/mandos/trunk

# -*- mode: python; coding: utf-8; after-save-hook: (lambda () (let ((command (if (and (boundp 'tramp-file-name-structure) (string-match (car tramp-file-name-structure) (buffer-file-name))) (tramp-file-name-localname (tramp-dissect-file-name (buffer-file-name))) (buffer-file-name)))) (if (= (shell-command (format "%s --check" (shell-quote-argument command)) "*Test*") 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w)) (kill-buffer "*Test*")) (display-buffer "*Test*")))); -*-

#

#

# Copyright © 2008-2019 Teddy Hogeborn

# Copyright © 2008-2019 Björn Påhlsson

#

# This file is part of Mandos.

#

# Mandos is free software: you can redistribute it and/or modify it

# under the terms of the GNU General Public License as published by

#     Mandos is distributed in the hope that it will be useful, but

#     WITHOUT ANY WARRANTY; without even the implied warranty of

#

# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.

#

#

try:

    from future_builtins import *

except ImportError:

    pass

import json

import unittest

import logging

# Show warnings by default

if not sys.warnoptions:

    import warnings

    warnings.simplefilter("default")

 

log = logging.getLogger(sys.argv[0])

logging.basicConfig(level="INFO", # Show info level messages

                    format="%(message)s") # Show basic log messages

 

logging.captureWarnings(True)   # Show warnings via the logging system

 

if sys.version_info.major == 2:

    str = unicode

 

version = "1.8.3"

 

 

try:

    dbus.OBJECT_MANAGER_IFACE

except AttributeError:

    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

 

            .format(days="{}T".format(td.days) if td.days else "",

                    hours=td.seconds // 3600,

                    minutes=(td.seconds % 3600) // 60,

                    seconds=td.seconds % 60))

 

    >>> rfc3339_duration_to_delta("P60M")

    datetime.timedelta(1680)

    >>> # Can not be empty:

    >>> rfc3339_duration_to_delta("")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: u''

    >>> # Must start with "P":

    >>> rfc3339_duration_to_delta("1D")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: u'1D'

    >>> # Must use correct order

    >>> rfc3339_duration_to_delta("PT1S2M")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: u'PT1S2M'

    >>> # Time needs time marker

    >>> rfc3339_duration_to_delta("P1H2S")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: u'P1H2S'

    >>> # Weeks can not be combined with anything else

    >>> rfc3339_duration_to_delta("P1D2W")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: u'P1D2W'

    >>> rfc3339_duration_to_delta("P2W2H")

    Traceback (most recent call last):

    ...

    ValueError: Invalid RFC 3339 duration: u'P2W2H'

 

 

    Token = collections.namedtuple("Token", (

        "regexp",  # To match token; if "value" is not None, must have

                   # a "group" containing digits

        "value",   # datetime.timedelta or None

        "followers"))           # Tokens valid after this token

                         frozenset((token_end, )))

                       frozenset((token_end, )))

                                      token_week)))

    # Define starting values:

    # Value so far

    value = datetime.timedelta()

    # Following valid tokens

    followers = frozenset((token_duration, ))

    # String left to parse

    s = duration

            raise ValueError("Invalid RFC 3339 duration: {!r}"

                             .format(duration))

    """Parse a string and return a datetime.timedelta"""

 

    try:

        return rfc3339_duration_to_delta(interval)

    except ValueError as e:

        log.warning("%s - Parsing as pre-1.6.1 interval instead",

                    ' '.join(e.args))

    return parse_pre_1_6_1_interval(interval)

 

 

def parse_pre_1_6_1_interval(interval):

    """Parse an interval string as documented by Mandos before 1.6.1,

    and return a datetime.timedelta

 

    >>> parse_pre_1_6_1_interval('7d')

    >>> parse_pre_1_6_1_interval('60s')

    >>> parse_pre_1_6_1_interval('60m')

    >>> parse_pre_1_6_1_interval('24h')

    >>> parse_pre_1_6_1_interval('1w')

    >>> parse_pre_1_6_1_interval('5m 30s')

    >>> parse_pre_1_6_1_interval('')

    datetime.timedelta(0)

