/mandos/trunk : revision 352

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8; after-save-hook: (lambda () (let ((command (if (and (boundp 'tramp-file-name-structure) (string-match (car tramp-file-name-structure) (buffer-file-name))) (tramp-file-name-localname (tramp-dissect-file-name (buffer-file-name))) (buffer-file-name)))) (if (= (shell-command (format "%s --check" (shell-quote-argument command)) "*Test*") 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)) (kill-buffer "*Test*")) (display-buffer "*Test*")))); -*-

3

#

4

# Mandos Monitor - Control and monitor the Mandos server

5

#

6

7

8

#

9

# This file is part of Mandos.

10

#

11

# Mandos is free software: you can redistribute it and/or modify it

12

# under the terms of the GNU General Public License as published by

13

# the Free Software Foundation, either version 3 of the License, or

14

# (at your option) any later version.

15

#

16

# Mandos is distributed in the hope that it will be useful, but

17

# WITHOUT ANY WARRANTY; without even the implied warranty of

18

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

19

# GNU General Public License for more details.

20

#

21

# You should have received a copy of the GNU General Public License

22

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

23

#

24

# Contact the authors at <mandos@recompile.se>.

25

#

26

27

from __future__ import (division, absolute_import, print_function,

28

unicode_literals)

29

30

try:

31

from future_builtins import *

32

except ImportError:

33

pass

34

2

# -*- mode: python; coding: utf-8 -*-

3

4

from __future__ import division

35

5

import sys

36

import argparse

6

import dbus

7

from optparse import OptionParser

37

8

import locale

38

9

import datetime

39

10

import re

40

import os

41

import collections

42

import json

43

import unittest

44

import logging

45

46

import dbus

47

48

# Show warnings by default

49

if not sys.warnoptions:

50

import warnings

51

warnings.simplefilter("default")

52

53

log = logging.getLogger(sys.argv[0])

54

logging.basicConfig(level="INFO", # Show info level messages

55

format="%(message)s") # Show basic log messages

56

57

logging.captureWarnings(True) # Show warnings via the logging system

58

59

if sys.version_info.major == 2:

60

str = unicode

61

62

locale.setlocale(locale.LC_ALL, "")

63

64

domain = "se.recompile"

65

busname = domain + ".Mandos"

66

server_path = "/"

67

server_interface = domain + ".Mandos"

68

client_interface = domain + ".Mandos.Client"

69

version = "1.8.3"

70

71

72

try:

73

dbus.OBJECT_MANAGER_IFACE

74

except AttributeError:

75

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

76

11

12

locale.setlocale(locale.LC_ALL, u'')

13

14

tablewords = {

15

'name': u'Name',

16

'enabled': u'Enabled',

17

'timeout': u'Timeout',

18

'last_checked_ok': u'Last Successful Check',

19

'created': u'Created',

20

'interval': u'Interval',

21

'host': u'Host',

22

'fingerprint': u'Fingerprint',

23

'checker_running': u'Check Is Running',

24

'last_enabled': u'Last Enabled',

25

'checker': u'Checker',

26

}

27

defaultkeywords = ('name', 'enabled', 'timeout', 'last_checked_ok',

28

'checker')

29

domain = 'se.bsnet.fukt'

30

busname = domain + '.Mandos'

31

server_path = '/'

32

server_interface = domain + '.Mandos'

33

client_interface = domain + '.Mandos.Client'

34

version = "1.0.11"

35

bus = dbus.SystemBus()

36

mandos_dbus_objc = bus.get_object(busname, server_path)

37

mandos_serv = dbus.Interface(mandos_dbus_objc,

38

dbus_interface = server_interface)

39

mandos_clients = mandos_serv.GetAllClientsWithProperties()

40

41

def datetime_to_milliseconds(dt):

42

"Return the 'timeout' attribute in milliseconds"

43

return ((dt.days * 24 * 60 * 60 * 1000)

44

+ (dt.seconds * 1000)

45

+ (dt.microseconds // 1000))

77

46

78

47

def milliseconds_to_string(ms):

79

48

td = datetime.timedelta(0, 0, 0, ms)

80

return ("{days}{hours:02}:{minutes:02}:{seconds:02}"

81

.format(days="{}T".format(td.days) if td.days else "",

82

hours=td.seconds // 3600,

83

minutes=(td.seconds % 3600) // 60,

84

seconds=td.seconds % 60))

85

86

87

def rfc3339_duration_to_delta(duration):

88

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

89

90

>>> rfc3339_duration_to_delta("P7D")

91

datetime.timedelta(7)

92

>>> rfc3339_duration_to_delta("PT60S")

93

datetime.timedelta(0, 60)

94

>>> rfc3339_duration_to_delta("PT60M")

95

datetime.timedelta(0, 3600)

96

>>> rfc3339_duration_to_delta("P60M")

97

datetime.timedelta(1680)

98

>>> rfc3339_duration_to_delta("PT24H")

99

datetime.timedelta(1)

100

>>> rfc3339_duration_to_delta("P1W")

101

datetime.timedelta(7)

102

>>> rfc3339_duration_to_delta("PT5M30S")

103

datetime.timedelta(0, 330)

104

>>> rfc3339_duration_to_delta("P1DT3M20S")

105

datetime.timedelta(1, 200)

106

>>> # Can not be empty:

107

>>> rfc3339_duration_to_delta("")

108

Traceback (most recent call last):

109

...

110

ValueError: Invalid RFC 3339 duration: u''

111

>>> # Must start with "P":

112

>>> rfc3339_duration_to_delta("1D")

113

Traceback (most recent call last):

114

...

