From 3c9b4d0e434d536c471d225e01723a61af544cb1 Mon Sep 17 00:00:00 2001 From: Tony Mack Date: Wed, 2 Mar 2011 16:26:03 -0500 Subject: [PATCH] add support for flash clients using flashpolicy --- config/default_config.xml | 25 ++++++ flashpolicy/.sfa_flashpolicy.py.swp | Bin 0 -> 20480 bytes flashpolicy/sfa_flashpolicy.py | 115 +++++++++++++++++++++++++ flashpolicy/sfa_flashpolicy_config.xml | 8 ++ setup.py | 3 + sfa.spec | 12 +++ sfa/init.d/sfa | 4 + 7 files changed, 167 insertions(+) create mode 100644 flashpolicy/.sfa_flashpolicy.py.swp create mode 100644 flashpolicy/sfa_flashpolicy.py create mode 100644 flashpolicy/sfa_flashpolicy_config.xml diff --git a/config/default_config.xml b/config/default_config.xml index aa8a3482..3eecf98e 100644 --- a/config/default_config.xml +++ b/config/default_config.xml @@ -265,6 +265,31 @@ Thierry Parmentelat + + SFA Flash Policy + The settings that affect the flash policy server that will run + as part of this SFA instance. + + + + Enable Flash Policy Server + false + Allows this local SFA instance to run a + flash policy server. + + + Flash policy config file + /etc/sfa/sfa_flashpolicy_config.xml + The path to where the flash policy config file can be reached. + + + Flash policy port + 843 + The flash policy server port. + + + + diff --git a/flashpolicy/.sfa_flashpolicy.py.swp b/flashpolicy/.sfa_flashpolicy.py.swp new file mode 100644 index 0000000000000000000000000000000000000000..cf37d73c61f2c38c4dda9fb3b44be137ddbbdd1b GIT binary patch literal 20480 zcmeI2ZEPGz8ON8DKwHum(EvpPG_e)!S-m@-6E|rM7ZJs_WRlpf&j}J~*zVoV*<0`J z9y_zPuR!@!A%sAHXjLQxqJ^M-K!6IWM4QkGB#L+u;zQDcc#(LE@&VLJL4|&R|1-0D zyXTjtYRd>1W?9Mzh^UO1^&opZ%XO6Rj)iDdtjh6M5?}x{azJITEpJ!RJiKXuxQ|XuxQ|XuxQ|XuxQ|XuxQ|XuxQ|XuxRT z|3m{W{QSSdCV%%0C@}p0bOvw^AZzXnf& zAA;|K?|_Fu51a(kU>Mv4{(7Bd{StJ*wct4v;2CfM`~W-vJ`Ox^5bOjmyv4G<1wISr zz)o=STFd%2;Nach-`7~y@4;E{C9nz>z~!qg>nZRVFbQr1|9rD${Rx~0=Rg8ZfZgEv zH(Az?!DHYPU=i#B&+N3UGavwO2QT8lEk5_rj^lb^&_5;qQXO2zTW!B-+U3KHSt->Qp3T|Z}LDls< zC+bQ+3QKmSjktEDLP_zL$AzrhT~{vK<(JGj@P*_di$dfbOEy2ZuvpAgg}2YNt23pf zd8RrbdtF}lLrG<6yGbDHw~g=Lt}FwZfg%LzRJZqb<7kQ5>=q_uTsk?m(3qK<9VwQE z)fp6^)KQ&NnwVFrDJ8;P;`o}%I8~`o8S7M?(@blrt`%&dc&y|4VQFL{Z=-IEqO(JX zL{C(O^mrVXsSrw)lpu(fN`eP%^%e<>6`=Q3ieOL0aTK#IVrC;eVc)h*~RLR#E4O3N)A>6)LY_ zgF{P2qm|Ld8Wk!-Y3U(7R0R(`Hwcs#t6GF^Ssh3JpXYSa4SbKq{38i08^0~?uW~Qb zVHAv#(L{d*uh%Wd1nN+WEMq2KPO-UBOqpRS zQY@yKrrQj9Ohyq4+!!+l#<3z!( zuRMz2l1vcuX(_ep#@sQdF?ZzX)FMn&PYR7WXJP6@W9snaOw8imxXSc#@9cY zz{Atd%)jdBD6CAwqS*AP6nzU;Au{637zewXjtnbC)6*AA ziO8j3X^9UoJ@tVM+j0ERmyVNJHNL?(Y0#OlTDUn(lM@XCj$Rs{}5Q(an zboZ57G42?nT4lCRThQhYsgY(eQ4Yk3y6C(1C>GYENWJNLGTx!9ARf$p@`DTPWBTvI z^Yc@)lUe8p>=r$vc3^y5=RM5U*VnOlU+-{M!363HhJSY_Sg>F`>9{MLi3Ibhnrt!F zEmI?4t`%5XCSBjd2!ttABCUYk1RhH;)_Qz3OoCvb*6BOstus!;g{qMnbizV4`Wi|) zu2?Chi7^@@b{jXhOCt=6mD&V_9lq|%EDFLjI{03?`gj>hhK7bFUEYakC8gF9tt5`s zYB7#lT!<rrm7wWSPW^2hiC@nU#Yyqnutbznf`}V%-tqiOB08wImJ{BzrYF@od zu!iyK1Z_ShSmD0AhYRm4+l0&x>_AkC26D$lqzj%JzTO3<8$&b?o2L8p5Whh#3D`55 zhdu=r9KxZ~RFoI#oKK)~63tPkIob* zf&QS2s!p)_F;cImIub0|>g2XVXDc|U6SFsI2z?Z-d`Cfe)JY z|8(d7GWPm^0T;ke!DHYX;OpQ4a6kAY_%L`cxCLAdUcmnUXW&t=0RDk}|9Nm0JORE6 zJ_?#(2D}SgfQ=GkSZmeueP3E zC{FIYP=3bO;zmX4pHh>_z;u>1RGz1~V3MVMN%s{!VcL(xjjB?oou!CZ1M zmmIXi-du7pmmK1J=hdInX%@!DDV>b<&xXq)=8}WC 10000: + raise exceptions.RuntimeError('File probably too large to be a policy file', + path) + if 'cross-domain-policy' not in policy: + raise exceptions.RuntimeError('Not a valid policy file', + path) + return policy + def run(self): + try: + while True: + thread.start_new_thread(self.handle, self.sock.accept()) + except socket.error, e: + self.log('Error accepting connection: %s' % (e[1],)) + def handle(self, conn, addr): + addrstr = '%s:%s' % (addr[0],addr[1]) + try: + self.log('Connection from %s' % (addrstr,)) + with contextlib.closing(conn): + # It's possible that