/mandos/release : revision 237.7.20

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8; after-save-hook: (lambda () (let ((command (if (and (boundp 'tramp-file-name-structure) (string-match (car tramp-file-name-structure) (buffer-file-name))) (tramp-file-name-localname (tramp-dissect-file-name (buffer-file-name))) (buffer-file-name)))) (if (= (shell-command (format "%s --check" (shell-quote-argument command)) "*Test*") 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)) (kill-buffer "*Test*")) (display-buffer "*Test*")))); -*-

3

#

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos Monitor - Control and monitor the Mandos server

5

#

6

7

8

#

9

# This file is part of Mandos.

10

#

11

# Mandos is free software: you can redistribute it and/or modify it

12

# under the terms of the GNU General Public License as published by

5

#

6

7

8

#

9

# This program is free software: you can redistribute it and/or modify

10

# it under the terms of the GNU General Public License as published by

13

11

# the Free Software Foundation, either version 3 of the License, or

14

12

# (at your option) any later version.

15

13

#

16

# Mandos is distributed in the hope that it will be useful, but

17

# WITHOUT ANY WARRANTY; without even the implied warranty of

14

# This program is distributed in the hope that it will be useful,

15

# but WITHOUT ANY WARRANTY; without even the implied warranty of

18

16

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

19

17

# GNU General Public License for more details.

20

#

18

#

21

19

# You should have received a copy of the GNU General Public License

22

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

23

#

24

# Contact the authors at <mandos@recompile.se>.

25

#

20

# along with this program. If not, see <http://www.gnu.org/licenses/>.

21

#

22

# Contact the authors at <mandos@fukt.bsnet.se>.

23

#

26

24

27

25

from __future__ import (division, absolute_import, print_function,

28

26

unicode_literals)

29

27

30

try:

31

from future_builtins import *

32

except ImportError:

33

pass

34

35

28

import sys

36

import argparse

29

import dbus

30

from optparse import OptionParser

37

31

import locale

38

32

import datetime

39

33

import re

40

34

import os

41

import collections

42

import json

43

import unittest

44

import logging

45

import io

46

import tempfile

47

import contextlib

48

49

import dbus

50

51

# Show warnings by default

52

if not sys.warnoptions:

53

import warnings

54

warnings.simplefilter("default")

55

56

log = logging.getLogger(sys.argv[0])

57

logging.basicConfig(level="INFO", # Show info level messages

58

format="%(message)s") # Show basic log messages

59

60

logging.captureWarnings(True) # Show warnings via the logging system

61

62

if sys.version_info.major == 2:

63

str = unicode

64

35

65

36

locale.setlocale(locale.LC_ALL, "")

66

37

67

dbus_busname_domain = "se.recompile"

68

dbus_busname = dbus_busname_domain + ".Mandos"

69

server_dbus_path = "/"

70

server_dbus_interface = dbus_busname_domain + ".Mandos"

71

client_dbus_interface = dbus_busname_domain + ".Mandos.Client"

72

del dbus_busname_domain

73

version = "1.8.3"

74

75

76

try:

77

dbus.OBJECT_MANAGER_IFACE

78

except AttributeError:

79

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

80

81

38

tablewords = {

39

"Name": "Name",

40

"Enabled": "Enabled",

41

"Timeout": "Timeout",

42

"LastCheckedOK": "Last Successful Check",

43

"LastApprovalRequest": "Last Approval Request",

44

"Created": "Created",

45

"Interval": "Interval",

46

"Host": "Host",

47

"Fingerprint": "Fingerprint",

48

"CheckerRunning": "Check Is Running",

49

"LastEnabled": "Last Enabled",

50

"ApprovalPending": "Approval Is Pending",

51

"ApprovedByDefault": "Approved By Default",

52

"ApprovalDelay": "Approval Delay",

53

"ApprovalDuration": "Approval Duration",

54

"Checker": "Checker",

55

}

56

defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")

57

domain = "se.bsnet.fukt"

58

busname = domain + ".Mandos"

59

server_path = "/"

60

server_interface = domain + ".Mandos"

61

client_interface = domain + ".Mandos.Client"

62

version = "1.2.3"

63

64

def timedelta_to_milliseconds(td):

65

"""Convert a datetime.timedelta object to milliseconds"""

66

return ((td.days * 24 * 60 * 60 * 1000)

67

+ (td.seconds * 1000)

68

+ (td.microseconds // 1000))

69

70

def milliseconds_to_string(ms):

71

td = datetime.timedelta(0, 0, 0, ms)

72

return ("%(days)s%(hours)02d:%(minutes)02d:%(seconds)02d"

73

% { "days": "%dT" % td.days if td.days else "",

74

"hours": td.seconds // 3600,

75

"minutes": (td.seconds % 3600) // 60,

76

"seconds": td.seconds % 60,

77

})

78

79

80

def string_to_delta(interval):

81

"""Parse a string and return a datetime.timedelta

82

83

>>> string_to_delta("7d")

84

datetime.timedelta(7)

85

>>> string_to_delta("60s")

86

datetime.timedelta(0, 60)

87

>>> string_to_delta("60m")

88

datetime.timedelta(0, 3600)

89

>>> string_to_delta("24h")

90

datetime.timedelta(1)

91

>>> string_to_delta("1w")

92

datetime.timedelta(7)

93

>>> string_to_delta("5m 30s")

94

datetime.timedelta(0, 330)

95

"""

96

timevalue = datetime.timedelta(0)

97

regexp = re.compile("\d+[dsmhw]")

98

99

for s in regexp.findall(interval):

100

try:

101

suffix = unicode(s[-1])

102

value = int(s[:-1])

103

if suffix == "d":

104

delta = datetime.timedelta(value)

105

elif suffix == "s":

106

delta = datetime.timedelta(0, value)

107

elif suffix == "m":

108

delta = datetime.timedelta(0, 0, 0, 0, value)

109

elif suffix == "h":

110

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

111

elif suffix == "w":

112

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

113

else:

114

raise ValueError

115

except (ValueError, IndexError):

116

raise ValueError

117

timevalue += delta

118

return timevalue

119

120

def print_clients(clients, keywords):

121

def valuetostring(value, keyword):

122

if type(value) is dbus.Boolean:

123

return "Yes" if value else "No"

124

if keyword in ("Timeout", "Interval", "ApprovalDelay",

125

"ApprovalDuration"):

126

return milliseconds_to_string(value)

127

return unicode(value)

128

129

# Create format string to print table rows

130

format_string = " ".join("%%-%ds" %

131

max(len(tablewords[key]),

132

max(len(valuetostring(client[key],

133

key))

134

for client in

135

clients))

136

for key in keywords)

137

# Print header line

138

print(format_string % tuple(tablewords[key] for key in keywords))

139

for client in clients:

140

print(format_string % tuple(valuetostring(client[key], key)

141

for key in keywords))

142

143

def has_actions(options):

144

return any((options.enable,

145

options.disable,

146

options.bump_timeout,

147

options.start_checker,

148

options.stop_checker,

149

options.is_enabled,

150

options.remove,

151

options.checker is not None,

152

options.timeout is not None,

153

options.interval is not None,

154

options.approved_by_default is not None,

155

options.approval_delay is not None,

156

options.approval_duration is not None,

157

options.host is not None,

158

options.secret is not None,

159

options.approve,

160

options.deny))

161

82

162

def main():

83

parser = argparse.ArgumentParser()

84

85

add_command_line_options(parser)

86

87

options = parser.parse_args()

88

89

check_option_syntax(parser, options)

90

91

clientnames = options.client

92

93

if options.debug:

94

log.setLevel(logging.DEBUG)

95

96

try:

97

bus = dbus.SystemBus()

98

log.debug("D-Bus: Connect to: (busname=%r, path=%r)",

99

dbus_busname, server_dbus_path)

100

mandos_dbus_objc = bus.get_object(dbus_busname,

101

server_dbus_path)

102

except dbus.exceptions.DBusException:

103

log.critical("Could not connect to Mandos server")

104

sys.exit(1)

105

106

mandos_serv = dbus.Interface(mandos_dbus_objc,

107

dbus_interface=server_dbus_interface)

108

mandos_serv_object_manager = dbus.Interface(

109

mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)

110

111

# Filter out log message from dbus module

112

dbus_logger = logging.getLogger("dbus.proxies")

113

class NullFilter(logging.Filter):

114

def filter(self, record):

115

return False

116

dbus_filter = NullFilter()

117

try:

118

dbus_logger.addFilter(dbus_filter)

119

log.debug("D-Bus: %s:%s:%s.GetManagedObjects()", dbus_busname,

120

server_dbus_path, dbus.OBJECT_MANAGER_IFACE)

121

mandos_clients = {path: ifs_and_props[client_dbus_interface]

122

for path, ifs_and_props in

123

mandos_serv_object_manager

124

.GetManagedObjects().items()

125

if client_dbus_interface in ifs_and_props}

126

except dbus.exceptions.DBusException as e:

127

log.critical("Failed to access Mandos server through D-Bus:"

128

"\n%s", e)

129

sys.exit(1)

130

finally:

131

# restore dbus logger

132

dbus_logger.removeFilter(dbus_filter)

133

134

# Compile dict of (clients: properties) to process

135

clients = {}

136

137

if not clientnames:

