2
0
mirror of https://github.com/xcat2/confluent.git synced 2026-06-11 17:28:50 +00:00
Commit Graph

113 Commits

Author SHA1 Message Date
Jarrod Johnson 2586393a45 Implement unix socket permission controls 2026-05-07 10:07:08 -04:00
Jarrod Johnson 2650b11421 Rework consolesessieon to async create function 2026-04-17 16:15:03 -04:00
Jarrod Johnson f1f5f1b3b8 Fix issues associated with unix domain vs tls 2026-04-17 10:42:40 -04:00
Jarrod Johnson a31532d8e4 Fix transmit of notfound errors 2026-03-02 08:41:18 -05:00
Jarrod Johnson d89305ca42 Merge branch 'master' into async
Try to merge in 2025 work into async
2026-01-20 14:24:01 -05:00
Jarrod Johnson 2fcfbe9774 Fix multi-session access to shell
Shell sessions are now wired up to vtbufferd

The shellserver now correctly accounts for sessions being started.

The sockapi now correctly allows the client to specify/attach
to a specific session id.
2025-02-05 16:57:26 -05:00
Jarrod Johnson 19439463b1 Normalize non-http and http and http async and internal passthrough
Have the core provide normalization and use it across
places that need it.
2024-08-21 14:40:58 -04:00
Jarrod Johnson 1d861e60bb Refactor task management to its own module 2024-08-21 11:38:46 -04:00
Jarrod Johnson 556e40787c Have OpenBMC work with async changes 2024-08-15 11:28:08 -04:00
Jarrod Johnson 5be422958b Removed redundant definitions introduced by merge attempt 2024-08-08 10:10:16 -04:00
Jarrod Johnson c754dc2641 Merge branch 'master' into async 2024-08-08 09:45:15 -04:00
Jarrod Johnson 80296b6cbc Point to the C context object rather than python class
The OpenSSL variant of Context is a python class, but it does have
a C context in it.
2024-07-25 14:05:10 -04:00
Jarrod Johnson 2235faa76d Stop using private interface of PyCA
PyCA changes their minds about which bindings to include.

So make the binding ourselves since PyCA removed it in certain versions.

This is a backport of the implementation from the async port effort.
2024-07-24 08:33:20 -04:00
Jarrod Johnson 9394e83c81 Avoid pam blocking main thread execution
Use processpool to execute pam authentication,
avoiding a hang while waiting for child process.
2024-06-14 10:47:02 -04:00
Jarrod Johnson 85c8268ad8 Fix proxy console through collective in async 2024-05-30 16:14:39 -04:00
Jarrod Johnson cbb52739d3 Fix a number of issues with async rework
Have util retain tasks that are 'fire and forget', to avoid
garbage collection trying to delete the background tasks.

Move some utilities explicitly over to asynclient/asynctlvdata that
had previously been reworked.

Implement terminal resize in new asyncssh backend.
2024-05-30 13:59:14 -04:00
Jarrod Johnson c5405f832c Advance state of async shellserver
Can successfully run ssh sessions through
confluent with async now
2024-05-29 20:18:07 -04:00
Jarrod Johnson 4c3f93765f Have async and traditional client
Since a lot of the traditional client did not need async,
make life easier by just having them in parallel for now.

The server must use the async client, but the client applications can
stick with the somewhat more straightforward synchronous client.
2024-05-29 12:23:05 -04:00
Jarrod Johnson 207cc3471e Fix closing sockets in various contexts
With asyncio, we must close the writer half of a pair

Also rework the get_next_msg to work better.

Still need to allow stop_following to interrupt get_next_msg
2024-05-16 15:40:43 -04:00
Jarrod Johnson b967c552fd Migrate intra-collective requests to asyncio
Update dispatch to be asyncio based, remove eventlet from core

Clean up some overly verbose print statements.
2024-04-30 13:56:00 -04:00
Jarrod Johnson 553916340e Advanced asyncio port progress
Offer a function in core to normalize plugin return.

A plugin might return an async generator, a traditional generator,
or might even return an awaitable wrapping a traditional generator.

Replace eventlet spawn with util spawn in discover core

Have node attribute update await the set_node_attributes appropriately
2024-04-30 10:44:43 -04:00
Jarrod Johnson e890276bf6 Advance state of collective in asyncio
Eventlet is nominally removed from collective manager, however the join process still
needs to be reworked, and a lot more flows need to be adjusted.
2024-04-16 16:53:45 -04:00
Jarrod Johnson e8110551db Port some of the collective management to asyncio 2024-04-15 17:19:27 -04:00
Jarrod Johnson 7b2e32009f Numerous async improvements
Restore 'as available' behavior to noderange over socket

Bring the httpapi to the point where the webui is able to start working,
notably bringing the asynchttp online with the websocket.

Fix a flaw in the async ipmi that would cause hangups.
2024-04-04 17:13:37 -04:00
Jarrod Johnson 198ffb8be6 Advance asyncio port
Purge sockapi of remaining eventlet call

Extend asyncio into the credserver to finish out sockapi.

