/mandos/trunk

#!/usr/bin/python

# -*- mode: python; coding: utf-8; after-save-hook: (lambda () (let ((command (if (and (boundp 'tramp-file-name-structure) (string-match (car tramp-file-name-structure) (buffer-file-name))) (tramp-file-name-localname (tramp-dissect-file-name (buffer-file-name))) (buffer-file-name)))) (if (= (shell-command (format "%s --check" (shell-quote-argument command)) "*Test*") 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)) (kill-buffer "*Test*")) (display-buffer "*Test*")))); -*-

#

# Mandos Monitor - Control and monitor the Mandos server

#

# Copyright © 2008-2019 Teddy Hogeborn

# Copyright © 2008-2019 Björn Påhlsson

#

# This file is part of Mandos.

#

# Mandos is free software: you can redistribute it and/or modify it

# under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

#     Mandos is distributed in the hope that it will be useful, but

#     WITHOUT ANY WARRANTY; without even the implied warranty of

#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

#     GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.

#

# Contact the authors at <mandos@recompile.se>.

#

from __future__ import (division, absolute_import, print_function,

                        unicode_literals)

try:

    from future_builtins import *

except ImportError:

    pass

import sys

import argparse

import locale

import datetime

import re

import os

import collections

import json

import unittest

import logging

import dbus

# Show warnings by default

if not sys.warnoptions:

    import warnings

    warnings.simplefilter("default")

log = logging.getLogger(sys.argv[0])

logging.basicConfig(level="INFO", # Show info level messages

                    format="%(message)s") # Show basic log messages

logging.captureWarnings(True)   # Show warnings via the logging system

if sys.version_info.major == 2:

    str = unicode

locale.setlocale(locale.LC_ALL, "")

tablewords = {

    "Name": "Name",

    "Enabled": "Enabled",

    "Timeout": "Timeout",

    "LastCheckedOK": "Last Successful Check",

    "LastApprovalRequest": "Last Approval Request",

    "Created": "Created",

    "Interval": "Interval",

    "Host": "Host",

    "Fingerprint": "Fingerprint",

    "KeyID": "Key ID",

    "CheckerRunning": "Check Is Running",

    "LastEnabled": "Last Enabled",

    "ApprovalPending": "Approval Is Pending",

    "ApprovedByDefault": "Approved By Default",

    "ApprovalDelay": "Approval Delay",

    "ApprovalDuration": "Approval Duration",

    "Checker": "Checker",

    "ExtendedTimeout": "Extended Timeout",

    "Expires": "Expires",

    "LastCheckerStatus": "Last Checker Status",

}

defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")

domain = "se.recompile"

busname = domain + ".Mandos"

server_path = "/"

server_interface = domain + ".Mandos"

client_interface = domain + ".Mandos.Client"

version = "1.8.3"

try:

    dbus.OBJECT_MANAGER_IFACE

except AttributeError:

    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

def milliseconds_to_string(ms):

    td = datetime.timedelta(0, 0, 0, ms)

    return ("{days}{hours:02}:{minutes:02}:{seconds:02}"

            .format(days="{}T".format(td.days) if td.days else "",

                    hours=td.seconds // 3600,

                    minutes=(td.seconds % 3600) // 60,

                    seconds=td.seconds % 60))

def rfc3339_duration_to_delta(duration):

    """Parse an RFC 3339 "duration" and return a datetime.timedelta

    >>> rfc3339_duration_to_delta("P7D")

    datetime.timedelta(7)

    >>> rfc3339_duration_to_delta("PT60S")

    datetime.timedelta(0, 60)

    >>> rfc3339_duration_to_delta("PT60M")

    datetime.timedelta(0, 3600)

    >>> rfc3339_duration_to_delta("P60M")

    datetime.timedelta(1680)

    >>> rfc3339_duration_to_delta("PT24H")

    datetime.timedelta(1)

    >>> rfc3339_duration_to_delta("P1W")

    datetime.timedelta(7)

    >>> rfc3339_duration_to_delta("PT5M30S")

    datetime.timedelta(0, 330)

    >>> rfc3339_duration_to_delta("P1DT3M20S")

    datetime.timedelta(1, 200)

    >>> # Can not be empty:

    >>> rfc3339_duration_to_delta("")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: u''

    >>> # Must start with "P":

    >>> rfc3339_duration_to_delta("1D")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: u'1D'

    >>> # Must use correct order

    >>> rfc3339_duration_to_delta("PT1S2M")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: u'PT1S2M'

