mirror of https://github.com/GNS3/gns3-server
Merge pull request #4 from planctechnologies/gns3-87
Gns3 87 - add server security and startup scriptspull/37/head^2
jseutter
10 years ago
commit
6ff2c654d9
@ -0,0 +1,99 @@
|
||||
#!/bin/bash
|
||||
|
||||
# -*- coding: utf-8 -*-
|
||||
#
|
||||
# Copyright (C) 2013 GNS3 Technologies Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
# Bash shell script for generating self-signed certs. Run this in a folder, as it
|
||||
# generates a few files. Large portions of this script were taken from the
|
||||
# following artcile:
|
||||
#
|
||||
# http://usrportage.de/archives/919-Batch-generating-SSL-certificates.html
|
||||
#
|
||||
# Additional alterations by: Brad Landers
|
||||
# Date: 2012-01-27
|
||||
# https://gist.github.com/bradland/1690807
|
||||
|
||||
# Script accepts a single argument, the fqdn for the cert
|
||||
|
||||
DST_DIR="$HOME/.config/GNS3Certs/"
|
||||
OLD_DIR=`pwd`
|
||||
|
||||
#GNS3 Server expects to find certs with the default FQDN below. If you create
|
||||
#different certs you will need to update server.py
|
||||
DOMAIN="$1"
|
||||
if [ -z "$DOMAIN" ]; then
|
||||
DOMAIN="gns3server.localdomain.com"
|
||||
fi
|
||||
|
||||
fail_if_error() {
|
||||
[ $1 != 0 ] && {
|
||||
unset PASSPHRASE
|
||||
cd $OLD_DIR
|
||||
exit 10
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
mkdir -p $DST_DIR
|
||||
fail_if_error $?
|
||||
cd $DST_DIR
|
||||
|
||||
|
||||
# Generate a passphrase
|
||||
export PASSPHRASE=$(head -c 500 /dev/urandom | tr -dc a-z0-9A-Z | head -c 128; echo)
|
||||
|
||||
# Certificate details; replace items in angle brackets with your own info
|
||||
subj="
|
||||
C=CA
|
||||
ST=Alberta
|
||||
O=GNS3
|
||||
localityName=Calgary
|
||||
commonName=gns3server.localdomain.com
|
||||
organizationalUnitName=GNS3Server
|
||||
emailAddress=gns3cert@gns3.com
|
||||
"
|
||||
|
||||
# Generate the server private key
|
||||
openssl genrsa -aes256 -out $DOMAIN.key -passout env:PASSPHRASE 2048
|
||||
fail_if_error $?
|
||||
|
||||
#openssl rsa -outform der -in $DOMAIN.pem -out $DOMAIN.key -passin env:PASSPHRASE
|
||||
|
||||
# Generate the CSR
|
||||
openssl req \
|
||||
-new \
|
||||
-batch \
|
||||
-subj "$(echo -n "$subj" | tr "\n" "/")" \
|
||||
-key $DOMAIN.key \
|
||||
-out $DOMAIN.csr \
|
||||
-passin env:PASSPHRASE
|
||||
fail_if_error $?
|
||||
cp $DOMAIN.key $DOMAIN.key.org
|
||||
fail_if_error $?
|
||||
|
||||
# Strip the password so we don't have to type it every time we restart Apache
|
||||
openssl rsa -in $DOMAIN.key.org -out $DOMAIN.key -passin env:PASSPHRASE
|
||||
fail_if_error $?
|
||||
|
||||
# Generate the cert (good for 10 years)
|
||||
openssl x509 -req -days 3650 -in $DOMAIN.csr -signkey $DOMAIN.key -out $DOMAIN.crt
|
||||
fail_if_error $?
|
||||
|
||||
echo "${DST_DIR}${DOMAIN}.key"
|
||||
echo "${DST_DIR}${DOMAIN}.crt"
|
||||
|
||||
cd $OLD_DIR
|
||||
@ -0,0 +1,82 @@
|
||||
# -*- coding: utf-8 -*-
|
||||
#
|
||||
# Copyright (C) 2014 GNS3 Technologies Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
"""
|
||||
Simple file upload & listing handler.
