Added client ACLs:

* IP and CIDR-based ACLs
* Metadata (group/hostname)-based ACLs
* Documentation
* Unit tests

6 files changed, 269 insertions, 38 deletions

diff --git a/src/lib/Bcfg2/Server/CherryPyCore.py b/src/lib/Bcfg2/Server/CherryPyCore.py
index fa66abce9..bf3be72f9 100644
--- a/src/lib/Bcfg2/Server/CherryPyCore.py
+++ b/src/lib/Bcfg2/Server/CherryPyCore.py
@@ -67,10 +67,13 @@ class Core(BaseCore):
         cert = None
         address = (cherrypy.request.remote.ip, cherrypy.request.remote.port)
 
-        if not self.check_acls(address[0]):
-            raise cherrypy.HTTPError(401)
+        rpcmethod = xmlrpcutil.process_body()[1]
+        if rpcmethod == 'ERRORMETHOD':
+            raise Exception("Unknown error processing XML-RPC request body")
 
-        return self.authenticate(cert, username, password, address)
+        if (not self.check_acls(address[0], rpcmethod) or
+            not self.authenticate(cert, username, password, address)):
+            raise cherrypy.HTTPError(401)
 
     @cherrypy.expose
     def default(self, *args, **params):  # pylint: disable=W0613
diff --git a/src/lib/Bcfg2/Server/Core.py b/src/lib/Bcfg2/Server/Core.py
index c01b493de..f93ca0a7b 100644
--- a/src/lib/Bcfg2/Server/Core.py
+++ b/src/lib/Bcfg2/Server/Core.py
@@ -744,6 +744,48 @@ class BaseCore(object):
         return result
 
     @Bcfg2.Server.Statistics.track_statistics()
+    def check_acls(self, address, rmi):
+        """ Check client IP address and metadata object against all
+        :class:`Bcfg2.Server.Plugin.interfaces.ClientACLs` plugins.
+        If any ACL plugin denies access, then access is denied.  ACLs
+        are checked in two phases: First, with the client IP address;
+        and second, with the client metadata object.  This lets an ACL
+        interface do a quick rejection based on IP before metadata is
+        ever built.
+
+        :param address: The address pair of the client to check ACLs for
+        :type address: tuple of (<ip address>, <port>)
+        :param rmi: The fully-qualified name of the RPC call
+        :param rmi: string
+        :returns: bool
+        """
+        plugins = self.plugins_by_type(Bcfg2.Server.Plugin.ClientACLs)
+        try:
+            ip_checks = [p.check_acl_ip(address, rmi) for p in plugins]
+        except:
+            self.logger.error("Unexpected error checking ACLs for %s for %s: "
+                              "%s" % (address[0], rmi, sys.exc_info()[1]))
+            return False  # failsafe
+
+        if all(ip_checks):
+            # if all ACL plugins return True (allow), then allow
+            return True
+        elif False in ip_checks:
+            # if any ACL plugin returned False (deny), then deny
+            return False
+        # else, no plugins returned False, but not all plugins
+        # returned True, so some plugin returned None (defer), so
+        # defer.
+
+        client, metadata = self.resolve_client(address)
+        try:
+            return all(p.check_acl_metadata(metadata, rmi) for p in plugins)
+        except:
+            self.logger.error("Unexpected error checking ACLs for %s for %s: "
+                              "%s" % (client, rmi, sys.exc_info()[1]))
+            return False  # failsafe
+
+    @Bcfg2.Server.Statistics.track_statistics()
     def build_metadata(self, client_name):
         """ Build initial client metadata for a client
 
@@ -804,7 +846,7 @@ class BaseCore(object):
 
         :param address: The address pair of the client to get the
                         canonical hostname for.
-        :type address: tuple of (<ip address>, <hostname>)
+        :type address: tuple of (<ip address>, <port>)
         :param cleanup_cache: Tell the
                               :class:`Bcfg2.Server.Plugin.interfaces.Metadata`
                               plugin in :attr:`metadata` to clean up
@@ -881,21 +923,23 @@ class BaseCore(object):
     def listMethods(self, address):  # pylint: disable=W0613
         """ List all exposed methods, including plugin RMI.
 
