To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos-ctl
- browse files at revision 1005
- compare with another revision
- download diff
- download tarball
- view history from revision 1005
- Committer: Teddy Hogeborn
- Date: 2019-03-03 12:54:35 UTC
- Revision ID: teddy@recompile.se-20190303125435-33pvzrb511cu78j3
mandos-ctl: Filter logging instead of messing with stderr
* mandos-ctl (main): Eliminate logs from dbus module by altering its
logger, not by redirecting stderr.
* mandos-ctl (main): Eliminate logs from dbus module by altering its
logger, not by redirecting stderr.
- files added:
- DBUS-API
- debian/source
- debian/upstream
- network-hooks.d
- plugin-helpers
- files removed:
- initramfs-tools-hook-conf
- files modified:
- .bzrignore
added
removed
mandos-ctl
1
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
4
from __future__ import division
2
# -*- mode: python; coding: utf-8; after-save-hook: (lambda () (let ((command (if (and (boundp 'tramp-file-name-structure) (string-match (car tramp-file-name-structure) (buffer-file-name))) (tramp-file-name-localname (tramp-dissect-file-name (buffer-file-name))) (buffer-file-name)))) (if (= (shell-command (format "%s --check" (shell-quote-argument command)) "*Test*") 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)) (kill-buffer "*Test*")) (display-buffer "*Test*")))); -*-
3
#
4
# Mandos Monitor - Control and monitor the Mandos server
5
#
6
# Copyright © 2008-2019 Teddy Hogeborn
7
# Copyright © 2008-2019 Björn Påhlsson
8
#
9
# This file is part of Mandos.
10
#
11
# Mandos is free software: you can redistribute it and/or modify it
12
# under the terms of the GNU General Public License as published by
13
# the Free Software Foundation, either version 3 of the License, or
14
# (at your option) any later version.
15
#
16
# Mandos is distributed in the hope that it will be useful, but
17
# WITHOUT ANY WARRANTY; without even the implied warranty of
18
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19
# GNU General Public License for more details.
20
#
21
# You should have received a copy of the GNU General Public License
22
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
23
#
24
# Contact the authors at <mandos@recompile.se>.
25
#
26
27
from __future__ import (division, absolute_import, print_function,
28
unicode_literals)
29
30
try:
31
from future_builtins import *
32
except ImportError:
33
pass
34
5
35
import sys
6
import dbus
7
from optparse import OptionParser
36
import argparse
8
37
import locale
9
38
import datetime
10
39
import re
11
12
locale.setlocale(locale.LC_ALL, u'')
13
14
tablewords = {
15
'name': u'Name',
16
'enabled': u'Enabled',
17
'timeout': u'Timeout',
18
'last_checked_ok': u'Last Successful Check',
19
'created': u'Created',
20
'interval': u'Interval',
21
'host': u'Host',
22
'fingerprint': u'Fingerprint',
23
'checker_running': u'Check Is Running',
24
'last_enabled': u'Last Enabled',
25
'checker': u'Checker',
26
}
27
defaultkeywords = ('name', 'enabled', 'timeout', 'last_checked_ok',
28
'checker')
29
domain = 'se.bsnet.fukt'
30
busname = domain + '.Mandos'
31
server_path = '/'
32
server_interface = domain + '.Mandos'
33
client_interface = domain + '.Mandos.Client'
34
version = "1.0.14"
35
bus = dbus.SystemBus()
36
mandos_dbus_objc = bus.get_object(busname, server_path)
37
mandos_serv = dbus.Interface(mandos_dbus_objc,
38
