52
65
    "ApprovalDelay": "Approval Delay",
 
53
66
    "ApprovalDuration": "Approval Duration",
 
54
67
    "Checker": "Checker",
 
55
 
    "ExtendedTimeout" : "Extended Timeout"
 
 
68
    "ExtendedTimeout": "Extended Timeout",
 
 
70
    "LastCheckerStatus": "Last Checker Status",
 
57
72
defaultkeywords = ("Name", "Enabled", "Timeout", "LastCheckedOK")
 
58
73
domain = "se.recompile"
 
59
74
busname = domain + ".Mandos"
 
61
76
server_interface = domain + ".Mandos"
 
62
77
client_interface = domain + ".Mandos.Client"
 
65
 
def timedelta_to_milliseconds(td):
 
66
 
    """Convert a datetime.timedelta object to milliseconds"""
 
67
 
    return ((td.days * 24 * 60 * 60 * 1000)
 
69
 
            + (td.microseconds // 1000))
 
 
82
    dbus.OBJECT_MANAGER_IFACE
 
 
83
except AttributeError:
 
 
84
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
 
71
87
def milliseconds_to_string(ms):
 
72
88
    td = datetime.timedelta(0, 0, 0, ms)
 
73
 
    return ("%(days)s%(hours)02d:%(minutes)02d:%(seconds)02d"
 
74
 
            % { "days": "%dT" % td.days if td.days else "",
 
75
 
                "hours": td.seconds // 3600,
 
76
 
                "minutes": (td.seconds % 3600) // 60,
 
77
 
                "seconds": td.seconds % 60,
 
 
89
    return ("{days}{hours:02}:{minutes:02}:{seconds:02}"
 
 
90
            .format(days="{}T".format(td.days) if td.days else "",
 
 
91
                    hours=td.seconds // 3600,
 
 
92
                    minutes=(td.seconds % 3600) // 60,
 
 
93
                    seconds=td.seconds % 60))
 
 
96
def rfc3339_duration_to_delta(duration):
 
 
97
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
 
 
99
    >>> rfc3339_duration_to_delta("P7D")
 
 
100
    datetime.timedelta(7)
 
 
101
    >>> rfc3339_duration_to_delta("PT60S")
 
 
102
    datetime.timedelta(0, 60)
 
 
103
    >>> rfc3339_duration_to_delta("PT60M")
 
 
104
    datetime.timedelta(0, 3600)
 
 
105
    >>> rfc3339_duration_to_delta("PT24H")
 
 
106
    datetime.timedelta(1)
 
 
107
    >>> rfc3339_duration_to_delta("P1W")
 
 
108
    datetime.timedelta(7)
 
 
109
    >>> rfc3339_duration_to_delta("PT5M30S")
 
 
110
    datetime.timedelta(0, 330)
 
 
111
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
 
112
    datetime.timedelta(1, 200)
 
 
115
    # Parsing an RFC 3339 duration with regular expressions is not
 
 
116
    # possible - there would have to be multiple places for the same
 
 
117
    # values, like seconds.  The current code, while more esoteric, is
 
 
118
    # cleaner without depending on a parsing library.  If Python had a
 
 
119
    # built-in library for parsing we would use it, but we'd like to
 
 
120
    # avoid excessive use of external libraries.
 
 
122
    # New type for defining tokens, syntax, and semantics all-in-one
 
 
123
    Token = collections.namedtuple("Token", (
 
 
124
        "regexp",  # To match token; if "value" is not None, must have
 
 
125
                   # a "group" containing digits
 
 
126
        "value",   # datetime.timedelta or None
 
 
127
        "followers"))           # Tokens valid after this token
 
 
128
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
 
 
129
    # the "duration" ABNF definition in RFC 3339, Appendix A.
 
 
130
    token_end = Token(re.compile(r"$"), None, frozenset())
 
 
131
    token_second = Token(re.compile(r"(\d+)S"),
 
 
132
                         datetime.timedelta(seconds=1),
 
 
133
                         frozenset((token_end, )))
 
 
134
    token_minute = Token(re.compile(r"(\d+)M"),
 
 
135
                         datetime.timedelta(minutes=1),
 
 
136
                         frozenset((token_second, token_end)))
 
 
137
    token_hour = Token(re.compile(r"(\d+)H"),
 
 
138
                       datetime.timedelta(hours=1),
 
 
139
                       frozenset((token_minute, token_end)))
 
 
140
    token_time = Token(re.compile(r"T"),
 
 
142
                       frozenset((token_hour, token_minute,
 
 
144
    token_day = Token(re.compile(r"(\d+)D"),
 
 
145
                      datetime.timedelta(days=1),
 
 
146
                      frozenset((token_time, token_end)))
 