-        :param address: Client (address, hostname) pair
+        :param address: Client (address, port) pair
         :type address: tuple
         :returns: list of exposed method names
         """
         methods = [name
                    for name, func in inspect.getmembers(self, callable)
-                   if getattr(func, "exposed", False)]
-        methods.extend(self._get_rmi().keys())
+                   if (getattr(func, "exposed", False) and
+                       self.check_acls(address, name))]
+        methods.extend([m for m in self._get_rmi().keys()
+                        if self.check_acls(address, m)])
         return methods
 
     @exposed
     def methodHelp(self, address, method_name):  # pylint: disable=W0613
         """ Get help from the docstring of an exposed method
 
-        :param address: Client (address, hostname) pair
+        :param address: Client (address, port) pair
         :type address: tuple
         :param method_name: The name of the method to get help on
         :type method_name: string
@@ -911,7 +955,7 @@ class BaseCore(object):
     def DeclareVersion(self, address, version):
         """ Declare the client version.
 
-        :param address: Client (address, hostname) pair
+        :param address: Client (address, port) pair
         :type address: tuple
         :param version: The client's declared version
         :type version: string
@@ -932,7 +976,7 @@ class BaseCore(object):
     def GetProbes(self, address):
         """ Fetch probes for the client.
 
-        :param address: Client (address, hostname) pair
+        :param address: Client (address, port) pair
         :type address: tuple
         :returns: lxml.etree._Element - XML tree describing probes for
                   this client
@@ -955,7 +999,7 @@ class BaseCore(object):
     def RecvProbeData(self, address, probedata):
         """ Receive probe data from clients.
 
-        :param address: Client (address, hostname) pair
+        :param address: Client (address, port) pair
         :type address: tuple
         :returns: bool - True on success
         :raises: :exc:`xmlrpclib.Fault`
@@ -1001,7 +1045,7 @@ class BaseCore(object):
     def AssertProfile(self, address, profile):
         """ Set profile for a client.
 
-        :param address: Client (address, hostname) pair
+        :param address: Client (address, port) pair
         :type address: tuple
         :returns: bool - True on success
         :raises: :exc:`xmlrpclib.Fault`
@@ -1021,7 +1065,7 @@ class BaseCore(object):
         """ Build config for a client by calling
         :func:`BuildConfiguration`.
 
-        :param address: Client (address, hostname) pair
+        :param address: Client (address, port) pair
         :type address: tuple
         :returns: lxml.etree._Element - The full configuration
                   document for the client
@@ -1039,7 +1083,7 @@ class BaseCore(object):
     def RecvStats(self, address, stats):
         """ Act on statistics upload with :func:`process_statistics`.
 
-        :param address: Client (address, hostname) pair
+        :param address: Client (address, port) pair
         :type address: tuple
         :returns: bool - True on success
         :raises: :exc:`xmlrpclib.Fault`
@@ -1060,7 +1104,7 @@ class BaseCore(object):
         :type user: string
         :param password: The password supplied by the client
         :type password: string
-        :param address: An address pair of ``(<ip address>, <hostname>)``
+        :param address: An address pair of ``(<ip address>, <port>)``
         :type address: tuple
         :return: bool - True if the authenticate succeeds, False otherwise
         """
@@ -1084,7 +1128,7 @@ class BaseCore(object):
     def GetDecisionList(self, address, mode):
         """ Get the decision list for the client with :func:`GetDecisions`.
 
-        :param address: Client (address, hostname) pair
+        :param address: Client (address, port) pair
         :type address: tuple
         :returns: list of decision tuples
         :raises: :exc:`xmlrpclib.Fault`
@@ -1111,7 +1155,7 @@ class BaseCore(object):
     def toggle_debug(self, address):
         """ Toggle debug status of the FAM and all plugins
 