dbus_interface = server_interface)
39
mandos_clients = mandos_serv.GetAllClientsWithProperties()
40
41
def timedelta_to_milliseconds(td):
42
"Convert a datetime.timedelta object to milliseconds"
43
return ((td.days * 24 * 60 * 60 * 1000)
44
+ (td.seconds * 1000)
45
+ (td.microseconds // 1000))
40
import os
41
import collections
42
import json
43
import unittest
44
import logging
45
46
import dbus
47
48
# Show warnings by default
49
if not sys.warnoptions:
50
import warnings
51
warnings.simplefilter("default")
52
53
log = logging.getLogger(sys.argv[0])
54
logging.basicConfig(level="INFO", # Show info level messages
55
format="%(message)s") # Show basic log messages
56
57
logging.captureWarnings(True) # Show warnings via the logging system
58
59
if sys.version_info.major == 2:
60
str = unicode
61
62
locale.setlocale(locale.LC_ALL, "")
63
64
domain = "se.recompile"
65
busname = domain + ".Mandos"
66
server_path = "/"
67
server_interface = domain + ".Mandos"
68
client_interface = domain + ".Mandos.Client"
69
version = "1.8.3"
70
71
72
try:
73
dbus.OBJECT_MANAGER_IFACE
74
except AttributeError:
75
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
76
46
77
47
78
def milliseconds_to_string(ms):
48
79
td = datetime.timedelta(0, 0, 0, ms)
49
return (u"%(days)s%(hours)02d:%(minutes)02d:%(seconds)02d"
50
% { "days": "%dT" % td.days if td.days else "",
51
"hours": td.seconds // 3600,
52
"minutes": (td.seconds % 3600) // 60,
53
"seconds": td.seconds % 60,
54
})
80
return ("{days}{hours:02}:{minutes:02}:{seconds:02}"
81
.format(days="{}T".format(td.days) if td.days else "",
82
hours=td.seconds // 3600,
83
minutes=(td.seconds % 3600) // 60,
84
seconds=td.seconds % 60))
85
86
87
def rfc3339_duration_to_delta(duration):
88
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
89
90
>>> rfc3339_duration_to_delta("P7D")
91
datetime.timedelta(7)
92
>>> rfc3339_duration_to_delta("PT60S")
93
datetime.timedelta(0, 60)
94
>>> rfc3339_duration_to_delta("PT60M")
95
datetime.timedelta(0, 3600)
96
>>> rfc3339_duration_to_delta("P60M")
97
datetime.timedelta(1680)
98
>>> rfc3339_duration_to_delta("PT24H")
99
datetime.timedelta(1)
100
>>> rfc3339_duration_to_delta("P1W")
101
datetime.timedelta(7)
102
>>> rfc3339_duration_to_delta("PT5M30S")
103
datetime.timedelta(0, 330)
104
>>> rfc3339_duration_to_delta("P1DT3M20S")
105
datetime.timedelta(1, 200)
106
>>> # Can not be empty:
107
>>> rfc3339_duration_to_delta("")
108
Traceback (most recent call last):
109
...
110
ValueError: Invalid RFC 3339 duration: u''
111
>>> # Must start with "P":
112
>>> rfc3339_duration_to_delta("1D")
113
Traceback (most recent call last):
114
...
115
ValueError: Invalid RFC 3339 duration: u'1D'
116
>>> # Must use correct order
117
>>> rfc3339_duration_to_delta("PT1S2M")
118
Traceback (most recent call last):
119
...
120
ValueError: Invalid RFC 3339 duration: u'PT1S2M'
121
>>> # Time needs time marker
122
>>> rfc3339_duration_to_delta("P1H2S")
123
Traceback (most recent call last):
124
...
125
ValueError: Invalid RFC 3339 duration: u'P1H2S'
126
>>> # Weeks can not be combined with anything else
127
>>> rfc3339_duration_to_delta("P1D2W")
128
Traceback (most recent call last):
129
...
130
ValueError: Invalid RFC 3339 duration: u'P1D2W'
131
>>> rfc3339_duration_to_delta("P2W2H")
132
Traceback (most recent call last):
133
...
134
ValueError: Invalid RFC 3339 duration: u'P2W2H'
135
"""
