To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos-ctl
- browse files at revision 1020
- compare with another revision
- download diff
- download tarball
- view history from revision 1020
- Committer: Teddy Hogeborn
- Date: 2019-03-04 20:39:48 UTC
- Revision ID: teddy@recompile.se-20190304203948-x8cdobs47h1f89xk
mandos-ctl: Bug fix: fix client/properties confusion
* mandos-ctl (Command.run_on_one_client): Take an additional
"properties" argument. All
callers and users changed.
(IsEnabledCmd.is_enabled): Don't run client.Get(); just look at the
"Enabled" property key.
(TestCmd.setUp): Set self.clients to the correct form of dict, and
set self.one_client to be a dict with only one
client. Also set self.other_client to other client
object. All users of these attributes changed.
(TestCmd.setUp.MockClient.__getitem__): Removed.
(TestCmd.setUp.MockClient.__setitem__): - '' -
(TestIsEnabled.test_is_enabled_does_get_attribute): Removed.
(TestIsEnabled.test_is_enabled_run_exits_with_failure): Don't use []
to alter client attribute; modify client.attributes dict directly.
(TestRemoveCmd.test_remove): Run on full client list.
(TestApproveCmd.test_approve): - '' -
(TestDenyCmd.test_approve): - '' - and rename to "test_deny".
* mandos-ctl (Command.run_on_one_client): Take an additional
"properties" argument. All
callers and users changed.
(IsEnabledCmd.is_enabled): Don't run client.Get(); just look at the
"Enabled" property key.
(TestCmd.setUp): Set self.clients to the correct form of dict, and
set self.one_client to be a dict with only one
client. Also set self.other_client to other client
object. All users of these attributes changed.
(TestCmd.setUp.MockClient.__getitem__): Removed.
(TestCmd.setUp.MockClient.__setitem__): - '' -
(TestIsEnabled.test_is_enabled_does_get_attribute): Removed.
(TestIsEnabled.test_is_enabled_run_exits_with_failure): Don't use []
to alter client attribute; modify client.attributes dict directly.
(TestRemoveCmd.test_remove): Run on full client list.
(TestApproveCmd.test_approve): - '' -
(TestDenyCmd.test_approve): - '' - and rename to "test_deny".
- files added:
- debian/mandos-client.templates
- files removed:
- initramfs-tools-hook-conf
- files modified:
- DBUS-API
added
removed
mandos-ctl
1
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
#
2
# -*- mode: python; coding: utf-8; after-save-hook: (lambda () (let ((command (if (and (boundp 'tramp-file-name-structure) (string-match (car tramp-file-name-structure) (buffer-file-name))) (tramp-file-name-localname (tramp-dissect-file-name (buffer-file-name))) (buffer-file-name)))) (if (= (shell-command (format "%s --check" (shell-quote-argument command)) "*Test*") 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)) (kill-buffer "*Test*")) (display-buffer "*Test*")))); -*-
