/mandos/release

domain = "se.recompile"

busname = domain + ".Mandos"

server_path = "/"

server_interface = domain + ".Mandos"

client_interface = domain + ".Mandos.Client"

def milliseconds_to_string(ms):

    td = datetime.timedelta(0, 0, 0, ms)

    return ("{days}{hours:02}:{minutes:02}:{seconds:02}"

            .format(days="{}T".format(td.days) if td.days else "",

                    hours=td.seconds // 3600,

                    minutes=(td.seconds % 3600) // 60,

                    seconds=td.seconds % 60))

def string_to_delta(interval):

    """Parse a string and return a datetime.timedelta"""

 

    try:

        return rfc3339_duration_to_delta(interval)

    except ValueError as e:

        log.warning("%s - Parsing as pre-1.6.1 interval instead",

                    ' '.join(e.args))

    return parse_pre_1_6_1_interval(interval)

 

 

## Classes for commands.

 

# Abstract classes first

    def run(self, mandos, clients):

        for client, properties in clients.items():

class PrintCmd(Command):

    """Abstract class for commands printing client details"""

    def run(self, mandos, clients):

        print(self.output(clients))

 

class PropertyCmd(Command):

    """Abstract class for Actions for setting one client property"""

    def run_on_one_client(self, client, properties):

        """Set the Client's D-Bus property"""

        client.Set(client_interface, self.property, self.value_to_set,

                   dbus_interface=dbus.PROPERTIES_IFACE)

 

class ValueArgumentMixIn(object):

    """Mixin class for commands taking a value as argument"""

    def __init__(self, value):

        self.value_to_set = value

 

class MillisecondsValueArgumentMixIn(ValueArgumentMixIn):

    """Mixin class for commands taking a value argument as

    milliseconds."""

    @property

    def value_to_set(self):

        return self._vts

    @value_to_set.setter

    def value_to_set(self, value):

        """When setting, convert value to a datetime.timedelta"""

        self._vts = string_to_delta(value).total_seconds() * 1000

 

# Actual (non-abstract) command classes

 

class PrintTableCmd(PrintCmd):

        default_keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")

        return str(self.TableOfClients(clients.values(), keywords))

        @staticmethod

        def valuetostring(value, keyword):

                return milliseconds_to_string(value)

 

 

class DumpJSONCmd(PrintCmd):

    def output(self, clients):

        data = {client["Name"]:

                {key: self.dbus_boolean_to_bool(client[key])

                 for key in self.all_keywords}

                for client in clients.values()}

        return json.dumps(data, indent=4, separators=(',', ': '))

    @staticmethod

    def dbus_boolean_to_bool(value):

        if isinstance(value, dbus.Boolean):

            value = bool(value)

        return value

 

class IsEnabledCmd(Command):

    def run_on_one_client(self, client, properties):

        if self.is_enabled(client, properties):

            sys.exit(0)

        sys.exit(1)

    def is_enabled(self, client, properties):

        return bool(properties["Enabled"])

 

class RemoveCmd(Command):

    def run_on_one_client(self, client, properties):

        self.mandos.RemoveClient(client.__dbus_object_path__)

 

class ApproveCmd(Command):

    def run_on_one_client(self, client, properties):

        client.Approve(dbus.Boolean(True),

                       dbus_interface=client_interface)

 

class DenyCmd(Command):

    def run_on_one_client(self, client, properties):

        client.Approve(dbus.Boolean(False),

                       dbus_interface=client_interface)

    property = "Enabled"

    property = "Enabled"

    property = "LastCheckedOK"

    property = "CheckerRunning"

    property = "CheckerRunning"

    property = "ApprovedByDefault"

    property = "ApprovedByDefault"

class SetCheckerCmd(PropertyCmd, ValueArgumentMixIn):

    property = "Checker"

 

class SetHostCmd(PropertyCmd, ValueArgumentMixIn):

    property = "Host"

 

class SetSecretCmd(PropertyCmd, ValueArgumentMixIn):

    property = "Secret"

 

class SetTimeoutCmd(PropertyCmd, MillisecondsValueArgumentMixIn):

    property = "Timeout"

 

class SetExtendedTimeoutCmd(PropertyCmd,

                            MillisecondsValueArgumentMixIn):

    property = "ExtendedTimeout"

 

class SetIntervalCmd(PropertyCmd, MillisecondsValueArgumentMixIn):

    property = "Interval"

