fun requestDbUser dbtype =
let
- val (_, bio) = requestBio (fn () => ())
+ val (_, context) = requestContext (fn () => ())
+ val bio = OpenSSL.connect true (context,
+ Config.Dbms.dbmsNode ^ ":" ^ Int.toString Config.slavePort)
in
Msg.send (bio, MsgCreateDbUser dbtype);
case Msg.recv bio of
fun requestDbPasswd rc =
let
- val (_, bio) = requestBio (fn () => ())
+ val (_, context) = requestContext (fn () => ())
+ val bio = OpenSSL.connect true (context,
+ Config.Dbms.dbmsNode ^ ":" ^ Int.toString Config.slavePort)
in
Msg.send (bio, MsgDbPasswd rc);
case Msg.recv bio of
fun requestDbTable p =
let
- val (user, bio) = requestBio (fn () => ())
+ val (user, context) = requestContext (fn () => ())
+ val bio = OpenSSL.connect true (context,
+ Config.Dbms.dbmsNode ^ ":" ^ Int.toString Config.slavePort)
in
Msg.send (bio, MsgCreateDb p);
case Msg.recv bio of
fun requestDbDrop p =
let
- val (user, bio) = requestBio (fn () => ())
+ val (user, context) = requestContext (fn () => ())
+ val bio = OpenSSL.connect true (context,
+ Config.Dbms.dbmsNode ^ ":" ^ Int.toString Config.slavePort)
in
Msg.send (bio, MsgDropDb p);
case Msg.recv bio of
fun requestDbGrant p =
let
- val (user, bio) = requestBio (fn () => ())
+ val (user, context) = requestContext (fn () => ())
+ val bio = OpenSSL.connect true (context,
+ Config.Dbms.dbmsNode ^ ":" ^ Int.toString Config.slavePort)
in
Msg.send (bio, MsgGrantDb p);
case Msg.recv bio of
fun requestMysqlFixperms () =
let
- val (_, bio) = requestBio (fn () => ())
+ val (_, context) = requestContext (fn () => ())
+ val bio = OpenSSL.connect true (context,
+ Config.Dbms.dbmsNode ^ ":" ^ Int.toString Config.slavePort)
in
Msg.send (bio, MsgMysqlFixperms);
case Msg.recv bio of
fun requestApt {node, pkg} =
let
val (user, context) = requestContext (fn () => ())
- val bio = OpenSSL.connect true (context, if node = Config.masterNode then
+ val bio = OpenSSL.connect true (context, if node = Config.dispatcherName then
dispatcher
else
Domain.nodeIp node ^ ":" ^ Int.toString Config.slavePort)
fun requestCron {node, uname} =
let
val (user, context) = requestContext (fn () => ())
- val bio = OpenSSL.connect true (context, if node = Config.masterNode then
+ val bio = OpenSSL.connect true (context, if node = Config.dispatcherName then
dispatcher
else
Domain.nodeIp node ^ ":" ^ Int.toString Config.slavePort)
fun requestFtp {node, uname} =
let
val (user, context) = requestContext (fn () => ())
- val bio = OpenSSL.connect true (context, if node = Config.masterNode then
+ val bio = OpenSSL.connect true (context, if node = Config.dispatcherName then
dispatcher
else
Domain.nodeIp node ^ ":" ^ Int.toString Config.slavePort)
fun requestTrustedPath {node, uname} =
let
val (user, context) = requestContext (fn () => ())
- val bio = OpenSSL.connect true (context, if node = Config.masterNode then
+ val bio = OpenSSL.connect true (context, if node = Config.dispatcherName then
dispatcher
else
Domain.nodeIp node ^ ":" ^ Int.toString Config.slavePort)
fun requestSocketPerm {node, uname} =
let
val (user, context) = requestContext (fn () => ())
- val bio = OpenSSL.connect true (context, if node = Config.masterNode then
+ val bio = OpenSSL.connect true (context, if node = Config.dispatcherName then
dispatcher
else
Domain.nodeIp node ^ ":" ^ Int.toString Config.slavePort)
fun requestFirewall {node, uname} =
let
val (user, context) = requestContext (fn () => ())
- val bio = OpenSSL.connect true (context, if node = Config.masterNode then
