/mandos/trunk : revision 247

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8; after-save-hook: (lambda () (let ((command (if (and (boundp 'tramp-file-name-structure) (string-match (car tramp-file-name-structure) (buffer-file-name))) (tramp-file-name-localname (tramp-dissect-file-name (buffer-file-name))) (buffer-file-name)))) (if (= (shell-command (format "%s --check" (shell-quote-argument command)) "*Test*") 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)) (kill-buffer "*Test*")) (display-buffer "*Test*")))); -*-

3

#

4

# Mandos Monitor - Control and monitor the Mandos server

5

#

6

7

8

#

9

# This file is part of Mandos.

10

#

11

# Mandos is free software: you can redistribute it and/or modify it

12

# under the terms of the GNU General Public License as published by

13

# the Free Software Foundation, either version 3 of the License, or

14

# (at your option) any later version.

15

#

16

# Mandos is distributed in the hope that it will be useful, but

17

# WITHOUT ANY WARRANTY; without even the implied warranty of

18

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

19

# GNU General Public License for more details.

20

#

21

# You should have received a copy of the GNU General Public License

22

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

23

#

24

# Contact the authors at <mandos@recompile.se>.

25

#

26

27

from __future__ import (division, absolute_import, print_function,

28

unicode_literals)

29

30

try:

31

from future_builtins import *

32

except ImportError:

33

pass

34

35

import sys

36

import argparse

2

# -*- mode: python; coding: utf-8 -*-

3

4

import dbus

5

from optparse import OptionParser

37

6

import locale

38

import datetime

39

import re

40

import os

41

import collections

42

import json

43

import unittest

44

import logging

45

import io

46

import tempfile

47

import contextlib

48

49

import dbus

50

51

# Show warnings by default

52

if not sys.warnoptions:

53

import warnings

54

warnings.simplefilter("default")

55

56

log = logging.getLogger(sys.argv[0])

57

logging.basicConfig(level="INFO", # Show info level messages

58

format="%(message)s") # Show basic log messages

59

60

logging.captureWarnings(True) # Show warnings via the logging system

61

62

if sys.version_info.major == 2:

63

str = unicode

64

65

locale.setlocale(locale.LC_ALL, "")

66

67

dbus_busname_domain = "se.recompile"

68

dbus_busname = dbus_busname_domain + ".Mandos"

69

server_dbus_path = "/"

70

server_dbus_interface = dbus_busname_domain + ".Mandos"

71

client_dbus_interface = dbus_busname_domain + ".Mandos.Client"

72

del dbus_busname_domain

73

version = "1.8.3"

74

75

76

try:

77

dbus.OBJECT_MANAGER_IFACE

78

except AttributeError:

79

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

80

81

82

def main():

83

parser = argparse.ArgumentParser()

84

85

add_command_line_options(parser)

86

87

options = parser.parse_args()

88

89

check_option_syntax(parser, options)

90

91

clientnames = options.client

92

93

if options.debug:

94

log.setLevel(logging.DEBUG)

95

96

bus = dbus.SystemBus()

97

98

mandos_dbus_object = get_mandos_dbus_object(bus)

99

100

mandos_serv = dbus.Interface(

101

mandos_dbus_object, dbus_interface=server_dbus_interface)

102

mandos_serv_object_manager = dbus.Interface(

103

mandos_dbus_object, dbus_interface=dbus.OBJECT_MANAGER_IFACE)

104

105

managed_objects = get_managed_objects(mandos_serv_object_manager)

106

107

all_clients = {}

108

for path, ifs_and_props in managed_objects.items():

109

try:

110

all_clients[path] = ifs_and_props[client_dbus_interface]

111

except KeyError:

112

pass

113

114

# Compile dict of (clientpath: properties) to process

115

if not clientnames:

116

clients = all_clients

7

8

locale.setlocale(locale.LC_ALL, u'')

9

10

tablewords = {

11

'name': u'Name',

12

'enabled': u'Enabled',

13

'timeout': u'Timeout',

14

'last_checked_ok': u'Last Successful Check',

15

'created': u'Created',

16

'interval': u'Interval',

17

'host': u'Host',

18

'fingerprint': u'Fingerprint',

19

'checker_running': u'Check Is Running',

20

'last_enabled': u'Last Enabled',

21

'checker': u'Checker',

22

}

23

busname = 'org.mandos-system.Mandos'

24

object_path = '/Mandos'

25

interface = 'org.mandos_system.Mandos'

26

version = "1.0.2"

27

defaultkeywords = ('name', 'enabled', 'timeout', 'last_checked_ok',

28

'checker')

29

30

parser = OptionParser(version = "%%prog %s" % version)

31

parser.add_option("-a", "--all", action="store_true", default=False,

32

help="Print all fields")

33

options = parser.parse_args()[0]

34

if options.all:

35

keywords = ('name', 'enabled', 'timeout', 'last_checked_ok',

36

'created', 'interval', 'host', 'fingerprint',

37

'checker_running', 'last_enabled', 'checker')

38

else:

39

keywords = defaultkeywords

40

41

42

bus = dbus.SystemBus()

43

mandos_dbus_objc = bus.get_object(busname, object_path)

44

mandos_serv = dbus.Interface(mandos_dbus_objc,

45

dbus_interface = interface)

46

mandos_clients = mandos_serv.GetAllClientsWithProperties()

47

48

def valuetostring(x):

49

if type(x) is dbus.Boolean:

50

return u"Yes" if x else u"No"

117

51

else:

118

clients = {}

119

for name in clientnames:

120

for objpath, properties in all_clients.items():

121

if properties["Name"] == name:

122

clients[objpath] = properties

123

break

124

else:

125

log.critical("Client not found on server: %r", name)

126

sys.exit(1)

127

128

# Run all commands on clients

129

commands = commands_from_options(options)

130

for command in commands:

131

command.run(clients, bus, mandos_serv)

132

133

134

def add_command_line_options(parser):

135

parser.add_argument("--version", action="version",

136

version="%(prog)s {}".format(version),

137

help="show version number and exit")

138

parser.add_argument("-a", "--all", action="store_true",

139

help="Select all clients")

140

parser.add_argument("-v", "--verbose", action="store_true",

141

help="Print all fields")

142

parser.add_argument("-j", "--dump-json", action="store_true",

143

help="Dump client data in JSON format")

144

enable_disable = parser.add_mutually_exclusive_group()

145

enable_disable.add_argument("-e", "--enable", action="store_true",

146

help="Enable client")

147

enable_disable.add_argument("-d", "--disable",

148

action="store_true",

149

help="disable client")

150

parser.add_argument("-b", "--bump-timeout", action="store_true",

151

help="Bump timeout for client")

152

start_stop_checker = parser.add_mutually_exclusive_group()

153

start_stop_checker.add_argument("--start-checker",

154

action="store_true",

155

help="Start checker for client")

156

start_stop_checker.add_argument("--stop-checker",

157

action="store_true",

158

help="Stop checker for client")

159

parser.add_argument("-V", "--is-enabled", action="store_true",

160

help="Check if client is enabled")

161

parser.add_argument("-r", "--remove", action="store_true",

162

help="Remove client")

163

parser.add_argument("-c", "--checker",

164

help="Set checker command for client")

165

parser.add_argument("-t", "--timeout", type=string_to_delta,

166

help="Set timeout for client")

167

parser.add_argument("--extended-timeout", type=string_to_delta,

168

help="Set extended timeout for client")

169

parser.add_argument("-i", "--interval", type=string_to_delta,

170

help="Set checker interval for client")

171

approve_deny_default = parser.add_mutually_exclusive_group()

172

approve_deny_default.add_argument(

173

"--approve-by-default", action="store_true",

174

default=None, dest="approved_by_default",

175

help="Set client to be approved by default")

176

approve_deny_default.add_argument(

177

"--deny-by-default", action="store_false",

178

dest="approved_by_default",

179

help="Set client to be denied by default")

180

parser.add_argument("--approval-delay", type=string_to_delta,

181

help="Set delay before client approve/deny")

182

parser.add_argument("--approval-duration", type=string_to_delta,

183

help="Set duration of one client approval")

184

parser.add_argument("-H", "--host", help="Set host for client")

185

parser.add_argument("-s", "--secret",

186

type=argparse.FileType(mode="rb"),

187

help="Set password blob (file) for client")

188

approve_deny = parser.add_mutually_exclusive_group()

189

approve_deny.add_argument(

190

"-A", "--approve", action="store_true",

191

help="Approve any current client request")

192

approve_deny.add_argument("-D", "--deny", action="store_true",

193

help="Deny any current client request")

194

parser.add_argument("--debug", action="store_true",

195

help="Debug mode (show D-Bus commands)")

