/mandos/trunk : revision 379

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8; after-save-hook: (lambda () (let ((command (if (and (boundp 'tramp-file-name-structure) (string-match (car tramp-file-name-structure) (buffer-file-name))) (tramp-file-name-localname (tramp-dissect-file-name (buffer-file-name))) (buffer-file-name)))) (if (= (shell-command (format "%s --check" (shell-quote-argument command)) "*Test*") 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)) (kill-buffer "*Test*")) (display-buffer "*Test*")))); -*-

3

#

4

# Mandos Monitor - Control and monitor the Mandos server

5

#

6

7

8

#

9

# This file is part of Mandos.

10

#

11

# Mandos is free software: you can redistribute it and/or modify it

12

# under the terms of the GNU General Public License as published by

13

# the Free Software Foundation, either version 3 of the License, or

14

# (at your option) any later version.

15

#

16

# Mandos is distributed in the hope that it will be useful, but

17

# WITHOUT ANY WARRANTY; without even the implied warranty of

18

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

19

# GNU General Public License for more details.

20

#

21

# You should have received a copy of the GNU General Public License

22

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

23

#

24

# Contact the authors at <mandos@recompile.se>.

25

#

26

27

from __future__ import (division, absolute_import, print_function,

28

unicode_literals)

29

30

try:

31

from future_builtins import *

32

except ImportError:

33

pass

34

2

# -*- mode: python; coding: utf-8 -*-

3

4

from __future__ import division

35

5

import sys

36

import argparse

6

import dbus

7

from optparse import OptionParser

37

8

import locale

38

9

import datetime

39

10

import re

40

import os

41

import collections

42

import json

43

import unittest

44

import logging

45

46

import dbus

47

48

# Show warnings by default

49

if not sys.warnoptions:

50

import warnings

51

warnings.simplefilter("default")

52

53

log = logging.getLogger(sys.argv[0])

54

logging.basicConfig(level="INFO", # Show info level messages

55

format="%(message)s") # Show basic log messages

56

57

logging.captureWarnings(True) # Show warnings via the logging system

58

59

if sys.version_info.major == 2:

60

str = unicode

61

62

locale.setlocale(locale.LC_ALL, "")

63

64

domain = "se.recompile"

65

busname = domain + ".Mandos"

66

server_path = "/"

67

server_interface = domain + ".Mandos"

68

client_interface = domain + ".Mandos.Client"

69

version = "1.8.3"

70

71

72

try:

73

dbus.OBJECT_MANAGER_IFACE

74

except AttributeError:

75

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

76

11

12

locale.setlocale(locale.LC_ALL, u'')

13

14

tablewords = {

15

'name': u'Name',

16

'enabled': u'Enabled',

17

'timeout': u'Timeout',

18

'last_checked_ok': u'Last Successful Check',

19

'created': u'Created',

20

'interval': u'Interval',

21

'host': u'Host',

22

'fingerprint': u'Fingerprint',

23

'checker_running': u'Check Is Running',

24

'last_enabled': u'Last Enabled',

25

'checker': u'Checker',

26

}

27

defaultkeywords = ('name', 'enabled', 'timeout', 'last_checked_ok',

28

'checker')

29

domain = 'se.bsnet.fukt'

30

busname = domain + '.Mandos'

31

server_path = '/'

32

server_interface = domain + '.Mandos'

33

client_interface = domain + '.Mandos.Client'

34

version = "1.0.12"

35

bus = dbus.SystemBus()

36

mandos_dbus_objc = bus.get_object(busname, server_path)

37

mandos_serv = dbus.Interface(mandos_dbus_objc,

38

dbus_interface = server_interface)

39

mandos_clients = mandos_serv.GetAllClientsWithProperties()

40

41

def datetime_to_milliseconds(dt):

42

"Return the 'timeout' attribute in milliseconds"

43

return ((dt.days * 24 * 60 * 60 * 1000)

44

+ (dt.seconds * 1000)

45

+ (dt.microseconds // 1000))

77

46

78

47

def milliseconds_to_string(ms):

79

48

td = datetime.timedelta(0, 0, 0, ms)

80

return ("{days}{hours:02}:{minutes:02}:{seconds:02}"

81

.format(days="{}T".format(td.days) if td.days else "",

82

hours=td.seconds // 3600,

83

minutes=(td.seconds % 3600) // 60,

84

seconds=td.seconds % 60))

85

86

87

def rfc3339_duration_to_delta(duration):

88

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

89

90

>>> rfc3339_duration_to_delta("P7D")

91

datetime.timedelta(7)

92

>>> rfc3339_duration_to_delta("PT60S")

93

datetime.timedelta(0, 60)

94

>>> rfc3339_duration_to_delta("PT60M")

95

datetime.timedelta(0, 3600)

96

>>> rfc3339_duration_to_delta("P60M")

97

datetime.timedelta(1680)

98

>>> rfc3339_duration_to_delta("PT24H")

99

datetime.timedelta(1)

100

>>> rfc3339_duration_to_delta("P1W")

101

datetime.timedelta(7)

102

>>> rfc3339_duration_to_delta("PT5M30S")

103

datetime.timedelta(0, 330)

104

>>> rfc3339_duration_to_delta("P1DT3M20S")

105

datetime.timedelta(1, 200)

106

>>> # Can not be empty:

107

>>> rfc3339_duration_to_delta("")

108

Traceback (most recent call last):

109

...

