To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos-ctl
- browse files at revision 1018
- compare with another revision
- download diff
- download tarball
- view history from revision 1018
- Committer: Teddy Hogeborn
- Date: 2019-03-04 18:52:48 UTC
- Revision ID: teddy@recompile.se-20190304185248-1yrqw03l1s2skue4
mandos-ctl: Refactor tests
* mandos-ctl (TestCmd.client): New; contains one mock client.
(TestPrintTableCmd.test_one_client): Use TestCmd.client.
(TestDumpJSONCmd.test_one_client): - '' -
(TestIsEnabledCmd.test_is_enabled_does_get_attribute): - '' -
(TestIsEnabledCmd.test_is_enabled_run_exits_successfully): - '' -
(TestIsEnabledCmd.test_is_enabled_run_exits_with_failure): - '' -
(TestRemoveCmd.test_remove): - '' -
* mandos-ctl (TestCmd.client): New; contains one mock client.
(TestPrintTableCmd.test_one_client): Use TestCmd.client.
(TestDumpJSONCmd.test_one_client): - '' -
(TestIsEnabledCmd.test_is_enabled_does_get_attribute): - '' -
(TestIsEnabledCmd.test_is_enabled_run_exits_successfully): - '' -
(TestIsEnabledCmd.test_is_enabled_run_exits_with_failure): - '' -
(TestRemoveCmd.test_remove): - '' -
- files added:
- debian/mandos-client.templates
- files removed:
- initramfs-tools-hook-conf
- files modified:
- DBUS-API
added
removed
mandos-ctl
1
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
2
# -*- mode: python; coding: utf-8; after-save-hook: (lambda () (let ((command (if (and (boundp 'tramp-file-name-structure) (string-match (car tramp-file-name-structure) (buffer-file-name))) (tramp-file-name-localname (tramp-dissect-file-name (buffer-file-name))) (buffer-file-name)))) (if (= (shell-command (format "%s --check" (shell-quote-argument command)) "*Test*") 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)) (kill-buffer "*Test*")) (display-buffer "*Test*")))); -*-
3
#
4
4
# Mandos Monitor - Control and monitor the Mandos server
5
#
6
# Copyright © 2008-2016 Teddy Hogeborn
7
# Copyright © 2008-2016 Björn Påhlsson
8
#
9
# This program is free software: you can redistribute it and/or modify
10
# it under the terms of the GNU General Public License as published by
5
#
6
# Copyright © 2008-2019 Teddy Hogeborn
7
# Copyright © 2008-2019 Björn Påhlsson
8
#
9
# This file is part of Mandos.
10
#
11
# Mandos is free software: you can redistribute it and/or modify it
12
# under the terms of the GNU General Public License as published by
11
13
# the Free Software Foundation, either version 3 of the License, or
12
14
# (at your option) any later version.
13
15
#
14
# This program is distributed in the hope that it will be useful,
15
# but WITHOUT ANY WARRANTY; without even the implied warranty of
16
# Mandos is distributed in the hope that it will be useful, but
17
# WITHOUT ANY WARRANTY; without even the implied warranty of
16
18
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17
19
# GNU General Public License for more details.
18
#
20
#
19
21
# You should have received a copy of the GNU General Public License
20
# along with this program. If not, see
21
# <http://www.gnu.org/licenses/>.
22
#
22
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
23
#
23
24
# Contact the authors at <mandos@recompile.se>.
24
#
25
#
25
26
26
27
from __future__ import (division, absolute_import, print_function,
27
28
unicode_literals)
38
39
import re
39
40
import os
40
41
import collections
41
import doctest
42
42
import json
43
import unittest
44
import logging
43
45
44
46
import dbus
45
47
48
# Show warnings by default
49
if not sys.warnoptions:
50
import warnings
51
warnings.simplefilter("default")
52
53
log = logging.getLogger(sys.argv[0])
54
logging.basicConfig(level="INFO", # Show info level messages
55
format="%(message)s") # Show basic log messages
56
57
logging.captureWarnings(True) # Show warnings via the logging system
58
46
59
if sys.version_info.major == 2:
47
60
str = unicode
48
61
49
62
locale.setlocale(locale.LC_ALL, "")
50
63
51
tablewords = {
52
"Name": "Name",
53
"Enabled": "Enabled",
54
"Timeout": "Timeout",
55
"LastCheckedOK": "Last Successful Check",
56
"LastApprovalRequest": "Last Approval Request",
57
"Created": "Created",
58
"Interval": "Interval",
59
"Host": "Host",
60
"Fingerprint": "Fingerprint",
61
"CheckerRunning": "Check Is Running",
62
"LastEnabled": "Last Enabled",
63
"ApprovalPending": "Approval Is Pending",
64
"ApprovedByDefault": "Approved By Default",
65
"ApprovalDelay": "Approval Delay",
66
"ApprovalDuration": "Approval Duration",
67
"Checker": "Checker",
68
"ExtendedTimeout": "Extended Timeout"
69
}
70
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
71
64
domain = "se.recompile"
72
65
busname = domain + ".Mandos"
73
66
server_path = "/"
74
67
server_interface = domain + ".Mandos"
75
68
client_interface = domain + ".Mandos.Client"
76
version = "1.7.10"
69
version = "1.8.3"
77
70
78
71
79
72
try:
81
74
except AttributeError:
82
75
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
83
76
77
84
78
def milliseconds_to_string(ms):
85
79
td = datetime.timedelta(0, 0, 0, ms)
86
return ("{days}{hours:02}:{minutes:02}:{seconds:02}".format(
87
days = "{}T".format(td.days) if td.days else "",
88
hours = td.seconds // 3600,
89
minutes = (td.seconds % 3600) // 60,
90
seconds = td.seconds % 60))
80
return ("{days}{hours:02}:{minutes:02}:{seconds:02}"
81
.format(days="{}T".format(td.days) if td.days else "",
82
hours=td.seconds // 3600,
83
minutes=(td.seconds % 3600) // 60,
84
seconds=td.seconds % 60))
91
85
92
86
93
87
def rfc3339_duration_to_delta(duration):
94
88
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
95
89
96
90
>>> rfc3339_duration_to_delta("P7D")
97
91
datetime.timedelta(7)
98
92
>>> rfc3339_duration_to_delta("PT60S")
99
93
datetime.timedelta(0, 60)
100
94
>>> rfc3339_duration_to_delta("PT60M")
101
95
datetime.timedelta(0, 3600)
96
>>> rfc3339_duration_to_delta("P60M")
97
datetime.timedelta(1680)
102
98
>>> rfc3339_duration_to_delta("PT24H")
103
99
datetime.timedelta(1)
104
100
>>> rfc3339_duration_to_delta("P1W")
107
103
datetime.timedelta(0, 330)
108
104
>>> rfc3339_duration_to_delta("P1DT3M20S")
109
105
datetime.timedelta(1, 200)
106
>>> # Can not be empty:
107
>>> rfc3339_duration_to_delta("")
108
Traceback (most recent call last):
109
...
