1 | #!/usr/bin/perl
|
---|
2 | # XMLRPC interface to IPDB search
|
---|
3 | # Copyright (C) 2017 Kris Deugau <kdeugau@deepnet.cx>
|
---|
4 |
|
---|
5 | use strict;
|
---|
6 | use warnings;
|
---|
7 |
|
---|
8 | use DBI;
|
---|
9 | use NetAddr::IP;
|
---|
10 | use FCGI;
|
---|
11 | use Frontier::Responder;
|
---|
12 |
|
---|
13 | use Sys::Syslog;
|
---|
14 |
|
---|
15 | # don't remove! required for GNU/FHS-ish install from tarball
|
---|
16 | ##uselib##
|
---|
17 |
|
---|
18 | # push "the directory the script is in" into @INC
|
---|
19 | use FindBin;
|
---|
20 | use lib "$FindBin::RealBin/";
|
---|
21 |
|
---|
22 | use MyIPDB;
|
---|
23 | use CustIDCK;
|
---|
24 |
|
---|
25 | openlog "IPDB-search-rpc","pid","$IPDB::syslog_facility";
|
---|
26 |
|
---|
27 | ##fixme: username source? can we leverage some other auth method?
|
---|
28 | # we don't care except for logging here, and Frontier::Client needs
|
---|
29 | # a patch that's not well-distributed to use HTTP AUTH.
|
---|
30 |
|
---|
31 | # Collect the username from HTTP auth. If undefined, we're in
|
---|
32 | # a test environment, or called without a username.
|
---|
33 | my $authuser;
|
---|
34 | if (!defined($ENV{'REMOTE_USER'})) {
|
---|
35 | $authuser = '__temptest';
|
---|
36 | } else {
|
---|
37 | $authuser = $ENV{'REMOTE_USER'};
|
---|
38 | }
|
---|
39 |
|
---|
40 | # Why not a global DB handle? (And a global statement handle, as well...)
|
---|
41 | # Use the connectDB function, otherwise we end up confusing ourselves
|
---|
42 | my $ip_dbh;
|
---|
43 | my $sth;
|
---|
44 | my $errstr;
|
---|
45 | ($ip_dbh,$errstr) = connectDB_My;
|
---|
46 | initIPDBGlobals($ip_dbh);
|
---|
47 |
|
---|
48 | my $methods = {
|
---|
49 | 'ipdb.search' => \&rpc_search,
|
---|
50 | };
|
---|
51 |
|
---|
52 | my $reqcnt = 0;
|
---|
53 |
|
---|
54 | my $req = FCGI::Request();
|
---|
55 |
|
---|
56 | # main FCGI loop.
|
---|
57 | while ($req->Accept() >= 0) {
|
---|
58 | # done here to a) prevent $ENV{'REMOTE_ADDR'} from being empty and b) to collect
|
---|
59 | # the right user for the individual call (since we may be running with FCGI)
|
---|
60 | syslog "debug", "$authuser active, $ENV{'REMOTE_ADDR'}";
|
---|
61 |
|
---|
62 | # don't *think* we need any of these...