    >>> # Time needs time marker

    >>> rfc3339_duration_to_delta("P1H2S")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: u'P1H2S'

    >>> # Weeks can not be combined with anything else

    >>> rfc3339_duration_to_delta("P1D2W")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: u'P1D2W'

    >>> rfc3339_duration_to_delta("P2W2H")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: u'P2W2H'

    """

    # Parsing an RFC 3339 duration with regular expressions is not

    # possible - there would have to be multiple places for the same

    # values, like seconds.  The current code, while more esoteric, is

    # cleaner without depending on a parsing library.  If Python had a

    # built-in library for parsing we would use it, but we'd like to

    # avoid excessive use of external libraries.

    # New type for defining tokens, syntax, and semantics all-in-one

    Token = collections.namedtuple("Token", (

        "regexp",  # To match token; if "value" is not None, must have

                   # a "group" containing digits

        "value",   # datetime.timedelta or None

        "followers"))           # Tokens valid after this token

    # RFC 3339 "duration" tokens, syntax, and semantics; taken from

    # the "duration" ABNF definition in RFC 3339, Appendix A.

    token_end = Token(re.compile(r"$"), None, frozenset())

    token_second = Token(re.compile(r"(\d+)S"),

                         datetime.timedelta(seconds=1),

                         frozenset((token_end, )))

    token_minute = Token(re.compile(r"(\d+)M"),

                         datetime.timedelta(minutes=1),

                         frozenset((token_second, token_end)))

    token_hour = Token(re.compile(r"(\d+)H"),

                       datetime.timedelta(hours=1),

                       frozenset((token_minute, token_end)))

    token_time = Token(re.compile(r"T"),

                       None,

                       frozenset((token_hour, token_minute,

                                  token_second)))

    token_day = Token(re.compile(r"(\d+)D"),

                      datetime.timedelta(days=1),

                      frozenset((token_time, token_end)))

    token_month = Token(re.compile(r"(\d+)M"),

                        datetime.timedelta(weeks=4),

                        frozenset((token_day, token_end)))

    token_year = Token(re.compile(r"(\d+)Y"),

                       datetime.timedelta(weeks=52),

                       frozenset((token_month, token_end)))

    token_week = Token(re.compile(r"(\d+)W"),

                       datetime.timedelta(weeks=1),

                       frozenset((token_end, )))

    token_duration = Token(re.compile(r"P"), None,

                           frozenset((token_year, token_month,

                                      token_day, token_time,

                                      token_week)))

    # Define starting values:

    # Value so far

    value = datetime.timedelta()

    found_token = None

    # Following valid tokens

    followers = frozenset((token_duration, ))

    # String left to parse

    s = duration

    # Loop until end token is found

    while found_token is not token_end:

        # Search for any currently valid tokens

        for token in followers:

            match = token.regexp.match(s)

            if match is not None:

                # Token found

                if token.value is not None:

                    # Value found, parse digits

                    factor = int(match.group(1), 10)

                    # Add to value so far

                    value += factor * token.value

                # Strip token from string

                s = token.regexp.sub("", s, 1)

                # Go to found token

                found_token = token

                # Set valid next tokens

                followers = found_token.followers

                break

        else:

            # No currently valid tokens were found

            raise ValueError("Invalid RFC 3339 duration: {!r}"

                             .format(duration))

    # End token found

    return value

def string_to_delta(interval):

    """Parse a string and return a datetime.timedelta

    """

    try:

        return rfc3339_duration_to_delta(interval)

    except ValueError as e:

        log.warning("%s - Parsing as pre-1.6.1 interval instead",

                    ' '.join(e.args))

    return parse_pre_1_6_1_interval(interval)

def parse_pre_1_6_1_interval(interval):

    """Parse an interval string as documented by Mandos before 1.6.1, and

    return a datetime.timedelta

    >>> parse_pre_1_6_1_interval('7d')

    datetime.timedelta(7)

    >>> parse_pre_1_6_1_interval('60s')

    datetime.timedelta(0, 60)

    >>> parse_pre_1_6_1_interval('60m')

    datetime.timedelta(0, 3600)

    >>> parse_pre_1_6_1_interval('24h')

    datetime.timedelta(1)

    >>> parse_pre_1_6_1_interval('1w')

    datetime.timedelta(7)

    >>> parse_pre_1_6_1_interval('5m 30s')

    datetime.timedelta(0, 330)

    >>> parse_pre_1_6_1_interval('')

    datetime.timedelta(0)