 
147
    token_month = Token(re.compile(r"(\d+)M"),
 
 
148
                        datetime.timedelta(weeks=4),
 
 
149
                        frozenset((token_day, token_end)))
 
 
150
    token_year = Token(re.compile(r"(\d+)Y"),
 
 
151
                       datetime.timedelta(weeks=52),
 
 
152
                       frozenset((token_month, token_end)))
 
 
153
    token_week = Token(re.compile(r"(\d+)W"),
 
 
154
                       datetime.timedelta(weeks=1),
 
 
155
                       frozenset((token_end, )))
 
 
156
    token_duration = Token(re.compile(r"P"), None,
 
 
157
                           frozenset((token_year, token_month,
 
 
158
                                      token_day, token_time,
 
 
160
    # Define starting values:
 
 
162
    value = datetime.timedelta()
 
 
164
    # Following valid tokens
 
 
165
    followers = frozenset((token_duration, ))
 
 
166
    # String left to parse
 
 
168
    # Loop until end token is found
 
 
169
    while found_token is not token_end:
 
 
170
        # Search for any currently valid tokens
 
 
171
        for token in followers:
 
 
172
            match = token.regexp.match(s)
 
 
173
            if match is not None:
 
 
175
                if token.value is not None:
 
 
176
                    # Value found, parse digits
 
 
177
                    factor = int(match.group(1), 10)
 
 
178
                    # Add to value so far
 
 
179
                    value += factor * token.value
 
 
180
                # Strip token from string
 
 
181
                s = token.regexp.sub("", s, 1)
 
 
184
                # Set valid next tokens
 
 
185
                followers = found_token.followers
 
 
188
            # No currently valid tokens were found
 
 
189
            raise ValueError("Invalid RFC 3339 duration: {!r}"
 
80
195
def string_to_delta(interval):
 
81
196
    """Parse a string and return a datetime.timedelta
 
83
 
    >>> string_to_delta("7d")
 
 
198
    >>> string_to_delta('7d')
 
84
199
    datetime.timedelta(7)
 
85
 
    >>> string_to_delta("60s")
 
 
200
    >>> string_to_delta('60s')
 
86
201
    datetime.timedelta(0, 60)
 
87
 
    >>> string_to_delta("60m")
 
 
202
    >>> string_to_delta('60m')
 
88
203
    datetime.timedelta(0, 3600)
 
89
 
    >>> string_to_delta("24h")
 
 
204
    >>> string_to_delta('24h')
 
90
205
    datetime.timedelta(1)
 
91
 
    >>> string_to_delta("1w")
 
 
206
    >>> string_to_delta('1w')
 
92
207
    datetime.timedelta(7)
 
93
 
    >>> string_to_delta("5m 30s")
 
 
208
    >>> string_to_delta('5m 30s')
 
94
209
    datetime.timedelta(0, 330)
 
 
213
        return rfc3339_duration_to_delta(interval)
 
96
217
    value = datetime.timedelta(0)
 
97
 
    regexp = re.compile("(\d+)([dsmhw]?)")
 
 
218
    regexp = re.compile(r"(\d+)([dsmhw]?)")
 
99
220
    for num, suffix in regexp.findall(interval):
 
100
221
        if suffix == "d":
 
101
222
            value += datetime.timedelta(int(num))
 
 
196
322
    parser.add_argument("--approval-duration",
 
197
323
                        help="Set duration of one client approval")
 
198
324
    parser.add_argument("-H", "--host", help="Set host for client")
 
199
 
    parser.add_argument("-s", "--secret", type=file,
 
 
325
    parser.add_argument("-s", "--secret",
 
 
326
                        type=argparse.FileType(mode="rb"),
 
200
327
                        help="Set password blob (file) for client")
 
201
328
    parser.add_argument("-A", "--approve", action="store_true",
 
202
329
                        help="Approve any current client request")
 
203
330
    parser.add_argument("-D", "--deny", action="store_true",
 
204
331
                        help="Deny any current client request")
 
 
332
    parser.add_argument("--check", action="store_true",
 
 
333
                        help="Run self-test")
 
205
334
    parser.add_argument("client", nargs="*", help="Client name")
 
206
335
    options = parser.parse_args()
 
208
 
    if has_actions(options) and not options.client and not options.all:
 
 
337
    if has_actions(options) and not (options.client or options.all):
 
209
338
        parser.error("Options require clients names or --all.")
 
210
339
    if options.verbose and has_actions(options):
 
211
 
        parser.error("--verbose can only be used alone or with"
 
 
340
        parser.error("--verbose can only be used alone.")
 
