#!/usr/bin/env python # -*- coding: utf-8 -*- """Helps a client to join domain and maintain itself.""" __author__ = 'BgLUG' __email__ = 'info@bglug.it' from contextlib import contextmanager, closing from subprocess import Popen, PIPE from sqlite3 import connect from bottle import Bottle, request from json import dumps from ConfigParser import ConfigParser from Crypto.Hash import MD5 from Crypto.Cipher import AES import base64 import json import sys import re import os class MyApp: def __init__(self, configfile = '/etc/mac2hostname.ini'): if not os.path.isfile(configfile): print "Cannot find main file, %s. Exiting." % configfile sys.exit(1) # Loads configurations config = ConfigParser() config.read(configfile) # Populates private properties with configuration self.__dbfile = config.get('Daemon', 'Database') if config.has_option('Daemon', 'Database') else '/var/lib/doraemon/doraemon.db' self.__logdir = config.get('Daemon', 'LogFile') if config.has_option('Daemon', 'LogFile') else '/var/log/doraemon.log' self.__pidfile = config.get('Daemon', 'PIDFile') if config.has_option('Daemon', 'PIDFile') else '/var/run/doraemon.pid' self.__bindaddress = config.get('Daemon', 'BindAddress') if config.has_option('Daemon', 'BindAddress') else '127.0.0.1' self.__port = config.getint('Daemon', 'Port') if config.has_option('Daemon', 'Port') else 8080 self.__defaultbase = config.get('NameSettings', 'Base') if config.has_option('NameSettings', 'Base') else 'client' self.__defaultrole = config.get('NameSettings', 'Role') if config.has_option('NameSettings', 'Role') else 'client' self.__namedigits = config.get('NameSettings', 'Digits') if config.has_option('NameSettings', 'Digits') else '2' self.__domainfile = config.get('Files', 'Domain') if config.has_option('Files', 'Domain') else None self.__mgmtfile = config.get('Files', 'MgmtKey') if config.has_option('Files', 'MgmtKey') else None self.__vaultpassfile = config.get('Files', 'VaultPassFile') if config.has_option('Files', 'VaultPassFile') else None self.__app = Bottle() # Applies routes self.__route() # Assures table creation self.__init_tables() @contextmanager def __getcursor(self): with connect(self.__dbfile) as connection: with closing(connection.cursor()) as cursor: yield cursor # Private methods def __route(self): self.__app.get('/mac2hostname', callback=self.mac2hostname) self.__app.get('/whatsmyhostname', callback=self.whatsmyhostname) self.__app.get('/hosts', callback=self.hosts) self.__app.get('/domain', callback=self.domain) self.__app.get('/mgmtkey', callback=self.mgmtkey) self.__app.get('/vaultpass', callback=self.vaultpass) self.__app.get('/ansible_list', callback=self.ansible_list) self.__app.get('/ansible_host', callback=self.ansible_host) def __init_tables(self): with self.__getcursor() as cursor: cursor.execute('CREATE TABLE IF NOT EXISTS client (id INT PRIMARY KEY,' 'hostname TEXT NOT NULL UNIQUE, mac TEXT UNIQUE, role TEXT)') cursor.execute('CREATE INDEX IF NOT EXISTS idxmac ON client(mac)') def __getmac(self, ip): Popen(['ping', '-c1', '-t2', ip], stdout=PIPE).communicate() arp = Popen(['arp', '-n', ip], stdout=PIPE).communicate()[0] return re.search(r'(([\da-fA-F]{1,2}\:){5}[\da-fA-F]{1,2})', arp).group(1).lower() def __normalizemac(self, mac): return ':'.join(x.zfill(2) for x in mac.split('_')).lower() def __gethostname(self, mac, base = None, role = None): if base == None: base = self.__defaultbase if role == None: role = self.__defaultrole with self.__getcursor() as cursor: (newid,) = cursor.execute('SELECT COALESCE(MAX(id) + 1, 1) FROM client').fetchone() # Constucts the hostname format formatstring = '%s-%0' + self.