136
137
# Parsing an RFC 3339 duration with regular expressions is not
138
# possible - there would have to be multiple places for the same
139
# values, like seconds. The current code, while more esoteric, is
140
# cleaner without depending on a parsing library. If Python had a
141
# built-in library for parsing we would use it, but we'd like to
142
# avoid excessive use of external libraries.
143
144
# New type for defining tokens, syntax, and semantics all-in-one
145
Token = collections.namedtuple("Token", (
146
"regexp", # To match token; if "value" is not None, must have
147
# a "group" containing digits
148
"value", # datetime.timedelta or None
149
"followers")) # Tokens valid after this token
150
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
151
# the "duration" ABNF definition in RFC 3339, Appendix A.
152
token_end = Token(re.compile(r"$"), None, frozenset())
153
token_second = Token(re.compile(r"(\d+)S"),
154
datetime.timedelta(seconds=1),
155
frozenset((token_end, )))
156
token_minute = Token(re.compile(r"(\d+)M"),
157
datetime.timedelta(minutes=1),
158
frozenset((token_second, token_end)))
159
token_hour = Token(re.compile(r"(\d+)H"),
160
datetime.timedelta(hours=1),
161
frozenset((token_minute, token_end)))
162
token_time = Token(re.compile(r"T"),
163
None,
164
frozenset((token_hour, token_minute,
165
token_second)))
166
token_day = Token(re.compile(r"(\d+)D"),
167
datetime.timedelta(days=1),
168
frozenset((token_time, token_end)))
169
token_month = Token(re.compile(r"(\d+)M"),
170
datetime.timedelta(weeks=4),
171
frozenset((token_day, token_end)))
172
token_year = Token(re.compile(r"(\d+)Y"),
173
datetime.timedelta(weeks=52),
174
frozenset((token_month, token_end)))
175
token_week = Token(re.compile(r"(\d+)W"),
176
datetime.timedelta(weeks=1),
177
frozenset((token_end, )))
178
token_duration = Token(re.compile(r"P"), None,
179
frozenset((token_year, token_month,
180
token_day, token_time,
181
token_week)))
182
# Define starting values:
183
# Value so far
184
value = datetime.timedelta()
185
found_token = None
186
# Following valid tokens
187
followers = frozenset((token_duration, ))
188
# String left to parse
189
s = duration
190
# Loop until end token is found
191
while found_token is not token_end:
192
# Search for any currently valid tokens
193
for token in followers:
194
match = token.regexp.match(s)
195
if match is not None:
196
# Token found
197
if token.value is not None:
198
# Value found, parse digits
199
factor = int(match.group(1), 10)
200
# Add to value so far
201
value += factor * token.value
202
# Strip token from string
203
s = token.regexp.sub("", s, 1)
204
# Go to found token
205
found_token = token
206
# Set valid next tokens
207
followers = found_token.followers
208
break
209
else:
210
# No currently valid tokens were found
211
raise ValueError("Invalid RFC 3339 duration: {!r}"
212
.format(duration))
213
# End token found
214
return value
55
215
56
216
57
217
def string_to_delta(interval):
58
"""Parse a string and return a datetime.timedelta
59
60
>>> string_to_delta('7d')
218
"""Parse a string and return a datetime.timedelta"""
219
220
try:
221
return rfc3339_duration_to_delta(interval)
222
except ValueError as e:
223
log.warning("%s - Parsing as pre-1.6.1 interval instead",
224
' '.join(e.args))
225
return parse_pre_1_6_1_interval(interval)
226
227
228
def parse_pre_1_6_1_interval(interval):
229
"""Parse an interval string as documented by Mandos before 1.6.1,
230
and return a datetime.timedelta
231
232
>>> parse_pre_1_6_1_interval('7d')
61
233
datetime.timedelta(7)
62
>>> string_to_delta('60s')
234
>>> parse_pre_1_6_1_interval('60s')
63
235
datetime.timedelta(0, 60)
64
>>> string_to_delta('60m')
236
>>> parse_pre_1_6_1_interval('60m')
65
237
datetime.timedelta(0, 3600)
66
>>> string_to_delta('24h')
238
>>> parse_pre_1_6_1_interval('24h')
67
239
datetime.timedelta(1)
68
>>> string_to_delta(u'1w')
240
>>> parse_pre_1_6_1_interval('1w')
69
241
datetime.timedelta(7)
70
>>> string_to_delta('5m 30s')
242
>>> parse_pre_1_6_1_interval('5m 30s')
71
243
datetime.timedelta(0, 330)
244
>>> parse_pre_1_6_1_interval('')
245
datetime.timedelta(0)
246
>>> # Ignore unknown characters, allow any order and repetitions
247
>>> parse_pre_1_6_1_interval('2dxy7zz11y3m5m')
248
datetime.timedelta(2, 480, 18000)
249
72
250
"""
73
timevalue = datetime.timedelta(0)
74
regexp = re.compile("\d+[dsmhw]")
75
76
for s in regexp.findall(interval):
77
try:
78
suffix = unicode(s[-1])
79
value = int(s[:-1])
80
if suffix == u"d":
81
delta = datetime.timedelta(value)
82
elif suffix == u"s":
83
delta = datetime.timedelta(0, value)
84
elif suffix == u"m":
85
delta = datetime.timedelta(0, 0, 0, 0, value)
86
elif suffix == u"h":
87
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
88
elif suffix == u"w":
89
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
90
else:
91
raise ValueError
92
except (ValueError, IndexError):
93
raise ValueError
94
timevalue += delta
95
return timevalue
96
97
def print_clients(clients):
251
252
value = datetime.timedelta(0)
253
regexp = re.compile(r"(\d+)([dsmhw]?)")