138

clients = {objpath: properties

139

for objpath, properties in mandos_clients.items()}

140

else:

141

for name in clientnames:

142

for objpath, properties in mandos_clients.items():

143

if properties["Name"] == name:

144

clients[objpath] = properties

145

break

146

else:

147

log.critical("Client not found on server: %r", name)

148

sys.exit(1)

149

150

# Run all commands on clients

151

commands = commands_from_options(options)

152

for command in commands:

153

command.run(clients, bus, mandos_serv)

154

155

156

def add_command_line_options(parser):

157

parser.add_argument("--version", action="version",

158

version="%(prog)s {}".format(version),

159

help="show version number and exit")

160

parser.add_argument("-a", "--all", action="store_true",

161

help="Select all clients")

162

parser.add_argument("-v", "--verbose", action="store_true",

163

help="Print all fields")

164

parser.add_argument("-j", "--dump-json", action="store_true",

165

help="Dump client data in JSON format")

166

enable_disable = parser.add_mutually_exclusive_group()

167

enable_disable.add_argument("-e", "--enable", action="store_true",

168

help="Enable client")

169

enable_disable.add_argument("-d", "--disable",

170

action="store_true",

171

help="disable client")

172

parser.add_argument("-b", "--bump-timeout", action="store_true",

173

help="Bump timeout for client")

174

start_stop_checker = parser.add_mutually_exclusive_group()

175

start_stop_checker.add_argument("--start-checker",

176

action="store_true",

177

help="Start checker for client")

178

start_stop_checker.add_argument("--stop-checker",

179

action="store_true",

180

help="Stop checker for client")

181

parser.add_argument("-V", "--is-enabled", action="store_true",

182

help="Check if client is enabled")

183

parser.add_argument("-r", "--remove", action="store_true",

184

help="Remove client")

185

parser.add_argument("-c", "--checker",

186

help="Set checker command for client")

187

parser.add_argument("-t", "--timeout", type=string_to_delta,

188

help="Set timeout for client")

189

parser.add_argument("--extended-timeout", type=string_to_delta,

190

help="Set extended timeout for client")

191

parser.add_argument("-i", "--interval", type=string_to_delta,

192

help="Set checker interval for client")

193

approve_deny_default = parser.add_mutually_exclusive_group()

194

approve_deny_default.add_argument(

195

"--approve-by-default", action="store_true",

196

default=None, dest="approved_by_default",

197

help="Set client to be approved by default")

198

approve_deny_default.add_argument(

199

"--deny-by-default", action="store_false",

200

dest="approved_by_default",

201

help="Set client to be denied by default")

202

parser.add_argument("--approval-delay", type=string_to_delta,

203

help="Set delay before client approve/deny")

204

parser.add_argument("--approval-duration", type=string_to_delta,

205

help="Set duration of one client approval")

206

parser.add_argument("-H", "--host", help="Set host for client")

207

parser.add_argument("-s", "--secret",

208

type=argparse.FileType(mode="rb"),

209

help="Set password blob (file) for client")

210

approve_deny = parser.add_mutually_exclusive_group()

211

approve_deny.add_argument(

212

"-A", "--approve", action="store_true",

213

help="Approve any current client request")

214

approve_deny.add_argument("-D", "--deny", action="store_true",

215

help="Deny any current client request")

216

parser.add_argument("--debug", action="store_true",

217

help="Debug mode (show D-Bus commands)")

218

parser.add_argument("--check", action="store_true",

219

help="Run self-test")

220

parser.add_argument("client", nargs="*", help="Client name")

221

222

223

def string_to_delta(interval):

224

"""Parse a string and return a datetime.timedelta"""

225

226

try:

227

return rfc3339_duration_to_delta(interval)

228

except ValueError as e:

229

log.warning("%s - Parsing as pre-1.6.1 interval instead",

230

' '.join(e.args))

231

return parse_pre_1_6_1_interval(interval)

232

233

234

def rfc3339_duration_to_delta(duration):

235

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

236

237

>>> rfc3339_duration_to_delta("P7D")

238

datetime.timedelta(7)

239

>>> rfc3339_duration_to_delta("PT60S")

240

datetime.timedelta(0, 60)

241

>>> rfc3339_duration_to_delta("PT60M")

242

datetime.timedelta(0, 3600)

243

>>> rfc3339_duration_to_delta("P60M")

244

datetime.timedelta(1680)

245

>>> rfc3339_duration_to_delta("PT24H")

246

datetime.timedelta(1)

247

>>> rfc3339_duration_to_delta("P1W")

248

datetime.timedelta(7)

249

>>> rfc3339_duration_to_delta("PT5M30S")

250

datetime.timedelta(0, 330)

251

>>> rfc3339_duration_to_delta("P1DT3M20S")

252

datetime.timedelta(1, 200)

253

>>> # Can not be empty:

254

>>> rfc3339_duration_to_delta("")

255

Traceback (most recent call last):

256

...

257

ValueError: Invalid RFC 3339 duration: u''

258

>>> # Must start with "P":

259

>>> rfc3339_duration_to_delta("1D")

260

Traceback (most recent call last):

261

...

262

ValueError: Invalid RFC 3339 duration: u'1D'

263

>>> # Must use correct order

264

>>> rfc3339_duration_to_delta("PT1S2M")

265

Traceback (most recent call last):

266

...

267

ValueError: Invalid RFC 3339 duration: u'PT1S2M'

268

>>> # Time needs time marker

269

>>> rfc3339_duration_to_delta("P1H2S")

270

Traceback (most recent call last):

271

...

272

ValueError: Invalid RFC 3339 duration: u'P1H2S'

273

>>> # Weeks can not be combined with anything else

274

>>> rfc3339_duration_to_delta("P1D2W")

275

Traceback (most recent call last):

276

...

277

ValueError: Invalid RFC 3339 duration: u'P1D2W'

278

>>> rfc3339_duration_to_delta("P2W2H")

279

Traceback (most recent call last):

280

...

281

ValueError: Invalid RFC 3339 duration: u'P2W2H'

282

"""

283

284

# Parsing an RFC 3339 duration with regular expressions is not

285

# possible - there would have to be multiple places for the same

286

# values, like seconds. The current code, while more esoteric, is

287

# cleaner without depending on a parsing library. If Python had a

288

# built-in library for parsing we would use it, but we'd like to

289

# avoid excessive use of external libraries.

290

291

# New type for defining tokens, syntax, and semantics all-in-one

292

Token = collections.namedtuple("Token", (

293

"regexp", # To match token; if "value" is not None, must have

294

# a "group" containing digits

295

"value", # datetime.timedelta or None

296

"followers")) # Tokens valid after this token

297

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

298

# the "duration" ABNF definition in RFC 3339, Appendix A.

299

token_end = Token(re.compile(r"$"), None, frozenset())

300

token_second = Token(re.compile(r"(\d+)S"),

301

datetime.timedelta(seconds=1),

302

frozenset((token_end, )))

303

token_minute = Token(re.compile(r"(\d+)M"),

304

datetime.timedelta(minutes=1),

305

frozenset((token_second, token_end)))

306

token_hour = Token(re.compile(r"(\d+)H"),

307

datetime.timedelta(hours=1),

308

frozenset((token_minute, token_end)))

309

token_time = Token(re.compile(r"T"),

310

None,

311

frozenset((token_hour, token_minute,

312

token_second)))

313

token_day = Token(re.compile(r"(\d+)D"),

314

datetime.timedelta(days=1),

315

frozenset((token_time, token_end)))

316

token_month = Token(re.compile(r"(\d+)M"),

317

datetime.timedelta(weeks=4),

318

frozenset((token_day, token_end)))

319

token_year = Token(re.compile(r"(\d+)Y"),

320

datetime.timedelta(weeks=52),

321

frozenset((token_month, token_end)))

322

token_week = Token(re.compile(r"(\d+)W"),

323

datetime.timedelta(weeks=1),

324

frozenset((token_end, )))

325

token_duration = Token(re.compile(r"P"), None,

326

frozenset((token_year, token_month,

327

token_day, token_time,

328

token_week)))

329

# Define starting values:

330

# Value so far

331

value = datetime.timedelta()

332

found_token = None

333

# Following valid tokens

334

followers = frozenset((token_duration, ))

335

# String left to parse

336

s = duration

337

# Loop until end token is found

338

while found_token is not token_end:

339

# Search for any currently valid tokens

340

for token in followers:

341

match = token.regexp.match(s)

342

if match is not None:

343

# Token found

344

if token.value is not None:

345

# Value found, parse digits

346

factor = int(match.group(1), 10)

347

# Add to value so far

348

value += factor * token.value

349

# Strip token from string

350

s = token.regexp.sub("", s, 1)

351

# Go to found token

352

found_token = token

353

# Set valid next tokens

354

followers = found_token.followers

355

break

356

else:

357

# No currently valid tokens were found

358

raise ValueError("Invalid RFC 3339 duration: {!r}"

359

.format(duration))

360

# End token found

361

return value

362

363

364

def parse_pre_1_6_1_interval(interval):

365

"""Parse an interval string as documented by Mandos before 1.6.1,

366

and return a datetime.timedelta

367

368

>>> parse_pre_1_6_1_interval('7d')

369

datetime.timedelta(7)

370

>>> parse_pre_1_6_1_interval('60s')

371

datetime.timedelta(0, 60)

372

>>> parse_pre_1_6_1_interval('60m')

373

datetime.timedelta(0, 3600)

374

>>> parse_pre_1_6_1_interval('24h')

375

datetime.timedelta(1)

376

>>> parse_pre_1_6_1_interval('1w')

377

datetime.timedelta(7)

378

>>> parse_pre_1_6_1_interval('5m 30s')

379

datetime.timedelta(0, 330)

380

>>> parse_pre_1_6_1_interval('')

381

datetime.timedelta(0)

382

>>> # Ignore unknown characters, allow any order and repetitions

383

>>> parse_pre_1_6_1_interval('2dxy7zz11y3m5m')

384

datetime.timedelta(2, 480, 18000)

385

386

"""

387

388

value = datetime.timedelta(0)

389

regexp = re.compile(r"(\d+)([dsmhw]?)")

