103
109
datetime.timedelta(0, 330)
104
110
>>> rfc3339_duration_to_delta("P1DT3M20S")
105
111
datetime.timedelta(1, 200)
106
>>> # Can not be empty:
107
>>> rfc3339_duration_to_delta("")
108
Traceback (most recent call last):
110
ValueError: Invalid RFC 3339 duration: u''
111
>>> # Must start with "P":
112
>>> rfc3339_duration_to_delta("1D")
113
Traceback (most recent call last):
115
ValueError: Invalid RFC 3339 duration: u'1D'
116
>>> # Must use correct order
117
>>> rfc3339_duration_to_delta("PT1S2M")
118
Traceback (most recent call last):
120
ValueError: Invalid RFC 3339 duration: u'PT1S2M'
121
>>> # Time needs time marker
122
>>> rfc3339_duration_to_delta("P1H2S")
123
Traceback (most recent call last):
125
ValueError: Invalid RFC 3339 duration: u'P1H2S'
126
>>> # Weeks can not be combined with anything else
127
>>> rfc3339_duration_to_delta("P1D2W")
128
Traceback (most recent call last):
130
ValueError: Invalid RFC 3339 duration: u'P1D2W'
131
>>> rfc3339_duration_to_delta("P2W2H")
132
Traceback (most recent call last):
134
ValueError: Invalid RFC 3339 duration: u'P2W2H'
137
114
# Parsing an RFC 3339 duration with regular expressions is not
138
115
# possible - there would have to be multiple places for the same
139
116
# values, like seconds. The current code, while more esoteric, is
140
117
# cleaner without depending on a parsing library. If Python had a
141
118
# built-in library for parsing we would use it, but we'd like to
142
119
# avoid excessive use of external libraries.
144
121
# New type for defining tokens, syntax, and semantics all-in-one
145
122
Token = collections.namedtuple("Token", (
146
123
"regexp", # To match token; if "value" is not None, must have
217
191
def string_to_delta(interval):
218
"""Parse a string and return a datetime.timedelta"""
192
"""Parse a string and return a datetime.timedelta
194
>>> string_to_delta('7d')
195
datetime.timedelta(7)
196
>>> string_to_delta('60s')
197
datetime.timedelta(0, 60)
198
>>> string_to_delta('60m')
199
datetime.timedelta(0, 3600)
200
>>> string_to_delta('24h')
201
datetime.timedelta(1)
202
>>> string_to_delta('1w')
203
datetime.timedelta(7)
204
>>> string_to_delta('5m 30s')
205
datetime.timedelta(0, 330)
221
209
return rfc3339_duration_to_delta(interval)
222
except ValueError as e:
223
log.warning("%s - Parsing as pre-1.6.1 interval instead",
225
return parse_pre_1_6_1_interval(interval)
228
def parse_pre_1_6_1_interval(interval):
229
"""Parse an interval string as documented by Mandos before 1.6.1,
230
and return a datetime.timedelta
232
>>> parse_pre_1_6_1_interval('7d')
233
datetime.timedelta(7)
234
>>> parse_pre_1_6_1_interval('60s')
235
datetime.timedelta(0, 60)
236
>>> parse_pre_1_6_1_interval('60m')
237
datetime.timedelta(0, 3600)
238
>>> parse_pre_1_6_1_interval('24h')
239
datetime.timedelta(1)
240
>>> parse_pre_1_6_1_interval('1w')
241
datetime.timedelta(7)
242
>>> parse_pre_1_6_1_interval('5m 30s')
243
datetime.timedelta(0, 330)
244
>>> parse_pre_1_6_1_interval('')
245
datetime.timedelta(0)
246
>>> # Ignore unknown characters, allow any order and repetitions
247
>>> parse_pre_1_6_1_interval('2dxy7zz11y3m5m')
248
datetime.timedelta(2, 480, 18000)
252
213
value = datetime.timedelta(0)
253
214
regexp = re.compile(r"(\d+)([dsmhw]?)")