    >>> # Ignore unknown characters, allow any order and repetitions

    >>> parse_pre_1_6_1_interval('2dxy7zz11y3m5m')

    datetime.timedelta(2, 480, 18000)

    """

    value = datetime.timedelta(0)

    regexp = re.compile(r"(\d+)([dsmhw]?)")

    for num, suffix in regexp.findall(interval):

        if suffix == "d":

            value += datetime.timedelta(int(num))

        elif suffix == "s":

            value += datetime.timedelta(0, int(num))

        elif suffix == "m":

            value += datetime.timedelta(0, 0, 0, 0, int(num))

        elif suffix == "h":

            value += datetime.timedelta(0, 0, 0, 0, 0, int(num))

        elif suffix == "w":

            value += datetime.timedelta(0, 0, 0, 0, 0, 0, int(num))

        elif suffix == "":

            value += datetime.timedelta(0, 0, 0, int(num))

    return value

def print_clients(clients, keywords):

    print('\n'.join(table_rows_of_clients(clients, keywords)))

def table_rows_of_clients(clients, keywords):

    def valuetostring(value, keyword):

        if isinstance(value, dbus.Boolean):

            return "Yes" if value else "No"

        if keyword in ("Timeout", "Interval", "ApprovalDelay",

                       "ApprovalDuration", "ExtendedTimeout"):

            return milliseconds_to_string(value)

        return str(value)

    # Create format string to print table rows

    format_string = " ".join("{{{key}:{width}}}".format(

        width=max(len(tablewords[key]),

                  max(len(valuetostring(client[key], key))

                      for client in clients)),

        key=key)

                             for key in keywords)

    # Start with header line

    rows = [format_string.format(**tablewords)]

    for client in clients:

        rows.append(format_string

                    .format(**{key: valuetostring(client[key], key)

                               for key in keywords}))

    return rows

def has_actions(options):

    return any((options.enable,

                options.disable,

                options.bump_timeout,

                options.start_checker,

                options.stop_checker,

                options.is_enabled,

                options.remove,

                options.checker is not None,

                options.timeout is not None,

                options.extended_timeout is not None,

                options.interval is not None,

                options.approved_by_default is not None,

                options.approval_delay is not None,

                options.approval_duration is not None,

                options.host is not None,

                options.secret is not None,

                options.approve,

                options.deny))

def main():

    parser = argparse.ArgumentParser()

    parser.add_argument("--version", action="version",

                        version="%(prog)s {}".format(version),

                        help="show version number and exit")

    parser.add_argument("-a", "--all", action="store_true",

                        help="Select all clients")

    parser.add_argument("-v", "--verbose", action="store_true",

                        help="Print all fields")

    parser.add_argument("-j", "--dump-json", action="store_true",

                        help="Dump client data in JSON format")

    parser.add_argument("-e", "--enable", action="store_true",

                        help="Enable client")

    parser.add_argument("-d", "--disable", action="store_true",

                        help="disable client")

    parser.add_argument("-b", "--bump-timeout", action="store_true",

                        help="Bump timeout for client")

    parser.add_argument("--start-checker", action="store_true",

                        help="Start checker for client")

    parser.add_argument("--stop-checker", action="store_true",

                        help="Stop checker for client")

    parser.add_argument("-V", "--is-enabled", action="store_true",

                        help="Check if client is enabled")

    parser.add_argument("-r", "--remove", action="store_true",

                        help="Remove client")

    parser.add_argument("-c", "--checker",

                        help="Set checker command for client")

    parser.add_argument("-t", "--timeout",

                        help="Set timeout for client")

    parser.add_argument("--extended-timeout",

                        help="Set extended timeout for client")

    parser.add_argument("-i", "--interval",

                        help="Set checker interval for client")

    parser.add_argument("--approve-by-default", action="store_true",

                        default=None, dest="approved_by_default",

                        help="Set client to be approved by default")

    parser.add_argument("--deny-by-default", action="store_false",

                        dest="approved_by_default",

                        help="Set client to be denied by default")

    parser.add_argument("--approval-delay",

                        help="Set delay before client approve/deny")

    parser.add_argument("--approval-duration",

                        help="Set duration of one client approval")

    parser.add_argument("-H", "--host", help="Set host for client")

    parser.add_argument("-s", "--secret",

                        type=argparse.FileType(mode="rb"),

                        help="Set password blob (file) for client")

    parser.add_argument("-A", "--approve", action="store_true",

                        help="Approve any current client request")

    parser.add_argument("-D", "--deny", action="store_true",

                        help="Deny any current client request")

    parser.add_argument("--check", action="store_true",

                        help="Run self-test")

    parser.add_argument("client", nargs="*", help="Client name")

    options = parser.parse_args()

    if has_actions(options) and not (options.client or options.all):

        parser.error("Options require clients names or --all.")