110
ValueError: Invalid RFC 3339 duration: u''
111
>>> # Must start with "P":
112
>>> rfc3339_duration_to_delta("1D")
113
Traceback (most recent call last):
114
...
115
ValueError: Invalid RFC 3339 duration: u'1D'
116
>>> # Must use correct order
117
>>> rfc3339_duration_to_delta("PT1S2M")
118
Traceback (most recent call last):
119
...
120
ValueError: Invalid RFC 3339 duration: u'PT1S2M'
121
>>> # Time needs time marker
122
>>> rfc3339_duration_to_delta("P1H2S")
123
Traceback (most recent call last):
124
...
125
ValueError: Invalid RFC 3339 duration: u'P1H2S'
126
>>> # Weeks can not be combined with anything else
127
>>> rfc3339_duration_to_delta("P1D2W")
128
Traceback (most recent call last):
129
...
130
ValueError: Invalid RFC 3339 duration: u'P1D2W'
131
>>> rfc3339_duration_to_delta("P2W2H")
132
Traceback (most recent call last):
133
...
134
ValueError: Invalid RFC 3339 duration: u'P2W2H'
110
135
"""
111
136
112
137
# Parsing an RFC 3339 duration with regular expressions is not
113
138
# possible - there would have to be multiple places for the same
114
139
# values, like seconds. The current code, while more esoteric, is
115
140
# cleaner without depending on a parsing library. If Python had a
116
141
# built-in library for parsing we would use it, but we'd like to
117
142
# avoid excessive use of external libraries.
118
143
119
144
# New type for defining tokens, syntax, and semantics all-in-one
120
145
Token = collections.namedtuple("Token", (
121
146
"regexp", # To match token; if "value" is not None, must have
154
179
frozenset((token_year, token_month,
155
180
token_day, token_time,
156
181
token_week)))
157
# Define starting values
158
value = datetime.timedelta() # Value so far
182
# Define starting values:
183
# Value so far
184
value = datetime.timedelta()
159
185
found_token = None
160
followers = frozenset((token_duration, )) # Following valid tokens
161
s = duration # String left to parse
186
# Following valid tokens
187
followers = frozenset((token_duration, ))
188
# String left to parse
189
s = duration
162
190
# Loop until end token is found
163
191
while found_token is not token_end:
164
192
# Search for any currently valid tokens
187
215
188
216
189
217
def string_to_delta(interval):
190
"""Parse a string and return a datetime.timedelta
191
192
>>> string_to_delta('7d')
193
datetime.timedelta(7)
194
>>> string_to_delta('60s')
195
datetime.timedelta(0, 60)
196
>>> string_to_delta('60m')
197
datetime.timedelta(0, 3600)
198
>>> string_to_delta('24h')
199
datetime.timedelta(1)
200
>>> string_to_delta('1w')
201
datetime.timedelta(7)
202
>>> string_to_delta('5m 30s')
203
datetime.timedelta(0, 330)
204
"""
205
218
"""Parse a string and return a datetime.timedelta"""
219
206
220
try:
207
221
return rfc3339_duration_to_delta(interval)
208
except ValueError:
209
pass
210
222
except ValueError as e:
223
log.warning("%s - Parsing as pre-1.6.1 interval instead",
224
' '.join(e.args))
225
return parse_pre_1_6_1_interval(interval)
226
227
228
def parse_pre_1_6_1_interval(interval):
229
"""Parse an interval string as documented by Mandos before 1.6.1,
230
and return a datetime.timedelta
231
232
>>> parse_pre_1_6_1_interval('7d')
233
datetime.timedelta(7)
234
>>> parse_pre_1_6_1_interval('60s')
235
datetime.timedelta(0, 60)
236
>>> parse_pre_1_6_1_interval('60m')
237
datetime.timedelta(0, 3600)
238
>>> parse_pre_1_6_1_interval('24h')
239
datetime.timedelta(1)
240
>>> parse_pre_1_6_1_interval('1w')
241
datetime.timedelta(7)
242
>>> parse_pre_1_6_1_interval('5m 30s')
243
datetime.timedelta(0, 330)
244
>>> parse_pre_1_6_1_interval('')
245
datetime.timedelta(0)
246
>>> # Ignore unknown characters, allow any order and repetitions
247
>>> parse_pre_1_6_1_interval('2dxy7zz11y3m5m')
248
datetime.timedelta(2, 480, 18000)
249
250
"""
251
211
252
value = datetime.timedelta(0)
212
253
regexp = re.compile(r"(\d+)([dsmhw]?)")