|
---|
63 | # %disp_alloctypes, %def_custids, %list_alloctypes
|
---|
64 | # @citylist, @poplist
|
---|
65 | # @masterblocks, %allocated, %free, %bigfree, %routed (removed in /trunk)
|
---|
66 | # %IPDBacl
|
---|
67 | #initIPDBGlobals($ip_dbh);
|
---|
68 |
|
---|
69 | my $res = Frontier::Responder->new(
|
---|
70 | methods => $methods
|
---|
71 | );
|
---|
72 |
|
---|
73 | # "Can't do that" errors
|
---|
74 | if (!$ip_dbh) {
|
---|
75 | print "Content-type: text/xml\n\n".$res->{_decode}->encode_fault(5, $DBI::errstr);
|
---|
76 | } else {
|
---|
77 | print $res->answer;
|
---|
78 | }
|
---|
79 | last if $reqcnt++ > $IPDB::maxfcgi;
|
---|
80 | } # while FCGI::accept
|
---|
81 |
|
---|
82 | exit 0;
|
---|
83 |
|
---|
84 |
|
---|
85 | ##
|
---|
86 | ## Private subs
|
---|
87 | ##
|
---|
88 |
|
---|
89 | # Check RPC ACL
|
---|
90 | sub _aclcheck {
|
---|
91 | my $subsys = shift;
|
---|
92 | return 1 if grep /$ENV{REMOTE_ADDR}/, @{$IPDB::rpcacl{$subsys}};
|
---|
93 | warn "$subsys/$ENV{REMOTE_ADDR} not in ACL\n"; # a bit of logging
|
---|
94 | return 0;
|
---|
95 | }
|
---|
96 |
|
---|
97 | sub _commoncheck {
|
---|
98 | my $argref = shift;
|
---|
99 | my $needslog = shift;
|
---|
100 |
|
---|
101 | die "Missing remote system name\n" if !$argref->{rpcsystem};
|
---|
102 | die "Access denied\n" if !_aclcheck($argref->{rpcsystem});
|
---|
103 | if ($needslog) {
|
---|
104 | die "Missing remote username\n" if !$argref->{rpcuser};
|
---|
105 | }
|
---|
106 | }
|
---|
107 |
|
---|
108 | # stripped-down copy from from main.cgi. should probably be moved to IPDB.pm
|
---|
109 | sub _validateInput {
|
---|
110 | my $argref = shift;
|
---|
111 |
|
---|
112 | if (!$argref->{block}) {
|
---|
113 | $argref->{block} = $argref->{cidr} if $argref->{cidr};
|
---|
114 | die "Block/IP is required\n" if !$argref->{block};
|
---|
115 | }
|
---|
116 |
|
---|
117 | # Alloctype check.
|
---|
118 | chomp $argref->{type};
|
---|
119 |
|
---|
120 | die "Invalid allocation type\n" if (!grep /$argref->{type}/, keys %disp_alloctypes);
|
---|
121 |
|
---|
122 | # Arguably not quite correct, as the custID won't be checked for
|
---|
123 | # validity if there's a default on the type.
|
---|
124 | if ($def_custids{$argref->{type}} eq '') {
|
---|
125 | # Types without a default custID must have one passed in
|
---|
126 | die "Customer ID is required\n" if !$argref->{custid};
|
---|
127 | # Crosscheck with billing.
|
---|
128 | my $status = CustIDCK->custid_exist($argref->{custid});
|
---|
129 | die "Error verifying customer ID: $CustIDCK::ErrMsg\n" if $CustIDCK::Error;
|
---|
130 | die "Customer ID not valid\n" if !$status;
|
---|
131 | } else {
|
---|
132 | # Types that have a default will use it unless one is specified.
|
---|
133 | if ((!$argref->{custid}) || ($argref->{custid} ne 'STAFF')) {
|
---|
134 | $argref->{custid} = $def_custids{$argref->{type}};
|
---|
135 | }
|
---|
136 | }
|
---|
137 | } # end validateInput()
|
---|
138 |
|
---|
139 |
|
---|
140 | ##
|
---|
141 | ## RPC method subs
|
---|
142 | ##
|
---|
143 |
|
---|
144 | sub rpc_search {
|
---|
145 | my %args = @_;
|
---|
146 |
|
---|
147 | _commoncheck(\%args, 'n');
|
---|
148 |
|
---|
149 | my @fields;
|
---|
150 | my @vals;
|
---|
151 | my @matchtypes;
|
---|
152 |
|
---|
153 | my %mt = (
|
---|
154 | EXACT => '=',
|
---|
155 | EQUAL => '=',
|
---|
156 | NOT => '!~', # text only?
|
---|
157 | # CIDR options
|
---|
158 | MASK => 'MASK',
|
---|
159 | WITHIN => '<<=',
|
---|
160 | CONTAINS => '>>=',
|
---|
161 | );
|
---|
162 |
|
---|
163 | if ($args{type}) {
|
---|
164 | # assume alloctype class if we only get one letter
|
---|
165 | $args{type} = "_$args{type}" if $args{type} =~ /^.$/;
|
---|
166 | my $notflag = '';
|
---|
167 | if ($args{type} =~ /^NOT:/) {
|
---|
168 | $args{type} =~ s/^NOT://;
|
---|
169 | $notflag = 'NOT ';
|
---|
170 | }
|
---|
171 | if ($args{type} =~ /\./) {
|
---|
172 | $args{type} =~ s/\./_/;
|
---|
173 | push @matchtypes, $notflag.'LIKE';
|
---|
174 | } else {
|
---|
175 | push @matchtypes, ($notflag ? '<>' : '=');
|
---|
176 | }
|
---|
177 | push @fields, 's.type';
|
---|
178 | push @vals, $args{type};
|
---|
179 | }
|
---|
180 |
|
---|
181 | ## CIDR query options.
