65
52
    "ApprovalDelay": "Approval Delay",
 
66
53
    "ApprovalDuration": "Approval Duration",
 
67
54
    "Checker": "Checker",
 
68
 
    "ExtendedTimeout": "Extended Timeout",
 
70
 
    "LastCheckerStatus": "Last Checker Status",
 
 
55
    "ExtendedTimeout" : "Extended Timeout"
 
72
57
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
 
73
58
domain = "se.recompile"
 
74
59
busname = domain + ".Mandos"
 
76
61
server_interface = domain + ".Mandos"
 
77
62
client_interface = domain + ".Mandos.Client"
 
82
 
    dbus.OBJECT_MANAGER_IFACE
 
83
 
except AttributeError:
 
84
 
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
 
 
65
def timedelta_to_milliseconds(td):
 
 
66
    """Convert a datetime.timedelta object to milliseconds"""
 
 
67
    return ((td.days * 24 * 60 * 60 * 1000)
 
 
69
            + (td.microseconds // 1000))
 
87
71
def milliseconds_to_string(ms):
 
88
72
    td = datetime.timedelta(0, 0, 0, ms)
 
89
 
    return ("{days}{hours:02}:{minutes:02}:{seconds:02}"
 
90
 
            .format(days="{}T".format(td.days) if td.days else "",
 
91
 
                    hours=td.seconds // 3600,
 
92
 
                    minutes=(td.seconds % 3600) // 60,
 
93
 
                    seconds=td.seconds % 60))
 
96
 
def rfc3339_duration_to_delta(duration):
 
97
 
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
 
99
 
    >>> rfc3339_duration_to_delta("P7D")
 
100
 
    datetime.timedelta(7)
 
101
 
    >>> rfc3339_duration_to_delta("PT60S")
 
102
 
    datetime.timedelta(0, 60)
 
103
 
    >>> rfc3339_duration_to_delta("PT60M")
 
104
 
    datetime.timedelta(0, 3600)
 
105
 
    >>> rfc3339_duration_to_delta("PT24H")
 
106
 
    datetime.timedelta(1)
 
107
 
    >>> rfc3339_duration_to_delta("P1W")
 
108
 
    datetime.timedelta(7)
 
109
 
    >>> rfc3339_duration_to_delta("PT5M30S")
 
110
 
    datetime.timedelta(0, 330)
 
111
 
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
112
 
    datetime.timedelta(1, 200)
 
115
 
    # Parsing an RFC 3339 duration with regular expressions is not
 
116
 
    # possible - there would have to be multiple places for the same
 
117
 
    # values, like seconds.  The current code, while more esoteric, is
 
118
 
    # cleaner without depending on a parsing library.  If Python had a
 
119
 
    # built-in library for parsing we would use it, but we'd like to
 
120
 
    # avoid excessive use of external libraries.
 
122
 
    # New type for defining tokens, syntax, and semantics all-in-one
 
123
 
    Token = collections.namedtuple("Token", (
 
124
 
        "regexp",  # To match token; if "value" is not None, must have
 
125
 
                   # a "group" containing digits
 
126
 
        "value",   # datetime.timedelta or None
 
127
 
        "followers"))           # Tokens valid after this token
 
128
 
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
 
129
 
    # the "duration" ABNF definition in RFC 3339, Appendix A.
 
130
 
    token_end = Token(re.compile(r"$"), None, frozenset())
 
131
 
    token_second = Token(re.compile(r"(\d+)S"),
 
132
 
                         datetime.timedelta(seconds=1),
 
133
 
                         frozenset((token_end, )))
 
134
 
    token_minute = Token(re.compile(r"(\d+)M"),
 
135
 
                         datetime.timedelta(minutes=1),
 
136
 
                         frozenset((token_second, token_end)))
 
137
 
    token_hour = Token(re.compile(r"(\d+)H"),
 
138
 
                       datetime.timedelta(hours=1),
 
139
 
                       frozenset((token_minute, token_end)))
 
140
 
    token_time = Token(re.compile(r"T"),
 
142
 
                       frozenset((token_hour, token_minute,
 
144
 
    token_day = Token(re.compile(r"(\d+)D"),
 
145
 
                      datetime.timedelta(days=1),
 
146
 
                      frozenset((token_time, token_end)))
 
147
 
    token_month = Token(re.compile(r"(\d+)M"),
 
148
 
                        datetime.timedelta(weeks=4),
 
149
 
                        frozenset((token_day, token_end)))
 
150
 
    token_year = Token(re.compile(r"(\d+)Y"),
 
151
 
                       datetime.timedelta(weeks=52),
 
152
 
                       frozenset((token_month, token_end)))
 