255
216
for num, suffix in regexp.findall(interval):
256
217
if suffix == "d":
257
218
value += datetime.timedelta(int(num))
271
class TableOfClients(object):
274
"Enabled": "Enabled",
275
"Timeout": "Timeout",
276
"LastCheckedOK": "Last Successful Check",
277
"LastApprovalRequest": "Last Approval Request",
278
"Created": "Created",
279
"Interval": "Interval",
281
"Fingerprint": "Fingerprint",
283
"CheckerRunning": "Check Is Running",
284
"LastEnabled": "Last Enabled",
285
"ApprovalPending": "Approval Is Pending",
286
"ApprovedByDefault": "Approved By Default",
287
"ApprovalDelay": "Approval Delay",
288
"ApprovalDuration": "Approval Duration",
289
"Checker": "Checker",
290
"ExtendedTimeout": "Extended Timeout",
291
"Expires": "Expires",
292
"LastCheckerStatus": "Last Checker Status",
295
def __init__(self, clients, keywords, tableheaders=None):
296
self.clients = clients
297
self.keywords = keywords
298
if tableheaders is not None:
299
self.tableheaders = tableheaders
302
return "\n".join(self.rows())
304
if sys.version_info.major == 2:
305
__unicode__ = __str__
307
return str(self).encode(locale.getpreferredencoding())
310
format_string = self.row_formatting_string()
311
rows = [self.header_line(format_string)]
312
rows.extend(self.client_line(client, format_string)
313
for client in self.clients)
316
def row_formatting_string(self):
317
"Format string used to format table rows"
318
return " ".join("{{{key}:{width}}}".format(
319
width=max(len(self.tableheaders[key]),
320
*(len(self.string_from_client(client, key))
321
for client in self.clients)),
323
for key in self.keywords)
325
def string_from_client(self, client, key):
326
return self.valuetostring(client[key], key)
232
def print_clients(clients, keywords):
329
233
def valuetostring(value, keyword):
330
if isinstance(value, dbus.Boolean):
234
if type(value) is dbus.Boolean:
331
235
return "Yes" if value else "No"
332
236
if keyword in ("Timeout", "Interval", "ApprovalDelay",
333
237
"ApprovalDuration", "ExtendedTimeout"):
334
238
return milliseconds_to_string(value)
335
239
return str(value)
337
def header_line(self, format_string):
338
return format_string.format(**self.tableheaders)
340
def client_line(self, client, format_string):
341
return format_string.format(
342
**{key: self.string_from_client(client, key)
343
for key in self.keywords})
346
## Classes for commands.
348
# Abstract classes first
349
class Command(object):
350
"""Abstract class for commands"""
351
def run(self, mandos, clients):
352
"""Normal commands should implement run_on_one_client(), but
353
commands which want to operate on all clients at the same time
354
can override this run() method instead."""
356
for client in clients:
357
self.run_on_one_client(client)
359
class PrintCmd(Command):
360
"""Abstract class for commands printing client details"""
361
all_keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
362
"Created", "Interval", "Host", "KeyID",
363
"Fingerprint", "CheckerRunning", "LastEnabled",
364
"ApprovalPending", "ApprovedByDefault",
365
"LastApprovalRequest", "ApprovalDelay",
366
"ApprovalDuration", "Checker", "ExtendedTimeout",
367
"Expires", "LastCheckerStatus")
368
def run(self, mandos, clients):
369
print(self.output(clients))
371
class PropertyCmd(Command):
372
"""Abstract class for Actions for setting one client property"""
373
def run_on_one_client(self, client):
374
"""Set the Client's D-Bus property"""
375
client.Set(client_interface, self.property, self.value_to_set,
376
dbus_interface=dbus.PROPERTIES_IFACE)
378
class ValueArgumentMixIn(object):
379
"""Mixin class for commands taking a value as argument"""
380
def __init__(self, value):
381
self.value_to_set = value
383
class MillisecondsValueArgumentMixIn(ValueArgumentMixIn):
384
"""Mixin class for commands taking a value argument as
387
def value_to_set(self):
390
def value_to_set(self, value):
391
"""When setting, convert value to a datetime.timedelta"""
392
self._vts = string_to_delta(value).total_seconds() * 1000
394
# Actual (non-abstract) command classes
396
