def process(self):
self.hosts = {}
self.changed = []
self.devinfo = CsHelper.get_device_info()
self.preseed()
self.cloud = CsFile(DHCP_HOSTS)
self.conf = CsFile(CLOUD_CONF)
self.cloud.repopulate()
for item in self.dbag:
if item == "id":
continue
self.add(self.dbag[item])
self.write_hosts()
if self.cloud.is_changed():
self.delete_leases()
self.configure_server()
self.conf.commit()
self.cloud.commit()
# We restart DNSMASQ every time the configure.py is called in order to avoid lease problems.
# But only do that on the master or else VMs will get leases from the backup resulting in
# Cloud-init to get the passwd and other meta-data from the backup as well.
if not self.cl.is_redundant() or self.cl.is_master():
CsHelper.execute2("service dnsmasq restart")
def _configure_syslog(self, syslogserverlist):
self.syslogconf = CsFile(RSYSLOG_IPTABLES_CONF)
self.syslogconf.repopulate()
logging.debug("Processing syslog server list: %s" % syslogserverlist)
ips = filter(bool, syslogserverlist.split(','))
if not ips:
# no IP in the syslog server list; reset the config to default:
self.syslogconf.append(
"# no remote syslog servers so stop further processing")
self.syslogconf.append("# this file is managed by CsVrConfig.py")
self.syslogconf.append(
":msg, regex, \"^\[ *[0-9]*\.[0-9]*\] iptables denied: \" ~")
else:
# add IPs from the syslog server list to the config:
self.syslogconf.append(
"# forwarding IP tables syslog to %s and stop further processing"
% syslogserverlist)
self.syslogconf.append("# this file is managed by CsVrConfig.py")
first = True
for ip in ips:
if first:
self.syslogconf.append(
":msg, regex, \"^\[ *[0-9]*\.[0-9]*\] iptables denied: \" @@%s:514"
% ip)
first = False
else:
self.syslogconf.append("& @@%s:514" % ip)
self.syslogconf.append("& ~")
changed = self.syslogconf.is_changed()
self.syslogconf.commit()
if changed:
CsHelper.execute2("service rsyslog restart")
def process(self):
self.hosts = {}
self.changed = []
self.devinfo = CsHelper.get_device_info()
self.preseed()
self.cloud = CsFile(DHCP_HOSTS)
self.dhcp_opts = CsFile(DHCP_OPTS)
self.conf = CsFile(CLOUD_CONF)
self.cloud.repopulate()
self.dhcp_opts.repopulate()
for item in self.dbag:
if item == "id":
continue
self.add(self.dbag[item])
if self.dbag[item]['default_gateway'] == "0.0.0.0":
self.add_dhcp_opts(self.dbag[item])
self.write_hosts()
if self.cloud.is_changed():
self.delete_leases()
self.configure_server()
self.conf.commit()
self.cloud.commit()
self.dhcp_opts.commit()
# We restart DNSMASQ every time the configure.py is called in order to avoid lease problems.
# But only do that on the master or else VMs will get leases from the backup resulting in
# Cloud-init to get the passwd and other meta-data from the backup as well.
if not self.cl.is_redundant() or self.cl.is_master():
CsHelper.execute2("service dnsmasq restart")
def setup(self):
CsHelper.copy_if_needed(
"/etc/apache2/vhost.template",
"/etc/apache2/sites-enabled/vhost-%s.conf" % self.ip)
file = CsFile("/etc/apache2/sites-enabled/vhost-%s.conf" % (self.ip))
if not self.config.cl.is_redundant():
file.replaceIfFound("<VirtualHost.*:8180>",
"<VirtualHost %s:80>" % (self.ip))
file.replaceIfFound("<VirtualHost.*:8443>",
"\t<VirtualHost %s:443>" % (self.ip))
file.replaceIfFound("Listen .*:8180", "Listen %s:80" % (self.ip))
file.replaceIfFound("Listen .*:8443", "Listen %s:443" % (self.ip))
else:
file.replaceIfFound(
"<VirtualHost.*:8180>",
"<VirtualHost %s:80 %s:80>" % (self.ip, self.gateway))
file.replaceIfFound(
"<VirtualHost.*:8443>",
"\t<VirtualHost %s:443 %s:443>" % (self.ip, self.gateway))
file.replaceIfFound(
"Listen .*:8180",
"Listen %s:80\nListen %s:80" % (self.ip, self.gateway))
file.replaceIfFound(
"Listen .*:8443",
"Listen %s:443\nListen %s:443" % (self.ip, self.gateway))