153
 
    token_week = Token(re.compile(r"(\d+)W"),
 
154
 
                       datetime.timedelta(weeks=1),
 
155
 
                       frozenset((token_end, )))
 
156
 
    token_duration = Token(re.compile(r"P"), None,
 
157
 
                           frozenset((token_year, token_month,
 
158
 
                                      token_day, token_time,
 
160
 
    # Define starting values:
 
162
 
    value = datetime.timedelta()
 
164
 
    # Following valid tokens
 
165
 
    followers = frozenset((token_duration, ))
 
166
 
    # String left to parse
 
168
 
    # Loop until end token is found
 
169
 
    while found_token is not token_end:
 
170
 
        # Search for any currently valid tokens
 
171
 
        for token in followers:
 
172
 
            match = token.regexp.match(s)
 
173
 
            if match is not None:
 
175
 
                if token.value is not None:
 
176
 
                    # Value found, parse digits
 
177
 
                    factor = int(match.group(1), 10)
 
178
 
                    # Add to value so far
 
179
 
                    value += factor * token.value
 
180
 
                # Strip token from string
 
181
 
                s = token.regexp.sub("", s, 1)
 
184
 
                # Set valid next tokens
 
185
 
                followers = found_token.followers
 
188
 
            # No currently valid tokens were found
 
189
 
            raise ValueError("Invalid RFC 3339 duration: {!r}"
 
 
73
    return ("%(days)s%(hours)02d:%(minutes)02d:%(seconds)02d"
 
 
74
            % { "days": "%dT" % td.days if td.days else "",
 
 
75
                "hours": td.seconds // 3600,
 
 
76
                "minutes": (td.seconds % 3600) // 60,
 
 
77
                "seconds": td.seconds % 60,
 
195
80
def string_to_delta(interval):
 
196
81
    """Parse a string and return a datetime.timedelta
 
198
 
    >>> string_to_delta('7d')
 
 
83
    >>> string_to_delta("7d")
 
199
84
    datetime.timedelta(7)
 
200
 
    >>> string_to_delta('60s')
 
 
85
    >>> string_to_delta("60s")
 
201
86
    datetime.timedelta(0, 60)
 
202
 
    >>> string_to_delta('60m')
 
 
87
    >>> string_to_delta("60m")
 
203
88
    datetime.timedelta(0, 3600)
 
204
 
    >>> string_to_delta('24h')
 
 
89
    >>> string_to_delta("24h")
 
205
90
    datetime.timedelta(1)
 
206
 
    >>> string_to_delta('1w')
 
 
91
    >>> string_to_delta("1w")
 
207
92
    datetime.timedelta(7)
 
208
 
    >>> string_to_delta('5m 30s')
 
 
93
    >>> string_to_delta("5m 30s")
 
209
94
    datetime.timedelta(0, 330)
 
213
 
        return rfc3339_duration_to_delta(interval)
 
217
96
    value = datetime.timedelta(0)
 
218
 
    regexp = re.compile(r"(\d+)([dsmhw]?)")
 
 
97
    regexp = re.compile("(\d+)([dsmhw]?)")
 
220
99
    for num, suffix in regexp.findall(interval):
 
221
100
        if suffix == "d":
 
222
101
            value += datetime.timedelta(int(num))
 
 
322
196
    parser.add_argument("--approval-duration",
 
323
197
                        help="Set duration of one client approval")
 
324
198
    parser.add_argument("-H", "--host", help="Set host for client")
 
325
 
    parser.add_argument("-s", "--secret",
 
326
 
                        type=argparse.FileType(mode="rb"),
 
 
199
    parser.add_argument("-s", "--secret", type=file,
 
327
200
                        help="Set password blob (file) for client")
 
328
201
    parser.add_argument("-A", "--approve", action="store_true",
 
329
202
                        help="Approve any current client request")
 
330
203
    parser.add_argument("-D", "--deny", action="store_true",
 
331
204
                        help="Deny any current client request")
 
332
 
    parser.add_argument("--check", action="store_true",
 
333
 
                        help="Run self-test")
 
334
205
    parser.add_argument("client", nargs="*", help="Client name")
 
335
206
    options = parser.parse_args()
 
337
 
    if has_actions(options) and not (options.client or options.all):
 
 
208
    if has_actions(options) and not options.client and not options.all:
 
338
209
        parser.error("Options require clients names or --all.")
 
339
210
    if options.verbose and has_actions(options):
 
340
 
        parser.error("--verbose can only be used alone.")
 