|
||||
"""
|
||||
|
||||
|
||||
import os
|
||||
import tornado.web
|
||||
import tornado.websocket
|
||||
|
||||
import logging
|
||||
log = logging.getLogger(__name__)
|
||||
|
||||
class GNS3BaseHandler(tornado.web.RequestHandler):
|
||||
def get_current_user(self):
|
||||
user = self.get_secure_cookie("user")
|
||||
if not user:
|
||||
return None
|
||||
|
||||
if self.settings['required_user'] == user.decode("utf-8"):
|
||||
return user
|
||||
|
||||
class GNS3WebSocketBaseHandler(tornado.websocket.WebSocketHandler):
|
||||
def get_current_user(self):
|
||||
user = self.get_secure_cookie("user")
|
||||
if not user:
|
||||
return None
|
||||
|
||||
if self.settings['required_user'] == user.decode("utf-8"):
|
||||
return user
|
||||
|
||||
|
||||
class LoginHandler(tornado.web.RequestHandler):
|
||||
def get(self):
|
||||
self.write('<html><body><form action="/login" method="post">'
|
||||
'Name: <input type="text" name="name">'
|
||||
'Password: <input type="text" name="password">'
|
||||
'<input type="submit" value="Sign in">'
|
||||
'</form></body></html>')
|
||||
|
||||
try:
|
||||
redirect_to = self.get_argument("next")
|
||||
self.set_secure_cookie("login_success_redirect_to", redirect_to)
|
||||
except tornado.web.MissingArgumentError:
|
||||
pass
|
||||
|
||||
def post(self):
|
||||
|
||||
user = self.get_argument("name")
|
||||
password = self.get_argument("password")
|
||||
|
||||
if self.settings['required_user'] == user and self.settings['required_pass'] == password:
|
||||
self.set_secure_cookie("user", user)
|
||||
auth_status = "successful"
|
||||
else:
|
||||
self.set_secure_cookie("user", "None")
|
||||
auth_status = "failure"
|
||||
|
||||
log.info("Authentication attempt %s: %s" %(auth_status, user))
|
||||
|
||||
try:
|
||||
redirect_to = self.get_secure_cookie("login_success_redirect_to")
|
||||
except tornado.web.MissingArgumentError:
|
||||
redirect_to = "/"
|
||||
|
||||
self.redirect(redirect_to)
|
||||
@ -0,0 +1,153 @@
|
||||
# -*- coding: utf-8 -*-
|
||||
#
|
||||
# Copyright (C) 2014 GNS3 Technologies Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
"""
|
||||
DeadMan server module.
|
||||
"""
|
||||
|
||||
import os
|
||||
import time
|
||||
import subprocess
|
||||
|
||||
from gns3server.modules import IModule
|
||||
from gns3server.config import Config
|
||||
|
||||
|
||||
import logging
|
||||
log = logging.getLogger(__name__)
|
||||
|
||||
class DeadMan(IModule):
|
||||
"""
|
||||
DeadMan module.
|
||||
|
||||
:param name: module name
|
||||
:param args: arguments for the module
|
||||
:param kwargs: named arguments for the module
|
||||
"""
|
||||
|
||||
def __init__(self, name, *args, **kwargs):
|
||||
config = Config.instance()
|
||||
|
||||
# a new process start when calling IModule
|
||||
IModule.__init__(self, name, *args, **kwargs)
|
||||
self._host = kwargs["host"]
|
||||
self._projects_dir = kwargs["projects_dir"]
|
||||
self._tempdir = kwargs["temp_dir"]
|
||||
self._working_dir = self._projects_dir
|
||||
self._heartbeat_file = "%s/heartbeat_file_for_gnsdms" % (
|
||||
self._tempdir)
|
||||
|
||||
if 'heartbeat_file' in kwargs:
|
||||
self._heartbeat_file = kwargs['heartbeat_file']
|
||||
|
||||
self._deadman_process = None
|
||||
self.heartbeat()
|
||||
self.start()
|
||||
|
||||
def _start_deadman_process(self):
|
||||
"""
|
||||
Start a subprocess and return the object
|
||||
"""
|
||||
|
||||
#gnsserver gets configuration options from cloud.conf. This is where
|
||||
#the client adds specific cloud information.