254
255
for num, suffix in regexp.findall(interval):
256
if suffix == "d":
257
value += datetime.timedelta(int(num))
258
elif suffix == "s":
259
value += datetime.timedelta(0, int(num))
260
elif suffix == "m":
261
value += datetime.timedelta(0, 0, 0, 0, int(num))
262
elif suffix == "h":
263
value += datetime.timedelta(0, 0, 0, 0, 0, int(num))
264
elif suffix == "w":
265
value += datetime.timedelta(0, 0, 0, 0, 0, 0, int(num))
266
elif suffix == "":
267
value += datetime.timedelta(0, 0, 0, int(num))
268
return value
269
270
271
class TableOfClients(object):
272
tableheaders = {
273
"Name": "Name",
274
"Enabled": "Enabled",
275
"Timeout": "Timeout",
276
"LastCheckedOK": "Last Successful Check",
277
"LastApprovalRequest": "Last Approval Request",
278
"Created": "Created",
279
"Interval": "Interval",
280
"Host": "Host",
281
"Fingerprint": "Fingerprint",
282
"KeyID": "Key ID",
283
"CheckerRunning": "Check Is Running",
284
"LastEnabled": "Last Enabled",
285
"ApprovalPending": "Approval Is Pending",
286
"ApprovedByDefault": "Approved By Default",
287
"ApprovalDelay": "Approval Delay",
288
"ApprovalDuration": "Approval Duration",
289
"Checker": "Checker",
290
"ExtendedTimeout": "Extended Timeout",
291
"Expires": "Expires",
292
"LastCheckerStatus": "Last Checker Status",
293
}
294
295
def __init__(self, clients, keywords, tableheaders=None):
296
self.clients = clients
297
self.keywords = keywords
298
if tableheaders is not None:
299
self.tableheaders = tableheaders
300
301
def __str__(self):
302
return "\n".join(self.rows())
303
304
if sys.version_info.major == 2:
305
__unicode__ = __str__
306
def __str__(self):
307
return str(self).encode(locale.getpreferredencoding())
308
309
def rows(self):
310
format_string = self.row_formatting_string()
311
rows = [self.header_line(format_string)]
312
rows.extend(self.client_line(client, format_string)
313
for client in self.clients)
314
return rows
315
316
def row_formatting_string(self):
317
"Format string used to format table rows"
318
return " ".join("{{{key}:{width}}}".format(
319
width=max(len(self.tableheaders[key]),
320
*(len(self.string_from_client(client, key))
321
for client in self.clients)),
322
key=key)
323
for key in self.keywords)
324
325
def string_from_client(self, client, key):
326
return self.valuetostring(client[key], key)
327
328
@staticmethod
98
329
def valuetostring(value, keyword):
99
if type(value) is dbus.Boolean:
100
return u"Yes" if value else u"No"
101
if keyword in (u"timeout", u"interval"):
330
if isinstance(value, dbus.Boolean):
331
return "Yes" if value else "No"
332
if keyword in ("Timeout", "Interval", "ApprovalDelay",
333
"ApprovalDuration", "ExtendedTimeout"):
102
334
return milliseconds_to_string(value)
103
return unicode(value)
104
105
# Create format string to print table rows
106
format_string = u' '.join(u'%%-%ds' %
107
max(len(tablewords[key]),
108
max(len(valuetostring(client[key], key))
109
for client in
110
clients))
111
for key in keywords)
112
# Print header line
113
print format_string % tuple(tablewords[key] for key in keywords)
114
for client in clients:
115
print format_string % tuple(valuetostring(client[key], key)
116
for key in keywords)
117
118
parser = OptionParser(version = "%%prog %s" % version)
119
parser.add_option("-a", "--all", action="store_true",
120
help="Print all fields")
121
parser.add_option("-e", "--enable", action="store_true",
122
help="Enable client")
123
parser.add_option("-d", "--disable", action="store_true",
124
help="disable client")
125
parser.add_option("-b", "--bump-timeout", action="store_true",
126
help="Bump timeout for client")
127
parser.add_option("--start-checker", action="store_true",
128
help="Start checker for client")
129
parser.add_option("--stop-checker", action="store_true",
130
help="Stop checker for client")
131
parser.add_option("-V", "--is-valid", action="store_true",
132
help="Check if client is still valid")
133
parser.add_option("-r", "--remove", action="store_true",
134
help="Remove client")
135
parser.add_option("-c", "--checker", type="string",
136
help="Set checker command for client")
137
parser.add_option("-t", "--timeout", type="string",
138
help="Set timeout for client")
139
parser.add_option("-i", "--interval", type="string",
140
help="Set checker interval for client")
141
parser.add_option("-H", "--host", type="string",
142
help="Set host for client")
143
parser.add_option("-s", "--secret", type="string",
144
help="Set password blob (file) for client")
145
options, client_names = parser.parse_args()
146
147
# Compile list of clients to process
148
clients=[]
149
for name in client_names:
150
for path, client in mandos_clients.iteritems():
151
if client['name'] == name:
152
client_objc = bus.get_object(busname, path)
153
clients.append(client_objc)
154
break
155
else:
156
print >> sys.stderr, "Client not found on server: %r" % name
157
sys.exit(1)
158
159
if not clients and mandos_clients.values():
160
keywords = defaultkeywords
161
if options.all:
162
keywords = ('name', 'enabled', 'timeout', 'last_checked_ok',
163
'created', 'interval', 'host', 'fingerprint',
164
'checker_running', 'last_enabled', 'checker')
165
print_clients(mandos_clients.values())
166
167
# Process each client in the list by all selected options
168
for client in clients:
169
if options.remove:
170
mandos_serv.RemoveClient(client.__dbus_object_path__)
335
return str(value)
336
337
def header_line(self, format_string):
338
return format_string.format(**self.tableheaders)
339
340
def client_line(self, client, format_string):
341
return format_string.format(
342
**{key: self.string_from_client(client, key)
343
for key in self.keywords})
344
345
346
## Classes for commands.
347
348
# Abstract classes first
349
class Command(object):
350
"""Abstract class for commands"""
351
def run(self, clients):
352
"""Normal commands should implement run_on_one_client(), but
353
commands which want to operate on all clients at the same time
354
can override this run() method instead."""