110

ValueError: Invalid RFC 3339 duration: u''

111

>>> # Must start with "P":

112

>>> rfc3339_duration_to_delta("1D")

113

Traceback (most recent call last):

114

...

115

ValueError: Invalid RFC 3339 duration: u'1D'

116

>>> # Must use correct order

117

>>> rfc3339_duration_to_delta("PT1S2M")

118

Traceback (most recent call last):

119

...

120

ValueError: Invalid RFC 3339 duration: u'PT1S2M'

121

>>> # Time needs time marker

122

>>> rfc3339_duration_to_delta("P1H2S")

123

Traceback (most recent call last):

124

...

125

ValueError: Invalid RFC 3339 duration: u'P1H2S'

126

>>> # Weeks can not be combined with anything else

127

>>> rfc3339_duration_to_delta("P1D2W")

128

Traceback (most recent call last):

129

...

130

ValueError: Invalid RFC 3339 duration: u'P1D2W'

131

>>> rfc3339_duration_to_delta("P2W2H")

132

Traceback (most recent call last):

133

...

134

ValueError: Invalid RFC 3339 duration: u'P2W2H'

135

"""

136

137

# Parsing an RFC 3339 duration with regular expressions is not

138

# possible - there would have to be multiple places for the same

139

# values, like seconds. The current code, while more esoteric, is

140

# cleaner without depending on a parsing library. If Python had a

141

# built-in library for parsing we would use it, but we'd like to

142

# avoid excessive use of external libraries.

143

144

# New type for defining tokens, syntax, and semantics all-in-one

145

Token = collections.namedtuple("Token", (

146

"regexp", # To match token; if "value" is not None, must have

147

# a "group" containing digits

148

"value", # datetime.timedelta or None

149

"followers")) # Tokens valid after this token

150

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

151

# the "duration" ABNF definition in RFC 3339, Appendix A.

152

token_end = Token(re.compile(r"$"), None, frozenset())

153

token_second = Token(re.compile(r"(\d+)S"),

154

datetime.timedelta(seconds=1),

155

frozenset((token_end, )))

156

token_minute = Token(re.compile(r"(\d+)M"),

157

datetime.timedelta(minutes=1),

158

frozenset((token_second, token_end)))

159

token_hour = Token(re.compile(r"(\d+)H"),

160

datetime.timedelta(hours=1),

161

frozenset((token_minute, token_end)))

162

token_time = Token(re.compile(r"T"),

163

None,

164

frozenset((token_hour, token_minute,

165

token_second)))

166

token_day = Token(re.compile(r"(\d+)D"),

167

datetime.timedelta(days=1),

168

frozenset((token_time, token_end)))

169

token_month = Token(re.compile(r"(\d+)M"),

170

datetime.timedelta(weeks=4),

171

frozenset((token_day, token_end)))

172

token_year = Token(re.compile(r"(\d+)Y"),

173

datetime.timedelta(weeks=52),

174

frozenset((token_month, token_end)))

175

token_week = Token(re.compile(r"(\d+)W"),

176

datetime.timedelta(weeks=1),

177

frozenset((token_end, )))

178

token_duration = Token(re.compile(r"P"), None,

179

frozenset((token_year, token_month,

180

token_day, token_time,

181

token_week)))

182

# Define starting values:

183

# Value so far

184

value = datetime.timedelta()

185

found_token = None

186

# Following valid tokens

187

followers = frozenset((token_duration, ))

188

# String left to parse

189

s = duration

190

# Loop until end token is found

191

while found_token is not token_end:

192

# Search for any currently valid tokens

193

for token in followers:

194

match = token.regexp.match(s)

195

if match is not None:

196

# Token found

197

if token.value is not None:

198

# Value found, parse digits

199

factor = int(match.group(1), 10)

200

# Add to value so far

201

value += factor * token.value

202

# Strip token from string

203

s = token.regexp.sub("", s, 1)

204

# Go to found token

205

found_token = token

206

# Set valid next tokens

207

followers = found_token.followers

208

break

209

else:

210

# No currently valid tokens were found

211

raise ValueError("Invalid RFC 3339 duration: {!r}"

212

.format(duration))