    >>> # Ignore unknown characters, allow any order and repetitions

    >>> parse_pre_1_6_1_interval('2dxy7zz11y3m5m')

    datetime.timedelta(2, 480, 18000)

 

 

 

 

## Classes for commands.

 

# Abstract classes first

class Command(object):

    """Abstract class for commands"""

    def run(self, mandos, clients):

        """Normal commands should implement run_on_one_client(), but

        commands which want to operate on all clients at the same time

        can override this run() method instead."""

        self.mandos = mandos

        for client in clients:

            self.run_on_one_client(client)

 

class PrintCmd(Command):

    """Abstract class for commands printing client details"""

    all_keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",

                    "Created", "Interval", "Host", "KeyID",

                    "Fingerprint", "CheckerRunning", "LastEnabled",

                    "ApprovalPending", "ApprovedByDefault",

                    "LastApprovalRequest", "ApprovalDelay",

                    "ApprovalDuration", "Checker", "ExtendedTimeout",

                    "Expires", "LastCheckerStatus")

    def run(self, mandos, clients):

        print(self.output(clients))

 

class PropertyCmd(Command):

    """Abstract class for Actions for setting one client property"""

    def run_on_one_client(self, client):

        """Set the Client's D-Bus property"""

        client.Set(client_interface, self.property, self.value_to_set,

                   dbus_interface=dbus.PROPERTIES_IFACE)

 

class ValueArgumentMixIn(object):

    """Mixin class for commands taking a value as argument"""

    def __init__(self, value):

        self.value_to_set = value

 

class MillisecondsValueArgumentMixIn(ValueArgumentMixIn):

    """Mixin class for commands taking a value argument as

    milliseconds."""

    @property

    def value_to_set(self):

        return self._vts

    @value_to_set.setter

    def value_to_set(self, value):

        """When setting, convert value to a datetime.timedelta"""

        self._vts = string_to_delta(value).total_seconds() * 1000

 

# Actual (non-abstract) command classes

 

class PrintTableCmd(PrintCmd):

    def __init__(self, verbose=False):

        self.verbose = verbose

 

    def output(self, clients):

        if self.verbose:

            keywords = self.all_keywords

        else:

            keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")

        return str(self.TableOfClients(clients.values(), keywords))

 

    class TableOfClients(object):

        tableheaders = {

            "Name": "Name",

            "Enabled": "Enabled",

            "Timeout": "Timeout",

            "LastCheckedOK": "Last Successful Check",

            "LastApprovalRequest": "Last Approval Request",

            "Created": "Created",

            "Interval": "Interval",

            "Host": "Host",

            "Fingerprint": "Fingerprint",

            "KeyID": "Key ID",

            "CheckerRunning": "Check Is Running",

            "LastEnabled": "Last Enabled",

            "ApprovalPending": "Approval Is Pending",

            "ApprovedByDefault": "Approved By Default",

            "ApprovalDelay": "Approval Delay",

            "ApprovalDuration": "Approval Duration",

            "Checker": "Checker",

            "ExtendedTimeout": "Extended Timeout",

            "Expires": "Expires",

            "LastCheckerStatus": "Last Checker Status",

        }

 

        def __init__(self, clients, keywords, tableheaders=None):

            self.clients = clients

            self.keywords = keywords

            if tableheaders is not None:

                self.tableheaders = tableheaders

 

        def __str__(self):

            return "\n".join(self.rows())

 

        if sys.version_info.major == 2:

            __unicode__ = __str__

            def __str__(self):

                return str(self).encode(locale.getpreferredencoding())

 

        def rows(self):

            format_string = self.row_formatting_string()

            rows = [self.header_line(format_string)]

            rows.extend(self.client_line(client, format_string)

                        for client in self.clients)

            return rows

 

        def row_formatting_string(self):

            "Format string used to format table rows"

            return " ".join("{{{key}:{width}}}".format(

                width=max(len(self.tableheaders[key]),

                          *(len(self.string_from_client(client, key))

                            for client in self.clients)),

                key=key)

                            for key in self.keywords)

