code.grnet.gr Git - snf-nfdhcpd/blob - nfdhcp.py

   1 #!/usr/bin/env python
   2 #
   3
   4 # nfdcpd: A promiscuous, NFQUEUE-based DHCP server for virtual machine hosting
   5 # Copyright (c) 2010 GRNET SA
   6 #
   7 #    This program is free software; you can redistribute it and/or modify
   8 #    it under the terms of the GNU General Public License as published by
   9 #    the Free Software Foundation; either version 2 of the License, or
  10 #    (at your option) any later version.
  11 #
  12 #    This program is distributed in the hope that it will be useful,
  13 #    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 #    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 #    GNU General Public License for more details.
  16 #
  17 #    You should have received a copy of the GNU General Public License along
  18 #    with this program; if not, write to the Free Software Foundation, Inc.,
  19 #    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  20 #
  21
  22 import os
  23 import re
  24 import glob
  25 import logging
  26 import logging.handlers
  27 import subprocess
  28
  29 import daemon
  30 import nfqueue
  31 import pyinotify
  32
  33 import IPy
  34 from select import select
  35 from socket import AF_INET, AF_PACKET, AF_UNSPEC
  36
  37 from scapy.layers.l2 import Ether
  38 from scapy.layers.inet import IP, UDP
  39 from scapy.layers.dhcp import BOOTP, DHCP
  40 from scapy.sendrecv import sendp
  41
  42 DEFAULT_PATH = "/var/run/ganeti-dhcpd"
  43 DEFAULT_NFQUEUE_NUM = 42
  44 DEFAULT_USER = "nobody"
  45 DEFAULT_LEASE_TIME = 604800 # 1 week
  46 DEFAULT_RENEWAL_TIME = 600  # 10 min
  47
  48 LOG_FILENAME = "/var/log/nfdhcpd/nfdhcpd.log"
  49
  50 SYSFS_NET = "/sys/class/net"
  51 MY_IP = "1.2.3.4"
  52
  53 LOG_FORMAT = "%(asctime)-15s %(levelname)-6s %(message)s"
  54
  55 DHCPDISCOVER = 1
  56 DHCPOFFER = 2
  57 DHCPREQUEST = 3
  58 DHCPDECLINE = 4
  59 DHCPACK = 5
  60 DHCPNAK = 6
  61 DHCPRELEASE = 7
  62 DHCPINFORM = 8
  63
  64 DHCP_TYPES = {
  65     DHCPDISCOVER: "DHCPDISCOVER",
  66     DHCPOFFER: "DHCPOFFER",
  67     DHCPREQUEST: "DHCPREQUEST",
  68     DHCPDECLINE: "DHCPDECLINE",
  69     DHCPACK: "DHCPACK",
  70     DHCPNAK: "DHCPNAK",
  71     DHCPRELEASE: "DHCPRELEASE",
  72     DHCPINFORM: "DHCPINFORM",
  73 }
  74
  75 DHCP_REQRESP = {
  76     DHCPDISCOVER: DHCPOFFER,
  77     DHCPREQUEST: DHCPACK,
  78     DHCPINFORM: DHCPACK,
  79     }
  80
  81 class DhcpBindingHandler(pyinotify.ProcessEvent):
  82     def __init__(self, dhcp):
  83         pyinotify.ProcessEvent.__init__(self)
  84         self.dhcp = dhcp
  85
  86     def process_IN_DELETE(self, event):
  87         self.dhcp.remove_iface(event.name)
  88
  89     def process_IN_CLOSE_WRITE(self, event):
  90         self.dhcp.add_iface(os.path.join(event.path, event.name))
  91
  92 class DhcpBinding(object):
  93     def __init__(self, mac=None, ips=None, link=None, hostname=None):
  94         self.mac = mac
  95         self.ips = ips
  96         self.hostname = hostname
  97         self.link = link
  98         self.iface = None
  99
 100     @property
 101     def ip(self):
 102         return self.ips[0]
 103
 104     def is_valid(self):
 105         return self.mac is not None and self.ips is not None\
 106                and self.hostname is not None
 107
 108
 109 class Subnet(object):
 110     def __init__(self, net=None, gw=None, dev=None):
 111         if isinstance(net, str):
 112             self.net = IPy.IP(net)
 113         else:
 114             self.net = net
 115         self.gw = gw
 116         self.dev = dev
 117
 118     @property
 119     def netmask(self):
 120         return str(self.net.netmask())
 121
 122     @property
 123     def broadcast(self):
 124         return str(self.net.broadcast())
 125
 126
 127 class DhcpServer(object):
 128     def __init__(self, data_path, queue_num):
 129         self.data_path = data_path
 130         self.clients = {}
 131         self.subnets = {}
 132         self.ifaces = {}
 133
 134         # Inotify setup
 135         self.wm = pyinotify.WatchManager()
 136         mask = pyinotify.EventsCodes.ALL_FLAGS["IN_DELETE"]
 137         mask |= pyinotify.EventsCodes.ALL_FLAGS["IN_CLOSE_WRITE"]
 138         handler = DhcpBindingHandler(self)
