Synnefo » snf-vncauthproxy

# Daemon files

# By default, bind / listen for control connections to TCP *:24999

# (both IPv4 and IPv6)

DEFAULT_LISTEN_ADDRESS = None

DEFAULT_LISTEN_PORT = 24999

# Backlog for the control socket

DEFAULT_BACKLOG = 256

# Timeout for the VNC server connection establishment / RFB handshake

DEFAULT_SERVER_TIMEOUT = 60.0

# Connect retries and delay between retries for the VNC server socket

# Connect timeout for the listening sockets

DEFAULT_CONNECT_TIMEOUT = 30

# Port range for the listening sockets

#

#

# We also take into account the ports that Ganeti daemons bind to, the port

# range used by DRBD etc.

    def __init__(self, logger, client):

        @type client: socket.socket

        @param listeners: the client control connection socket

        self.client = client

        self.sport = None

        self.pool = None

        self.daddr = None

        self.dport = None

        self.server = None

        self.password = None

    def _perform_server_handshake(self):

        """

        Initiate a connection with the backend server and perform basic

        RFB 3.8 handshake with it.

        Return a socket connected to the backend server.

        """

        server = None

        tries = self.retries

        while tries:

            tries -= 1

            # Initiate server connection

            for res in socket.getaddrinfo(self.addr, self.dport,

                                          socket.AF_UNSPEC,

                                          socket.SOCK_STREAM, 0,

                                          socket.AI_PASSIVE):

                af, socktype, proto, canonname, sa = res

                try:

                    server = socket.socket(af, socktype, proto)

                except socket.error:

                    server = None

                    continue

                # Set socket timeout for the initial handshake

                server.settimeout(self.server_timeout)

                try:

                    logger.debug("Connecting to %s:%s", *sa[:2])

                    server.connect(sa)

                    logger.debug("Connection to %s:%s successful", *sa[:2])

                except socket.error:

                    server.close()

                    server = None

                    continue

                # We succesfully connected to the server

                tries = 0

                break

            # Wait and retry

            gevent.sleep(self.retry_wait)

        if server is None:

            raise Exception("Failed to connect to server")

        version = server.recv(1024)

        if not rfb.check_version(version):

            raise Exception("Unsupported RFB version: %s" % version.strip())

        server.send(rfb.RFB_VERSION_3_8 + "\n")

        res = server.recv(1024)

        types = rfb.parse_auth_request(res)

        if not types:

            raise Exception("Error handshaking with the server")

        else:

            logger.debug("Supported authentication types: %s",

                         " ".join([str(x) for x in types]))

        if rfb.RFB_AUTHTYPE_NONE not in types:

            raise Exception("Error, server demands authentication")

        server.send(rfb.to_u8(rfb.RFB_AUTHTYPE_NONE))

        # Check authentication response

        res = server.recv(4)

        res = rfb.from_u32(res)

        if res != 0:

            raise Exception("Authentication error")

        # Reset the timeout for the rest of the session

        server.settimeout(None)

        self.server = server

    def _establish_connection(self):

        client = self.client

        ports = VncAuthProxy.ports

        # Receive and parse a client request.

        response = {

            "source_port": 0,

            "status": "FAILED",

        }

        try:

            # TODO: support multiple forwardings in the same message?

            #

            # Control request, in JSON:

            #

            # {

            #     "source_port":

            #         <source port or 0 for automatic allocation>,

            #     "destination_address":

            #         <destination address of backend server>,

            #     "destination_port":

            #         <destination port>

            #     "password":

            #         <the password to use to authenticate clients>

            # }

            #

            # The <password> is used for MITM authentication of clients

            # connecting to <source_port>, who will subsequently be

            # forwarded to a VNC server listening at

            # <destination_address>:<destination_port>

            #

            # Control reply, in JSON:

            # {

            #     "source_port": <the allocated source port>

            #     "status": <one of "OK" or "FAILED">

            # }

            #

            buf = client.recv(1024)

            req = json.loads(buf)

            sport_orig = int(req['source_port'])

            daddr = req['destination_address']

            dport = int(req['destination_port'])

            password = req['password']

        except Exception, e:

            logger.warn("Malformed request: %s", buf)

            client.send(json.dumps(response))

            client.close()

            raise gevent.GreenletExit

        server = None

        try:

            # If the client has so indicated, pick an ephemeral source port

            # randomly, and remove it from the port pool.

            if sport_orig == 0:

                while True:

                    try:

                        sport = random.choice(ports)

                        ports.remove(sport)

                        break

                    except ValueError:

                        logger.debug("Port %d already taken", sport)

                logger.debug("Got port %d from pool, %d remaining",

                             sport, len(ports))

                pool = ports

            else:

                sport = sport_orig

                pool = None

            self.sport = sport

            self.pool = pool

            self.listeners = get_listening_sockets(sport)

            perform_server_handshake()

            logger.info("New forwarding: %d (client req'd: %d) -> %s:%d",

                        sport, sport_orig, self.daddr, self.dport)

            response = {"source_port": sport,

                        "status": "OK"}

        except IndexError:

            logger.error(("FAILED forwarding, out of ports for [req'd by "

                          "client: %d -> %s:%d]"),

                         sport_orig, self.daddr, self.dport)

            raise gevent.GreenletExit

        except Exception, msg:

            logger.error(msg)

            logger.error(("FAILED forwarding: %d (client req'd: %d) -> "

                          "%s:%d"), sport, sport_orig, self.daddr, self.dport)

            if not pool is None:

                pool.append(sport)

                logger.debug("Returned port %d to pool, %d remanining",

                             sport, len(pool))

            if not server is None:

                server.close()

            raise gevent.GreenletExit

        finally:

            client.send(json.dumps(response))

            client.close()

    def _proxy(self):

    def _run(self):

        _establish_connection()

        _proxy()

def get_listening_sockets(sport, saddr=None):

    for res in socket.getaddrinfo(saddr, sport, socket.AF_UNSPEC,

    parser.add_option("--log", dest="log_file",

                      help=("Write log to FILE (default: %s)" %

    parser.add_option("--listen-address", dest="listen_address",

                      default=DEFAULT_LISTEN_ADDRESS,

                      metavar="LISTEN_ADDRESS",

                      help=("Address to listen for control connections"

                            "(default: *)"))

    parser.add_option("--listen-port", dest="listen_port",

                      default=DEFAULT_LISTEN_PORT,

                      metavar="LISTEN_PORT",

                      help=("Port to listen for control connections"

                            "(default: %d)" % DEFAULT_LISTEN_PORT))

    parser.add_option("-b", "--backlog", dest="backlog",

                      default=DEFAULT_BACKLOG, type="int", metavar="N",

                      help=("Size of the backlog for the control connection "

                          "socket (default: %s)" % DEFAULT_BACKLOG))

    parser.add_option("--server-timeout", dest="server_timeout",

                      default=DEFAULT_SERVER_TIMEOUT, type="float",

                      metavar="N",

                      help=("Wait for N seconds for the VNC server RFB "

                            "handshake (default %s)" % DEFAULT_SERVER_TIMEOUT))

    parser.add_option("--connect-retries", dest="connect_retries",

                      metavar="N",

                      help=("Retry N times to connect to the "

                            "server (default: %d)" %

                            DEFAULT_CONNECT_RETRIES))

    parser.add_option("--retry-wait", dest="retry_wait",

                      metavar="N",

                      help=("Wait N seconds before retrying "

                            "to connect to the server (default: %s)" %

                            DEFAULT_RETRY_WAIT))

    parser.add_option("--connect-timeout", dest="connect_timeout",

                      default=DEFAULT_CONNECT_TIMEOUT, type="int",

                      metavar="N",

                      help=("Wait N seconds for a client "

                            "to connect (default: %d)"

                            % DEFAULT_CONNECT_TIMEOUT))

                            "allocated ephemeral ports (default: %s)" %

                            DEFAULT_MIN_PORT))

                            "allocated ephemeral ports (default: %s)" %

                            DEFAULT_MAX_PORT))

    (opts, args) = parser.parse_args(args)

    if args:

        parser.print_help()

        sys.exit(1)

    (opts, ) = parse_arguments(sys.argv[1:])

    # Init VncAuthProxy class attributes

    VncAuthProxy.server_timeout = opts.server_timeout

    VncAuthProxy.connect_retries = opts.connect_retries

    VncAuthProxy.retry_wait = opts.retry_wait

    VncAuthProxy.connect_timeout = opts.connect_timeout

    try:

        sockets = get_listening_sockets(opts.listen_address,

                                        opts.listen_port)

    except socket.error:

        logger.critical("Error binding control socket")

        sys.exit(1)

                client, _ = ctrl.accept()

                VncAuthProxy.spawn(logger, client)