-        :param address: Client (address, hostname) pair
+        :param address: Client (address, port) pair
         :type address: tuple
         :returns: bool - The new debug state of the FAM
         """
diff --git a/src/lib/Bcfg2/Server/Plugin/helpers.py b/src/lib/Bcfg2/Server/Plugin/helpers.py
index 9bdfe347f..ae3b84fc2 100644
--- a/src/lib/Bcfg2/Server/Plugin/helpers.py
+++ b/src/lib/Bcfg2/Server/Plugin/helpers.py
@@ -137,7 +137,7 @@ class PluginDatabaseModel(object):
         app_label = "Server"
 
 
-class FileBacked(object):
+class FileBacked(Debuggable):
     """ This object caches file data in memory. FileBacked objects are
     principally meant to be used as a part of
     :class:`Bcfg2.Server.Plugin.helpers.DirectoryBacked`. """
@@ -147,7 +147,7 @@ class FileBacked(object):
         :param name: The full path to the file to cache and monitor
         :type name: string
         """
-        object.__init__(self)
+        Debuggable.__init__(self)
 
         #: A string containing the raw data in this file
         self.data = ''
@@ -172,10 +172,10 @@ class FileBacked(object):
             self.Index()
         except IOError:
             err = sys.exc_info()[1]
-            LOGGER.error("Failed to read file %s: %s" % (self.name, err))
+            self.logger.error("Failed to read file %s: %s" % (self.name, err))
         except:
             err = sys.exc_info()[1]
-            LOGGER.error("Failed to parse file %s: %s" % (self.name, err))
+            self.logger.error("Failed to parse file %s: %s" % (self.name, err))
 
     def Index(self):
         """ Index() is called by :func:`HandleEvent` every time the
@@ -462,9 +462,9 @@ class XMLFileBacked(FileBacked):
                 else:
                     msg = "%s: %s does not exist, skipping" % (self.name, name)
                     if el.findall('./%sfallback' % Bcfg2.Server.XI_NAMESPACE):
-                        LOGGER.debug(msg)
+                        self.logger.debug(msg)
                     else:
-                        LOGGER.warning(msg)
+                        self.logger.warning(msg)
 
     def Index(self):
         self.xdata = lxml.etree.XML(self.data, base_url=self.name,
@@ -475,7 +475,8 @@ class XMLFileBacked(FileBacked):
                 self.xdata.getroottree().xinclude()
             except lxml.etree.XIncludeError:
                 err = sys.exc_info()[1]
-                LOGGER.error("XInclude failed on %s: %s" % (self.name, err))
+                self.logger.error("XInclude failed on %s: %s" % (self.name,
+                                                                 err))
 
         self.entries = self.xdata.getchildren()
         if self.__identifier__ is not None:
@@ -502,7 +503,7 @@ class XMLFileBacked(FileBacked):
         return "%s at %s" % (self.__class__.__name__, self.name)
 
 
-class StructFile(XMLFileBacked, Debuggable):
+class StructFile(XMLFileBacked):
     """ StructFiles are XML files that contain a set of structure file
     formatting logic for handling ``<Group>`` and ``<Client>``
     tags.
@@ -533,7 +534,6 @@ class StructFile(XMLFileBacked, Debuggable):
 
     def __init__(self, filename, should_monitor=False):
         XMLFileBacked.__init__(self, filename, should_monitor=should_monitor)
-        Debuggable.__init__(self)
         self.setup = Bcfg2.Options.get_option_parser()
         self.encoding = self.setup['encoding']
         self.template = None
@@ -684,6 +684,8 @@ class StructFile(XMLFileBacked, Debuggable):
         Match() (and *not* their descendents) should be considered to
         match the metadata.
 
+        Match() returns matching fragments in document order.
+
         :param metadata: Client metadata to match against.
         :type metadata: Bcfg2.Server.Plugins.Metadata.ClientMetadata
         :returns: list of lxml.etree._Element objects """
@@ -734,11 +736,15 @@ class StructFile(XMLFileBacked, Debuggable):
         All ``<Group>`` and ``<Client>`` tags will have been stripped
         out.
 