3
#
4
4
# Mandos Monitor - Control and monitor the Mandos server
5
#
6
# Copyright © 2008-2016 Teddy Hogeborn
7
# Copyright © 2008-2016 Björn Påhlsson
8
#
9
# This program is free software: you can redistribute it and/or modify
10
# it under the terms of the GNU General Public License as published by
5
#
6
# Copyright © 2008-2019 Teddy Hogeborn
7
# Copyright © 2008-2019 Björn Påhlsson
8
#
9
# This file is part of Mandos.
10
#
11
# Mandos is free software: you can redistribute it and/or modify it
12
# under the terms of the GNU General Public License as published by
11
13
# the Free Software Foundation, either version 3 of the License, or
12
14
# (at your option) any later version.
13
15
#
14
# This program is distributed in the hope that it will be useful,
15
# but WITHOUT ANY WARRANTY; without even the implied warranty of
16
# Mandos is distributed in the hope that it will be useful, but
17
# WITHOUT ANY WARRANTY; without even the implied warranty of
16
18
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17
19
# GNU General Public License for more details.
18
#
20
#
19
21
# You should have received a copy of the GNU General Public License
20
# along with this program. If not, see
21
# <http://www.gnu.org/licenses/>.
22
#
22
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
23
#
23
24
# Contact the authors at <mandos@recompile.se>.
24
#
25
#
25
26
26
27
from __future__ import (division, absolute_import, print_function,
27
28
unicode_literals)
38
39
import re
39
40
import os
40
41
import collections
41
import doctest
42
42
import json
43
import unittest
44
import logging
43
45
44
46
import dbus
45
47
48
# Show warnings by default
49
if not sys.warnoptions:
50
import warnings
51
warnings.simplefilter("default")
52
53
log = logging.getLogger(sys.argv[0])
54
logging.basicConfig(level="INFO", # Show info level messages
55
format="%(message)s") # Show basic log messages
56
57
logging.captureWarnings(True) # Show warnings via the logging system
58
46
59
if sys.version_info.major == 2:
47
60
str = unicode
48
61
49
62
locale.setlocale(locale.LC_ALL, "")
50
63
51
tablewords = {
52
"Name": "Name",
53
"Enabled": "Enabled",
54
"Timeout": "Timeout",
55
"LastCheckedOK": "Last Successful Check",
56
"LastApprovalRequest": "Last Approval Request",
57
"Created": "Created",
58
"Interval": "Interval",
59
"Host": "Host",
60
"Fingerprint": "Fingerprint",
61
"CheckerRunning": "Check Is Running",
62
"LastEnabled": "Last Enabled",
63
"ApprovalPending": "Approval Is Pending",
64
"ApprovedByDefault": "Approved By Default",
65
"ApprovalDelay": "Approval Delay",
66
"ApprovalDuration": "Approval Duration",
67
"Checker": "Checker",
68
"ExtendedTimeout": "Extended Timeout",
69
"Expires": "Expires",
70
"LastCheckerStatus": "Last Checker Status",
71
}
72
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
73
64
domain = "se.recompile"
74
65
busname = domain + ".Mandos"
75
66
server_path = "/"
76
67
server_interface = domain + ".Mandos"
77
68
client_interface = domain + ".Mandos.Client"
78
version = "1.7.10"
69
version = "1.8.3"
79
70
80
71
81
72
try:
83
74
except AttributeError:
84
75
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
85
76
77
86
78
def milliseconds_to_string(ms):
87
79
td = datetime.timedelta(0, 0, 0, ms)
88
return ("{days}{hours:02}:{minutes:02}:{seconds:02}".format(
89
days = "{}T".format(td.days) if td.days else "",
90
hours = td.seconds // 3600,
91
minutes = (td.seconds % 3600) // 60,
92
seconds = td.seconds % 60))
80
return ("{days}{hours:02}:{minutes:02}:{seconds:02}"
81
.format(days="{}T".format(td.days) if td.days else "",
82
hours=td.seconds // 3600,
83
minutes=(td.seconds % 3600) // 60,
84
seconds=td.seconds % 60))
93
85
94
86
95
87
def rfc3339_duration_to_delta(duration):
96
88
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
97
89
98
90
>>> rfc3339_duration_to_delta("P7D")
99
91
datetime.timedelta(7)
100
92
>>> rfc3339_duration_to_delta("PT60S")
101
93
datetime.timedelta(0, 60)
102
94
>>> rfc3339_duration_to_delta("PT60M")
103
95
datetime.timedelta(0, 3600)
96
>>> rfc3339_duration_to_delta("P60M")
97
datetime.timedelta(1680)
104
98
>>> rfc3339_duration_to_delta("PT24H")
105
99
datetime.timedelta(1)
106
100
>>> rfc3339_duration_to_delta("P1W")
109
103
datetime.timedelta(0, 330)
110
104
>>> rfc3339_duration_to_delta("P1DT3M20S")
111
105
datetime.timedelta(1, 200)
106
>>> # Can not be empty:
107
>>> rfc3339_duration_to_delta("")
108
Traceback (most recent call last):
109
...
110
ValueError: Invalid RFC 3339 duration: u''
111
>>> # Must start with "P":
112
>>> rfc3339_duration_to_delta("1D")
113
Traceback (most recent call last):
114
...
115
ValueError: Invalid RFC 3339 duration: u'1D'
116
>>> # Must use correct order
117
>>> rfc3339_duration_to_delta("PT1S2M")
118
Traceback (most recent call last):
119
...
120
ValueError: Invalid RFC 3339 duration: u'PT1S2M'
121
>>> # Time needs time marker
122
>>> rfc3339_duration_to_delta("P1H2S")
123
Traceback (most recent call last):
124
...
125
ValueError: Invalid RFC 3339 duration: u'P1H2S'
126
>>> # Weeks can not be combined with anything else
127
>>> rfc3339_duration_to_delta("P1D2W")
128
Traceback (most recent call last):
129
...
130
ValueError: Invalid RFC 3339 duration: u'P1D2W'
131
>>> rfc3339_duration_to_delta("P2W2H")
132
Traceback (most recent call last):
133
...
134
ValueError: Invalid RFC 3339 duration: u'P2W2H'
112
135
"""
113
136
114
137
# Parsing an RFC 3339 duration with regular expressions is not
115
138
# possible - there would have to be multiple places for the same
116
139
# values, like seconds. The current code, while more esoteric, is
117
140
# cleaner without depending on a parsing library. If Python had a
118
141
# built-in library for parsing we would use it, but we'd like to
119
142
# avoid excessive use of external libraries.
120
143
121
144
# New type for defining tokens, syntax, and semantics all-in-one
122
145
Token = collections.namedtuple("Token", (
123
146
"regexp", # To match token; if "value" is not None, must have
156
179
frozenset((token_year, token_month,
157
180
token_day, token_time,
158
181
token_week)))
159
# Define starting values
160
value = datetime.timedelta() # Value so far
182
# Define starting values:
183
# Value so far
184
value = datetime.timedelta()
161
185
found_token = None
162
followers = frozenset((token_duration, )) # Following valid tokens
163
s = duration # String left to parse
186
# Following valid tokens
187
followers = frozenset((token_duration, ))
188
# String left to parse
189
s = duration
164
190
# Loop until end token is found
165
191
while found_token is not token_end:
166
192
# Search for any currently valid tokens
189
215
190
216
191
217
def string_to_delta(interval):
192
"""Parse a string and return a datetime.timedelta
193
194
>>> string_to_delta('7d')
195
datetime.timedelta(7)
196
>>> string_to_delta('60s')
197
datetime.timedelta(0, 60)
198
>>> string_to_delta('60m')
199
datetime.timedelta(0, 3600)
200
>>> string_to_delta('24h')
201
datetime.timedelta(1)
202
>>> string_to_delta('1w')
203
datetime.timedelta(7)
204
>>> string_to_delta('5m 30s')
205
datetime.timedelta(0, 330)
206
"""
207
218
"""Parse a string and return a datetime.timedelta"""
219
208
220
try:
209
221
return rfc3339_duration_to_delta(interval)
210
except ValueError:
211
pass
212
222
except ValueError as e:
223
log.warning("%s - Parsing as pre-1.6.1 interval instead",
224
' '.join(e.args))
225
return parse_pre_1_6_1_interval(interval)
226
227
228
def parse_pre_1_6_1_interval(interval):
229
"""Parse an interval string as documented by Mandos before 1.6.1,
230
and return a datetime.timedelta
231
232
>>> parse_pre_1_6_1_interval('7d')
233
datetime.timedelta(7)
234
>>> parse_pre_1_6_1_interval('60s')
235
datetime.timedelta(0, 60)
236
>>> parse_pre_1_6_1_interval('60m')
237
datetime.timedelta(0, 3600)
238
>>> parse_pre_1_6_1_interval('24h')
239
datetime.timedelta(1)
240
>>> parse_pre_1_6_1_interval('1w')
241
datetime.timedelta(7)
242
>>> parse_pre_1_6_1_interval('5m 30s')
243
datetime.timedelta(0, 330)
244
>>> parse_pre_1_6_1_interval('')
245
datetime.timedelta(0)
246
>>> # Ignore unknown characters, allow any order and repetitions
247
>>> parse_pre_1_6_1_interval('2dxy7zz11y3m5m')
248
datetime.timedelta(2, 480, 18000)
249
250
"""
251
213
252
value = datetime.timedelta(0)
214
253
regexp = re.compile(r"(\d+)([dsmhw]?)")
