Code

2nd try: Dots are a security hole in file names
[nagixsc.git] / nagixsc_conf2http.py
index d5200e09e34102b91729145eeebb8d4988827a23..1c5d28ff137af6c64218c6eb4bfb138d80bbdde0 100755 (executable)
@@ -1,25 +1,64 @@
 #!/usr/bin/python
 
-import BaseHTTPServer
+import ConfigParser
 import base64
-import md5
+import optparse
 import os
 import re
 import subprocess
+import sys
 
-config = {     'ip':                   '',
-                       'port':                 15666,
-               }
+try:
+       from hashlib import md5
+except ImportError:
+       from md5 import md5
 
-users = {      'nagixsc':              '019b0966d98fb71d1a4bc4ca0c81d5cc',             # PW: nagixsc
-               }
+##############################################################################
 
-CONFDIR='./examples'
-C2X='./nagixsc_conf2xml.py'
+from nagixsc import *
 
-class Conf2HTTPHandler(BaseHTTPServer.BaseHTTPRequestHandler):
+##############################################################################
 
-       def http_error(code, output):
+parser = optparse.OptionParser()
+
+parser.add_option('-c', '', dest='cfgfile', help='Config file')
+parser.add_option('-d', '--daemon', action='store_true', dest='daemon', help='Daemonize, go to background')
+parser.add_option('', '--nossl', action='store_true', dest='nossl', help='Disable SSL (overwrites config file)')
+
+parser.set_defaults(cfgfile='conf2http.cfg')
+
+(options, args) = parser.parse_args()
+
+cfgread = ConfigParser.SafeConfigParser()
+cfgread.optionxform = str # We need case-sensitive options
+cfg_list = cfgread.read(options.cfgfile)
+
+if cfg_list == []:
+       print 'Config file "%s" could not be read!' % options.cfgfile
+       sys.exit(1)
+
+config = {}
+try:
+       config['ip']   = cfgread.get('server', 'ip')
+       config['port'] = cfgread.getint('server', 'port')
+       config['ssl']  = cfgread.getboolean('server', 'ssl')
+       config['cert'] = cfgread.get('server', 'sslcert')
+
+       config['conf_dir']         = cfgread.get('server', 'conf_dir')
+
+except ConfigParser.NoOptionError, e:
+       print 'Config file error: %s ' % e
+       sys.exit(1)
+
+users = {}
+for u in cfgread.options('users'):
+       users[u] = cfgread.get('users', u)
+
+##############################################################################
+
+class Conf2HTTPHandler(MyHTTPRequestHandler):
+
+       def http_error(self, code, output):
                self.send_response(code)
                self.send_header('Content-Type', 'text/plain')
                self.end_headers()
@@ -28,14 +67,12 @@ class Conf2HTTPHandler(BaseHTTPServer.BaseHTTPRequestHandler):
 
 
        def do_GET(self):
-               cmdline = C2X
-
                path = self.path.split('/')
 
                # Check Basic Auth
                try:
                        authdata = base64.b64decode(self.headers['Authorization'].split(' ')[1]).split(':')
-                       if not users[authdata[0]] == md5.md5(authdata[1]).hexdigest():
+                       if not users[authdata[0]] == md5(authdata[1]).hexdigest():
                                raise Exception
                except:
                        self.send_response(401)
@@ -49,57 +86,58 @@ class Conf2HTTPHandler(BaseHTTPServer.BaseHTTPRequestHandler):
                if len(path) >= 4:
                        service = path[3]
                else:
-                       service = ''
+                       service = None
 
                if len(path) >= 3:
                        host = path[2]
                else:
-                       host = ''
+                       host = None
 
                if len(path) >= 2:
-                       configfile = path[1]
+                       configfile = path[1] + '.conf'
                else:
-                       configfile =''
+                       self.http_error(500, 'No config file specified')
+                       return
 
                if re.search('\.\.', configfile):
-                       http_error(500, 'Found ".." in config file name')
+                       self.http_error(500, 'Found ".." in config file name')
                        return
-               if configfile and not re.search('^[a-zA-Z0-9-_\.]+$', configfile):
-                       http_error(500, 'Config file name contains invalid characters')
+               if not re.search('^[a-zA-Z0-9-_]+.conf$', configfile):
+                       self.http_error(500, 'Config file name contains invalid characters')
                        return
 
-               if configfile:
-                       configfile += '.conf'
-                       cmdline    += ' -c ' + os.path.join(CONFDIR, configfile)
-
-               if host:
-                       cmdline += ' -H %s' % host
-                       if service:
-                               cmdline += ' -D %s' % service
+               check_config = read_inifile(os.path.join(config['conf_dir'], configfile))
+               if not check_config:
+                       self.http_error(500, 'Could not read config file "%s"' % configfile)
+                       return
 
-               try:
-                       cmd     = subprocess.Popen(cmdline.split(' '), stdout=subprocess.PIPE)
-                       output  = cmd.communicate()[0].rstrip()
-                       retcode = cmd.returncode
-               except OSError:
-                       http_error(500, 'Could not execute "%s"' % cmdline)
+               checks = conf2dict(check_config, host, service)
+               if not checks:
+                       self.http_error(500, 'No checks executed')
                        return
 
-               if retcode == 0:
-                       self.send_response(200)
-                       self.send_header('Content-Type', 'text/xml')
-                       self.end_headers()
-                       self.wfile.write(output)
-               else:
-                       http_error(500, output)
+               self.send_response(200)
+               self.send_header('Content-Type', 'text/xml')
+               self.end_headers()
+               self.wfile.write(xml_from_dict(checks))
 
                return
 
 
 
 def main():
+       if options.nossl:
+               config['ssl'] = False
+
+       if config['ssl'] and not os.path.isfile(config['cert']):
+               print 'SSL certificate "%s" not found!' % config['cert']
+               sys.exit(127)
+
+       if options.daemon:
+               daemonize(pidfile='/var/run/nagixsc_conf2http.pid')
+
+       server = MyHTTPServer((config['ip'], config['port']), Conf2HTTPHandler, ssl=config['ssl'], sslpemfile=config['cert'])
        try:
-               server = BaseHTTPServer.HTTPServer((config['ip'], config['port']), Conf2HTTPHandler)
                server.serve_forever()
        except:
                server.socket.close()