choria-mcorpc-support 0.0.1

data/lib/mcollective/runnerstats.rb

@@ -0,0 +1,90 @@
+module MCollective
+  # Class to store stats about the mcollectived, it should live in the PluginManager
+  # so that agents etc can get hold of it and return the stats to callers
+  class RunnerStats
+    def initialize
+      @starttime = Time.now.to_i
+      @validated = 0
+      @unvalidated = 0
+      @filtered = 0
+      @passed = 0
+      @total = 0
+      @replies = 0
+      @ttlexpired = 0
+
+      @mutex = Mutex.new
+    end
+
+    # Records a message that failed TTL checks
+    def ttlexpired
+      Log.debug("Incrementing ttl expired stat")
+      @ttlexpired += 1
+    end
+
+    # Records a message that passed the filters
+    def passed
+      Log.debug("Incrementing passed stat")
+      @passed += 1
+    end
+
+    # Records a message that didnt pass the filters
+    def filtered
+      Log.debug("Incrementing filtered stat")
+      @filtered += 1
+    end
+
+    # Records a message that validated ok
+    def validated
+      Log.debug("Incrementing validated stat")
+      @validated += 1
+    end
+
+    def unvalidated
+      Log.debug("Incrementing unvalidated stat")
+      @unvalidated += 1
+    end
+
+    # Records receipt of a message
+    def received
+      Log.debug("Incrementing total stat")
+      @total += 1
+    end
+
+    # Records sending a message
+    def sent
+      @mutex.synchronize do
+        Log.debug("Incrementing replies stat")
+        @replies += 1
+      end
+    end
+
+    # Returns a hash with all stats
+    def to_hash
+      stats = {:validated => @validated,
+        :unvalidated => @unvalidated,
+        :passed => @passed,
+        :filtered => @filtered,
+        :starttime => @starttime,
+        :total => @total,
+        :ttlexpired => @ttlexpired,
+        :replies => @replies}
+
+      reply = {:stats => stats,
+        :threads => [],
+        :pid => Process.pid,
+        :times => {} }
+
+      ::Process.times.each_pair{|k,v|
+        k = k.to_sym
+        reply[:times][k] = v
+      }
+
+      Thread.list.each do |t|
+        reply[:threads] << "#{t.inspect}"
+      end
+
+      reply[:agents] = Agents.agentlist
+      reply
+    end
+  end
+end

data/lib/mcollective/security.rb

@@ -0,0 +1,26 @@
+module MCollective
+  # Security is implimented using a module structure and installations
+  # can configure which module they want to use.
+  #
+  # Security modules deal with various aspects of authentication and authorization:
+  #
+  # - Determines if a filter excludes this host from dealing with a request
+  # - Serialization and Deserialization of messages
+  # - Validation of messages against keys, certificates or whatever the class choose to impliment
+  # - Encoding and Decoding of messages
+  #
+  # To impliment a new security class using SSL for example you would inherit from the base
+  # class and only impliment:
+  #
+  # - decodemsg
+  # - encodereply
+  # - encoderequest
+  # - validrequest?
+  #
+  # Each of these methods should increment various stats counters, see the default MCollective::Security::Psk module for examples of this
+  #
+  # Filtering can be extended by providing a new validate_filter? method.
+  module Security
+    require "mcollective/security/base"
+  end
+end

data/lib/mcollective/security/base.rb

@@ -0,0 +1,244 @@
+module MCollective
+  module Security
+    # This is a base class the other security modules should inherit from
+    # it handles statistics and validation of messages that should in most
+    # cases apply to all security models.
+    #
+    # To create your own security plugin you should provide a plugin that inherits
+    # from this and provides the following methods:
+    #
+    # decodemsg      - Decodes a message that was received from the middleware
+    # encodereply    - Encodes a reply message to a previous request message
+    # encoderequest  - Encodes a new request message
+    # validrequest?  - Validates a request received from the middleware
+    #
+    # Optionally if you are identifying users by some other means like certificate name
+    # you can provide your own callerid method that can provide the rest of the system
+    # with an id, and you would see this id being usable in SimpleRPC authorization methods
+    #
+    # The @initiated_by variable will be set to either :client or :node depending on
+    # who is using this plugin.  This is to help security providers that operate in an
+    # asymetric mode like public/private key based systems.
+    #
+    # Specifics of each of these are a bit fluid and the interfaces for this is not
+    # set in stone yet, specifically the encode methods will be provided with a helper
+    # that takes care of encoding the core requirements.  The best place to see how security
+    # works is by looking at the provided MCollective::Security::PSK plugin.
+    class Base
+      attr_reader :stats
+      attr_accessor :initiated_by
+
+      # Register plugins that inherits base
+      def self.inherited(klass)
+        PluginManager << {:type => "security_plugin", :class => klass.to_s}
+      end
+
+      # Initializes configuration and logging as well as prepare a zero'd hash of stats
+      # various security methods and filter validators should increment stats, see MCollective::Security::Psk for a sample
+      def initialize
+        @config = Config.instance
+        @log = Log
+        @stats = PluginManager["global_stats"]
+      end
+
+      # Takes a Hash with a filter in it and validates it against host information.
+      #
+      # At present this supports filter matches against the following criteria:
+      #
+      # - puppet_class|cf_class - Presence of a configuration management class in
+      #                           the file configured with classesfile
+      # - agent - Presence of a MCollective agent with a supplied name
+      # - fact - The value of a fact avout this system
+      # - identity - the configured identity of the system
+      #
+      # TODO: Support REGEX and/or multiple filter keys to be AND'd
+      def validate_filter?(filter)
+        failed = 0
+        passed = 0
+
+        passed = 1 if Util.empty_filter?(filter)
+
+        filter.keys.each do |key|
+          case key
+          when /puppet_class|cf_class/
+            filter[key].each do |f|
+              Log.debug("Checking for class #{f}")
+              if Util.has_cf_class?(f) then
+                Log.debug("Passing based on configuration management class #{f}")
+                passed += 1
+              else
+                Log.debug("Failing based on configuration management class #{f}")
+                failed += 1
+              end
+            end
+
+          when "compound"
+            filter[key].each do |compound|
+              result = false
+              truth_values = []
+
+              begin
+                compound.each do |expression|
+                  case expression.keys.first
+                    when "statement"
+                      truth_values << Matcher.eval_compound_statement(expression).to_s
+                    when "fstatement"
+                      truth_values << Matcher.eval_compound_fstatement(expression.values.first)
+                    when "and"
+                      truth_values << "&&"
+                    when "or"
+                      truth_values << "||"
+                    when "("
+                      truth_values << "("
+                    when ")"
+                      truth_values << ")"
+                    when "not"
+                      truth_values << "!"
+                  end
+                end
+
+                result = eval(truth_values.join(" "))
+              rescue DDLValidationError
+                result = false
+              end
+
+              if result
+                Log.debug("Passing based on class and fact composition")
+                passed +=1
+              else
+                Log.debug("Failing based on class and fact composition")