196

parser.add_argument("--check", action="store_true",

197

help="Run self-test")

198

parser.add_argument("client", nargs="*", help="Client name")

199

200

201

def string_to_delta(interval):

202

"""Parse a string and return a datetime.timedelta"""

203

204

try:

205

return rfc3339_duration_to_delta(interval)

206

except ValueError as e:

207

log.warning("%s - Parsing as pre-1.6.1 interval instead",

208

' '.join(e.args))

209

return parse_pre_1_6_1_interval(interval)

210

211

212

def rfc3339_duration_to_delta(duration):

213

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

214

215

>>> rfc3339_duration_to_delta("P7D")

216

datetime.timedelta(7)

217

>>> rfc3339_duration_to_delta("PT60S")

218

datetime.timedelta(0, 60)

219

>>> rfc3339_duration_to_delta("PT60M")

220

datetime.timedelta(0, 3600)

221

>>> rfc3339_duration_to_delta("P60M")

222

datetime.timedelta(1680)

223

>>> rfc3339_duration_to_delta("PT24H")

224

datetime.timedelta(1)

225

>>> rfc3339_duration_to_delta("P1W")

226

datetime.timedelta(7)

227

>>> rfc3339_duration_to_delta("PT5M30S")

228

datetime.timedelta(0, 330)

229

>>> rfc3339_duration_to_delta("P1DT3M20S")

230

datetime.timedelta(1, 200)

231

>>> # Can not be empty:

232

>>> rfc3339_duration_to_delta("")

233

Traceback (most recent call last):

234

...

235

ValueError: Invalid RFC 3339 duration: u''

236

>>> # Must start with "P":

237

>>> rfc3339_duration_to_delta("1D")

238

Traceback (most recent call last):

239

...

240

ValueError: Invalid RFC 3339 duration: u'1D'

241

>>> # Must use correct order

242

>>> rfc3339_duration_to_delta("PT1S2M")

243

Traceback (most recent call last):

244

...

245

ValueError: Invalid RFC 3339 duration: u'PT1S2M'

246

>>> # Time needs time marker

247

>>> rfc3339_duration_to_delta("P1H2S")

248

Traceback (most recent call last):

249

...

250

ValueError: Invalid RFC 3339 duration: u'P1H2S'

251

>>> # Weeks can not be combined with anything else

252

>>> rfc3339_duration_to_delta("P1D2W")

253

Traceback (most recent call last):

254

...

255

ValueError: Invalid RFC 3339 duration: u'P1D2W'

256

>>> rfc3339_duration_to_delta("P2W2H")

257

Traceback (most recent call last):

258

...

259

ValueError: Invalid RFC 3339 duration: u'P2W2H'

260

"""

261

262

# Parsing an RFC 3339 duration with regular expressions is not

263

# possible - there would have to be multiple places for the same

264

# values, like seconds. The current code, while more esoteric, is

265

# cleaner without depending on a parsing library. If Python had a

266

# built-in library for parsing we would use it, but we'd like to

267

# avoid excessive use of external libraries.

268

269

# New type for defining tokens, syntax, and semantics all-in-one

270

Token = collections.namedtuple("Token", (

271

"regexp", # To match token; if "value" is not None, must have

272

# a "group" containing digits

273

"value", # datetime.timedelta or None

274

"followers")) # Tokens valid after this token

275

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

276

# the "duration" ABNF definition in RFC 3339, Appendix A.

277

token_end = Token(re.compile(r"$"), None, frozenset())

278

token_second = Token(re.compile(r"(\d+)S"),

279

datetime.timedelta(seconds=1),

280

frozenset((token_end, )))

281

token_minute = Token(re.compile(r"(\d+)M"),

282

datetime.timedelta(minutes=1),

283

frozenset((token_second, token_end)))

284

token_hour = Token(re.compile(r"(\d+)H"),

285

datetime.timedelta(hours=1),

286

frozenset((token_minute, token_end)))

287

token_time = Token(re.compile(r"T"),

288

None,

289

frozenset((token_hour, token_minute,

290

token_second)))

291

token_day = Token(re.compile(r"(\d+)D"),

292

datetime.timedelta(days=1),

293

frozenset((token_time, token_end)))

294

token_month = Token(re.compile(r"(\d+)M"),

295

datetime.timedelta(weeks=4),

296

frozenset((token_day, token_end)))

297

token_year = Token(re.compile(r"(\d+)Y"),

298

datetime.timedelta(weeks=52),

299

frozenset((token_month, token_end)))

300

token_week = Token(re.compile(r"(\d+)W"),

301

datetime.timedelta(weeks=1),

302

frozenset((token_end, )))

303

token_duration = Token(re.compile(r"P"), None,

304

frozenset((token_year, token_month,

305

token_day, token_time,

306

token_week)))

307

# Define starting values:

308

# Value so far

309

value = datetime.timedelta()

310

found_token = None

311

# Following valid tokens

312

followers = frozenset((token_duration, ))

313

# String left to parse

314

s = duration

315

# Loop until end token is found

316

while found_token is not token_end:

317

# Search for any currently valid tokens

318

for token in followers:

319

match = token.regexp.match(s)

320

if match is not None:

321

# Token found

322

if token.value is not None:

323

# Value found, parse digits

324

factor = int(match.group(1), 10)

325

# Add to value so far

326

value += factor * token.value

327

# Strip token from string

328

s = token.regexp.sub("", s, 1)

329

# Go to found token

330

found_token = token

331

# Set valid next tokens

332

followers = found_token.followers

333

break

334

else:

335

# No currently valid tokens were found

336

raise ValueError("Invalid RFC 3339 duration: {!r}"

337

.format(duration))

338

# End token found

339

return value

340

341

342

def parse_pre_1_6_1_interval(interval):

343

"""Parse an interval string as documented by Mandos before 1.6.1,

344

and return a datetime.timedelta

345

346

>>> parse_pre_1_6_1_interval('7d')

347

datetime.timedelta(7)

348

>>> parse_pre_1_6_1_interval('60s')

349

datetime.timedelta(0, 60)

350

>>> parse_pre_1_6_1_interval('60m')

351

datetime.timedelta(0, 3600)

352

>>> parse_pre_1_6_1_interval('24h')

353

datetime.timedelta(1)

354

>>> parse_pre_1_6_1_interval('1w')

355

datetime.timedelta(7)

356

>>> parse_pre_1_6_1_interval('5m 30s')

357

datetime.timedelta(0, 330)

358

>>> parse_pre_1_6_1_interval('')

359

datetime.timedelta(0)

360

>>> # Ignore unknown characters, allow any order and repetitions

361

>>> parse_pre_1_6_1_interval('2dxy7zz11y3m5m')

362

datetime.timedelta(2, 480, 18000)

363

364

"""

365

366

value = datetime.timedelta(0)

367

regexp = re.compile(r"(\d+)([dsmhw]?)")

368

369

for num, suffix in regexp.findall(interval):

370

if suffix == "d":

371

value += datetime.timedelta(int(num))

372

elif suffix == "s":

373

value += datetime.timedelta(0, int(num))

374

elif suffix == "m":

375

value += datetime.timedelta(0, 0, 0, 0, int(num))

376

elif suffix == "h":

377

value += datetime.timedelta(0, 0, 0, 0, 0, int(num))

378

elif suffix == "w":

379

value += datetime.timedelta(0, 0, 0, 0, 0, 0, int(num))

380

elif suffix == "":

381

value += datetime.timedelta(0, 0, 0, int(num))

382

return value

383

384

385

def check_option_syntax(parser, options):

386

"""Apply additional restrictions on options, not expressible in

387

argparse"""

388

389

def has_actions(options):

390

return any((options.enable,

391

options.disable,

392

options.bump_timeout,

393

options.start_checker,

394

options.stop_checker,

395

options.is_enabled,

396

options.remove,

397

options.checker is not None,

398

options.timeout is not None,

399

options.extended_timeout is not None,

400

options.interval is not None,

401

options.approved_by_default is not None,

402

options.approval_delay is not None,

403

options.approval_duration is not None,

404

options.host is not None,

405

options.secret is not None,

406

options.approve,

407

options.deny))

408

409

if has_actions(options) and not (options.client or options.all):

410

parser.error("Options require clients names or --all.")

411

if options.verbose and has_actions(options):

412

parser.error("--verbose can only be used alone.")

413

if options.dump_json and (options.verbose

414

or has_actions(options)):

415

parser.error("--dump-json can only be used alone.")

416

if options.all and not has_actions(options):

417

parser.error("--all requires an action.")