355
for client in clients:
356
self.run_on_one_client(client)
357
358
class PrintCmd(Command):
359
"""Abstract class for commands printing client details"""
360
all_keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
361
"Created", "Interval", "Host", "KeyID",
362
"Fingerprint", "CheckerRunning", "LastEnabled",
363
"ApprovalPending", "ApprovedByDefault",
364
"LastApprovalRequest", "ApprovalDelay",
365
"ApprovalDuration", "Checker", "ExtendedTimeout",
366
"Expires", "LastCheckerStatus")
367
def run(self, clients):
368
print(self.output(clients))
369
370
class PropertyCmd(Command):
371
"""Abstract class for Actions for setting one client property"""
372
def run_on_one_client(self, client):
373
"""Set the Client's D-Bus property"""
374
client.Set(client_interface, self.property, self.value_to_set,
375
dbus_interface=dbus.PROPERTIES_IFACE)
376
377
class ValueArgumentMixIn(object):
378
"""Mixin class for commands taking a value as argument"""
379
def __init__(self, value):
380
self.value_to_set = value
381
382
class MillisecondsValueArgumentMixIn(ValueArgumentMixIn):
383
"""Mixin class for commands taking a value argument as
384
milliseconds."""
385
@property
386
def value_to_set(self):
387
return self._vts
388
@value_to_set.setter
389
def value_to_set(self, value):
390
"""When setting, convert value to a datetime.timedelta"""
391
self._vts = string_to_delta(value).total_seconds() * 1000
392
393
# Actual (non-abstract) command classes
394
395
class PrintTableCmd(PrintCmd):
396
def __init__(self, verbose=False):
397
self.verbose = verbose
398
def output(self, clients):
399
if self.verbose:
400
keywords = self.all_keywords
401
else:
402
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
403
return str(TableOfClients(clients.values(), keywords))
404
405
class DumpJSONCmd(PrintCmd):
406
def output(self, clients):
407
data = {client["Name"]:
408
{key: self.dbus_boolean_to_bool(client[key])
409
for key in self.all_keywords}
410
for client in clients.values()}
411
return json.dumps(data, indent=4, separators=(',', ': '))
412
@staticmethod
413
def dbus_boolean_to_bool(value):
414
if isinstance(value, dbus.Boolean):
415
value = bool(value)
416
return value
417
418
class IsEnabledCmd(Command):
419
def run_on_one_client(self, client):
420
if self.is_enabled(client):
421
sys.exit(0)
422
sys.exit(1)
423
def is_enabled(self, client):
424
return client.Get(client_interface, "Enabled",
425
dbus_interface=dbus.PROPERTIES_IFACE)
426
427
class RemoveCmd(Command):
428
def __init__(self, mandos):
429
self.mandos = mandos
430
def run_on_one_client(self, client):
431
self.mandos.RemoveClient(client.__dbus_object_path__)
432
433
class ApproveCmd(Command):
434
def run_on_one_client(self, client):
435
client.Approve(dbus.Boolean(True),
436
dbus_interface=client_interface)
437
438
class DenyCmd(Command):
439
def run_on_one_client(self, client):
440
client.Approve(dbus.Boolean(False),
441
dbus_interface=client_interface)
442
443
class EnableCmd(PropertyCmd):
444
property = "Enabled"
445
value_to_set = dbus.Boolean(True)
446
447
class DisableCmd(PropertyCmd):
448
property = "Enabled"
449
value_to_set = dbus.Boolean(False)
450
451
class BumpTimeoutCmd(PropertyCmd):
452
property = "LastCheckedOK"
453
value_to_set = ""
454
455
class StartCheckerCmd(PropertyCmd):
456
property = "CheckerRunning"
457
value_to_set = dbus.Boolean(True)
458
459
class StopCheckerCmd(PropertyCmd):
460
property = "CheckerRunning"
461
value_to_set = dbus.Boolean(False)
462
463
class ApproveByDefaultCmd(PropertyCmd):
464
property = "ApprovedByDefault"
465
value_to_set = dbus.Boolean(True)
466
467
class DenyByDefaultCmd(PropertyCmd):
468
property = "ApprovedByDefault"
469
value_to_set = dbus.Boolean(False)
470
471
class SetCheckerCmd(PropertyCmd, ValueArgumentMixIn):
472
property = "Checker"
473
474
class SetHostCmd(PropertyCmd, ValueArgumentMixIn):
475
property = "Host"
476
477
class SetSecretCmd(PropertyCmd, ValueArgumentMixIn):
478
property = "Secret"
479
480
class SetTimeoutCmd(PropertyCmd, MillisecondsValueArgumentMixIn):
481
property = "Timeout"
482
483
class SetExtendedTimeoutCmd(PropertyCmd,
484
MillisecondsValueArgumentMixIn):
485
property = "ExtendedTimeout"
486
487
class SetIntervalCmd(PropertyCmd, MillisecondsValueArgumentMixIn):
488