 139         self.notifier = pyinotify.Notifier(self.wm, handler)
 140         self.wm.add_watch(self.data_path, mask, rec=True)
 141
 142         # NFQueue setup
 143         self.q = nfqueue.queue()
 144         self.q.set_callback(self.make_reply)
 145         self.q.fast_open(queue_num, AF_INET)
 146         self.q.set_queue_maxlen(5000)
 147         # This is mandatory for the queue to operate
 148         self.q.set_mode(nfqueue.NFQNL_COPY_PACKET)
 149
 150     def build_config(self):
 151         self.clients.clear()
 152         self.subnets.clear()
 153
 154         for file in glob.glob(os.path.join(self.data_path, "*")):
 155             self.add_iface(file)
 156
 157     def get_ifindex(self, iface):
 158         """ Get the interface index from sysfs
 159
 160         """
 161         file = os.path.abspath(os.path.join(SYSFS_NET, iface, "ifindex"))
 162         if not file.startswith(SYSFS_NET):
 163             return None
 164
 165         ifindex = None
 166
 167         try:
 168             f = open(file, 'r')
 169             ifindex = int(f.readline().strip())
 170             f.close()
 171         except:
 172             pass
 173
 174         return ifindex
 175
 176
 177     def get_iface_hw_addr(self, iface):
 178         """ Get the interface hardware address from sysfs
 179
 180         """
 181         file = os.path.abspath(os.path.join(SYSFS_NET, iface, "address"))
 182         if not file.startswith(SYSFS_NET):
 183             return None
 184
 185         addr = None
 186         try:
 187             f = open(file, 'r')
 188             addr = f.readline().strip()
 189             f.close()
 190         except:
 191             pass
 192         return addr
 193
 194     def parse_routing_table(self, table="main"):
 195         """ Parse the given routing table to get connected route, gateway and
 196         default device.
 197
 198         """
 199         ipro = subprocess.Popen(["ip", "ro", "ls", "table", table],
 200                                 stdout=subprocess.PIPE)
 201         routes = ipro.stdout.readlines()
 202
 203         def_gw = None
 204         def_dev = None
 205         def_net = None
 206
 207         for route in routes:
 208             match = re.match(r'^default.*via ([^\s]+).*dev ([^\s]+)', route)
 209             if match:
 210                 def_gw, def_dev = match.groups()
 211                 break
 212
 213         for route in routes:
 214             # Find the least-specific connected route
 215             try:
 216                 def_net = re.match("^([^\\s]+) dev %s" %
 217                                    def_dev, route).groups()[0]
 218                 def_net = IPy.IP(def_net)
 219             except:
 220                 pass
 221
 222         return Subnet(net=def_net, gw=def_gw, dev=def_dev)
 223
 224     def parse_binding_file(self, path):
 225         """ Read a client configuration from a tap file
 226
 227         """
 228         try:
 229             iffile = open(path, 'r')
 230         except:
 231             return (None, None, None, None)
 232         mac = None
 233         ips = None
 234         link = None
 235         hostname = None
 236
 237         for line in iffile:
 238             if line.startswith("IP="):
 239                 ip = line.strip().split("=")[1]
 240                 ips = ip.split()
 241             elif line.startswith("MAC="):
 242                 mac = line.strip().split("=")[1]
 243             elif line.startswith("LINK="):
 244                 link = line.strip().split("=")[1]
 245             elif line.startswith("HOSTNAME="):
 246                 hostname = line.strip().split("=")[1]
 247
 248         return DhcpBinding(mac=mac, ips=ips, link=link, hostname=hostname)
 249
 250     def add_iface(self, path):
 251         """ Add an interface to monitor
 252
 253         """
 254         iface = os.path.basename(path)
 255
 256         logging.debug("Updating configuration for %s" % iface)
 257         binding = self.parse_binding_file(path)
 258         ifindex = self.get_ifindex(iface)
 259
 260         if ifindex is None:
 261             logging.warn("Stale configuration for %s found" % iface)
 262         else:
 263             if binding.is_valid():
 264                 binding.iface = iface