    if options.verbose and has_actions(options):

        parser.error("--verbose can only be used alone.")

    if options.dump_json and (options.verbose

                              or has_actions(options)):

        parser.error("--dump-json can only be used alone.")

    if options.all and not has_actions(options):

        parser.error("--all requires an action.")

    try:

        bus = dbus.SystemBus()

        mandos_dbus_objc = bus.get_object(busname, server_path)

    except dbus.exceptions.DBusException:

        log.critical("Could not connect to Mandos server")

        sys.exit(1)

    mandos_serv = dbus.Interface(mandos_dbus_objc,

                                 dbus_interface=server_interface)

    mandos_serv_object_manager = dbus.Interface(

        mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)

    # block stderr since dbus library prints to stderr

    null = os.open(os.path.devnull, os.O_RDWR)

    stderrcopy = os.dup(sys.stderr.fileno())

    os.dup2(null, sys.stderr.fileno())

    os.close(null)

    try:

        try:

            mandos_clients = {path: ifs_and_props[client_interface]

                              for path, ifs_and_props in

                              mandos_serv_object_manager

                              .GetManagedObjects().items()

                              if client_interface in ifs_and_props}

        finally:

            # restore stderr

            os.dup2(stderrcopy, sys.stderr.fileno())

            os.close(stderrcopy)

    except dbus.exceptions.DBusException as e:

        log.critical("Failed to access Mandos server through D-Bus:"

                     "\n%s", e)

        sys.exit(1)

    # Compile dict of (clients: properties) to process

    clients = {}

    if options.all or not options.client:

        clients = {bus.get_object(busname, path): properties

                   for path, properties in mandos_clients.items()}

    else:

        for name in options.client:

            for path, client in mandos_clients.items():

                if client["Name"] == name:

                    client_objc = bus.get_object(busname, path)

                    clients[client_objc] = client

                    break

            else:

                log.critical("Client not found on server: %r", name)

                sys.exit(1)

    if not has_actions(options) and clients:

        if options.verbose or options.dump_json:

            keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",

                        "Created", "Interval", "Host", "KeyID",

                        "Fingerprint", "CheckerRunning",

                        "LastEnabled", "ApprovalPending",

                        "ApprovedByDefault", "LastApprovalRequest",

                        "ApprovalDelay", "ApprovalDuration",

                        "Checker", "ExtendedTimeout", "Expires",

                        "LastCheckerStatus")

        else:

            keywords = defaultkeywords

        if options.dump_json:

            json.dump({client["Name"]: {key:

                                        bool(client[key])

                                        if isinstance(client[key],

                                                      dbus.Boolean)

                                        else client[key]

                                        for key in keywords}

                       for client in clients.values()},

                      fp=sys.stdout, indent=4,

                      separators=(',', ': '))

            print()

        else:

            print_clients(clients.values(), keywords)

    else:

        # Process each client in the list by all selected options

        for client in clients:

            def set_client_prop(prop, value):

                """Set a Client D-Bus property"""

                client.Set(client_interface, prop, value,

                           dbus_interface=dbus.PROPERTIES_IFACE)

            def set_client_prop_ms(prop, value):

                """Set a Client D-Bus property, converted

                from a string to milliseconds."""

                set_client_prop(prop,

                                string_to_delta(value).total_seconds()

                                * 1000)

            if options.remove:

                mandos_serv.RemoveClient(client.__dbus_object_path__)

            if options.enable:

                set_client_prop("Enabled", dbus.Boolean(True))

            if options.disable:

                set_client_prop("Enabled", dbus.Boolean(False))

            if options.bump_timeout:

                set_client_prop("LastCheckedOK", "")

            if options.start_checker:

                set_client_prop("CheckerRunning", dbus.Boolean(True))

            if options.stop_checker:

                set_client_prop("CheckerRunning", dbus.Boolean(False))

            if options.is_enabled:

                if client.Get(client_interface, "Enabled",

                              dbus_interface=dbus.PROPERTIES_IFACE):

                    sys.exit(0)

                else:

                    sys.exit(1)

            if options.checker is not None:

                set_client_prop("Checker", options.checker)

            if options.host is not None:

                set_client_prop("Host", options.host)