213
254
214
255
for num, suffix in regexp.findall(interval):
215
256
if suffix == "d":
216
257
value += datetime.timedelta(int(num))
227
268
return value
228
269
229
270
230
def print_clients(clients, keywords):
231
def valuetostring(value, keyword):
232
if type(value) is dbus.Boolean:
233
return "Yes" if value else "No"
234
if keyword in ("Timeout", "Interval", "ApprovalDelay",
235
"ApprovalDuration", "ExtendedTimeout"):
236
return milliseconds_to_string(value)
237
return str(value)
238
239
# Create format string to print table rows
240
format_string = " ".join("{{{key}:{width}}}".format(
241
width = max(len(tablewords[key]),
242
max(len(valuetostring(client[key], key))
243
for client in clients)),
244
key = key)
245
for key in keywords)
246
# Print header line
247
print(format_string.format(**tablewords))
248
for client in clients:
249
print(format_string.format(**{
250
key: valuetostring(client[key], key)
251
for key in keywords }))
252
271
## Classes for commands.
272
273
# Abstract classes first
274
class Command(object):
275
"""Abstract class for commands"""
276
def run(self, mandos, clients):
277
"""Normal commands should implement run_on_one_client(), but
278
commands which want to operate on all clients at the same time
279
can override this run() method instead."""
280
self.mandos = mandos
281
for client in clients:
282
self.run_on_one_client(client)
283
284
class PrintCmd(Command):
285
"""Abstract class for commands printing client details"""
286
all_keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
287
"Created", "Interval", "Host", "KeyID",
288
"Fingerprint", "CheckerRunning", "LastEnabled",
289
"ApprovalPending", "ApprovedByDefault",
290
"LastApprovalRequest", "ApprovalDelay",
291
"ApprovalDuration", "Checker", "ExtendedTimeout",
292
"Expires", "LastCheckerStatus")
293
def run(self, mandos, clients):
294
print(self.output(clients))
295
296
class PropertyCmd(Command):
297
"""Abstract class for Actions for setting one client property"""
298
def run_on_one_client(self, client):
299
"""Set the Client's D-Bus property"""
300
client.Set(client_interface, self.property, self.value_to_set,
301
dbus_interface=dbus.PROPERTIES_IFACE)
302
303
class ValueArgumentMixIn(object):
304
"""Mixin class for commands taking a value as argument"""
305
def __init__(self, value):
306
self.value_to_set = value
307
308
class MillisecondsValueArgumentMixIn(ValueArgumentMixIn):
309
"""Mixin class for commands taking a value argument as
310
milliseconds."""
311
@property
312
def value_to_set(self):
313
return self._vts
314
@value_to_set.setter
315
def value_to_set(self, value):
316
"""When setting, convert value to a datetime.timedelta"""
317
self._vts = string_to_delta(value).total_seconds() * 1000
318
319
# Actual (non-abstract) command classes
320
321
class PrintTableCmd(PrintCmd):
322
def __init__(self, verbose=False):
323
self.verbose = verbose
324
325
def output(self, clients):
326
if self.verbose:
327
keywords = self.all_keywords
328
else:
329
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
330
return str(self.TableOfClients(clients.values(), keywords))
331
332
class TableOfClients(object):
333
tableheaders = {
334
"Name": "Name",
335
"Enabled": "Enabled",
336
"Timeout": "Timeout",
337
"LastCheckedOK": "Last Successful Check",
338
"LastApprovalRequest": "Last Approval Request",
339
"Created": "Created",
340
"Interval": "Interval",
341
"Host": "Host",
342
"Fingerprint": "Fingerprint",
343
"KeyID": "Key ID",
344
"CheckerRunning": "Check Is Running",
345
"LastEnabled": "Last Enabled",
346
"ApprovalPending": "Approval Is Pending",
347
"ApprovedByDefault": "Approved By Default",
348
"ApprovalDelay": "Approval Delay",
349
"ApprovalDuration": "Approval Duration",
350
"Checker": "Checker",
351
"ExtendedTimeout": "Extended Timeout",
352
"Expires": "Expires",
353
"LastCheckerStatus": "Last Checker Status",
354
}
355
356
def __init__(self, clients, keywords, tableheaders=None):
357
self.clients = clients
358
self.keywords = keywords
359
if tableheaders is not None:
360
self.tableheaders = tableheaders
361
362
def __str__(self):
363
return "\n".join(self.rows())
364
365
if sys.version_info.major == 2:
366
__unicode__ = __str__
367
def __str__(self):
368
return str(self).encode(locale.getpreferredencoding())
369
370
def rows(self):
371
format_string = self.row_formatting_string()
372
rows = [self.header_line(format_string)]
373
rows.extend(self.client_line(client, format_string)
374
for client in self.clients)
375
return rows
376
377
def row_formatting_string(self):
378
"Format string used to format table rows"
379
return " ".join("{{{key}:{width}}}".format(
380
width=max(len(self.tableheaders[key]),
381
*(len(self.string_from_client(client, key))
382
for client in self.clients)),
383
key=key)
384
for key in self.keywords)
385
386
def string_from_client(self, client, key):
387
return self.valuetostring(client[key], key)
388
389
@staticmethod
390
def valuetostring(value, keyword):
391
if isinstance(value, dbus.Boolean):
392
return "Yes" if value else "No"
393
if keyword in ("Timeout", "Interval", "ApprovalDelay",
394
"ApprovalDuration", "ExtendedTimeout"):