 

class SetApprovalDelayCmd(PropertyCmd,

                          MillisecondsValueArgumentMixIn):

    property = "ApprovalDelay"

 

class SetApprovalDurationCmd(PropertyCmd,

                             MillisecondsValueArgumentMixIn):

    property = "ApprovalDuration"

 

def has_actions(options):

    return any((options.enable,

                options.disable,

                options.bump_timeout,

                options.start_checker,

                options.stop_checker,

                options.is_enabled,

                options.remove,

                options.checker is not None,

                options.timeout is not None,

                options.extended_timeout is not None,

                options.interval is not None,

                options.approved_by_default is not None,

                options.approval_delay is not None,

                options.approval_duration is not None,

                options.host is not None,

                options.secret is not None,

                options.approve,

                options.deny))

 

def add_command_line_options(parser):

    parser.add_argument("--version", action="version",

                        version="%(prog)s {}".format(version),

                        help="show version number and exit")

    parser.add_argument("-a", "--all", action="store_true",

                        help="Select all clients")

    parser.add_argument("-v", "--verbose", action="store_true",

                        help="Print all fields")

    parser.add_argument("-j", "--dump-json", action="store_true",

                        help="Dump client data in JSON format")

    enable_disable = parser.add_mutually_exclusive_group()

    enable_disable.add_argument("-e", "--enable", action="store_true",

                                help="Enable client")

    enable_disable.add_argument("-d", "--disable",

                                action="store_true",

                                help="disable client")

    parser.add_argument("-b", "--bump-timeout", action="store_true",

                        help="Bump timeout for client")

    start_stop_checker = parser.add_mutually_exclusive_group()

    start_stop_checker.add_argument("--start-checker",

                                    action="store_true",

                                    help="Start checker for client")

    start_stop_checker.add_argument("--stop-checker",

                                    action="store_true",

                                    help="Stop checker for client")

    parser.add_argument("-V", "--is-enabled", action="store_true",

                        help="Check if client is enabled")

    parser.add_argument("-r", "--remove", action="store_true",

                        help="Remove client")

    parser.add_argument("-c", "--checker",

                        help="Set checker command for client")

    parser.add_argument("-t", "--timeout",

                        help="Set timeout for client")

    parser.add_argument("--extended-timeout",

                        help="Set extended timeout for client")

    parser.add_argument("-i", "--interval",

                        help="Set checker interval for client")

    approve_deny_default = parser.add_mutually_exclusive_group()

    approve_deny_default.add_argument(

        "--approve-by-default", action="store_true",

        default=None, dest="approved_by_default",

        help="Set client to be approved by default")

    approve_deny_default.add_argument(

        "--deny-by-default", action="store_false",

        dest="approved_by_default",

        help="Set client to be denied by default")

    parser.add_argument("--approval-delay",

                        help="Set delay before client approve/deny")

    parser.add_argument("--approval-duration",

                        help="Set duration of one client approval")

    parser.add_argument("-H", "--host", help="Set host for client")

    parser.add_argument("-s", "--secret",

                        type=argparse.FileType(mode="rb"),

                        help="Set password blob (file) for client")

    approve_deny = parser.add_mutually_exclusive_group()

    approve_deny.add_argument(

        "-A", "--approve", action="store_true",

        help="Approve any current client request")

    approve_deny.add_argument("-D", "--deny", action="store_true",

                              help="Deny any current client request")

    parser.add_argument("--check", action="store_true",

                        help="Run self-test")

    parser.add_argument("client", nargs="*", help="Client name")

 

 

def commands_from_options(options):

 

    commands = []

 

    if options.dump_json:

        commands.append(DumpJSONCmd())

 

    if options.enable:

        commands.append(EnableCmd())

 

    if options.disable:

        commands.append(DisableCmd())

 

    if options.bump_timeout:

        commands.append(BumpTimeoutCmd())

 

    if options.start_checker:

        commands.append(StartCheckerCmd())

 

    if options.stop_checker:

        commands.append(StopCheckerCmd())

 

    if options.is_enabled:

        commands.append(IsEnabledCmd())

 

    if options.remove:

        commands.append(RemoveCmd())

 

    if options.checker is not None:

        commands.append(SetCheckerCmd(options.checker))

 

    if options.timeout is not None:

        commands.append(SetTimeoutCmd(options.timeout))

 

    if options.extended_timeout:

        commands.append(

            SetExtendedTimeoutCmd(options.extended_timeout))