+ val bio = OpenSSL.connect true (context, if node = Config.dispatcherName then
dispatcher
else
Domain.nodeIp node ^ ":" ^ Int.toString Config.slavePort)
OpenSSL.close bio
end
+fun requestFirewallRegen node =
+ let
+ val (user, context) = requestContext (fn () => ())
+ val bio = OpenSSL.connect true (context, Domain.nodeIp node ^ ":" ^ Int.toString Config.slavePort)
+ (* Only supporting on slave nodes *)
+
+ val _ = Msg.send (bio, MsgFirewallRegen)
+
+ fun handleResult () =
+ case Msg.recv bio of
+ NONE => (print "Server closed connection unexpectedly.\n";
+ OS.Process.failure)
+ | SOME m =>
+ case m of
+ MsgOk => (print "Firewall regenerated.\n";
+ OS.Process.success)
+ | MsgError s => (print ("Firewall regeneration failed: " ^ s ^ "\n");
+ OS.Process.failure)
+ | _ => (print "Unexpected server reply.\n";
+ OS.Process.failure)
+ in
+ handleResult()
+ before OpenSSL.close bio
+ end
+
structure SS = StringSet
fun domainList dname =
| QSocket user => "Asked about socket permissions for user " ^ user
| QFirewall user => "Asked about firewall rules for user " ^ user
+fun doIt' loop bio f cleanup =
+ ((case f () of
+ (msgLocal, SOME msgRemote) =>
+ (print msgLocal;
+ print "\n";
+ Msg.send (bio, MsgError msgRemote))
+ | (msgLocal, NONE) =>
+ (print msgLocal;
+ print "\n";
+ Msg.send (bio, MsgOk)))
+ handle e as (OpenSSL.OpenSSL s) =>
+ (print ("OpenSSL error: " ^ s ^ "\n");
+ app (fn x => print (x ^ "\n")) (SMLofNJ.exnHistory e);
+ Msg.send (bio, MsgError ("OpenSSL error: " ^ s))
+ handle OpenSSL.OpenSSL _ => ())
+ | OS.SysErr (s, _) =>
+ (print "System error: ";
+ print s;
+ print "\n";
+ Msg.send (bio, MsgError ("System error: " ^ s))
+ handle OpenSSL.OpenSSL _ => ())
+ | Fail s =>
+ (print "Failure: ";
+ print s;
+ print "\n";
+ Msg.send (bio, MsgError ("Failure: " ^ s))
+ handle OpenSSL.OpenSSL _ => ())
+ | ErrorMsg.Error =>
+ (print "Compilation error\n";
+ Msg.send (bio, MsgError "Error during configuration evaluation")
+ handle OpenSSL.OpenSSL _ => ());
+ (cleanup ();
+ ignore (OpenSSL.readChar bio);
+ OpenSSL.close bio)
+ handle OpenSSL.OpenSSL _ => ();
+ loop ())
+
fun service () =
let
val host = Slave.hostname ()
val user = OpenSSL.peerCN bio
val () = print ("\nConnection from " ^ user ^ " at " ^ now () ^ "\n")
val () = Domain.setUser user
-
- fun doIt f cleanup =
- ((case f () of
- (msgLocal, SOME msgRemote) =>
- (print msgLocal;
- print "\n";
- Msg.send (bio, MsgError msgRemote))
- | (msgLocal, NONE) =>
- (print msgLocal;
- print "\n";
- Msg.send (bio, MsgOk)))
- handle e as (OpenSSL.OpenSSL s) =>
- (print ("OpenSSL error: " ^ s ^ "\n");
- app (fn x => print (x ^ "\n")) (SMLofNJ.exnHistory e);
- Msg.send (bio, MsgError ("OpenSSL error: " ^ s))
- handle OpenSSL.OpenSSL _ => ())
- | OS.SysErr (s, _) =>
- (print "System error: ";
- print s;
- print "\n";
- Msg.send (bio, MsgError ("System error: " ^ s))
- handle OpenSSL.OpenSSL _ => ())
- | Fail s =>
- (print "Failure: ";
- print s;
- print "\n";
- Msg.send (bio, MsgError ("Failure: " ^ s))
- handle OpenSSL.OpenSSL _ => ())
- | ErrorMsg.Error =>
- (print "Compilation error\n";
- Msg.send (bio, MsgError "Error during configuration evaluation")
- handle OpenSSL.OpenSSL _ => ());
- (cleanup ();
- ignore (OpenSSL.readChar bio);
- OpenSSL.close bio)
- handle OpenSSL.OpenSSL _ => ();
- loop ())
+ val doIt = doIt' loop bio
fun doConfig codes =
let
SOME "Not authorized to remove users"))
(fn () => ())
- | MsgCreateDbUser {dbtype, passwd} =>
- doIt (fn () =>
- case Dbms.lookup dbtype of