|
---|
182 | if ($args{cidr}) {
|
---|
183 | $args{cidr} =~ s/^\s*(.+)\s*$/$1/g;
|
---|
184 | # strip matching type substring, if any - only applies to full-CIDR
|
---|
185 | my ($mnote) = $args{cidr} =~ /^(\w+):/;
|
---|
186 | $args{cidr} =~ s/^$mnote:// if $mnote;
|
---|
187 |
|
---|
188 | if ($args{cidr} eq '') { # We has a blank CIDR. Ignore it.
|
---|
189 | } elsif ($args{cidr} =~ /\//) {
|
---|
190 | my ($net,$maskbits) = split /\//, $args{cidr};
|
---|
191 | if ($args{cidr} =~ /^(\d{1,3}\.){3}\d{1,3}\/\d{2}$/) {
|
---|
192 | # Full CIDR match.
|
---|
193 | push @fields, 's.cidr';
|
---|
194 | push @vals, $args{cidr};
|
---|
195 | if ($mnote =~ /(EQUAL|EXACT|CONTAINS|WITHIN)/) {
|
---|
196 | push @matchtypes, $mt{$1};
|
---|
197 | } else { # default to exact match
|
---|
198 | push @matchtypes, '=';
|
---|
199 | }
|
---|
200 | } elsif ($args{cidr} =~ /^(\d{1,3}\.){2}\d{1,3}\/\d{2}$/) {
|
---|
201 | # Partial match; beginning of subnet and maskbits are provided
|
---|
202 | # Show any blocks with the leading octet(s) and that masklength
|
---|
203 | # eg 192.168.179/26 should show all /26 subnets in 192.168.179
|
---|
204 | # Need some more magic for bare /nn searches:
|
---|
205 | push @fields, 's.cidr','masklen(s.cidr)';
|
---|
206 | push @vals, "$net.0/24", $maskbits;
|
---|
207 | push @matchtypes, '<<=','=';
|
---|
208 | }
|
---|
209 | } elsif ($args{cidr} =~ /^(\d{1,3}\.){3}\d{1,3}$/) {
|
---|
210 | # Specific IP address match. Will show the parent chain down to the final allocation.
|
---|
211 | push @fields, 's.cidr';
|
---|
212 | push @vals, $args{cidr};
|
---|
213 | push @matchtypes, '>>=';
|
---|
214 | } elsif ($args{cidr} =~ /^\d{1,3}(\.(\d{1,3}(\.(\d{1,3}\.?)?)?)?)?$/) {
|
---|
215 | # 1, 2, or 3 leading octets in CIDR
|
---|
216 | push @fields, 'text(s.cidr)';
|
---|
217 | push @vals, "$args{cidr}\%";
|
---|
218 | push @matchtypes, 'LIKE'; # hmm
|
---|
219 | } else {
|
---|
220 | # do nothing.
|
---|
221 | ##fixme we'll ignore this to clear out the references to legacy code.
|
---|
222 | } # done with CIDR query options.
|
---|
223 |
|
---|
224 | } # args{cidr}
|
---|
225 |
|
---|
226 | foreach (qw(custid description notes city) ) {
|
---|
227 | if ($args{$_}) {
|
---|
228 | push @fields, "s.$_";
|
---|
229 | if ($args{$_} =~ /^(EXACT|NOT):/) {
|
---|
230 | push @matchtypes, $mt{$1};
|
---|
231 | $args{$_} =~ s/^$1://;
|
---|
232 | } else {
|
---|
233 | push @matchtypes, '~*';
|
---|
234 | }
|
---|
235 | push @vals, $args{$_};
|
---|
236 | }
|
---|
237 | }
|
---|
238 |
|
---|
239 | # Filter on "available", because we can.