 

    if options.interval is not None:

        commands.append(SetIntervalCmd(options.interval))

 

    if options.approved_by_default is not None:

        if options.approved_by_default:

            commands.append(ApproveByDefaultCmd())

        else:

            commands.append(DenyByDefaultCmd())

 

    if options.approval_delay is not None:

        commands.append(SetApprovalDelayCmd(options.approval_delay))

 

    if options.approval_duration is not None:

        commands.append(

            SetApprovalDurationCmd(options.approval_duration))

 

    if options.host is not None:

        commands.append(SetHostCmd(options.host))

 

    if options.secret is not None:

        commands.append(SetSecretCmd(options.secret))

 

    if options.approve:

        commands.append(ApproveCmd())

 

    if options.deny:

        commands.append(DenyCmd())

 

    # If no command option has been given, show table of clients,

    # optionally verbosely

    if not commands:

        commands.append(PrintTableCmd(verbose=options.verbose))

 

    return commands

 

 

def main():

    parser = argparse.ArgumentParser()

 

    add_command_line_options(parser)

 

    options = parser.parse_args()

 

    if has_actions(options) and not (options.client or options.all):

        parser.error("Options require clients names or --all.")

    if options.verbose and has_actions(options):

        parser.error("--verbose can only be used alone.")

    if options.dump_json and (options.verbose

                              or has_actions(options)):

        parser.error("--dump-json can only be used alone.")

    if options.all and not has_actions(options):

        parser.error("--all requires an action.")

    if options.is_enabled and len(options.client) > 1:

        parser.error("--is-enabled requires exactly one client")

 

    clientnames = options.client

 

    try:

        bus = dbus.SystemBus()

        mandos_dbus_objc = bus.get_object(busname, server_path)

    except dbus.exceptions.DBusException:

        log.critical("Could not connect to Mandos server")

        sys.exit(1)

 

    mandos_serv = dbus.Interface(mandos_dbus_objc,

                                 dbus_interface=server_interface)

    mandos_serv_object_manager = dbus.Interface(

        mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)

 

    # Filter out log message from dbus module

    dbus_logger = logging.getLogger("dbus.proxies")

    class NullFilter(logging.Filter):

        def filter(self, record):

            return False

    dbus_filter = NullFilter()

    try:

        dbus_logger.addFilter(dbus_filter)

        mandos_clients = {path: ifs_and_props[client_interface]

                          for path, ifs_and_props in

                          mandos_serv_object_manager

                          .GetManagedObjects().items()

                          if client_interface in ifs_and_props}

    except dbus.exceptions.DBusException as e:

        log.critical("Failed to access Mandos server through D-Bus:"

                     "\n%s", e)

        sys.exit(1)

    finally:

        # restore dbus logger

        dbus_logger.removeFilter(dbus_filter)

 

    # Compile dict of (clients: properties) to process

    clients = {}

 

    if not clientnames:

        clients = {bus.get_object(busname, path): properties

                   for path, properties in mandos_clients.items()}

    else:

        for name in clientnames:

            for path, client in mandos_clients.items():

                if client["Name"] == name:

                    client_objc = bus.get_object(busname, path)

                    clients[client_objc] = client

                    break

            else:

                log.critical("Client not found on server: %r", name)

                sys.exit(1)

 

    # Run all commands on clients

    commands = commands_from_options(options)

    for command in commands:

        command.run(mandos_serv, clients)

class Test_milliseconds_to_string(unittest.TestCase):

    def test_all(self):

        self.assertEqual(milliseconds_to_string(93785000),

                         "1T02:03:05")

    def test_no_days(self):

        self.assertEqual(milliseconds_to_string(7385000), "02:03:05")

    def test_all_zero(self):

        self.assertEqual(milliseconds_to_string(0), "00:00:00")

    def test_no_fractional_seconds(self):

        self.assertEqual(milliseconds_to_string(400), "00:00:00")

        self.assertEqual(milliseconds_to_string(900), "00:00:00")

        self.assertEqual(milliseconds_to_string(1900), "00:00:01")

 

                self.__dbus_object_path__ = "objpath_{}".format(name)

            def Set(self, interface, property, value, dbus_interface):

                testcase.assertEqual(interface, client_interface)

                testcase.assertEqual(dbus_interface,

                                     dbus.PROPERTIES_IFACE)

                self.attributes[property] = value

            def Get(self, interface, property, dbus_interface):

                testcase.assertEqual(interface, client_interface)

                testcase.assertEqual(dbus_interface,

                                     dbus.PROPERTIES_IFACE)

                return self.attributes[property]

                testcase.assertEqual(dbus_interface, client_interface)