- NONE => ("Database user creation request with unknown datatype type " ^ dbtype,
- SOME ("Unknown database type " ^ dbtype))
- | SOME handler =>
- case #adduser handler {user = user, passwd = passwd} of
- NONE => ("Added " ^ dbtype ^ " user " ^ user ^ ".",
- NONE)
- | SOME msg =>
- ("Error adding a " ^ dbtype ^ " user " ^ user ^ ": " ^ msg,
- SOME ("Error adding user: " ^ msg)))
- (fn () => ())
-
- | MsgDbPasswd {dbtype, passwd} =>
- doIt (fn () =>
- case Dbms.lookup dbtype of
- NONE => ("Database passwd request with unknown datatype type " ^ dbtype,
- SOME ("Unknown database type " ^ dbtype))
- | SOME handler =>
- case #passwd handler {user = user, passwd = passwd} of
- NONE => ("Changed " ^ dbtype ^ " password of user " ^ user ^ ".",
- NONE)
- | SOME msg =>
- ("Error setting " ^ dbtype ^ " password of user " ^ user ^ ": " ^ msg,
- SOME ("Error adding user: " ^ msg)))
- (fn () => ())
-
- | MsgCreateDb {dbtype, dbname, encoding} =>
- doIt (fn () =>
- if Dbms.validDbname dbname then
- case Dbms.lookup dbtype of
- NONE => ("Database creation request with unknown datatype type " ^ dbtype,
- SOME ("Unknown database type " ^ dbtype))
- | SOME handler =>
- if not (Dbms.validEncoding encoding) then
- ("Invalid encoding " ^ valOf encoding ^ " requested for database creation.",
- SOME "Invalid encoding")
- else
- case #createdb handler {user = user, dbname = dbname, encoding = encoding} of
- NONE => ("Created database " ^ user ^ "_" ^ dbname ^ ".",
- NONE)
- | SOME msg => ("Error creating database " ^ user ^ "_" ^ dbname ^ ": " ^ msg,
- SOME ("Error creating database: " ^ msg))
- else
- ("Invalid database name " ^ user ^ "_" ^ dbname,
- SOME ("Invalid database name " ^ dbname)))
- (fn () => ())
-
- | MsgDropDb {dbtype, dbname} =>
- doIt (fn () =>
- if Dbms.validDbname dbname then
- case Dbms.lookup dbtype of
- NONE => ("Database drop request with unknown datatype type " ^ dbtype,
- SOME ("Unknown database type " ^ dbtype))
- | SOME handler =>
- case #dropdb handler {user = user, dbname = dbname} of
- NONE => ("Drop database " ^ user ^ "_" ^ dbname ^ ".",
- NONE)
- | SOME msg => ("Error dropping database " ^ user ^ "_" ^ dbname ^ ": " ^ msg,
- SOME ("Error dropping database: " ^ msg))
- else
- ("Invalid database name " ^ user ^ "_" ^ dbname,
- SOME ("Invalid database name " ^ dbname)))
- (fn () => ())
-
- | MsgGrantDb {dbtype, dbname} =>
- doIt (fn () =>
- if Dbms.validDbname dbname then
- case Dbms.lookup dbtype of
- NONE => ("Database drop request with unknown datatype type " ^ dbtype,
- SOME ("Unknown database type " ^ dbtype))
- | SOME handler =>
- case #grant handler {user = user, dbname = dbname} of
- NONE => ("Grant permissions to database " ^ user ^ "_" ^ dbname ^ ".",
- NONE)
- | SOME msg => ("Error granting permissions to database " ^ user ^ "_" ^ dbname ^ ": " ^ msg,
- SOME ("Error granting permissions to database: " ^ msg))
- else
- ("Invalid database name " ^ user ^ "_" ^ dbname,
- SOME ("Invalid database name " ^ dbname)))
- (fn () => ())
-
| MsgListMailboxes domain =>
doIt (fn () =>
if not (Domain.yourDomain domain) then
(describeQuery q,
NONE)))
(fn () => ())
-
- | MsgMysqlFixperms =>
- (print "Starting mysql-fixperms\n";
- doIt (fn () => if OS.Process.isSuccess
- (OS.Process.system "/usr/bin/sudo -H /afs/hcoop.net/common/etc/scripts/mysql-grant-table-drop") then
- ("Requested mysql-fixperms",
- NONE)
- else
- ("Requested mysql-fixperms, but execution failed!",
- SOME "Script execution failed."))