418

if options.is_enabled and len(options.client) > 1:

419

parser.error("--is-enabled requires exactly one client")

420

if options.remove:

421

options.remove = False

422

if has_actions(options) and not options.deny:

423

parser.error("--remove can only be combined with --deny")

424

options.remove = True

425

426

427

def get_mandos_dbus_object(bus):

428

log.debug("D-Bus: Connect to: (busname=%r, path=%r)",

429

dbus_busname, server_dbus_path)

430

with if_dbus_exception_log_with_exception_and_exit(

431

"Could not connect to Mandos server: %s"):

432

mandos_dbus_object = bus.get_object(dbus_busname,

433

server_dbus_path)

434

return mandos_dbus_object

435

436

437

@contextlib.contextmanager

438

def if_dbus_exception_log_with_exception_and_exit(*args, **kwargs):

439

try:

440

yield

441

except dbus.exceptions.DBusException as e:

442

log.critical(*(args + (e,)), **kwargs)

443

sys.exit(1)

444

445

446

def get_managed_objects(object_manager):

447

log.debug("D-Bus: %s:%s:%s.GetManagedObjects()", dbus_busname,

448

server_dbus_path, dbus.OBJECT_MANAGER_IFACE)

449

with if_dbus_exception_log_with_exception_and_exit(

450

"Failed to access Mandos server through D-Bus:\n%s"):

451

with SilenceLogger("dbus.proxies"):

452

managed_objects = object_manager.GetManagedObjects()

453

return managed_objects

454

455

456

class SilenceLogger(object):

457

"Simple context manager to silence a particular logger"

458

def __init__(self, loggername):

459

self.logger = logging.getLogger(loggername)

460

461

def __enter__(self):

462

self.logger.addFilter(self.nullfilter)

463

return self

464

465

class NullFilter(logging.Filter):

466

def filter(self, record):

467

return False

468

469

nullfilter = NullFilter()

470

471

def __exit__(self, exc_type, exc_val, exc_tb):

472

self.logger.removeFilter(self.nullfilter)

473

474

475

def commands_from_options(options):

476

477

commands = []

478

479

if options.is_enabled:

480

commands.append(IsEnabledCmd())

481

482

if options.approve:

483

commands.append(ApproveCmd())

484

485

if options.deny:

486

commands.append(DenyCmd())

487

488

if options.remove:

489

commands.append(RemoveCmd())

490

491

if options.dump_json:

492

commands.append(DumpJSONCmd())

493

494

if options.enable:

495

commands.append(EnableCmd())

496

497

if options.disable:

498

commands.append(DisableCmd())

499

500

if options.bump_timeout:

501

commands.append(BumpTimeoutCmd())

502

503

if options.start_checker:

504

commands.append(StartCheckerCmd())

505

506

if options.stop_checker:

507

commands.append(StopCheckerCmd())

508

509

if options.approved_by_default is not None:

510

if options.approved_by_default:

511

commands.append(ApproveByDefaultCmd())

512

else:

513

commands.append(DenyByDefaultCmd())

514

515

if options.checker is not None:

516

commands.append(SetCheckerCmd(options.checker))

517

518

if options.host is not None:

519

commands.append(SetHostCmd(options.host))

520

521

if options.secret is not None:

522

commands.append(SetSecretCmd(options.secret))

523

524

if options.timeout is not None:

525

commands.append(SetTimeoutCmd(options.timeout))

526

527

if options.extended_timeout:

528

commands.append(

529

SetExtendedTimeoutCmd(options.extended_timeout))

530

531

if options.interval is not None:

532

commands.append(SetIntervalCmd(options.interval))

533

534

if options.approval_delay is not None:

535

commands.append(SetApprovalDelayCmd(options.approval_delay))

536

537

if options.approval_duration is not None:

538

commands.append(

539

SetApprovalDurationCmd(options.approval_duration))

540

541

# If no command option has been given, show table of clients,

542

# optionally verbosely

543

if not commands:

544

commands.append(PrintTableCmd(verbose=options.verbose))

545

546

return commands

547

548

549

class Command(object):

550

"""Abstract class for commands"""

551

def run(self, clients, bus=None, mandos=None):

552

"""Normal commands should implement run_on_one_client(), but

553

commands which want to operate on all clients at the same time

554

can override this run() method instead."""

555

self.mandos = mandos

556

for clientpath, properties in clients.items():

557

log.debug("D-Bus: Connect to: (busname=%r, path=%r)",

558

dbus_busname, str(clientpath))

559

client = bus.get_object(dbus_busname, clientpath)

560

self.run_on_one_client(client, properties)

561

562

563

class IsEnabledCmd(Command):

564

def run(self, clients, bus=None, mandos=None):

565

client, properties = next(iter(clients.items()))

566

if self.is_enabled(client, properties):

567

sys.exit(0)

568

sys.exit(1)

569

def is_enabled(self, client, properties):

570

return properties["Enabled"]

571

572

573

class ApproveCmd(Command):

574

def run_on_one_client(self, client, properties):

575

log.debug("D-Bus: %s:%s:%s.Approve(True)", dbus_busname,

576

client.__dbus_object_path__, client_dbus_interface)

577

client.Approve(dbus.Boolean(True),

578

dbus_interface=client_dbus_interface)

579

580

581

class DenyCmd(Command):

582

def run_on_one_client(self, client, properties):

583

log.debug("D-Bus: %s:%s:%s.Approve(False)", dbus_busname,

584

client.__dbus_object_path__, client_dbus_interface)

585

client.Approve(dbus.Boolean(False),

586

dbus_interface=client_dbus_interface)

587

588

589

class RemoveCmd(Command):

590

def run_on_one_client(self, client, properties):

591

log.debug("D-Bus: %s:%s:%s.RemoveClient(%r)", dbus_busname,

592

server_dbus_path, server_dbus_interface,

593

str(client.__dbus_object_path__))

594

self.mandos.RemoveClient(client.__dbus_object_path__)

595

596

597

class OutputCmd(Command):

598

"""Abstract class for commands outputting client details"""

599

all_keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",

600

"Created", "Interval", "Host", "KeyID",

601

"Fingerprint", "CheckerRunning", "LastEnabled",

602

"ApprovalPending", "ApprovedByDefault",

603

"LastApprovalRequest", "ApprovalDelay",

604

"ApprovalDuration", "Checker", "ExtendedTimeout",

605

"Expires", "LastCheckerStatus")

606

607

def run(self, clients, bus=None, mandos=None):

608

print(self.output(clients.values()))

609

610

def output(self, clients):

611

raise NotImplementedError()

612

613

614

class DumpJSONCmd(OutputCmd):

615

def output(self, clients):

616

data = {client["Name"]:

617

{key: self.dbus_boolean_to_bool(client[key])

618

for key in self.all_keywords}

619

for client in clients}

620

return json.dumps(data, indent=4, separators=(',', ': '))

621

622

@staticmethod

623

def dbus_boolean_to_bool(value):

624

if isinstance(value, dbus.Boolean):

625

value = bool(value)

626

return value

627

628

629

class PrintTableCmd(OutputCmd):

630

def __init__(self, verbose=False):

631

self.verbose = verbose

632

633

def output(self, clients):

634

default_keywords = ("Name", "Enabled", "Timeout",

635

"LastCheckedOK")

636

keywords = default_keywords

637

if self.verbose:

638

keywords = self.all_keywords

639

return str(self.TableOfClients(clients, keywords))

640

641

class TableOfClients(object):

642

tableheaders = {

643

"Name": "Name",

644

"Enabled": "Enabled",

645

"Timeout": "Timeout",

646

"LastCheckedOK": "Last Successful Check",

647

"LastApprovalRequest": "Last Approval Request",

648

"Created": "Created",

649

"Interval": "Interval",

650

"Host": "Host",

651

"Fingerprint": "Fingerprint",

652

"KeyID": "Key ID",

653

"CheckerRunning": "Check Is Running",

654

"LastEnabled": "Last Enabled",

655

"ApprovalPending": "Approval Is Pending",

656

"ApprovedByDefault": "Approved By Default",

657

"ApprovalDelay": "Approval Delay",

658

"ApprovalDuration": "Approval Duration",

659

"Checker": "Checker",

660

"ExtendedTimeout": "Extended Timeout",

661

"Expires": "Expires",

662

"LastCheckerStatus": "Last Checker Status",

663

}

664

665

def __init__(self, clients, keywords):

666

self.clients = clients

667

self.keywords = keywords

668

669

def __str__(self):

670

return "\n".join(self.rows())

671

672

if sys.version_info.major == 2:

673

__unicode__ = __str__

674

def __str__(self):

675

return str(self).encode(locale.getpreferredencoding())

676

677

def rows(self):

678

format_string = self.row_formatting_string()

679

rows = [self.header_line(format_string)]

680

rows.extend(self.client_line(client, format_string)