213

# End token found

214

return value

49

return "%s%02d:%02d:%02d" % (("%dT" % td.days) if td.days else "", # days

50

td.seconds // 3600, # hours

51

(td.seconds % 3600) // 60, # minutes

52

(td.seconds % 60)) # seconds

215

53

216

54

217

55

def string_to_delta(interval):

218

"""Parse a string and return a datetime.timedelta"""

219

220

try:

221

return rfc3339_duration_to_delta(interval)

222

except ValueError as e:

223

log.warning("%s - Parsing as pre-1.6.1 interval instead",

224

' '.join(e.args))

225

return parse_pre_1_6_1_interval(interval)

226

227

228

def parse_pre_1_6_1_interval(interval):

229

"""Parse an interval string as documented by Mandos before 1.6.1,

230

and return a datetime.timedelta

231

232

>>> parse_pre_1_6_1_interval('7d')

56

"""Parse a string and return a datetime.timedelta

57

58

>>> string_to_delta('7d')

233

59

datetime.timedelta(7)

234

>>> parse_pre_1_6_1_interval('60s')

60

>>> string_to_delta('60s')

235

61

datetime.timedelta(0, 60)

236

>>> parse_pre_1_6_1_interval('60m')

62

>>> string_to_delta('60m')

237

63

datetime.timedelta(0, 3600)

238

>>> parse_pre_1_6_1_interval('24h')

64

>>> string_to_delta('24h')

239

65

datetime.timedelta(1)

240

>>> parse_pre_1_6_1_interval('1w')

66

>>> string_to_delta(u'1w')

241

67

datetime.timedelta(7)

242

>>> parse_pre_1_6_1_interval('5m 30s')

68

>>> string_to_delta('5m 30s')

243

69

datetime.timedelta(0, 330)

244

>>> parse_pre_1_6_1_interval('')

245

datetime.timedelta(0)

246

>>> # Ignore unknown characters, allow any order and repetitions

247

>>> parse_pre_1_6_1_interval('2dxy7zz11y3m5m')

248

datetime.timedelta(2, 480, 18000)

249

250

70

"""

251

252

value = datetime.timedelta(0)

253

regexp = re.compile(r"(\d+)([dsmhw]?)")

254

255

for num, suffix in regexp.findall(interval):

256

if suffix == "d":

257

value += datetime.timedelta(int(num))

258

elif suffix == "s":

259

value += datetime.timedelta(0, int(num))

260

elif suffix == "m":

261

value += datetime.timedelta(0, 0, 0, 0, int(num))

262

elif suffix == "h":

263

value += datetime.timedelta(0, 0, 0, 0, 0, int(num))

264

elif suffix == "w":

265

value += datetime.timedelta(0, 0, 0, 0, 0, 0, int(num))

266

elif suffix == "":

267

value += datetime.timedelta(0, 0, 0, int(num))

268

return value

269

270

271

class TableOfClients(object):

272

tableheaders = {

273

"Name": "Name",

274

"Enabled": "Enabled",

275

"Timeout": "Timeout",

276

"LastCheckedOK": "Last Successful Check",

277

"LastApprovalRequest": "Last Approval Request",

278

"Created": "Created",

279

"Interval": "Interval",

280

"Host": "Host",

281

"Fingerprint": "Fingerprint",

282

"KeyID": "Key ID",

283

"CheckerRunning": "Check Is Running",

284

"LastEnabled": "Last Enabled",

285

"ApprovalPending": "Approval Is Pending",

286

"ApprovedByDefault": "Approved By Default",

287

"ApprovalDelay": "Approval Delay",

288

"ApprovalDuration": "Approval Duration",

289

"Checker": "Checker",

290

"ExtendedTimeout": "Extended Timeout",

291

"Expires": "Expires",

292

"LastCheckerStatus": "Last Checker Status",

293

}

294

295

def __init__(self, clients, keywords, tableheaders=None):

296

self.clients = clients

297

self.keywords = keywords

298

if tableheaders is not None:

299

self.tableheaders = tableheaders

300

301

def __str__(self):

302

return "\n".join(self.rows())

303

304

if sys.version_info.major == 2:

305

__unicode__ = __str__

306

def __str__(self):

307

return str(self).encode(locale.getpreferredencoding())

308

309

def rows(self):

310

format_string = self.row_formatting_string()

311

rows = [self.header_line(format_string)]

312

rows.extend(self.client_line(client, format_string)

313

for client in self.clients)

314

return rows

315

316

def row_formatting_string(self):

317

"Format string used to format table rows"

318

return " ".join("{{{key}:{width}}}".format(

319

width=max(len(self.tableheaders[key]),

320

*(len(self.string_from_client(client, key))

321

for client in self.clients)),

322

key=key)

323

for key in self.keywords)

324

325

def string_from_client(self, client, key):

326

return self.valuetostring(client[key], key)