115

ValueError: Invalid RFC 3339 duration: u'1D'

116

>>> # Must use correct order

117

>>> rfc3339_duration_to_delta("PT1S2M")

118

Traceback (most recent call last):

119

...

120

ValueError: Invalid RFC 3339 duration: u'PT1S2M'

121

>>> # Time needs time marker

122

>>> rfc3339_duration_to_delta("P1H2S")

123

Traceback (most recent call last):

124

...

125

ValueError: Invalid RFC 3339 duration: u'P1H2S'

126

>>> # Weeks can not be combined with anything else

127

>>> rfc3339_duration_to_delta("P1D2W")

128

Traceback (most recent call last):

129

...

130

ValueError: Invalid RFC 3339 duration: u'P1D2W'

131

>>> rfc3339_duration_to_delta("P2W2H")

132

Traceback (most recent call last):

133

...

134

ValueError: Invalid RFC 3339 duration: u'P2W2H'

135

"""

136

137

# Parsing an RFC 3339 duration with regular expressions is not

138

# possible - there would have to be multiple places for the same

139

# values, like seconds. The current code, while more esoteric, is

140

# cleaner without depending on a parsing library. If Python had a

141

# built-in library for parsing we would use it, but we'd like to

142

# avoid excessive use of external libraries.

143

144

# New type for defining tokens, syntax, and semantics all-in-one

145

Token = collections.namedtuple("Token", (

146

"regexp", # To match token; if "value" is not None, must have

147

# a "group" containing digits

148

"value", # datetime.timedelta or None

149

"followers")) # Tokens valid after this token

150

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

151

# the "duration" ABNF definition in RFC 3339, Appendix A.

152

token_end = Token(re.compile(r"$"), None, frozenset())

153

token_second = Token(re.compile(r"(\d+)S"),

154

datetime.timedelta(seconds=1),

155

frozenset((token_end, )))

156

token_minute = Token(re.compile(r"(\d+)M"),

157

datetime.timedelta(minutes=1),

158

frozenset((token_second, token_end)))

159

token_hour = Token(re.compile(r"(\d+)H"),

160

datetime.timedelta(hours=1),

161

frozenset((token_minute, token_end)))

162

token_time = Token(re.compile(r"T"),

163

None,

164

frozenset((token_hour, token_minute,

165

token_second)))

166

token_day = Token(re.compile(r"(\d+)D"),

167

datetime.timedelta(days=1),

168

frozenset((token_time, token_end)))

169

token_month = Token(re.compile(r"(\d+)M"),

170

datetime.timedelta(weeks=4),

171

frozenset((token_day, token_end)))

172

token_year = Token(re.compile(r"(\d+)Y"),

173

datetime.timedelta(weeks=52),

174

frozenset((token_month, token_end)))

175

token_week = Token(re.compile(r"(\d+)W"),

176

datetime.timedelta(weeks=1),

177

frozenset((token_end, )))

178

token_duration = Token(re.compile(r"P"), None,

179

frozenset((token_year, token_month,

180

token_day, token_time,

181

token_week)))

182

# Define starting values:

183

# Value so far

184

value = datetime.timedelta()

185

found_token = None

186

# Following valid tokens

187

followers = frozenset((token_duration, ))

188

# String left to parse

189

s = duration

190

# Loop until end token is found

191

while found_token is not token_end:

192

# Search for any currently valid tokens

193

for token in followers:

194

match = token.regexp.match(s)

195

if match is not None:

196

# Token found

197

if token.value is not None:

198

# Value found, parse digits

199

factor = int(match.group(1), 10)

200

# Add to value so far

201

value += factor * token.value

202

# Strip token from string

203

s = token.regexp.sub("", s, 1)

204

# Go to found token

205

found_token = token

206

# Set valid next tokens

207

followers = found_token.followers

208

break

209

else:

210

# No currently valid tokens were found

211

raise ValueError("Invalid RFC 3339 duration: {!r}"

212

.format(duration))

213

# End token found

214

return value

49

return "%s%02d:%02d:%02d" % (("%dT" % td.days) if td.days else "", # days

50

td.seconds // 3600, # hours

51

(td.seconds % 3600) // 60, # minutes

52

(td.seconds % 60)) # seconds

215

53

216

54

217

55

def string_to_delta(interval):

218

"""Parse a string and return a datetime.timedelta"""

219

220

try:

221

return rfc3339_duration_to_delta(interval)

222

except ValueError as e:

223

log.warning("%s - Parsing as pre-1.6.1 interval instead",

224

' '.join(e.args))

225

return parse_pre_1_6_1_interval(interval)

226

227

228

def parse_pre_1_6_1_interval(interval):

229

"""Parse an interval string as documented by Mandos before 1.6.1,

230

and return a datetime.timedelta

231

232

>>> parse_pre_1_6_1_interval('7d')

56

"""Parse a string and return a datetime.timedelta

57

58

>>> string_to_delta('7d')

233

59

datetime.timedelta(7)

234

>>> parse_pre_1_6_1_interval('60s')

60

>>> string_to_delta('60s')

235

61

datetime.timedelta(0, 60)

236

>>> parse_pre_1_6_1_interval('60m')

62

>>> string_to_delta('60m')

237

63

datetime.timedelta(0, 3600)

238

>>> parse_pre_1_6_1_interval('24h')

64

>>> string_to_delta('24h')

239

65

datetime.timedelta(1)

240

>>> parse_pre_1_6_1_interval('1w')

66

>>> string_to_delta(u'1w')

241

67

datetime.timedelta(7)

242

>>> parse_pre_1_6_1_interval('5m 30s')

68

>>> string_to_delta('5m 30s')

243

69

datetime.timedelta(0, 330)

244

>>> parse_pre_1_6_1_interval('')

245

datetime.timedelta(0)

246

>>> # Ignore unknown characters, allow any order and repetitions

247

>>> parse_pre_1_6_1_interval('2dxy7zz11y3m5m')

248

datetime.timedelta(2, 480, 18000)

249

250

70

"""

251

252

value = datetime.timedelta(0)

253

regexp = re.compile(r"(\d+)([dsmhw]?)")