395
return milliseconds_to_string(value)
396
return str(value)
397
398
def header_line(self, format_string):
399
return format_string.format(**self.tableheaders)
400
401
def client_line(self, client, format_string):
402
return format_string.format(
403
**{key: self.string_from_client(client, key)
404
for key in self.keywords})
405
406
407
408
class DumpJSONCmd(PrintCmd):
409
def output(self, clients):
410
data = {client["Name"]:
411
{key: self.dbus_boolean_to_bool(client[key])
412
for key in self.all_keywords}
413
for client in clients.values()}
414
return json.dumps(data, indent=4, separators=(',', ': '))
415
@staticmethod
416
def dbus_boolean_to_bool(value):
417
if isinstance(value, dbus.Boolean):
418
value = bool(value)
419
return value
420
421
class IsEnabledCmd(Command):
422
def run_on_one_client(self, client):
423
if self.is_enabled(client):
424
sys.exit(0)
425
sys.exit(1)
426
def is_enabled(self, client):
427
return client.Get(client_interface, "Enabled",
428
dbus_interface=dbus.PROPERTIES_IFACE)
429
430
class RemoveCmd(Command):
431
def run_on_one_client(self, client):
432
self.mandos.RemoveClient(client.__dbus_object_path__)
433
434
class ApproveCmd(Command):
435
def run_on_one_client(self, client):
436
client.Approve(dbus.Boolean(True),
437
dbus_interface=client_interface)
438
439
class DenyCmd(Command):
440
def run_on_one_client(self, client):
441
client.Approve(dbus.Boolean(False),
442
dbus_interface=client_interface)
443
444
class EnableCmd(PropertyCmd):
445
property = "Enabled"
446
value_to_set = dbus.Boolean(True)
447
448
class DisableCmd(PropertyCmd):
449
property = "Enabled"
450
value_to_set = dbus.Boolean(False)
451
452
class BumpTimeoutCmd(PropertyCmd):
453
property = "LastCheckedOK"
454
value_to_set = ""
455
456
class StartCheckerCmd(PropertyCmd):
457
property = "CheckerRunning"
458
value_to_set = dbus.Boolean(True)
459
460
class StopCheckerCmd(PropertyCmd):
461
property = "CheckerRunning"
462
value_to_set = dbus.Boolean(False)
463
464
class ApproveByDefaultCmd(PropertyCmd):
465
property = "ApprovedByDefault"
466
value_to_set = dbus.Boolean(True)
467
468
class DenyByDefaultCmd(PropertyCmd):
469
property = "ApprovedByDefault"
470
value_to_set = dbus.Boolean(False)
471
472
class SetCheckerCmd(PropertyCmd, ValueArgumentMixIn):
473
property = "Checker"
474
475
class SetHostCmd(PropertyCmd, ValueArgumentMixIn):
476
property = "Host"
477
478
class SetSecretCmd(PropertyCmd, ValueArgumentMixIn):
479
property = "Secret"
480
481
class SetTimeoutCmd(PropertyCmd, MillisecondsValueArgumentMixIn):
482
property = "Timeout"
483
484
class SetExtendedTimeoutCmd(PropertyCmd,
485
MillisecondsValueArgumentMixIn):
486
property = "ExtendedTimeout"
487
488
class SetIntervalCmd(PropertyCmd, MillisecondsValueArgumentMixIn):
489
property = "Interval"
490
491
class SetApprovalDelayCmd(PropertyCmd,
492
MillisecondsValueArgumentMixIn):
493
property = "ApprovalDelay"
494
495
class SetApprovalDurationCmd(PropertyCmd,
496
MillisecondsValueArgumentMixIn):
497
property = "ApprovalDuration"
253
498
254
499
def has_actions(options):
255
500
return any((options.enable,
271
516
options.approve,
272
517
options.deny))
273
518
274
275
def main():
276
parser = argparse.ArgumentParser()
519
def add_command_line_options(parser):
277
520
parser.add_argument("--version", action="version",
278
version = "%(prog)s {}".format(version),
521
version="%(prog)s {}".format(version),
279
522
help="show version number and exit")
280
523
parser.add_argument("-a", "--all", action="store_true",
281
524
help="Select all clients")
283
526
help="Print all fields")
284
527
parser.add_argument("-j", "--dump-json", action="store_true",
285
528
help="Dump client data in JSON format")
286
parser.add_argument("-e", "--enable", action="store_true",
287
help="Enable client")
288
parser.add_argument("-d", "--disable", action="store_true",
289
help="disable client")
529
enable_disable = parser.add_mutually_exclusive_group()
530
enable_disable.add_argument("-e", "--enable", action="store_true",
531
help="Enable client")
532
enable_disable.add_argument("-d", "--disable",
533
action="store_true",
534
help="disable client")
290
535
parser.add_argument("-b", "--bump-timeout", action="store_true",
291
536
help="Bump timeout for client")
292
parser.add_argument("--start-checker", action="store_true",
293
help="Start checker for client")
294
parser.add_argument("--stop-checker", action="store_true",
295
help="Stop checker for client")
537
start_stop_checker = parser.add_mutually_exclusive_group()
538
start_stop_checker.add_argument("--start-checker",
539
action="store_true",
540
help="Start checker for client")
541
start_stop_checker.add_argument("--stop-checker",
542
action="store_true",
543
help="Stop checker for client")
296
544
parser.add_argument("-V", "--is-enabled", action="store_true",
297
545
help="Check if client is enabled")
298
546
parser.add_argument("-r", "--remove", action="store_true",
305
553
help="Set extended timeout for client")
306
554
parser.add_argument("-i", "--interval",
307
555
help="Set checker interval for client")
308
parser.add_argument("--approve-by-default", action="store_true",