681

for client in self.clients)

682

return rows

683

684

def row_formatting_string(self):

685

"Format string used to format table rows"

686

return " ".join("{{{key}:{width}}}".format(

687

width=max(len(self.tableheaders[key]),

688

*(len(self.string_from_client(client, key))

689

for client in self.clients)),

690

key=key)

691

for key in self.keywords)

692

693

def string_from_client(self, client, key):

694

return self.valuetostring(client[key], key)

695

696

@classmethod

697

def valuetostring(cls, value, keyword):

698

if isinstance(value, dbus.Boolean):

699

return "Yes" if value else "No"

700

if keyword in ("Timeout", "Interval", "ApprovalDelay",

701

"ApprovalDuration", "ExtendedTimeout"):

702

return cls.milliseconds_to_string(value)

703

return str(value)

704

705

def header_line(self, format_string):

706

return format_string.format(**self.tableheaders)

707

708

def client_line(self, client, format_string):

709

return format_string.format(

710

**{key: self.string_from_client(client, key)

711

for key in self.keywords})

712

713

@staticmethod

714

def milliseconds_to_string(ms):

715

td = datetime.timedelta(0, 0, 0, ms)

716

return ("{days}{hours:02}:{minutes:02}:{seconds:02}"

717

.format(days="{}T".format(td.days)

718

if td.days else "",

719

hours=td.seconds // 3600,

720

minutes=(td.seconds % 3600) // 60,

721

seconds=td.seconds % 60))

722

723

724

class PropertyCmd(Command):

725

"""Abstract class for Actions for setting one client property"""

726

727

def run_on_one_client(self, client, properties):

728

"""Set the Client's D-Bus property"""

729

log.debug("D-Bus: %s:%s:%s.Set(%r, %r, %r)", dbus_busname,

730

client.__dbus_object_path__,

731

dbus.PROPERTIES_IFACE, client_dbus_interface,

732

self.propname, self.value_to_set

733

if not isinstance(self.value_to_set, dbus.Boolean)

734

else bool(self.value_to_set))

735

client.Set(client_dbus_interface, self.propname,

736

self.value_to_set,

737

dbus_interface=dbus.PROPERTIES_IFACE)

738

739

@property

740

def propname(self):

741

raise NotImplementedError()

742

743

744

class EnableCmd(PropertyCmd):

745

propname = "Enabled"

746

value_to_set = dbus.Boolean(True)

747

748

749

class DisableCmd(PropertyCmd):

750

propname = "Enabled"

751

value_to_set = dbus.Boolean(False)

752

753

754

class BumpTimeoutCmd(PropertyCmd):

755

propname = "LastCheckedOK"

756

value_to_set = ""

757

758

759

class StartCheckerCmd(PropertyCmd):

760

propname = "CheckerRunning"

761

value_to_set = dbus.Boolean(True)

762

763

764

class StopCheckerCmd(PropertyCmd):

765

propname = "CheckerRunning"

766

value_to_set = dbus.Boolean(False)

767

768

769

class ApproveByDefaultCmd(PropertyCmd):

770

propname = "ApprovedByDefault"

771

value_to_set = dbus.Boolean(True)

772

773

774

class DenyByDefaultCmd(PropertyCmd):

775

propname = "ApprovedByDefault"

776

value_to_set = dbus.Boolean(False)

777

778

779

class PropertyValueCmd(PropertyCmd):

780

"""Abstract class for PropertyCmd recieving a value as argument"""

781

def __init__(self, value):

782

self.value_to_set = value

783

784

785

class SetCheckerCmd(PropertyValueCmd):

786

propname = "Checker"

787

788

789

class SetHostCmd(PropertyValueCmd):

790

propname = "Host"

791

792

793

class SetSecretCmd(PropertyValueCmd):

794

propname = "Secret"

795

796

@property

797

def value_to_set(self):

798

return self._vts

799

800

@value_to_set.setter

801

def value_to_set(self, value):

802

"""When setting, read data from supplied file object"""

803

self._vts = value.read()

804

value.close()

805

806

807

class MillisecondsPropertyValueArgumentCmd(PropertyValueCmd):

808

"""Abstract class for PropertyValueCmd taking a value argument as

809

a datetime.timedelta() but should store it as milliseconds."""

810

811

@property

812

def value_to_set(self):

813

return self._vts

814

815

@value_to_set.setter

816

def value_to_set(self, value):

817

"""When setting, convert value from a datetime.timedelta"""

818

self._vts = int(round(value.total_seconds() * 1000))

819

820

821

class SetTimeoutCmd(MillisecondsPropertyValueArgumentCmd):

822

propname = "Timeout"

823

824

825

class SetExtendedTimeoutCmd(MillisecondsPropertyValueArgumentCmd):

826

propname = "ExtendedTimeout"

827

828

829

class SetIntervalCmd(MillisecondsPropertyValueArgumentCmd):

830

propname = "Interval"

831

832

833

class SetApprovalDelayCmd(MillisecondsPropertyValueArgumentCmd):

834

propname = "ApprovalDelay"

835

836

837

class SetApprovalDurationCmd(MillisecondsPropertyValueArgumentCmd):

838

propname = "ApprovalDuration"

839

840

841

842

class TestCaseWithAssertLogs(unittest.TestCase):

843

"""unittest.TestCase.assertLogs only exists in Python 3.4"""

844

845

if not hasattr(unittest.TestCase, "assertLogs"):

846

@contextlib.contextmanager

847

def assertLogs(self, logger, level=logging.INFO):

848

capturing_handler = self.CapturingLevelHandler(level)

849

old_level = logger.level

850

old_propagate = logger.propagate

851

logger.addHandler(capturing_handler)

852

logger.setLevel(level)

853

logger.propagate = False

854

try:

855

yield capturing_handler.watcher

856

finally:

857

logger.propagate = old_propagate

858

logger.removeHandler(capturing_handler)

859

logger.setLevel(old_level)

860

self.assertGreater(len(capturing_handler.watcher.records),

861

0)

862

863

class CapturingLevelHandler(logging.Handler):

864

def __init__(self, level, *args, **kwargs):

865

logging.Handler.__init__(self, *args, **kwargs)

866

self.watcher = self.LoggingWatcher([], [])

867

def emit(self, record):

868

self.watcher.records.append(record)

869

self.watcher.output.append(self.format(record))

870

871

LoggingWatcher = collections.namedtuple("LoggingWatcher",

872

("records",

873

"output"))

874

875

class Test_string_to_delta(TestCaseWithAssertLogs):

876

def test_handles_basic_rfc3339(self):

877

self.assertEqual(string_to_delta("PT0S"),

878

datetime.timedelta())

879

self.assertEqual(string_to_delta("P0D"),

880

datetime.timedelta())

881

self.assertEqual(string_to_delta("PT1S"),

882

datetime.timedelta(0, 1))

883

self.assertEqual(string_to_delta("PT2H"),

884

datetime.timedelta(0, 7200))

885

886

def test_falls_back_to_pre_1_6_1_with_warning(self):

887

with self.assertLogs(log, logging.WARNING):

888

value = string_to_delta("2h")

889

self.assertEqual(value, datetime.timedelta(0, 7200))

890

891

892

class Test_check_option_syntax(unittest.TestCase):

893

def setUp(self):

894

self.parser = argparse.ArgumentParser()

895

add_command_line_options(self.parser)

896

897

def test_actions_requires_client_or_all(self):

898

for action, value in self.actions.items():

899

options = self.parser.parse_args()

900

setattr(options, action, value)

901

with self.assertParseError():

902

self.check_option_syntax(options)

903

904

# This mostly corresponds to the definition from has_actions() in

905

# check_option_syntax()

906

actions = {

907

# The actual values set here are not that important, but we do

908

# at least stick to the correct types, even though they are

909

# never used

910

"enable": True,

911

"disable": True,

912

"bump_timeout": True,

913

"start_checker": True,

914

"stop_checker": True,

915

"is_enabled": True,

916

"remove": True,

917

"checker": "x",

918

"timeout": datetime.timedelta(),

919

"extended_timeout": datetime.timedelta(),

920

"interval": datetime.timedelta(),

921

"approved_by_default": True,

922

"approval_delay": datetime.timedelta(),

923

"approval_duration": datetime.timedelta(),

924

"host": "x",

925

"secret": io.BytesIO(b"x"),

926

"approve": True,

927

"deny": True,

928

}

929

930

@contextlib.contextmanager

931

def assertParseError(self):

932

with self.assertRaises(SystemExit) as e:

933

with self.temporarily_suppress_stderr():

934

yield

935

# Exit code from argparse is guaranteed to be "2". Reference:

936

# https://docs.python.org/3/library

937

# /argparse.html#exiting-methods

938

self.assertEqual(e.exception.code, 2)