 

        def string_from_client(self, client, key):

            return self.valuetostring(client[key], key)

 

        @staticmethod

        def valuetostring(value, keyword):

            if isinstance(value, dbus.Boolean):

                return "Yes" if value else "No"

            if keyword in ("Timeout", "Interval", "ApprovalDelay",

                           "ApprovalDuration", "ExtendedTimeout"):

                return milliseconds_to_string(value)

            return str(value)

 

        def header_line(self, format_string):

            return format_string.format(**self.tableheaders)

 

        def client_line(self, client, format_string):

            return format_string.format(

                **{key: self.string_from_client(client, key)

                   for key in self.keywords})

 

 

 

class DumpJSONCmd(PrintCmd):

    def output(self, clients):

        data = {client["Name"]:

                {key: self.dbus_boolean_to_bool(client[key])

                 for key in self.all_keywords}

                for client in clients.values()}

        return json.dumps(data, indent=4, separators=(',', ': '))

    @staticmethod

    def dbus_boolean_to_bool(value):

        if isinstance(value, dbus.Boolean):

            value = bool(value)

        return value

 

class IsEnabledCmd(Command):

    def run_on_one_client(self, client):

        if self.is_enabled(client):

            sys.exit(0)

        sys.exit(1)

    def is_enabled(self, client):

        return client.Get(client_interface, "Enabled",

                          dbus_interface=dbus.PROPERTIES_IFACE)

 

class RemoveCmd(Command):

    def run_on_one_client(self, client):

        self.mandos.RemoveClient(client.__dbus_object_path__)

 

class ApproveCmd(Command):

    def run_on_one_client(self, client):

        client.Approve(dbus.Boolean(True),

                       dbus_interface=client_interface)

 

class DenyCmd(Command):

    def run_on_one_client(self, client):

        client.Approve(dbus.Boolean(False),

                       dbus_interface=client_interface)

 

class EnableCmd(PropertyCmd):

    property = "Enabled"

    value_to_set = dbus.Boolean(True)

 

class DisableCmd(PropertyCmd):

    property = "Enabled"

    value_to_set = dbus.Boolean(False)

 

class BumpTimeoutCmd(PropertyCmd):

    property = "LastCheckedOK"

    value_to_set = ""

 

class StartCheckerCmd(PropertyCmd):

    property = "CheckerRunning"

    value_to_set = dbus.Boolean(True)

 

class StopCheckerCmd(PropertyCmd):

    property = "CheckerRunning"

    value_to_set = dbus.Boolean(False)

 

class ApproveByDefaultCmd(PropertyCmd):

    property = "ApprovedByDefault"

    value_to_set = dbus.Boolean(True)

 

class DenyByDefaultCmd(PropertyCmd):

    property = "ApprovedByDefault"

    value_to_set = dbus.Boolean(False)

 

class SetCheckerCmd(PropertyCmd, ValueArgumentMixIn):

    property = "Checker"

 

class SetHostCmd(PropertyCmd, ValueArgumentMixIn):

    property = "Host"

 

class SetSecretCmd(PropertyCmd, ValueArgumentMixIn):

    property = "Secret"

 

class SetTimeoutCmd(PropertyCmd, MillisecondsValueArgumentMixIn):

    property = "Timeout"

 

class SetExtendedTimeoutCmd(PropertyCmd,

                            MillisecondsValueArgumentMixIn):

    property = "ExtendedTimeout"

 

class SetIntervalCmd(PropertyCmd, MillisecondsValueArgumentMixIn):

    property = "Interval"

 

class SetApprovalDelayCmd(PropertyCmd,

                          MillisecondsValueArgumentMixIn):

    property = "ApprovalDelay"

 

class SetApprovalDurationCmd(PropertyCmd,

                             MillisecondsValueArgumentMixIn):

    property = "ApprovalDuration"

 

def commands_and_clients_from_options(args=None):

    if args is None:

        args=sys.argv[1:]