property = "Interval"
489
490
class SetApprovalDelayCmd(PropertyCmd,
491
MillisecondsValueArgumentMixIn):
492
property = "ApprovalDelay"
493
494
class SetApprovalDurationCmd(PropertyCmd,
495
MillisecondsValueArgumentMixIn):
496
property = "ApprovalDuration"
497
498
def has_actions(options):
499
return any((options.enable,
500
options.disable,
501
options.bump_timeout,
502
options.start_checker,
503
options.stop_checker,
504
options.is_enabled,
505
options.remove,
506
options.checker is not None,
507
options.timeout is not None,
508
options.extended_timeout is not None,
509
options.interval is not None,
510
options.approved_by_default is not None,
511
options.approval_delay is not None,
512
options.approval_duration is not None,
513
options.host is not None,
514
options.secret is not None,
515
options.approve,
516
options.deny))
517
518
519
def main():
520
parser = argparse.ArgumentParser()
521
parser.add_argument("--version", action="version",
522
version="%(prog)s {}".format(version),
523
help="show version number and exit")
524
parser.add_argument("-a", "--all", action="store_true",
525
help="Select all clients")
526
parser.add_argument("-v", "--verbose", action="store_true",
527
help="Print all fields")
528
parser.add_argument("-j", "--dump-json", action="store_true",
529
help="Dump client data in JSON format")
530
enable_disable = parser.add_mutually_exclusive_group()
531
enable_disable.add_argument("-e", "--enable", action="store_true",
532
help="Enable client")
533
enable_disable.add_argument("-d", "--disable",
534
action="store_true",
535
help="disable client")
536
parser.add_argument("-b", "--bump-timeout", action="store_true",
537
help="Bump timeout for client")
538
start_stop_checker = parser.add_mutually_exclusive_group()
539
start_stop_checker.add_argument("--start-checker",
540
action="store_true",
541
help="Start checker for client")
542
start_stop_checker.add_argument("--stop-checker",
543
action="store_true",
544
help="Stop checker for client")
545
parser.add_argument("-V", "--is-enabled", action="store_true",
546
help="Check if client is enabled")
547
parser.add_argument("-r", "--remove", action="store_true",
548
help="Remove client")
549
parser.add_argument("-c", "--checker",
550
help="Set checker command for client")
551
parser.add_argument("-t", "--timeout",
552
help="Set timeout for client")
553
parser.add_argument("--extended-timeout",
554
help="Set extended timeout for client")
555
parser.add_argument("-i", "--interval",
556
help="Set checker interval for client")
557
approve_deny_default = parser.add_mutually_exclusive_group()
558
approve_deny_default.add_argument(
559
"--approve-by-default", action="store_true",
560
default=None, dest="approved_by_default",
561
help="Set client to be approved by default")
562
approve_deny_default.add_argument(
563
"--deny-by-default", action="store_false",
564
dest="approved_by_default",
565
help="Set client to be denied by default")
566
parser.add_argument("--approval-delay",
567
help="Set delay before client approve/deny")
568
parser.add_argument("--approval-duration",
569
help="Set duration of one client approval")
570
parser.add_argument("-H", "--host", help="Set host for client")
571
parser.add_argument("-s", "--secret",
572
type=argparse.FileType(mode="rb"),
573
help="Set password blob (file) for client")
574
approve_deny = parser.add_mutually_exclusive_group()
575
approve_deny.add_argument(
576
"-A", "--approve", action="store_true",
577
help="Approve any current client request")
578
approve_deny.add_argument("-D", "--deny", action="store_true",
579
help="Deny any current client request")
580
parser.add_argument("--check", action="store_true",
581
help="Run self-test")
582
parser.add_argument("client", nargs="*", help="Client name")
583
options = parser.parse_args()
584
585
if has_actions(options) and not (options.client or options.all):
586
parser.error("Options require clients names or --all.")
587
if options.verbose and has_actions(options):
588
parser.error("--verbose can only be used alone.")
589
if options.dump_json and (options.verbose
590
or has_actions(options)):
591
parser.error("--dump-json can only be used alone.")
592
if options.all and not has_actions(options):
593
parser.error("--all requires an action.")
