

                followers = found_token.followers

                break

        else:

            # No currently valid tokens were found

            raise ValueError("Invalid RFC 3339 duration: \"{}\""

                             .format(duration))

    # End token found

    return value

def parse_pre_1_6_1_interval(interval):

    """Parse an interval string as documented by Mandos before 1.6.1,

    and return a datetime.timedelta

    >>> parse_pre_1_6_1_interval('7d')

    datetime.timedelta(7)

    >>> parse_pre_1_6_1_interval('60s')

    datetime.timedelta(0, 60)

    >>> parse_pre_1_6_1_interval('60m')

    datetime.timedelta(0, 3600)

    >>> parse_pre_1_6_1_interval('24h')

    datetime.timedelta(1)

    >>> parse_pre_1_6_1_interval('1w')

    datetime.timedelta(7)

    >>> parse_pre_1_6_1_interval('5m 30s')

    datetime.timedelta(0, 330)

    >>> parse_pre_1_6_1_interval('')

    datetime.timedelta(0)

    >>> # Ignore unknown characters, allow any order and repetitions

    >>> parse_pre_1_6_1_interval('2dxy7zz11y3m5m')

    datetime.timedelta(2, 480, 18000)

    """

    value = datetime.timedelta(0)

    regexp = re.compile(r"(\d+)([dsmhw]?)")

    for num, suffix in regexp.findall(interval):

        if suffix == "d":

            value += datetime.timedelta(int(num))

        elif suffix == "s":

            value += datetime.timedelta(0, int(num))

        elif suffix == "m":

            value += datetime.timedelta(0, 0, 0, 0, int(num))

        elif suffix == "h":

            value += datetime.timedelta(0, 0, 0, 0, 0, int(num))

        elif suffix == "w":

            value += datetime.timedelta(0, 0, 0, 0, 0, 0, int(num))

        elif suffix == "":

            value += datetime.timedelta(0, 0, 0, int(num))

    return value

def check_option_syntax(parser, options):

    """Apply additional restrictions on options, not expressible in

argparse"""

    def has_actions(options):

        return any((options.enable,

                    options.disable,

                    options.bump_timeout,

                    options.start_checker,

                    options.stop_checker,

                    options.is_enabled,

                    options.remove,

                    options.checker is not None,

                    options.timeout is not None,

                    options.extended_timeout is not None,

                    options.interval is not None,

                    options.approved_by_default is not None,

                    options.approval_delay is not None,

                    options.approval_duration is not None,

                    options.host is not None,

                    options.secret is not None,

                    options.approve,

                    options.deny))

    if has_actions(options) and not (options.client or options.all):

        parser.error("Options require clients names or --all.")

    if options.verbose and has_actions(options):

        parser.error("--verbose can only be used alone.")

    if options.dump_json and (options.verbose

                              or has_actions(options)):

        parser.error("--dump-json can only be used alone.")

    if options.all and not has_actions(options):

        parser.error("--all requires an action.")

    if options.is_enabled and len(options.client) > 1:

        parser.error("--is-enabled requires exactly one client")

    if options.remove:

        options.remove = False

        if has_actions(options) and not options.deny:

            parser.error("--remove can only be combined with --deny")

        options.remove = True

def get_mandos_dbus_object(bus):

    log.debug("D-Bus: Connect to: (busname=%r, path=%r)",

              dbus_busname, server_dbus_path)

    with if_dbus_exception_log_with_exception_and_exit(

            "Could not connect to Mandos server: %s"):

        mandos_dbus_object = bus.get_object(dbus_busname,

                                            server_dbus_path)

    return mandos_dbus_object

@contextlib.contextmanager

def if_dbus_exception_log_with_exception_and_exit(*args, **kwargs):

    try:

        yield

    except dbus.exceptions.DBusException as e:

        log.critical(*(args + (e,)), **kwargs)

        sys.exit(1)

def get_managed_objects(object_manager):

    log.debug("D-Bus: %s:%s:%s.GetManagedObjects()", dbus_busname,

              server_dbus_path, dbus.OBJECT_MANAGER_IFACE)

    with if_dbus_exception_log_with_exception_and_exit(

            "Failed to access Mandos server through D-Bus:\n%s"):

        with SilenceLogger("dbus.proxies"):

            managed_objects = object_manager.GetManagedObjects()

    return managed_objects

class SilenceLogger(object):

    "Simple context manager to silence a particular logger"

    def __init__(self, loggername):

        self.logger = logging.getLogger(loggername)

    def __enter__(self):

        self.logger.addFilter(self.nullfilter)

    class NullFilter(logging.Filter):

        def filter(self, record):

            return False

    nullfilter = NullFilter()

    def __exit__(self, exc_type, exc_val, exc_tb):

        self.logger.removeFilter(self.nullfilter)

def commands_from_options(options):

    commands = []

    if options.is_enabled:

        commands.append(command.IsEnabled())

    if options.approve:

        commands.append(command.Approve())

    if options.deny:

        commands.append(command.Deny())

    if options.remove:

        commands.append(command.Remove())

    if options.dump_json:

        commands.append(command.DumpJSON())

    if options.enable:

        commands.append(command.Enable())

    if options.disable:

        commands.append(command.Disable())

    if options.bump_timeout:

        commands.append(command.BumpTimeout())

    if options.start_checker:

        commands.append(command.StartChecker())

    if options.stop_checker:

        commands.append(command.StopChecker())

    if options.approved_by_default is not None:

        if options.approved_by_default:

            commands.append(command.ApproveByDefault())

        else:

            commands.append(command.DenyByDefault())

    if options.checker is not None:

        commands.append(command.SetChecker(options.checker))

    if options.host is not None:

        commands.append(command.SetHost(options.host))

    if options.secret is not None:

        commands.append(command.SetSecret(options.secret))

    if options.timeout is not None:

        commands.append(command.SetTimeout(options.timeout))

    if options.extended_timeout:

        commands.append(

            command.SetExtendedTimeout(options.extended_timeout))

    if options.interval is not None:

        commands.append(command.SetInterval(options.interval))

    if options.approval_delay is not None:

        commands.append(

            command.SetApprovalDelay(options.approval_delay))

    if options.approval_duration is not None:

        commands.append(

            command.SetApprovalDuration(options.approval_duration))

    # If no command option has been given, show table of clients,

    # optionally verbosely

    if not commands:

        commands.append(command.PrintTable(verbose=options.verbose))

    return commands

class command(object):

    """A namespace for command classes"""

    class Base(object):

        """Abstract base class for commands"""

        def run(self, clients, bus=None, mandos=None):

            """Normal commands should implement run_on_one_client(),

but commands which want to operate on all clients at the same time can

override this run() method instead.

"""

            for clientpath, properties in clients.items():

                log.debug("D-Bus: Connect to: (busname=%r, path=%r)",

                          dbus_busname, str(clientpath))

                client = bus.get_object(dbus_busname, clientpath)

                self.run_on_one_client(client, properties)

    class IsEnabled(Base):

        def run(self, clients, bus=None, mandos=None):

            client, properties = next(iter(clients.items()))

            if self.is_enabled(client, properties):

                sys.exit(0)

            sys.exit(1)

        def is_enabled(self, client, properties):

            return properties["Enabled"]

    class Approve(Base):

        def run_on_one_client(self, client, properties):

            log.debug("D-Bus: %s:%s:%s.Approve(True)", dbus_busname,

                      client.__dbus_object_path__,

                      client_dbus_interface)

            client.Approve(dbus.Boolean(True),

                           dbus_interface=client_dbus_interface)

    class Deny(Base):

        def run_on_one_client(self, client, properties):

            log.debug("D-Bus: %s:%s:%s.Approve(False)", dbus_busname,

                      client.__dbus_object_path__,

                      client_dbus_interface)

            client.Approve(dbus.Boolean(False),

                           dbus_interface=client_dbus_interface)

    class Remove(Base):

        def run(self, clients, bus, mandos):

            for clientpath in clients.keys():

                log.debug("D-Bus: %s:%s:%s.RemoveClient(%r)",

                          dbus_busname, server_dbus_path,

                          server_dbus_interface, clientpath)

                mandos.RemoveClient(clientpath)

    class Output(Base):

        """Abstract class for commands outputting client details"""

        all_keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",

                        "Created", "Interval", "Host", "KeyID",

                        "Fingerprint", "CheckerRunning",

                        "LastEnabled", "ApprovalPending",

                        "ApprovedByDefault", "LastApprovalRequest",

                        "ApprovalDelay", "ApprovalDuration",

                        "Checker", "ExtendedTimeout", "Expires",

                        "LastCheckerStatus")

    class DumpJSON(Output):

        def run(self, clients, bus=None, mandos=None):

            data = {client["Name"]:

                    {key: self.dbus_boolean_to_bool(client[key])

                     for key in self.all_keywords}

                    for client in clients.values()}

            print(json.dumps(data, indent=4, separators=(',', ': ')))

        @staticmethod

        def dbus_boolean_to_bool(value):

            if isinstance(value, dbus.Boolean):

                value = bool(value)

            return value

    class PrintTable(Output):

        def __init__(self, verbose=False):

            self.verbose = verbose

        def run(self, clients, bus=None, mandos=None):

            default_keywords = ("Name", "Enabled", "Timeout",

                                "LastCheckedOK")

            keywords = default_keywords

            if self.verbose:

                keywords = self.all_keywords

            print(self.TableOfClients(clients.values(), keywords))

        class TableOfClients(object):

            tableheaders = {

                "Name": "Name",

                "Enabled": "Enabled",

                "Timeout": "Timeout",

                "LastCheckedOK": "Last Successful Check",

                "LastApprovalRequest": "Last Approval Request",

                "Created": "Created",

                "Interval": "Interval",

                "Host": "Host",

                "Fingerprint": "Fingerprint",

                "KeyID": "Key ID",

                "CheckerRunning": "Check Is Running",

                "LastEnabled": "Last Enabled",

                "ApprovalPending": "Approval Is Pending",

                "ApprovedByDefault": "Approved By Default",

                "ApprovalDelay": "Approval Delay",

                "ApprovalDuration": "Approval Duration",

                "Checker": "Checker",

                "ExtendedTimeout": "Extended Timeout",

                "Expires": "Expires",

                "LastCheckerStatus": "Last Checker Status",

            }

            def __init__(self, clients, keywords):

                self.clients = clients

                self.keywords = keywords

            def __str__(self):

                return "\n".join(self.rows())

            if sys.version_info.major == 2:

                __unicode__ = __str__

                def __str__(self):

                    return str(self).encode(

                        locale.getpreferredencoding())

            def rows(self):