309
default=None, dest="approved_by_default",
310
help="Set client to be approved by default")
311
parser.add_argument("--deny-by-default", action="store_false",
312
dest="approved_by_default",
313
help="Set client to be denied by default")
556
approve_deny_default = parser.add_mutually_exclusive_group()
557
approve_deny_default.add_argument(
558
"--approve-by-default", action="store_true",
559
default=None, dest="approved_by_default",
560
help="Set client to be approved by default")
561
approve_deny_default.add_argument(
562
"--deny-by-default", action="store_false",
563
dest="approved_by_default",
564
help="Set client to be denied by default")
314
565
parser.add_argument("--approval-delay",
315
566
help="Set delay before client approve/deny")
316
567
parser.add_argument("--approval-duration",
319
570
parser.add_argument("-s", "--secret",
320
571
type=argparse.FileType(mode="rb"),
321
572
help="Set password blob (file) for client")
322
parser.add_argument("-A", "--approve", action="store_true",
323
help="Approve any current client request")
324
parser.add_argument("-D", "--deny", action="store_true",
325
help="Deny any current client request")
573
approve_deny = parser.add_mutually_exclusive_group()
574
approve_deny.add_argument(
575
"-A", "--approve", action="store_true",
576
help="Approve any current client request")
577
approve_deny.add_argument("-D", "--deny", action="store_true",
578
help="Deny any current client request")
326
579
parser.add_argument("--check", action="store_true",
327
580
help="Run self-test")
328
581
parser.add_argument("client", nargs="*", help="Client name")
582
583
584
def commands_and_clients_from_options(options):
585
586
commands = []
587
588
if options.dump_json:
589
commands.append(DumpJSONCmd())
590
591
if options.enable:
592
commands.append(EnableCmd())
593
594
if options.disable:
595
commands.append(DisableCmd())
596
597
if options.bump_timeout:
598
commands.append(BumpTimeoutCmd(options.bump_timeout))
599
600
if options.start_checker:
601
commands.append(StartCheckerCmd())
602
603
if options.stop_checker:
604
commands.append(StopCheckerCmd())
605
606
if options.is_enabled:
607
commands.append(IsEnabledCmd())
608
609
if options.remove:
610
commands.append(RemoveCmd())
611
612
if options.checker is not None:
613
commands.append(SetCheckerCmd())
614
615
if options.timeout is not None:
616
commands.append(SetTimeoutCmd(options.timeout))
617
618
if options.extended_timeout:
619
commands.append(
620
SetExtendedTimeoutCmd(options.extended_timeout))
621
622
if options.interval is not None:
623
command.append(SetIntervalCmd(options.interval))
624
625
if options.approved_by_default is not None:
626
if options.approved_by_default:
627
command.append(ApproveByDefaultCmd())
628
else:
629
command.append(DenyByDefaultCmd())
630
631
if options.approval_delay is not None:
632
command.append(SetApprovalDelayCmd(options.approval_delay))
633
634
if options.approval_duration is not None:
635
command.append(
636
SetApprovalDurationCmd(options.approval_duration))
637
638
if options.host is not None:
639
command.append(SetHostCmd(options.host))
640
641
if options.secret is not None:
642
command.append(SetSecretCmd(options.secret))
643
644
if options.approve:
645
commands.append(ApproveCmd())
646
647
if options.deny:
648
commands.append(DenyCmd())
649
650
# If no command option has been given, show table of clients,
651
# optionally verbosely
652
if not commands:
653
commands.append(PrintTableCmd(verbose=options.verbose))
654
655
return commands, options.client
656
657
658
def main():
659
parser = argparse.ArgumentParser()
660
661
add_command_line_options(parser)
662
329
663
options = parser.parse_args()
330
664
331
665
if has_actions(options) and not (options.client or options.all):
332
666
parser.error("Options require clients names or --all.")
333
667
if options.verbose and has_actions(options):
334
668
parser.error("--verbose can only be used alone.")
335
if options.dump_json and (options.verbose or has_actions(options)):
669
if options.dump_json and (options.verbose
670
or has_actions(options)):
336
671
parser.error("--dump-json can only be used alone.")
337
672
if options.all and not has_actions(options):
338
673
parser.error("--all requires an action.")
339
340
if options.check:
341
fail_count, test_count = doctest.testmod()
342
sys.exit(os.EX_OK if fail_count == 0 else 1)
343
674
if options.is_enabled and len(options.client) > 1:
675
parser.error("--is-enabled requires exactly one client")
676
677
commands, clientnames = commands_and_clients_from_options(options)
678
344
679
try:
345
680
bus = dbus.SystemBus()
346
681
mandos_dbus_objc = bus.get_object(busname, server_path)
347
682
except dbus.exceptions.DBusException:
348
print("Could not connect to Mandos server", file=sys.stderr)
683
log.critical("Could not connect to Mandos server")
349
684
sys.exit(1)
350
685
351
686
mandos_serv = dbus.Interface(mandos_dbus_objc,
352
dbus_interface = server_interface)
687
dbus_interface=server_interface)
353
688
mandos_serv_object_manager = dbus.Interface(
354
mandos_dbus_objc, dbus_interface = dbus.OBJECT_MANAGER_IFACE)
355
356