390

391

for num, suffix in regexp.findall(interval):

392

if suffix == "d":

393

value += datetime.timedelta(int(num))

394

elif suffix == "s":

395

value += datetime.timedelta(0, int(num))

396

elif suffix == "m":

397

value += datetime.timedelta(0, 0, 0, 0, int(num))

398

elif suffix == "h":

399

value += datetime.timedelta(0, 0, 0, 0, 0, int(num))

400

elif suffix == "w":

401

value += datetime.timedelta(0, 0, 0, 0, 0, 0, int(num))

402

elif suffix == "":

403

value += datetime.timedelta(0, 0, 0, int(num))

404

return value

405

406

407

def check_option_syntax(parser, options):

408

"""Apply additional restrictions on options, not expressible in

409

argparse"""

410

411

def has_actions(options):

412

return any((options.enable,

413

options.disable,

414

options.bump_timeout,

415

options.start_checker,

416

options.stop_checker,

417

options.is_enabled,

418

options.remove,

419

options.checker is not None,

420

options.timeout is not None,

421

options.extended_timeout is not None,

422

options.interval is not None,

423

options.approved_by_default is not None,

424

options.approval_delay is not None,

425

options.approval_duration is not None,

426

options.host is not None,

427

options.secret is not None,

428

options.approve,

429

options.deny))

430

431

if has_actions(options) and not (options.client or options.all):

432

parser.error("Options require clients names or --all.")

433

if options.verbose and has_actions(options):

434

parser.error("--verbose can only be used alone.")

435

if options.dump_json and (options.verbose

436

or has_actions(options)):

437

parser.error("--dump-json can only be used alone.")

438

if options.all and not has_actions(options):

439

parser.error("--all requires an action.")

440

if options.is_enabled and len(options.client) > 1:

441

parser.error("--is-enabled requires exactly one client")

442

if options.remove:

443

options.remove = False

444

if has_actions(options) and not options.deny:

445

parser.error("--remove can only be combined with --deny")

446

options.remove = True

447

448

449

def commands_from_options(options):

450

451

commands = []

452

453

if options.is_enabled:

454

commands.append(IsEnabledCmd())

455

456

if options.approve:

457

commands.append(ApproveCmd())

458

459

if options.deny:

460

commands.append(DenyCmd())

461

462

if options.remove:

463

commands.append(RemoveCmd())

464

465

if options.dump_json:

466

commands.append(DumpJSONCmd())

467

468

if options.enable:

469

commands.append(EnableCmd())

470

471

if options.disable:

472

commands.append(DisableCmd())

473

474

if options.bump_timeout:

475

commands.append(BumpTimeoutCmd())

476

477

if options.start_checker:

478

commands.append(StartCheckerCmd())

479

480

if options.stop_checker:

481

commands.append(StopCheckerCmd())

482

483

if options.approved_by_default is not None:

484

if options.approved_by_default:

485

commands.append(ApproveByDefaultCmd())

486

else:

487

commands.append(DenyByDefaultCmd())

488

489

if options.checker is not None:

490

commands.append(SetCheckerCmd(options.checker))

491

492

if options.host is not None:

493

commands.append(SetHostCmd(options.host))

494

495

if options.secret is not None:

496

commands.append(SetSecretCmd(options.secret))

497

498

if options.timeout is not None:

499

commands.append(SetTimeoutCmd(options.timeout))

500

501

if options.extended_timeout:

502

commands.append(

503

SetExtendedTimeoutCmd(options.extended_timeout))

504

505

if options.interval is not None:

506

commands.append(SetIntervalCmd(options.interval))

507

508

if options.approval_delay is not None:

509

commands.append(SetApprovalDelayCmd(options.approval_delay))

510

511

if options.approval_duration is not None:

512

commands.append(

513

SetApprovalDurationCmd(options.approval_duration))

514

515

# If no command option has been given, show table of clients,

516

# optionally verbosely

517

if not commands:

518

commands.append(PrintTableCmd(verbose=options.verbose))

519

520

return commands

521

522

523

class Command(object):

524

"""Abstract class for commands"""

525

def run(self, clients, bus=None, mandos=None):

526

"""Normal commands should implement run_on_one_client(), but

527

commands which want to operate on all clients at the same time

528

can override this run() method instead."""

529

self.mandos = mandos

530

for clientpath, properties in clients.items():

531

log.debug("D-Bus: Connect to: (busname=%r, path=%r)",

532

dbus_busname, str(clientpath))

533

client = bus.get_object(dbus_busname, clientpath)

534

self.run_on_one_client(client, properties)

535

536

537

class IsEnabledCmd(Command):

538

def run(self, clients, bus=None, mandos=None):

539

client, properties = next(iter(clients.items()))

540

if self.is_enabled(client, properties):

541

sys.exit(0)

542

sys.exit(1)

543

def is_enabled(self, client, properties):

544

return properties["Enabled"]

545

546

547

class ApproveCmd(Command):

548

def run_on_one_client(self, client, properties):

549

log.debug("D-Bus: %s:%s:%s.Approve(True)", dbus_busname,

550

client.__dbus_object_path__, client_dbus_interface)

551

client.Approve(dbus.Boolean(True),

552

dbus_interface=client_dbus_interface)

553

554

555

class DenyCmd(Command):

556

def run_on_one_client(self, client, properties):

557

log.debug("D-Bus: %s:%s:%s.Approve(False)", dbus_busname,

558

client.__dbus_object_path__, client_dbus_interface)

559

client.Approve(dbus.Boolean(False),

560

dbus_interface=client_dbus_interface)

561

562

563

class RemoveCmd(Command):

564

def run_on_one_client(self, client, properties):

565

log.debug("D-Bus: %s:%s:%s.RemoveClient(%r)", dbus_busname,

566

server_dbus_path, server_dbus_interface,

567

str(client.__dbus_object_path__))

568

self.mandos.RemoveClient(client.__dbus_object_path__)

569

570

571

class OutputCmd(Command):

572

"""Abstract class for commands outputting client details"""

573

all_keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",

574

"Created", "Interval", "Host", "KeyID",

575

"Fingerprint", "CheckerRunning", "LastEnabled",

576

"ApprovalPending", "ApprovedByDefault",

577

"LastApprovalRequest", "ApprovalDelay",

578

"ApprovalDuration", "Checker", "ExtendedTimeout",

579

"Expires", "LastCheckerStatus")

580

581

def run(self, clients, bus=None, mandos=None):

582

print(self.output(clients.values()))

583

584

def output(self, clients):

585

raise NotImplementedError()

586

587

588

class DumpJSONCmd(OutputCmd):

589

def output(self, clients):

590

data = {client["Name"]:

591

{key: self.dbus_boolean_to_bool(client[key])

592

for key in self.all_keywords}

593

for client in clients.values()}

594

return json.dumps(data, indent=4, separators=(',', ': '))

595

596

@staticmethod

597

def dbus_boolean_to_bool(value):

598

if isinstance(value, dbus.Boolean):

599

value = bool(value)

600

return value

601

602

603

class PrintTableCmd(OutputCmd):

604

def __init__(self, verbose=False):

605

self.verbose = verbose

606

607

def output(self, clients):

608

default_keywords = ("Name", "Enabled", "Timeout",

609

"LastCheckedOK")

610

keywords = default_keywords

611

if self.verbose:

612

keywords = self.all_keywords

613

return str(self.TableOfClients(clients, keywords))

614

615

class TableOfClients(object):

616

tableheaders = {

617

"Name": "Name",

618

"Enabled": "Enabled",

619

"Timeout": "Timeout",

620

"LastCheckedOK": "Last Successful Check",

621

"LastApprovalRequest": "Last Approval Request",

622

"Created": "Created",

623

"Interval": "Interval",

624

"Host": "Host",

625

"Fingerprint": "Fingerprint",

626

"KeyID": "Key ID",

627

"CheckerRunning": "Check Is Running",

628

"LastEnabled": "Last Enabled",

629

"ApprovalPending": "Approval Is Pending",

630

"ApprovedByDefault": "Approved By Default",

631

"ApprovalDelay": "Approval Delay",

632

"ApprovalDuration": "Approval Duration",

633

"Checker": "Checker",

634

"ExtendedTimeout": "Extended Timeout",

635

"Expires": "Expires",

636

"LastCheckerStatus": "Last Checker Status",

637

}

638

639

def __init__(self, clients, keywords, tableheaders=None):