                        version="%(prog)s {}".format(version),

    parser.add_argument("-j", "--dump-json", action="store_true",

                        help="Dump client data in JSON format")

    enable_disable = parser.add_mutually_exclusive_group()

    enable_disable.add_argument("-e", "--enable", action="store_true",

                                help="Enable client")

    enable_disable.add_argument("-d", "--disable",

                                action="store_true",

                                help="disable client")

    start_stop_checker = parser.add_mutually_exclusive_group()

    start_stop_checker.add_argument("--start-checker",

                                    action="store_true",

                                    help="Start checker for client")

    start_stop_checker.add_argument("--stop-checker",

                                    action="store_true",

                                    help="Stop checker for client")

    approve_deny_default = parser.add_mutually_exclusive_group()

    approve_deny_default.add_argument(

        "--approve-by-default", action="store_true",

        default=None, dest="approved_by_default",

        help="Set client to be approved by default")

    approve_deny_default.add_argument(

        "--deny-by-default", action="store_false",

        dest="approved_by_default",

        help="Set client to be denied by default")

    parser.add_argument("-s", "--secret",

                        type=argparse.FileType(mode="rb"),

    approve_deny = parser.add_mutually_exclusive_group()

    approve_deny.add_argument(

        "-A", "--approve", action="store_true",

        help="Approve any current client request")

    approve_deny.add_argument("-D", "--deny", action="store_true",

                              help="Deny any current client request")

    options = parser.parse_args(args=args)

 

        parser.error("--verbose can only be used alone.")

    if options.dump_json and (options.verbose

                              or has_actions(options)):

        parser.error("--dump-json can only be used alone.")

    if options.is_enabled and len(options.client) > 1:

            parser.error("--is-enabled requires exactly one client")

 

    commands = []

 

    if options.dump_json:

        commands.append(DumpJSONCmd())

 

    if options.enable:

        commands.append(EnableCmd())

 

    if options.disable:

        commands.append(DisableCmd())

 

    if options.bump_timeout:

        commands.append(BumpTimeoutCmd(options.bump_timeout))

 

    if options.start_checker:

        commands.append(StartCheckerCmd())

 

    if options.stop_checker:

        commands.append(StopCheckerCmd())

 

    if options.is_enabled:

        commands.append(IsEnabledCmd())

 

    if options.remove:

        commands.append(RemoveCmd())

 

    if options.checker is not None:

        commands.append(SetCheckerCmd())

 

    if options.timeout is not None:

        commands.append(SetTimeoutCmd(options.timeout))

 

    if options.extended_timeout:

        commands.append(

            SetExtendedTimeoutCmd(options.extended_timeout))

 

    if options.interval is not None:

        command.append(SetIntervalCmd(options.interval))

 

    if options.approved_by_default is not None:

        if options.approved_by_default:

            command.append(ApproveByDefaultCmd())

        else:

            command.append(DenyByDefaultCmd())

 

    if options.approval_delay is not None:

        command.append(SetApprovalDelayCmd(options.approval_delay))

 

    if options.approval_duration is not None:

        command.append(

            SetApprovalDurationCmd(options.approval_duration))

 

    if options.host is not None:

        command.append(SetHostCmd(options.host))

 

    if options.secret is not None:

        command.append(SetSecretCmd(options.secret))

 

    if options.approve:

        commands.append(ApproveCmd())

 

    if options.deny:

        commands.append(DenyCmd())

 

    # If no command option has been given, show table of clients,

    # optionally verbosely

    if not commands:

        commands.append(PrintTableCmd(verbose=options.verbose))

 

    return commands, options.client

 

 

def main():

    commands, clientnames = commands_and_clients_from_options()

 

        log.critical("Could not connect to Mandos server")

 

                                 dbus_interface=server_interface)

    mandos_serv_object_manager = dbus.Interface(

        mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)

 

    # Filter out log message from dbus module

    dbus_logger = logging.getLogger("dbus.proxies")

    class NullFilter(logging.Filter):

        def filter(self, record):

            return False

    dbus_filter = NullFilter()

    dbus_logger.addFilter(dbus_filter)

            mandos_clients = {path: ifs_and_props[client_interface]

                              for path, ifs_and_props in

                              mandos_serv_object_manager

                              .GetManagedObjects().items()