#block stderr since dbus library prints to stderr
357
null = os.open(os.path.devnull, os.O_RDWR)
358
stderrcopy = os.dup(sys.stderr.fileno())
359
os.dup2(null, sys.stderr.fileno())
360
os.close(null)
689
mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)
690
691
# Filter out log message from dbus module
692
dbus_logger = logging.getLogger("dbus.proxies")
693
class NullFilter(logging.Filter):
694
def filter(self, record):
695
return False
696
dbus_filter = NullFilter()
361
697
try:
362
try:
363
mandos_clients = { path: ifs_and_props[client_interface]
364
for path, ifs_and_props in
365
mandos_serv_object_manager
366
.GetManagedObjects().items()
367
if client_interface in ifs_and_props }
368
finally:
369
#restore stderr
370
os.dup2(stderrcopy, sys.stderr.fileno())
371
os.close(stderrcopy)
698
dbus_logger.addFilter(dbus_filter)
699
mandos_clients = {path: ifs_and_props[client_interface]
700
for path, ifs_and_props in
701
mandos_serv_object_manager
702
.GetManagedObjects().items()
703
if client_interface in ifs_and_props}
372
704
except dbus.exceptions.DBusException as e:
373
print("Access denied: Accessing mandos server through D-Bus: {}"
374
.format(e), file=sys.stderr)
705
log.critical("Failed to access Mandos server through D-Bus:"
706
"\n%s", e)
375
707
sys.exit(1)
376
708
finally:
709
# restore dbus logger
710
dbus_logger.removeFilter(dbus_filter)
711
377
712
# Compile dict of (clients: properties) to process
378
clients={}
379
380
if options.all or not options.client:
381
clients = { bus.get_object(busname, path): properties
382
for path, properties in mandos_clients.items() }
713
clients = {}
714
715
if not clientnames:
716
clients = {bus.get_object(busname, path): properties
717
for path, properties in mandos_clients.items()}
383
718
else:
384
for name in options.client:
719
for name in clientnames:
385
720
for path, client in mandos_clients.items():
386
721
if client["Name"] == name:
387
722
client_objc = bus.get_object(busname, path)
388
723
clients[client_objc] = client
389
724
break
390
725
else:
391
print("Client not found on server: {!r}"
392
.format(name), file=sys.stderr)
726
log.critical("Client not found on server: %r", name)
393
727
sys.exit(1)
394
395
if not has_actions(options) and clients:
396
if options.verbose or options.dump_json:
397
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
398
"Created", "Interval", "Host", "Fingerprint",
399
"CheckerRunning", "LastEnabled",
400
"ApprovalPending", "ApprovedByDefault",
401
"LastApprovalRequest", "ApprovalDelay",
402
"ApprovalDuration", "Checker",
403
"ExtendedTimeout")
404
else:
405
keywords = defaultkeywords
406
407
if options.dump_json:
408
json.dump({client["Name"]: {key:
409
bool(client[key])
410
if isinstance(client[key],
411
dbus.Boolean)
412
else client[key]
413
for key in keywords }
414
for client in clients.values() },
415
fp = sys.stdout, indent = 4,
416
separators = (',', ': '))
417
print()
418
else:
419
print_clients(clients.values(), keywords)
420
else:
421
# Process each client in the list by all selected options
422
for client in clients:
423
424
def set_client_prop(prop, value):
425
"""Set a Client D-Bus property"""
426
client.Set(client_interface, prop, value,
427
dbus_interface=dbus.PROPERTIES_IFACE)
428
429
def set_client_prop_ms(prop, value):
430
"""Set a Client D-Bus property, converted
431
from a string to milliseconds."""
432
set_client_prop(prop,
433
string_to_delta(value).total_seconds()
434
* 1000)
435
436
if options.remove:
437
mandos_serv.RemoveClient(client.__dbus_object_path__)
438
if options.enable:
439
set_client_prop("Enabled", dbus.Boolean(True))
440
if options.disable:
441
set_client_prop("Enabled", dbus.Boolean(False))
442
if options.bump_timeout:
443
set_client_prop("LastCheckedOK", "")
444
if options.start_checker:
445
set_client_prop("CheckerRunning", dbus.Boolean(True))
446
if options.stop_checker:
447
set_client_prop("CheckerRunning", dbus.Boolean(False))
448
if options.is_enabled:
449
sys.exit(0 if client.Get(client_interface,
450
"Enabled",
451
dbus_interface=
452
dbus.PROPERTIES_IFACE)
453
else 1)
454
if options.checker is not None:
455
set_client_prop("Checker", options.checker)
456
if options.host is not None:
457
set_client_prop("Host", options.host)
458
if options.interval is not None:
459
set_client_prop_ms("Interval", options.interval)
460
if options.approval_delay is not None:
461
set_client_prop_ms("ApprovalDelay",
462
options.approval_delay)
463
if options.approval_duration is not None:
464
set_client_prop_ms("ApprovalDuration",
465
options.approval_duration)
466
if options.timeout is not None:
467
set_client_prop_ms("Timeout", options.timeout)
468
if options.extended_timeout is not None:
469
set_client_prop_ms("ExtendedTimeout",
470
options.extended_timeout)
471
if options.secret is not None:
472
set_client_prop("Secret",
473
dbus.ByteArray(options.secret.read()))
474
if options.approved_by_default is not None:
475
set_client_prop("ApprovedByDefault",
476
dbus.Boolean(options
477
.approved_by_default))
478
if options.approve:
479
client.Approve(dbus.Boolean(True),
480
dbus_interface=client_interface)
481
elif options.deny:
482
client.Approve(dbus.Boolean(False),
483
dbus_interface=client_interface)
484
728
729
# Run all commands on clients
730
for command in commands:
731
command.run(mandos_serv, clients)
732
733
734
class Test_milliseconds_to_string(unittest.TestCase):
735
def test_all(self):
736
self.assertEqual(milliseconds_to_string(93785000),
737
"1T02:03:05")
738
def test_no_days(self):
739
self.assertEqual(milliseconds_to_string(7385000), "02:03:05")
740
def test_all_zero(self):
741
self.assertEqual(milliseconds_to_string(0), "00:00:00")
742
def test_no_fractional_seconds(self):
743
self.assertEqual(milliseconds_to_string(400), "00:00:00")
744
self.assertEqual(milliseconds_to_string(900), "00:00:00")
745
self.assertEqual(milliseconds_to_string(1900), "00:00:01")
746
747
class Test_string_to_delta(unittest.TestCase):
748
def test_handles_basic_rfc3339(self):
749
self.assertEqual(string_to_delta("PT2H"),
750
datetime.timedelta(0, 7200))
751
def test_falls_back_to_pre_1_6_1_with_warning(self):
752
# assertLogs only exists in Python 3.4
753
if hasattr(self, "assertLogs"):
754
with self.assertLogs(log, logging.WARNING):
755
value = string_to_delta("2h")
756
else:
757
class WarningFilter(logging.Filter):
758
"""Don't show, but record the presence of, warnings"""
759
def filter(self, record):
760
is_warning = record.levelno >= logging.WARNING
761
self.found = is_warning or getattr(self, "found",
762
False)
763
return not is_warning
764
warning_filter = WarningFilter()
765
log.addFilter(warning_filter)
766
try:
767
value = string_to_delta("2h")
768
finally:
769
log.removeFilter(warning_filter)
770
self.assertTrue(getattr(warning_filter, "found", False))
771
self.assertEqual(value, datetime.timedelta(0, 7200))
772
773
774
class TestCmd(unittest.TestCase):
775
"""Abstract class for tests of command classes"""
776
def setUp(self):
777
testcase = self
778
class MockClient(object):
779
def __init__(self, name, **attributes):
780
self.__dbus_object_path__ = "objpath_{}".format(name)
781
self.attributes = attributes
782
self.attributes["Name"] = name
783
self.calls = []
784
def Set(self, interface, property, value, dbus_interface):
785
testcase.assertEqual(interface, client_interface)
786
testcase.assertEqual(dbus_interface,
787
dbus.PROPERTIES_IFACE)
788
self.attributes[property] = value
789
self.calls.append(("Set", (interface, property, value,
790
dbus_interface)))
791
def Get(self, interface, property, dbus_interface):
792
testcase.assertEqual(interface, client_interface)
793
testcase.assertEqual(dbus_interface,
794
dbus.PROPERTIES_IFACE)
795
self.calls.append(("Get", (interface, property,
796
dbus_interface)))
797
return self.attributes[property]
798
def __getitem__(self, key):
799
return self.attributes[key]
800
def __setitem__(self, key, value):
801
self.attributes[key] = value
802
self.clients = collections.OrderedDict([
803
("foo",
804
MockClient(
805
"foo",
806
KeyID=("92ed150794387c03ce684574b1139a65"
807
"94a34f895daaaf09fd8ea90a27cddb12"),
808
Secret=b"secret",
809
Host="foo.example.org",
810
Enabled=dbus.Boolean(True),
811
Timeout=300000,
812
LastCheckedOK="2019-02-03T00:00:00",
813
Created="2019-01-02T00:00:00",
814
Interval=120000,
815
Fingerprint=("778827225BA7DE539C5A"
816
"7CFA59CFF7CDBD9A5920"),
817
CheckerRunning=dbus.Boolean(False),
818
LastEnabled="2019-01-03T00:00:00",
819
ApprovalPending=dbus.Boolean(False),
820
ApprovedByDefault=dbus.Boolean(True),
821
LastApprovalRequest="",
822
ApprovalDelay=0,
823
ApprovalDuration=1000,
824
Checker="fping -q -- %(host)s",
825
ExtendedTimeout=900000,
826
Expires="2019-02-04T00:00:00",
827
LastCheckerStatus=0)),
828
("barbar",
829
MockClient(
830
"barbar",
831
KeyID=("0558568eedd67d622f5c83b35a115f79"
832
"6ab612cff5ad227247e46c2b020f441c"),
833
Secret=b"secretbar",
834
Host="192.0.2.3",
835
Enabled=dbus.Boolean(True),
836
Timeout=300000,
837
LastCheckedOK="2019-02-04T00:00:00",
838
Created="2019-01-03T00:00:00",
839
Interval=120000,
840
Fingerprint=("3E393AEAEFB84C7E89E2"
841
"F547B3A107558FCA3A27"),
842
CheckerRunning=dbus.Boolean(True),
843
LastEnabled="2019-01-04T00:00:00",
844
ApprovalPending=dbus.Boolean(False),
845
ApprovedByDefault=dbus.Boolean(False),
846
LastApprovalRequest="2019-01-03T00:00:00",
847
ApprovalDelay=30000,
848
ApprovalDuration=1000,
849
Checker=":",
850
ExtendedTimeout=900000,
851
Expires="2019-02-05T00:00:00",
852
LastCheckerStatus=-2)),
853
])
854
self.client = self.clients["foo"]
855
856
class TestPrintTableCmd(TestCmd):
857
def test_normal(self):
858
output = PrintTableCmd().output(self.clients)
859
expected_output = """
860
Name Enabled Timeout Last Successful Check
861
foo Yes 00:05:00 2019-02-03T00:00:00
862
barbar Yes 00:05:00 2019-02-04T00:00:00
863
"""[1:-1]
864
self.assertEqual(output, expected_output)
865
def test_verbose(self):
866
output = PrintTableCmd(verbose=True).output(self.clients)
867
expected_output = """
868
Name Enabled Timeout Last Successful Check Created Interval Host Key ID Fingerprint Check Is Running Last Enabled Approval Is Pending Approved By Default Last Approval Request Approval Delay Approval Duration Checker Extended Timeout Expires Last Checker Status