939

940

@staticmethod

941

@contextlib.contextmanager

942

def temporarily_suppress_stderr():

943

null = os.open(os.path.devnull, os.O_RDWR)

944

stderrcopy = os.dup(sys.stderr.fileno())

945

os.dup2(null, sys.stderr.fileno())

946

os.close(null)

947

try:

948

yield

949

finally:

950

# restore stderr

951

os.dup2(stderrcopy, sys.stderr.fileno())

952

os.close(stderrcopy)

953

954

def check_option_syntax(self, options):

955

check_option_syntax(self.parser, options)

956

957

def test_actions_conflicts_with_verbose(self):

958

for action, value in self.actions.items():

959

options = self.parser.parse_args()

960

setattr(options, action, value)

961

options.verbose = True

962

with self.assertParseError():

963

self.check_option_syntax(options)

964

965

def test_dump_json_conflicts_with_verbose(self):

966

options = self.parser.parse_args()

967

options.dump_json = True

968

options.verbose = True

969

with self.assertParseError():

970

self.check_option_syntax(options)

971

972

def test_dump_json_conflicts_with_action(self):

973

for action, value in self.actions.items():

974

options = self.parser.parse_args()

975

setattr(options, action, value)

976

options.dump_json = True

977

with self.assertParseError():

978

self.check_option_syntax(options)

979

980

def test_all_can_not_be_alone(self):

981

options = self.parser.parse_args()

982

options.all = True

983

with self.assertParseError():

984

self.check_option_syntax(options)

985

986

def test_all_is_ok_with_any_action(self):

987

for action, value in self.actions.items():

988

options = self.parser.parse_args()

989

setattr(options, action, value)

990

options.all = True

991

self.check_option_syntax(options)

992

993

def test_is_enabled_fails_without_client(self):

994

options = self.parser.parse_args()

995

options.is_enabled = True

996

with self.assertParseError():

997

self.check_option_syntax(options)

998

999

def test_is_enabled_works_with_one_client(self):

1000

options = self.parser.parse_args()

1001

options.is_enabled = True

1002

options.client = ["foo"]

1003

self.check_option_syntax(options)

1004

1005

def test_is_enabled_fails_with_two_clients(self):

1006

options = self.parser.parse_args()

1007

options.is_enabled = True

1008

options.client = ["foo", "barbar"]

1009

with self.assertParseError():

1010

self.check_option_syntax(options)

1011

1012

def test_remove_can_only_be_combined_with_action_deny(self):

1013

for action, value in self.actions.items():

1014

if action in {"remove", "deny"}:

1015

continue

1016

options = self.parser.parse_args()

1017

setattr(options, action, value)

1018

options.all = True

1019

options.remove = True

1020

with self.assertParseError():

1021

self.check_option_syntax(options)

1022

1023

1024

class Test_get_mandos_dbus_object(TestCaseWithAssertLogs):

1025

def test_calls_and_returns_get_object_on_bus(self):

1026

class MockBus(object):

1027

called = False

1028

def get_object(mockbus_self, busname, dbus_path):

1029

# Note that "self" is still the testcase instance,

1030

# this MockBus instance is in "mockbus_self".

1031

self.assertEqual(busname, dbus_busname)

1032

self.assertEqual(dbus_path, server_dbus_path)

1033

mockbus_self.called = True

1034

return mockbus_self

1035

1036

mockbus = get_mandos_dbus_object(bus=MockBus())

1037

self.assertIsInstance(mockbus, MockBus)

1038

self.assertTrue(mockbus.called)

1039

1040

def test_logs_and_exits_on_dbus_error(self):

1041

class MockBusFailing(object):

1042

def get_object(self, busname, dbus_path):

1043

raise dbus.exceptions.DBusException("Test")

1044

1045

with self.assertLogs(log, logging.CRITICAL):

1046

with self.assertRaises(SystemExit) as e:

1047

bus = get_mandos_dbus_object(bus=MockBusFailing())

1048

1049

if isinstance(e.exception.code, int):

1050

self.assertNotEqual(e.exception.code, 0)

1051

else:

1052

self.assertIsNotNone(e.exception.code)

1053

1054

1055

class Test_get_managed_objects(TestCaseWithAssertLogs):

1056

def test_calls_and_returns_GetManagedObjects(self):

1057

managed_objects = {"/clients/foo": { "Name": "foo"}}

1058

class MockObjectManager(object):

1059

def GetManagedObjects(self):

1060

return managed_objects

1061

retval = get_managed_objects(MockObjectManager())

1062

self.assertDictEqual(managed_objects, retval)

1063

1064

def test_logs_and_exits_on_dbus_error(self):

1065

dbus_logger = logging.getLogger("dbus.proxies")

1066

1067

class MockObjectManagerFailing(object):

1068

def GetManagedObjects(self):

1069

dbus_logger.error("Test")

1070

raise dbus.exceptions.DBusException("Test")

1071

1072

class CountingHandler(logging.Handler):

1073

count = 0

1074

def emit(self, record):

1075

self.count += 1

1076

1077

counting_handler = CountingHandler()

1078

1079

dbus_logger.addHandler(counting_handler)

1080

1081

try:

1082

with self.assertLogs(log, logging.CRITICAL) as watcher:

1083

with self.assertRaises(SystemExit) as e:

1084

get_managed_objects(MockObjectManagerFailing())

1085

finally:

1086

dbus_logger.removeFilter(counting_handler)

1087

1088

# Make sure the dbus logger was suppressed

1089

self.assertEqual(counting_handler.count, 0)

1090

1091

# Test that the dbus_logger still works

1092

with self.assertLogs(dbus_logger, logging.ERROR):

1093

dbus_logger.error("Test")

1094

1095

if isinstance(e.exception.code, int):

1096

self.assertNotEqual(e.exception.code, 0)

1097

else:

1098

self.assertIsNotNone(e.exception.code)

1099

1100

1101

class Test_commands_from_options(unittest.TestCase):

1102

def setUp(self):

1103

self.parser = argparse.ArgumentParser()

1104

add_command_line_options(self.parser)

1105

1106

def test_is_enabled(self):

1107

self.assert_command_from_args(["--is-enabled", "foo"],

1108

IsEnabledCmd)

1109

1110

def assert_command_from_args(self, args, command_cls,

1111

**cmd_attrs):

1112

"""Assert that parsing ARGS should result in an instance of

1113

COMMAND_CLS with (optionally) all supplied attributes (CMD_ATTRS)."""

1114

options = self.parser.parse_args(args)

1115

check_option_syntax(self.parser, options)

1116

commands = commands_from_options(options)

1117

self.assertEqual(len(commands), 1)

1118

command = commands[0]

1119

self.assertIsInstance(command, command_cls)

1120

for key, value in cmd_attrs.items():

1121

self.assertEqual(getattr(command, key), value)

1122

1123

def test_is_enabled_short(self):

1124

self.assert_command_from_args(["-V", "foo"], IsEnabledCmd)

1125

1126

def test_approve(self):

1127

self.assert_command_from_args(["--approve", "foo"],

1128

ApproveCmd)

1129

1130

def test_approve_short(self):

1131

self.assert_command_from_args(["-A", "foo"], ApproveCmd)

1132

1133

def test_deny(self):

1134

self.assert_command_from_args(["--deny", "foo"], DenyCmd)

1135

1136

def test_deny_short(self):

1137

self.assert_command_from_args(["-D", "foo"], DenyCmd)

1138

1139

def test_remove(self):

1140

self.assert_command_from_args(["--remove", "foo"],

1141

RemoveCmd)

1142

1143

def test_deny_before_remove(self):

1144

options = self.parser.parse_args(["--deny", "--remove",

1145

"foo"])

1146

check_option_syntax(self.parser, options)

1147

commands = commands_from_options(options)

1148

self.assertEqual(len(commands), 2)

1149

self.assertIsInstance(commands[0], DenyCmd)

1150

self.assertIsInstance(commands[1], RemoveCmd)

1151

1152

def test_deny_before_remove_reversed(self):

1153

options = self.parser.parse_args(["--remove", "--deny",

1154

"--all"])

1155

check_option_syntax(self.parser, options)

1156

commands = commands_from_options(options)

1157

self.assertEqual(len(commands), 2)

1158

self.assertIsInstance(commands[0], DenyCmd)

1159

self.assertIsInstance(commands[1], RemoveCmd)

1160

1161

def test_remove_short(self):

1162

self.assert_command_from_args(["-r", "foo"], RemoveCmd)

1163

1164

def test_dump_json(self):

1165

self.assert_command_from_args(["--dump-json"], DumpJSONCmd)