- (fn () => ()))
-
| MsgDescribe dom =>
doIt (fn () => if not (Domain.validDomain dom) then
("Requested description of invalid domain " ^ dom,
(fn () => ())
| MsgReUsers =>
- doIt (fn () => (usersChanged ();
- ("Users change callbacks run", NONE)))
+ doIt (fn () => if Acl.query {user = user, class = "priv", value = "regen"}
+ orelse Acl.query {user = user, class = "priv", value = "all"} then
+ (usersChanged ();
+ ("Users change callbacks run", NONE))
+ else
+ ("Unauthorized user asked to reusers!",
+ SOME "You aren't authorized to regenerate files."))
(fn () => ())
| _ =>
val _ = print ("Slave server starting at " ^ now () ^ "\n")
fun loop () =
- case OpenSSL.accept sock of
- NONE => ()
- | SOME bio =>
- let
- val peer = OpenSSL.peerCN bio
- val () = print ("\nConnection from " ^ peer ^ " at " ^ now () ^ "\n")
- in
- if peer = Config.dispatcherName then let
- fun loop' files =
- case Msg.recv bio of
- NONE => print "Dispatcher closed connection unexpectedly\n"
- | SOME m =>
- case m of
- MsgFile file => loop' (file :: files)
- | MsgDoFiles => (Slave.handleChanges files;
- Msg.send (bio, MsgOk))
- | MsgRegenerate => (Domain.resetLocal ();
- Msg.send (bio, MsgOk))
- | _ => (print "Dispatcher sent unexpected command\n";
- Msg.send (bio, MsgError "Unexpected command"))
- in
- loop' [];
- ignore (OpenSSL.readChar bio);
- OpenSSL.close bio;
- loop ()
- end
- else if peer = "domtool" then
- case Msg.recv bio of
- SOME MsgShutdown => (OpenSSL.close bio;
- print ("Shutting down at " ^ now () ^ "\n\n"))
- | _ => (OpenSSL.close bio;
- loop ())
- else
- case Msg.recv bio of
- SOME (MsgQuery q) => (print (describeQuery q ^ "\n");
- Msg.send (bio, answerQuery q);
- ignore (OpenSSL.readChar bio);
- OpenSSL.close bio;
- loop ())
- | _ => (OpenSSL.close bio;
- loop ())
- end handle OpenSSL.OpenSSL s =>
- (print ("OpenSSL error: " ^ s ^ "\n");
- OpenSSL.close bio
+ (Acl.read Config.aclFile;
+ case OpenSSL.accept sock of
+ NONE => ()
+ | SOME bio =>
+ let
+ val peer = OpenSSL.peerCN bio
+ val () = print ("\nConnection from " ^ peer ^ " at " ^ now () ^ "\n")
+ in
+ if peer = Config.dispatcherName then let
+ fun loop' files =
+ case Msg.recv bio of
+ NONE => print "Dispatcher closed connection unexpectedly\n"
+ | SOME m =>
+ case m of
+ MsgFile file => loop' (file :: files)
+ | MsgDoFiles => (Slave.handleChanges files;
+ Msg.send (bio, MsgOk))
+ | MsgRegenerate => (Domain.resetLocal ();
+ Msg.send (bio, MsgOk))
+ | MsgVmailChanged => (if Vmail.doChanged () then
+ Msg.send (bio, MsgOk)
+ else
+ Msg.send (bio, MsgError "userdb update failed"))
+ | _ => (print "Dispatcher sent unexpected command\n";
+ Msg.send (bio, MsgError "Unexpected command"))
+ in
+ loop' [];
+ ignore (OpenSSL.readChar bio);
+ OpenSSL.close bio;
+ loop ()
+ end
+ else if peer = "domtool" then
+ case Msg.recv bio of
+ SOME MsgShutdown => (OpenSSL.close bio;
+ print ("Shutting down at " ^ now () ^ "\n\n"))
+ | _ => (OpenSSL.close bio;
