pve-manager/bin/pveproxy
Dietmar Maurer 4b73743aa9 run pveproxy as unpriviledged user (www-data)
We log to /var/log/pveproxy/access.log. Extra directory is needed because we run
as www-data (no permissions to write into /var/log/pve/).
2013-04-10 09:58:35 +02:00

268 lines
6.1 KiB
Perl
Executable File

#!/usr/bin/perl -T -w
$ENV{'PATH'} = '/sbin:/bin:/usr/sbin:/usr/bin';
delete @ENV{qw(IFS CDPATH ENV BASH_ENV)};
use lib '..'; # fixme
use strict;
use English;
use Getopt::Long;
use POSIX ":sys_wait_h";
use Socket;
use IO::Socket::INET;
use PVE::SafeSyslog;
# use PVE::Config; # fixme
use PVE::APIDaemon;
use HTTP::Response;
use Encode;
use URI;
use URI::QueryParam;
use File::Find;
use Data::Dumper;
my $pidfile = "/var/run/pveproxy/pveproxy.pid";
my $lockfile = "/var/lock/pveproxy.lck";
my $opt_debug;
initlog ('pveproxy');
if (!GetOptions ('debug' => \$opt_debug)) {
die "usage: $0 [--debug]\n";
}
$SIG{'__WARN__'} = sub {
my $err = $@;
my $t = $_[0];
chomp $t;
syslog('warning', "WARNING: %s", $t);
$@ = $err;
};
$0 = "pveproxy";
# run as www-data
my $gid = getgrnam('www-data') || die "getgrnam failed - $!\n";
POSIX::setgid($gid) || die "setgid $gid failed - $!\n";
$EGID = "$gid $gid"; # this calls setgroups
my $uid = getpwnam('www-data') || die "getpwnam failed - $!\n";
POSIX::setuid($uid) || die "setuid $uid failed - $!\n";
# just to be sure
die "detected strange uid/gid\n" if !($UID == $uid && $EUID == $uid && $GID eq "$gid $gid" && $EGID eq "$gid $gid");
PVE::APIDaemon::enable_debug() if $opt_debug;
sub add_dirs {
my ($result_hash, $alias, $subdir) = @_;
$result_hash->{$alias} = $subdir;
my $wanted = sub {
my $dir = $File::Find::dir;
if ($dir =~m!^$subdir(.*)$!) {
my $name = "$alias$1/";
$result_hash->{$name} = "$dir/";
}
};
find({wanted => $wanted, follow => 0, no_chdir => 1}, $subdir);
}
my $cpid;
my $daemon;
eval {
my $dirs = {};
add_dirs($dirs, '/pve2/ext4/', '/usr/share/pve-manager/ext4/');
add_dirs($dirs, '/pve2/images/' => '/usr/share/pve-manager/images/');
add_dirs($dirs, '/pve2/css/' => '/usr/share/pve-manager/css/');
add_dirs($dirs, '/vncterm/' => '/usr/share/vncterm/');