1166

1167

def test_enable(self):

1168

self.assert_command_from_args(["--enable", "foo"], EnableCmd)

1169

1170

def test_enable_short(self):

1171

self.assert_command_from_args(["-e", "foo"], EnableCmd)

1172

1173

def test_disable(self):

1174

self.assert_command_from_args(["--disable", "foo"],

1175

DisableCmd)

1176

1177

def test_disable_short(self):

1178

self.assert_command_from_args(["-d", "foo"], DisableCmd)

1179

1180

def test_bump_timeout(self):

1181

self.assert_command_from_args(["--bump-timeout", "foo"],

1182

BumpTimeoutCmd)

1183

1184

def test_bump_timeout_short(self):

1185

self.assert_command_from_args(["-b", "foo"], BumpTimeoutCmd)

1186

1187

def test_start_checker(self):

1188

self.assert_command_from_args(["--start-checker", "foo"],

1189

StartCheckerCmd)

1190

1191

def test_stop_checker(self):

1192

self.assert_command_from_args(["--stop-checker", "foo"],

1193

StopCheckerCmd)

1194

1195

def test_approve_by_default(self):

1196

self.assert_command_from_args(["--approve-by-default", "foo"],

1197

ApproveByDefaultCmd)

1198

1199

def test_deny_by_default(self):

1200

self.assert_command_from_args(["--deny-by-default", "foo"],

1201

DenyByDefaultCmd)

1202

1203

def test_checker(self):

1204

self.assert_command_from_args(["--checker", ":", "foo"],

1205

SetCheckerCmd, value_to_set=":")

1206

1207

def test_checker_empty(self):

1208

self.assert_command_from_args(["--checker", "", "foo"],

1209

SetCheckerCmd, value_to_set="")

1210

1211

def test_checker_short(self):

1212

self.assert_command_from_args(["-c", ":", "foo"],

1213

SetCheckerCmd, value_to_set=":")

1214

1215

def test_host(self):

1216

self.assert_command_from_args(["--host", "foo.example.org",

1217

"foo"], SetHostCmd,

1218

value_to_set="foo.example.org")

1219

1220

def test_host_short(self):

1221

self.assert_command_from_args(["-H", "foo.example.org",

1222

"foo"], SetHostCmd,

1223

value_to_set="foo.example.org")

1224

1225

def test_secret_devnull(self):

1226

self.assert_command_from_args(["--secret", os.path.devnull,

1227

"foo"], SetSecretCmd,

1228

value_to_set=b"")

1229

1230

def test_secret_tempfile(self):

1231

with tempfile.NamedTemporaryFile(mode="r+b") as f:

1232

value = b"secret\0xyzzy\nbar"

1233

f.write(value)

1234

f.seek(0)

1235

self.assert_command_from_args(["--secret", f.name,

1236

"foo"], SetSecretCmd,

1237

value_to_set=value)

1238

1239

def test_secret_devnull_short(self):

1240

self.assert_command_from_args(["-s", os.path.devnull, "foo"],

1241

SetSecretCmd, value_to_set=b"")

1242

1243

def test_secret_tempfile_short(self):

1244

with tempfile.NamedTemporaryFile(mode="r+b") as f:

1245

value = b"secret\0xyzzy\nbar"

1246

f.write(value)

1247

f.seek(0)

1248

self.assert_command_from_args(["-s", f.name, "foo"],

1249

SetSecretCmd,

1250

value_to_set=value)

1251

1252

def test_timeout(self):

1253

self.assert_command_from_args(["--timeout", "PT5M", "foo"],

1254

SetTimeoutCmd,

1255

value_to_set=300000)

1256

1257

def test_timeout_short(self):

1258

self.assert_command_from_args(["-t", "PT5M", "foo"],

1259

SetTimeoutCmd,

1260

value_to_set=300000)

1261

1262

def test_extended_timeout(self):

1263

self.assert_command_from_args(["--extended-timeout", "PT15M",

1264

"foo"],

1265

SetExtendedTimeoutCmd,

1266

value_to_set=900000)

1267

1268

def test_interval(self):

1269

self.assert_command_from_args(["--interval", "PT2M", "foo"],

1270

SetIntervalCmd,

1271

value_to_set=120000)

1272

1273

def test_interval_short(self):

1274

self.assert_command_from_args(["-i", "PT2M", "foo"],

1275

SetIntervalCmd,

1276

value_to_set=120000)

1277

1278

def test_approval_delay(self):

1279

self.assert_command_from_args(["--approval-delay", "PT30S",

1280

"foo"], SetApprovalDelayCmd,

1281

value_to_set=30000)

1282

1283

def test_approval_duration(self):

1284

self.assert_command_from_args(["--approval-duration", "PT1S",

1285

"foo"], SetApprovalDurationCmd,

1286

value_to_set=1000)

1287

1288

def test_print_table(self):

1289

self.assert_command_from_args([], PrintTableCmd,

1290

verbose=False)

1291

1292

def test_print_table_verbose(self):

1293

self.assert_command_from_args(["--verbose"], PrintTableCmd,

1294

verbose=True)

1295

1296

def test_print_table_verbose_short(self):

1297

self.assert_command_from_args(["-v"], PrintTableCmd,

1298

verbose=True)

1299

1300

1301

class TestCmd(unittest.TestCase):

1302

"""Abstract class for tests of command classes"""

1303

1304

def setUp(self):

1305

testcase = self

1306

class MockClient(object):

1307

def __init__(self, name, **attributes):

1308

self.__dbus_object_path__ = "/clients/{}".format(name)

1309

self.attributes = attributes

1310

self.attributes["Name"] = name

1311

self.calls = []

1312

def Set(self, interface, propname, value, dbus_interface):

1313

testcase.assertEqual(interface, client_dbus_interface)

1314

testcase.assertEqual(dbus_interface,

1315

dbus.PROPERTIES_IFACE)

1316

self.attributes[propname] = value

1317

def Get(self, interface, propname, dbus_interface):

1318

testcase.assertEqual(interface, client_dbus_interface)

1319

testcase.assertEqual(dbus_interface,

1320

dbus.PROPERTIES_IFACE)

1321

return self.attributes[propname]

1322

def Approve(self, approve, dbus_interface):

1323

testcase.assertEqual(dbus_interface,

1324

client_dbus_interface)

1325

self.calls.append(("Approve", (approve,

1326

dbus_interface)))

1327

self.client = MockClient(

1328

"foo",

1329

KeyID=("92ed150794387c03ce684574b1139a65"

1330

"94a34f895daaaf09fd8ea90a27cddb12"),

1331

Secret=b"secret",

1332

Host="foo.example.org",

1333

Enabled=dbus.Boolean(True),

1334

Timeout=300000,

1335

LastCheckedOK="2019-02-03T00:00:00",

1336

Created="2019-01-02T00:00:00",

1337

Interval=120000,

1338

Fingerprint=("778827225BA7DE539C5A"

1339

"7CFA59CFF7CDBD9A5920"),

1340

CheckerRunning=dbus.Boolean(False),

1341

LastEnabled="2019-01-03T00:00:00",

1342

ApprovalPending=dbus.Boolean(False),

1343

ApprovedByDefault=dbus.Boolean(True),

1344

LastApprovalRequest="",

1345

ApprovalDelay=0,

1346

ApprovalDuration=1000,

1347

Checker="fping -q -- %(host)s",

1348

ExtendedTimeout=900000,

1349

Expires="2019-02-04T00:00:00",

1350

LastCheckerStatus=0)

1351

self.other_client = MockClient(

1352

"barbar",

1353

KeyID=("0558568eedd67d622f5c83b35a115f79"

1354

"6ab612cff5ad227247e46c2b020f441c"),

1355

Secret=b"secretbar",

1356

Host="192.0.2.3",

1357

Enabled=dbus.Boolean(True),

1358

Timeout=300000,

1359

LastCheckedOK="2019-02-04T00:00:00",

1360

Created="2019-01-03T00:00:00",

1361

Interval=120000,

1362

Fingerprint=("3E393AEAEFB84C7E89E2"

1363

"F547B3A107558FCA3A27"),

1364

CheckerRunning=dbus.Boolean(True),

1365

LastEnabled="2019-01-04T00:00:00",

1366

ApprovalPending=dbus.Boolean(False),

1367

ApprovedByDefault=dbus.Boolean(False),

1368

LastApprovalRequest="2019-01-03T00:00:00",

1369

ApprovalDelay=30000,

1370

ApprovalDuration=93785000,

1371

Checker=":",

1372

ExtendedTimeout=900000,

1373

Expires="2019-02-05T00:00:00",

1374

LastCheckerStatus=-2)