            if options.interval is not None:

                set_client_prop_ms("Interval", options.interval)

            if options.approval_delay is not None:

                set_client_prop_ms("ApprovalDelay",

                                   options.approval_delay)

            if options.approval_duration is not None:

                set_client_prop_ms("ApprovalDuration",

                                   options.approval_duration)

            if options.timeout is not None:

                set_client_prop_ms("Timeout", options.timeout)

            if options.extended_timeout is not None:

                set_client_prop_ms("ExtendedTimeout",

                                   options.extended_timeout)

            if options.secret is not None:

                set_client_prop("Secret",

                                dbus.ByteArray(options.secret.read()))

            if options.approved_by_default is not None:

                set_client_prop("ApprovedByDefault",

                                dbus.Boolean(options

                                             .approved_by_default))

            if options.approve:

                client.Approve(dbus.Boolean(True),

                               dbus_interface=client_interface)

            elif options.deny:

                client.Approve(dbus.Boolean(False),

                               dbus_interface=client_interface)

class Test_milliseconds_to_string(unittest.TestCase):

    def test_all(self):

        self.assertEqual(milliseconds_to_string(93785000),

                         "1T02:03:05")

    def test_no_days(self):

        self.assertEqual(milliseconds_to_string(7385000), "02:03:05")

    def test_all_zero(self):

        self.assertEqual(milliseconds_to_string(0), "00:00:00")

    def test_no_fractional_seconds(self):

        self.assertEqual(milliseconds_to_string(400), "00:00:00")

        self.assertEqual(milliseconds_to_string(900), "00:00:00")

        self.assertEqual(milliseconds_to_string(1900), "00:00:01")

class Test_string_to_delta(unittest.TestCase):

    def test_handles_basic_rfc3339(self):

        self.assertEqual(string_to_delta("PT2H"),

                         datetime.timedelta(0, 7200))

    def test_falls_back_to_pre_1_6_1_with_warning(self):

        # assertLogs only exists in Python 3.4

        if hasattr(self, "assertLogs"):

            with self.assertLogs(log, logging.WARNING):

                value = string_to_delta("2h")

        else:

            value = string_to_delta("2h")

        self.assertEqual(value, datetime.timedelta(0, 7200))

class Test_table_rows_of_clients(unittest.TestCase):

    def setUp(self):

        global tablewords

        self.old_tablewords = tablewords

        tablewords = {

            "Attr1": "X",

            "AttrTwo": "Yy",

            "AttrThree": "Zzz",

            "Bool": "A D-BUS Boolean",

            "NonDbusBoolean": "A Non-D-BUS Boolean",

            "Integer": "An Integer",

            "Timeout": "Timedelta 1",

            "Interval": "Timedelta 2",

            "ApprovalDelay": "Timedelta 3",

            "ApprovalDuration": "Timedelta 4",

            "ExtendedTimeout": "Timedelta 5",

            "String": "A String",

        }

        self.keywords = ["Attr1", "AttrTwo"]

        self.clients = [

            {

                "Attr1": "x1",

                "AttrTwo": "y1",

                "AttrThree": "z1",

                "Bool": dbus.Boolean(False),

                "NonDbusBoolean": False,

                "Integer": 0,

                "Timeout": 0,

                "Interval": 1000,

                "ApprovalDelay": 2000,

                "ApprovalDuration": 3000,

                "ExtendedTimeout": 4000,

                "String": "",

            },

            {

                "Attr1": "x2",

                "AttrTwo": "y2",

                "AttrThree": "z2",

                "Bool": dbus.Boolean(True),

                "NonDbusBoolean": True,

                "Integer": 1,

                "Timeout": 93785000,

                "Interval": 93786000,

                "ApprovalDelay": 93787000,

                "ApprovalDuration": 93788000,

                "ExtendedTimeout": 93789000,

                "String": "A huge string which will not fit," * 10,

            },

        ]

    def tearDown(self):

        global tablewords

        tablewords = self.old_tablewords

    def test_short_header(self):

        rows = table_rows_of_clients(self.clients, self.keywords)

        expected_rows = [

            "X  Yy",

            "x1 y1",

            "x2 y2"]

        self.assertEqual(rows, expected_rows)

    def test_booleans(self):

        keywords = ["Bool", "NonDbusBoolean"]

        rows = table_rows_of_clients(self.clients, keywords)

        expected_rows = [

            "A D-BUS Boolean A Non-D-BUS Boolean",

            "No              False              ",

            "Yes             True               ",