|
||||
#gns3dms also reads in cloud.conf. That is why we don't need to specific
|
||||
#all the command line arguments here.
|
||||
|
||||
cmd = []
|
||||
cmd.append("gns3dms")
|
||||
cmd.append("--file")
|
||||
cmd.append("%s" % (self._heartbeat_file))
|
||||
cmd.append("--background")
|
||||
log.debug("Deadman: Running %s"%(cmd))
|
||||
|
||||
process = subprocess.Popen(cmd, stderr=subprocess.STDOUT, shell=False)
|
||||
return process
|
||||
|
||||
def _stop_deadman_process(self):
|
||||
"""
|
||||
Start a subprocess and return the object
|
||||
"""
|
||||
|
||||
cmd = []
|
||||
|
||||
cmd.append("gns3dms")
|
||||
cmd.append("-k")
|
||||
log.debug("Deadman: Running %s"%(cmd))
|
||||
|
||||
process = subprocess.Popen(cmd, shell=False)
|
||||
return process
|
||||
|
||||
|
||||
def stop(self, signum=None):
|
||||
"""
|
||||
Properly stops the module.
|
||||
|
||||
:param signum: signal number (if called by the signal handler)
|
||||
"""
|
||||
|
||||
if self._deadman_process == None:
|
||||
log.info("Deadman: Can't stop, is not currently running")
|
||||
|
||||
log.debug("Deadman: Stopping process")
|
||||
|
||||
self._deadman_process = self._stop_deadman_process()
|
||||
self._deadman_process = None
|
||||
#Jerry or Jeremy why do we do this? Won't this stop the I/O loop for
|
||||
#for everyone?
|
||||
IModule.stop(self, signum) # this will stop the I/O loop
|
||||
|
||||
def start(self, request=None):
|
||||
"""
|
||||
Start the deadman process on the server
|
||||
"""
|
||||
|
||||
self._deadman_process = self._start_deadman_process()
|
||||
log.debug("Deadman: Process is starting")
|
||||
|
||||
@IModule.route("deadman.reset")
|
||||
def reset(self, request=None):
|
||||
"""
|
||||
Resets the module (JSON-RPC notification).
|
||||
|
||||
:param request: JSON request (not used)
|
||||
"""
|
||||
|
||||
self.stop()
|
||||
self.start()
|
||||
|
||||
log.info("Deadman: Module has been reset")
|
||||
|
||||
|
||||
@IModule.route("deadman.heartbeat")
|
||||
def heartbeat(self, request=None):
|
||||
"""
|
||||
Update a file on the server that the deadman switch will monitor
|
||||
"""
|
||||
|
||||
now = time.time()
|
||||
|
||||
with open(self._heartbeat_file, 'w') as heartbeat_file:
|
||||
heartbeat_file.write(str(now))
|
||||
heartbeat_file.close()
|
||||
|
||||
log.debug("Deadman: heartbeat_file updated: %s %s" % (
|
||||
self._heartbeat_file,
|
||||
now,
|
||||
))
|
||||
|
||||
self.start()