594
if options.is_enabled and len(options.client) > 1:
595
parser.error("--is-enabled requires exactly one client")
596
597
try:
598
bus = dbus.SystemBus()
599
mandos_dbus_objc = bus.get_object(busname, server_path)
600
except dbus.exceptions.DBusException:
601
log.critical("Could not connect to Mandos server")
602
sys.exit(1)
603
604
mandos_serv = dbus.Interface(mandos_dbus_objc,
605
dbus_interface=server_interface)
606
mandos_serv_object_manager = dbus.Interface(
607
mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)
608
609
commands = []
610
611
if options.dump_json:
612
commands.append(DumpJSONCmd())
613
171
614
if options.enable:
172
client.Enable(dbus_interface=client_interface)
615
commands.append(EnableCmd())
616
173
617
if options.disable:
174
client.Disable(dbus_interface=client_interface)
618
commands.append(DisableCmd())
619
175
620
if options.bump_timeout:
176
client.CheckedOK(dbus_interface=client_interface)
621
commands.append(BumpTimeoutCmd(options.bump_timeout))
622
177
623
if options.start_checker:
178
client.StartChecker(dbus_interface=client_interface)
624
commands.append(StartCheckerCmd())
625
179
626
if options.stop_checker:
180
client.StopChecker(dbus_interface=client_interface)
181
if options.is_valid:
182
sys.exit(0 if client.Get(client_interface,
183
u"enabled",
184
dbus_interface=dbus.PROPERTIES_IFACE)
185
else 1)
186
if options.checker:
187
client.Set(client_interface, u"checker", options.checker,
188
dbus_interface=dbus.PROPERTIES_IFACE)
189
if options.host:
190
client.Set(client_interface, u"host", options.host,
191
dbus_interface=dbus.PROPERTIES_IFACE)
192
if options.interval:
193
client.Set(client_interface, u"interval",
194
timedelta_to_milliseconds
195
(string_to_delta(options.interval)),
196
dbus_interface=dbus.PROPERTIES_IFACE)
197
if options.timeout:
198
client.Set(client_interface, u"timeout",
199
timedelta_to_milliseconds(string_to_delta
200
(options.timeout)),
201
dbus_interface=dbus.PROPERTIES_IFACE)
202
if options.secret:
203
client.Set(client_interface, u"secret",
204
dbus.ByteArray(open(options.secret, u'rb').read()),
205
dbus_interface=dbus.PROPERTIES_IFACE)
627
commands.append(StopCheckerCmd())
628
629
if options.is_enabled:
630
commands.append(IsEnabledCmd())
631
632
if options.remove:
633
commands.append(RemoveCmd(mandos_serv))
634
635
if options.checker is not None:
636
commands.append(SetCheckerCmd())
637
638
if options.timeout is not None:
639
commands.append(SetTimeoutCmd(options.timeout))
640
641
if options.extended_timeout:
642
commands.append(
643
SetExtendedTimeoutCmd(options.extended_timeout))
644
645
if options.interval is not None:
646
command.append(SetIntervalCmd(options.interval))
647
648
if options.approved_by_default is not None:
649
if options.approved_by_default:
650
command.append(ApproveByDefaultCmd())
651
else:
652
command.append(DenyByDefaultCmd())
653
654
if options.approval_delay is not None:
655
command.append(SetApprovalDelayCmd(options.approval_delay))
656
657
if options.approval_duration is not None:
658
command.append(
659
SetApprovalDurationCmd(options.approval_duration))
660
661
if options.host is not None:
662
command.append(SetHostCmd(options.host))
663
664
if options.secret is not None:
665
command.append(SetSecretCmd(options.secret))
666
667
if options.approve:
668
commands.append(ApproveCmd())
669
670
if options.deny:
671
commands.append(DenyCmd())
672
673
# If no command option has been given, show table of clients,
674
# optionally verbosely
675
if not commands:
676
commands.append(PrintTableCmd(verbose=options.verbose))
677
678
# Filter out log message from dbus module
679
dbus_logger = logging.getLogger("dbus.proxies")
680
class NullFilter(logging.Filter):
681
def filter(self, record):
682
return False
683
dbus_filter = NullFilter()
684
dbus_logger.addFilter(dbus_filter)
685
try:
686
try:
687
mandos_clients = {path: ifs_and_props[client_interface]
688
for path, ifs_and_props in
689
mandos_serv_object_manager
690
.GetManagedObjects().items()
691
if client_interface in ifs_and_props}
692
finally:
693
# restore dbus logger
694
dbus_logger.removeFilter(dbus_filter)
695
except dbus.exceptions.DBusException as e:
696
log.critical("Failed to access Mandos server through D-Bus:"
697
"\n%s", e)
698
sys.exit(1)
699
700
# Compile dict of (clients: properties) to process
701
clients = {}
702
703
if options.all or not options.client:
704
clients = {bus.get_object(busname, path): properties
705
for path, properties in mandos_clients.items()}
706
else:
707
for name in options.client:
708
for path, client in mandos_clients.items():
709