class PrintTableCmd(PrintCmd):
397
def __init__(self, verbose=False):
398
self.verbose = verbose
399
def output(self, clients):
401
keywords = self.all_keywords
403
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
404
return str(TableOfClients(clients.values(), keywords))
406
class DumpJSONCmd(PrintCmd):
407
def output(self, clients):
408
data = {client["Name"]:
409
{key: self.dbus_boolean_to_bool(client[key])
410
for key in self.all_keywords}
411
for client in clients.values()}
412
return json.dumps(data, indent=4, separators=(',', ': '))
414
def dbus_boolean_to_bool(value):
415
if isinstance(value, dbus.Boolean):
419
class IsEnabledCmd(Command):
420
def run_on_one_client(self, client):
421
if self.is_enabled(client):
424
def is_enabled(self, client):
425
return client.Get(client_interface, "Enabled",
426
dbus_interface=dbus.PROPERTIES_IFACE)
428
class RemoveCmd(Command):
429
def run_on_one_client(self, client):
430
self.mandos.RemoveClient(client.__dbus_object_path__)
432
class ApproveCmd(Command):
433
def run_on_one_client(self, client):
434
client.Approve(dbus.Boolean(True),
435
dbus_interface=client_interface)
437
class DenyCmd(Command):
438
def run_on_one_client(self, client):
439
client.Approve(dbus.Boolean(False),
440
dbus_interface=client_interface)
442
class EnableCmd(PropertyCmd):
444
value_to_set = dbus.Boolean(True)
446
class DisableCmd(PropertyCmd):
448
value_to_set = dbus.Boolean(False)
450
class BumpTimeoutCmd(PropertyCmd):
451
property = "LastCheckedOK"
454
class StartCheckerCmd(PropertyCmd):
455
property = "CheckerRunning"
456
value_to_set = dbus.Boolean(True)
458
class StopCheckerCmd(PropertyCmd):
459
property = "CheckerRunning"
460
value_to_set = dbus.Boolean(False)
462
class ApproveByDefaultCmd(PropertyCmd):
463
property = "ApprovedByDefault"
464
value_to_set = dbus.Boolean(True)
466
class DenyByDefaultCmd(PropertyCmd):
467
property = "ApprovedByDefault"
468
value_to_set = dbus.Boolean(False)
470
class SetCheckerCmd(PropertyCmd, ValueArgumentMixIn):
473
class SetHostCmd(PropertyCmd, ValueArgumentMixIn):
476
class SetSecretCmd(PropertyCmd, ValueArgumentMixIn):
479
class SetTimeoutCmd(PropertyCmd, MillisecondsValueArgumentMixIn):
482
class SetExtendedTimeoutCmd(PropertyCmd,
483
MillisecondsValueArgumentMixIn):
484
property = "ExtendedTimeout"
486
class SetIntervalCmd(PropertyCmd, MillisecondsValueArgumentMixIn):
487
property = "Interval"
489
class SetApprovalDelayCmd(PropertyCmd,
490
MillisecondsValueArgumentMixIn):
491
property = "ApprovalDelay"
493
class SetApprovalDurationCmd(PropertyCmd,
494
MillisecondsValueArgumentMixIn):
495
property = "ApprovalDuration"
241
# Create format string to print table rows
242
format_string = " ".join("{{{key}:{width}}}".format(
243
width = max(len(tablewords[key]),
244
max(len(valuetostring(client[key], key))
245
for client in clients)),
249
print(format_string.format(**tablewords))
250
for client in clients:
251
print(format_string.format(**{
252
key: valuetostring(client[key], key)
253
for key in keywords }))
497
256
def has_actions(options):
498
257
return any((options.enable,
570
321
parser.add_argument("-s", "--secret",
571
322
type=argparse.FileType(mode="rb"),
572
323
help="Set password blob (file) for client")
573
approve_deny = parser.add_mutually_exclusive_group()
574
approve_deny.add_argument(
575
"-A", "--approve", action="store_true",
576
help="Approve any current client request")
577
approve_deny.add_argument("-D", "--deny", action="store_true",
578
help="Deny any current client request")
324
parser.add_argument("-A", "--approve", action="store_true",
325
help="Approve any current client request")
326
parser.add_argument("-D", "--deny", action="store_true",
327
help="Deny any current client request")
579
328
parser.add_argument("--check", action="store_true",
580
329
help="Run self-test")
581
330
parser.add_argument("client", nargs="*", help="Client name")
582
331
options = parser.parse_args()
584
333
if has_actions(options) and not (options.client or options.all):
585
334
parser.error("Options require clients names or --all.")