                              if client_interface in ifs_and_props}

            # restore dbus logger

            dbus_logger.removeFilter(dbus_filter)

    except dbus.exceptions.DBusException as e:

        log.critical("Failed to access Mandos server through D-Bus:"

                     "\n%s", e)

 

    clients = {}

 

    if not clientnames:

        clients = {bus.get_object(busname, path): properties

                   for path, properties in mandos_clients.items()}

        for name in clientnames:

            for path, client in mandos_clients.items():

                log.critical("Client not found on server: %r", name)

 

    # Run all commands on clients

    for command in commands:

        command.run(mandos_serv, clients)

 

 

class Test_milliseconds_to_string(unittest.TestCase):

    def test_all(self):

        self.assertEqual(milliseconds_to_string(93785000),

                         "1T02:03:05")

    def test_no_days(self):

        self.assertEqual(milliseconds_to_string(7385000), "02:03:05")

    def test_all_zero(self):

        self.assertEqual(milliseconds_to_string(0), "00:00:00")

    def test_no_fractional_seconds(self):

        self.assertEqual(milliseconds_to_string(400), "00:00:00")

        self.assertEqual(milliseconds_to_string(900), "00:00:00")

        self.assertEqual(milliseconds_to_string(1900), "00:00:01")

 

class Test_string_to_delta(unittest.TestCase):

    def test_handles_basic_rfc3339(self):

        self.assertEqual(string_to_delta("PT2H"),

                         datetime.timedelta(0, 7200))

    def test_falls_back_to_pre_1_6_1_with_warning(self):

        # assertLogs only exists in Python 3.4

        if hasattr(self, "assertLogs"):

            with self.assertLogs(log, logging.WARNING):

                value = string_to_delta("2h")

            class WarningFilter(logging.Filter):

                """Don't show, but record the presence of, warnings"""

                def filter(self, record):

                    is_warning = record.levelno >= logging.WARNING

                    self.found = is_warning or getattr(self, "found",

                                                       False)

                    return not is_warning

            warning_filter = WarningFilter()

            log.addFilter(warning_filter)

            try:

                value = string_to_delta("2h")

            finally:

                log.removeFilter(warning_filter)

            self.assertTrue(getattr(warning_filter, "found", False))

        self.assertEqual(value, datetime.timedelta(0, 7200))

 

 

class TestCmd(unittest.TestCase):

    """Abstract class for tests of command classes"""

    def setUp(self):

        testcase = self

        class MockClient(object):

            def __init__(self, name, **attributes):

                self.__dbus_object_path__ = "objpath_{}".format(name)

                self.attributes = attributes

                self.attributes["Name"] = name

            def Set(interface, property, value,

                    properties_interface):

                testcase.assertEqual(interface, client_interface)

                testcase.assertEqual(properties_interface,

                                     dbus.PROPERTIES_IFACE)

                self.attributes[property] = value

            def Get(interface, property, properties_interface):

                testcase.assertEqual(interface, client_interface)

                testcase.assertEqual(properties_interface,

                                     dbus.PROPERTIES_IFACE)

                return self.attributes[property]

            def __getitem__(self, key):

                return self.attributes[key]

        self.clients = collections.OrderedDict([

            ("foo",

             MockClient(

                 "foo",

                 KeyID=("92ed150794387c03ce684574b1139a65"

                        "94a34f895daaaf09fd8ea90a27cddb12"),

                 Secret=b"secret",

                 Host="foo.example.org",

                 Enabled=dbus.Boolean(True),

                 Timeout=300000,

                 LastCheckedOK="2019-02-03T00:00:00",

                 Created="2019-01-02T00:00:00",

                 Interval=120000,

                 Fingerprint=("778827225BA7DE539C5A"

                              "7CFA59CFF7CDBD9A5920"),

                 CheckerRunning=dbus.Boolean(False),

                 LastEnabled="2019-01-03T00:00:00",

                 ApprovalPending=dbus.Boolean(False),

                 ApprovedByDefault=dbus.Boolean(True),

                 LastApprovalRequest="",

                 ApprovalDelay=0,

                 ApprovalDuration=1000,

                 Checker="fping -q -- %(host)s",

                 ExtendedTimeout=900000,

                 Expires="2019-02-04T00:00:00",

                 LastCheckerStatus=0)),

            ("barbar",

             MockClient(

                 "barbar",

                 KeyID=("0558568eedd67d622f5c83b35a115f79"