254

255

for num, suffix in regexp.findall(interval):

256

if suffix == "d":

257

value += datetime.timedelta(int(num))

258

elif suffix == "s":

259

value += datetime.timedelta(0, int(num))

260

elif suffix == "m":

261

value += datetime.timedelta(0, 0, 0, 0, int(num))

262

elif suffix == "h":

263

value += datetime.timedelta(0, 0, 0, 0, 0, int(num))

264

elif suffix == "w":

265

value += datetime.timedelta(0, 0, 0, 0, 0, 0, int(num))

266

elif suffix == "":

267

value += datetime.timedelta(0, 0, 0, int(num))

268

return value

269

270

271

## Classes for commands.

272

273

# Abstract classes first

274

class Command(object):

275

"""Abstract class for commands"""

276

def run(self, mandos, clients):

277

"""Normal commands should implement run_on_one_client(), but

278

commands which want to operate on all clients at the same time

279

can override this run() method instead."""

280

self.mandos = mandos

281

for client in clients:

282

self.run_on_one_client(client)

283

284

class PrintCmd(Command):

285

"""Abstract class for commands printing client details"""

286

all_keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",

287

"Created", "Interval", "Host", "KeyID",

288

"Fingerprint", "CheckerRunning", "LastEnabled",

289

"ApprovalPending", "ApprovedByDefault",

290

"LastApprovalRequest", "ApprovalDelay",

291

"ApprovalDuration", "Checker", "ExtendedTimeout",

292

"Expires", "LastCheckerStatus")

293

def run(self, mandos, clients):

294

print(self.output(clients))

295

296

class PropertyCmd(Command):

297

"""Abstract class for Actions for setting one client property"""

298

def run_on_one_client(self, client):

299

"""Set the Client's D-Bus property"""

300

client.Set(client_interface, self.property, self.value_to_set,

301

dbus_interface=dbus.PROPERTIES_IFACE)

302

303

class ValueArgumentMixIn(object):

304

"""Mixin class for commands taking a value as argument"""

305

def __init__(self, value):

306

self.value_to_set = value

307

308

class MillisecondsValueArgumentMixIn(ValueArgumentMixIn):

309

"""Mixin class for commands taking a value argument as

310

milliseconds."""

311

@property

312

def value_to_set(self):

313

return self._vts

314

@value_to_set.setter

315

def value_to_set(self, value):

316

"""When setting, convert value to a datetime.timedelta"""

317

self._vts = string_to_delta(value).total_seconds() * 1000

318

319

# Actual (non-abstract) command classes

320

321

class PrintTableCmd(PrintCmd):

322

def __init__(self, verbose=False):

323

self.verbose = verbose

324

325

def output(self, clients):

326

if self.verbose:

327

keywords = self.all_keywords

328

else:

329

keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")

330

return str(self.TableOfClients(clients.values(), keywords))

331

332

class TableOfClients(object):

333

tableheaders = {

334

"Name": "Name",

335

"Enabled": "Enabled",

336

"Timeout": "Timeout",

337

"LastCheckedOK": "Last Successful Check",

338

"LastApprovalRequest": "Last Approval Request",

339

"Created": "Created",

340

"Interval": "Interval",

341

"Host": "Host",

342

"Fingerprint": "Fingerprint",

343

"KeyID": "Key ID",

344

"CheckerRunning": "Check Is Running",

345

"LastEnabled": "Last Enabled",

346

"ApprovalPending": "Approval Is Pending",

347

"ApprovedByDefault": "Approved By Default",

348

"ApprovalDelay": "Approval Delay",

349

"ApprovalDuration": "Approval Duration",

350

"Checker": "Checker",

351

"ExtendedTimeout": "Extended Timeout",

352

"Expires": "Expires",

353

"LastCheckerStatus": "Last Checker Status",

354

}

355

356

def __init__(self, clients, keywords, tableheaders=None):

357

self.clients = clients

358

self.keywords = keywords

359

if tableheaders is not None:

360

self.tableheaders = tableheaders

361

362

def __str__(self):

363

return "\n".join(self.rows())

364

365

if sys.version_info.major == 2:

366

__unicode__ = __str__

367

def __str__(self):

368

return str(self).encode(locale.getpreferredencoding())

369

370

def rows(self):

371

format_string = self.row_formatting_string()

372

rows = [self.header_line(format_string)]

373

rows.extend(self.client_line(client, format_string)

374

for client in self.clients)

375

return rows

376

377

def row_formatting_string(self):

378

"Format string used to format table rows"

379

return " ".join("{{{key}:{width}}}".format(

380

width=max(len(self.tableheaders[key]),

381

*(len(self.string_from_client(client, key))

382

for client in self.clients)),

383

key=key)

384

for key in self.keywords)

385

386

def string_from_client(self, client, key):

387

return self.valuetostring(client[key], key)

388

389

@staticmethod

390

def valuetostring(value, keyword):

391

if isinstance(value, dbus.Boolean):

392

return "Yes" if value else "No"

393

if keyword in ("Timeout", "Interval", "ApprovalDelay",

394

"ApprovalDuration", "ExtendedTimeout"):

395

return milliseconds_to_string(value)

396

return str(value)

397

398

def header_line(self, format_string):

399

return format_string.format(**self.tableheaders)

400

401

def client_line(self, client, format_string):

