009d23cb5be67ebf6464a30f7979eec31d29f2aa
1 package ArpHandler;
3 use Exporter;
4 @ISA = ("Exporter");
6 use strict;
7 use warnings;
8 use GOSA::GosaSupportDaemon;
9 use POSIX;
10 use Fcntl;
11 use Net::LDAP;
12 use Net::LDAP::LDIF;
13 use Net::LDAP::Entry;
14 use Net::DNS;
15 use Switch;
16 use Data::Dumper;
18 # Don't start if some of the modules are missing
19 my $start_service=1;
20 BEGIN{
21 unless(eval('use Socket qw(PF_INET SOCK_DGRAM inet_ntoa sockaddr_in)')) {
22 $start_service=0;
23 }
24 unless(eval('use POE qw(Component::Pcap Component::ArpWatch)')) {
25 $start_service=0;
26 }
27 }
29 END{}
31 my ($timeout, $mailto, $mailfrom, $user, $group);
32 my ($arp_activ, $arp_interface, $ldap_uri, $ldap_base, $ldap_admin_dn, $ldap_admin_password);
33 my $hosts_database={};
34 my $resolver=Net::DNS::Resolver->new;
35 my $ldap;
37 my %cfg_defaults =
38 (
39 "arp" => {
40 "arp_activ" => [\$arp_activ, "on"],
41 "arp_interface" => [\$arp_interface, "all"],
42 },
43 "server" => {
44 "ldap_uri" => [\$ldap_uri, ""],
45 "ldap_base" => [\$ldap_base, ""],
46 "ldap_admin_dn" => [\$ldap_admin_dn, ""],
47 "ldap_admin_password" => [\$ldap_admin_password, ""],
48 },
49 );
51 #=== FUNCTION ================================================================
52 # NAME: read_configfile
53 # PARAMETERS: cfg_file - string -
54 # RETURNS: nothing
55 # DESCRIPTION: read cfg_file and set variables
56 #===============================================================================
57 sub read_configfile {
58 my $cfg;
59 if( defined( $main::cfg_file) && ( length($main::cfg_file) > 0 )) {
60 if( -r $main::cfg_file ) {
61 $cfg = Config::IniFiles->new( -file => $main::cfg_file );
62 } else {
63 print STDERR "Couldn't read config file!";
64 }
65 } else {
66 $cfg = Config::IniFiles->new() ;
67 }
68 foreach my $section (keys %cfg_defaults) {
69 foreach my $param (keys %{$cfg_defaults{ $section }}) {
70 my $pinfo = $cfg_defaults{ $section }{ $param };
71 ${@$pinfo[0]} = $cfg->val( $section, $param, @$pinfo[1] );
72 }
73 }
74 }
76 sub get_module_info {
77 my @info = (undef,
78 undef,
79 undef,
80 undef,
81 "socket",
82 );
84 &read_configfile();
85 # Don't start if some of the modules are missing
86 if(($arp_activ eq 'on') && $start_service) {
87 $ldap = Net::LDAP->new($ldap_uri);
88 if (!$ldap) {
89 &main::daemon_log("Could not connect to LDAP Server at $ldap_uri!\n$@", 1);
90 } else {
91 $ldap->bind($ldap_admin_dn, password => $ldap_admin_password);
92 }
94 # When interface is not configured (or 'all'), start arpwatch on all possible interfaces
95 if ((!defined($arp_interface)) || $arp_interface eq 'all') {
96 foreach my $device(&get_interfaces) {
97 # TODO: Need a better workaround for IPv4-to-IPv6 bridges
98 if($device =~ m/^sit\d+$/) {
99 next;
100 }
102 # If device has a valid mac address
103 # TODO: Check if this should be the right way
104 if(not(&get_mac($device) eq "00:00:00:00:00:00")) {
105 &main::daemon_log("Starting ArpWatch on $device", 1);
106 POE::Session->create(
107 inline_states => {
108 _start => sub {
109 &start(@_,$device);
110 },
111 _stop => sub {
112 $ldap->unbind if (defined($ldap));
113 $ldap->disconnect if (defined($ldap));
114 $_[KERNEL]->post( sprintf("arp_watch_$device") => 'shutdown' )
115 },
116 got_packet => \&got_packet,
117 },
118 );
119 }
120 }
121 } else {
122 foreach my $device(split(/[\s,]+/, $arp_interface)) {