215
254
216
255
for num, suffix in regexp.findall(interval):
217
256
if suffix == "d":
218
257
value += datetime.timedelta(int(num))
229
268
return value
230
269
231
270
232
def print_clients(clients, keywords):
233
def valuetostring(value, keyword):
234
if type(value) is dbus.Boolean:
235
return "Yes" if value else "No"
236
if keyword in ("Timeout", "Interval", "ApprovalDelay",
237
"ApprovalDuration", "ExtendedTimeout"):
238
return milliseconds_to_string(value)
239
return str(value)
240
241
# Create format string to print table rows
242
format_string = " ".join("{{{key}:{width}}}".format(
243
width = max(len(tablewords[key]),
244
max(len(valuetostring(client[key], key))
245
for client in clients)),
246
key = key)
247
for key in keywords)
248
# Print header line
249
print(format_string.format(**tablewords))
250
for client in clients:
251
print(format_string.format(**{
252
key: valuetostring(client[key], key)
253
for key in keywords }))
254
271
## Classes for commands.
272
273
# Abstract classes first
274
class Command(object):
275
"""Abstract class for commands"""
276
def run(self, mandos, clients):
277
"""Normal commands should implement run_on_one_client(), but
278
commands which want to operate on all clients at the same time
279
can override this run() method instead."""
280
self.mandos = mandos
281
for client, properties in clients.items():
282
self.run_on_one_client(client, properties)
283
284
class PrintCmd(Command):
285
"""Abstract class for commands printing client details"""
286
all_keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
287
"Created", "Interval", "Host", "KeyID",
288
"Fingerprint", "CheckerRunning", "LastEnabled",
289
"ApprovalPending", "ApprovedByDefault",
290
"LastApprovalRequest", "ApprovalDelay",
291
"ApprovalDuration", "Checker", "ExtendedTimeout",
292
"Expires", "LastCheckerStatus")
293
def run(self, mandos, clients):
294
print(self.output(clients))
295
296
class PropertyCmd(Command):
297
"""Abstract class for Actions for setting one client property"""
298
def run_on_one_client(self, client, properties):
299
"""Set the Client's D-Bus property"""
300
client.Set(client_interface, self.property, self.value_to_set,
301
dbus_interface=dbus.PROPERTIES_IFACE)
302
303
class ValueArgumentMixIn(object):
304
"""Mixin class for commands taking a value as argument"""
305
def __init__(self, value):
306
self.value_to_set = value
307
308
class MillisecondsValueArgumentMixIn(ValueArgumentMixIn):
309
"""Mixin class for commands taking a value argument as
310
milliseconds."""
311
@property
312
def value_to_set(self):
313
return self._vts
314
@value_to_set.setter
315
def value_to_set(self, value):
316
"""When setting, convert value to a datetime.timedelta"""
317
self._vts = string_to_delta(value).total_seconds() * 1000
318
319
# Actual (non-abstract) command classes
320
321
class PrintTableCmd(PrintCmd):
322
def __init__(self, verbose=False):
323
self.verbose = verbose
324
325
def output(self, clients):
326
if self.verbose:
327
keywords = self.all_keywords
328
else:
329
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
330
return str(self.TableOfClients(clients.values(), keywords))
331
332
class TableOfClients(object):
333
tableheaders = {
334
"Name": "Name",
335
"Enabled": "Enabled",
336
"Timeout": "Timeout",
337
"LastCheckedOK": "Last Successful Check",
338
"LastApprovalRequest": "Last Approval Request",
339
"Created": "Created",
340
"Interval": "Interval",
341
"Host": "Host",
342
"Fingerprint": "Fingerprint",
343
"KeyID": "Key ID",
344
"CheckerRunning": "Check Is Running",
345
"LastEnabled": "Last Enabled",
346
"ApprovalPending": "Approval Is Pending",
347
"ApprovedByDefault": "Approved By Default",
348
"ApprovalDelay": "Approval Delay",
349
"ApprovalDuration": "Approval Duration",
350
"Checker": "Checker",
351
"ExtendedTimeout": "Extended Timeout",
352
"Expires": "Expires",
353
"LastCheckerStatus": "Last Checker Status",
354
}
355
356
def __init__(self, clients, keywords, tableheaders=None):
357
self.clients = clients
358
self.keywords = keywords
359
if tableheaders is not None:
360
self.tableheaders = tableheaders
361
362
def __str__(self):
363
return "\n".join(self.rows())
364
365
if sys.version_info.major == 2:
366
__unicode__ = __str__
367
def __str__(self):
368
return str(self).encode(locale.getpreferredencoding())
369
370
def rows(self):
371
format_string = self.row_formatting_string()
372
rows = [self.header_line(format_string)]
373
rows.extend(self.client_line(client, format_string)
374
for client in self.clients)
375
return rows
376
377
def row_formatting_string(self):
378
"Format string used to format table rows"
379
return " ".join("{{{key}:{width}}}".format(
380
width=max(len(self.tableheaders[key]),
381
*(len(self.string_from_client(client, key))
382
for client in self.clients)),
383
key=key)
384
for key in self.keywords)
385
386
def string_from_client(self, client, key):
387
return self.valuetostring(client[key], key)
388
389
@staticmethod
390
def valuetostring(value, keyword):
391
if isinstance(value, dbus.Boolean):
392
return "Yes" if value else "No"
393
if keyword in ("Timeout", "Interval", "ApprovalDelay",
394
"ApprovalDuration", "ExtendedTimeout"):
395
return milliseconds_to_string(value)