 
341
    if options.dump_json and (options.verbose
 
 
342
                              or has_actions(options)):
 
 
343
        parser.error("--dump-json can only be used alone.")
 
213
344
    if options.all and not has_actions(options):
 
214
345
        parser.error("--all requires an action.")
 
 
349
        fail_count, test_count = doctest.testmod()
 
 
350
        sys.exit(os.EX_OK if fail_count == 0 else 1)
 
217
353
        bus = dbus.SystemBus()
 
218
354
        mandos_dbus_objc = bus.get_object(busname, server_path)
 
219
355
    except dbus.exceptions.DBusException:
 
220
 
        print("Could not connect to Mandos server",
 
 
356
        print("Could not connect to Mandos server", file=sys.stderr)
 
224
359
    mandos_serv = dbus.Interface(mandos_dbus_objc,
 
225
 
                                 dbus_interface = server_interface)
 
227
 
    #block stderr since dbus library prints to stderr
 
 
360
                                 dbus_interface=server_interface)
 
 
361
    mandos_serv_object_manager = dbus.Interface(
 
 
362
        mandos_dbus_objc, dbus_interface=dbus.OBJECT_MANAGER_IFACE)
 
 
364
    # block stderr since dbus library prints to stderr
 
228
365
    null = os.open(os.path.devnull, os.O_RDWR)
 
229
366
    stderrcopy = os.dup(sys.stderr.fileno())
 
230
367
    os.dup2(null, sys.stderr.fileno())
 
234
 
            mandos_clients = mandos_serv.GetAllClientsWithProperties()
 
 
371
            mandos_clients = {path: ifs_and_props[client_interface]
 
 
372
                              for path, ifs_and_props in
 
 
373
                              mandos_serv_object_manager
 
 
374
                              .GetManagedObjects().items()
 
 
375
                              if client_interface in ifs_and_props}
 
237
378
            os.dup2(stderrcopy, sys.stderr.fileno())
 
238
379
            os.close(stderrcopy)
 
239
 
    except dbus.exceptions.DBusException:
 
240
 
        print("Access denied: Accessing mandos server through dbus.",
 
 
380
    except dbus.exceptions.DBusException as e:
 
 
381
        print("Access denied: "
 
 
382
              "Accessing mandos server through D-Bus: {}".format(e),
 
244
386
    # Compile dict of (clients: properties) to process
 
247
389
    if options.all or not options.client:
 
248
 
        clients = dict((bus.get_object(busname, path), properties)
 
249
 
                       for path, properties in
 
250
 
                       mandos_clients.iteritems())
 
 
390
        clients = {bus.get_object(busname, path): properties
 
 
391
                   for path, properties in mandos_clients.items()}
 
252
393
        for name in options.client:
 
253
 
            for path, client in mandos_clients.iteritems():
 
 
394
            for path, client in mandos_clients.items():
 
254
395
                if client["Name"] == name:
 
255
396
                    client_objc = bus.get_object(busname, path)
 
256
397
                    clients[client_objc] = client
 
259
 
                print("Client not found on server: %r" % name,
 
 
400
                print("Client not found on server: {!r}"
 
 
401
                      .format(name), file=sys.stderr)
 
263
404
    if not has_actions(options) and clients:
 
265
 
            keywords = ("Name", "Enabled", "Timeout",
 
266
 
                        "LastCheckedOK", "Created", "Interval",
 
267
 
                        "Host", "Fingerprint", "CheckerRunning",
 
268
 
                        "LastEnabled", "ApprovalPending",
 
 
405
        if options.verbose or options.dump_json:
 
 
406
            keywords = ("Name", "Enabled", "Timeout", "LastCheckedOK",
 
 
407
                        "Created", "Interval", "Host", "Fingerprint",
 
 
408
                        "CheckerRunning", "LastEnabled",
 
 
409
                        "ApprovalPending", "ApprovedByDefault",
 
270
410
                        "LastApprovalRequest", "ApprovalDelay",
 
271
411
                        "ApprovalDuration", "Checker",
 
 
412
                        "ExtendedTimeout", "Expires",
 
274
415
            keywords = defaultkeywords
 
276
 
        print_clients(clients.values(), keywords)
 
 
417
        if options.dump_json:
 
 
418
            json.dump({client["Name"]: {key:
 
 
420
                                        if isinstance(client[key],
 
 
424
                       for client in clients.values()},
 
 
425
                      fp=sys.stdout, indent=4,
 
 
426
                      separators=(',', ': '))
 
 
429
            print_clients(clients.values(), keywords)
 
278
431
        # Process each client in the list by all selected options
 
279
432
        for client in clients:
 
 
434
            def set_client_prop(prop, value):
 
 
435
                """Set a Client D-Bus property"""
 
 
436
                client.Set(client_interface, prop, value,
 
 
437
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
 
439
            def set_client_prop_ms(prop, value):
 
 
440
                """Set a Client D-Bus property, converted
 
 
441
                from a string to milliseconds."""
 