+                failed +=1
+              end
+            end
+
+          when "agent"
+            filter[key].each do |f|
+              if Util.has_agent?(f) || f == "mcollective"
+                Log.debug("Passing based on agent #{f}")
+                passed += 1
+              else
+                Log.debug("Failing based on agent #{f}")
+                failed += 1
+              end
+            end
+
+          when "fact"
+            filter[key].each do |f|
+              if Util.has_fact?(f[:fact], f[:value], f[:operator])
+                Log.debug("Passing based on fact #{f[:fact]} #{f[:operator]} #{f[:value]}")
+                passed += 1
+              else
+                Log.debug("Failing based on fact #{f[:fact]} #{f[:operator]} #{f[:value]}")
+                failed += 1
+              end
+            end
+
+          when "identity"
+            unless filter[key].empty?
+              # Identity filters should not be 'and' but 'or' as each node can only have one identity
+              matched = filter[key].select{|f| Util.has_identity?(f)}.size
+
+              if matched == 1
+                Log.debug("Passing based on identity")
+                passed += 1
+              else
+                Log.debug("Failed based on identity")
+                failed += 1
+              end
+            end
+          end
+        end
+
+        if failed == 0 && passed > 0
+          Log.debug("Message passed the filter checks")
+
+          @stats.passed
+
+          return true
+        else
+          Log.debug("Message failed the filter checks")
+
+          @stats.filtered
+
+          return false
+        end
+      end
+
+      def create_reply(reqid, agent, body)
+        Log.debug("Encoded a message for request #{reqid}")
+
+        {:senderid => @config.identity,
+         :requestid => reqid,
+         :senderagent => agent,
+         :msgtime => Time.now.utc.to_i,
+         :body => body}
+      end
+
+      def create_request(reqid, filter, msg, initiated_by, target_agent, target_collective, ttl=60)
+        Log.debug("Encoding a request for agent '#{target_agent}' in collective #{target_collective} with request id #{reqid}")
+
+        {:body => msg,
+         :senderid => @config.identity,
+         :requestid => reqid,
+         :filter => filter,
+         :collective => target_collective,
+         :agent => target_agent,
+         :callerid => callerid,
+         :ttl => ttl,
+         :msgtime => Time.now.utc.to_i}
+      end
+
+      # Give a MC::Message instance and a message id this will figure out if you the incoming
+      # message id matches the one the Message object is expecting and raise if its not
+      #
+      # Mostly used by security plugins to figure out if they should do the hard work of decrypting
+      # etc messages that would only later on be ignored
+      def should_process_msg?(msg, msgid)
+        if msg.expected_msgid
+          unless msg.expected_msgid == msgid
+            msgtext = "Got a message with id %s but was expecting %s, ignoring message" % [msgid, msg.expected_msgid]
+            Log.debug msgtext
+            raise MsgDoesNotMatchRequestID, msgtext
+          end
+        end
+
+        true
+      end
+
+      # Validates a callerid.  We do not want to allow things like \ and / in
+      # callerids since other plugins make assumptions that these are safe strings.
+      #
+      # callerids are generally in the form uid=123 or cert=foo etc so we do that
+      # here but security plugins could override this for some complex uses
+      def valid_callerid?(id)
+        !!id.match(/^[\w]+=[\w\.\-]+$/)
+      end
+
+      # Returns a unique id for the caller, by default we just use the unix
+      # user id, security plugins can provide their own means of doing ids.
+      def callerid
+        "uid=#{Process.uid}"
+      end
+
+      # Security providers should provide this, see MCollective::Security::Psk
+      def validrequest?(req)
+        Log.error("validrequest? is not implemented in #{self.class}")
+      end
+
+      # Security providers should provide this, see MCollective::Security::Psk
+      def encoderequest(sender, msg, filter={})
+        Log.error("encoderequest is not implemented in #{self.class}")
+      end
+
+      # Security providers should provide this, see MCollective::Security::Psk
+      def encodereply(sender, msg, requestcallerid=nil)
+        Log.error("encodereply is not implemented in #{self.class}")
+      end
+
+      # Security providers should provide this, see MCollective::Security::Psk
+      def decodemsg(msg)
+        Log.error("decodemsg is not implemented in #{self.class}")
+      end
+    end
+  end
+end