+        The new document produced by XMLMatch() is not necessarily in
+        the same order as the original document.
+
         :param metadata: Client metadata to match against.
         :type metadata: Bcfg2.Server.Plugins.Metadata.ClientMetadata
         :returns: lxml.etree._Element """
         return self._do_xmlmatch(metadata)
 
+
 class INode(object):
     """ INodes provide lists of things available at a particular group
     intersection.  INodes are deprecated; new plugins should use
@@ -834,7 +840,7 @@ class XMLSrc(XMLFileBacked):
             data = open(self.name).read()
         except IOError:
             msg = "Failed to read file %s: %s" % (self.name, sys.exc_info()[1])
-            LOGGER.error(msg)
+            self.logger.error(msg)
             raise PluginExecutionError(msg)
         self.items = {}
         try:
@@ -842,7 +848,7 @@ class XMLSrc(XMLFileBacked):
         except lxml.etree.XMLSyntaxError:
             msg = "Failed to parse file %s: %s" % (self.name,
                                                    sys.exc_info()[1])
-            LOGGER.error(msg)
+            self.logger.error(msg)
             raise PluginExecutionError(msg)
         self.pnode = self.__node__(xdata, self.items)
         self.cache = None
@@ -852,7 +858,7 @@ class XMLSrc(XMLFileBacked):
             if self.__priority_required__:
                 msg = "Got bogus priority %s for file %s" % \
                     (xdata.get('priority'), self.name)
-                LOGGER.error(msg)
+                self.logger.error(msg)
                 raise PluginExecutionError(msg)
 
         del xdata, data
@@ -862,8 +868,8 @@ class XMLSrc(XMLFileBacked):
         if self.cache is None or self.cache[0] != metadata:
             cache = (metadata, self.__cacheobj__())
             if self.pnode is None:
-                LOGGER.error("Cache method called early for %s; "
-                             "forcing data load" % self.name)
+                self.logger.error("Cache method called early for %s; "
+                                  "forcing data load" % self.name)
                 self.HandleEvent()
                 return
             self.pnode.Match(metadata, cache[1])
@@ -1165,7 +1171,7 @@ class SpecificData(object):
         except UnicodeDecodeError:
             self.data = open(self.name, mode='rb').read()
         except:  # pylint: disable=W0201
-            LOGGER.error("Failed to read file %s" % self.name)
+            self.logger.error("Failed to read file %s" % self.name)
 
 
 class EntrySet(Debuggable):
diff --git a/src/lib/Bcfg2/Server/Plugin/interfaces.py b/src/lib/Bcfg2/Server/Plugin/interfaces.py
index fcd342b33..c1dbb1578 100644
--- a/src/lib/Bcfg2/Server/Plugin/interfaces.py
+++ b/src/lib/Bcfg2/Server/Plugin/interfaces.py
@@ -596,3 +596,33 @@ class ClientRunHooks(object):
         :returns: None
         """
         pass
+
+
+class ClientACLs(object):
+    """ ClientACLs are used to grant or deny access to different
+    XML-RPC calls based on client IP or metadata. """
+
+    def check_acl_ip(self, address, rmi):
+        """ Check if the given IP address is authorized to make the
+        named XML-RPC call.
+
+        :param address: The address pair of the client to check ACLs for
+        :type address: tuple of (<ip address>, <port>)
+        :param rmi: The fully-qualified name of the RPC call
+        :param rmi: string
+        :returns: bool or None - True to allow, False to deny, None to
+                  defer to metadata ACLs
+        """
+        return True
+
+    def check_acl_metadata(self, metadata, rmi):
+        """ Check if the given client is authorized to make the named
+        XML-RPC call.
+
+        :param metadata: The client metadata
+        :type metadata: Bcfg2.Server.Plugins.Metadata.ClientMetadata
+        :param rmi: The fully-qualified name of the RPC call
+        :param rmi: string
+        :returns: bool
+        """
+        return True
diff --git a/src/lib/Bcfg2/Server/Plugins/ACL.py b/src/lib/Bcfg2/Server/Plugins/ACL.py
new file mode 100644
index 000000000..3de3f767c
--- /dev/null
+++ b/src/lib/Bcfg2/Server/Plugins/ACL.py
@@ -0,0 +1,145 @@
+""" Support for client ACLs based on IP address and client metadata """
+
+import os
+import struct
+import socket
+import Bcfg2.Server.Plugin
+
+
+def rmi_names_equal(first, second):
+    """ Compare two XML-RPC method names and see if they match.
+    Resolves some limited wildcards; see
+    :ref:`server-plugins-misc-acl-wildcards` for details.
+
+    :param first: One of the ACLs to compare
+    :type first: string
+    :param second: The other ACL to compare
+    :type second: string
+    :returns: bool """
+    if first == second:
+        # single wildcard is special, and matches everything
+        return True
+    if first is None or second is None:
+        return False
+    if '*' not in first + second:
+        # no wildcards, and not exactly equal
+        return False
+    first_parts = first.split('.')
+    second_parts = second.split('.')
+    if len(first_parts) != len(second_parts):
+        return False
+    for i in range(len(first_parts)):
+        if (first_parts[i] != second_parts[i] and first_parts[i] != '*' and
+            second_parts[i] != '*'):
+            return False
+    return True
+
+
+def ip2int(ip):
+    """ convert a dotted-quad IP address into an integer
+    representation of the same """
+    return struct.unpack('>L', socket.inet_pton(socket.AF_INET, ip))[0]
+
+
+def ip_matches(ip, entry):
+    """ Return True if the given IP matches the IP or IP and netmask
+    in the given ACL entry; False otherwise """
+    if entry.get("netmask"):
+        try:
+            mask = int("1" * int(entry.get("netmask")) +
+                       "0" * (32 - int(entry.get("netmask"))), 2)
+        except ValueError:
+            mask = ip2int(entry.get("netmask"))
+        return ip2int(ip) & mask == ip2int(entry.get("address")) & mask
+    elif entry.get("address") is None:
+        # no address, no netmask -- match all
+        return True
+    elif ip == entry.get("address"):
+        # just a plain ip address
+        return True
+    return False
+
+
+class IPACLFile(Bcfg2.Server.Plugin.XMLFileBacked):
+    """ representation of ACL ip.xml, for IP-based ACLs """
+    actions = dict(Allow=True,
+                   Deny=False,
+                   Defer=None)
+
+    def check_acl(self, address, rmi):
+        """ Check a client address against the ACL list """
+        if not len(self.entries):
+            # default defer if no ACLs are defined.
+            self.debug_log("ACL: %s requests %s: No IP ACLs, defer" %
+                           (address, rmi))
+            return self.actions["Defer"]
+        for entry in self.entries:
+            if (ip_matches(address, entry) and
+                rmi_names_equal(entry.get("method"), rmi)):
+                self.debug_log("ACL: %s requests %s: Found matching IP ACL, "
+                               "%s" % (address, rmi, entry.tag.lower()))
+                return self.actions[entry.tag]
+        if address == "127.0.0.1":
+            self.debug_log("ACL: %s requests %s: No matching IP ACLs, "
+                           "localhost allowed" % (address, rmi))
+            return self.actions['Allow']  # default allow for localhost
+
+        self.debug_log("ACL: %s requests %s: No matching IP ACLs, defer" %
+                       (address, rmi))
+        return self.actions["Defer"]  # default defer for other machines
+
+
+class MetadataACLFile(Bcfg2.Server.Plugin.StructFile):
+    """ representation of ACL metadata.xml, for metadata-based ACLs """
+    def check_acl(self, metadata, rmi):
+        """ check client metadata against the ACL list """
+        if not len(self.entries):
+            # default allow if no ACLs are defined.
+            self.debug_log("ACL: %s requests %s: No metadata ACLs, allow" %
+                           (metadata.hostname, rmi))
+            return True
+        for el in self.Match(metadata):
+            if rmi_names_equal(el.get("method"), rmi):
+                self.debug_log("ACL: %s requests %s: Found matching metadata "
+                               "ACL, %s" % (metadata.hostname, rmi,
+                                            el.tag.lower()))
+                return el.tag == "Allow"
+        if metadata.hostname in ['localhost', 'localhost.localdomain']:
+            # default allow for localhost
+            self.debug_log("ACL: %s requests %s: No matching metadata ACLs, "
+                           "localhost allowed" % (metadata.hostname, rmi))
+            return True
+        self.debug_log("ACL: %s requests %s: No matching metadata ACLs, deny" %
+                       (metadata.hostname, rmi))
+        return False  # default deny for other machines
+
+
+class ACL(Bcfg2.Server.Plugin.Plugin,
+          Bcfg2.Server.Plugin.ClientACLs):
+    """ allow connections to bcfg-server based on IP address """
+
+    def __init__(self, core, datastore):
+        Bcfg2.Server.Plugin.Plugin.__init__(self, core, datastore)
+        Bcfg2.Server.Plugin.ClientACLs.__init__(self)
+        self.ip_acls = IPACLFile(os.path.join(self.data, 'ip.xml'),
+                                 should_monitor=True)
+        self.metadata_acls = MetadataACLFile(os.path.join(self.data,
+                                                          'metadata.xml'),
+                                             should_monitor=True)
+
+    def check_acl_ip(self, address, rmi):
+        self.debug_log("ACL: %s requests %s: Checking IP ACLs" %
+                       (address[0], rmi))
+        return self.ip_acls.check_acl(address[0], rmi)
+
+    def check_acl_metadata(self, metadata, rmi):
+        self.debug_log("ACL: %s requests %s: Checking metadata ACLs" %
+                       (metadata.hostname, rmi))
+        return self.metadata_acls.check_acl(metadata, rmi)
+
+    def set_debug(self, debug):
+        rv = Bcfg2.Server.Plugin.Plugin.set_debug(self, debug)
+        self.ip_acls.set_debug(debug)
+        self.metadata_acls.set_debug(debug)
+        return rv
+    set_debug.__doc__ = Bcfg2.Server.Plugin.Plugin.set_debug.__doc__
diff --git a/src/lib/Bcfg2/Server/SSLServer.py b/src/lib/Bcfg2/Server/SSLServer.py
index f2fb4913a..0d1246d85 100644
--- a/src/lib/Bcfg2/Server/SSLServer.py
+++ b/src/lib/Bcfg2/Server/SSLServer.py
@@ -27,8 +27,7 @@ class XMLRPCDispatcher(SimpleXMLRPCServer.SimpleXMLRPCDispatcher):
             # Python 2.4?
             SimpleXMLRPCServer.SimpleXMLRPCDispatcher.__init__(self)
 