640

self.clients = clients

641

self.keywords = keywords

642

if tableheaders is not None:

643

self.tableheaders = tableheaders

644

645

def __str__(self):

646

return "\n".join(self.rows())

647

648

if sys.version_info.major == 2:

649

__unicode__ = __str__

650

def __str__(self):

651

return str(self).encode(locale.getpreferredencoding())

652

653

def rows(self):

654

format_string = self.row_formatting_string()

655

rows = [self.header_line(format_string)]

656

rows.extend(self.client_line(client, format_string)

657

for client in self.clients)

658

return rows

659

660

def row_formatting_string(self):

661

"Format string used to format table rows"

662

return " ".join("{{{key}:{width}}}".format(

663

width=max(len(self.tableheaders[key]),

664

*(len(self.string_from_client(client, key))

665

for client in self.clients)),

666

key=key)

667

for key in self.keywords)

668

669

def string_from_client(self, client, key):

670

return self.valuetostring(client[key], key)

671

672

@classmethod

673

def valuetostring(cls, value, keyword):

674

if isinstance(value, dbus.Boolean):

675

return "Yes" if value else "No"

676

if keyword in ("Timeout", "Interval", "ApprovalDelay",

677

"ApprovalDuration", "ExtendedTimeout"):

678

return cls.milliseconds_to_string(value)

679

return str(value)

680

681

def header_line(self, format_string):

682

return format_string.format(**self.tableheaders)

683

684

def client_line(self, client, format_string):

685

return format_string.format(

686

**{key: self.string_from_client(client, key)

687

for key in self.keywords})

688

689

@staticmethod

690

def milliseconds_to_string(ms):

691

td = datetime.timedelta(0, 0, 0, ms)

692

return ("{days}{hours:02}:{minutes:02}:{seconds:02}"

693

.format(days="{}T".format(td.days)

694

if td.days else "",

695

hours=td.seconds // 3600,

696

minutes=(td.seconds % 3600) // 60,

697

seconds=td.seconds % 60))

698

699

700

class PropertyCmd(Command):

701

"""Abstract class for Actions for setting one client property"""

702

703

def run_on_one_client(self, client, properties):

704

"""Set the Client's D-Bus property"""

705

log.debug("D-Bus: %s:%s:%s.Set(%r, %r, %r)", dbus_busname,

706

client.__dbus_object_path__,

707

dbus.PROPERTIES_IFACE, client_dbus_interface,

708

self.propname, self.value_to_set

709

if not isinstance(self.value_to_set, dbus.Boolean)

710

else bool(self.value_to_set))

711

client.Set(client_dbus_interface, self.propname,

712

self.value_to_set,

713

dbus_interface=dbus.PROPERTIES_IFACE)

714

715

@property

716

def propname(self):

717

raise NotImplementedError()

718

719

720

class EnableCmd(PropertyCmd):

721

propname = "Enabled"

722

value_to_set = dbus.Boolean(True)

723

724

725

class DisableCmd(PropertyCmd):

726

propname = "Enabled"

727

value_to_set = dbus.Boolean(False)

728

729

730

class BumpTimeoutCmd(PropertyCmd):

731

propname = "LastCheckedOK"

732

value_to_set = ""

733

734

735

class StartCheckerCmd(PropertyCmd):

736

propname = "CheckerRunning"

737

value_to_set = dbus.Boolean(True)

738

739

740

class StopCheckerCmd(PropertyCmd):

741

propname = "CheckerRunning"

742

value_to_set = dbus.Boolean(False)

743

744

745

class ApproveByDefaultCmd(PropertyCmd):

746

propname = "ApprovedByDefault"

747

value_to_set = dbus.Boolean(True)

748

749

750

class DenyByDefaultCmd(PropertyCmd):

751

propname = "ApprovedByDefault"

752

value_to_set = dbus.Boolean(False)

753

754

755

class PropertyValueCmd(PropertyCmd):

756

"""Abstract class for PropertyCmd recieving a value as argument"""

757

def __init__(self, value):

758

self.value_to_set = value

759

760

761

class SetCheckerCmd(PropertyValueCmd):

762

propname = "Checker"

763

764

765

class SetHostCmd(PropertyValueCmd):

766

propname = "Host"

767

768

769

class SetSecretCmd(PropertyValueCmd):

770

propname = "Secret"

771

772

@property

773

def value_to_set(self):

774

return self._vts

775

776

@value_to_set.setter

777

def value_to_set(self, value):

778

"""When setting, read data from supplied file object"""

779

self._vts = value.read()

780

value.close()

781

782

783

class MillisecondsPropertyValueArgumentCmd(PropertyValueCmd):

784

"""Abstract class for PropertyValueCmd taking a value argument as

785

a datetime.timedelta() but should store it as milliseconds."""

786

787

@property

788

def value_to_set(self):

789

return self._vts

790

791

@value_to_set.setter

792

def value_to_set(self, value):

793

"""When setting, convert value from a datetime.timedelta"""

794

self._vts = int(round(value.total_seconds() * 1000))

795

796

797

class SetTimeoutCmd(MillisecondsPropertyValueArgumentCmd):

798

propname = "Timeout"

799

800

801

class SetExtendedTimeoutCmd(MillisecondsPropertyValueArgumentCmd):

802

propname = "ExtendedTimeout"

803

804

805

class SetIntervalCmd(MillisecondsPropertyValueArgumentCmd):

806

propname = "Interval"

807

808

809

class SetApprovalDelayCmd(MillisecondsPropertyValueArgumentCmd):

810

propname = "ApprovalDelay"

811

812

813

class SetApprovalDurationCmd(MillisecondsPropertyValueArgumentCmd):

814

propname = "ApprovalDuration"

815

816

817

818

class Test_string_to_delta(unittest.TestCase):

819

def test_handles_basic_rfc3339(self):

820

self.assertEqual(string_to_delta("PT0S"),

821

datetime.timedelta())

822

self.assertEqual(string_to_delta("P0D"),

823

datetime.timedelta())

824

self.assertEqual(string_to_delta("PT1S"),

825

datetime.timedelta(0, 1))

826

self.assertEqual(string_to_delta("PT2H"),

827

datetime.timedelta(0, 7200))

828

829

def test_falls_back_to_pre_1_6_1_with_warning(self):

830

# assertLogs only exists in Python 3.4

831

if hasattr(self, "assertLogs"):

832

with self.assertLogs(log, logging.WARNING):

833

value = string_to_delta("2h")

834

else:

835

class WarningFilter(logging.Filter):

836

"""Don't show, but record the presence of, warnings"""

837

def filter(self, record):

838

is_warning = record.levelno >= logging.WARNING

839

self.found = is_warning or getattr(self, "found",

840

False)

841

return not is_warning

842

warning_filter = WarningFilter()

843

log.addFilter(warning_filter)

844

try:

845

value = string_to_delta("2h")

846

finally:

847

log.removeFilter(warning_filter)

848

self.assertTrue(getattr(warning_filter, "found", False))

849

self.assertEqual(value, datetime.timedelta(0, 7200))

850

851

852

class Test_check_option_syntax(unittest.TestCase):

853

def setUp(self):

854

self.parser = argparse.ArgumentParser()

855

add_command_line_options(self.parser)

856

857

def test_actions_requires_client_or_all(self):

858

for action, value in self.actions.items():

859

options = self.parser.parse_args()

860

setattr(options, action, value)

861

with self.assertParseError():

862

self.check_option_syntax(options)

863

864

# This mostly corresponds to the definition from has_actions() in

865

# check_option_syntax()

866

actions = {

867

# The actual values set here are not that important, but we do

868

# at least stick to the correct types, even though they are

869

# never used

870

"enable": True,

871

"disable": True,

872

"bump_timeout": True,

873

"start_checker": True,

874

"stop_checker": True,

875

"is_enabled": True,

876

"remove": True,

877

"checker": "x",

878

"timeout": datetime.timedelta(),

879

"extended_timeout": datetime.timedelta(),

880

"interval": datetime.timedelta(),

881

"approved_by_default": True,

882

"approval_delay": datetime.timedelta(),

883

"approval_duration": datetime.timedelta(),

884

"host": "x",

885

"secret": io.BytesIO(b"x"),

886

"approve": True,

887

"deny": True,

888

}

889

890

@contextlib.contextmanager

891

def assertParseError(self):

892

with self.assertRaises(SystemExit) as e:

893

with self.temporarily_suppress_stderr():

894

yield

895

# Exit code from argparse is guaranteed to be "2". Reference:

896

# https://docs.python.org/3/library

897

# /argparse.html#exiting-methods

898

self.assertEqual(e.exception.code, 2)

899

900

@staticmethod

901

@contextlib.contextmanager

902

def temporarily_suppress_stderr():

163

parser = OptionParser(version = "%%prog %s" % version)

164

parser.add_option("-a", "--all", action="store_true",

165

help="Select all clients")

166

parser.add_option("-v", "--verbose", action="store_true",

167

help="Print all fields")

168

parser.add_option("-e", "--enable", action="store_true",

169

help="Enable client")

170

parser.add_option("-d", "--disable", action="store_true",

171

help="disable client")

172

parser.add_option("-b", "--bump-timeout", action="store_true",

173

help="Bump timeout for client")