327

328

@staticmethod

71

timevalue = datetime.timedelta(0)

72

regexp = re.compile("\d+[dsmhw]")

73

74

for s in regexp.findall(interval):

75

try:

76

suffix = unicode(s[-1])

77

value = int(s[:-1])

78

if suffix == u"d":

79

delta = datetime.timedelta(value)

80

elif suffix == u"s":

81

delta = datetime.timedelta(0, value)

82

elif suffix == u"m":

83

delta = datetime.timedelta(0, 0, 0, 0, value)

84

elif suffix == u"h":

85

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

86

elif suffix == u"w":

87

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

88

else:

89

raise ValueError

90

except (ValueError, IndexError):

91

raise ValueError

92

timevalue += delta

93

return timevalue

94

95

def print_clients(clients):

329

96

def valuetostring(value, keyword):

330

if isinstance(value, dbus.Boolean):

331

return "Yes" if value else "No"

332

if keyword in ("Timeout", "Interval", "ApprovalDelay",

333

"ApprovalDuration", "ExtendedTimeout"):

97

if type(value) is dbus.Boolean:

98

return u"Yes" if value else u"No"

99

if keyword in ("timeout", "interval"):

334

100

return milliseconds_to_string(value)

335

return str(value)

336

337

def header_line(self, format_string):

338

return format_string.format(**self.tableheaders)

339

340

def client_line(self, client, format_string):

341

return format_string.format(

342

**{key: self.string_from_client(client, key)

343

for key in self.keywords})

344

345

346

## Classes for commands.

347

348

# Abstract classes first

349

class Command(object):

350

"""Abstract class for commands"""

351

def run(self, clients):

352

"""Normal commands should implement run_on_one_client(), but

353

commands which want to operate on all clients at the same time

354

can override this run() method instead."""

355

for client in clients:

356

self.run_on_one_client(client)

357

358

class PrintCmd(Command):

359

"""Abstract class for commands printing client details"""

360

all_keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",

361

"Created", "Interval", "Host", "KeyID",

362

"Fingerprint", "CheckerRunning", "LastEnabled",

363

"ApprovalPending", "ApprovedByDefault",

364

"LastApprovalRequest", "ApprovalDelay",

365

"ApprovalDuration", "Checker", "ExtendedTimeout",

366

"Expires", "LastCheckerStatus")

367

def run(self, clients):

368

print(self.output(clients))

369

370

class PropertyCmd(Command):

371

"""Abstract class for Actions for setting one client property"""

372

def run_on_one_client(self, client):

373

"""Set the Client's D-Bus property"""

374

client.Set(client_interface, self.property, self.value_to_set,

375

dbus_interface=dbus.PROPERTIES_IFACE)

376

377

class ValueArgumentMixIn(object):

378

"""Mixin class for commands taking a value as argument"""

379

def __init__(self, value):

380

self.value_to_set = value

381

382

class MillisecondsValueArgumentMixIn(ValueArgumentMixIn):

383

"""Mixin class for commands taking a value argument as

384

milliseconds."""

385

@property

386

def value_to_set(self):

387

return self._vts

388

@value_to_set.setter

389

def value_to_set(self, value):

390

"""When setting, convert value to a datetime.timedelta"""

391

self._vts = string_to_delta(value).total_seconds() * 1000

392

393

# Actual (non-abstract) command classes

394

395

class PrintTableCmd(PrintCmd):

396

def __init__(self, verbose=False):

397

self.verbose = verbose

398

def output(self, clients):

399

if self.verbose:

400

keywords = self.all_keywords

401

else:

402

keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")

403

return str(TableOfClients(clients.values(), keywords))

404

405

class DumpJSONCmd(PrintCmd):

406

def output(self, clients):

407

data = {client["Name"]:

408

{key: self.dbus_boolean_to_bool(client[key])

409

for key in self.all_keywords}

410

for client in clients.values()}

411

return json.dumps(data, indent=4, separators=(',', ': '))

412

@staticmethod

413

def dbus_boolean_to_bool(value):

414

if isinstance(value, dbus.Boolean):

415

value = bool(value)

416

return value

417

418

class IsEnabledCmd(Command):

419

def run_on_one_client(self, client):

420

if self.is_enabled(client):

421

sys.exit(0)

422

sys.exit(1)

423

def is_enabled(self, client):

424

return client.Get(client_interface, "Enabled",

425

dbus_interface=dbus.PROPERTIES_IFACE)

426

427

class RemoveCmd(Command):

428

def __init__(self, mandos):

429

self.mandos = mandos

430

def run_on_one_client(self, client):

431

self.mandos.RemoveClient(client.__dbus_object_path__)

432

433

class ApproveCmd(Command):

434

def run_on_one_client(self, client):