586
335
if options.verbose and has_actions(options):
587
336
parser.error("--verbose can only be used alone.")
588
if options.dump_json and (options.verbose
589
or has_actions(options)):
337
if options.dump_json and (options.verbose or has_actions(options)):
590
338
parser.error("--dump-json can only be used alone.")
591
339
if options.all and not has_actions(options):
592
340
parser.error("--all requires an action.")
593
if options.is_enabled and len(options.client) > 1:
594
parser.error("--is-enabled requires exactly one client")
343
fail_count, test_count = doctest.testmod()
344
sys.exit(os.EX_OK if fail_count == 0 else 1)
597
347
bus = dbus.SystemBus()
598
348
mandos_dbus_objc = bus.get_object(busname, server_path)
599
349
except dbus.exceptions.DBusException:
600
log.critical("Could not connect to Mandos server")
350
print("Could not connect to Mandos server", file=sys.stderr)
603
353
mandos_serv = dbus.Interface(mandos_dbus_objc,
604
dbus_interface=server_interface)
354
dbus_interface = server_interface)
605
355
mandos_serv_object_manager = dbus.Interface(
606
mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)
610
if options.dump_json:
611
commands.append(DumpJSONCmd())
614
commands.append(EnableCmd())
617
commands.append(DisableCmd())
619
if options.bump_timeout:
620
commands.append(BumpTimeoutCmd(options.bump_timeout))
622
if options.start_checker:
623
commands.append(StartCheckerCmd())
625
if options.stop_checker:
626
commands.append(StopCheckerCmd())
628
if options.is_enabled:
629
commands.append(IsEnabledCmd())
632
commands.append(RemoveCmd())
634
if options.checker is not None:
635
commands.append(SetCheckerCmd())
637
if options.timeout is not None:
638
commands.append(SetTimeoutCmd(options.timeout))
640
if options.extended_timeout:
642
SetExtendedTimeoutCmd(options.extended_timeout))
644
if options.interval is not None:
645
command.append(SetIntervalCmd(options.interval))
647
if options.approved_by_default is not None:
648
if options.approved_by_default:
649
command.append(ApproveByDefaultCmd())
651
command.append(DenyByDefaultCmd())
653
if options.approval_delay is not None:
654
command.append(SetApprovalDelayCmd(options.approval_delay))
656
if options.approval_duration is not None:
658
SetApprovalDurationCmd(options.approval_duration))
660
if options.host is not None:
661
command.append(SetHostCmd(options.host))
663
if options.secret is not None:
664
command.append(SetSecretCmd(options.secret))
667
commands.append(ApproveCmd())
670
commands.append(DenyCmd())
672
# If no command option has been given, show table of clients,
673
# optionally verbosely
675
commands.append(PrintTableCmd(verbose=options.verbose))
677
# Filter out log message from dbus module
678
dbus_logger = logging.getLogger("dbus.proxies")
679
class NullFilter(logging.Filter):
680
def filter(self, record):
682
dbus_filter = NullFilter()
683
dbus_logger.addFilter(dbus_filter)
356
mandos_dbus_objc, dbus_interface = dbus.OBJECT_MANAGER_IFACE)
358
#block stderr since dbus library prints to stderr
359
null = os.open(os.path.devnull, os.O_RDWR)
360
stderrcopy = os.dup(sys.stderr.fileno())
361
os.dup2(null, sys.stderr.fileno())
686
mandos_clients = {path: ifs_and_props[client_interface]
687
for path, ifs_and_props in
688
mandos_serv_object_manager
689
.GetManagedObjects().items()
690
if client_interface in ifs_and_props}
365
mandos_clients = { path: ifs_and_props[client_interface]
366
for path, ifs_and_props in
367
mandos_serv_object_manager
368
.GetManagedObjects().items()
369
if client_interface in ifs_and_props }
692
# restore dbus logger
693
dbus_logger.removeFilter(dbus_filter)
372
os.dup2(stderrcopy, sys.stderr.fileno())
694
374
except dbus.exceptions.DBusException as e:
695
log.critical("Failed to access Mandos server through D-Bus:"
375
print("Access denied: Accessing mandos server through D-Bus: {}"
376
.format(e), file=sys.stderr)
699
379
# Compile dict of (clients: properties) to process
702
382
if options.all or not options.client:
703
clients = {bus.get_object(busname, path): properties
704
for path, properties in mandos_clients.items()}
383
clients = { bus.get_object(busname, path): properties
384
for path, properties in mandos_clients.items() }
706
386
for name in options.client:
707
387
for path, client in mandos_clients.items():
710
390
clients[client_objc] = client
713
log.critical("Client not found on server: %r", name)
393
print("Client not found on server: {!r}"
394
.format(name), file=sys.stderr)
716
# Run all commands on clients
717
for command in commands:
718
command.run(mandos_serv, clients)
721
class Test_milliseconds_to_string(unittest.TestCase):
723
self.assertEqual(milliseconds_to_string(93785000),
725
def test_no_days(self):
726
self.assertEqual(milliseconds_to_string(7385000), "02:03:05")
727
def test_all_zero(self):
728
self.assertEqual(milliseconds_to_string(0), "00:00:00")
729
def test_no_fractional_seconds(self):
730
self.assertEqual(milliseconds_to_string(400), "00:00:00")
731
self.assertEqual(milliseconds_to_string(900), "00:00:00")
732
self.assertEqual(milliseconds_to_string(1900), "00:00:01")
734
class Test_string_to_delta(unittest.TestCase):
735
def test_handles_basic_rfc3339(self):
736
self.assertEqual(string_to_delta("PT2H"),
737
datetime.timedelta(0, 7200))
738
def test_falls_back_to_pre_1_6_1_with_warning(self):
739
# assertLogs only exists in Python 3.4
740
if hasattr(self, "assertLogs"):
741
with self.assertLogs(log, logging.WARNING):
742
value = string_to_delta("2h")
744
class WarningFilter(logging.Filter):
745
"""Don't show, but record the presence of, warnings"""
746
def filter(self, record):
747
is_warning = record.levelno >= logging.WARNING
748
self.found = is_warning or getattr(self, "found",
750
return not is_warning
751
warning_filter = WarningFilter()
752
log.addFilter(warning_filter)
754
value = string_to_delta("2h")
756
log.removeFilter(warning_filter)
757
self.assertTrue(getattr(warning_filter, "found", False))
758
self.assertEqual(value, datetime.timedelta(0, 7200))
760
class Test_TableOfClients(unittest.TestCase):
762
self.tableheaders = {
766
"Bool": "A D-BUS Boolean",
767
"NonDbusBoolean": "A Non-D-BUS Boolean",
768
"Integer": "An Integer",
769
"Timeout": "Timedelta 1",
770
"Interval": "Timedelta 2",
771
"ApprovalDelay": "Timedelta 3",
772
"ApprovalDuration": "Timedelta 4",
773
"ExtendedTimeout": "Timedelta 5",
774
"String": "A String",
776
self.keywords = ["Attr1", "AttrTwo"]
782
"Bool": dbus.Boolean(False),
783
"NonDbusBoolean": False,
787
"ApprovalDelay": 2000,
788
"ApprovalDuration": 3000,
789
"ExtendedTimeout": 4000,
796
"Bool": dbus.Boolean(True),
797
"NonDbusBoolean": True,
800
"Interval": 93786000,
801
"ApprovalDelay": 93787000,
802
"ApprovalDuration": 93788000,
803
"ExtendedTimeout": 93789000,
804
"String": "A huge string which will not fit," * 10,
807
def test_short_header(self):
808
text = str(TableOfClients(self.clients, self.keywords,
815
self.assertEqual(text, expected_text)
816
def test_booleans(self):
817
keywords = ["Bool", "NonDbusBoolean"]
818
text = str(TableOfClients(self.clients, keywords,
821
A D-BUS Boolean A Non-D-BUS Boolean
825
self.assertEqual(text, expected_text)
826
def test_milliseconds_detection(self):
827
keywords = ["Integer", "Timeout", "Interval", "ApprovalDelay",
828
"ApprovalDuration", "ExtendedTimeout"]
829
text = str(TableOfClients(self.clients, keywords,
832