174

parser.add_option("--start-checker", action="store_true",

175

help="Start checker for client")

176

parser.add_option("--stop-checker", action="store_true",

177

help="Stop checker for client")

178

parser.add_option("-V", "--is-enabled", action="store_true",

179

help="Check if client is enabled")

180

parser.add_option("-r", "--remove", action="store_true",

181

help="Remove client")

182

parser.add_option("-c", "--checker", type="string",

183

help="Set checker command for client")

184

parser.add_option("-t", "--timeout", type="string",

185

help="Set timeout for client")

186

parser.add_option("-i", "--interval", type="string",

187

help="Set checker interval for client")

188

parser.add_option("--approve-by-default", action="store_true",

189

dest="approved_by_default",

190

help="Set client to be approved by default")

191

parser.add_option("--deny-by-default", action="store_false",

192

dest="approved_by_default",

193

help="Set client to be denied by default")

194

parser.add_option("--approval-delay", type="string",

195

help="Set delay before client approve/deny")

196

parser.add_option("--approval-duration", type="string",

197

help="Set duration of one client approval")

198

parser.add_option("-H", "--host", type="string",

199

help="Set host for client")

200

parser.add_option("-s", "--secret", type="string",

201

help="Set password blob (file) for client")

202

parser.add_option("-A", "--approve", action="store_true",

203

help="Approve any current client request")

204

parser.add_option("-D", "--deny", action="store_true",

205

help="Deny any current client request")

206

options, client_names = parser.parse_args()

207

208

if has_actions(options) and not client_names and not options.all:

209

parser.error("Options require clients names or --all.")

210

if options.verbose and has_actions(options):

211

parser.error("--verbose can only be used alone or with"

212

" --all.")

213

if options.all and not has_actions(options):

214

parser.error("--all requires an action.")

215

216

try:

217

bus = dbus.SystemBus()

218

mandos_dbus_objc = bus.get_object(busname, server_path)

219

except dbus.exceptions.DBusException:

220

print("Could not connect to Mandos server",

221

file=sys.stderr)

222

sys.exit(1)

223

224

mandos_serv = dbus.Interface(mandos_dbus_objc,

225

dbus_interface = server_interface)

226

227

#block stderr since dbus library prints to stderr

903

228

null = os.open(os.path.devnull, os.O_RDWR)

904

229

stderrcopy = os.dup(sys.stderr.fileno())

905

230

os.dup2(null, sys.stderr.fileno())

906

231

os.close(null)

907

232

try:

908

yield

909

finally:

910

# restore stderr

911

os.dup2(stderrcopy, sys.stderr.fileno())

912

os.close(stderrcopy)

913

914

def check_option_syntax(self, options):

915

check_option_syntax(self.parser, options)

916

917

def test_actions_conflicts_with_verbose(self):

918

for action, value in self.actions.items():

919

options = self.parser.parse_args()

920

setattr(options, action, value)

921

options.verbose = True

922

with self.assertParseError():

923

self.check_option_syntax(options)

924

925

def test_dump_json_conflicts_with_verbose(self):

926

options = self.parser.parse_args()

927

options.dump_json = True

928

options.verbose = True

929

with self.assertParseError():

930

self.check_option_syntax(options)

931

932

def test_dump_json_conflicts_with_action(self):

933

for action, value in self.actions.items():

934

options = self.parser.parse_args()

935

setattr(options, action, value)

936

options.dump_json = True

937

with self.assertParseError():

938

self.check_option_syntax(options)

939

940

def test_all_can_not_be_alone(self):

941

options = self.parser.parse_args()

942

options.all = True

943

with self.assertParseError():

944

self.check_option_syntax(options)

945

946

def test_all_is_ok_with_any_action(self):

947

for action, value in self.actions.items():

948

options = self.parser.parse_args()

949

setattr(options, action, value)

950

options.all = True

951

self.check_option_syntax(options)

952

953

def test_is_enabled_fails_without_client(self):

954

options = self.parser.parse_args()

955

options.is_enabled = True

956

with self.assertParseError():

957

self.check_option_syntax(options)

958

959

def test_is_enabled_works_with_one_client(self):

960

options = self.parser.parse_args()

961

options.is_enabled = True

962

options.client = ["foo"]

963

self.check_option_syntax(options)

964

965

def test_is_enabled_fails_with_two_clients(self):

966

options = self.parser.parse_args()

967

options.is_enabled = True

968

options.client = ["foo", "barbar"]

969

with self.assertParseError():

970

self.check_option_syntax(options)

971

972

def test_remove_can_only_be_combined_with_action_deny(self):

973

for action, value in self.actions.items():

974

if action in {"remove", "deny"}:

975

continue

976

options = self.parser.parse_args()

977

setattr(options, action, value)

978

options.all = True

979

options.remove = True

980

with self.assertParseError():

981

self.check_option_syntax(options)

982

983

984

class Test_commands_from_options(unittest.TestCase):

985

def setUp(self):

986

self.parser = argparse.ArgumentParser()

987

add_command_line_options(self.parser)

988

989

def test_is_enabled(self):

990

self.assert_command_from_args(["--is-enabled", "foo"],

991

IsEnabledCmd)

992

993

def assert_command_from_args(self, args, command_cls,

994

**cmd_attrs):

995

"""Assert that parsing ARGS should result in an instance of

996

COMMAND_CLS with (optionally) all supplied attributes (CMD_ATTRS)."""

997

options = self.parser.parse_args(args)

998

check_option_syntax(self.parser, options)

999

commands = commands_from_options(options)

1000

self.assertEqual(len(commands), 1)

1001

command = commands[0]

1002

self.assertIsInstance(command, command_cls)

1003

for key, value in cmd_attrs.items():

1004

self.assertEqual(getattr(command, key), value)

1005

1006

def test_is_enabled_short(self):

1007

self.assert_command_from_args(["-V", "foo"], IsEnabledCmd)

1008

1009

def test_approve(self):

1010

self.assert_command_from_args(["--approve", "foo"],

1011

ApproveCmd)

1012

1013

def test_approve_short(self):

1014

self.assert_command_from_args(["-A", "foo"], ApproveCmd)

1015

1016

def test_deny(self):

1017

self.assert_command_from_args(["--deny", "foo"], DenyCmd)

1018

1019

def test_deny_short(self):

1020

self.assert_command_from_args(["-D", "foo"], DenyCmd)

1021

1022

def test_remove(self):

1023

self.assert_command_from_args(["--remove", "foo"],

1024

RemoveCmd)

1025

1026

def test_deny_before_remove(self):

1027

options = self.parser.parse_args(["--deny", "--remove",

1028

"foo"])

1029

check_option_syntax(self.parser, options)

1030

commands = commands_from_options(options)

1031

self.assertEqual(len(commands), 2)

1032

self.assertIsInstance(commands[0], DenyCmd)

1033

self.assertIsInstance(commands[1], RemoveCmd)

1034

1035

def test_deny_before_remove_reversed(self):

1036

options = self.parser.parse_args(["--remove", "--deny",

1037

"--all"])

1038

check_option_syntax(self.parser, options)

1039

commands = commands_from_options(options)

1040

self.assertEqual(len(commands), 2)

1041

self.assertIsInstance(commands[0], DenyCmd)

1042

self.assertIsInstance(commands[1], RemoveCmd)

1043

1044

def test_remove_short(self):

1045

self.assert_command_from_args(["-r", "foo"], RemoveCmd)

1046

1047

def test_dump_json(self):

1048

self.assert_command_from_args(["--dump-json"], DumpJSONCmd)

1049

1050

def test_enable(self):

1051

self.assert_command_from_args(["--enable", "foo"], EnableCmd)

1052

1053

def test_enable_short(self):

1054

self.assert_command_from_args(["-e", "foo"], EnableCmd)

1055

1056

def test_disable(self):

1057

self.assert_command_from_args(["--disable", "foo"],

1058

DisableCmd)

1059

1060

def test_disable_short(self):

1061

self.assert_command_from_args(["-d", "foo"], DisableCmd)

1062

1063

def test_bump_timeout(self):

1064

self.assert_command_from_args(["--bump-timeout", "foo"],

1065

BumpTimeoutCmd)

1066

1067

def test_bump_timeout_short(self):

1068

self.assert_command_from_args(["-b", "foo"], BumpTimeoutCmd)

1069

1070

def test_start_checker(self):

1071

self.assert_command_from_args(["--start-checker", "foo"],

1072

StartCheckerCmd)

1073

1074

def test_stop_checker(self):

1075

self.assert_command_from_args(["--stop-checker", "foo"],

1076

StopCheckerCmd)

1077

1078

def test_approve_by_default(self):

1079

self.assert_command_from_args(["--approve-by-default", "foo"],

1080

ApproveByDefaultCmd)

1081

1082

def test_deny_by_default(self):

1083

self.assert_command_from_args(["--deny-by-default", "foo"],

1084

DenyByDefaultCmd)

1085

1086

def test_checker(self):

1087

self.assert_command_from_args(["--checker", ":", "foo"],

1088

SetCheckerCmd, value_to_set=":")

1089

1090

def test_checker_empty(self):

1091

self.assert_command_from_args(["--checker", "", "foo"],

1092

SetCheckerCmd, value_to_set="")