396
return str(value)
397
398
def header_line(self, format_string):
399
return format_string.format(**self.tableheaders)
400
401
def client_line(self, client, format_string):
402
return format_string.format(
403
**{key: self.string_from_client(client, key)
404
for key in self.keywords})
405
406
407
408
class DumpJSONCmd(PrintCmd):
409
def output(self, clients):
410
data = {client["Name"]:
411
{key: self.dbus_boolean_to_bool(client[key])
412
for key in self.all_keywords}
413
for client in clients.values()}
414
return json.dumps(data, indent=4, separators=(',', ': '))
415
@staticmethod
416
def dbus_boolean_to_bool(value):
417
if isinstance(value, dbus.Boolean):
418
value = bool(value)
419
return value
420
421
class IsEnabledCmd(Command):
422
def run_on_one_client(self, client, properties):
423
if self.is_enabled(client, properties):
424
sys.exit(0)
425
sys.exit(1)
426
def is_enabled(self, client, properties):
427
return bool(properties["Enabled"])
428
429
class RemoveCmd(Command):
430
def run_on_one_client(self, client, properties):
431
self.mandos.RemoveClient(client.__dbus_object_path__)
432
433
class ApproveCmd(Command):
434
def run_on_one_client(self, client, properties):
435
client.Approve(dbus.Boolean(True),
436
dbus_interface=client_interface)
437
438
class DenyCmd(Command):
439
def run_on_one_client(self, client, properties):
440
client.Approve(dbus.Boolean(False),
441
dbus_interface=client_interface)
442
443
class EnableCmd(PropertyCmd):
444
property = "Enabled"
445
value_to_set = dbus.Boolean(True)
446
447
class DisableCmd(PropertyCmd):
448
property = "Enabled"
449
value_to_set = dbus.Boolean(False)
450
451
class BumpTimeoutCmd(PropertyCmd):
452
property = "LastCheckedOK"
453
value_to_set = ""
454
455
class StartCheckerCmd(PropertyCmd):
456
property = "CheckerRunning"
457
value_to_set = dbus.Boolean(True)
458
459
class StopCheckerCmd(PropertyCmd):
460
property = "CheckerRunning"
461
value_to_set = dbus.Boolean(False)
462
463
class ApproveByDefaultCmd(PropertyCmd):
464
property = "ApprovedByDefault"
465
value_to_set = dbus.Boolean(True)
466
467
class DenyByDefaultCmd(PropertyCmd):
468
property = "ApprovedByDefault"
469
value_to_set = dbus.Boolean(False)
470
471
class SetCheckerCmd(PropertyCmd, ValueArgumentMixIn):
472
property = "Checker"
473
474
class SetHostCmd(PropertyCmd, ValueArgumentMixIn):
475
property = "Host"
476
477
class SetSecretCmd(PropertyCmd, ValueArgumentMixIn):
478
property = "Secret"
479
480
class SetTimeoutCmd(PropertyCmd, MillisecondsValueArgumentMixIn):
481
property = "Timeout"
482
483
class SetExtendedTimeoutCmd(PropertyCmd,
484
MillisecondsValueArgumentMixIn):
485
property = "ExtendedTimeout"
486
487
class SetIntervalCmd(PropertyCmd, MillisecondsValueArgumentMixIn):
488
property = "Interval"
489
490
class SetApprovalDelayCmd(PropertyCmd,
491
MillisecondsValueArgumentMixIn):
492
property = "ApprovalDelay"
493
494
class SetApprovalDurationCmd(PropertyCmd,
495
MillisecondsValueArgumentMixIn):
496
property = "ApprovalDuration"
255
497
256
498
def has_actions(options):
257
499
return any((options.enable,
273
515
options.approve,
274
516
options.deny))
275
517
276
277
def main():
278
parser = argparse.ArgumentParser()
518
def add_command_line_options(parser):
279
519
parser.add_argument("--version", action="version",
280
version = "%(prog)s {}".format(version),
520
version="%(prog)s {}".format(version),
281
521
help="show version number and exit")
282
522
parser.add_argument("-a", "--all", action="store_true",
283
523
help="Select all clients")
285
525
help="Print all fields")
286
526
parser.add_argument("-j", "--dump-json", action="store_true",
287
527
help="Dump client data in JSON format")
288
parser.add_argument("-e", "--enable", action="store_true",
289
help="Enable client")
290
parser.add_argument("-d", "--disable", action="store_true",
291
help="disable client")
528
enable_disable = parser.add_mutually_exclusive_group()
529
enable_disable.add_argument("-e", "--enable", action="store_true",
530
help="Enable client")
531
enable_disable.add_argument("-d", "--disable",
532
action="store_true",
533
help="disable client")
292
534
parser.add_argument("-b", "--bump-timeout", action="store_true",
293
535
help="Bump timeout for client")
294
parser.add_argument("--start-checker", action="store_true",
295
help="Start checker for client")
296
parser.add_argument("--stop-checker", action="store_true",
297
help="Stop checker for client")
536
start_stop_checker = parser.add_mutually_exclusive_group()
537
start_stop_checker.add_argument("--start-checker",
538
action="store_true",
539
help="Start checker for client")
540
start_stop_checker.add_argument("--stop-checker",
541
action="store_true",
542
help="Stop checker for client")
298
543
parser.add_argument("-V", "--is-enabled", action="store_true",
299
544
help="Check if client is enabled")
300
545
parser.add_argument("-r", "--remove", action="store_true",
307
552
help="Set extended timeout for client")
308
553
parser.add_argument("-i", "--interval",
309
554
help="Set checker interval for client")
310
parser.add_argument("--approve-by-default", action="store_true",
311
default=None, dest="approved_by_default",
312
help="Set client to be approved by default")
313