we won't get the entire request in + # a single recv, but very unlikely. + request = conn.recv(1024).strip() + if request != '\0': + self.log('Unrecognized request from %s: %s' % (addrstr, request)) + return + self.log('Valid request received from %s' % (addrstr,)) + conn.sendall(self.policy) + self.log('Sent policy file to %s' % (addrstr,)) + except socket.error, e: + self.log('Error handling connection from %s: %s' % (addrstr, e[1])) + except Exception, e: + self.log('Error handling connection from %s: %s' % (addrstr, e[1])) + def log(self, str): + print >>sys.stderr, str + +def main(): + parser = optparse.OptionParser(usage = '%prog [--port=PORT] --file=FILE', + version='%prog ' + str(VERSION)) + parser.add_option('-p', '--port', dest='port', type=int, default=843, + help='listen on port PORT', metavar='PORT') + parser.add_option('-f', '--file', dest='path', + help='server policy file FILE', metavar='FILE') + parser.add_option("-d", "--daemon", dest="daemon", action="store_true", + help="Run as daemon.", default=False) + opts, args = parser.parse_args() + if args: + parser.error('No arguments are needed. See help.') + if not opts.path: + parser.error('File must be specified. See help.') + + try: + if opts.daemon: + daemon() + policy_server(opts.port, opts.path).run() + except Exception, e: + print >> sys.stderr, e + sys.exit(1) + except KeyboardInterrupt: + pass + +if __name__ == '__main__': + main() diff --git a/flashpolicy/sfa_flashpolicy_config.xml b/flashpolicy/sfa_flashpolicy_config.xml new file mode 100644 index 00000000..757022b0 --- /dev/null +++ b/flashpolicy/sfa_flashpolicy_config.xml @@ -0,0 +1,8 @@ + + + + + + + + diff --git a/setup.py b/setup.py index ffa138e8..87a45297 100755 --- a/setup.py +++ b/setup.py @@ -31,6 +31,7 @@ bins = [ 'sfa/client/sfiDeleteAttribute.py', 'sfatables/sfatables', 'keyconvert/keyconvert.py' + 'flashpolicy/sfa_flashpolicy.py', ] package_dirs = [ @@ -47,6 +48,7 @@ package_dirs = [ 'sfatables', 'sfatables/commands', 'sfatables/processors', + 'flashpolicy', ] @@ -60,6 +62,7 @@ data_files = [('/etc/sfa/', [ 'config/aggregates.xml', 'sfa/trust/sig.xsd', 'sfa/trust/xml.xsd', 'sfa/trust/protogeni-rspec-common.xsd', + 'flash_policy/flashpolicy_config.xml', ]), ('/etc/sfatables/matches/', glob('sfatables/matches/*.xml')), ('/etc/sfatables/targets/', glob('sfatables/targets/*.xml')), diff --git a/sfa.spec b/sfa.spec index 27364039..94904c3c 100644 --- a/sfa.spec +++ b/sfa.spec @@ -70,6 +70,11 @@ Summary: sfatables policy tool for SFA Group: Applications/System Requires: sfa +%package flashpolicy +Summary: SFA support for flash clients +Group: Applications/System +Requires: sfa + %Package tests Summary: unit tests suite for SFA Group: Applications/System @@ -95,6 +100,9 @@ sfatables is a tool for defining access and admission control policies in an SFA network, in much the same way as iptables is for ip networks. This is the command line interface to manage sfatables +%description flashpolicy +This package provides support for adobe flash client applications. + %description tests Provides some binary unit tests in /usr/share/sfa/tests @@ -154,6 +162,10 @@ rm -rf $RPM_BUILD_ROOT %files sfatables %{_bindir}/sfatables +%files flashpolicy +%{_bindir}/sfa_flashpolicy.py +/etc/sfa/flashpolicy_config.xml + %files tests %{_datadir}/sfa/tests diff --git a/sfa/init.d/sfa b/sfa/init.d/sfa index 5e579ee5..e4b8fecd 100755 --- a/sfa/init.d/sfa +++ b/sfa/init.d/sfa @@ -75,6 +75,10 @@ start() { action "SFA SliceMgr" daemon /usr/bin/sfa-server.py -s -d $OPTIONS fi + if [ "$SFA_FLASHPOLICY_ENABLED" -eq 1 ]; then + action "Flash Policy Server" daemon /usr/bin/sfa_flashpolicy.py --file="$SFA_FLASHPOLICY_CONFIG_FILE" --port=$SFA_FLASHPOLICY_PORT -d + fi + RETVAL=$? [ $RETVAL -eq 0 ] && touch /var/lock/subsys/sfa-server.py -- 2.43.0