|
||||
@ -0,0 +1,240 @@
|
||||
# -*- coding: utf-8 -*-
|
||||
#
|
||||
# Copyright (C) 2013 GNS3 Technologies Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
# __version__ is a human-readable version number.
|
||||
|
||||
# __version_info__ is a four-tuple for programmatic comparison. The first
|
||||
# three numbers are the components of the version number. The fourth
|
||||
# is zero for an official release, positive for a development branch,
|
||||
# or negative for a release candidate or beta (after the base version
|
||||
# number has been incremented)
|
||||
|
||||
"""
|
||||
Startup script for GNS3 Server Cloud Instance
|
||||
"""
|
||||
|
||||
import os
|
||||
import sys
|
||||
import configparser
|
||||
import getopt
|
||||
import datetime
|
||||
import signal
|
||||
from logging.handlers import *
|
||||
from os.path import expanduser
|
||||
from gns3server.config import Config
|
||||
import ast
|
||||
import subprocess
|
||||
import uuid
|
||||
|
||||
SCRIPT_NAME = os.path.basename(__file__)
|
||||
|
||||
#Is the full path when used as an import
|
||||
SCRIPT_PATH = os.path.dirname(__file__)
|
||||
|
||||
if not SCRIPT_PATH:
|
||||
SCRIPT_PATH = os.path.join(os.path.dirname(os.path.abspath(
|
||||
sys.argv[0])))
|
||||
|
||||
|
||||
LOG_NAME = "gns3-startup"
|
||||
log = None
|
||||
|
||||
usage = """
|
||||
USAGE: %s
|
||||
|
||||
Options:
|
||||
|
||||
-d, --debug Enable debugging
|
||||
-v, --verbose Enable verbose logging
|
||||
-h, --help Display this menu :)
|
||||
|
||||
--data Python dict of data to be written to the config file:
|
||||
" { 'gns3' : 'Is AWESOME' } "
|
||||
|
||||
""" % (SCRIPT_NAME)
|
||||
|
||||
# Parse cmd line options
|
||||
def parse_cmd_line(argv):
|
||||
"""
|
||||
Parse command line arguments
|
||||
|
||||
argv: Pass in cmd line arguments
|
||||
"""
|
||||
|
||||
short_args = "dvh"
|
||||
long_args = ("debug",
|
||||
"verbose",
|
||||
"help",
|
||||
"data=",
|
||||
)
|
||||
try:
|
||||
opts, extra_opts = getopt.getopt(argv[1:], short_args, long_args)
|
||||
except getopt.GetoptError as e:
|
||||
print("Unrecognized command line option or missing required argument: %s" %(e))
|
||||
print(usage)
|
||||
sys.exit(2)
|
||||
|
||||
cmd_line_option_list = {}
|
||||
cmd_line_option_list["debug"] = False
|
||||
cmd_line_option_list["verbose"] = True
|
||||
cmd_line_option_list["data"] = None
|
||||
|
||||
if sys.platform == "linux":
|
||||
cmd_line_option_list['syslog'] = "/dev/log"
|
||||
elif sys.platform == "osx":
|
||||
cmd_line_option_list['syslog'] = "/var/run/syslog"
|
||||
else:
|
||||
cmd_line_option_list['syslog'] = ('localhost',514)
|
||||
|
||||
for opt, val in opts:
|
||||
if (opt in ("-h", "--help")):
|
||||
print(usage)
|
||||
sys.exit(0)
|
||||
elif (opt in ("-d", "--debug")):
|
||||
cmd_line_option_list["debug"] = True
|
||||
elif (opt in ("-v", "--verbose")):
|
||||
cmd_line_option_list["verbose"] = True
|
||||
elif (opt in ("--data")):
|
||||
cmd_line_option_list["data"] = ast.literal_eval(val)
|
||||
|
||||
return cmd_line_option_list
|
||||
|
||||
|
||||
def set_logging(cmd_options):
|
||||
"""
|
||||
Setup logging and format output for console and syslog
|
||||
|
||||
Syslog is using the KERN facility
|
||||
"""
|
||||
log = logging.getLogger("%s" % (LOG_NAME))
|
||||
log_level = logging.INFO
|
||||
log_level_console = logging.WARNING
|
||||
|
||||
if cmd_options['verbose'] == True:
|
||||
log_level_console = logging.INFO
|
||||
|
||||
if cmd_options['debug'] == True:
|
||||
log_level_console = logging.DEBUG
|
||||
log_level = logging.DEBUG
|
||||
|
||||
formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s')
|
||||
sys_formatter = logging.Formatter('%(name)s - %(levelname)s - %(message)s')
|
||||
|
||||
console_log = logging.StreamHandler()
|
||||
console_log.setLevel(log_level_console)
|
||||
console_log.setFormatter(formatter)
|
||||
|
||||
syslog_hndlr = SysLogHandler(
|
||||
address=cmd_options['syslog'],
|
||||
facility=SysLogHandler.LOG_KERN
|
||||
)
|
||||
|
||||
syslog_hndlr.setFormatter(sys_formatter)
|
||||
|
||||
log.setLevel(log_level)
|
||||
log.addHandler(console_log)
|
||||
log.addHandler(syslog_hndlr)
|
||||
|
||||
return log
|
||||
|
||||
def _generate_certs():
|
||||
cmd = []
|
||||
cmd.append("%s/cert_utils/create_cert.sh" % (SCRIPT_PATH))
|
||||
|
||||
log.debug("Generating certs ...")