parser.add_argument("--deny-by-default", action="store_false",
314
dest="approved_by_default",
315
help="Set client to be denied by default")
555
approve_deny_default = parser.add_mutually_exclusive_group()
556
approve_deny_default.add_argument(
557
"--approve-by-default", action="store_true",
558
default=None, dest="approved_by_default",
559
help="Set client to be approved by default")
560
approve_deny_default.add_argument(
561
"--deny-by-default", action="store_false",
562
dest="approved_by_default",
563
help="Set client to be denied by default")
316
564
parser.add_argument("--approval-delay",
317
565
help="Set delay before client approve/deny")
318
566
parser.add_argument("--approval-duration",
321
569
parser.add_argument("-s", "--secret",
322
570
type=argparse.FileType(mode="rb"),
323
571
help="Set password blob (file) for client")
324
parser.add_argument("-A", "--approve", action="store_true",
325
help="Approve any current client request")
326
parser.add_argument("-D", "--deny", action="store_true",
327
help="Deny any current client request")
572
approve_deny = parser.add_mutually_exclusive_group()
573
approve_deny.add_argument(
574
"-A", "--approve", action="store_true",
575
help="Approve any current client request")
576
approve_deny.add_argument("-D", "--deny", action="store_true",
577
help="Deny any current client request")
328
578
parser.add_argument("--check", action="store_true",
329
579
help="Run self-test")
330
580
parser.add_argument("client", nargs="*", help="Client name")
581
582
583
def commands_and_clients_from_options(options):
584
585
commands = []
586
587
if options.dump_json:
588
commands.append(DumpJSONCmd())
589
590
if options.enable:
591
commands.append(EnableCmd())
592
593
if options.disable:
594
commands.append(DisableCmd())
595
596
if options.bump_timeout:
597
commands.append(BumpTimeoutCmd(options.bump_timeout))
598
599
if options.start_checker:
600
commands.append(StartCheckerCmd())
601
602
if options.stop_checker:
603
commands.append(StopCheckerCmd())
604
605
if options.is_enabled:
606
commands.append(IsEnabledCmd())
607
608
if options.remove:
609
commands.append(RemoveCmd())
610
611
if options.checker is not None:
612
commands.append(SetCheckerCmd())
613
614
if options.timeout is not None:
615
commands.append(SetTimeoutCmd(options.timeout))
616
617
if options.extended_timeout:
618
commands.append(
619
SetExtendedTimeoutCmd(options.extended_timeout))
620
621
if options.interval is not None:
622
command.append(SetIntervalCmd(options.interval))
623
624
if options.approved_by_default is not None:
625
if options.approved_by_default:
626
command.append(ApproveByDefaultCmd())
627
else:
628
command.append(DenyByDefaultCmd())
629
630
if options.approval_delay is not None:
631
command.append(SetApprovalDelayCmd(options.approval_delay))
632
633
if options.approval_duration is not None:
634
command.append(
635
SetApprovalDurationCmd(options.approval_duration))
636
637
if options.host is not None:
638
command.append(SetHostCmd(options.host))
639
640
if options.secret is not None:
641
command.append(SetSecretCmd(options.secret))
642
643
if options.approve:
644
commands.append(ApproveCmd())
645
646
if options.deny:
647
commands.append(DenyCmd())
648
649
# If no command option has been given, show table of clients,
650
# optionally verbosely
651
if not commands:
652
commands.append(PrintTableCmd(verbose=options.verbose))
653
654
return commands, options.client
655
656
657
def main():
658
parser = argparse.ArgumentParser()
659
660
add_command_line_options(parser)
661
331
662
options = parser.parse_args()
332
663
333
664
if has_actions(options) and not (options.client or options.all):
334
665
parser.error("Options require clients names or --all.")
335
666
if options.verbose and has_actions(options):
336
667
parser.error("--verbose can only be used alone.")
337
if options.dump_json and (options.verbose or has_actions(options)):
668
if options.dump_json and (options.verbose
669
or has_actions(options)):
338
670
parser.error("--dump-json can only be used alone.")
339
671
if options.all and not has_actions(options):
340
672
parser.error("--all requires an action.")
341
342
if options.check:
343
fail_count, test_count = doctest.testmod()
344
sys.exit(os.EX_OK if fail_count == 0 else 1)
345
673
if options.is_enabled and len(options.client) > 1:
674
parser.error("--is-enabled requires exactly one client")
675
676
commands, clientnames = commands_and_clients_from_options(options)
677
346
678
try:
347
679
bus = dbus.SystemBus()
348
680
mandos_dbus_objc = bus.get_object(busname, server_path)
349
681
except dbus.exceptions.DBusException:
350
print("Could not connect to Mandos server", file=sys.stderr)
682
log.critical("Could not connect to Mandos server")
351
683
sys.exit(1)
352
684
353
685
mandos_serv = dbus.Interface(mandos_dbus_objc,
354
dbus_interface = server_interface)
686
dbus_interface=server_interface)
355
687
mandos_serv_object_manager = dbus.Interface(
356
mandos_dbus_objc, dbus_interface = dbus.OBJECT_MANAGER_IFACE)
357
358
#block stderr since dbus library prints to stderr
359
null = os.open(os.path.devnull, os.O_RDWR)
360
stderrcopy = os.dup(sys.stderr.fileno())
361
os.dup2(null, sys.stderr.fileno())
362
os.close(null)