402

return format_string.format(

403

**{key: self.string_from_client(client, key)

404

for key in self.keywords})

405

406

407

408

class DumpJSONCmd(PrintCmd):

409

def output(self, clients):

410

data = {client["Name"]:

411

{key: self.dbus_boolean_to_bool(client[key])

412

for key in self.all_keywords}

413

for client in clients.values()}

414

return json.dumps(data, indent=4, separators=(',', ': '))

415

@staticmethod

416

def dbus_boolean_to_bool(value):

417

if isinstance(value, dbus.Boolean):

418

value = bool(value)

419

return value

420

421

class IsEnabledCmd(Command):

422

def run_on_one_client(self, client):

423

if self.is_enabled(client):

424

sys.exit(0)

71

timevalue = datetime.timedelta(0)

72

regexp = re.compile("\d+[dsmhw]")

73

74

for s in regexp.findall(interval):

75

try:

76

suffix = unicode(s[-1])

77

value = int(s[:-1])

78

if suffix == u"d":

79

delta = datetime.timedelta(value)

80

elif suffix == u"s":

81

delta = datetime.timedelta(0, value)

82

elif suffix == u"m":

83

delta = datetime.timedelta(0, 0, 0, 0, value)

84

elif suffix == u"h":

85

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

86

elif suffix == u"w":

87

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

88

else:

89

raise ValueError

90

except (ValueError, IndexError):

91

raise ValueError

92

timevalue += delta

93

return timevalue

94

95

def print_clients(clients):

96

def valuetostring(value, keyword):

97

if type(value) is dbus.Boolean:

98

return u"Yes" if value else u"No"

99

if keyword in ("timeout", "interval"):

100

return milliseconds_to_string(value)

101

return unicode(value)

102

103

format_string = u' '.join(u'%%-%ds' %

104

max(len(tablewords[key]),

105

max(len(valuetostring(client[key], key))

106

for client in

107

clients))

108

for key in keywords)

109

print format_string % tuple(tablewords[key] for key in keywords)

110

for client in clients:

111

print format_string % tuple(valuetostring(client[key], key)

112

for key in keywords)

113

114

parser = OptionParser(version = "%%prog %s" % version)

115

parser.add_option("-a", "--all", action="store_true",

116

help="Print all fields")

117

parser.add_option("-e", "--enable", action="store_true",

118

help="Enable client")

119

parser.add_option("-d", "--disable", action="store_true",

120

help="disable client")

121

parser.add_option("-b", "--bump-timeout", action="store_true",

122

help="Bump timeout for client")

123

parser.add_option("--start-checker", action="store_true",

124

help="Start checker for client")

125

parser.add_option("--stop-checker", action="store_true",

126

help="Stop checker for client")

127

parser.add_option("-V", "--is-valid", action="store_true",

128

help="Check if client is still valid")

129

parser.add_option("-r", "--remove", action="store_true",

130

help="Remove client")

131

parser.add_option("-c", "--checker", type="string",

132

help="Set checker command for client")

133

parser.add_option("-t", "--timeout", type="string",

134

help="Set timeout for client")

135

parser.add_option("-i", "--interval", type="string",

136

help="Set checker interval for client")

137

parser.add_option("-H", "--host", type="string",

138

help="Set host for client")

139

parser.add_option("-s", "--secret", type="string",

140

help="Set password blob (file) for client")

141

options, client_names = parser.parse_args()

142

143

# Compile list of clients to process

144

clients=[]

145

for name in client_names:

146

for path, client in mandos_clients.iteritems():

147

if client['name'] == name:

148

client_objc = bus.get_object(busname, path)

149

clients.append(dbus.Interface(client_objc,

150

dbus_interface

151

= client_interface))

152

break

153

else:

154

print >> sys.stderr, "Client not found on server: %r" % name

425

155

sys.exit(1)

426

def is_enabled(self, client):

427

return client.Get(client_interface, "Enabled",

428

dbus_interface=dbus.PROPERTIES_IFACE)

429

430

class RemoveCmd(Command):

431

def run_on_one_client(self, client):

432

self.mandos.RemoveClient(client.__dbus_object_path__)

433

434

class ApproveCmd(Command):

435

def run_on_one_client(self, client):

436

client.Approve(dbus.Boolean(True),

437

dbus_interface=client_interface)

438

439

class DenyCmd(Command):

440

def run_on_one_client(self, client):

441

client.Approve(dbus.Boolean(False),

442

dbus_interface=client_interface)

443

444

class EnableCmd(PropertyCmd):

445

property = "Enabled"

446

value_to_set = dbus.Boolean(True)

447

448

class DisableCmd(PropertyCmd):

449

property = "Enabled"

450

value_to_set = dbus.Boolean(False)

451

452

class BumpTimeoutCmd(PropertyCmd):

453

property = "LastCheckedOK"

454

value_to_set = ""

455

456

class StartCheckerCmd(PropertyCmd):

457

property = "CheckerRunning"

458

value_to_set = dbus.Boolean(True)

459

460

class StopCheckerCmd(PropertyCmd):

461

property = "CheckerRunning"

462

value_to_set = dbus.Boolean(False)

463

464

class ApproveByDefaultCmd(PropertyCmd):

465

property = "ApprovedByDefault"

466

value_to_set = dbus.Boolean(True)

467

468

class DenyByDefaultCmd(PropertyCmd):

469

property = "ApprovedByDefault"

470

value_to_set = dbus.Boolean(False)

471

472

class SetCheckerCmd(PropertyCmd, ValueArgumentMixIn):

473

property = "Checker"

474

475

class SetHostCmd(PropertyCmd, ValueArgumentMixIn):

476

property = "Host"