An Integer Timedelta 1 Timedelta 2 Timedelta 3 Timedelta 4 Timedelta 5
833
0 00:00:00 00:00:01 00:00:02 00:00:03 00:00:04
834
1 1T02:03:05 1T02:03:06 1T02:03:07 1T02:03:08 1T02:03:09
836
self.assertEqual(text, expected_text)
837
def test_empty_and_long_string_values(self):
838
keywords = ["String"]
839
text = str(TableOfClients(self.clients, keywords,
844
A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,A huge string which will not fit,
846
self.assertEqual(text, expected_text)
850
def should_only_run_tests():
851
parser = argparse.ArgumentParser(add_help=False)
852
parser.add_argument("--check", action='store_true')
853
args, unknown_args = parser.parse_known_args()
854
run_tests = args.check
856
# Remove --check argument from sys.argv
857
sys.argv[1:] = unknown_args
860
# Add all tests from doctest strings
861
def load_tests(loader, tests, none):
863
tests.addTests(doctest.DocTestSuite())
397
if not has_actions(options) and clients:
398
if options.verbose or options.dump_json:
399
keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
400
"Created", "Interval", "Host", "Fingerprint",
401
"CheckerRunning", "LastEnabled",
402
"ApprovalPending", "ApprovedByDefault",
403
"LastApprovalRequest", "ApprovalDelay",
404
"ApprovalDuration", "Checker",
405
"ExtendedTimeout", "Expires",
408
keywords = defaultkeywords
410
if options.dump_json:
411
json.dump({client["Name"]: {key:
413
if isinstance(client[key],
416
for key in keywords }
417
for client in clients.values() },
418
fp = sys.stdout, indent = 4,
419
separators = (',', ': '))
422
print_clients(clients.values(), keywords)
424
# Process each client in the list by all selected options
425
for client in clients:
427
def set_client_prop(prop, value):
428
"""Set a Client D-Bus property"""
429
client.Set(client_interface, prop, value,
430
dbus_interface=dbus.PROPERTIES_IFACE)
432
def set_client_prop_ms(prop, value):
433
"""Set a Client D-Bus property, converted
434
from a string to milliseconds."""
435
set_client_prop(prop,
436
string_to_delta(value).total_seconds()
440
mandos_serv.RemoveClient(client.__dbus_object_path__)
442
set_client_prop("Enabled", dbus.Boolean(True))
444
set_client_prop("Enabled", dbus.Boolean(False))
445
if options.bump_timeout:
446
set_client_prop("LastCheckedOK", "")
447
if options.start_checker:
448
set_client_prop("CheckerRunning", dbus.Boolean(True))
449
if options.stop_checker:
450
set_client_prop("CheckerRunning", dbus.Boolean(False))
451
if options.is_enabled:
452
sys.exit(0 if client.Get(client_interface,
455
dbus.PROPERTIES_IFACE)
457
if options.checker is not None:
458
set_client_prop("Checker", options.checker)
459
if options.host is not None:
460
set_client_prop("Host", options.host)
461
if options.interval is not None:
462
set_client_prop_ms("Interval", options.interval)
463
if options.approval_delay is not None:
464
set_client_prop_ms("ApprovalDelay",
465
options.approval_delay)
466
if options.approval_duration is not None:
467
set_client_prop_ms("ApprovalDuration",
468
options.approval_duration)
469
if options.timeout is not None:
470
set_client_prop_ms("Timeout", options.timeout)
471
if options.extended_timeout is not None:
472
set_client_prop_ms("ExtendedTimeout",
473
options.extended_timeout)
474
if options.secret is not None:
475
set_client_prop("Secret",
476
dbus.ByteArray(options.secret.read()))
477
if options.approved_by_default is not None:
478
set_client_prop("ApprovedByDefault",
480
.approved_by_default))
482
client.Approve(dbus.Boolean(True),
483
dbus_interface=client_interface)
485
client.Approve(dbus.Boolean(False),
486
dbus_interface=client_interface)
866
489
if __name__ == "__main__":
867
if should_only_run_tests():
868
# Call using ./tdd-python-script --check [--verbose]