123 &main::daemon_log("Starting ArpWatch on $device", 1);
124 POE::Session->create(
125 inline_states => {
126 _start => sub {
127 &start(@_,$device);
128 },
129 _stop => sub {
130 $ldap->unbind if (defined($ldap));
131 $ldap->disconnect if (defined($ldap));
132 $_[KERNEL]->post( sprintf("arp_watch_$device") => 'shutdown' )
133 },
134 got_packet => \&got_packet,
135 },
136 );
137 }
138 }
139 } else {
140 &main::daemon_log("ArpHandler disabled. Not starting any capture processes");
141 }
142 return \@info;
143 }
145 sub process_incoming_msg {
146 return 1;
147 }
149 sub start {
150 my $device = (exists($_[ARG0])?$_[ARG0]:'eth0');
151 POE::Component::ArpWatch->spawn(
152 Alias => sprintf("arp_watch_$device"),
153 Device => $device,
154 Dispatch => 'got_packet',
155 Session => $_[SESSION],
156 );
158 $_[KERNEL]->post( sprintf("arp_watch_$device") => 'run' );
159 }
161 sub got_packet {
162 my ($kernel, $heap, $sender, $packet) = @_[KERNEL, HEAP, SENDER, ARG0];
164 if( $packet->{source_haddr} eq "00:00:00:00:00:00" ||
165 $packet->{source_haddr} eq "ff:ff:ff:ff:ff:ff" ||
166 $packet->{source_ipaddr} eq "0.0.0.0") {
167 return;
168 }
170 my $capture_device = sprintf "%s", $kernel->alias_list($sender) =~ /^arp_watch_(.*)$/;
172 if(!exists($hosts_database->{$packet->{source_haddr}})) {
173 my $dnsresult= $resolver->search($packet->{source_ipaddr});
174 my $dnsname= (defined($dnsresult))?$dnsresult->{answer}[0]->{ptrdname}:$packet->{source_ipaddr};
175 my $ldap_result=&get_host_from_ldap($packet->{source_haddr});
176 if(exists($ldap_result->{dn})) {
177 $hosts_database->{$packet->{source_haddr}}=$ldap_result;
178 if(!exists($ldap_result->{ipHostNumber})) {
179 $hosts_database->{$packet->{source_haddr}}->{ipHostNumber}=$packet->{source_ipaddr};
180 } else {
181 if(!($ldap_result->{ipHostNumber} eq $packet->{source_ipaddr})) {
182 &main::daemon_log(
183 "Current IP Address ".$packet->{source_ipaddr}.
184 " of host ".$ldap_result->{dnsname}.
185 " differs from LDAP (".$ldap_result->{ipHostNumber}.")", 4);
186 }
187 }
188 $hosts_database->{$packet->{source_haddr}}->{dnsname}=$dnsname;
189 &main::daemon_log("Host was found in LDAP as ".$ldap_result->{dn}, 6);
190 } else {
191 $hosts_database->{$packet->{source_haddr}}={
192 macAddress => $packet->{source_haddr},
193 ipHostNumber => $packet->{source_ipaddr},
194 dnsname => $dnsname,
195 cn => ($dnsname =~ /^(\d){1,3}\.(\d){1,3}\.(\d){1,3}\.(\d){1,3}/) ? $dnsname : sprintf "%s", $dnsname =~ /([^\.]+)\./,
196 };
197 &main::daemon_log("Host was not found in LDAP (".($hosts_database->{$packet->{source_haddr}}->{dnsname}).")",6);
198 &main::daemon_log(
199 "New Host ".($hosts_database->{$packet->{source_haddr}}->{dnsname}).
200 ": ".$hosts_database->{$packet->{source_haddr}}->{ipHostNumber}.
201 "/".$hosts_database->{$packet->{source_haddr}}->{macAddress},4);
202 &add_ldap_entry(
203 $ldap,
204 $ldap_base,
205 $hosts_database->{$packet->{source_haddr}}->{macAddress},
206 'new-system',
207 $hosts_database->{$packet->{source_haddr}}->{ipHostNumber});
208 # TODO add mac vendor as description
209 }
210 $hosts_database->{$packet->{source_haddr}}->{device}= $capture_device;
211 } else {
212 if(!($hosts_database->{$packet->{source_haddr}}->{ipHostNumber} eq $packet->{source_ipaddr})) {
213 &main::daemon_log(
214 "IP Address change of MAC ".$packet->{source_haddr}.
215 ": ".$hosts_database->{$packet->{source_haddr}}->{ipHostNumber}.
216 "->".$packet->{source_ipaddr}, 4);
217 $hosts_database->{$packet->{source_haddr}}->{ipHostNumber}= $packet->{source_ipaddr};
218 &change_ldap_entry(
219 $ldap,
220 $ldap_base,
221 $hosts_database->{$packet->{source_haddr}}->{macAddress},
222 'ip-changed',
223 $hosts_database->{$packet->{source_haddr}}->{ipHostNumber},
224 );
226 }
227 &main::daemon_log("Host already in cache (".($hosts_database->{$packet->{source_haddr}}->{device})."->".($hosts_database->{$packet->{source_haddr}}->{dnsname}).")",6);
228 }
229 }
231 sub get_host_from_ldap {
232 my $mac=shift;
233 my $result={};
235 my $ldap_result= &search_ldap_entry(
236 $ldap,
237 $ldap_base,
238 "(|(macAddress=$mac)(dhcpHWAddress=ethernet $mac))"
239 );
241 if(defined($ldap_result) && $ldap_result->count==1) {
242 if(exists($ldap_result->{entries}[0]) &&
243 exists($ldap_result->{entries}[0]->{asn}->{objectName}) &&
244 exists($ldap_result->{entries}[0]->{asn}->{attributes})) {
246 for my $attribute(@{$ldap_result->{entries}[0]->{asn}->{attributes}}) {
247 if($attribute->{type} eq 'cn') {
248 $result->{cn} = $attribute->{vals}[0];
249 }
250 if($attribute->{type} eq 'macAddress') {
251 $result->{macAddress} = $attribute->{vals}[0];
252 }
253 if($attribute->{type} eq 'dhcpHWAddress') {
254 $result->{dhcpHWAddress} = $attribute->{vals}[0];
255 }
256 if($attribute->{type} eq 'ipHostNumber') {
257 $result->{ipHostNumber} = $attribute->{vals}[0];
258 }
259 }
260 }
261 $result->{dn} = $ldap_result->{entries}[0]->{asn}->{objectName};
262 }
264 return $result;
265 }
267 #=== FUNCTION ================================================================
268 # NAME: get_interfaces
269 # PARAMETERS: none
270 # RETURNS: (list of interfaces)
271 # DESCRIPTION: Uses proc fs (/proc/net/dev) to get list of interfaces.
272 #===============================================================================
273 sub get_interfaces {
274 my @result;
275 my $PROC_NET_DEV= ('/proc/net/dev');
277 open(PROC_NET_DEV, "<$PROC_NET_DEV")
278 or die "Could not open $PROC_NET_DEV";
280 my @ifs = <PROC_NET_DEV>;
282 close(PROC_NET_DEV);
284 # Eat first two line
285 shift @ifs;
286 shift @ifs;
288 chomp @ifs;
289 foreach my $line(@ifs) {
290 my $if= (split /:/, $line)[0];
291 $if =~ s/^\s+//;
292 push @result, $if;
293 }
295 return @result;
296 }
298 #=== FUNCTION ================================================================
299 # NAME: get_mac
300 # PARAMETERS: interface name (i.e. eth0)
301 # RETURNS: (mac address)
302 # DESCRIPTION: Uses ioctl to get mac address directly from system.
303 #===============================================================================
304 sub get_mac {
305 my $ifreq= shift;
306 my $result;
307 if ($ifreq && length($ifreq) > 0) {
308 if($ifreq eq "all") {
309 $result = "00:00:00:00:00:00";
310 } else {
311 my $SIOCGIFHWADDR= 0x8927; # man 2 ioctl_list
313 socket SOCKET, PF_INET, SOCK_DGRAM, getprotobyname('ip')
314 or die "socket: $!";
316 if(ioctl SOCKET, $SIOCGIFHWADDR, $ifreq) {
317 my ($if, $mac)= unpack 'h36 H12', $ifreq;
319 if (length($mac) > 0) {
320 $mac=~ m/^([0-9a-f][0-9a-f])([0-9a-f][0-9a-f])([0-9a-f][0-9a-f])([0-9a-f][0-9a-f])([0-9a-f][0-9a-f])([0-9a-f][0-9a-f])$/;
321 $mac= sprintf("%s:%s:%s:%s:%s:%s", $1, $2, $3, $4, $5, $6);
322 $result = $mac;
323 }
324 }
325 }
326 }
327 return $result;
328 }
330 #=== FUNCTION ================================================================
331 # NAME: add_ldap_entry
332 # PURPOSE: adds an element to ldap-tree
333 # PARAMETERS:
334 # RETURNS: none
335 # DESCRIPTION: ????
336 # THROWS: no exceptions
337 # COMMENTS: none
338 # SEE ALSO: n/a/bin
339 #===============================================================================
340 sub add_ldap_entry {
341 my ($ldap_tree, $ldap_base, $mac, $gotoSysStatus, $ip, $interface, $desc) = @_;
342 my $dn = "cn=".$hosts_database->{$mac}->{cn}.",ou=incoming,$ldap_base";
343 my $s_res = &search_ldap_entry($ldap_tree, $ldap_base, "(|(macAddress=$mac)(dhcpHWAddress=ethernet $mac))");
344 my $c_res = (defined($s_res))?$s_res->count:0;
345 if($c_res == 1) {
346 &main::daemon_log("WARNING: macAddress $mac already in LDAP", 1);
347 return;
348 } elsif($c_res > 0) {
349 &main::daemon_log("ERROR: macAddress $mac exists $c_res times in LDAP", 1);
350 return;
351 }
353 # create LDAP entry
354 my $entry = Net::LDAP::Entry->new( $dn );
355 $entry->dn($dn);
356 $entry->add("objectClass" => "goHard");
357 $entry->add("cn" => $hosts_database->{$mac}->{cn});
358 $entry->add("macAddress" => $mac);
359 if(defined $gotoSysStatus) {$entry->add("gotoSysStatus" => $gotoSysStatus)}
360 if(defined $ip) {$entry->add("ipHostNumber" => $ip) }
361 #if(defined $interface) { }
362 if(defined $desc) {$entry->add("description" => $desc) }
364 # submit entry to LDAP
365 my $result = $entry->update ($ldap_tree);
367 # for $result->code constants please look at Net::LDAP::Constant
368 if($result->code == 68) { # entry already exists
369 &main::daemon_log("WARNING: $dn ".$result->error, 3);
370 } elsif($result->code == 0) { # everything went fine
371 &main::daemon_log("add entry $dn to ldap", 1);
372 } else { # if any other error occur
373 &main::daemon_log("ERROR: $dn, ".$result->code.", ".$result->error, 1);
374 }
375 return;
376 }
379 #=== FUNCTION ================================================================
380 # NAME: change_ldap_entry
381 # PURPOSE: ????
382 # PARAMETERS: ????
383 # RETURNS: ????
384 # DESCRIPTION: ????
385 # THROWS: no exceptions
386 # COMMENTS: none
387 # SEE ALSO: n/a
388 #===============================================================================
389 sub change_ldap_entry {
390 my ($ldap_tree, $ldap_base, $mac, $gotoSysStatus, $ip) = @_;
392 # check if ldap_entry exists or not
393 my $s_res = &search_ldap_entry($ldap_tree, $ldap_base, "(|(macAddress=$mac)(dhcpHWAddress=ethernet $mac))");
394 my $c_res = (defined $s_res)?$s_res->count:0;
395 if($c_res == 0) {
396 &main::daemon_log("WARNING: macAddress $mac not in LDAP", 1);
397 return;
398 } elsif($c_res > 1) {
399 &main::daemon_log("ERROR: macAddress $mac exists $c_res times in LDAP", 1);
400 return;
401 }
403 my $s_res_entry = $s_res->pop_entry();
404 my $dn = $s_res_entry->dn();
405 my $replace = {
406 'gotoSysStatus' => $gotoSysStatus,
407 };
408 if (defined($ip)) {
409 $replace->{'ip'} = $ip;
410 }
411 my $result = $ldap->modify( $dn, replace => $replace );
413 # for $result->code constants please look at Net::LDAP::Constant
414 if($result->code == 32) { # entry doesnt exists
415 &add_ldap_entry($mac, $gotoSysStatus);
416 } elsif($result->code == 0) { # everything went fine
417 &main::daemon_log("entry $dn changed successful", 1);
418 } else { # if any other error occur
419 &main::daemon_log("ERROR: $dn, ".$result->code.", ".$result->error, 1);
420 }
422 return;
423 }
425 #=== FUNCTION ================================================================
426 # NAME: search_ldap_entry
427 # PURPOSE: ????