1093

1094

def test_checker_short(self):

1095

self.assert_command_from_args(["-c", ":", "foo"],

1096

SetCheckerCmd, value_to_set=":")

1097

1098

def test_host(self):

1099

self.assert_command_from_args(["--host", "foo.example.org",

1100

"foo"], SetHostCmd,

1101

value_to_set="foo.example.org")

1102

1103

def test_host_short(self):

1104

self.assert_command_from_args(["-H", "foo.example.org",

1105

"foo"], SetHostCmd,

1106

value_to_set="foo.example.org")

1107

1108

def test_secret_devnull(self):

1109

self.assert_command_from_args(["--secret", os.path.devnull,

1110

"foo"], SetSecretCmd,

1111

value_to_set=b"")

1112

1113

def test_secret_tempfile(self):

1114

with tempfile.NamedTemporaryFile(mode="r+b") as f:

1115

value = b"secret\0xyzzy\nbar"

1116

f.write(value)

1117

f.seek(0)

1118

self.assert_command_from_args(["--secret", f.name,

1119

"foo"], SetSecretCmd,

1120

value_to_set=value)

1121

1122

def test_secret_devnull_short(self):

1123

self.assert_command_from_args(["-s", os.path.devnull, "foo"],

1124

SetSecretCmd, value_to_set=b"")

1125

1126

def test_secret_tempfile_short(self):

1127

with tempfile.NamedTemporaryFile(mode="r+b") as f:

1128

value = b"secret\0xyzzy\nbar"

1129

f.write(value)

1130

f.seek(0)

1131

self.assert_command_from_args(["-s", f.name, "foo"],

1132

SetSecretCmd,

1133

value_to_set=value)

1134

1135

def test_timeout(self):

1136

self.assert_command_from_args(["--timeout", "PT5M", "foo"],

1137

SetTimeoutCmd,

1138

value_to_set=300000)

1139

1140

def test_timeout_short(self):

1141

self.assert_command_from_args(["-t", "PT5M", "foo"],

1142

SetTimeoutCmd,

1143

value_to_set=300000)

1144

1145

def test_extended_timeout(self):

1146

self.assert_command_from_args(["--extended-timeout", "PT15M",

1147

"foo"],

1148

SetExtendedTimeoutCmd,

1149

value_to_set=900000)

1150

1151

def test_interval(self):

1152

self.assert_command_from_args(["--interval", "PT2M", "foo"],

1153

SetIntervalCmd,

1154

value_to_set=120000)

1155

1156

def test_interval_short(self):

1157

self.assert_command_from_args(["-i", "PT2M", "foo"],

1158

SetIntervalCmd,

1159

value_to_set=120000)

1160

1161

def test_approval_delay(self):

1162

self.assert_command_from_args(["--approval-delay", "PT30S",

1163

"foo"], SetApprovalDelayCmd,

1164

value_to_set=30000)

1165

1166

def test_approval_duration(self):

1167

self.assert_command_from_args(["--approval-duration", "PT1S",

1168

"foo"], SetApprovalDurationCmd,

1169

value_to_set=1000)

1170

1171

def test_print_table(self):

1172

self.assert_command_from_args([], PrintTableCmd,

1173

verbose=False)

1174

1175

def test_print_table_verbose(self):

1176

self.assert_command_from_args(["--verbose"], PrintTableCmd,

1177

verbose=True)

1178

1179

def test_print_table_verbose_short(self):

1180

self.assert_command_from_args(["-v"], PrintTableCmd,

1181

verbose=True)

1182

1183

1184

class TestCmd(unittest.TestCase):

1185

"""Abstract class for tests of command classes"""

1186

1187

def setUp(self):

1188

testcase = self

1189

class MockClient(object):

1190

def __init__(self, name, **attributes):

1191

self.__dbus_object_path__ = "/clients/{}".format(name)

1192

self.attributes = attributes

1193

self.attributes["Name"] = name

1194

self.calls = []

1195

def Set(self, interface, propname, value, dbus_interface):

1196

testcase.assertEqual(interface, client_dbus_interface)

1197

testcase.assertEqual(dbus_interface,

1198

dbus.PROPERTIES_IFACE)

1199

self.attributes[propname] = value

1200

def Get(self, interface, propname, dbus_interface):

1201

testcase.assertEqual(interface, client_dbus_interface)

1202

testcase.assertEqual(dbus_interface,

1203

dbus.PROPERTIES_IFACE)

1204

return self.attributes[propname]

1205

def Approve(self, approve, dbus_interface):

1206

testcase.assertEqual(dbus_interface,

1207

client_dbus_interface)

1208

self.calls.append(("Approve", (approve,

1209

dbus_interface)))

1210

self.client = MockClient(

1211

"foo",

1212

KeyID=("92ed150794387c03ce684574b1139a65"

1213

"94a34f895daaaf09fd8ea90a27cddb12"),

1214

Secret=b"secret",

1215

Host="foo.example.org",

1216

Enabled=dbus.Boolean(True),

1217

Timeout=300000,

1218

LastCheckedOK="2019-02-03T00:00:00",

1219

Created="2019-01-02T00:00:00",

1220

Interval=120000,

1221

Fingerprint=("778827225BA7DE539C5A"

1222

"7CFA59CFF7CDBD9A5920"),

1223

CheckerRunning=dbus.Boolean(False),

1224

LastEnabled="2019-01-03T00:00:00",

1225

ApprovalPending=dbus.Boolean(False),

1226

ApprovedByDefault=dbus.Boolean(True),

1227

LastApprovalRequest="",

1228

ApprovalDelay=0,

1229

ApprovalDuration=1000,

1230

Checker="fping -q -- %(host)s",

1231

ExtendedTimeout=900000,

1232

Expires="2019-02-04T00:00:00",

1233

LastCheckerStatus=0)

1234

self.other_client = MockClient(

1235

"barbar",

1236

KeyID=("0558568eedd67d622f5c83b35a115f79"

1237

"6ab612cff5ad227247e46c2b020f441c"),

1238

Secret=b"secretbar",

1239

Host="192.0.2.3",

1240

Enabled=dbus.Boolean(True),

1241

Timeout=300000,

1242

LastCheckedOK="2019-02-04T00:00:00",

1243

Created="2019-01-03T00:00:00",

1244

Interval=120000,

1245

Fingerprint=("3E393AEAEFB84C7E89E2"

1246

"F547B3A107558FCA3A27"),

1247

CheckerRunning=dbus.Boolean(True),

1248

LastEnabled="2019-01-04T00:00:00",

1249

ApprovalPending=dbus.Boolean(False),

1250

ApprovedByDefault=dbus.Boolean(False),

1251

LastApprovalRequest="2019-01-03T00:00:00",

1252

ApprovalDelay=30000,

1253

ApprovalDuration=93785000,

1254

Checker=":",

1255

ExtendedTimeout=900000,

1256

Expires="2019-02-05T00:00:00",

1257

LastCheckerStatus=-2)

1258

self.clients = collections.OrderedDict(

1259

[

1260

("/clients/foo", self.client.attributes),

1261

("/clients/barbar", self.other_client.attributes),

1262

])

1263

self.one_client = {"/clients/foo": self.client.attributes}

1264

1265

@property

1266

def bus(self):

1267

class Bus(object):

1268

@staticmethod

1269

def get_object(client_bus_name, path):

1270

self.assertEqual(client_bus_name, dbus_busname)

1271

return {

1272

"/clients/foo": self.client,

1273

"/clients/barbar": self.other_client,

1274

}[path]

1275

return Bus()

1276

1277

1278

class TestIsEnabledCmd(TestCmd):

1279

def test_is_enabled(self):

1280

self.assertTrue(all(IsEnabledCmd().is_enabled(client,

1281

properties)

1282

for client, properties

1283

in self.clients.items()))

1284

1285

def test_is_enabled_run_exits_successfully(self):

1286

with self.assertRaises(SystemExit) as e:

1287

IsEnabledCmd().run(self.one_client)

1288

if e.exception.code is not None:

1289

self.assertEqual(e.exception.code, 0)

1290

else:

1291

self.assertIsNone(e.exception.code)

1292

1293

def test_is_enabled_run_exits_with_failure(self):

1294

self.client.attributes["Enabled"] = dbus.Boolean(False)

1295

with self.assertRaises(SystemExit) as e:

1296

IsEnabledCmd().run(self.one_client)

1297

if isinstance(e.exception.code, int):

1298

self.assertNotEqual(e.exception.code, 0)

1299

else:

1300

self.assertIsNotNone(e.exception.code)

1301

1302

1303

class TestApproveCmd(TestCmd):

1304

def test_approve(self):

1305

ApproveCmd().run(self.clients, self.bus)

1306

for clientpath in self.clients:

1307

client = self.bus.get_object(dbus_busname, clientpath)

1308

self.assertIn(("Approve", (True, client_dbus_interface)),

1309

client.calls)

1310

1311

1312

class TestDenyCmd(TestCmd):

1313

def test_deny(self):

1314

DenyCmd().run(self.clients, self.bus)

1315

for clientpath in self.clients:

1316

client = self.bus.get_object(dbus_busname, clientpath)

1317

self.assertIn(("Approve", (False, client_dbus_interface)),

1318

client.calls)