435

client.Approve(dbus.Boolean(True),

436

dbus_interface=client_interface)

437

438

class DenyCmd(Command):

439

def run_on_one_client(self, client):

440

client.Approve(dbus.Boolean(False),

441

dbus_interface=client_interface)

442

443

class EnableCmd(PropertyCmd):

444

property = "Enabled"

445

value_to_set = dbus.Boolean(True)

446

447

class DisableCmd(PropertyCmd):

448

property = "Enabled"

449

value_to_set = dbus.Boolean(False)

450

451

class BumpTimeoutCmd(PropertyCmd):

452

property = "LastCheckedOK"

453

value_to_set = ""

454

455

class StartCheckerCmd(PropertyCmd):

456

property = "CheckerRunning"

457

value_to_set = dbus.Boolean(True)

458

459

class StopCheckerCmd(PropertyCmd):

460

property = "CheckerRunning"

461

value_to_set = dbus.Boolean(False)

462

463

class ApproveByDefaultCmd(PropertyCmd):

464

property = "ApprovedByDefault"

465

value_to_set = dbus.Boolean(True)

466

467

class DenyByDefaultCmd(PropertyCmd):

468

property = "ApprovedByDefault"

469

value_to_set = dbus.Boolean(False)

470

471

class SetCheckerCmd(PropertyCmd, ValueArgumentMixIn):

472

property = "Checker"

473

474

class SetHostCmd(PropertyCmd, ValueArgumentMixIn):

475

property = "Host"

476

477

class SetSecretCmd(PropertyCmd, ValueArgumentMixIn):

478

property = "Secret"

479

480

class SetTimeoutCmd(PropertyCmd, MillisecondsValueArgumentMixIn):

481

property = "Timeout"

482

483

class SetExtendedTimeoutCmd(PropertyCmd,

484

MillisecondsValueArgumentMixIn):

485

property = "ExtendedTimeout"

486

487

class SetIntervalCmd(PropertyCmd, MillisecondsValueArgumentMixIn):

488

property = "Interval"

489

490

class SetApprovalDelayCmd(PropertyCmd,

491

MillisecondsValueArgumentMixIn):

492

property = "ApprovalDelay"

493

494

class SetApprovalDurationCmd(PropertyCmd,

495

MillisecondsValueArgumentMixIn):

496

property = "ApprovalDuration"

497

498

def has_actions(options):

499

return any((options.enable,

500

options.disable,

501

options.bump_timeout,

502

options.start_checker,

503

options.stop_checker,

504

options.is_enabled,

505

options.remove,

506

options.checker is not None,

507

options.timeout is not None,

508

options.extended_timeout is not None,

509

options.interval is not None,

510

options.approved_by_default is not None,

511

options.approval_delay is not None,

512

options.approval_duration is not None,

513

options.host is not None,

514

options.secret is not None,

515

options.approve,

516

options.deny))

517

518

519

def main():

520

parser = argparse.ArgumentParser()

521

parser.add_argument("--version", action="version",

522

version="%(prog)s {}".format(version),

523

help="show version number and exit")

524

parser.add_argument("-a", "--all", action="store_true",

525

help="Select all clients")

526

parser.add_argument("-v", "--verbose", action="store_true",

527

help="Print all fields")

528

parser.add_argument("-j", "--dump-json", action="store_true",

529

help="Dump client data in JSON format")

530

enable_disable = parser.add_mutually_exclusive_group()

531

enable_disable.add_argument("-e", "--enable", action="store_true",

532

help="Enable client")

533

enable_disable.add_argument("-d", "--disable",

534

action="store_true",

535

help="disable client")

536

parser.add_argument("-b", "--bump-timeout", action="store_true",

537

help="Bump timeout for client")

538

start_stop_checker = parser.add_mutually_exclusive_group()

539

start_stop_checker.add_argument("--start-checker",

540

action="store_true",

541

help="Start checker for client")

542

start_stop_checker.add_argument("--stop-checker",

543

action="store_true",

544

help="Stop checker for client")

545

parser.add_argument("-V", "--is-enabled", action="store_true",

546

help="Check if client is enabled")

547

parser.add_argument("-r", "--remove", action="store_true",

548

help="Remove client")

549

parser.add_argument("-c", "--checker",

550

help="Set checker command for client")

551

parser.add_argument("-t", "--timeout",

552

help="Set timeout for client")

553

parser.add_argument("--extended-timeout",

554

help="Set extended timeout for client")

555

parser.add_argument("-i", "--interval",

556

help="Set checker interval for client")

557

approve_deny_default = parser.add_mutually_exclusive_group()

558

approve_deny_default.add_argument(

559

"--approve-by-default", action="store_true",

560

default=None, dest="approved_by_default",

561

help="Set client to be approved by default")

562

approve_deny_default.add_argument(

563

"--deny-by-default", action="store_false",

564

dest="approved_by_default",

565

help="Set client to be denied by default")