477

478

class SetSecretCmd(PropertyCmd, ValueArgumentMixIn):

479

property = "Secret"

480

481

class SetTimeoutCmd(PropertyCmd, MillisecondsValueArgumentMixIn):

482

property = "Timeout"

483

484

class SetExtendedTimeoutCmd(PropertyCmd,

485

MillisecondsValueArgumentMixIn):

486

property = "ExtendedTimeout"

487

488

class SetIntervalCmd(PropertyCmd, MillisecondsValueArgumentMixIn):

489

property = "Interval"

490

491

class SetApprovalDelayCmd(PropertyCmd,

492

MillisecondsValueArgumentMixIn):

493

property = "ApprovalDelay"

494

495

class SetApprovalDurationCmd(PropertyCmd,

496

MillisecondsValueArgumentMixIn):

497

property = "ApprovalDuration"

498

499

def has_actions(options):

500

return any((options.enable,

501

options.disable,

502

options.bump_timeout,

503

options.start_checker,

504

options.stop_checker,

505

options.is_enabled,

506

options.remove,

507

options.checker is not None,

508

options.timeout is not None,

509

options.extended_timeout is not None,

510

options.interval is not None,

511

options.approved_by_default is not None,

512

options.approval_delay is not None,

513

options.approval_duration is not None,

514

options.host is not None,

515

options.secret is not None,

516

options.approve,

517

options.deny))

518

519

def add_command_line_options(parser):

520

parser.add_argument("--version", action="version",

521

version="%(prog)s {}".format(version),

522

help="show version number and exit")

523

parser.add_argument("-a", "--all", action="store_true",

524

help="Select all clients")

525

parser.add_argument("-v", "--verbose", action="store_true",

526

help="Print all fields")

527

parser.add_argument("-j", "--dump-json", action="store_true",

528

help="Dump client data in JSON format")

529

enable_disable = parser.add_mutually_exclusive_group()

530

enable_disable.add_argument("-e", "--enable", action="store_true",

531

help="Enable client")

532

enable_disable.add_argument("-d", "--disable",

533

action="store_true",

534

help="disable client")

535

parser.add_argument("-b", "--bump-timeout", action="store_true",

536

help="Bump timeout for client")

537

start_stop_checker = parser.add_mutually_exclusive_group()

538

start_stop_checker.add_argument("--start-checker",

539

action="store_true",

540

help="Start checker for client")

541

start_stop_checker.add_argument("--stop-checker",

542

action="store_true",

543

help="Stop checker for client")

544

parser.add_argument("-V", "--is-enabled", action="store_true",

545

help="Check if client is enabled")

546

parser.add_argument("-r", "--remove", action="store_true",

547

help="Remove client")

548

parser.add_argument("-c", "--checker",

549

help="Set checker command for client")

550

parser.add_argument("-t", "--timeout",

551

help="Set timeout for client")

552

parser.add_argument("--extended-timeout",

553

help="Set extended timeout for client")

554

parser.add_argument("-i", "--interval",

555

help="Set checker interval for client")

556

approve_deny_default = parser.add_mutually_exclusive_group()

557

approve_deny_default.add_argument(

558

"--approve-by-default", action="store_true",

559

default=None, dest="approved_by_default",

560

help="Set client to be approved by default")

561

approve_deny_default.add_argument(

562

"--deny-by-default", action="store_false",

563

dest="approved_by_default",

564

help="Set client to be denied by default")

565

parser.add_argument("--approval-delay",

566

help="Set delay before client approve/deny")

567

parser.add_argument("--approval-duration",

568

help="Set duration of one client approval")

569

parser.add_argument("-H", "--host", help="Set host for client")

570

parser.add_argument("-s", "--secret",

571

type=argparse.FileType(mode="rb"),

572

help="Set password blob (file) for client")

573

approve_deny = parser.add_mutually_exclusive_group()

574

approve_deny.add_argument(

575

"-A", "--approve", action="store_true",

576

help="Approve any current client request")

577

approve_deny.add_argument("-D", "--deny", action="store_true",

578

help="Deny any current client request")

579

parser.add_argument("--check", action="store_true",

580

help="Run self-test")

581

parser.add_argument("client", nargs="*", help="Client name")

582

583

584

def commands_and_clients_from_options(options):

585

586

commands = []

587

588

if options.dump_json:

589

commands.append(DumpJSONCmd())

590

156

157

if not clients and mandos_clients.values():

158

keywords = defaultkeywords

159

if options.all:

160

keywords = ('name', 'enabled', 'timeout', 'last_checked_ok',

161

'created', 'interval', 'host', 'fingerprint',

162

'checker_running', 'last_enabled', 'checker')

163

print_clients(mandos_clients.values())

164

165

# Process each client in the list by all selected options

166

for client in clients:

167

if options.remove:

168

mandos_serv.RemoveClient(client.__dbus_object_path__)

591

169

if options.enable:

592

commands.append(EnableCmd())

593

170

client.Enable()

594

171

if options.disable:

595

commands.append(DisableCmd())

596

172

client.Disable()

597

173

if options.bump_timeout:

598

commands.append(BumpTimeoutCmd(options.bump_timeout))

599

174

client.BumpTimeout()

600

175

if options.start_checker:

601

commands.append(StartCheckerCmd())

602

176

client.StartChecker()

603

177

if options.stop_checker:

604

commands.append(StopCheckerCmd())

605

606

if options.is_enabled:

607

commands.append(IsEnabledCmd())

608

609

if options.remove:

610

commands.append(RemoveCmd())

611

612

if options.checker is not None:

613

commands.append(SetCheckerCmd())

614

615

if options.timeout is not None:

616

commands.append(SetTimeoutCmd(options.timeout))