1319

1320

1321

class TestRemoveCmd(TestCmd):

1322

def test_remove(self):

1323

class MockMandos(object):

1324

def __init__(self):

1325

self.calls = []

1326

def RemoveClient(self, dbus_path):

1327

self.calls.append(("RemoveClient", (dbus_path,)))

1328

mandos = MockMandos()

1329

super(TestRemoveCmd, self).setUp()

1330

RemoveCmd().run(self.clients, self.bus, mandos)

1331

self.assertEqual(len(mandos.calls), 2)

1332

for clientpath in self.clients:

1333

self.assertIn(("RemoveClient", (clientpath,)),

1334

mandos.calls)

1335

1336

1337

class TestDumpJSONCmd(TestCmd):

1338

def setUp(self):

1339

self.expected_json = {

1340

"foo": {

1341

"Name": "foo",

1342

"KeyID": ("92ed150794387c03ce684574b1139a65"

1343

"94a34f895daaaf09fd8ea90a27cddb12"),

1344

"Host": "foo.example.org",

1345

"Enabled": True,

1346

"Timeout": 300000,

1347

"LastCheckedOK": "2019-02-03T00:00:00",

1348

"Created": "2019-01-02T00:00:00",

1349

"Interval": 120000,

1350

"Fingerprint": ("778827225BA7DE539C5A"

1351

"7CFA59CFF7CDBD9A5920"),

1352

"CheckerRunning": False,

1353

"LastEnabled": "2019-01-03T00:00:00",

1354

"ApprovalPending": False,

1355

"ApprovedByDefault": True,

1356

"LastApprovalRequest": "",

1357

"ApprovalDelay": 0,

1358

"ApprovalDuration": 1000,

1359

"Checker": "fping -q -- %(host)s",

1360

"ExtendedTimeout": 900000,

1361

"Expires": "2019-02-04T00:00:00",

1362

"LastCheckerStatus": 0,

1363

},

1364

"barbar": {

1365

"Name": "barbar",

1366

"KeyID": ("0558568eedd67d622f5c83b35a115f79"

1367

"6ab612cff5ad227247e46c2b020f441c"),

1368

"Host": "192.0.2.3",

1369

"Enabled": True,

1370

"Timeout": 300000,

1371

"LastCheckedOK": "2019-02-04T00:00:00",

1372

"Created": "2019-01-03T00:00:00",

1373

"Interval": 120000,

1374

"Fingerprint": ("3E393AEAEFB84C7E89E2"

1375

"F547B3A107558FCA3A27"),

1376

"CheckerRunning": True,

1377

"LastEnabled": "2019-01-04T00:00:00",

1378

"ApprovalPending": False,

1379

"ApprovedByDefault": False,

1380

"LastApprovalRequest": "2019-01-03T00:00:00",

1381

"ApprovalDelay": 30000,

1382

"ApprovalDuration": 93785000,

1383

"Checker": ":",

1384

"ExtendedTimeout": 900000,

1385

"Expires": "2019-02-05T00:00:00",

1386

"LastCheckerStatus": -2,

1387

},

1388

}

1389

return super(TestDumpJSONCmd, self).setUp()

1390

1391

def test_normal(self):

1392

json_data = json.loads(DumpJSONCmd().output(self.clients))

1393

self.assertDictEqual(json_data, self.expected_json)

1394

1395

def test_one_client(self):

1396

clients = self.one_client

1397

json_data = json.loads(DumpJSONCmd().output(clients))

1398

expected_json = {"foo": self.expected_json["foo"]}

1399

self.assertDictEqual(json_data, expected_json)

1400

1401

1402

class TestPrintTableCmd(TestCmd):

1403

def test_normal(self):

1404

output = PrintTableCmd().output(self.clients.values())

1405

expected_output = "\n".join((

1406

"Name Enabled Timeout Last Successful Check",

1407

"foo Yes 00:05:00 2019-02-03T00:00:00 ",

1408

"barbar Yes 00:05:00 2019-02-04T00:00:00 ",

1409

))

1410

self.assertEqual(output, expected_output)

1411

1412

def test_verbose(self):

1413

output = PrintTableCmd(verbose=True).output(

1414

self.clients.values())

1415

columns = (

1416

(

1417

"Name ",

1418

"foo ",

1419

"barbar ",

1420

),(

1421

"Enabled ",

1422

"Yes ",

1423

"Yes ",

1424

),(

1425

"Timeout ",

1426

"00:05:00 ",

1427

"00:05:00 ",

1428

),(

1429

"Last Successful Check ",

1430

"2019-02-03T00:00:00 ",

1431

"2019-02-04T00:00:00 ",

1432

),(

1433

"Created ",

1434

"2019-01-02T00:00:00 ",

1435

"2019-01-03T00:00:00 ",

1436

),(

1437

"Interval ",

1438

"00:02:00 ",

1439

"00:02:00 ",

1440

),(

1441

"Host ",

1442

"foo.example.org ",

1443

"192.0.2.3 ",

1444

),(

1445

("Key ID "

1446

" "),

1447

("92ed150794387c03ce684574b1139a6594a34f895daaaf09fd8"

1448

"ea90a27cddb12 "),

1449

("0558568eedd67d622f5c83b35a115f796ab612cff5ad227247e"

1450

"46c2b020f441c "),

1451

),(

1452

"Fingerprint ",

1453

"778827225BA7DE539C5A7CFA59CFF7CDBD9A5920 ",

1454

"3E393AEAEFB84C7E89E2F547B3A107558FCA3A27 ",

1455

),(

1456

"Check Is Running ",

1457

"No ",

1458

"Yes ",

1459

),(

1460

"Last Enabled ",

1461

"2019-01-03T00:00:00 ",

1462

"2019-01-04T00:00:00 ",

1463

),(

1464

"Approval Is Pending ",

1465

"No ",

1466

"No ",

1467

),(

1468

"Approved By Default ",

1469

"Yes ",

1470

"No ",

1471

),(

1472

"Last Approval Request ",

1473

" ",

1474

"2019-01-03T00:00:00 ",

1475

),(

1476

"Approval Delay ",

1477

"00:00:00 ",

1478

"00:00:30 ",

1479

),(

1480

"Approval Duration ",

1481

"00:00:01 ",

1482

"1T02:03:05 ",

1483

),(

1484

"Checker ",

1485

"fping -q -- %(host)s ",

1486

": ",

1487

),(

1488

"Extended Timeout ",

1489

"00:15:00 ",

1490

"00:15:00 ",

1491

),(

1492

"Expires ",

1493

"2019-02-04T00:00:00 ",

1494

"2019-02-05T00:00:00 ",

1495

),(

1496

"Last Checker Status",

1497

"0 ",

1498

"-2 ",

1499

)

1500

)

1501

num_lines = max(len(rows) for rows in columns)

1502

expected_output = "\n".join("".join(rows[line]

1503

for rows in columns)

1504

for line in range(num_lines))

1505

self.assertEqual(output, expected_output)

1506

1507

def test_one_client(self):

1508

output = PrintTableCmd().output(self.one_client.values())

1509

expected_output = "\n".join((

1510

"Name Enabled Timeout Last Successful Check",

1511

"foo Yes 00:05:00 2019-02-03T00:00:00 ",

1512

))

1513

self.assertEqual(output, expected_output)

1514

1515

1516

class Unique(object):

1517

"""Class for objects which exist only to be unique objects, since

1518

unittest.mock.sentinel only exists in Python 3.3"""

1519

1520

1521

class TestPropertyCmd(TestCmd):

1522

"""Abstract class for tests of PropertyCmd classes"""

1523

def runTest(self):

1524

if not hasattr(self, "command"):

1525

return

1526

values_to_get = getattr(self, "values_to_get",

1527

self.values_to_set)

1528

for value_to_set, value_to_get in zip(self.values_to_set,

1529

values_to_get):

1530

for clientpath in self.clients:

1531

client = self.bus.get_object(dbus_busname, clientpath)

1532

old_value = client.attributes[self.propname]

1533

self.assertNotIsInstance(old_value, Unique)

1534

client.attributes[self.propname] = Unique()

1535

self.run_command(value_to_set, self.clients)

1536

for clientpath in self.clients:

1537

client = self.bus.get_object(dbus_busname, clientpath)

1538

value = client.attributes[self.propname]

1539

self.assertNotIsInstance(value, Unique)

1540

self.assertEqual(value, value_to_get)

1541

def run_command(self, value, clients):

1542

self.command().run(clients, self.bus)

1543

1544

1545

class TestEnableCmd(TestPropertyCmd):

1546

command = EnableCmd

1547

propname = "Enabled"

1548

values_to_set = [dbus.Boolean(True)]

1549

1550

1551

class TestDisableCmd(TestPropertyCmd):

1552

command = DisableCmd

1553

propname = "Enabled"

1554

values_to_set = [dbus.Boolean(False)]

1555

1556

1557

class TestBumpTimeoutCmd(TestPropertyCmd):

1558

command = BumpTimeoutCmd

1559

propname = "LastCheckedOK"

1560

values_to_set = [""]

1561

1562

1563

class TestStartCheckerCmd(TestPropertyCmd):

1564

command = StartCheckerCmd

1565

propname = "CheckerRunning"

1566

values_to_set = [dbus.Boolean(True)]