1375

self.clients = collections.OrderedDict(

1376

[

1377

("/clients/foo", self.client.attributes),

1378

("/clients/barbar", self.other_client.attributes),

1379

])

1380

self.one_client = {"/clients/foo": self.client.attributes}

1381

1382

@property

1383

def bus(self):

1384

class Bus(object):

1385

@staticmethod

1386

def get_object(client_bus_name, path):

1387

self.assertEqual(client_bus_name, dbus_busname)

1388

return {

1389

# Note: "self" here is the TestCmd instance, not

1390

# the Bus instance, since this is a static method!

1391

"/clients/foo": self.client,

1392

"/clients/barbar": self.other_client,

1393

}[path]

1394

return Bus()

1395

1396

1397

class TestIsEnabledCmd(TestCmd):

1398

def test_is_enabled(self):

1399

self.assertTrue(all(IsEnabledCmd().is_enabled(client,

1400

properties)

1401

for client, properties

1402

in self.clients.items()))

1403

1404

def test_is_enabled_run_exits_successfully(self):

1405

with self.assertRaises(SystemExit) as e:

1406

IsEnabledCmd().run(self.one_client)

1407

if e.exception.code is not None:

1408

self.assertEqual(e.exception.code, 0)

1409

else:

1410

self.assertIsNone(e.exception.code)

1411

1412

def test_is_enabled_run_exits_with_failure(self):

1413

self.client.attributes["Enabled"] = dbus.Boolean(False)

1414

with self.assertRaises(SystemExit) as e:

1415

IsEnabledCmd().run(self.one_client)

1416

if isinstance(e.exception.code, int):

1417

self.assertNotEqual(e.exception.code, 0)

1418

else:

1419

self.assertIsNotNone(e.exception.code)

1420

1421

1422

class TestApproveCmd(TestCmd):

1423

def test_approve(self):

1424

ApproveCmd().run(self.clients, self.bus)

1425

for clientpath in self.clients:

1426

client = self.bus.get_object(dbus_busname, clientpath)

1427

self.assertIn(("Approve", (True, client_dbus_interface)),

1428

client.calls)

1429

1430

1431

class TestDenyCmd(TestCmd):

1432

def test_deny(self):

1433

DenyCmd().run(self.clients, self.bus)

1434

for clientpath in self.clients:

1435

client = self.bus.get_object(dbus_busname, clientpath)

1436

self.assertIn(("Approve", (False, client_dbus_interface)),

1437

client.calls)

1438

1439

1440

class TestRemoveCmd(TestCmd):

1441

def test_remove(self):

1442

class MockMandos(object):

1443

def __init__(self):

1444

self.calls = []

1445

def RemoveClient(self, dbus_path):

1446

self.calls.append(("RemoveClient", (dbus_path,)))

1447

mandos = MockMandos()

1448

super(TestRemoveCmd, self).setUp()

1449

RemoveCmd().run(self.clients, self.bus, mandos)

1450

self.assertEqual(len(mandos.calls), 2)

1451

for clientpath in self.clients:

1452

self.assertIn(("RemoveClient", (clientpath,)),

1453

mandos.calls)

1454

1455

1456

class TestDumpJSONCmd(TestCmd):

1457

def setUp(self):

1458

self.expected_json = {

1459

"foo": {

1460

"Name": "foo",

1461

"KeyID": ("92ed150794387c03ce684574b1139a65"

1462

"94a34f895daaaf09fd8ea90a27cddb12"),

1463

"Host": "foo.example.org",

1464

"Enabled": True,

1465

"Timeout": 300000,

1466

"LastCheckedOK": "2019-02-03T00:00:00",

1467

"Created": "2019-01-02T00:00:00",

1468

"Interval": 120000,

1469

"Fingerprint": ("778827225BA7DE539C5A"

1470

"7CFA59CFF7CDBD9A5920"),

1471

"CheckerRunning": False,

1472

"LastEnabled": "2019-01-03T00:00:00",

1473

"ApprovalPending": False,

1474

"ApprovedByDefault": True,

1475

"LastApprovalRequest": "",

1476

"ApprovalDelay": 0,

1477

"ApprovalDuration": 1000,

1478

"Checker": "fping -q -- %(host)s",

1479

"ExtendedTimeout": 900000,

1480

"Expires": "2019-02-04T00:00:00",

1481

"LastCheckerStatus": 0,

1482

},

1483

"barbar": {

1484

"Name": "barbar",

1485

"KeyID": ("0558568eedd67d622f5c83b35a115f79"

1486

"6ab612cff5ad227247e46c2b020f441c"),

1487

"Host": "192.0.2.3",

1488

"Enabled": True,

1489

"Timeout": 300000,

1490

"LastCheckedOK": "2019-02-04T00:00:00",

1491

"Created": "2019-01-03T00:00:00",

1492

"Interval": 120000,

1493

"Fingerprint": ("3E393AEAEFB84C7E89E2"

1494

"F547B3A107558FCA3A27"),

1495

"CheckerRunning": True,

1496

"LastEnabled": "2019-01-04T00:00:00",

1497

"ApprovalPending": False,

1498

"ApprovedByDefault": False,

1499

"LastApprovalRequest": "2019-01-03T00:00:00",

1500

"ApprovalDelay": 30000,

1501

"ApprovalDuration": 93785000,

1502

"Checker": ":",

1503

"ExtendedTimeout": 900000,

1504

"Expires": "2019-02-05T00:00:00",

1505

"LastCheckerStatus": -2,

1506

},

1507

}

1508

return super(TestDumpJSONCmd, self).setUp()

1509

1510

def test_normal(self):

1511

output = DumpJSONCmd().output(self.clients.values())

1512

json_data = json.loads(output)

1513

self.assertDictEqual(json_data, self.expected_json)

1514

1515

def test_one_client(self):

1516

output = DumpJSONCmd().output(self.one_client.values())

1517

json_data = json.loads(output)

1518

expected_json = {"foo": self.expected_json["foo"]}

1519

self.assertDictEqual(json_data, expected_json)

1520

1521

1522

class TestPrintTableCmd(TestCmd):

1523

def test_normal(self):

1524

output = PrintTableCmd().output(self.clients.values())

1525

expected_output = "\n".join((

1526

"Name Enabled Timeout Last Successful Check",

1527

"foo Yes 00:05:00 2019-02-03T00:00:00 ",

1528

"barbar Yes 00:05:00 2019-02-04T00:00:00 ",

1529

))

1530

self.assertEqual(output, expected_output)

1531

1532

def test_verbose(self):

1533

output = PrintTableCmd(verbose=True).output(

1534

self.clients.values())

1535

columns = (

1536

(

1537

"Name ",

1538

"foo ",

1539

"barbar ",

1540

),(

1541

"Enabled ",

1542

"Yes ",

1543

"Yes ",

1544

),(

1545

"Timeout ",

1546

"00:05:00 ",

1547

"00:05:00 ",

1548

),(

1549

"Last Successful Check ",

1550

"2019-02-03T00:00:00 ",

1551

"2019-02-04T00:00:00 ",

1552

),(

1553

"Created ",

1554

"2019-01-02T00:00:00 ",

1555

"2019-01-03T00:00:00 ",

1556

),(

1557

"Interval ",

1558

"00:02:00 ",

1559

"00:02:00 ",

1560

),(

1561

"Host ",

1562

"foo.example.org ",

1563

"192.0.2.3 ",

1564

),(

1565

("Key ID "

1566

" "),

1567

("92ed150794387c03ce684574b1139a6594a34f895daaaf09fd8"

1568

"ea90a27cddb12 "),

1569

("0558568eedd67d622f5c83b35a115f796ab612cff5ad227247e"

1570

"46c2b020f441c "),

1571

),(

1572

"Fingerprint ",

1573

"778827225BA7DE539C5A7CFA59CFF7CDBD9A5920 ",

1574

"3E393AEAEFB84C7E89E2F547B3A107558FCA3A27 ",

1575

),(

1576

"Check Is Running ",

1577

"No ",

1578

"Yes ",

1579

),(

1580

"Last Enabled ",

1581

"2019-01-03T00:00:00 ",

1582

"2019-01-04T00:00:00 ",

1583

),(

1584

"Approval Is Pending ",

1585

"No ",

1586

"No ",

1587

),(

1588

"Approved By Default ",

1589

"Yes ",

1590

"No ",

1591

),(

1592

"Last Approval Request ",

1593

" ",

1594

"2019-01-03T00:00:00 ",

1595

),(

1596

"Approval Delay ",

1597

"00:00:00 ",

1598

"00:00:30 ",

1599

),(

1600

"Approval Duration ",

1601

"00:00:01 ",

1602

"1T02:03:05 ",

1603

),(

1604

"Checker ",

1605

"fping -q -- %(host)s ",

1606

": ",

1607

),(

1608

"Extended Timeout ",

1609

"00:15:00 ",

1610

"00:15:00 ",

1611

),(

1612

"Expires ",

1613

"2019-02-04T00:00:00 ",

1614

"2019-02-05T00:00:00 ",

1615

),(

1616

"Last Checker Status",

1617

"0 ",

1618

"-2 ",

1619

)