617

618

if options.extended_timeout:

619

commands.append(

620

SetExtendedTimeoutCmd(options.extended_timeout))

621

622

if options.interval is not None:

623

command.append(SetIntervalCmd(options.interval))

624

625

if options.approved_by_default is not None:

626

if options.approved_by_default:

627

command.append(ApproveByDefaultCmd())

628

else:

629

command.append(DenyByDefaultCmd())

630

631

if options.approval_delay is not None:

632

command.append(SetApprovalDelayCmd(options.approval_delay))

633

634

if options.approval_duration is not None:

635

command.append(

636

SetApprovalDurationCmd(options.approval_duration))

637

638

if options.host is not None:

639

command.append(SetHostCmd(options.host))

640

641

if options.secret is not None:

642

command.append(SetSecretCmd(options.secret))

643

644

if options.approve:

645

commands.append(ApproveCmd())

646

647

if options.deny:

648

commands.append(DenyCmd())

649

650

# If no command option has been given, show table of clients,

651

# optionally verbosely

652

if not commands:

653

commands.append(PrintTableCmd(verbose=options.verbose))

654

655

return commands, options.client

656

657

658

def main():

659

parser = argparse.ArgumentParser()

660

661

add_command_line_options(parser)

662

663

options = parser.parse_args()

664

665

if has_actions(options) and not (options.client or options.all):

666

parser.error("Options require clients names or --all.")

667

if options.verbose and has_actions(options):

668

parser.error("--verbose can only be used alone.")

669

if options.dump_json and (options.verbose

670

or has_actions(options)):

671

parser.error("--dump-json can only be used alone.")

672

if options.all and not has_actions(options):

673

parser.error("--all requires an action.")

674

if options.is_enabled and len(options.client) > 1:

675

parser.error("--is-enabled requires exactly one client")

676

677

commands, clientnames = commands_and_clients_from_options(options)

678

679

try:

680

bus = dbus.SystemBus()

681

mandos_dbus_objc = bus.get_object(busname, server_path)

682

except dbus.exceptions.DBusException:

683

log.critical("Could not connect to Mandos server")

684

sys.exit(1)

685

686

mandos_serv = dbus.Interface(mandos_dbus_objc,

687

dbus_interface=server_interface)

688

mandos_serv_object_manager = dbus.Interface(

689

mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)

690

691

# Filter out log message from dbus module

692

dbus_logger = logging.getLogger("dbus.proxies")

693

class NullFilter(logging.Filter):

694

def filter(self, record):

695

return False

696

dbus_filter = NullFilter()

697

try:

698

dbus_logger.addFilter(dbus_filter)

699

mandos_clients = {path: ifs_and_props[client_interface]

700

for path, ifs_and_props in

701

mandos_serv_object_manager

702

.GetManagedObjects().items()

703

if client_interface in ifs_and_props}

704

except dbus.exceptions.DBusException as e:

705

log.critical("Failed to access Mandos server through D-Bus:"

706

"\n%s", e)

707

sys.exit(1)

708

finally:

709

# restore dbus logger

710

dbus_logger.removeFilter(dbus_filter)

711

712

# Compile dict of (clients: properties) to process

713

clients = {}

714

715

if not clientnames:

716

clients = {bus.get_object(busname, path): properties

717

for path, properties in mandos_clients.items()}

718

else:

719

for name in clientnames:

720

for path, client in mandos_clients.items():

721

if client["Name"] == name:

722

client_objc = bus.get_object(busname, path)

723

clients[client_objc] = client

724

break

725

else:

726

log.critical("Client not found on server: %r", name)

727

sys.exit(1)

728

729

# Run all commands on clients

730

for command in commands:

731

command.run(mandos_serv, clients)

732

733

734

class Test_milliseconds_to_string(unittest.TestCase):

735

def test_all(self):

736

self.assertEqual(milliseconds_to_string(93785000),

737

"1T02:03:05")

738

def test_no_days(self):

739

self.assertEqual(milliseconds_to_string(7385000), "02:03:05")

740

def test_all_zero(self):

741

self.assertEqual(milliseconds_to_string(0), "00:00:00")

742

def test_no_fractional_seconds(self):

743

self.assertEqual(milliseconds_to_string(400), "00:00:00")

744

self.assertEqual(milliseconds_to_string(900), "00:00:00")

745

self.assertEqual(milliseconds_to_string(1900), "00:00:01")

746

747

class Test_string_to_delta(unittest.TestCase):

748

def test_handles_basic_rfc3339(self):

749

self.assertEqual(string_to_delta("PT2H"),

750

datetime.timedelta(0, 7200))

751

def test_falls_back_to_pre_1_6_1_with_warning(self):

752

# assertLogs only exists in Python 3.4

753

if hasattr(self, "assertLogs"):

754

with self.assertLogs(log, logging.WARNING):

755

value = string_to_delta("2h")

756

else:

757

class WarningFilter(logging.Filter):

758

"""Don't show, but record the presence of, warnings"""

759

def filter(self, record):

760

is_warning = record.levelno >= logging.WARNING

761

self.found = is_warning or getattr(self, "found",

762

False)

763

return not is_warning

764

warning_filter = WarningFilter()

765

log.addFilter(warning_filter)

766

try:

767

value = string_to_delta("2h")

768

finally:

769

log.removeFilter(warning_filter)

770

self.assertTrue(getattr(warning_filter, "found", False))

771

self.assertEqual(value, datetime.timedelta(0, 7200))

772

773

774

class TestCmd(unittest.TestCase):

775

"""Abstract class for tests of command classes"""

776

def setUp(self):

777

testcase = self

778

class MockClient(object):

779

def __init__(self, name, **attributes):

