2
# -*- mode: python; coding: utf-8; after-save-hook: (lambda () (let ((command (if (and (boundp 'tramp-file-name-structure) (string-match (car tramp-file-name-structure) (buffer-file-name))) (tramp-file-name-localname (tramp-dissect-file-name (buffer-file-name))) (buffer-file-name)))) (if (= (shell-command (format "%s --check" (shell-quote-argument command)) "*Test*") 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)) (kill-buffer "*Test*")) (display-buffer "*Test*")))); -*-
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos Monitor - Control and monitor the Mandos server
6
# Copyright © 2008-2019 Teddy Hogeborn
7
# Copyright © 2008-2019 Björn Påhlsson
9
# This file is part of Mandos.
11
# Mandos is free software: you can redistribute it and/or modify it
12
# under the terms of the GNU General Public License as published by
6
# Copyright © 2008-2012 Teddy Hogeborn
7
# Copyright © 2008-2012 Björn Påhlsson
9
# This program is free software: you can redistribute it and/or modify
10
# it under the terms of the GNU General Public License as published by
13
11
# the Free Software Foundation, either version 3 of the License, or
14
12
# (at your option) any later version.
16
# Mandos is distributed in the hope that it will be useful, but
17
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# This program is distributed in the hope that it will be useful,
15
# but WITHOUT ANY WARRANTY; without even the implied warranty of
18
16
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19
17
# GNU General Public License for more details.
21
19
# You should have received a copy of the GNU General Public License
22
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
20
# along with this program. If not, see
21
# <http://www.gnu.org/licenses/>.
24
23
# Contact the authors at <mandos@recompile.se>.
27
26
from __future__ import (division, absolute_import, print_function,
31
from future_builtins import *
29
from future_builtins import *
48
# Show warnings by default
49
if not sys.warnoptions:
51
warnings.simplefilter("default")
53
log = logging.getLogger(sys.argv[0])
54
logging.basicConfig(level="INFO", # Show info level messages
55
format="%(message)s") # Show basic log messages
57
logging.captureWarnings(True) # Show warnings via the logging system
59
if sys.version_info.major == 2:
62
39
locale.setlocale(locale.LC_ALL, "")
79
55
"ApprovalDelay": "Approval Delay",
80
56
"ApprovalDuration": "Approval Duration",
81
57
"Checker": "Checker",
82
"ExtendedTimeout": "Extended Timeout",
84
"LastCheckerStatus": "Last Checker Status",
58
"ExtendedTimeout" : "Extended Timeout"
86
60
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
87
61
domain = "se.recompile"
88
62
busname = domain + ".Mandos"
90
64
server_interface = domain + ".Mandos"
91
65
client_interface = domain + ".Mandos.Client"
96
dbus.OBJECT_MANAGER_IFACE
97
except AttributeError:
98
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
68
def timedelta_to_milliseconds(td):
69
"""Convert a datetime.timedelta object to milliseconds"""
70
return ((td.days * 24 * 60 * 60 * 1000)
72
+ (td.microseconds // 1000))
101
74
def milliseconds_to_string(ms):
102
75
td = datetime.timedelta(0, 0, 0, ms)
103
76
return ("{days}{hours:02}:{minutes:02}:{seconds:02}"
104
.format(days="{}T".format(td.days) if td.days else "",
105
hours=td.seconds // 3600,
106
minutes=(td.seconds % 3600) // 60,
107
seconds=td.seconds % 60))
110
def rfc3339_duration_to_delta(duration):
111
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
113
>>> rfc3339_duration_to_delta("P7D")
114
datetime.timedelta(7)
115
>>> rfc3339_duration_to_delta("PT60S")
116
datetime.timedelta(0, 60)
117
>>> rfc3339_duration_to_delta("PT60M")
118
datetime.timedelta(0, 3600)
119
>>> rfc3339_duration_to_delta("PT24H")
120
datetime.timedelta(1)
121
>>> rfc3339_duration_to_delta("P1W")
122
datetime.timedelta(7)
123
>>> rfc3339_duration_to_delta("PT5M30S")
124
datetime.timedelta(0, 330)
125
>>> rfc3339_duration_to_delta("P1DT3M20S")
126
datetime.timedelta(1, 200)