1620

)

1621

num_lines = max(len(rows) for rows in columns)

1622

expected_output = "\n".join("".join(rows[line]

1623

for rows in columns)

1624

for line in range(num_lines))

1625

self.assertEqual(output, expected_output)

1626

1627

def test_one_client(self):

1628

output = PrintTableCmd().output(self.one_client.values())

1629

expected_output = "\n".join((

1630

"Name Enabled Timeout Last Successful Check",

1631

"foo Yes 00:05:00 2019-02-03T00:00:00 ",

1632

))

1633

self.assertEqual(output, expected_output)

1634

1635

1636

class TestPropertyCmd(TestCmd):

1637

"""Abstract class for tests of PropertyCmd classes"""

1638

def runTest(self):

1639

if not hasattr(self, "command"):

1640

return

1641

values_to_get = getattr(self, "values_to_get",

1642

self.values_to_set)

1643

for value_to_set, value_to_get in zip(self.values_to_set,

1644

values_to_get):

1645

for clientpath in self.clients:

1646

client = self.bus.get_object(dbus_busname, clientpath)

1647

old_value = client.attributes[self.propname]

1648

self.assertNotIsInstance(old_value, self.Unique)

1649

client.attributes[self.propname] = self.Unique()

1650

self.run_command(value_to_set, self.clients)

1651

for clientpath in self.clients:

1652

client = self.bus.get_object(dbus_busname, clientpath)

1653

value = client.attributes[self.propname]

1654

self.assertNotIsInstance(value, self.Unique)

1655

self.assertEqual(value, value_to_get)

1656

1657

class Unique(object):

1658

"""Class for objects which exist only to be unique objects,

1659

since unittest.mock.sentinel only exists in Python 3.3"""

1660

1661

def run_command(self, value, clients):

1662

self.command().run(clients, self.bus)

1663

1664

1665

class TestEnableCmd(TestPropertyCmd):

1666

command = EnableCmd

1667

propname = "Enabled"

1668

values_to_set = [dbus.Boolean(True)]

1669

1670

1671

class TestDisableCmd(TestPropertyCmd):

1672

command = DisableCmd

1673

propname = "Enabled"

1674

values_to_set = [dbus.Boolean(False)]

1675

1676

1677

class TestBumpTimeoutCmd(TestPropertyCmd):

1678

command = BumpTimeoutCmd

1679

propname = "LastCheckedOK"

1680

values_to_set = [""]

1681

1682

1683

class TestStartCheckerCmd(TestPropertyCmd):

1684

command = StartCheckerCmd

1685

propname = "CheckerRunning"

1686

values_to_set = [dbus.Boolean(True)]

1687

1688

1689

class TestStopCheckerCmd(TestPropertyCmd):

1690

command = StopCheckerCmd

1691

propname = "CheckerRunning"

1692

values_to_set = [dbus.Boolean(False)]

1693

1694

1695

class TestApproveByDefaultCmd(TestPropertyCmd):

1696

command = ApproveByDefaultCmd

1697

propname = "ApprovedByDefault"

1698

values_to_set = [dbus.Boolean(True)]

1699

1700

1701

class TestDenyByDefaultCmd(TestPropertyCmd):

1702

command = DenyByDefaultCmd

1703

propname = "ApprovedByDefault"

1704

values_to_set = [dbus.Boolean(False)]

1705

1706

1707

class TestPropertyValueCmd(TestPropertyCmd):

1708

"""Abstract class for tests of PropertyValueCmd classes"""

1709

1710

def runTest(self):

1711

if type(self) is TestPropertyValueCmd:

1712

return

1713

return super(TestPropertyValueCmd, self).runTest()

1714

1715

def run_command(self, value, clients):

1716

self.command(value).run(clients, self.bus)

1717

1718

1719

class TestSetCheckerCmd(TestPropertyValueCmd):

1720

command = SetCheckerCmd

1721

propname = "Checker"

1722

values_to_set = ["", ":", "fping -q -- %s"]

1723

1724

1725

class TestSetHostCmd(TestPropertyValueCmd):

1726

command = SetHostCmd

1727

propname = "Host"

1728

values_to_set = ["192.0.2.3", "foo.example.org"]

1729

1730

1731

class TestSetSecretCmd(TestPropertyValueCmd):

1732

command = SetSecretCmd

1733

propname = "Secret"

1734

values_to_set = [io.BytesIO(b""),

1735

io.BytesIO(b"secret\0xyzzy\nbar")]

1736

values_to_get = [b"", b"secret\0xyzzy\nbar"]

1737

1738

1739

class TestSetTimeoutCmd(TestPropertyValueCmd):

1740

command = SetTimeoutCmd

1741

propname = "Timeout"

1742

values_to_set = [datetime.timedelta(),

1743

datetime.timedelta(minutes=5),

1744

datetime.timedelta(seconds=1),

1745

datetime.timedelta(weeks=1),

1746

datetime.timedelta(weeks=52)]

1747

values_to_get = [0, 300000, 1000, 604800000, 31449600000]

1748

1749

1750

class TestSetExtendedTimeoutCmd(TestPropertyValueCmd):

1751

command = SetExtendedTimeoutCmd

1752

propname = "ExtendedTimeout"

1753

values_to_set = [datetime.timedelta(),

1754

datetime.timedelta(minutes=5),

1755

datetime.timedelta(seconds=1),

1756

datetime.timedelta(weeks=1),

1757

datetime.timedelta(weeks=52)]

1758

values_to_get = [0, 300000, 1000, 604800000, 31449600000]

1759

1760

1761

class TestSetIntervalCmd(TestPropertyValueCmd):

1762

command = SetIntervalCmd

1763

propname = "Interval"

1764

values_to_set = [datetime.timedelta(),

1765

datetime.timedelta(minutes=5),

1766

datetime.timedelta(seconds=1),

1767

datetime.timedelta(weeks=1),

1768

datetime.timedelta(weeks=52)]

1769

values_to_get = [0, 300000, 1000, 604800000, 31449600000]

1770

1771

1772

class TestSetApprovalDelayCmd(TestPropertyValueCmd):

1773

command = SetApprovalDelayCmd

1774

propname = "ApprovalDelay"

1775

values_to_set = [datetime.timedelta(),

1776

datetime.timedelta(minutes=5),

1777

datetime.timedelta(seconds=1),

1778

datetime.timedelta(weeks=1),

1779

datetime.timedelta(weeks=52)]

1780

values_to_get = [0, 300000, 1000, 604800000, 31449600000]

1781

1782

1783

class TestSetApprovalDurationCmd(TestPropertyValueCmd):

1784

command = SetApprovalDurationCmd

1785

propname = "ApprovalDuration"

1786

values_to_set = [datetime.timedelta(),

1787

datetime.timedelta(minutes=5),

1788

datetime.timedelta(seconds=1),

1789

datetime.timedelta(weeks=1),

1790

datetime.timedelta(weeks=52)]

1791

values_to_get = [0, 300000, 1000, 604800000, 31449600000]

1792

1793

1794

1795

def should_only_run_tests():

1796

parser = argparse.ArgumentParser(add_help=False)

1797

parser.add_argument("--check", action='store_true')

1798

args, unknown_args = parser.parse_known_args()

1799

run_tests = args.check

1800

if run_tests:

1801

# Remove --check argument from sys.argv

1802

sys.argv[1:] = unknown_args

1803

return run_tests

1804

1805

# Add all tests from doctest strings

1806

def load_tests(loader, tests, none):

1807

import doctest

1808

tests.addTests(doctest.DocTestSuite())

1809

return tests

1810

1811

if __name__ == "__main__":

1812

try:

1813

if should_only_run_tests():

1814

# Call using ./tdd-python-script --check [--verbose]

1815

unittest.main()

1816

else:

1817

main()

1818

finally:

1819

logging.shutdown()

52

return unicode(x)

53

54

format_string = u' '.join(u'%%-%ds'

55

% max(len(tablewords[key]),

56

max(len(valuetostring(client[key]))

57

for client

58

in mandos_clients.itervalues()))

59

for key in keywords)

60

print format_string % tuple(tablewords[key] for key in keywords)

61

for client in mandos_clients.itervalues():

62

print format_string % tuple(valuetostring(client[key])

63

for key in keywords)

64

65