|
---|
240 | if ($args{available} && $args{available} =~ /^[yn]$/) {
|
---|
241 | push @fields, "s.available";
|
---|
242 | push @matchtypes, '=';
|
---|
243 | push @vals, $args{available};
|
---|
244 | }
|
---|
245 |
|
---|
246 | my $cols = "s.cidr, s.custid, s.type, s.city, s.description, s.id, s.parent_id, s.available, s.vrf, a.dispname";
|
---|
247 | my $sql = qq(SELECT $cols FROM searchme s JOIN alloctypes a ON s.type = a.type);
|
---|
248 | my @sqlcriteria;
|
---|
249 | for (my $i = 0; $i <= $#fields; $i++) {
|
---|
250 | push @sqlcriteria, "$fields[$i] $matchtypes[$i] ?";
|
---|
251 | }
|
---|
252 | $sql .= " WHERE ".join(' AND ', @sqlcriteria) if @sqlcriteria;
|
---|
253 |
|
---|
254 | # multifield sorting!
|
---|
255 | if ($args{order}) {
|
---|
256 | my @ordfields = split /,/, $args{order};
|
---|
257 | # there are probably better ways to do this
|
---|
258 | my %omap = (cidr => 's.cidr', net => 's.cidr', network => 's.cidr', ip => 's.cidr',
|
---|
259 | custid => 's.custid', type => 's.type', city => 's.city',
|
---|
260 | desc => 's.description', description => 's.description');
|
---|
261 | my @ordlist;
|
---|
262 | # only pass sort field values from the list of acceptable field names or aliases as per %omap
|
---|
263 | foreach my $ord (@ordfields) {
|
---|
264 | push @ordlist, $omap{$ord}
|
---|
265 | if grep /^$ord$/, (keys %omap);
|
---|
266 | }
|
---|
267 | if (@ordlist) {
|
---|
268 | $sql .= " ORDER BY ". join(',', @ordlist);
|
---|
269 | }
|
---|
270 | }
|
---|
271 |
|
---|
272 | my $result = $ip_dbh->selectall_arrayref($sql, {Slice=>{}}, @vals);
|
---|
273 | die $ip_dbh->errstr if !$result;
|
---|
274 |
|
---|
275 | return $result;
|
---|
276 | } # rpc_search()
|
---|
277 |
|
---|
278 |
|
---|
279 | __END__
|
---|
280 |
|
---|
281 | =pod
|
---|
282 |
|
---|
283 | =head1 IPDB XMLRPC Search
|
---|
284 |
|
---|
285 | This is a general-purpose search API for IPDB. It is currently being extended based on requirements from other tools needing to
|
---|
286 | search for data in IPDB.
|
---|
287 |
|
---|
288 | It supports one XMLRPC sub, "search".
|
---|
289 |
|
---|
290 | The calling URL for this API should end with "/search-rpc.cgi". If you are doing many requests, you should use the FastCGI variant
|
---|
291 | with .fcgi instead of .cgi.
|
---|
292 |
|
---|
293 | =head2 Calling conventions
|
---|
294 |
|
---|
295 | IPDB RPC services use "XMLRPC", http://xmlrpc.com, for data exchange.
|
---|
296 |
|
---|
297 | Arguments are passed in as a key-value list, and data is returned as an array of hashes in some form.
|
---|
298 |
|
---|
299 | =over 4
|
---|
300 |
|
---|
301 | =item Perl
|
---|
302 |
|
---|
303 | use Frontier::Client;
|
---|
304 | my $server = Frontier::Client->new(
|
---|
305 | url => "http://server/path/search-rpc.cgi",
|
---|
306 | );
|
---|
307 | my %args = (
|
---|
308 | rpcsystem => 'somesystem',
|
---|
309 | rpcuser => 'someuser',
|
---|
310 | arg1 => 'val1',
|
---|
311 | arg2 => 'val2',
|
---|
312 | );
|
---|
313 | my $result = $server->call('ipdb.search', %args);
|
---|
314 |
|
---|
315 | =item Python 2
|
---|
316 |
|
---|
317 | import xmlrpclib
|
---|
318 | server = xmlrpclib.Server("http://server/path/search-rpc.cgi")
|
---|
319 | result = server.ipdb.search(
|
---|
320 | 'rpcsystem', 'comesystems',
|
---|
321 | 'rpcuser', 'someuser',
|
---|
322 | 'arg1', 'val1',
|
---|
323 | 'arg2', 'val2',
|
---|
324 | )
|
---|
325 |
|
---|
326 | =item Python 3
|
---|
327 |
|
---|
328 | import xmlrpc.client
|
---|
329 | server = xmlrpc.client.ServerProxy("http://server/path/search-rpc.cgi")
|
---|
330 | result = server.ipdb.search(
|
---|
331 | 'rpcsystem', 'somesystem',
|
---|
332 | 'rpcuser', 'someuser',
|
---|
333 | 'arg1', 'val1',
|
---|
334 | 'arg2', 'val2',
|
---|
335 | )
|
---|
336 |
|
---|
337 | =back
|
---|
338 |
|
---|
339 | =head3 Standard arguments
|
---|
340 |
|
---|
341 | The C<rpcsystem> argument is required, and C<rpcuser> is strongly recommended as it may be used for access control in some future
|
---|
342 | updates.