file.search(
"ServerName.*", "\tServerName %s.%s" %
(self.config.cl.get_type(), self.config.get_domain()))
if file.is_changed():
file.commit()
CsHelper.execute2("systemctl restart apache2", False)
def arpPing(self):
cmd = "arping -c 1 -I %s -A -U -s %s %s" % (
self.dev, self.address['public_ip'], self.address['gateway'])
if not self.cl.is_redundant() and (not self.address['gateway'] or
self.address['gateway'] == "None"):
cmd = "arping -c 1 -I %s -A -U %s" % (self.dev,
self.address['public_ip'])
CsHelper.execute2(cmd, False)
def setup(self):
CsHelper.copy_if_needed(
"/etc/apache2/vhost.template",
"/etc/apache2/sites-enabled/vhost-%s.conf" % self.ip)
file = CsFile("/etc/apache2/sites-enabled/vhost-%s.conf" % (self.ip))
if not self.config.cl.is_redundant():
file.replaceIfFound("<VirtualHost.*:8180>",
"<VirtualHost %s:80>" % (self.ip))
file.replaceIfFound("<VirtualHost.*:8443>",
"\t<VirtualHost %s:443>" % (self.ip))
file.replaceIfFound("Listen .*:8180", "Listen %s:80" % (self.ip))
file.replaceIfFound("Listen .*:8443", "Listen %s:443" % (self.ip))
else:
file.replaceIfFound(
"<VirtualHost.*:8180>",
"<VirtualHost %s:80 %s:80>" % (self.ip, self.gateway))
file.replaceIfFound(
"<VirtualHost.*:8443>",
"\t<VirtualHost %s:443 %s:443>" % (self.ip, self.gateway))
file.replaceIfFound(
"Listen .*:8180",
"Listen %s:80\nListen %s:80" % (self.ip, self.gateway))
file.replaceIfFound(
"Listen .*:8443",
"Listen %s:443\nListen %s:443" % (self.ip, self.gateway))
file.search(
"ServerName.*", "\tServerName %s.%s" %
(self.config.cl.get_type(), self.config.get_domain()))
if file.is_changed():
file.commit()
CsHelper.execute2("systemctl restart apache2", False)
self.fw.append([
"", "front",
"-A INPUT -i %s -d %s/32 -p tcp -m tcp -m state --state NEW --dport 80 -j ACCEPT"
% (self.dev, self.ip)
])
self.fw.append([
"", "front",
"-A INPUT -i %s -d %s/32 -p tcp -m tcp -m state --state NEW --dport 443 -j ACCEPT"
% (self.dev, self.ip)
])
def compare(self, list):
""" Compare reality with what is needed """
# PASS 1: Ensure all chains are present
for fw in list:
new_rule = CsNetfilter()
new_rule.parse(fw[2])
new_rule.set_table(fw[0])
self.add_chain(new_rule)
ruleSet = set()
# PASS 2: Create rules
for fw in list:
tupledFw = tuple(fw)
if tupledFw in ruleSet :
logging.debug("Already processed : %s", tupledFw)
continue
new_rule = CsNetfilter()
new_rule.parse(fw[2])
new_rule.set_table(fw[0])
if isinstance(fw[1], int):
new_rule.set_count(fw[1])
rule_chain = new_rule.get_chain()
logging.debug("Checking if the rule already exists: rule=%s table=%s chain=%s", new_rule.get_rule(), new_rule.get_table(), new_rule.get_chain())
if self.has_rule(new_rule):
logging.debug("Exists: rule=%s table=%s", fw[2], new_rule.get_table())
else:
# print "Add rule %s in table %s" % ( fw[2], new_rule.get_table())
logging.info("Add: rule=%s table=%s", fw[2], new_rule.get_table())
# front means insert instead of append
cpy = fw[2]
if fw[1] == "front":
cpy = cpy.replace('-A', '-I')
if isinstance(fw[1], int):
# if the rule is for ACLs, we want to insert them in order, right before the DROP all
if rule_chain.startswith("ACL_INBOUND") or rule_chain.startswith("ACL_OUTBOUND"):
rule_count = self.chain.get_count(rule_chain)
cpy = cpy.replace("-A %s" % new_rule.get_chain(), '-I %s %s' % (new_rule.get_chain(), rule_count))
else:
cpy = cpy.replace("-A %s" % new_rule.get_chain(), '-I %s %s' % (new_rule.get_chain(), fw[1]))
ret = CsHelper.execute2("iptables -t %s %s" % (new_rule.get_table(), cpy))
#There are some issues in this framework causing failures .. like adding a chain without checking it is present causing
# the failures. Also some of the rule like removeFromLoadBalancerRule is deleting rule and deleteLoadBalancerRule
#trying to delete which causes the failure.