-        self.logger = logging.getLogger("%s.%s" % (self.__class__.__module__,
-                                                   self.__class__.__name__))
+        self.logger = logging.getLogger(self.__class__.__name__)
         self.allow_none = allow_none
         self.encoding = encoding
 
@@ -95,8 +94,7 @@ class SSLServer(SocketServer.TCPServer, object):
         if ':' in server_address[0]:
             self.address_family = socket.AF_INET6
 
-        self.logger = logging.getLogger("%s.%s" % (self.__class__.__module__,
-                                                   self.__class__.__name__))
+        self.logger = logging.getLogger(self.__class__.__name__)
 
         try:
             SocketServer.TCPServer.__init__(self, listen_address,
@@ -185,10 +183,9 @@ class XMLRPCRequestHandler(SimpleXMLRPCServer.SimpleXMLRPCRequestHandler):
     """
 
     def __init__(self, *args, **kwargs):
+        self.logger = logging.getLogger(self.__class__.__name__)
         SimpleXMLRPCServer.SimpleXMLRPCRequestHandler.__init__(self, *args,
                                                                **kwargs)
-        self.logger = logging.getLogger("%s.%s" % (self.__class__.__module__,
-                                                   self.__class__.__name__))
 
     def authenticate(self):
         try:
@@ -262,6 +259,12 @@ class XMLRPCRequestHandler(SimpleXMLRPCServer.SimpleXMLRPCRequestHandler):
                 raise
         else:
             # got a valid XML RPC response
+            # first, check ACLs
+            client_address = self.request.getpeername()
+            method = xmlrpclib.loads(data)[1]
+            if not self.server.instance.check_acls(client_address, method):
+                self.send_error(401, self.responses[401][0])
+                self.end_headers()
             try:
                 self.send_response(200)
                 self.send_header("Content-type", "text/xml")