688
mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)
689
690
# Filter out log message from dbus module
691
dbus_logger = logging.getLogger("dbus.proxies")
692
class NullFilter(logging.Filter):
693
def filter(self, record):
694
return False
695
dbus_filter = NullFilter()
363
696
try:
364
try:
365
mandos_clients = { path: ifs_and_props[client_interface]
366
for path, ifs_and_props in
367
mandos_serv_object_manager
368
.GetManagedObjects().items()
369
if client_interface in ifs_and_props }
370
finally:
371
#restore stderr
372
os.dup2(stderrcopy, sys.stderr.fileno())
373
os.close(stderrcopy)
697
dbus_logger.addFilter(dbus_filter)
698
mandos_clients = {path: ifs_and_props[client_interface]
699
for path, ifs_and_props in
700
mandos_serv_object_manager
701
.GetManagedObjects().items()
702
if client_interface in ifs_and_props}
374
703
except dbus.exceptions.DBusException as e:
375
print("Access denied: Accessing mandos server through D-Bus: {}"
376
.format(e), file=sys.stderr)
704
log.critical("Failed to access Mandos server through D-Bus:"
705
"\n%s", e)
377
706
sys.exit(1)
378
707
finally:
708
# restore dbus logger
709
dbus_logger.removeFilter(dbus_filter)
710
379
711
# Compile dict of (clients: properties) to process
380
clients={}
381
382
if options.all or not options.client:
383
clients = { bus.get_object(busname, path): properties
384
for path, properties in mandos_clients.items() }
712
clients = {}
713
714
if not clientnames:
715
clients = {bus.get_object(busname, path): properties
716
for path, properties in mandos_clients.items()}
385
717
else:
386
for name in options.client:
718
for name in clientnames:
387
719
for path, client in mandos_clients.items():
388
720
if client["Name"] == name:
389
721
client_objc = bus.get_object(busname, path)
390
722
clients[client_objc] = client
391
723
break
392
724
else:
393
print("Client not found on server: {!r}"
394
.format(name), file=sys.stderr)
725
log.critical("Client not found on server: %r", name)
395
726
sys.exit(1)
396
397
if not has_actions(options) and clients:
398
if options.verbose or options.dump_json:
399
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
400
"Created", "Interval", "Host", "Fingerprint",
401
"CheckerRunning", "LastEnabled",
402
"ApprovalPending", "ApprovedByDefault",
403
"LastApprovalRequest", "ApprovalDelay",
404
"ApprovalDuration", "Checker",
405
"ExtendedTimeout", "Expires",
406
"LastCheckerStatus")
407
else:
408
keywords = defaultkeywords
409
410
if options.dump_json:
411
json.dump({client["Name"]: {key:
412
bool(client[key])
413
if isinstance(client[key],
414
dbus.Boolean)
415
else client[key]
416
for key in keywords }
417
for client in clients.values() },
418
fp = sys.stdout, indent = 4,
419
separators = (',', ': '))
420
print()
421
else:
422
print_clients(clients.values(), keywords)
423
else:
424
# Process each client in the list by all selected options
425
for client in clients:
426
427
def set_client_prop(prop, value):
428
"""Set a Client D-Bus property"""
429
client.Set(client_interface, prop, value,
430
dbus_interface=dbus.PROPERTIES_IFACE)
431
432
def set_client_prop_ms(prop, value):
433
"""Set a Client D-Bus property, converted
434
from a string to milliseconds."""
435
set_client_prop(prop,
436
string_to_delta(value).total_seconds()
437
* 1000)
438
439
if options.remove:
440
mandos_serv.RemoveClient(client.__dbus_object_path__)
441
if options.enable:
442
set_client_prop("Enabled", dbus.Boolean(True))
443
if options.disable:
444
set_client_prop("Enabled", dbus.Boolean(False))
445
if options.bump_timeout:
446
set_client_prop("LastCheckedOK", "")
447
if options.start_checker:
448
set_client_prop("CheckerRunning", dbus.Boolean(True))
449
if options.stop_checker:
450
set_client_prop("CheckerRunning", dbus.Boolean(False))
451
if options.is_enabled:
452
sys.exit(0 if client.Get(client_interface,
453
"Enabled",
454
dbus_interface=
455
dbus.PROPERTIES_IFACE)
456
else 1)
457
if options.checker is not None:
458
set_client_prop("Checker", options.checker)
459
if options.host is not None:
460
set_client_prop("Host", options.host)
461
if options.interval is not None:
462
set_client_prop_ms("Interval", options.interval)
463
if options.approval_delay is not None:
464
set_client_prop_ms("ApprovalDelay",
465
options.approval_delay)
466
if options.approval_duration is not None:
467
set_client_prop_ms("ApprovalDuration",
468
options.approval_duration)
469
if options.timeout is not None:
470
set_client_prop_ms("Timeout", options.timeout)
471
if options.extended_timeout is not None:
472
set_client_prop_ms("ExtendedTimeout",
473
options.extended_timeout)
474
if options.secret is not None:
475
set_client_prop("Secret",
476
dbus.ByteArray(options.secret.read()))
477
if options.approved_by_default is not None:
478
set_client_prop("ApprovedByDefault",
479
dbus.Boolean(options
480
.approved_by_default))
481
if options.approve:
482
client.Approve(dbus.Boolean(True),
483
dbus_interface=client_interface)
484
elif options.deny:
485
client.Approve(dbus.Boolean(False),
486
dbus_interface=client_interface)
487
727
728
# Run all commands on clients
729
for command in commands:
730
command.run(mandos_serv, clients)
731
732
733
class Test_milliseconds_to_string(unittest.TestCase):