|
---|
343 |
|
---|
344 | C<rpcsystem> must match a configuration entry in the IPDB configuration, and a given string may only be used from an IP listed under
|
---|
345 | that configuration entry.
|
---|
346 |
|
---|
347 | =head2 Search fields and metaoperators
|
---|
348 |
|
---|
349 | Not all fields are exposed for search. For most purposes these should be sufficient.
|
---|
350 |
|
---|
351 | =over 4
|
---|
352 |
|
---|
353 | =item cidr
|
---|
354 |
|
---|
355 | A full or partial CIDR network or IP address. Valid formats include:
|
---|
356 |
|
---|
357 | =over 4
|
---|
358 |
|
---|
359 | =item Complete CIDR network, eg 192.168.2.0/24
|
---|
360 |
|
---|
361 | Returns an exact match for the passed CIDR network.
|
---|
362 |
|
---|
363 | If prefixed with "CONTAINS:", the containing netblocks up to the master block
|
---|
364 | will also be returned.
|
---|
365 |
|
---|
366 | If prefixed with "WITHIN:", any suballocations in that IP range will be returned.
|
---|
367 |
|
---|
368 | =item Partial/short CIDR specification with mask length, eg 192.168.3/27
|
---|
369 |
|
---|
370 | Returns all /27 assignments within 192.168.3.0/24.
|
---|
371 |
|
---|
372 | =item Partial/short CIDR specification, eg 192.168.4
|
---|
373 |
|
---|
374 | Returns all assignments matching that leading partial string. Note that 192.168.4 will also return 192.168.40.0/24 through
|
---|
375 | 192.168.49.0/24 as well as the obvious 192.168.4.0/24.
|
---|
376 |
|
---|
377 | =item Bare IP address with no mask, eg 192.168.5.42
|
---|
378 |
|
---|
379 | Returns all assignments containing that IP.
|
---|
380 |
|
---|
381 | =back
|
---|
382 |
|
---|
383 | =item custid
|
---|
384 |
|
---|
385 | Match on a customer ID. Defaults to a partial match.
|
---|
386 |
|
---|
387 | =item type
|
---|
388 |
|
---|
389 | Match the two-character internal allocation type identifier.
|
---|
390 |
|
---|
391 | Defaults to an exact match. Replace the first character with a dot or underscore, or leave it off, to match all subtypes of a
|
---|
392 | class; eg .i will return all types of static IP assignments.
|
---|
393 |
|
---|
394 | A full list of current allocation types is available from the main RPC API's getTypeList sub.
|
---|
395 |
|
---|
396 | =item city
|
---|
397 |
|
---|
398 | Matches in the city string.
|
---|
399 |
|
---|
400 | =item description
|
---|
401 |
|
---|
402 | Matches in the description string.
|
---|
403 |
|
---|
404 | =item notes
|
---|
405 |
|
---|
406 | Matches in the notes field.
|
---|
407 |
|
---|
408 | =item available
|
---|
409 |
|
---|
410 | Only useful for static IPs. For historic and architectural reasons, unallocated static IPs are included in general search results.
|
---|
411 | Specify 'y' or 'n' to return only unallocated or allocated static IPs respectively.
|
---|
412 |
|
---|
413 | To search for a free block, use the main RPC API's listFree or findAllocateFrom subs.
|
---|
414 |
|
---|
415 | =item order
|
---|
416 |
|
---|
417 | Sort order specification. Send a string of comma-separated field names for subsorting. Valid sort fields are cidr, custid, type,
|
---|
418 | city, and description.
|
---|
419 |
|
---|
420 | =back
|
---|
421 |
|
---|