__namedigits + 'd' data = (newid, formatstring % (base, newid), mac, role) # Since MAC is Unique, this fails with the same MAC address cursor.execute('INSERT OR IGNORE INTO client VALUES (?, ?, ?, ?)', data) (hostname,) = cursor.execute('SELECT hostname FROM client WHERE mac = "%s"' % mac).fetchone() return hostname # This should be used only after registration of the client # (whatsmyhostname) def __getrole(self): macaddress = self.__normalizemac(self.__getmac(request['REMOTE_ADDR'])) hostname = self.__gethostname(macaddress) with self.__getcursor() as cursor: (role,) = cursor.execute("SELECT role FROM client WHERE hostname = '%s' AND mac = '%s'" % (hostname, macaddress)).fetchone() return role # Variables returned to the client def __rolevars(self, role=None): retval = {'role': role, 'addpkg': [], 'delpkg': []} try: db = Popen(['db', 'roles', 'getjson'], stdout=PIPE).communicate()[0] for data in json.loads(db): if data['name'] == role: retval['addpkg'] = data['props']['Addpkg'].split() retval['delpkg'] = data['props']['Delpkg'].split() continue except: pass return retval # Instance methods AKA routes def mac2hostname(self): # Ensure required parameters have been passed if not request.query.mac: return "Usage: GET /mac2hostname?mac=XX_XX_XX_XX_XX_XX[&base=YYY][&role=ZZZ]" # Sets up variables for possible parameters mac = self.__normalizemac(request.query.mac) base = request.query.base or self.__defaultbase role = request.query.role or self.__defaultrole return self.__gethostname(mac, base, role) def whatsmyhostname(self): # No required parameters ip = request.query.ip or request['REMOTE_ADDR'] base = request.query.base or self.__defaultbase role = request.query.role or self.__defaultrole return self.__gethostname(self.__getmac(ip), base, role) def hosts(self): # Default where clause: no where specifications where = '' # If a role parameter is passed, list the hosts for that role if request.query.role: where = "WHERE role = '%s'" % request.query.role with self.__getcursor() as cursor: return dumps([dict((meta[0], data) for meta, data in zip(cursor.description, row)) for row in cursor.execute('SELECT role, hostname, mac FROM client ' + where + 'ORDER BY role ASC, hostname ASC')], indent=4) def domain(self): with open(self.__domainfile, 'r') as f: return f.read() def mgmtkey(self): with open(self.__mgmtfile, 'r') as f: return f.read() def vaultpass(self): with open(self.__vaultpassfile, 'r') as f: ip = request.query.ip or request['REMOTE_ADDR'] base = request.query.base or self.__defaultbase role = request.query.role or self.__defaultrole hostname = self.__gethostname(self.__getmac(ip), base, role) # Encryption key key = MD5.new(hostname).digest() # Secret secret = f.read().strip() # Creating a secret that is multiple of 16 in length i = 16 - (len(secret) % 16) lengthy_secret = secret + i * 'x' cipher = AES.new(key, AES.MODE_ECB) crypted = cipher.encrypt(lengthy_secret) # Encode in base64 because of unicode strings return base64.b64encode(crypted) def ansible_list(self): # Faking calls if request.query.role: role = request.query.role else: role = self.__getrole() result = { 'localhost': { 'hosts': [ 'localhost' ], 'vars': { 'ansible_connection': 'local' } }, '_meta': { 'hostvars': { 'localhost': self.__rolevars(role) } } } return dumps(result) def ansible_host(self): # Ignoring 'host' parameter, since it should always be 'localhost'. # Instead, for testing purposes, if asked for a role, use it if request.query.role: role = request.query.role else: role = self.__getrole() return dumps(self.__rolevars(role)) def start(self): # Opens up a PID file pid = os.getpid() pidfile = open(self.__pidfile, 'w') pidfile.write('%s' % pid) pidfile.close() # Runs Bottle, at last. self.__app.run(host=self.__bindaddress, port=self.__port) # Main body if __name__ == '__main__': cfgfile = '/etc/doraemon.ini' if len(sys.argv) > 1: cfgfile = sys.argv[1] app = MyApp(cfgfile) app.start()