$daemon = PVE::APIDaemon->new(
port => 8006,
keep_alive => 100,
max_conn => 500,
max_requests => 1000,
trusted_env => 0, # not trusted, anyone can connect
logfile => '/var/log/pveproxy/access.log',
lockfile => $lockfile,
ssl => {
key_file => '/etc/pve/local/pve-ssl.key',
cert_file => '/etc/pve/local/pve-ssl.pem',
},
# Note: there is no authentication for those pages and dirs!
pages => {
'/' => \&get_index,
# avoid authentication when accessing favicon
'/favicon.ico' => {
file => '/usr/share/pve-manager/images/favicon.ico',
},
},
dirs => $dirs,
);
};
my $err = $@;
if ($err) {
syslog ('err' , "unable to start server: $err");
print STDERR $err;
exit (-1);
}
if ($opt_debug || !($cpid = fork ())) {
$SIG{PIPE} = 'IGNORE';
$SIG{INT} = 'IGNORE' if !$opt_debug;
$SIG{TERM} = $SIG{QUIT} = sub {
syslog ('info' , "server closing");
$SIG{INT} = 'DEFAULT';
unlink "$pidfile";
exit (0);
};
syslog ('info' , "starting server");
if (!$opt_debug) {
# redirect STDIN/STDOUT/SDTERR to /dev/null
open STDIN, '</dev/null' || die "can't read /dev/null [$!]";
open STDOUT, '>/dev/null' || die "can't write /dev/null [$!]";
open STDERR, '>&STDOUT' || die "can't open STDERR to STDOUT [$!]";
}
POSIX::setsid();
eval {
$daemon->start_server();
};
my $err = $@;
if ($err) {
syslog ('err' , "unexpected server error: $err");
print STDERR $err if $opt_debug;
exit (-1);
}
} else {
open (PIDFILE, ">$pidfile") ||
die "cant write '$pidfile' - $! :ERROR";
print PIDFILE "$cpid\n";
close (PIDFILE) ||
die "cant write '$pidfile' - $! :ERROR";
}
exit (0);
# NOTE: Requests to those pages are not authenticated
# so we must be very careful here
sub get_index {
my ($server, $r, $params) = @_;
my $lang = 'en';
my $username;
my $token = 'null';
if (my $cookie = $r->header('Cookie')) {
if (my $newlang = ($cookie =~ /(?:^|\s)PVELangCookie=([^;]*)/)[0]) {
if ($newlang =~ m/^[a-z]{2,3}(_[A-Z]{2,3})?$/) {
$lang = $newlang;
}
}
my $ticket = PVE::REST::extract_auth_cookie($cookie);
if (($username = PVE::AccessControl::verify_ticket($ticket, 1))) {
$token = PVE::AccessControl::assemble_csrf_prevention_token($username);
}
}
my $args = $r->url->query_form_hash();
my $workspace = defined($args->{console}) ?
"PVE.ConsoleWorkspace" : "PVE.StdWorkspace";
$username = '' if !$username;
my $jssrc = <<_EOJS;
if (!PVE) PVE = {};
PVE.UserName = '$username';
PVE.CSRFPreventionToken = '$token';
_EOJS
my $langfile = "/usr/share/pve-manager/ext4/locale/ext-lang-${lang}.js";
$jssrc .= PVE::Tools::file_get_contents($langfile) if -f $langfile;
my $i18nsrc;
$langfile = "/usr/share/pve-manager/root/pve-lang-${lang}.js";
if (-f $langfile) {
$i18nsrc = PVE::Tools::file_get_contents($langfile);
} else {
$i18nsrc = 'function gettext(buf) { return buf; }';
}
$jssrc .= <<_EOJS;
// we need this (the java applet ignores the zindex)
Ext.useShims = true;
Ext.History.fieldid = 'x-history-field';
Ext.onReady(function() { Ext.create('$workspace');});
_EOJS
my $page = <<_EOD;
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Proxmox Virtual Environment</title>
<link rel="stylesheet" type="text/css" href="/pve2/ext4/resources/css/ext-all.css" />
<link rel="stylesheet" type="text/css" href="/pve2/css/ext-pve.css" />
<script type="text/javascript">$i18nsrc</script>
<script type="text/javascript" src="/pve2/ext4/ext-all-debug.js"></script>
<script type="text/javascript" src="/pve2/ext4/pvemanagerlib.js"></script>
<script type="text/javascript">$jssrc</script>
</head>
<body>
<!-- Fields required for history management -->
<form id="history-form" class="x-hidden">
<input type="hidden" id="x-history-field"/>
</form>
</body>
</html>
_EOD
my $resp = HTTP::Response->new(200, "OK", undef, $page);
return $resp;
}
__END__
=head1 NAME
pveproxy - the PVE API proxy server
=head1 SYNOPSIS
pveproxy [--debug]
=head1 DESCRIPTION
This is the REST API proxy server, listening on port 8006.