#For now raising the log.
#TODO: Need to fix in the framework.
if ret.returncode != 0 :
error = ret.communicate()[0]
logging.debug("iptables command got failed ... continuing")
ruleSet.add(tupledFw)
self.chain.add_rule(rule_chain)
self.del_standard()
self.get_unseen()
def compare(self, list):
""" Compare reality with what is needed """
# PASS 1: Ensure all chains are present
for fw in list:
new_rule = CsNetfilter()
new_rule.parse(fw[2])
new_rule.set_table(fw[0])
self.add_chain(new_rule)
ruleSet = set()
# PASS 2: Create rules
for fw in list:
tupledFw = tuple(fw)
if tupledFw in ruleSet:
logging.debug("Already processed : %s", tupledFw)
continue
new_rule = CsNetfilter()
new_rule.parse(fw[2])
new_rule.set_table(fw[0])
if isinstance(fw[1], int):
new_rule.set_count(fw[1])
rule_chain = new_rule.get_chain()
logging.debug("Checking if the rule already exists: rule=%s table=%s chain=%s", new_rule.get_rule(), new_rule.get_table(), new_rule.get_chain())
if self.has_rule(new_rule):
logging.debug("Exists: rule=%s table=%s", fw[2], new_rule.get_table())
else:
# print "Add rule %s in table %s" % ( fw[2], new_rule.get_table())
logging.info("Add: rule=%s table=%s", fw[2], new_rule.get_table())
# front means insert instead of append
cpy = fw[2]
if fw[1] == "front":
cpy = cpy.replace('-A', '-I')
if isinstance(fw[1], int):
# if the rule is for ACLs, we want to insert them in order, right before the DROP all
if rule_chain.startswith("ACL_INBOUND") or rule_chain.startswith("ACL_OUTBOUND"):
rule_count = self.chain.get_count(rule_chain) if self.chain.get_count(rule_chain) > 0 else 1
cpy = cpy.replace("-A %s" % new_rule.get_chain(), '-I %s %s' % (new_rule.get_chain(), rule_count))
else:
cpy = cpy.replace("-A %s" % new_rule.get_chain(), '-I %s %s' % (new_rule.get_chain(), fw[1]))
ret = CsHelper.execute2("iptables -t %s %s" % (new_rule.get_table(), cpy))
# There are some issues in this framework causing failures .. like adding a chain without checking it is present causing
# the failures. Also some of the rule like removeFromLoadBalancerRule is deleting rule and deleteLoadBalancerRule
# trying to delete which causes the failure.
# For now raising the log.
# TODO: Need to fix in the framework.
if ret.returncode != 0:
error = ret.communicate()[0]
logging.debug("iptables command got failed ... continuing")
ruleSet.add(tupledFw)
self.chain.add_rule(rule_chain)
self.del_standard()
self.get_unseen()
def setup(self):
CsHelper.copy_if_needed("/etc/apache2/vhost.template",
"/etc/apache2/sites-enabled/vhost-%s.conf" % self.ip)
file = CsFile("/etc/apache2/sites-enabled/vhost-%s.conf" % (self.ip))
file.search("<VirtualHost.*:80>", "\t<VirtualHost %s:80>" % (self.ip))
file.search("<VirtualHost.*:443>", "\t<VirtualHost %s:443>" % (self.ip))
file.search("Listen .*:80", "Listen %s:80" % (self.ip))
file.search("Listen .*:443", "Listen %s:443" % (self.ip))
file.search("ServerName.*", "\tServerName %s.%s" % (self.config.cl.get_type(), self.config.get_domain()))
if file.is_changed():
file.commit()
CsHelper.execute2("systemctl restart apache2", False)
self.fw.append([
"", "front",
"-A INPUT -i %s -d %s/32 -p tcp -m tcp -m state --state NEW --dport 80 -j ACCEPT" % (self.dev, self.ip)
])
self.fw.append([
"", "front",
"-A INPUT -i %s -d %s/32 -p tcp -m tcp -m state --state NEW --dport 443 -j ACCEPT" % (self.dev, self.ip)
])
def arpPing(self):
cmd = "arping -c 1 -I %s -A -U -s %s %s" % (
self.dev, self.address['public_ip'], self.address['gateway'])
if not self.cl.is_redundant() and (not self.address['gateway'] or self.address['gateway'] == "None"):
cmd = "arping -c 1 -I %s -A -U %s" % (self.dev, self.address['public_ip'])
CsHelper.execute2(cmd, False)