129
# Parsing an RFC 3339 duration with regular expressions is not
130
# possible - there would have to be multiple places for the same
131
# values, like seconds. The current code, while more esoteric, is
132
# cleaner without depending on a parsing library. If Python had a
133
# built-in library for parsing we would use it, but we'd like to
134
# avoid excessive use of external libraries.
136
# New type for defining tokens, syntax, and semantics all-in-one
137
Token = collections.namedtuple("Token", (
138
"regexp", # To match token; if "value" is not None, must have
139
# a "group" containing digits
140
"value", # datetime.timedelta or None
141
"followers")) # Tokens valid after this token
142
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
143
# the "duration" ABNF definition in RFC 3339, Appendix A.
144
token_end = Token(re.compile(r"$"), None, frozenset())
145
token_second = Token(re.compile(r"(\d+)S"),
146
datetime.timedelta(seconds=1),
147
frozenset((token_end, )))
148
token_minute = Token(re.compile(r"(\d+)M"),
149
datetime.timedelta(minutes=1),
150
frozenset((token_second, token_end)))
151
token_hour = Token(re.compile(r"(\d+)H"),
152
datetime.timedelta(hours=1),
153
frozenset((token_minute, token_end)))
154
token_time = Token(re.compile(r"T"),
156
frozenset((token_hour, token_minute,
158
token_day = Token(re.compile(r"(\d+)D"),
159
datetime.timedelta(days=1),
160
frozenset((token_time, token_end)))
161
token_month = Token(re.compile(r"(\d+)M"),
162
datetime.timedelta(weeks=4),
163
frozenset((token_day, token_end)))
164
token_year = Token(re.compile(r"(\d+)Y"),
165
datetime.timedelta(weeks=52),
166
frozenset((token_month, token_end)))
167
token_week = Token(re.compile(r"(\d+)W"),
168
datetime.timedelta(weeks=1),
169
frozenset((token_end, )))
170
token_duration = Token(re.compile(r"P"), None,
171
frozenset((token_year, token_month,
172
token_day, token_time,
174
# Define starting values:
176
value = datetime.timedelta()
178
# Following valid tokens
179
followers = frozenset((token_duration, ))
180
# String left to parse
182
# Loop until end token is found
183
while found_token is not token_end:
184
# Search for any currently valid tokens
185
for token in followers:
186
match = token.regexp.match(s)
187
if match is not None:
189
if token.value is not None:
190
# Value found, parse digits
191
factor = int(match.group(1), 10)
192
# Add to value so far
193
value += factor * token.value
194
# Strip token from string
195
s = token.regexp.sub("", s, 1)
198
# Set valid next tokens
199
followers = found_token.followers
202
# No currently valid tokens were found
203
raise ValueError("Invalid RFC 3339 duration: {!r}"
77
.format(days = "{0}T".format(td.days) if td.days else "",
78
hours = td.seconds // 3600,
79
minutes = (td.seconds % 3600) // 60,
80
seconds = td.seconds % 60,
209
83
def string_to_delta(interval):
210
84
"""Parse a string and return a datetime.timedelta
212
>>> string_to_delta('7d')
86
>>> string_to_delta("7d")
213
87
datetime.timedelta(7)
214
>>> string_to_delta('60s')
88
>>> string_to_delta("60s")
215
89
datetime.timedelta(0, 60)
216
>>> string_to_delta('60m')
90
>>> string_to_delta("60m")
217
91
datetime.timedelta(0, 3600)
218
>>> string_to_delta('24h')
92
>>> string_to_delta("24h")
219
93
datetime.timedelta(1)
220
>>> string_to_delta('1w')
94
>>> string_to_delta("1w")
221
95
datetime.timedelta(7)
222
>>> string_to_delta('5m 30s')
96
>>> string_to_delta("5m 30s")
223
97
datetime.timedelta(0, 330)
227
return rfc3339_duration_to_delta(interval)
231
99
value = datetime.timedelta(0)
232
regexp = re.compile(r"(\d+)([dsmhw]?)")
100
regexp = re.compile("(\d+)([dsmhw]?)")
234
102
for num, suffix in regexp.findall(interval):
235
103
if suffix == "d":
236
104
value += datetime.timedelta(int(num))
336
201
parser.add_argument("--approval-duration",
337
202
help="Set duration of one client approval")
338
203
parser.add_argument("-H", "--host", help="Set host for client")
339
parser.add_argument("-s", "--secret",
340
type=argparse.FileType(mode="rb"),
204
parser.add_argument("-s", "--secret", type=file,
341
205
help="Set password blob (file) for client")
342
206
parser.add_argument("-A", "--approve", action="store_true",
343
207
help="Approve any current client request")
344
208
parser.add_argument("-D", "--deny", action="store_true",
345
209
help="Deny any current client request")
346
parser.add_argument("--check", action="store_true",
347
help="Run self-test")
348
210
parser.add_argument("client", nargs="*", help="Client name")
349
211
options = parser.parse_args()
351
213
if has_actions(options) and not (options.client or options.all):
352
214
parser.error("Options require clients names or --all.")
353
215
if options.verbose and has_actions(options):
354
parser.error("--verbose can only be used alone.")
355
if options.dump_json and (options.verbose
356
or has_actions(options)):
357
parser.error("--dump-json can only be used alone.")
216
parser.error("--verbose can only be used alone or with"
358
218
if options.all and not has_actions(options):
359
219
parser.error("--all requires an action.")