if client["Name"] == name:
710
client_objc = bus.get_object(busname, path)
711
clients[client_objc] = client
712
break
713
else:
714
log.critical("Client not found on server: %r", name)
715
sys.exit(1)
716
717
# Run all commands on clients
718
for command in commands:
719
command.run(clients)
720
721
722
class Test_milliseconds_to_string(unittest.TestCase):
723
def test_all(self):
724
self.assertEqual(milliseconds_to_string(93785000),
725
"1T02:03:05")
726
def test_no_days(self):
727
self.assertEqual(milliseconds_to_string(7385000), "02:03:05")
728
def test_all_zero(self):
729
self.assertEqual(milliseconds_to_string(0), "00:00:00")
730
def test_no_fractional_seconds(self):
731
self.assertEqual(milliseconds_to_string(400), "00:00:00")
732
self.assertEqual(milliseconds_to_string(900), "00:00:00")
733
self.assertEqual(milliseconds_to_string(1900), "00:00:01")
734
735
class Test_string_to_delta(unittest.TestCase):
736
def test_handles_basic_rfc3339(self):
737
self.assertEqual(string_to_delta("PT2H"),
738
datetime.timedelta(0, 7200))
739
def test_falls_back_to_pre_1_6_1_with_warning(self):
740
# assertLogs only exists in Python 3.4
741
if hasattr(self, "assertLogs"):
742
with self.assertLogs(log, logging.WARNING):
743
value = string_to_delta("2h")
744
else:
745
value = string_to_delta("2h")
746
self.assertEqual(value, datetime.timedelta(0, 7200))
747
748
class Test_TableOfClients(unittest.TestCase):
749
def setUp(self):
750
self.tableheaders = {
751
"Attr1": "X",
752
"AttrTwo": "Yy",
753
"AttrThree": "Zzz",
754
"Bool": "A D-BUS Boolean",
755
"NonDbusBoolean": "A Non-D-BUS Boolean",
756
"Integer": "An Integer",
757
"Timeout": "Timedelta 1",
758
"Interval": "Timedelta 2",
759
"ApprovalDelay": "Timedelta 3",
760
"ApprovalDuration": "Timedelta 4",
761
"ExtendedTimeout": "Timedelta 5",
762
"String": "A String",
763
}
764
self.keywords = ["Attr1", "AttrTwo"]
765
self.clients = [
766
{
767
"Attr1": "x1",
768
"AttrTwo": "y1",
769
"AttrThree": "z1",
770
"Bool": dbus.Boolean(False),
771
"NonDbusBoolean": False,
772
"Integer": 0,
773
"Timeout": 0,
774
"Interval": 1000,
775
"ApprovalDelay": 2000,
776
"ApprovalDuration": 3000,
777
"ExtendedTimeout": 4000,
778
"String": "",
779
},
780
{
781
"Attr1": "x2",
782
"AttrTwo": "y2",
783
"AttrThree": "z2",
784
"Bool": dbus.Boolean(True),
785
"NonDbusBoolean": True,
786
"Integer": 1,
787
"Timeout": 93785000,
788
"Interval": 93786000,
789
"ApprovalDelay": 93787000,
790
"ApprovalDuration": 93788000,
791
"ExtendedTimeout": 93789000,
792
"String": "A huge string which will not fit," * 10,
793
},
794
]
795
def test_short_header(self):
796
text = str(TableOfClients(self.clients, self.keywords,
797
self.tableheaders))
798
expected_text = """
799
X Yy
800
x1 y1
801
x2 y2
802
"""[1:-1]
803
self.assertEqual(text, expected_text)
804
def test_booleans(self):
805
keywords = ["Bool", "NonDbusBoolean"]
806
text = str(TableOfClients(self.clients, keywords,
807
self.tableheaders))
808
expected_text = """
809
A D-BUS Boolean A Non-D-BUS Boolean
810
No False
811
Yes True
812
"""[1:-1]
813
self.assertEqual(text, expected_text)
814
def test_milliseconds_detection(self):
815
keywords = ["Integer", "Timeout", "Interval", "ApprovalDelay",
816
"ApprovalDuration", "ExtendedTimeout"]
817
text = str(TableOfClients(self.clients, keywords,
818
self.tableheaders))
819
expected_text = """
820
An Integer Timedelta 1 Timedelta 2 Timedelta 3 Timedelta 4 Timedelta 5
821
0 00:00:00 00:00:01 00:00:02 00:00:03 00:00:04
822
1 1T02:03:05 1T02:03:06 1T02:03:07 1T02:03:08 1T02:03:09
823
"""[1:-1]
824
self.assertEqual(text, expected_text)
825
def test_empty_and_long_string_values(self):
826
keywords = ["String"]
827
text = str(TableOfClients(self.clients, keywords,
828
self.tableheaders))
829
expected_text = """
830
A String
831
832
A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,
833
"""[1:-1]
834
self.assertEqual(text, expected_text)
835
836
837
838
def should_only_run_tests():
839
parser = argparse.ArgumentParser(add_help=False)
840
parser.add_argument("--check", action='store_true')
841
args, unknown_args = parser.parse_known_args()
842
run_tests = args.check
843
if run_tests:
844
# Remove --check argument from sys.argv
845
sys.argv[1:] = unknown_args
846
return run_tests
847
848
# Add all tests from doctest strings
849
def load_tests(loader, tests, none):
850
import doctest
851
tests.addTests(doctest.DocTestSuite())
852
return tests
853
854
if __name__ == "__main__":
855
if should_only_run_tests():
856
# Call using ./tdd-python-script --check [--verbose]
857
unittest.main()
858
else:
859
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0