428 # PARAMETERS: [Net::LDAP] $ldap_tree - object of an ldap-tree
429 # string $sub_tree - dn of the subtree the search is performed
430 # string $search_string - either a string or a Net::LDAP::Filter object
431 # RETURNS: [Net::LDAP::Search] $msg - result object of the performed search
432 # DESCRIPTION: ????
433 # THROWS: no exceptions
434 # COMMENTS: none
435 # SEE ALSO: n/a
436 #===============================================================================
437 sub search_ldap_entry {
438 my ($ldap_tree, $sub_tree, $search_string) = @_;
439 my $msg;
440 if(defined($ldap_tree)) {
441 $msg = $ldap_tree->search( # perform a search
442 base => $sub_tree,
443 filter => $search_string,
444 ) or &main::daemon_log("cannot perform search at ldap: $@", 1);
445 #if(defined $msg) {
446 # print $sub_tree."\t".$search_string."\t";
447 # print $msg->count."\n";
448 # foreach my $entry ($msg->entries) { $entry->dump; };
449 #}
450 }
451 return $msg;
452 }
453 # $ldap = Net::LDAP->new( "localhost" ) or die "$@";
454 # $ldap->bind($bind_phrase,
455 # password => $password,
456 # ) ;
457 #
458 # switch($arp_sig) {
459 # case 0 {&change_ldap_entry($ldap, $ldap_base,
460 # $mac, "ip-changed",
461 # )}
462 # case 1 {&change_ldap_entry($ldap, $ldap_base,
463 # $mac, "mac-not-whitelisted",
464 # )}
465 # case 2 {&change_ldap_entry($ldap, $ldap_base,
466 # $mac, "mac-in-blacklist",
467 # )}
468 # case 3 {&add_ldap_entry($ldap, $ldap_base,
469 # $mac, "new-mac-address", $ip,
470 # $interface, $desc,
471 # )}
472 # case 4 {&change_ldap_entry($ldap, $ldap_base,
473 # $mac, "unauthorized-arp-request",
474 # )}
475 # case 5 {&change_ldap_entry($ldap, $ldap_base,
476 # $mac, "abusive-number-of-arp-requests",
477 # )}
478 # case 6 {&change_ldap_entry($ldap, $ldap_base,
479 # $mac, "ether-and-arp-mac-differs",
480 # )}
481 # case 7 {&change_ldap_entry($ldap, $ldap_base,
482 # $mac, "flood-detected",
483 # )}
484 # case 8 {&add_ldap_entry($ldap, $ldap_base,
485 # $mac, $ip, "new-system",
486 # )}
487 # case 9 {&change_ldap_entry($ldap, $ldap_base,
488 # $mac, "mac-changed",
489 # )}
490 # }
491 #
492 #
493 # ldap search
494 # my $base_phrase = "dc=gonicus,dc=de";
495 # my $filter_phrase = "cn=keinesorge";
496 # my $attrs_phrase = "cn macAdress";
497 # my $msg_search = $ldap->search( base => $base_phrase,
498 # filter => $filter_phrase,
499 # attrs => $attrs_phrase,
500 # );
501 # $msg_search->code && die $msg_search->error;
502 #
503 # my @entries = $msg_search->entries;
504 # my $max = $msg_search->count;
505 # print "anzahl der entries: $max\n";
506 # my $i;
507 # for ( $i = 0 ; $i < $max ; $i++ ) {
508 # my $entry = $msg_search->entry ( $i );
509 # foreach my $attr ( $entry->attributes ) {
510 # if( not $attr eq "cn") {
511 # next;
512 # }
513 # print join( "\n ", $attr, $entry->get_value( $attr ) ), "\n\n";
514 # }
515 # }
516 #
517 # # ldap add
518 #
519 #
520 # $ldap->unbind;
521 # exit;
523 1;