 
442
                set_client_prop(prop,
 
 
443
                                string_to_delta(value).total_seconds()
 
280
446
            if options.remove:
 
281
447
                mandos_serv.RemoveClient(client.__dbus_object_path__)
 
282
448
            if options.enable:
 
283
 
                client.Enable(dbus_interface=client_interface)
 
 
449
                set_client_prop("Enabled", dbus.Boolean(True))
 
284
450
            if options.disable:
 
285
 
                client.Disable(dbus_interface=client_interface)
 
 
451
                set_client_prop("Enabled", dbus.Boolean(False))
 
286
452
            if options.bump_timeout:
 
287
 
                client.CheckedOK(dbus_interface=client_interface)
 
 
453
                set_client_prop("LastCheckedOK", "")
 
288
454
            if options.start_checker:
 
289
 
                client.StartChecker(dbus_interface=client_interface)
 
 
455
                set_client_prop("CheckerRunning", dbus.Boolean(True))
 
290
456
            if options.stop_checker:
 
291
 
                client.StopChecker(dbus_interface=client_interface)
 
 
457
                set_client_prop("CheckerRunning", dbus.Boolean(False))
 
292
458
            if options.is_enabled:
 
293
 
                sys.exit(0 if client.Get(client_interface,
 
296
 
                                         dbus.PROPERTIES_IFACE)
 
 
459
                if client.Get(client_interface, "Enabled",
 
 
460
                              dbus_interface=dbus.PROPERTIES_IFACE):
 
298
464
            if options.checker is not None:
 
299
 
                client.Set(client_interface, "Checker",
 
301
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
 
465
                set_client_prop("Checker", options.checker)
 
302
466
            if options.host is not None:
 
303
 
                client.Set(client_interface, "Host", options.host,
 
304
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
 
467
                set_client_prop("Host", options.host)
 
305
468
            if options.interval is not None:
 
306
 
                client.Set(client_interface, "Interval",
 
307
 
                           timedelta_to_milliseconds
 
308
 
                           (string_to_delta(options.interval)),
 
309
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
 
469
                set_client_prop_ms("Interval", options.interval)
 
310
470
            if options.approval_delay is not None:
 
311
 
                client.Set(client_interface, "ApprovalDelay",
 
312
 
                           timedelta_to_milliseconds
 
313
 
                           (string_to_delta(options.
 
315
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
 
471
                set_client_prop_ms("ApprovalDelay",
 
 
472
                                   options.approval_delay)
 
316
473
            if options.approval_duration is not None:
 
317
 
                client.Set(client_interface, "ApprovalDuration",
 
318
 
                           timedelta_to_milliseconds
 
319
 
                           (string_to_delta(options.
 
321
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
 
474
                set_client_prop_ms("ApprovalDuration",
 
 
475
                                   options.approval_duration)
 
322
476
            if options.timeout is not None:
 
323
 
                client.Set(client_interface, "Timeout",
 
324
 
                           timedelta_to_milliseconds
 
325
 
                           (string_to_delta(options.timeout)),
 
326
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
 
477
                set_client_prop_ms("Timeout", options.timeout)
 
327
478
            if options.extended_timeout is not None:
 
328
 
                client.Set(client_interface, "ExtendedTimeout",
 
329
 
                           timedelta_to_milliseconds
 
330
 
                           (string_to_delta(options.extended_timeout)),
 
331
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
 
479
                set_client_prop_ms("ExtendedTimeout",
 
 
480
                                   options.extended_timeout)
 
332
481
            if options.secret is not None:
 
333
 
                client.Set(client_interface, "Secret",
 
334
 
                           dbus.ByteArray(open(options.secret,
 
336
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
 
482
                set_client_prop("Secret",
 
 
483
                                dbus.ByteArray(options.secret.read()))
 
337
484
            if options.approved_by_default is not None:
 
338
 
                client.Set(client_interface, "ApprovedByDefault",
 
340
 
                                        .approved_by_default),
 
341
 
                           dbus_interface=dbus.PROPERTIES_IFACE)
 
 
485
                set_client_prop("ApprovedByDefault",
 
 
487
                                             .approved_by_default))
 
342
488
            if options.approve:
 
343
489
                client.Approve(dbus.Boolean(True),
 
344
490
                               dbus_interface=client_interface)