341
 
    if options.dump_json and (options.verbose
 
342
 
                              or has_actions(options)):
 
343
 
        parser.error("--dump-json can only be used alone.")
 
 
211
        parser.error("--verbose can only be used alone or with"
 
344
213
    if options.all and not has_actions(options):
 
345
214
        parser.error("--all requires an action.")
 
348
 
        fail_count, test_count = doctest.testmod()
 
349
 
        sys.exit(os.EX_OK if fail_count == 0 else 1)
 
352
217
        bus = dbus.SystemBus()
 
353
218
        mandos_dbus_objc = bus.get_object(busname, server_path)
 
354
219
    except dbus.exceptions.DBusException:
 
355
 
        print("Could not connect to Mandos server", file=sys.stderr)
 
 
220
        print("Could not connect to Mandos server",
 
358
224
    mandos_serv = dbus.Interface(mandos_dbus_objc,
 
359
 
                                 dbus_interface=server_interface)
 
360
 
    mandos_serv_object_manager = dbus.Interface(
 
361
 
        mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)
 
363
 
    # block stderr since dbus library prints to stderr
 
 
225
                                 dbus_interface = server_interface)
 
 
227
    #block stderr since dbus library prints to stderr
 
364
228
    null = os.open(os.path.devnull, os.O_RDWR)
 
365
229
    stderrcopy = os.dup(sys.stderr.fileno())
 
366
230
    os.dup2(null, sys.stderr.fileno())
 
370
 
            mandos_clients = {path: ifs_and_props[client_interface]
 
371
 
                              for path, ifs_and_props in
 
372
 
                              mandos_serv_object_manager
 
373
 
                              .GetManagedObjects().items()
 
374
 
                              if client_interface in ifs_and_props}
 
 
234
            mandos_clients = mandos_serv.GetAllClientsWithProperties()
 
377
237
            os.dup2(stderrcopy, sys.stderr.fileno())
 
378
238
            os.close(stderrcopy)
 
379
 
    except dbus.exceptions.DBusException as e:
 
380
 
        print("Access denied: "
 
381
 
              "Accessing mandos server through D-Bus: {}".format(e),
 
 
239
    except dbus.exceptions.DBusException, e:
 
 
240
        print("Access denied: Accessing mandos server through dbus.",
 
385
244
    # Compile dict of (clients: properties) to process
 
388
247
    if options.all or not options.client:
 
389
 
        clients = {bus.get_object(busname, path): properties
 
390
 
                   for path, properties in mandos_clients.items()}
 
 
248
        clients = dict((bus.get_object(busname, path), properties)
 
 
249
                       for path, properties in
 
 
250
                       mandos_clients.iteritems())
 
392
252
        for name in options.client:
 
393
 
            for path, client in mandos_clients.items():
 
 
253
            for path, client in mandos_clients.iteritems():
 
394
254
                if client["Name"] == name:
 
395
255
                    client_objc = bus.get_object(busname, path)
 
396
256
                    clients[client_objc] = client
 
399
 
                print("Client not found on server: {!r}"
 
400
 
                      .format(name), file=sys.stderr)
 
 
259
                print("Client not found on server: %r" % name,
 
403
263
    if not has_actions(options) and clients:
 
404
 
        if options.verbose or options.dump_json:
 
405
 
            keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
 
406
 
                        "Created", "Interval", "Host", "Fingerprint",
 
407
 
                        "CheckerRunning", "LastEnabled",
 
408
 
                        "ApprovalPending", "ApprovedByDefault",
 
 
265
            keywords = ("Name", "Enabled", "Timeout",
 
 
266
                        "LastCheckedOK", "Created", "Interval",
 
 
267
                        "Host", "Fingerprint", "CheckerRunning",
 
 
268
                        "LastEnabled", "ApprovalPending",
 
409
270
                        "LastApprovalRequest", "ApprovalDelay",
 
410
271
                        "ApprovalDuration", "Checker",
 
411
 
                        "ExtendedTimeout", "Expires",
 
414
274
            keywords = defaultkeywords
 
416
 
        if options.dump_json:
 
417
 
            json.dump({client["Name"]: {key:
 
419
 
                                        if isinstance(client[key],
 
423
 
                       for client in clients.values()},
 
424
 
                      fp=sys.stdout, indent=4,
 
425
 
                      separators=(',', ': '))
 
428
 
            print_clients(clients.values(), keywords)
 
 
276
        print_clients(clients.values(), keywords)
 
430
278
        # Process each client in the list by all selected options
 
431
279
        for client in clients:
 
433
 
            def set_client_prop(prop, value):
 
434
 
                """Set a Client D-Bus property"""
 
435
 
                client.Set(client_interface, prop, value,
 
436
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
438
 
            def set_client_prop_ms(prop, value):
 
439
 
                """Set a Client D-Bus property, converted
 
440
 
                from a string to milliseconds."""
 
