Do not move versions backward
[certmaster.git] / certmaster / minion / server.py
1 """
2 func
3
4 Copyright 2007, Red Hat, Inc
5 see AUTHORS
6
7 This software may be freely redistributed under the terms of the GNU
8 general public license.
9
10 You should have received a copy of the GNU General Public License
11 along with this program; if not, write to the Free Software
12 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
13 """
14
15 # standard modules
16 import SimpleXMLRPCServer
17 import string
18 import sys
19 import traceback
20 import socket
21 import fnmatch
22
23 from gettext import textdomain
24 I18N_DOMAIN = "func"
25
26
27 from func.config import read_config
28 from func.commonconfig import FuncdConfig
29 from func import logger
30 from func import certs
31 import func.jobthing as jobthing
32 import utils
33
34 # our modules
35 import AuthedXMLRPCServer
36 import codes
37 import module_loader
38 import func.utils as futils
39
40
41
42 class XmlRpcInterface(object):
43
44 def __init__(self):
45
46 """
47 Constructor.
48 """
49
50 config_file = '/etc/func/minion.conf'
51 self.config = read_config(config_file, FuncdConfig)
52 self.logger = logger.Logger().logger
53 self.audit_logger = logger.AuditLogger()
54 self.__setup_handlers()
55
56 # need a reference so we can log ip's, certs, etc
57 # self.server = server
58
59 def __setup_handlers(self):
60
61 """
62 Add RPC functions from each class to the global list so they can be called.
63 """
64
65 self.handlers = {}
66 for x in self.modules.keys():
67 try:
68 self.modules[x].register_rpc(self.handlers, x)
69 self.logger.debug("adding %s" % x)
70 except AttributeError, e:
71 self.logger.warning("module %s not loaded, missing register_rpc method" % self.modules[x])
72
73
74 # internal methods that we do instead of spreading internal goo
75 # all over the modules. For now, at lest -akl
76
77
78 # system.listMethods os a quasi stanard xmlrpc method, so
79 # thats why it has a odd looking name
80 self.handlers["system.listMethods"] = self.list_methods
81 self.handlers["system.list_methods"] = self.list_methods
82 self.handlers["system.list_modules"] = self.list_modules
83
84 def list_modules(self):
85 modules = self.modules.keys()
86 modules.sort()
87 return modules
88
89 def list_methods(self):
90 methods = self.handlers.keys()
91 methods.sort()
92 return methods
93
94 def get_dispatch_method(self, method):
95
96 if method in self.handlers:
97 return FuncApiMethod(self.logger, method, self.handlers[method])
98
99 else:
100 self.logger.info("Unhandled method call for method: %s " % method)
101 raise codes.InvalidMethodException
102
103
104 class FuncApiMethod:
105
106 """
107 Used to hold a reference to all of the registered functions.
108 """
109
110 def __init__(self, logger, name, method):
111
112 self.logger = logger
113 self.__method = method
114 self.__name = name
115
116 def __log_exc(self):
117
118 """
119 Log an exception.
120 """
121
122 (t, v, tb) = sys.exc_info()
123 self.logger.info("Exception occured: %s" % t )
124 self.logger.info("Exception value: %s" % v)
125 self.logger.info("Exception Info:\n%s" % string.join(traceback.format_list(traceback.extract_tb(tb))))
126
127 def __call__(self, *args):
128
129 self.logger.debug("(X) -------------------------------------------")
130
131 try:
132 rc = self.__method(*args)
133 except codes.FuncException, e:
134 self.__log_exc()
135 (t, v, tb) = sys.exc_info()
136 rc = futils.nice_exception(t,v,tb)
137 except:
138 self.__log_exc()
139 (t, v, tb) = sys.exc_info()
140 rc = futils.nice_exception(t,v,tb)
141 self.logger.debug("Return code for %s: %s" % (self.__name, rc))
142
143 return rc
144
145
146 def serve():
147
148 """
149 Code for starting the XMLRPC service.
150 """
151 server =FuncSSLXMLRPCServer(('', 51234))
152 server.logRequests = 0 # don't print stuff to console
153 server.serve_forever()
154
155
156
157 class FuncXMLRPCServer(SimpleXMLRPCServer.SimpleXMLRPCServer, XmlRpcInterface):
158
159 def __init__(self, args):
160
161 self.allow_reuse_address = True
162
163 self.modules = module_loader.load_modules()
164 SimpleXMLRPCServer.SimpleXMLRPCServer.__init__(self, args)
165 XmlRpcInterface.__init__(self)
166
167
168 class FuncSSLXMLRPCServer(AuthedXMLRPCServer.AuthedSSLXMLRPCServer,
169 XmlRpcInterface):
170 def __init__(self, args):
171 self.allow_reuse_address = True
172 self.modules = module_loader.load_modules()
173
174 XmlRpcInterface.__init__(self)
175 hn = utils.get_hostname()
176 self.key = "%s/%s.pem" % (self.config.cert_dir, hn)
177 self.cert = "%s/%s.cert" % (self.config.cert_dir, hn)
178 self.ca = "%s/ca.cert" % self.config.cert_dir
179
180 self._our_ca = certs.retrieve_cert_from_file(self.ca)
181
182 AuthedXMLRPCServer.AuthedSSLXMLRPCServer.__init__(self, ("", 51234),
183 self.key, self.cert,
184 self.ca)
185
186 def _dispatch(self, method, params):
187
188 """
189 the SimpleXMLRPCServer class will call _dispatch if it doesn't
190 find a handler method
191 """
192 # take _this_request and hand it off to check out the acls of the method
193 # being called vs the requesting host
194
195 if not hasattr(self, '_this_request'):
196 raise codes.InvalidMethodException
197
198 r,a = self._this_request
199 peer_cert = r.get_peer_certificate()
200 ip = a[0]
201
202
203 # generally calling conventions are: hardware.info
204 # async convention is async.hardware.info
205 # here we parse out the async to decide how to invoke it.
206 # see the async docs on the Wiki for further info.
207 async_dispatch = False
208 if method.startswith("async."):
209 async_dispatch = True
210 method = method.replace("async.","",1)
211
212 if not self._check_acl(peer_cert, ip, method, params):
213 raise codes.AccessToMethodDenied
214
215 # Recognize ipython's tab completion calls
216 if method == 'trait_names' or method == '_getAttributeNames':
217 return self.handlers.keys()
218
219 cn = peer_cert.get_subject().CN
220 sub_hash = peer_cert.subject_name_hash()
221 self.audit_logger.log_call(ip, cn, sub_hash, method, params)
222
223 try:
224 if not async_dispatch:
225 return self.get_dispatch_method(method)(*params)
226 else:
227 return jobthing.minion_async_run(self.get_dispatch_method, method, params)
228 except:
229 (t, v, tb) = sys.exc_info()
230 rc = futils.nice_exception(t, v, tb)
231 return rc
232
233 def auth_cb(self, request, client_address):
234 peer_cert = request.get_peer_certificate()
235 return peer_cert.get_subject().CN
236
237 def _check_acl(self, cert, ip, method, params):
238 acls = utils.get_acls_from_config(acldir=self.config.acl_dir)
239
240 # certmaster always gets to run things
241 ca_cn = self._our_ca.get_subject().CN
242 ca_hash = self._our_ca.subject_name_hash()
243 ca_key = '%s-%s' % (ca_cn, ca_hash)
244 acls[ca_key] = ['*']
245
246 cn = cert.get_subject().CN
247 sub_hash = cert.subject_name_hash()
248 if acls:
249 allow_list = []
250 hostkey = '%s-%s' % (cn, sub_hash)
251 # search all the keys, match to 'cn-subhash'
252 for hostmatch in acls.keys():
253 if fnmatch.fnmatch(hostkey, hostmatch):
254 allow_list.extend(acls[hostmatch])
255 # go through the allow_list and make sure this method is in there
256 for methodmatch in allow_list:
257 if fnmatch.fnmatch(method, methodmatch):
258 return True
259
260 return False
261
262
263 def main(argv):
264
265 """
266 Start things up.
267 """
268
269 if "daemon" in sys.argv or "--daemon" in sys.argv:
270 futils.daemonize("/var/run/funcd.pid")
271 else:
272 print "serving...\n"
273
274 try:
275 utils.create_minion_keys()
276 serve()
277 except codes.FuncException, e:
278 print >> sys.stderr, 'error: %s' % e
279 sys.exit(1)
280
281
282 # ======================================================================================
283 if __name__ == "__main__":
284 textdomain(I18N_DOMAIN)
285 main(sys.argv)