+ loop ())
+ else
+ let
+ val doIt = doIt' loop bio
+ val user = peer
+ in
+ case Msg.recv bio of
+ NONE => (OpenSSL.close bio
handle OpenSSL.OpenSSL _ => ();
- loop ())
- | e as OS.SysErr (s, _) =>
- (app (fn s => print (s ^ "\n")) (SMLofNJ.exnHistory e);
- print ("System error: "^ s ^ "\n");
- OpenSSL.close bio
- handle OpenSSL.OpenSSL _ => ();
- loop ())
- | IO.Io {function, name, ...} =>
- (print ("IO error: " ^ function ^ ": " ^ name ^ "\n");
- OpenSSL.close bio
- handle OpenSSL.OpenSSL _ => ();
- loop ())
- | e =>
- (app (fn s => print (s ^ "\n")) (SMLofNJ.exnHistory e);
- print "Uncaught exception!\n";
- OpenSSL.close bio
- handle OpenSSL.OpenSSL _ => ();
- loop ())
+ loop ())
+ | SOME m =>
+ case m of
+ (MsgQuery q) => (print (describeQuery q ^ "\n");
+ Msg.send (bio, answerQuery q);
+ ignore (OpenSSL.readChar bio);
+ OpenSSL.close bio;
+ loop ())
+ | MsgCreateDbUser {dbtype, passwd} =>
+ doIt (fn () =>
+ case Dbms.lookup dbtype of
+ NONE => ("Database user creation request with unknown datatype type " ^ dbtype,
+ SOME ("Unknown database type " ^ dbtype))
+ | SOME handler =>
+ case #adduser handler {user = user, passwd = passwd} of
+ NONE => ("Added " ^ dbtype ^ " user " ^ user ^ ".",
+ NONE)
+ | SOME msg =>
+ ("Error adding a " ^ dbtype ^ " user " ^ user ^ ": " ^ msg,
+ SOME ("Error adding user: " ^ msg)))
+ (fn () => ())
+
+ | MsgDbPasswd {dbtype, passwd} =>
+ doIt (fn () =>
+ case Dbms.lookup dbtype of
+ NONE => ("Database passwd request with unknown datatype type " ^ dbtype,
+ SOME ("Unknown database type " ^ dbtype))
+ | SOME handler =>
+ case #passwd handler {user = user, passwd = passwd} of
+ NONE => ("Changed " ^ dbtype ^ " password of user " ^ user ^ ".",
+ NONE)
+ | SOME msg =>
+ ("Error setting " ^ dbtype ^ " password of user " ^ user ^ ": " ^ msg,
+ SOME ("Error adding user: " ^ msg)))
+ (fn () => ())
+
+ | MsgCreateDb {dbtype, dbname, encoding} =>
+ doIt (fn () =>
+ if Dbms.validDbname dbname then
+ case Dbms.lookup dbtype of
+ NONE => ("Database creation request with unknown datatype type " ^ dbtype,
+ SOME ("Unknown database type " ^ dbtype))
+ | SOME handler =>
+ if not (Dbms.validEncoding encoding) then
+ ("Invalid encoding " ^ valOf encoding ^ " requested for database creation.",
+ SOME "Invalid encoding")
+ else
+ case #createdb handler {user = user, dbname = dbname, encoding = encoding} of
+ NONE => ("Created database " ^ user ^ "_" ^ dbname ^ ".",
+ NONE)
+ | SOME msg => ("Error creating database " ^ user ^ "_" ^ dbname ^ ": " ^ msg,
+ SOME ("Error creating database: " ^ msg))
+ else
+ ("Invalid database name " ^ user ^ "_" ^ dbname,
+ SOME ("Invalid database name " ^ dbname)))
+ (fn () => ())
+
+ | MsgDropDb {dbtype, dbname} =>
+ doIt (fn () =>
+ if Dbms.validDbname dbname then
+ case Dbms.lookup dbtype of
+ NONE => ("Database drop request with unknown datatype type " ^ dbtype,
+ SOME ("Unknown database type " ^ dbtype))
+ | SOME handler =>