Have client and sockapi complete TLS connection including password checking

Fix confetty ability to 'create'.
2024-04-01 16:38:10 -04:00
Jarrod Johnson 1fbaee6149 Further move toward asyncio and reduce PyOpenSSL dep
Since we are rebasing to at least Python 3.6, and with
some extra ctypes wranging of the ssl context, we can likely
remove PyOpenSSL. Take first steps by removing it from 'sockapi'.

Have confluent executable become the 'top level' for eventlet, to allow
work on 'de-eventleting' on 'main.py'.

Rework tlvdata to deal with either a socket or a reader, writer tuple.
Using TLS with asyncio is easiest with the 'open_connection'
semantics, which force either a Protocol handler (callback based) or
dual streams.  While protocol approach ends with a more socket-like
'transport', the 'protocol' half is a bit unwieldy. So reader and writer
streams instead.
2024-03-29 16:23:45 -04:00
Jarrod Johnson 0a8ec96cdf Further progress toward asyncio
Basic operations can now happen with some async flows.
2024-03-04 16:18:55 -05:00
Jarrod Johnson aa5de3c6a3 Suspend handling of new socket connections while configmanager down 2023-09-15 15:48:37 -04:00
Jarrod Johnson bf10e58f00 Bump version
With recent collective changes, bump the version to block connection with
older collective members until upgraded.
2023-08-02 13:43:41 -04:00
Jarrod Johnson 90a8d80b45 Rework trusted networks to attribute
This allows  more flexibility and less oddity with how remote subnets are treated.
2022-11-21 09:57:27 -05:00
Jarrod Johnson 4864d6abb0 Add mechanism to extend authentication to remote networks
This allows user to designate certain networks to be treated as
if they were local.

This enables the initial token grant to be allowed to a remote network.

This still requires that the api be armed (which should generally be a narrow window of
opportunity) and that the
request be privileged, it
just allows remote networks to be
elevated to be as trusted as local.
2022-10-25 11:26:44 -04:00
Jarrod Johnson 86891eb2e5 Rework resolv watcher
Handle symlinks better and do not trigger overly
eagerly
2022-05-05 09:26:55 -04:00
Jarrod Johnson dcca844e9b Refresh eventlet resolver on resolv.conf change
Eventlet holds on to stale resolv.conf. As a workaround,
monitor resolv.conf and explicitly reinitialize greendns
resolver.
2021-12-06 12:22:42 -05:00
Jarrod Johnson 797465b3eb Handle some intra-collective errors better 2021-08-24 15:50:03 -04:00
Jarrod Johnson 06cfd408fc Fix handling of abrupt client close 2021-08-24 07:57:14 -04:00
Jarrod Johnson b07ca72a8b Close stray filehandles
Proxied terminals and dispsatched
requests would leak filehandles.
2021-08-17 17:18:10 -04:00
Jarrod Johnson f32a9a2f08 Rework inline command handling
Previously, if hotkey entry
had text data come in, it
would corrupt the state of
the client.

Minimize the corruption and request the server to pause.
2021-04-23 14:22:24 -04:00
Jarrod Johnson f34e184d31 Restore libc access to sockapi
Cleanup went too for in python2 port.
2021-02-26 16:25:51 -05:00
Jarrod Johnson 83d92ecfcc Make file descriptor passing python2 friendly
python 2 did not have recvmsg/sendmsg,
so have to use ctypes to access
them through the c library.
2021-02-26 16:17:43 -05:00
Jarrod Johnson 0b5c4f6f0f Progress client managed filedescriptor 2021-02-18 14:58:45 -05:00
Jarrod Johnson c525a08c17 Correct a number of mistakes in the draft commit 2021-02-17 14:34:45 -05:00
Jarrod Johnson edaaafa059 Begin work on passing filehandles for local cli
This would enable files to be uploaded/downloaded
using the client filehandles, overcoming awkward
difference in file privilege between client and
server.
2021-02-17 13:54:18 -05:00
Jarrod Johnson 4348d9160b Provide ability for config file to specify cipher list
The default set of TLS 1.3 and TLS1.2 restricted ciphers are
generally considered strong today, but for future or special
circumstances, provide ability to override the defaults.
2020-08-26 09:43:55 -04:00
Jarrod Johnson e52556affb Fix certificate watch hang
If no certificate present, then once a day confluent could hang. Fix by
doing a non-blocking
read on the watcher.
2020-08-24 14:00:47 -04:00
Jarrod Johnson 88436ff129 Merge branch 'master' into osdeploy 2020-05-22 13:56:59 -04:00
Jarrod Johnson 213d440052 Fix certificate watch
In python3, it was not working.
If another file got added, it could go
with a busy loop.
2020-05-22 13:55:24 -04:00
Jarrod Johnson f798239f90 Switch to using the standard confluent port for credserver
Also add a check and only accept API arming
requests from local ips
2020-02-27 16:36:16 -05:00
Jarrod Johnson f6d4fef5e6 Improve error message for collective
When trying to not run as root, give a
better error message explaining the
situation more clearly.
2020-02-18 16:16:40 -05:00
Jarrod Johnson 4c8ba92856 Change configuration sync to use msgpack
This removes use of pickle for config sync over network.
2020-01-27 15:53:29 -05:00
Jarrod Johnson 453c344f7f Fix audit log for non root usage with python 3 2019-10-10 16:07:45 -04:00