data/lib/mcollective/shell.rb

@@ -0,0 +1,126 @@
+module MCollective
+  # Wrapper around systemu that handles executing of system commands
+  # in a way that makes stdout, stderr and status available.  Supports
+  # timeouts and sets a default sane environment.
+  #
+  #   s = Shell.new("date", opts)
+  #   s.runcommand
+  #   puts s.stdout
+  #   puts s.stderr
+  #   puts s.status.exitstatus
+  #
+  # Options hash can have:
+  #
+  #   cwd         - the working directory the command will be run from
+  #   stdin       - a string that will be sent to stdin of the program
+  #   stdout      - a variable that will receive stdout, must support <<
+  #   stderr      - a variable that will receive stdin, must support <<
+  #   environment - the shell environment, defaults to include LC_ALL=C
+  #                 set to nil to clear the environment even of LC_ALL
+  #   timeout     - a timeout in seconds after which the subprocess is killed,
+  #                 the special value :on_thread_exit kills the subprocess
+  #                 when the invoking thread (typically the agent) has ended
+  #
+  class Shell
+    attr_reader :environment, :command, :status, :stdout, :stderr, :stdin, :cwd, :timeout
+
+    def initialize(command, options={})
+      @environment = {"LC_ALL" => "C"}
+      @command = command
+      @status = nil
+      @stdout = ""
+      @stderr = ""
+      @stdin = nil
+      @cwd = Dir.tmpdir
+      @timeout = nil
+
+      options.each do |opt, val|
+        case opt.to_s
+          when "stdout"
+            raise "stdout should support <<" unless val.respond_to?("<<")
+            @stdout = val
+
+          when "stderr"
+            raise "stderr should support <<" unless val.respond_to?("<<")
+            @stderr = val
+
+          when "stdin"
+            raise "stdin should be a String" unless val.is_a?(String)
+            @stdin = val
+
+          when "cwd"
+            raise "Directory #{val} does not exist" unless File.directory?(val)
+            @cwd = val
+
+          when "environment"
+            if val.nil?
+              @environment = {}
+            else
+              @environment.merge!(val.dup)
+              @environment = @environment.delete_if { |k,v| v.nil? }
+            end
+
+          when "timeout"
+            raise "timeout should be a positive integer or the symbol :on_thread_exit symbol" unless val.eql?(:on_thread_exit) || ( val.is_a?(Integer) && val>0 )
+            @timeout = val
+        end
+      end
+    end
+
+    # Actually does the systemu call passing in the correct environment, stdout and stderr
+    def runcommand
+      opts = {"env"    => @environment,
+              "stdout" => @stdout,
+              "stderr" => @stderr,
+              "cwd"    => @cwd}
+
+      opts["stdin"] = @stdin if @stdin
+
+
+      thread = Thread.current
+      # Start a double fork and exec with systemu which implies a guard thread.
+      # If a valid timeout is configured the guard thread will terminate the
+      # executing process and reap the pid.
+      # If no timeout is specified the process will run to completion with the
+      # guard thread reaping the pid on completion.
+      @status = systemu(@command, opts) do |cid|
+        begin
+          if timeout.is_a?(Integer)
+            # wait for the specified timeout
+            sleep timeout
+          else
+            # sleep while the agent thread is still alive
+            while(thread.alive?)
+              sleep 0.1
+            end
+          end
+
+          # if the process is still running
+          if (Process.kill(0, cid))
+            # and a timeout was specified
+            if timeout
+              if Util.windows?
+                Process.kill('KILL', cid)
+              else
+                # Kill the process
+                Process.kill('TERM', cid)
+                sleep 2
+                Process.kill('KILL', cid) if (Process.kill(0, cid))
+              end
+            end
+            # only wait if the parent thread is dead
+            Process.waitpid(cid) unless thread.alive?
+          end
+        rescue SystemExit
+        rescue Errno::ESRCH
+        rescue Errno::ECHILD
+          Log.warn("Could not reap process '#{cid}'.")
+        rescue Exception => e
+          Log.info("Unexpected exception received while waiting for child process: #{e.class}: #{e}")
+        end
+      end
+      @status.thread.kill
+      @status
+    end
+  end
+end