diff options
Diffstat (limited to 'src')
| -rwxr-xr-x | src/hourly.py | 133 | ||||
| -rwxr-xr-x | src/vpn_wrapper.sh | 35 |
2 files changed, 135 insertions, 33 deletions
diff --git a/src/hourly.py b/src/hourly.py index f830bb7..209b577 100755 --- a/src/hourly.py +++ b/src/hourly.py @@ -4,6 +4,7 @@ from sys import argv import subprocess from os import path, waitpid, unlink from time import gmtime, strftime, sleep +import re # our own module used by several scripts in the project from ztdnslib import start_db_connection, \ @@ -54,11 +55,91 @@ def unlock_on_file(): except FileNotFoundError: return False +address_range_regex = re.compile(r''' +([\d]+\.[\d]+\.[\d]+\.[\d]+) # first IPv4 address in the range + +[\s]*-[\s]* # dash (with optional whitespace around) + +([\d]+\.[\d]+\.[\d]+\.[\d]+) # last IPv4 address in the range +''', re.VERBOSE) + +address_regex = re.compile(r'([\d]+)\.([\d]+)\.([\d]+)\.([\d]+)') + +def ip_address_to_number(address): + match = address_regex.match(address) + if not match: + return None + number = 0 + for byte in match.groups(): + byteval = int(byte) + if byteval > 256: + return None + number = number * 256 + byteval + return number + +def number_to_ip_address(number): + byte1 = number % 256 + number = number // 256 + byte2 = number % 256 + number = number // 256 + byte3 = number % 256 + number = number // 256 + byte4 = number % 256 + return "{}.{}.{}.{}".format(byte4, byte3, byte2, byte1) + +# this functions accepts list of IPv4 address ranges like: +# ['10.25.25.0 - 10.25.25.59', '10.25.25.120 - 10.25.25.135'] +# and returns a set of /30 subnetworks; each subnetwork is represented +# by a tuple of 2 usable addresses within that subnetwork. +# E.g. for subnetwork 10.25.25.16/30 it would be ('10.25.25.17', '10.25.25.18'); +# Addressess ending with .16 (subnet address) +# and .19 (broadcast in the subnet) are considered unusable in this case. +# The returned set will contain up to count elements. +def get_available_subnetworks(count, address_ranges, logfile): + available_subnetworks = set() + + for address_range in address_ranges: + match = address_range_regex.match(address_range) + ok_flag = True + + if not match: + ok_flag = False + + if ok_flag: + start_addr_number = ip_address_to_number(match.groups()[0]) + end_addr_number = ip_address_to_number(match.groups()[1]) + if not start_addr_number or not end_addr_number: + ok_flag = False + + if ok_flag: + # round so that start_addr is first ip address in a /30 network + # and end_addr is last ip address in a /30 network + while start_addr_number % 4 != 0: + start_addr_number += 1 + while end_addr_number % 4 != 3: + end_addr_number -= 1 + + if start_addr_number >= end_addr_number: + logfile.write("address range '{}' doesn't contain any" + " /30 subnetworks\n".format(address_range)) + else: + while len(available_subnetworks) < count and \ + start_addr_number < end_addr_number: + usable_addr1 = number_to_ip_address(start_addr_number + 1) + usable_addr2 = number_to_ip_address(start_addr_number + 2) + available_subnetworks.add((usable_addr1, usable_addr2)) + start_addr_number += 4 + else: + logfile.write("'{}' is not a valid address range\n"\ + .format(address_range)) + + return available_subnetworks + def do_hourly_work(hour, logfile): ztdns_config = get_ztdns_config() if ztdns_config['enabled'] != 'yes': logfile.write("0tdns not enabled in the config - exiting\n") - exit() + return connection = start_db_connection(ztdns_config) cursor = connection.cursor() @@ -73,6 +154,23 @@ def do_hourly_work(hour, logfile): # if not specfied in the config, all vpns are handled hadled_vpns = [vpn[0] for vpn in vpns] + parallel_vpns = ztdns_config['parallel_vpns'] # we need this many subnets + subnets = get_available_subnetworks(parallel_vpns, + ztdns_config['private_addresses'], + logfile) + + if not subnets: + logfile.write("couldn't get ANY /30 subnet of private addresses from" + " the 0tdns config file - exiting\n"); + return # TODO close cursor and connection here + + if len(subnets) < parallel_vpns: + logfile.write("configuration allows running {0} parallel vpn" + " connections, but provided private ip addresses give" + " only {1} /30 subnets, which limits parallel connections" + " to {1}\n".format(parallel_vpns, len(subnets))) + parallel_vpns = len(subnets) + for vpn_id, config_hash in vpns: config_path = "/var/lib/0tdns/{}.ovpn".format(config_hash) if not path.isfile(config_path): @@ -80,41 +178,48 @@ def do_hourly_work(hour, logfile): .format(vpn_id, config_hash)) sync_ovpn_config(cursor, vpn_id, config_path, config_hash) - parallel_vpns = ztdns_config['parallel_vpns'] - pids_vpns = {} # map each wrapper pid to id of the vpn it connects to + # map of each wrapper pid to tuple containing id of the vpn it connects to + # and subnet (represented as tuple of addresses) it uses for veth device + pids_wrappers = {} def wait_for_wrapper_process(): while True: pid, exit_status = waitpid(0, 0) - # make sure - if pids_vpns.get(pid) is not None: + # make sure it's one of our wrapper processes + vpn_id, subnet, _ = pids_wrappers.get(pid, (None, None, None)) + if subnet: break + if exit_status == 2: # this means our perform_queries.py crashed... not good logfile.write('performing queries through vpn {} failed\n'\ - .format(pids_vpns[pid])) + .format(vpn_id)) elif exit_status != 0: # vpn server is probably not responding logfile.write('connection to vpn {} failed\n'\ - .format(pids_vpns[pid])) - pids_vpns.pop(pid) + .format(vpn_id)) + pids_wrappers.pop(pid) + subnets.add(subnet) for vpn_id, config_hash in vpns: - if len(pids_vpns) == parallel_vpns: + if len(pids_wrappers) == parallel_vpns: wait_for_wrapper_process() config_path = "/var/lib/0tdns/{}.ovpn".format(config_hash) physical_ip = get_default_host_address(ztdns_config['host']) + subnet = subnets.pop() + veth_addr1, veth_addr2 = subnet route_through_veth = ztdns_config['host'] + "/32" command_in_namespace = [perform_queries, hour, str(vpn_id)] logfile.write("Running connection for vpn {}\n".format(vpn_id)) - - p = subprocess.Popen([wrapper, config_path, physical_ip, - route_through_veth] + command_in_namespace) - pids_vpns[p.pid] = vpn_id + p = subprocess.Popen([wrapper, config_path, physical_ip, veth_addr1, + veth_addr2, route_through_veth] + + command_in_namespace) + + pids_wrappers[p.pid] = (vpn_id, subnet, p) - while len(pids_vpns) > 0: + while len(pids_wrappers) > 0: wait_for_wrapper_process() cursor.execute(''' diff --git a/src/vpn_wrapper.sh b/src/vpn_wrapper.sh index 8dbb702..2dbb821 100755 --- a/src/vpn_wrapper.sh +++ b/src/vpn_wrapper.sh @@ -5,28 +5,25 @@ OVPN_COMMAND="/usr/sbin/openvpn" OPENVPN_CONFIG="$1" -PHYSICAL_IP="$2" -ROUTE_THROUGH_VETH="$3" -# rest of args is the command to run in network namespace -shift -shift -shift - # for routing some traffic from within the namespace to physical # network (e.g. database connection) we need to create a veth pair; +# ip datagrams routed through veth pair are going to have veth's private address +# as their source address - we need to change it to the address of our physical +# network device using iptables' SNAT. This address is provided by the caller. +PHYSICAL_IP="$2" # as we want multiple instances of vpn_wrapper.sh to be able to -# run simultaneously, we need unique ip addresses for them; -# the solution is to derive an ip address from current shell's -# PID (which is unique within a system) -NUMBER=$((($$ - 1) * 4)) -WORD0HOST0=$(($NUMBER % 256 + 1)) -WORD0HOST1=$(($NUMBER % 256 + 2)) -NUMBER=$(($NUMBER / 256)) -WORD1=$(($NUMBER % 256)) -NUMBER=$(($NUMBER / 256)) -WORD2=$(($NUMBER % 256)) -VETH_HOST0=10.$WORD2.$WORD1.$WORD0HOST0 -VETH_HOST1=10.$WORD2.$WORD1.$WORD0HOST1 +# run simultaneously, we need unique ip addresses for veth devices, which +# caller provides to us in command line arguments +VETH_HOST0="$3" +VETH_HOST1="$4" +# caller specifies space-delimited subnets, traffic to which should not be +# routed through the vpn (<database_ip>/32 is going to be here) +ROUTE_THROUGH_VETH="$5" + +# rest of args is the command to run in network namespace +for _ in `seq 5`; do + shift +done # to enable multiple instances of this script to run simultaneously, # we tag namespace name with this shell's PID |