            ApprovalDuration=1000,

                (self.client, self.client.attributes),

                (self.other_client, self.other_client.attributes),

        self.one_client = {self.client: self.client.attributes}

 

class TestPrintTableCmd(TestCmd):

    def test_normal(self):

        output = PrintTableCmd().output(self.clients)

        expected_output = """

Name   Enabled Timeout  Last Successful Check

foo    Yes     00:05:00 2019-02-03T00:00:00  

barbar Yes     00:05:00 2019-02-04T00:00:00  

"""[1:-1]

        self.assertEqual(output, expected_output)

    def test_verbose(self):

        output = PrintTableCmd(verbose=True).output(self.clients)

        expected_output = """

Name   Enabled Timeout  Last Successful Check Created             Interval Host            Key ID                                                           Fingerprint                              Check Is Running Last Enabled        Approval Is Pending Approved By Default Last Approval Request Approval Delay Approval Duration Checker              Extended Timeout Expires             Last Checker Status

foo    Yes     00:05:00 2019-02-03T00:00:00   2019-01-02T00:00:00 00:02:00 foo.example.org 92ed150794387c03ce684574b1139a6594a34f895daaaf09fd8ea90a27cddb12 778827225BA7DE539C5A7CFA59CFF7CDBD9A5920 No               2019-01-03T00:00:00 No                  Yes                                       00:00:00       00:00:01          fping -q -- %(host)s 00:15:00         2019-02-04T00:00:00 0                  

barbar Yes     00:05:00 2019-02-04T00:00:00   2019-01-03T00:00:00 00:02:00 192.0.2.3       0558568eedd67d622f5c83b35a115f796ab612cff5ad227247e46c2b020f441c 3E393AEAEFB84C7E89E2F547B3A107558FCA3A27 Yes              2019-01-04T00:00:00 No                  No                  2019-01-03T00:00:00   00:00:30       00:00:01          :                    00:15:00         2019-02-05T00:00:00 -2                 

"""[1:-1]

        self.assertEqual(output, expected_output)

    def test_one_client(self):

        output = PrintTableCmd().output(self.one_client)

        expected_output = """

Name Enabled Timeout  Last Successful Check

foo  Yes     00:05:00 2019-02-03T00:00:00  

"""[1:-1]

        self.assertEqual(output, expected_output)

                "ApprovalDuration": 1000,

class TestIsEnabledCmd(TestCmd):

    def test_is_enabled(self):

        self.assertTrue(all(IsEnabledCmd().is_enabled(client, properties)

                            for client, properties in self.clients.items()))

    def test_is_enabled_run_exits_successfully(self):

        with self.assertRaises(SystemExit) as e:

            IsEnabledCmd().run(None, self.one_client)

        if e.exception.code is not None:

            self.assertEqual(e.exception.code, 0)

        else:

            self.assertIsNone(e.exception.code)

    def test_is_enabled_run_exits_with_failure(self):

        self.client.attributes["Enabled"] = dbus.Boolean(False)

        with self.assertRaises(SystemExit) as e:

            IsEnabledCmd().run(None, self.one_client)

        if isinstance(e.exception.code, int):

            self.assertNotEqual(e.exception.code, 0)

        else:

            self.assertIsNotNone(e.exception.code)

 

class TestRemoveCmd(TestCmd):

    def test_remove(self):

        class MockMandos(object):

            def __init__(self):

                self.calls = []

            def RemoveClient(self, dbus_path):

                self.calls.append(("RemoveClient", (dbus_path,)))

        mandos = MockMandos()

        super(TestRemoveCmd, self).setUp()

        RemoveCmd().run(mandos, self.clients)

        self.assertEqual(len(mandos.calls), 2)

        for client in self.clients:

            self.assertIn(("RemoveClient",

                           (client.__dbus_object_path__,)),

                          mandos.calls)

 

class TestApproveCmd(TestCmd):

    def test_approve(self):

        ApproveCmd().run(None, self.clients)

        for client in self.clients:

            self.assertIn(("Approve", (True, client_interface)),

                          client.calls)

 

class TestDenyCmd(TestCmd):

    def test_deny(self):

        DenyCmd().run(None, self.clients)

        for client in self.clients: