#!/usr/bin/python

"""

sstp-proxy: SSTP routing proxy

A simple eventlet-based proxy server to take in SSL of SSTP

format and route to a specific virtual machine inside our

private cloud

We expect a path of: /tenant/instance

"""

# Steal stderr away and watch it in a file

# should never write anything, but if it does

# then a) our ssl connection dies, and b)

# we never see it

import sys

sys.stderr.close()

sys.stderr = open("/tmp/sstp.log","a")

# What's this you ask?

# Well, xinetd or stunel is reaping SIGCHLD, and if

# we use popen, we are screwed.

# and, keystone calls keyring which calls uname

import platform

def __syscmd_uname(option,default=''):

return 'x86_64'

platform._syscmd_uname = __syscmd_uname

import novaclient.client

from neutronclient.v2_0 import client as neutronclient

from keystoneclient.v2_0 import client as keystoneclient

import traceback

from novaclient.v3 import servers

from eventlet.green import socket

import socket

import ssl, re, os, argparse, sys

import StringIO

import ConfigParser

import syslog

import ctypes

import prctl

import os

import find_ns

from time import sleep

import requests

import memcache

import eventlet

eventlet.monkey_patch()

syslog.openlog(ident="sstp-proxy",logoption=syslog.LOG_PID, facility=syslog.LOG_LOCAL0)

#sys.stdout = os.fdopen(sys.stdout.fileno(), 'w', 0)

#sys.stderr = os.fdopen(sys.stderr.fileno(), 'w', 0)

def log(severity,txt):

syslog.syslog(severity,txt)

def forward(source, dest):

sys.exit(0)

# tenant might have dot, complicates parsing.

# disallow dots in instance(host) name

# don.n1.vpn.sandvine.rocks

# /don/db-vpn/sra_

# vhost--tenant.instance.vpn.sandvine.rocks

# vhost.instance.outreach.sandvine.rocks

def result_instance_tenant(s):

return tenant,instance

# /api/tenant/TID

def do_api(source,ibuf,args):

source.close()

def route(source,gp,args):

break

config = ConfigParser.RawConfigParser({'output_port':'443',

'keystone_url':''})

with open('/etc/default/sstp-proxy') as r:

ini_str= '[sstp_proxy]\n' + r.read()

ini_fp = StringIO.StringIO(ini_str)

config.readfp(ini_fp)

parser = argparse.ArgumentParser(description='SSTP proxy')

parser.add_argument('-output_port',type=int,default=443)

parser.add_argument('-output_tls',type=str,default='true')

parser.add_argument('-cert',type=str,default=config.get('sstp_proxy','cert'),help='Cert')

parser.add_argument('-key',type=str,default=config.get('sstp_proxy','key'),help='Key')

parser.add_argument('-admin_user',type=str,default=config.get('sstp_proxy','admin_user'),help='Keystone admin user')

parser.add_argument('-admin_pass',type=str,default=config.get('sstp_proxy','admin_pass'),help='Keystone admin password')

parser.add_argument('-keystone_url',type=str,default=config.get('sstp_proxy','keystone_url'),help='Keystone url')

args = parser.parse_args()

if (args.output_tls == 'true' or args.output_tls == 'True' or args.output_tls == '1'):

args.output_tls = True

else:

args.output_tls = False

if os.access(args.key, os.R_OK) == False:

print("Error: private key %s not readable" % args.key)

sys.exit(1)

if os.access(args.cert, os.R_OK) == False:

print("Error: certificate %s not readable" % args.cert)

sys.exit(1)

# This allows our app to get into a network namespace other than the default.

# to do so, open /var/run/netns/<file>, and then have @ it with the fd using

# the setns(2) call. E.g. f=open('/var/run/netns/x'); setns(f)

prctl.cap_permitted.sys_admin = True

prctl.cap_effective.sys_admin = True

fd = int(1)

source = socket.fromfd(fd, socket.AF_INET, socket.SOCK_STREAM)

source.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)

gp = eventlet.greenpool.GreenPool()

gp.spawn(route,source,gp,args)

gp.waitall()