362
222
bus = dbus.SystemBus()
363
223
mandos_dbus_objc = bus.get_object(busname, server_path)
364
224
except dbus.exceptions.DBusException:
365
log.critical("Could not connect to Mandos server")
225
print("Could not connect to Mandos server",
368
229
mandos_serv = dbus.Interface(mandos_dbus_objc,
369
dbus_interface=server_interface)
370
mandos_serv_object_manager = dbus.Interface(
371
mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)
373
# block stderr since dbus library prints to stderr
230
dbus_interface = server_interface)
232
#block stderr since dbus library prints to stderr
374
233
null = os.open(os.path.devnull, os.O_RDWR)
375
234
stderrcopy = os.dup(sys.stderr.fileno())
376
235
os.dup2(null, sys.stderr.fileno())
380
mandos_clients = {path: ifs_and_props[client_interface]
381
for path, ifs_and_props in
382
mandos_serv_object_manager
383
.GetManagedObjects().items()
384
if client_interface in ifs_and_props}
239
mandos_clients = mandos_serv.GetAllClientsWithProperties()
387
242
os.dup2(stderrcopy, sys.stderr.fileno())
388
243
os.close(stderrcopy)
389
except dbus.exceptions.DBusException as e:
390
log.critical("Failed to access Mandos server through D-Bus:"
244
except dbus.exceptions.DBusException:
245
print("Access denied: Accessing mandos server through dbus.",
394
249
# Compile dict of (clients: properties) to process
397
252
if options.all or not options.client:
398
clients = {bus.get_object(busname, path): properties
399
for path, properties in mandos_clients.items()}
253
clients = dict((bus.get_object(busname, path), properties)
254
for path, properties in
255
mandos_clients.iteritems())
401
257
for name in options.client:
402
for path, client in mandos_clients.items():
258
for path, client in mandos_clients.iteritems():
403
259
if client["Name"] == name:
404
260
client_objc = bus.get_object(busname, path)
405
261
clients[client_objc] = client
408
log.critical("Client not found on server: %r", name)
264
print("Client not found on server: {0!r}"
265
.format(name), file=sys.stderr)
411
268
if not has_actions(options) and clients:
412
if options.verbose or options.dump_json:
413
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
414
"Created", "Interval", "Host", "KeyID",
415
"Fingerprint", "CheckerRunning",
270
keywords = ("Name", "Enabled", "Timeout",
271
"LastCheckedOK", "Created", "Interval",
272
"Host", "Fingerprint", "CheckerRunning",
416
273
"LastEnabled", "ApprovalPending",
417
"ApprovedByDefault", "LastApprovalRequest",
418
"ApprovalDelay", "ApprovalDuration",
419
"Checker", "ExtendedTimeout", "Expires",
275
"LastApprovalRequest", "ApprovalDelay",
276
"ApprovalDuration", "Checker",
422
279
keywords = defaultkeywords
424
if options.dump_json:
425
json.dump({client["Name"]: {key:
427
if isinstance(client[key],
431
for client in clients.values()},
432
fp=sys.stdout, indent=4,
433
separators=(',', ': '))
436
print_clients(clients.values(), keywords)
281
print_clients(clients.values(), keywords)
438
283
# Process each client in the list by all selected options
439
284
for client in clients:
441
285
def set_client_prop(prop, value):
442
286
"""Set a Client D-Bus property"""
443
287
client.Set(client_interface, prop, value,
444
288
dbus_interface=dbus.PROPERTIES_IFACE)
446
289
def set_client_prop_ms(prop, value):
447
290
"""Set a Client D-Bus property, converted
448
291
from a string to milliseconds."""
449
292
set_client_prop(prop,
450
string_to_delta(value).total_seconds()
293
timedelta_to_milliseconds
294
(string_to_delta(value)))
453
295
if options.remove:
454
296
mandos_serv.RemoveClient(client.__dbus_object_path__)
455
297
if options.enable:
499
341
client.Approve(dbus.Boolean(False),
500
342
dbus_interface=client_interface)
503
class Test_milliseconds_to_string(unittest.TestCase):
505
self.assertEqual(milliseconds_to_string(93785000),
507
def test_no_days(self):
508
self.assertEqual(milliseconds_to_string(7385000), "02:03:05")
509
def test_all_zero(self):
510
self.assertEqual(milliseconds_to_string(0), "00:00:00")
511
def test_no_fractional_seconds(self):
512
self.assertEqual(milliseconds_to_string(400), "00:00:00")
513
self.assertEqual(milliseconds_to_string(900), "00:00:00")
514
self.assertEqual(milliseconds_to_string(1900), "00:00:01")
517
def should_only_run_tests():
518
parser = argparse.ArgumentParser(add_help=False)
519
parser.add_argument("--check", action='store_true')
520
args, unknown_args = parser.parse_known_args()
521
run_tests = args.check
523
# Remove --check argument from sys.argv
524
sys.argv[1:] = unknown_args
527
# Add all tests from doctest strings
528
def load_tests(loader, tests, none):
530
tests.addTests(doctest.DocTestSuite())
533
344
if __name__ == "__main__":
534
if should_only_run_tests():
535
# Call using ./tdd-python-script --check [--verbose]