734
def test_all(self):
735
self.assertEqual(milliseconds_to_string(93785000),
736
"1T02:03:05")
737
def test_no_days(self):
738
self.assertEqual(milliseconds_to_string(7385000), "02:03:05")
739
def test_all_zero(self):
740
self.assertEqual(milliseconds_to_string(0), "00:00:00")
741
def test_no_fractional_seconds(self):
742
self.assertEqual(milliseconds_to_string(400), "00:00:00")
743
self.assertEqual(milliseconds_to_string(900), "00:00:00")
744
self.assertEqual(milliseconds_to_string(1900), "00:00:01")
745
746
class Test_string_to_delta(unittest.TestCase):
747
def test_handles_basic_rfc3339(self):
748
self.assertEqual(string_to_delta("PT2H"),
749
datetime.timedelta(0, 7200))
750
def test_falls_back_to_pre_1_6_1_with_warning(self):
751
# assertLogs only exists in Python 3.4
752
if hasattr(self, "assertLogs"):
753
with self.assertLogs(log, logging.WARNING):
754
value = string_to_delta("2h")
755
else:
756
class WarningFilter(logging.Filter):
757
"""Don't show, but record the presence of, warnings"""
758
def filter(self, record):
759
is_warning = record.levelno >= logging.WARNING
760
self.found = is_warning or getattr(self, "found",
761
False)
762
return not is_warning
763
warning_filter = WarningFilter()
764
log.addFilter(warning_filter)
765
try:
766
value = string_to_delta("2h")
767
finally:
768
log.removeFilter(warning_filter)
769
self.assertTrue(getattr(warning_filter, "found", False))
770
self.assertEqual(value, datetime.timedelta(0, 7200))
771
772
773
class TestCmd(unittest.TestCase):
774
"""Abstract class for tests of command classes"""
775
def setUp(self):
776
testcase = self
777
class MockClient(object):
778
def __init__(self, name, **attributes):
779
self.__dbus_object_path__ = "objpath_{}".format(name)
780
self.attributes = attributes
781
self.attributes["Name"] = name
782
self.calls = []
783
def Set(self, interface, property, value, dbus_interface):
784
testcase.assertEqual(interface, client_interface)
785
testcase.assertEqual(dbus_interface,
786
dbus.PROPERTIES_IFACE)
787
self.attributes[property] = value
788
self.calls.append(("Set", (interface, property, value,
789
dbus_interface)))
790
def Get(self, interface, property, dbus_interface):
791
testcase.assertEqual(interface, client_interface)
792
testcase.assertEqual(dbus_interface,
793
dbus.PROPERTIES_IFACE)
794
self.calls.append(("Get", (interface, property,
795
dbus_interface)))
796
return self.attributes[property]
797
def Approve(self, approve, dbus_interface):
798
testcase.assertEqual(dbus_interface, client_interface)
799
self.calls.append(("Approve", (approve,
800
dbus_interface)))
801
self.client = MockClient(
802
"foo",
803
KeyID=("92ed150794387c03ce684574b1139a65"
804
"94a34f895daaaf09fd8ea90a27cddb12"),
805
Secret=b"secret",
806
Host="foo.example.org",
807
Enabled=dbus.Boolean(True),
808
Timeout=300000,
809
LastCheckedOK="2019-02-03T00:00:00",
810
Created="2019-01-02T00:00:00",
811
Interval=120000,
812
Fingerprint=("778827225BA7DE539C5A"
813
"7CFA59CFF7CDBD9A5920"),
814
CheckerRunning=dbus.Boolean(False),
815
LastEnabled="2019-01-03T00:00:00",
816
ApprovalPending=dbus.Boolean(False),
817
ApprovedByDefault=dbus.Boolean(True),
818
LastApprovalRequest="",
819
ApprovalDelay=0,
820
ApprovalDuration=1000,
821
Checker="fping -q -- %(host)s",
822
ExtendedTimeout=900000,
823
Expires="2019-02-04T00:00:00",
824
LastCheckerStatus=0)
825
self.other_client = MockClient(
826
"barbar",
827
KeyID=("0558568eedd67d622f5c83b35a115f79"
828
"6ab612cff5ad227247e46c2b020f441c"),
829
Secret=b"secretbar",
830
Host="192.0.2.3",
831
Enabled=dbus.Boolean(True),
832
Timeout=300000,
833
LastCheckedOK="2019-02-04T00:00:00",
834
Created="2019-01-03T00:00:00",
835
Interval=120000,
836
Fingerprint=("3E393AEAEFB84C7E89E2"
837
"F547B3A107558FCA3A27"),
838
CheckerRunning=dbus.Boolean(True),
839
LastEnabled="2019-01-04T00:00:00",
840
ApprovalPending=dbus.Boolean(False),
841
ApprovedByDefault=dbus.Boolean(False),
842
LastApprovalRequest="2019-01-03T00:00:00",
843
ApprovalDelay=30000,
844
ApprovalDuration=1000,
845
Checker=":",
846
ExtendedTimeout=900000,
847
Expires="2019-02-05T00:00:00",
848
LastCheckerStatus=-2)
849
self.clients = collections.OrderedDict(
850
[
851
(self.client, self.client.attributes),
852
(self.other_client, self.other_client.attributes),
853
])
854
self.one_client = {self.client: self.client.attributes}
855
856
class TestPrintTableCmd(TestCmd):
857
def test_normal(self):
858
output = PrintTableCmd().output(self.clients)
859
expected_output = """
860
Name Enabled Timeout Last Successful Check
861
foo Yes 00:05:00 2019-02-03T00:00:00
862
barbar Yes 00:05:00 2019-02-04T00:00:00
863
"""[1:-1]
864
self.assertEqual(output, expected_output)
865
def test_verbose(self):
866
output = PrintTableCmd(verbose=True).output(self.clients)
867
expected_output = """
868
Name Enabled Timeout Last Successful Check Created Interval Host Key ID Fingerprint Check Is Running Last Enabled Approval Is Pending Approved By Default Last Approval Request Approval Delay Approval Duration Checker Extended Timeout Expires Last Checker Status
869
foo Yes 00:05:00 2019-02-03T00:00:00 2019-01-02T00:00:00 00:02:00 foo.example.org 92ed150794387c03ce684574b1139a6594a34f895daaaf09fd8ea90a27cddb12 778827225BA7DE539C5A7CFA59CFF7CDBD9A5920 No 2019-01-03T00:00:00 No Yes 00:00:00 00:00:01 fping -q -- %(host)s 00:15:00 2019-02-04T00:00:00 0