|
||||
output_raw = subprocess.check_output(cmd, shell=False,
|
||||
stderr=subprocess.STDOUT)
|
||||
|
||||
output_str = output_raw.decode("utf-8")
|
||||
output = output_str.strip().split("\n")
|
||||
log.debug(output)
|
||||
return (output[-2], output[-1])
|
||||
|
||||
def _start_gns3server():
|
||||
cmd = []
|
||||
cmd.append("gns3server")
|
||||
|
||||
log.debug("Starting gns3server ...")
|
||||
subprocess.Popen(cmd, shell=False)
|
||||
|
||||
|
||||
def main():
|
||||
|
||||
global log
|
||||
options = parse_cmd_line(sys.argv)
|
||||
log = set_logging(options)
|
||||
|
||||
def _shutdown(signalnum=None, frame=None):
|
||||
"""
|
||||
Handles the SIGINT and SIGTERM event, inside of main so it has access to
|
||||
the log vars.
|
||||
"""
|
||||
|
||||
log.info("Received shutdown signal")
|
||||
sys.exit(0)
|
||||
|
||||
|
||||
# Setup signal to catch Control-C / SIGINT and SIGTERM
|
||||
signal.signal(signal.SIGINT, _shutdown)
|
||||
signal.signal(signal.SIGTERM, _shutdown)
|
||||
|
||||
client_data = {}
|
||||
|
||||
config = Config.instance()
|
||||
cfg = config.list_cloud_config_file()
|
||||
cfg_path = os.path.dirname(cfg)
|
||||
|
||||
try:
|
||||
os.makedirs(cfg_path)
|
||||
except FileExistsError:
|
||||
pass
|
||||
|
||||
(server_key, server_crt ) = _generate_certs()
|
||||
|
||||
cloud_config = configparser.ConfigParser()
|
||||
cloud_config['CLOUD_SERVER'] = {}
|
||||
|
||||
if options['data']:
|
||||
cloud_config['CLOUD_SERVER'] = options['data']
|
||||
|
||||
cloud_config['CLOUD_SERVER']['SSL_KEY'] = server_key
|
||||
cloud_config['CLOUD_SERVER']['SSL_CRT'] = server_crt
|
||||
cloud_config['CLOUD_SERVER']['SSL_ENABLED'] = 'yes'
|
||||
cloud_config['CLOUD_SERVER']['WEB_USERNAME'] = str(uuid.uuid4()).upper()[0:8]
|
||||
cloud_config['CLOUD_SERVER']['WEB_PASSWORD'] = str(uuid.uuid4()).upper()[0:8]
|
||||
|
||||
with open(cfg, 'w') as cloud_config_file:
|
||||
cloud_config.write(cloud_config_file)
|
||||
|
||||
cloud_config_file.close()
|
||||
|
||||
_start_gns3server()
|
||||
|
||||
with open(server_crt, 'r') as cert_file:
|
||||
cert_data = cert_file.readlines()
|
||||
|
||||
cert_file.close()
|
||||
|
||||
client_data['SSL_CRT_FILE'] = server_crt
|
||||
client_data['SSL_CRT'] = cert_data
|
||||
|
||||
print(client_data)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
result = main()
|
||||
sys.exit(result)
|
||||
Loading…
Reference in new issue