441
 
                set_client_prop(prop,
 
442
 
                                string_to_delta(value).total_seconds()
 
445
280
            if options.remove:
 
446
281
                mandos_serv.RemoveClient(client.__dbus_object_path__)
 
447
282
            if options.enable:
 
448
 
                set_client_prop("Enabled", dbus.Boolean(True))
 
 
283
                client.Enable(dbus_interface=client_interface)
 
449
284
            if options.disable:
 
450
 
                set_client_prop("Enabled", dbus.Boolean(False))
 
 
285
                client.Disable(dbus_interface=client_interface)
 
451
286
            if options.bump_timeout:
 
452
 
                set_client_prop("LastCheckedOK", "")
 
 
287
                client.CheckedOK(dbus_interface=client_interface)
 
453
288
            if options.start_checker:
 
454
 
                set_client_prop("CheckerRunning", dbus.Boolean(True))
 
 
289
                client.StartChecker(dbus_interface=client_interface)
 
455
290
            if options.stop_checker:
 
456
 
                set_client_prop("CheckerRunning", dbus.Boolean(False))
 
 
291
                client.StopChecker(dbus_interface=client_interface)
 
457
292
            if options.is_enabled:
 
458
 
                if client.Get(client_interface, "Enabled",
 
459
 
                              dbus_interface=dbus.PROPERTIES_IFACE):
 
 
293
                sys.exit(0 if client.Get(client_interface,
 
 
296
                                         dbus.PROPERTIES_IFACE)
 
463
298
            if options.checker is not None:
 
464
 
                set_client_prop("Checker", options.checker)
 
 
299
                client.Set(client_interface, "Checker",
 
 
301
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
465
302
            if options.host is not None:
 
466
 
                set_client_prop("Host", options.host)
 
 
303
                client.Set(client_interface, "Host", options.host,
 
 
304
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
467
305
            if options.interval is not None:
 
468
 
                set_client_prop_ms("Interval", options.interval)
 
 
306
                client.Set(client_interface, "Interval",
 
 
307
                           timedelta_to_milliseconds
 
 
308
                           (string_to_delta(options.interval)),
 
 
309
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
469
310
            if options.approval_delay is not None:
 
470
 
                set_client_prop_ms("ApprovalDelay",
 
471
 
                                   options.approval_delay)
 
 
311
                client.Set(client_interface, "ApprovalDelay",
 
 
312
                           timedelta_to_milliseconds
 
 
313
                           (string_to_delta(options.
 
 
315
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
472
316
            if options.approval_duration is not None:
 
473
 
                set_client_prop_ms("ApprovalDuration",
 
474
 
                                   options.approval_duration)
 
 
317
                client.Set(client_interface, "ApprovalDuration",
 
 
318
                           timedelta_to_milliseconds
 
 
319
                           (string_to_delta(options.
 
 
321
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
475
322
            if options.timeout is not None:
 
476
 
                set_client_prop_ms("Timeout", options.timeout)
 
 
323
                client.Set(client_interface, "Timeout",
 
 
324
                           timedelta_to_milliseconds
 
 
325
                           (string_to_delta(options.timeout)),
 
 
326
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
477
327
            if options.extended_timeout is not None:
 
478
 
                set_client_prop_ms("ExtendedTimeout",
 
479
 
                                   options.extended_timeout)
 
 
328
                client.Set(client_interface, "ExtendedTimeout",
 
 
329
                           timedelta_to_milliseconds
 
 
330
                           (string_to_delta(options.extended_timeout)),
 
 
331
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
480
332
            if options.secret is not None:
 
481
 
                set_client_prop("Secret",
 
482
 
                                dbus.ByteArray(options.secret.read()))
 
 
333
                client.Set(client_interface, "Secret",
 
 
334
                           dbus.ByteArray(open(options.secret,
 
 
336
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
483
337
            if options.approved_by_default is not None:
 
484
 
                set_client_prop("ApprovedByDefault",
 
486
 
                                             .approved_by_default))
 
 
338
                client.Set(client_interface, "ApprovedByDefault",
 
 
340
                                        .approved_by_default),
 
 
341
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
487
342
            if options.approve:
 
488
343
                client.Approve(dbus.Boolean(True),
 
489
344
                               dbus_interface=client_interface)