+ case #dropdb handler {user = user, dbname = dbname} of
+ NONE => ("Drop database " ^ user ^ "_" ^ dbname ^ ".",
+ NONE)
+ | SOME msg => ("Error dropping database " ^ user ^ "_" ^ dbname ^ ": " ^ msg,
+ SOME ("Error dropping database: " ^ msg))
+ else
+ ("Invalid database name " ^ user ^ "_" ^ dbname,
+ SOME ("Invalid database name " ^ dbname)))
+ (fn () => ())
+
+ | MsgGrantDb {dbtype, dbname} =>
+ doIt (fn () =>
+ if Dbms.validDbname dbname then
+ case Dbms.lookup dbtype of
+ NONE => ("Database drop request with unknown datatype type " ^ dbtype,
+ SOME ("Unknown database type " ^ dbtype))
+ | SOME handler =>
+ case #grant handler {user = user, dbname = dbname} of
+ NONE => ("Grant permissions to database " ^ user ^ "_" ^ dbname ^ ".",
+ NONE)
+ | SOME msg => ("Error granting permissions to database " ^ user ^ "_" ^ dbname ^ ": " ^ msg,
+ SOME ("Error granting permissions to database: " ^ msg))
+ else
+ ("Invalid database name " ^ user ^ "_" ^ dbname,
+ SOME ("Invalid database name " ^ dbname)))
+ (fn () => ())
+ | MsgMysqlFixperms =>
+ (print "Starting mysql-fixperms\n";
+ doIt (fn () => if OS.Process.isSuccess
+ (OS.Process.system "/usr/bin/sudo -H /afs/hcoop.net/common/etc/scripts/mysql-grant-table-drop") then
+ ("Requested mysql-fixperms",
+ NONE)
+ else
+ ("Requested mysql-fixperms, but execution failed!",
+ SOME "Script execution failed."))
+ (fn () => ()))
+ | MsgFirewallRegen =>
+ doIt (fn () => if Acl.query {user = user, class = "priv", value = "all"} then
+ if List.exists (fn x => x = host) Config.Firewall.firewallNodes then
+ if (Firewall.generateFirewallConfig (Firewall.parseRules ()) andalso Firewall.publishConfig ())
+ then
+ ("Firewall rules regenerated.", NONE)
+ else
+ ("Rules regeneration failed!", SOME "Script execution failed.")
+ else ("Node not controlled by domtool firewall.", SOME (host))
+ else
+ ("Not authorized to regenerate firewall.", SOME ("Unauthorized user " ^ user ^ " attempted to regenerated firewall")))
+ (fn () => ())
+
+ | _ => (OpenSSL.close bio;
+ loop ())
+ end
+ end handle OpenSSL.OpenSSL s =>
+ (print ("OpenSSL error: " ^ s ^ "\n");
+ OpenSSL.close bio
+ handle OpenSSL.OpenSSL _ => ();
+ loop ())
+ | e as OS.SysErr (s, _) =>
+ (app (fn s => print (s ^ "\n")) (SMLofNJ.exnHistory e);
+ print ("System error: "^ s ^ "\n");
+ OpenSSL.close bio
+ handle OpenSSL.OpenSSL _ => ();
+ loop ())
+ | IO.Io {function, name, ...} =>
+ (print ("IO error: " ^ function ^ ": " ^ name ^ "\n");
+ OpenSSL.close bio
+ handle OpenSSL.OpenSSL _ => ();
+ loop ())
+ | e =>
+ (app (fn s => print (s ^ "\n")) (SMLofNJ.exnHistory e);
+ print "Uncaught exception!\n";
+ OpenSSL.close bio
+ handle OpenSSL.OpenSSL _ => ();
+ loop ()))
+ handle OpenSSL.OpenSSL s =>
+ (print ("OpenSSL error: " ^ s ^ "\n");
+ loop ())
+ | e =>
+ (app (fn s => print (s ^ "\n")) (SMLofNJ.exnHistory e);
+ print "Uncaught exception!\n";
+ loop ())
in
loop ();
OpenSSL.shutdown sock