 265                 self.clients[binding.mac] = binding
 266                 self.subnets[binding.link] = self.parse_routing_table(
 267                                                 binding.link)
 268                 logging.debug("Added client %s on %s" %
 269                               (binding.hostname, iface))
 270                 self.ifaces[ifindex] = iface
 271
 272     def remove_iface(self, iface):
 273         """ Cleanup clients on a removed interface
 274
 275         """
 276         for mac in self.clients.keys():
 277             if self.clients[mac].iface == iface:
 278                 del self.clients[mac]
 279
 280         for ifindex in self.ifaces.keys():
 281             if self.ifaces[ifindex] == iface:
 282                 del self.ifaces[ifindex]
 283
 284         logging.debug("Removed interface %s" % iface)
 285
 286     def make_reply(self, i, payload):
 287         """ Generate a reply to a BOOTP/DHCP request
 288
 289         """
 290         # Decode the response - NFQUEUE relays IP packets
 291         pkt = IP(payload.get_data())
 292
 293         # Get the actual interface from the ifindex
 294         iface = self.ifaces[payload.get_indev()]
 295
 296         # Signal the kernel that it shouldn't further process the packet
 297         payload.set_verdict(nfqueue.NF_DROP)
 298
 299         # Get the client MAC address
 300         resp = pkt.getlayer(BOOTP).copy()
 301         hlen = resp.hlen
 302         mac = resp.chaddr[:hlen].encode("hex")
 303         mac, _ = re.subn(r'([0-9a-fA-F]{2})', r'\1:', mac, hlen-1)
 304
 305         # Server responses are always BOOTREPLYs
 306         resp.op = "BOOTREPLY"
 307         del resp.payload
 308
 309         try:
 310             binding = self.clients[mac]
 311         except KeyError:
 312             logging.warn("Invalid client %s on %s" % (mac, iface))
 313             return
 314
 315         if iface != binding.iface:
 316             logging.warn("Received spoofed DHCP request for %s from interface"
 317                          " %s instead of %s" %
 318                          (mac, iface, binding.iface))
 319             return
 320
 321         resp = Ether(dst=mac, src=self.get_iface_hw_addr(iface))/\
 322                IP(src=MY_IP, dst=binding.ip)/\
 323                UDP(sport=pkt.dport, dport=pkt.sport)/resp
 324         subnet = self.subnets[binding.link]
 325
 326         if not DHCP in pkt:
 327             logging.warn("Invalid request from %s on %s, no DHCP"
 328                          " payload found" % (binding.mac, iface))
 329             return
 330
 331         dhcp_options = []
 332         requested_addr = binding.ip
 333         for opt in pkt[DHCP].options:
 334             if type(opt) is tuple and opt[0] == "message-type":
 335                 req_type = opt[1]
 336             if type(opt) is tuple and opt[0] == "requested_addr":
 337                 requested_addr = opt[1]
 338
 339         logging.info("%s from %s on %s" %
 340                     (DHCP_TYPES.get(req_type, "UNKNOWN"), binding.mac, iface))
 341
 342         if req_type == DHCPREQUEST and requested_addr != binding.ip:
 343             resp_type = DHCPNAK
 344             logging.info("Sending DHCPNAK to %s on %s: requested %s"
 345                          " instead of %s" %
 346                          (binding.mac, iface, requested_addr, binding.ip))
 347
 348         elif req_type in (DHCPDISCOVER, DHCPREQUEST):
 349             resp_type = DHCP_REQRESP[req_type]
 350             resp.yiaddr = self.clients[mac].ip
 351             dhcp_options += [
 352                  ("hostname", binding.hostname),
 353                  ("domain", binding.hostname.split('.', 1)[-1]),
 354                  ("router", subnet.gw),
 355                  ("name_server", "194.177.210.10"),
 356                  ("name_server", "194.177.210.211"),
 357                  ("broadcast_address", str(subnet.broadcast)),
 358                  ("subnet_mask", str(subnet.netmask)),
 359                  ("renewal_time", DEFAULT_RENEWAL_TIME),
 360                  ("lease_time", DEFAULT_LEASE_TIME),
 361             ]
 362
 363         elif req_type == DHCPINFORM:
 364             resp_type = DHCP_REQRESP[req_type]
 365             dhcp_options += [
 366                  ("hostname", binding.hostname),