780

self.__dbus_object_path__ = "objpath_{}".format(name)

781

self.attributes = attributes

782

self.attributes["Name"] = name

783

self.calls = []

784

def Set(self, interface, property, value, dbus_interface):

785

testcase.assertEqual(interface, client_interface)

786

testcase.assertEqual(dbus_interface,

787

dbus.PROPERTIES_IFACE)

788

self.attributes[property] = value

789

self.calls.append(("Set", (interface, property, value,

790

dbus_interface)))

791

def Get(self, interface, property, dbus_interface):

792

testcase.assertEqual(interface, client_interface)

793

testcase.assertEqual(dbus_interface,

794

dbus.PROPERTIES_IFACE)

795

self.calls.append(("Get", (interface, property,

796

dbus_interface)))

797

return self.attributes[property]

798

def __getitem__(self, key):

799

return self.attributes[key]

800

def __setitem__(self, key, value):

801

self.attributes[key] = value

802

self.clients = collections.OrderedDict([

803

("foo",

804

MockClient(

805

"foo",

806

KeyID=("92ed150794387c03ce684574b1139a65"

807

"94a34f895daaaf09fd8ea90a27cddb12"),

808

Secret=b"secret",

809

Host="foo.example.org",

810

Enabled=dbus.Boolean(True),

811

Timeout=300000,

812

LastCheckedOK="2019-02-03T00:00:00",

813

Created="2019-01-02T00:00:00",

814

Interval=120000,

815

Fingerprint=("778827225BA7DE539C5A"

816

"7CFA59CFF7CDBD9A5920"),

817

CheckerRunning=dbus.Boolean(False),

818

LastEnabled="2019-01-03T00:00:00",

819

ApprovalPending=dbus.Boolean(False),

820

ApprovedByDefault=dbus.Boolean(True),

821

LastApprovalRequest="",

822

ApprovalDelay=0,

823

ApprovalDuration=1000,

824

Checker="fping -q -- %(host)s",

825

ExtendedTimeout=900000,

826

Expires="2019-02-04T00:00:00",

827

LastCheckerStatus=0)),

828

("barbar",

829

MockClient(

830

"barbar",

831

KeyID=("0558568eedd67d622f5c83b35a115f79"

832

"6ab612cff5ad227247e46c2b020f441c"),

833

Secret=b"secretbar",

834

Host="192.0.2.3",

835

Enabled=dbus.Boolean(True),

836

Timeout=300000,

837

LastCheckedOK="2019-02-04T00:00:00",

838

Created="2019-01-03T00:00:00",

839

Interval=120000,

840

Fingerprint=("3E393AEAEFB84C7E89E2"

841

"F547B3A107558FCA3A27"),

842

CheckerRunning=dbus.Boolean(True),

843

LastEnabled="2019-01-04T00:00:00",

844

ApprovalPending=dbus.Boolean(False),

845

ApprovedByDefault=dbus.Boolean(False),

846

LastApprovalRequest="2019-01-03T00:00:00",

847

ApprovalDelay=30000,

848

ApprovalDuration=1000,

849

Checker=":",

850

ExtendedTimeout=900000,

851

Expires="2019-02-05T00:00:00",

852

LastCheckerStatus=-2)),

853

])

854

855

class TestPrintTableCmd(TestCmd):

856

def test_normal(self):

857

output = PrintTableCmd().output(self.clients)

858

expected_output = """

859

Name Enabled Timeout Last Successful Check

860

foo Yes 00:05:00 2019-02-03T00:00:00

861

barbar Yes 00:05:00 2019-02-04T00:00:00

862

"""[1:-1]

863

self.assertEqual(output, expected_output)

864

def test_verbose(self):

865

output = PrintTableCmd(verbose=True).output(self.clients)

866

expected_output = """

867

Name Enabled Timeout Last Successful Check Created Interval Host Key ID Fingerprint Check Is Running Last Enabled Approval Is Pending Approved By Default Last Approval Request Approval Delay Approval Duration Checker Extended Timeout Expires Last Checker Status

868

foo Yes 00:05:00 2019-02-03T00:00:00 2019-01-02T00:00:00 00:02:00 foo.example.org 92ed150794387c03ce684574b1139a6594a34f895daaaf09fd8ea90a27cddb12 778827225BA7DE539C5A7CFA59CFF7CDBD9A5920 No 2019-01-03T00:00:00 No Yes 00:00:00 00:00:01 fping -q -- %(host)s 00:15:00 2019-02-04T00:00:00 0

869

barbar Yes 00:05:00 2019-02-04T00:00:00 2019-01-03T00:00:00 00:02:00 192.0.2.3 0558568eedd67d622f5c83b35a115f796ab612cff5ad227247e46c2b020f441c 3E393AEAEFB84C7E89E2F547B3A107558FCA3A27 Yes 2019-01-04T00:00:00 No No 2019-01-03T00:00:00 00:00:30 00:00:01 : 00:15:00 2019-02-05T00:00:00 -2

870

"""[1:-1]

871

self.assertEqual(output, expected_output)

872

def test_one_client(self):

873

output = PrintTableCmd().output({"foo": self.clients["foo"]})

874

expected_output = """

875

Name Enabled Timeout Last Successful Check

876

foo Yes 00:05:00 2019-02-03T00:00:00

877

"""[1:-1]

878

self.assertEqual(output, expected_output)

879

880

class TestDumpJSONCmd(TestCmd):

881

def setUp(self):

882

self.expected_json = {

883

"foo": {

884

"Name": "foo",

885

"KeyID": ("92ed150794387c03ce684574b1139a65"