869
foo Yes 00:05:00 2019-02-03T00:00:00 2019-01-02T00:00:00 00:02:00 foo.example.org 92ed150794387c03ce684574b1139a6594a34f895daaaf09fd8ea90a27cddb12 778827225BA7DE539C5A7CFA59CFF7CDBD9A5920 No 2019-01-03T00:00:00 No Yes 00:00:00 00:00:01 fping -q -- %(host)s 00:15:00 2019-02-04T00:00:00 0
870
barbar Yes 00:05:00 2019-02-04T00:00:00 2019-01-03T00:00:00 00:02:00 192.0.2.3 0558568eedd67d622f5c83b35a115f796ab612cff5ad227247e46c2b020f441c 3E393AEAEFB84C7E89E2F547B3A107558FCA3A27 Yes 2019-01-04T00:00:00 No No 2019-01-03T00:00:00 00:00:30 00:00:01 : 00:15:00 2019-02-05T00:00:00 -2
871
"""[1:-1]
872
self.assertEqual(output, expected_output)
873
def test_one_client(self):
874
output = PrintTableCmd().output({"foo": self.client})
875
expected_output = """
876
Name Enabled Timeout Last Successful Check
877
foo Yes 00:05:00 2019-02-03T00:00:00
878
"""[1:-1]
879
self.assertEqual(output, expected_output)
880
881
class TestDumpJSONCmd(TestCmd):
882
def setUp(self):
883
self.expected_json = {
884
"foo": {
885
"Name": "foo",
886
"KeyID": ("92ed150794387c03ce684574b1139a65"
887
"94a34f895daaaf09fd8ea90a27cddb12"),
888
"Host": "foo.example.org",
889
"Enabled": True,
890
"Timeout": 300000,
891
"LastCheckedOK": "2019-02-03T00:00:00",
892
"Created": "2019-01-02T00:00:00",
893
"Interval": 120000,
894
"Fingerprint": ("778827225BA7DE539C5A"
895
"7CFA59CFF7CDBD9A5920"),
896
"CheckerRunning": False,
897
"LastEnabled": "2019-01-03T00:00:00",
898
"ApprovalPending": False,
899
"ApprovedByDefault": True,
900
"LastApprovalRequest": "",
901
"ApprovalDelay": 0,
902
"ApprovalDuration": 1000,
903
"Checker": "fping -q -- %(host)s",
904
"ExtendedTimeout": 900000,
905
"Expires": "2019-02-04T00:00:00",
906
"LastCheckerStatus": 0,
907
},
908
"barbar": {
909
"Name": "barbar",
910
"KeyID": ("0558568eedd67d622f5c83b35a115f79"
911
"6ab612cff5ad227247e46c2b020f441c"),
912
"Host": "192.0.2.3",
913
"Enabled": True,
914
"Timeout": 300000,
915
"LastCheckedOK": "2019-02-04T00:00:00",
916
"Created": "2019-01-03T00:00:00",
917
"Interval": 120000,
918
"Fingerprint": ("3E393AEAEFB84C7E89E2"
919
"F547B3A107558FCA3A27"),
920
"CheckerRunning": True,
921
"LastEnabled": "2019-01-04T00:00:00",
922
"ApprovalPending": False,
923
"ApprovedByDefault": False,
924
"LastApprovalRequest": "2019-01-03T00:00:00",
925
"ApprovalDelay": 30000,
926
"ApprovalDuration": 1000,
927
"Checker": ":",
928
"ExtendedTimeout": 900000,
929
"Expires": "2019-02-05T00:00:00",
930
"LastCheckerStatus": -2,
931
},
932
}
933
return super(TestDumpJSONCmd, self).setUp()
934
def test_normal(self):
935
json_data = json.loads(DumpJSONCmd().output(self.clients))
936
self.assertDictEqual(json_data, self.expected_json)
937
def test_one_client(self):
938
clients = {"foo": self.client}
939
json_data = json.loads(DumpJSONCmd().output(clients))
940
expected_json = {"foo": self.expected_json["foo"]}
941
self.assertDictEqual(json_data, expected_json)
942
943
class TestIsEnabledCmd(TestCmd):
944
def test_is_enabled(self):
945
self.assertTrue(all(IsEnabledCmd().is_enabled(client)
946
for client in self.clients.values()))
947
def test_is_enabled_does_get_attribute(self):
948
self.assertTrue(IsEnabledCmd().is_enabled(self.client))
949
self.assertListEqual(self.client.calls,
950
[("Get",
951
("se.recompile.Mandos.Client",
952
"Enabled",
953
"org.freedesktop.DBus.Properties"))])
954
def test_is_enabled_run_exits_successfully(self):
955
with self.assertRaises(SystemExit) as e:
956
IsEnabledCmd().run(None, [self.client])
957
if e.exception.code is not None:
958
self.assertEqual(e.exception.code, 0)
959
else:
960
self.assertIsNone(e.exception.code)
961
def test_is_enabled_run_exits_with_failure(self):
962
self.client["Enabled"] = dbus.Boolean(False)
963
with self.assertRaises(SystemExit) as e:
964
IsEnabledCmd().run(None, [self.client])
965
if isinstance(e.exception.code, int):
966
self.assertNotEqual(e.exception.code, 0)
967
else:
968
self.assertIsNotNone(e.exception.code)
969
970
971
class TestRemoveCmd(TestCmd):
972
def test_remove(self):
973
class MockMandos(object):
974
def __init__(self):
975
self.calls = []
976
def RemoveClient(self, dbus_path):
977
self.calls.append(("RemoveClient", (dbus_path,)))
978
mandos = MockMandos()
979
RemoveCmd().run(mandos, [self.client])
980
self.assertEqual(len(mandos.calls), 1)
981
self.assertListEqual(mandos.calls,
982
[("RemoveClient",
983
(self.client.__dbus_object_path__,))])
984
985
986
987
def should_only_run_tests():
988
parser = argparse.ArgumentParser(add_help=False)
989
parser.add_argument("--check", action='store_true')
990
args, unknown_args = parser.parse_known_args()
991
run_tests = args.check
992
if run_tests:
993
# Remove --check argument from sys.argv
994
sys.argv[1:] = unknown_args
995
return run_tests
996
997
# Add all tests from doctest strings
998
def load_tests(loader, tests, none):
999
import doctest
1000
tests.addTests(doctest.DocTestSuite())
1001
return tests
485
1002
486
1003
if __name__ == "__main__":
487
main()
1004
if should_only_run_tests():
1005
# Call using ./tdd-python-script --check [--verbose]
1006
unittest.main()
1007
else:
1008
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0