870
barbar Yes 00:05:00 2019-02-04T00:00:00 2019-01-03T00:00:00 00:02:00 192.0.2.3 0558568eedd67d622f5c83b35a115f796ab612cff5ad227247e46c2b020f441c 3E393AEAEFB84C7E89E2F547B3A107558FCA3A27 Yes 2019-01-04T00:00:00 No No 2019-01-03T00:00:00 00:00:30 00:00:01 : 00:15:00 2019-02-05T00:00:00 -2
871
"""[1:-1]
872
self.assertEqual(output, expected_output)
873
def test_one_client(self):
874
output = PrintTableCmd().output(self.one_client)
875
expected_output = """
876
Name Enabled Timeout Last Successful Check
877
foo Yes 00:05:00 2019-02-03T00:00:00
878
"""[1:-1]
879
self.assertEqual(output, expected_output)
880
881
class TestDumpJSONCmd(TestCmd):
882
def setUp(self):
883
self.expected_json = {
884
"foo": {
885
"Name": "foo",
886
"KeyID": ("92ed150794387c03ce684574b1139a65"
887
"94a34f895daaaf09fd8ea90a27cddb12"),
888
"Host": "foo.example.org",
889
"Enabled": True,
890
"Timeout": 300000,
891
"LastCheckedOK": "2019-02-03T00:00:00",
892
"Created": "2019-01-02T00:00:00",
893
"Interval": 120000,
894
"Fingerprint": ("778827225BA7DE539C5A"
895
"7CFA59CFF7CDBD9A5920"),
896
"CheckerRunning": False,
897
"LastEnabled": "2019-01-03T00:00:00",
898
"ApprovalPending": False,
899
"ApprovedByDefault": True,
900
"LastApprovalRequest": "",
901
"ApprovalDelay": 0,
902
"ApprovalDuration": 1000,
903
"Checker": "fping -q -- %(host)s",
904
"ExtendedTimeout": 900000,
905
"Expires": "2019-02-04T00:00:00",
906
"LastCheckerStatus": 0,
907
},
908
"barbar": {
909
"Name": "barbar",
910
"KeyID": ("0558568eedd67d622f5c83b35a115f79"
911
"6ab612cff5ad227247e46c2b020f441c"),
912
"Host": "192.0.2.3",
913
"Enabled": True,
914
"Timeout": 300000,
915
"LastCheckedOK": "2019-02-04T00:00:00",
916
"Created": "2019-01-03T00:00:00",
917
"Interval": 120000,
918
"Fingerprint": ("3E393AEAEFB84C7E89E2"
919
"F547B3A107558FCA3A27"),
920
"CheckerRunning": True,
921
"LastEnabled": "2019-01-04T00:00:00",
922
"ApprovalPending": False,
923
"ApprovedByDefault": False,
924
"LastApprovalRequest": "2019-01-03T00:00:00",
925
"ApprovalDelay": 30000,
926
"ApprovalDuration": 1000,
927
"Checker": ":",
928
"ExtendedTimeout": 900000,
929
"Expires": "2019-02-05T00:00:00",
930
"LastCheckerStatus": -2,
931
},
932
}
933
return super(TestDumpJSONCmd, self).setUp()
934
def test_normal(self):
935
json_data = json.loads(DumpJSONCmd().output(self.clients))
936
self.assertDictEqual(json_data, self.expected_json)
937
def test_one_client(self):
938
clients = self.one_client
939
json_data = json.loads(DumpJSONCmd().output(clients))
940
expected_json = {"foo": self.expected_json["foo"]}
941
self.assertDictEqual(json_data, expected_json)
942
943
class TestIsEnabledCmd(TestCmd):
944
def test_is_enabled(self):
945
self.assertTrue(all(IsEnabledCmd().is_enabled(client, properties)
946
for client, properties in self.clients.items()))
947
def test_is_enabled_run_exits_successfully(self):
948
with self.assertRaises(SystemExit) as e:
949
IsEnabledCmd().run(None, self.one_client)
950
if e.exception.code is not None:
951
self.assertEqual(e.exception.code, 0)
952
else:
953
self.assertIsNone(e.exception.code)
954
def test_is_enabled_run_exits_with_failure(self):
955
self.client.attributes["Enabled"] = dbus.Boolean(False)
956
with self.assertRaises(SystemExit) as e:
957
IsEnabledCmd().run(None, self.one_client)
958
if isinstance(e.exception.code, int):
959
self.assertNotEqual(e.exception.code, 0)
960
else:
961
self.assertIsNotNone(e.exception.code)
962
963
class TestRemoveCmd(TestCmd):
964
def test_remove(self):
965
class MockMandos(object):
966
def __init__(self):
967
self.calls = []
968
def RemoveClient(self, dbus_path):
969
self.calls.append(("RemoveClient", (dbus_path,)))
970
mandos = MockMandos()
971
super(TestRemoveCmd, self).setUp()
972
RemoveCmd().run(mandos, self.clients)
973
self.assertEqual(len(mandos.calls), 2)
974
for client in self.clients:
975
self.assertIn(("RemoveClient",
976
(client.__dbus_object_path__,)),
977
mandos.calls)
978
979
class TestApproveCmd(TestCmd):
980
def test_approve(self):
981
ApproveCmd().run(None, self.clients)
982
for client in self.clients:
983
self.assertIn(("Approve", (True, client_interface)),
984
client.calls)
985
986
class TestDenyCmd(TestCmd):
987
def test_deny(self):
988
DenyCmd().run(None, self.clients)
989
for client in self.clients:
990
self.assertIn(("Approve", (False, client_interface)),
991
client.calls)
992
993
994
995
def should_only_run_tests():
996
parser = argparse.ArgumentParser(add_help=False)
997
parser.add_argument("--check", action='store_true')
998
args, unknown_args = parser.parse_known_args()
999
run_tests = args.check
1000
if run_tests:
1001
# Remove --check argument from sys.argv
1002
sys.argv[1:] = unknown_args
1003
return run_tests
1004
1005
# Add all tests from doctest strings
1006
def load_tests(loader, tests, none):
1007
import doctest
1008
tests.addTests(doctest.DocTestSuite())
1009
return tests
488
1010
489
1011
if __name__ == "__main__":
490
main()
1012
if should_only_run_tests():
1013
# Call using ./tdd-python-script --check [--verbose]
1014
unittest.main()
1015
else:
1016
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0