1567

1568

1569

class TestStopCheckerCmd(TestPropertyCmd):

1570

command = StopCheckerCmd

1571

propname = "CheckerRunning"

1572

values_to_set = [dbus.Boolean(False)]

1573

1574

1575

class TestApproveByDefaultCmd(TestPropertyCmd):

1576

command = ApproveByDefaultCmd

1577

propname = "ApprovedByDefault"

1578

values_to_set = [dbus.Boolean(True)]

1579

1580

1581

class TestDenyByDefaultCmd(TestPropertyCmd):

1582

command = DenyByDefaultCmd

1583

propname = "ApprovedByDefault"

1584

values_to_set = [dbus.Boolean(False)]

1585

1586

1587

class TestPropertyValueCmd(TestPropertyCmd):

1588

"""Abstract class for tests of PropertyValueCmd classes"""

1589

1590

def runTest(self):

1591

if type(self) is TestPropertyValueCmd:

1592

return

1593

return super(TestPropertyValueCmd, self).runTest()

1594

1595

def run_command(self, value, clients):

1596

self.command(value).run(clients, self.bus)

1597

1598

1599

class TestSetCheckerCmd(TestPropertyValueCmd):

1600

command = SetCheckerCmd

1601

propname = "Checker"

1602

values_to_set = ["", ":", "fping -q -- %s"]

1603

1604

1605

class TestSetHostCmd(TestPropertyValueCmd):

1606

command = SetHostCmd

1607

propname = "Host"

1608

values_to_set = ["192.0.2.3", "foo.example.org"]

1609

1610

1611

class TestSetSecretCmd(TestPropertyValueCmd):

1612

command = SetSecretCmd

1613

propname = "Secret"

1614

values_to_set = [io.BytesIO(b""),

1615

io.BytesIO(b"secret\0xyzzy\nbar")]

1616

values_to_get = [b"", b"secret\0xyzzy\nbar"]

1617

1618

1619

class TestSetTimeoutCmd(TestPropertyValueCmd):

1620

command = SetTimeoutCmd

1621

propname = "Timeout"

1622

values_to_set = [datetime.timedelta(),

1623

datetime.timedelta(minutes=5),

1624

datetime.timedelta(seconds=1),

1625

datetime.timedelta(weeks=1),

1626

datetime.timedelta(weeks=52)]

1627

values_to_get = [0, 300000, 1000, 604800000, 31449600000]

1628

1629

1630

class TestSetExtendedTimeoutCmd(TestPropertyValueCmd):

1631

command = SetExtendedTimeoutCmd

1632

propname = "ExtendedTimeout"

1633

values_to_set = [datetime.timedelta(),

1634

datetime.timedelta(minutes=5),

1635

datetime.timedelta(seconds=1),

1636

datetime.timedelta(weeks=1),

1637

datetime.timedelta(weeks=52)]

1638

values_to_get = [0, 300000, 1000, 604800000, 31449600000]

1639

1640

1641

class TestSetIntervalCmd(TestPropertyValueCmd):

1642

command = SetIntervalCmd

1643

propname = "Interval"

1644

values_to_set = [datetime.timedelta(),

1645

datetime.timedelta(minutes=5),

1646

datetime.timedelta(seconds=1),

1647

datetime.timedelta(weeks=1),

1648

datetime.timedelta(weeks=52)]

1649

values_to_get = [0, 300000, 1000, 604800000, 31449600000]

1650

1651

1652

class TestSetApprovalDelayCmd(TestPropertyValueCmd):

1653

command = SetApprovalDelayCmd

1654

propname = "ApprovalDelay"

1655

values_to_set = [datetime.timedelta(),

1656

datetime.timedelta(minutes=5),

1657

datetime.timedelta(seconds=1),

1658

datetime.timedelta(weeks=1),

1659

datetime.timedelta(weeks=52)]

1660

values_to_get = [0, 300000, 1000, 604800000, 31449600000]

1661

1662

1663

class TestSetApprovalDurationCmd(TestPropertyValueCmd):

1664

command = SetApprovalDurationCmd

1665

propname = "ApprovalDuration"

1666

values_to_set = [datetime.timedelta(),

1667

datetime.timedelta(minutes=5),

1668

datetime.timedelta(seconds=1),

1669

datetime.timedelta(weeks=1),

1670

datetime.timedelta(weeks=52)]

1671

values_to_get = [0, 300000, 1000, 604800000, 31449600000]

1672

1673

1674

1675

def should_only_run_tests():

1676

parser = argparse.ArgumentParser(add_help=False)

1677

parser.add_argument("--check", action='store_true')

1678

args, unknown_args = parser.parse_known_args()

1679

run_tests = args.check

1680

if run_tests:

1681

# Remove --check argument from sys.argv

1682

sys.argv[1:] = unknown_args

1683

return run_tests

1684

1685

# Add all tests from doctest strings

1686

def load_tests(loader, tests, none):

1687

import doctest

1688

tests.addTests(doctest.DocTestSuite())

1689

return tests

233

try:

234

mandos_clients = mandos_serv.GetAllClientsWithProperties()

235

finally:

236

#restore stderr

237

os.dup2(stderrcopy, sys.stderr.fileno())

238

os.close(stderrcopy)

239

except dbus.exceptions.DBusException, e:

240

print("Access denied: Accessing mandos server through dbus.",

241

file=sys.stderr)

242

sys.exit(1)

243

244

# Compile dict of (clients: properties) to process

245

clients={}

246

247

if options.all or not client_names:

248

clients = dict((bus.get_object(busname, path), properties)

249

for path, properties in

250

mandos_clients.iteritems())

251

else:

252

for name in client_names:

253

for path, client in mandos_clients.iteritems():

254

if client["Name"] == name:

255

client_objc = bus.get_object(busname, path)

256

clients[client_objc] = client

257

break

258

else:

259

print("Client not found on server: %r" % name,

260

file=sys.stderr)

261

sys.exit(1)

262

263

if not has_actions(options) and clients:

264

if options.verbose:

265

keywords = ("Name", "Enabled", "Timeout",

266

"LastCheckedOK", "Created", "Interval",

267

"Host", "Fingerprint", "CheckerRunning",

268

"LastEnabled", "ApprovalPending",

269

"ApprovedByDefault",

270

"LastApprovalRequest", "ApprovalDelay",

271

"ApprovalDuration", "Checker")

272

else:

273

keywords = defaultkeywords

274

275

print_clients(clients.values(), keywords)

276

else:

277

# Process each client in the list by all selected options

278

for client in clients:

279

if options.remove:

280

mandos_serv.RemoveClient(client.__dbus_object_path__)

281

if options.enable:

282

client.Enable(dbus_interface=client_interface)

283

if options.disable:

284

client.Disable(dbus_interface=client_interface)

285

if options.bump_timeout:

286

client.CheckedOK(dbus_interface=client_interface)

287

if options.start_checker:

288

client.StartChecker(dbus_interface=client_interface)

289

if options.stop_checker:

290

client.StopChecker(dbus_interface=client_interface)

291

if options.is_enabled:

292

sys.exit(0 if client.Get(client_interface,

293

"Enabled",

294

dbus_interface=dbus.PROPERTIES_IFACE)

295

else 1)

296

if options.checker:

297

client.Set(client_interface, "Checker", options.checker,

298

dbus_interface=dbus.PROPERTIES_IFACE)

299

if options.host:

300

client.Set(client_interface, "Host", options.host,

301

dbus_interface=dbus.PROPERTIES_IFACE)

302

if options.interval:

303

client.Set(client_interface, "Interval",

304

timedelta_to_milliseconds

305

(string_to_delta(options.interval)),

306

dbus_interface=dbus.PROPERTIES_IFACE)

307

if options.approval_delay:

308

client.Set(client_interface, "ApprovalDelay",

309

timedelta_to_milliseconds

310

(string_to_delta(options.

311

approval_delay)),

312

dbus_interface=dbus.PROPERTIES_IFACE)

313

if options.approval_duration:

314

client.Set(client_interface, "ApprovalDuration",

315

timedelta_to_milliseconds

316

(string_to_delta(options.

317

approval_duration)),

318

dbus_interface=dbus.PROPERTIES_IFACE)

319

if options.timeout:

320

client.Set(client_interface, "Timeout",

321

timedelta_to_milliseconds

322

(string_to_delta(options.timeout)),

323

dbus_interface=dbus.PROPERTIES_IFACE)

324

if options.secret:

325

client.Set(client_interface, "Secret",

326

dbus.ByteArray(open(options.secret,

327

"rb").read()),

328

dbus_interface=dbus.PROPERTIES_IFACE)

329

if options.approved_by_default is not None:

330

client.Set(client_interface, "ApprovedByDefault",

331

dbus.Boolean(options

332

.approved_by_default),

333

dbus_interface=dbus.PROPERTIES_IFACE)

334

if options.approve:

335

client.Approve(dbus.Boolean(True),

336

dbus_interface=client_interface)

337

elif options.deny:

338

client.Approve(dbus.Boolean(False),

339

dbus_interface=client_interface)

1690

340

1691

341

if __name__ == "__main__":

1692

if should_only_run_tests():

1693

# Call using ./tdd-python-script --check [--verbose]

1694

unittest.main()

1695

else:

1696

main()

342

main()