566

parser.add_argument("--approval-delay",

567

help="Set delay before client approve/deny")

568

parser.add_argument("--approval-duration",

569

help="Set duration of one client approval")

570

parser.add_argument("-H", "--host", help="Set host for client")

571

parser.add_argument("-s", "--secret",

572

type=argparse.FileType(mode="rb"),

573

help="Set password blob (file) for client")

574

approve_deny = parser.add_mutually_exclusive_group()

575

approve_deny.add_argument(

576

"-A", "--approve", action="store_true",

577

help="Approve any current client request")

578

approve_deny.add_argument("-D", "--deny", action="store_true",

579

help="Deny any current client request")

580

parser.add_argument("--check", action="store_true",

581

help="Run self-test")

582

parser.add_argument("client", nargs="*", help="Client name")

583

options = parser.parse_args()

584

585

if has_actions(options) and not (options.client or options.all):

586

parser.error("Options require clients names or --all.")

587

if options.verbose and has_actions(options):

588

parser.error("--verbose can only be used alone.")

589

if options.dump_json and (options.verbose

590

or has_actions(options)):

591

parser.error("--dump-json can only be used alone.")

592

if options.all and not has_actions(options):

593

parser.error("--all requires an action.")

594

if options.is_enabled and len(options.client) > 1:

595

parser.error("--is-enabled requires exactly one client")

596

597

try:

598

bus = dbus.SystemBus()

599

mandos_dbus_objc = bus.get_object(busname, server_path)

600

except dbus.exceptions.DBusException:

601

log.critical("Could not connect to Mandos server")

602

sys.exit(1)

603

604

mandos_serv = dbus.Interface(mandos_dbus_objc,

605

dbus_interface=server_interface)

606

mandos_serv_object_manager = dbus.Interface(

607

mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)

608

609

commands = []

610

611

if options.dump_json:

612

commands.append(DumpJSONCmd())

613

101

return unicode(value)

102

103

format_string = u' '.join(u'%%-%ds' %

104

max(len(tablewords[key]),

105

max(len(valuetostring(client[key], key))

106

for client in

107

clients))

108

for key in keywords)

109

print format_string % tuple(tablewords[key] for key in keywords)

110

for client in clients:

111

print format_string % tuple(valuetostring(client[key], key)

112

for key in keywords)

113

114

parser = OptionParser(version = "%%prog %s" % version)

115

parser.add_option("-a", "--all", action="store_true",

116

help="Print all fields")

117

parser.add_option("-e", "--enable", action="store_true",

118

help="Enable client")

119

parser.add_option("-d", "--disable", action="store_true",

120

help="disable client")

121

parser.add_option("-b", "--bump-timeout", action="store_true",

122

help="Bump timeout for client")

123

parser.add_option("--start-checker", action="store_true",

124

help="Start checker for client")

125

parser.add_option("--stop-checker", action="store_true",

126

help="Stop checker for client")

127

parser.add_option("-V", "--is-valid", action="store_true",

128

help="Check if client is still valid")

129

parser.add_option("-r", "--remove", action="store_true",

130

help="Remove client")

131

parser.add_option("-c", "--checker", type="string",

132

help="Set checker command for client")

133

parser.add_option("-t", "--timeout", type="string",

134

help="Set timeout for client")

135

parser.add_option("-i", "--interval", type="string",

136

help="Set checker interval for client")

137

parser.add_option("-H", "--host", type="string",

138

help="Set host for client")

139

parser.add_option("-s", "--secret", type="string",

140

help="Set password blob (file) for client")

141

options, client_names = parser.parse_args()

142

143

# Compile list of clients to process

144

clients=[]

145

for name in client_names:

146

for path, client in mandos_clients.iteritems():

147

if client['name'] == name:

148

client_objc = bus.get_object(busname, path)

149

clients.append(dbus.Interface(client_objc,

150

dbus_interface

151

= client_interface))

152

break

153

else:

154

print >> sys.stderr, "Client not found on server: %r" % name

155

sys.exit(1)

156

157

if not clients and mandos_clients.values():

158

keywords = defaultkeywords

159

if options.all:

160

keywords = ('name', 'enabled', 'timeout', 'last_checked_ok',

161

'created', 'interval', 'host', 'fingerprint',

162

'checker_running', 'last_enabled', 'checker')

163

print_clients(mandos_clients.values())

164

165

# Process each client in the list by all selected options

166

for client in clients:

167

if options.remove:

168

mandos_serv.RemoveClient(client.__dbus_object_path__)

614

169

if options.enable:

615

commands.append(EnableCmd())

616

170

client.Enable()

617

171

if options.disable:

618

commands.append(DisableCmd())

619

172

client.Disable()

620

173

if options.bump_timeout:

621

commands.append(BumpTimeoutCmd(options.bump_timeout))

622

174

client.BumpTimeout()

623

175

if options.start_checker:

624

commands.append(StartCheckerCmd())

625

176

client.StartChecker()

626

177

if options.stop_checker:

627

commands.append(StopCheckerCmd())

628

629

if options.is_enabled:

630

commands.append(IsEnabledCmd())

631

632

if options.remove:

633

commands.append(RemoveCmd(mandos_serv))

634

635

if options.checker is not None:

636

commands.append(SetCheckerCmd())

637

638

if options.timeout is not None:

639

commands.append(SetTimeoutCmd(options.timeout))

640

641

if options.extended_timeout:

642

commands.append(

643

SetExtendedTimeoutCmd(options.extended_timeout))

644

645

if options.interval is not None:

646

command.append(SetIntervalCmd(options.interval))

647

648

if options.approved_by_default is not None:

649

if options.approved_by_default:

650

command.append(ApproveByDefaultCmd())

651

else:

652

command.append(DenyByDefaultCmd())

653

654

if options.approval_delay is not None:

655

command.append(SetApprovalDelayCmd(options.approval_delay))

656

657

if options.approval_duration is not None:

658

command.append(

659

SetApprovalDurationCmd(options.approval_duration))

660

661

if options.host is not None:

662

command.append(SetHostCmd(options.host))

663

664

if options.secret is not None:

665

command.append(SetSecretCmd(options.secret))

666

667

if options.approve:

668

commands.append(ApproveCmd())

669

670

if options.deny:

671

commands.append(DenyCmd())

672

673

# If no command option has been given, show table of clients,

674

# optionally verbosely

675

if not commands:

676

commands.append(PrintTableCmd(verbose=options.verbose))

677

678

# Filter out log message from dbus module

679

dbus_logger = logging.getLogger("dbus.proxies")

680

class NullFilter(logging.Filter):

681

def filter(self, record):

682

return False

683

dbus_filter = NullFilter()

684

dbus_logger.addFilter(dbus_filter)

685

try:

686

try:

687

mandos_clients = {path: ifs_and_props[client_interface]

688

for path, ifs_and_props in

689

mandos_serv_object_manager

690

.GetManagedObjects().items()

691

if client_interface in ifs_and_props}

692

finally:

693

# restore dbus logger

694

dbus_logger.removeFilter(dbus_filter)

695

except dbus.exceptions.DBusException as e:

696

log.critical("Failed to access Mandos server through D-Bus:"

697

"\n%s", e)

698

sys.exit(1)

699

700

# Compile dict of (clients: properties) to process

701

clients = {}

702

703

if options.all or not options.client:

704

clients = {bus.get_object(busname, path): properties

705

for path, properties in mandos_clients.items()}

706

else:

707

for name in options.client:

708

for path, client in mandos_clients.items():

709

if client["Name"] == name:

710

client_objc = bus.get_object(busname, path)

711

clients[client_objc] = client

712

break

713

else:

714

log.critical("Client not found on server: %r", name)

715

sys.exit(1)

716

717

# Run all commands on clients

718

for command in commands:

719

command.run(clients)

720

721

722

class Test_milliseconds_to_string(unittest.TestCase):

723

def test_all(self):

724

self.assertEqual(milliseconds_to_string(93785000),

725

"1T02:03:05")

726

def test_no_days(self):

727

self.assertEqual(milliseconds_to_string(7385000), "02:03:05")

728

def test_all_zero(self):

729

self.assertEqual(milliseconds_to_string(0), "00:00:00")

730

def test_no_fractional_seconds(self):

731

self.assertEqual(milliseconds_to_string(400), "00:00:00")

732

self.assertEqual(milliseconds_to_string(900), "00:00:00")

733

self.assertEqual(milliseconds_to_string(1900), "00:00:01")

734

735

class Test_string_to_delta(unittest.TestCase):

736

def test_handles_basic_rfc3339(self):

737

self.assertEqual(string_to_delta("PT2H"),

738

datetime.timedelta(0, 7200))

739

def test_falls_back_to_pre_1_6_1_with_warning(self):

740

# assertLogs only exists in Python 3.4

741

if hasattr(self, "assertLogs"):

742

with self.assertLogs(log, logging.WARNING):

743

value = string_to_delta("2h")

744

else:

745

class WarningFilter(logging.Filter):

746

"""Don't show, but record the presence of, warnings"""

747

def filter(self, record):

748

is_warning = record.levelno >= logging.WARNING

749

self.found = is_warning or getattr(self, "found",

750

False)

751

return not is_warning

752

warning_filter = WarningFilter()

753

log.addFilter(warning_filter)

754

try:

755

value = string_to_delta("2h")

756

finally:

757

log.removeFilter(warning_filter)