 367                  ("domain", binding.hostname.split('.', 1)[-1]),
 368                  ("name_server", "194.177.210.10"),
 369                  ("name_server", "194.177.210.211"),
 370             ]
 371
 372         elif req_type == DHCPRELEASE:
 373             # Log and ignore
 374             logging.info("DHCPRELEASE from %s on %s" %
 375                          (binding.mac, iface))
 376             return
 377
 378         # Finally, always add the server identifier and end options
 379         dhcp_options += [
 380             ("message-type", resp_type),
 381             ("server_id", MY_IP),
 382             "end"
 383         ]
 384         resp /= DHCP(options=dhcp_options)
 385
 386         logging.info("%s to %s (%s) on %s" %
 387                       (DHCP_TYPES[resp_type], mac, binding.ip, iface))
 388         sendp(resp, iface=iface, verbose=False)
 389
 390
 391     def serve(self):
 392         """ Loop forever, serving DHCP requests
 393
 394         """
 395         self.build_config()
 396
 397         iwfd = self.notifier._fd
 398         qfd = self.q.get_fd()
 399
 400         while True:
 401             rlist, _, xlist = select([iwfd, qfd], [], [], 1.0)
 402             # First check if there are any inotify (= configuration change)
 403             # events
 404             if iwfd in rlist:
 405                 self.notifier.read_events()
 406                 self.notifier.process_events()
 407                 rlist.remove(iwfd)
 408
 409             for fd in rlist:
 410                 self.q.process_pending()
 411
 412
 413 if __name__ == "__main__":
 414     import optparse
 415     from capng import *
 416     from pwd import getpwnam, getpwuid
 417
 418     parser = optparse.OptionParser()
 419     parser.add_option("-p", "--path", dest="data_path",
 420                       help="The location of the data files", metavar="DIR",
 421                       default=DEFAULT_PATH)
 422     parser.add_option("-n", "--nfqueue-num", dest="queue_num",
 423                       help="The nfqueue to receive DHCP requests from",
 424                       metavar="NUM", default=DEFAULT_NFQUEUE_NUM)
 425     parser.add_option("-u", "--user", dest="user",
 426                       help="An unprivileged user to run as" ,
 427                       metavar="UID", default=DEFAULT_USER)
 428     parser.add_option("-d", "--debug", action="store_true", dest="debug",
 429                       help="Turn on debugging messages")
 430     parser.add_option("-f", "--foreground", action="store_false", dest="daemonize",
 431                       default=True, help="Do not daemonize, stay in the foreground")
 432
 433
 434     opts, args = parser.parse_args()
 435
 436     if opts.daemonize:
 437         d = daemon.DaemonContext()
 438         d.open()
 439
 440     pidfile = open("/var/run/nfdhcpd.pid", "w")
 441     pidfile.write("%s" % os.getpid())
 442     pidfile.close()
 443
 444     logger = logging.getLogger()
 445     if opts.debug:
 446         logger.setLevel(logging.DEBUG)
 447     else:
 448         logger.setLevel(logging.INFO)
 449
 450     if opts.daemonize:
 451         handler = logging.handlers.RotatingFileHandler(LOG_FILENAME,
 452                                                        maxBytes=2097152)
 453     else:
 454         handler = logging.StreamHandler()
 455
 456     handler.setFormatter(logging.Formatter(LOG_FORMAT))
 457     logger.addHandler(handler)
 458
 459     logging.info("Starting up")
 460     dhcp = DhcpServer(opts.data_path, opts.queue_num)
 461
 462     # Drop all capabilities except CAP_NET_RAW and change uid
 463     try:
 464         uid = getpwuid(int(opts.user))
 465     except ValueError:
 466         uid = getpwnam(opts.user)
 467
 468     logging.info("Setting capabilities and changing uid")
 469     logging.debug("User: %s, uid: %d, gid: %d" %
 470                   (opts.user, uid.pw_uid, uid.pw_gid))
 471     capng_clear(CAPNG_SELECT_BOTH)
 472     capng_update(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, CAP_NET_RAW)
 473     capng_change_id(uid.pw_uid, uid.pw_gid,
 474                     CAPNG_DROP_SUPP_GRP | CAPNG_CLEAR_BOUNDING)
 475     logging.info("Ready to serve requests")
 476     dhcp.serve()
 477
 478
 479 # vim: set ts=4 sts=4 sw=4 et :