                        "6ab612cff5ad227247e46c2b020f441c"),

                 Secret=b"secretbar",

                 Host="192.0.2.3",

                 Enabled=dbus.Boolean(True),

                 Timeout=300000,

                 LastCheckedOK="2019-02-04T00:00:00",

                 Created="2019-01-03T00:00:00",

                 Interval=120000,

                 Fingerprint=("3E393AEAEFB84C7E89E2"

                              "F547B3A107558FCA3A27"),

                 CheckerRunning=dbus.Boolean(True),

                 LastEnabled="2019-01-04T00:00:00",

                 ApprovalPending=dbus.Boolean(False),

                 ApprovedByDefault=dbus.Boolean(False),

                 LastApprovalRequest="2019-01-03T00:00:00",

                 ApprovalDelay=30000,

                 ApprovalDuration=1000,

                 Checker=":",

                 ExtendedTimeout=900000,

                 Expires="2019-02-05T00:00:00",

                 LastCheckerStatus=-2)),

            ])

 

class TestPrintTableCmd(TestCmd):

    def test_normal(self):

        output = PrintTableCmd().output(self.clients)

        expected_output = """

Name   Enabled Timeout  Last Successful Check

foo    Yes     00:05:00 2019-02-03T00:00:00  

barbar Yes     00:05:00 2019-02-04T00:00:00  

"""[1:-1]

        self.assertEqual(output, expected_output)

    def test_verbose(self):

        output = PrintTableCmd(verbose=True).output(self.clients)

        expected_output = """

Name   Enabled Timeout  Last Successful Check Created             Interval Host            Key ID                                                           Fingerprint                              Check Is Running Last Enabled        Approval Is Pending Approved By Default Last Approval Request Approval Delay Approval Duration Checker              Extended Timeout Expires             Last Checker Status

foo    Yes     00:05:00 2019-02-03T00:00:00   2019-01-02T00:00:00 00:02:00 foo.example.org 92ed150794387c03ce684574b1139a6594a34f895daaaf09fd8ea90a27cddb12 778827225BA7DE539C5A7CFA59CFF7CDBD9A5920 No               2019-01-03T00:00:00 No                  Yes                                       00:00:00       00:00:01          fping -q -- %(host)s 00:15:00         2019-02-04T00:00:00 0                  

barbar Yes     00:05:00 2019-02-04T00:00:00   2019-01-03T00:00:00 00:02:00 192.0.2.3       0558568eedd67d622f5c83b35a115f796ab612cff5ad227247e46c2b020f441c 3E393AEAEFB84C7E89E2F547B3A107558FCA3A27 Yes              2019-01-04T00:00:00 No                  No                  2019-01-03T00:00:00   00:00:30       00:00:01          :                    00:15:00         2019-02-05T00:00:00 -2                 

"""[1:-1]

        self.assertEqual(output, expected_output)

    def test_one_client(self):

        output = PrintTableCmd().output({"foo": self.clients["foo"]})

        expected_output = """

Name Enabled Timeout  Last Successful Check

foo  Yes     00:05:00 2019-02-03T00:00:00  

"""[1:-1]

        self.assertEqual(output, expected_output)

 

 

 

def should_only_run_tests():

    parser = argparse.ArgumentParser(add_help=False)

    parser.add_argument("--check", action='store_true')

    args, unknown_args = parser.parse_known_args()

    run_tests = args.check

    if run_tests:

        # Remove --check argument from sys.argv

        sys.argv[1:] = unknown_args

    return run_tests

 

# Add all tests from doctest strings

def load_tests(loader, tests, none):

    import doctest

    tests.addTests(doctest.DocTestSuite())

    return tests

    if should_only_run_tests():

        # Call using ./tdd-python-script --check [--verbose]

        unittest.main()

    else:

        main()