886

"94a34f895daaaf09fd8ea90a27cddb12"),

887

"Host": "foo.example.org",

888

"Enabled": True,

889

"Timeout": 300000,

890

"LastCheckedOK": "2019-02-03T00:00:00",

891

"Created": "2019-01-02T00:00:00",

892

"Interval": 120000,

893

"Fingerprint": ("778827225BA7DE539C5A"

894

"7CFA59CFF7CDBD9A5920"),

895

"CheckerRunning": False,

896

"LastEnabled": "2019-01-03T00:00:00",

897

"ApprovalPending": False,

898

"ApprovedByDefault": True,

899

"LastApprovalRequest": "",

900

"ApprovalDelay": 0,

901

"ApprovalDuration": 1000,

902

"Checker": "fping -q -- %(host)s",

903

"ExtendedTimeout": 900000,

904

"Expires": "2019-02-04T00:00:00",

905

"LastCheckerStatus": 0,

906

},

907

"barbar": {

908

"Name": "barbar",

909

"KeyID": ("0558568eedd67d622f5c83b35a115f79"

910

"6ab612cff5ad227247e46c2b020f441c"),

911

"Host": "192.0.2.3",

912

"Enabled": True,

913

"Timeout": 300000,

914

"LastCheckedOK": "2019-02-04T00:00:00",

915

"Created": "2019-01-03T00:00:00",

916

"Interval": 120000,

917

"Fingerprint": ("3E393AEAEFB84C7E89E2"

918

"F547B3A107558FCA3A27"),

919

"CheckerRunning": True,

920

"LastEnabled": "2019-01-04T00:00:00",

921

"ApprovalPending": False,

922

"ApprovedByDefault": False,

923

"LastApprovalRequest": "2019-01-03T00:00:00",

924

"ApprovalDelay": 30000,

925

"ApprovalDuration": 1000,

926

"Checker": ":",

927

"ExtendedTimeout": 900000,

928

"Expires": "2019-02-05T00:00:00",

929

"LastCheckerStatus": -2,

930

},

931

}

932

return super(TestDumpJSONCmd, self).setUp()

933

def test_normal(self):

934

json_data = json.loads(DumpJSONCmd().output(self.clients))

935

self.assertDictEqual(json_data, self.expected_json)

936

def test_one_client(self):

937

clients = {"foo": self.clients["foo"]}

938

json_data = json.loads(DumpJSONCmd().output(clients))

939

expected_json = {"foo": self.expected_json["foo"]}

940

self.assertDictEqual(json_data, expected_json)

941

942

class TestIsEnabledCmd(TestCmd):

943

def test_is_enabled(self):

944

self.assertTrue(all(IsEnabledCmd().is_enabled(client)

945

for client in self.clients.values()))

946

def test_is_enabled_does_get_attribute(self):

947

client = self.clients["foo"]

948

self.assertTrue(IsEnabledCmd().is_enabled(client))

949

self.assertListEqual(client.calls,

950

[("Get",

951

("se.recompile.Mandos.Client",

952

"Enabled",

953

"org.freedesktop.DBus.Properties"))])

954

def test_is_enabled_run_exits_successfully(self):

955

client = self.clients["foo"]

956

with self.assertRaises(SystemExit) as e:

957

IsEnabledCmd().run(None, [client])

958

if e.exception.code is not None:

959

self.assertEqual(e.exception.code, 0)

960

else:

961

self.assertIsNone(e.exception.code)

962

def test_is_enabled_run_exits_with_failure(self):

963

client = self.clients["foo"]

964

client["Enabled"] = dbus.Boolean(False)

965

with self.assertRaises(SystemExit) as e:

966

IsEnabledCmd().run(None, [client])

967

if isinstance(e.exception.code, int):

968

self.assertNotEqual(e.exception.code, 0)

969

else:

970

self.assertIsNotNone(e.exception.code)

971

972

973

class TestRemoveCmd(TestCmd):

974

def test_remove(self):

975

client = self.clients["foo"]

976

class MockMandos(object):

977

def __init__(self):

978

self.calls = []

979

def RemoveClient(self, dbus_path):

980

self.calls.append(("RemoveClient", (dbus_path,)))

981

mandos = MockMandos()

982

RemoveCmd().run(mandos, [client])

983

self.assertEqual(len(mandos.calls), 1)

984

self.assertListEqual(mandos.calls,

985

[("RemoveClient",

986

(client.__dbus_object_path__,))])

987

988

989

990

def should_only_run_tests():

991

parser = argparse.ArgumentParser(add_help=False)

992

parser.add_argument("--check", action='store_true')

993

args, unknown_args = parser.parse_known_args()

994

run_tests = args.check

995

if run_tests:

996

# Remove --check argument from sys.argv

997

sys.argv[1:] = unknown_args

998

return run_tests

999

1000

# Add all tests from doctest strings

1001

def load_tests(loader, tests, none):

1002

import doctest

1003

tests.addTests(doctest.DocTestSuite())

1004

return tests

1005

1006

if __name__ == "__main__":

1007

if should_only_run_tests():

1008

# Call using ./tdd-python-script --check [--verbose]

1009

unittest.main()

1010

else:

1011

main()

178

client.StopChecker()

179

if options.is_valid:

180

sys.exit(0 if client.IsStillValid() else 1)

181

if options.checker:

182

client.SetChecker(options.checker)

183

if options.host:

184

client.SetHost(options.host)

185

if options.interval:

186

client.SetInterval(datetime_to_milliseconds

187

(string_to_delta(options.interval)))

188

if options.timeout:

189

client.SetTimeout(datetime_to_milliseconds

190

(string_to_delta(options.timeout)))

191

if options.secret:

192

client.SetSecret(dbus.ByteArray(open(options.secret, 'rb').read()))

193