758

self.assertTrue(getattr(warning_filter, "found", False))

759

self.assertEqual(value, datetime.timedelta(0, 7200))

760

761

class Test_TableOfClients(unittest.TestCase):

762

def setUp(self):

763

self.tableheaders = {

764

"Attr1": "X",

765

"AttrTwo": "Yy",

766

"AttrThree": "Zzz",

767

"Bool": "A D-BUS Boolean",

768

"NonDbusBoolean": "A Non-D-BUS Boolean",

769

"Integer": "An Integer",

770

"Timeout": "Timedelta 1",

771

"Interval": "Timedelta 2",

772

"ApprovalDelay": "Timedelta 3",

773

"ApprovalDuration": "Timedelta 4",

774

"ExtendedTimeout": "Timedelta 5",

775

"String": "A String",

776

}

777

self.keywords = ["Attr1", "AttrTwo"]

778

self.clients = [

779

{

780

"Attr1": "x1",

781

"AttrTwo": "y1",

782

"AttrThree": "z1",

783

"Bool": dbus.Boolean(False),

784

"NonDbusBoolean": False,

785

"Integer": 0,

786

"Timeout": 0,

787

"Interval": 1000,

788

"ApprovalDelay": 2000,

789

"ApprovalDuration": 3000,

790

"ExtendedTimeout": 4000,

791

"String": "",

792

},

793

{

794

"Attr1": "x2",

795

"AttrTwo": "y2",

796

"AttrThree": "z2",

797

"Bool": dbus.Boolean(True),

798

"NonDbusBoolean": True,

799

"Integer": 1,

800

"Timeout": 93785000,

801

"Interval": 93786000,

802

"ApprovalDelay": 93787000,

803

"ApprovalDuration": 93788000,

804

"ExtendedTimeout": 93789000,

805

"String": "A huge string which will not fit," * 10,

806

},

807

]

808

def test_short_header(self):

809

text = str(TableOfClients(self.clients, self.keywords,

810

self.tableheaders))

811

expected_text = """

812

X Yy

813

x1 y1

814

x2 y2

815

"""[1:-1]

816

self.assertEqual(text, expected_text)

817

def test_booleans(self):

818

keywords = ["Bool", "NonDbusBoolean"]

819

text = str(TableOfClients(self.clients, keywords,

820

self.tableheaders))

821

expected_text = """

822

A D-BUS Boolean A Non-D-BUS Boolean

823

No False

824

Yes True

825

"""[1:-1]

826

self.assertEqual(text, expected_text)

827

def test_milliseconds_detection(self):

828

keywords = ["Integer", "Timeout", "Interval", "ApprovalDelay",

829

"ApprovalDuration", "ExtendedTimeout"]

830

text = str(TableOfClients(self.clients, keywords,

831

self.tableheaders))

832

expected_text = """

833

An Integer Timedelta 1 Timedelta 2 Timedelta 3 Timedelta 4 Timedelta 5

834

0 00:00:00 00:00:01 00:00:02 00:00:03 00:00:04

835

1 1T02:03:05 1T02:03:06 1T02:03:07 1T02:03:08 1T02:03:09

836

"""[1:-1]

837

self.assertEqual(text, expected_text)

838

def test_empty_and_long_string_values(self):

839

keywords = ["String"]

840

text = str(TableOfClients(self.clients, keywords,

841

self.tableheaders))

842

expected_text = """

843

A String

844

845

A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,

846

"""[1:-1]

847

self.assertEqual(text, expected_text)

848

849

850

851

def should_only_run_tests():

852

parser = argparse.ArgumentParser(add_help=False)

853

parser.add_argument("--check", action='store_true')

854

args, unknown_args = parser.parse_known_args()

855

run_tests = args.check

856

if run_tests:

857

# Remove --check argument from sys.argv

858

sys.argv[1:] = unknown_args

859

return run_tests

860

861

# Add all tests from doctest strings

862

def load_tests(loader, tests, none):

863

import doctest

864

tests.addTests(doctest.DocTestSuite())

865

return tests

866

867

if __name__ == "__main__":

868

if should_only_run_tests():

869

# Call using ./tdd-python-script --check [--verbose]

870

unittest.main()

871

else:

872

main()

178

client.StopChecker()

179

if options.is_valid:

180

sys.exit(0 if client.IsStillValid() else 1)

181

if options.checker:

182

client.SetChecker(options.checker)

183

if options.host:

184

client.SetHost(options.host)

185

if options.interval:

186

client.SetInterval(datetime_to_milliseconds

187

(string_to_delta(options.interval)))

188

if options.timeout:

189

client.SetTimeout(datetime_to_milliseconds

190

(string_to_delta(options.timeout)))

191

if options.secret:

192

client.SetSecret(dbus.ByteArray(open(options.secret, 'rb').read()))

193