GitLab

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>

dhcp - process_pending(5000)
rs - process_pending(10)
ns - process_pending(10)
Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>

This will create a logfile with proper permitions and the RotatingFileHandler
will not produce any error when bytes exceed maxBytes.
Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>

Cannot set individual values for arguments using python-setproctitle.
See https://code.google.com/p/py-setproctitle/issues/detail?id=23&can=1.

Use python-setproctitle to change the process title
of the running daemon. Make it appear as a native executable
to simplify administration.

We need to update CAP_NET_RAW, CAP_NET_ADMIN separetly.
Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>

nfdhcpd opens a socket during init. socket.send() blocks in case
SO_SNDBUF is full. This might happen when packages are pushed to
buffer but never consumed (e.g. VM is shuting down).

To fix this we use non-blocking send with MSG_DONTWAIT and catch
the error when the resource is not available.

In order to empty the socket buffer we close the socket and re-open it.
To this end we need CAP_NET_RAW capability otherwise operation
(socket.socket()) is not permitted.

Add various logging messages (during client creation, opening a
socket, etc.)
Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>

It catches locking exceptions.
Signed-off-by: Dimitris Aragriorgs <dimara@grnet.gr>

Signed-off-by: Dimitris Aragriorgs <dimara@grnet.gr>

Signed-off-by: Stratos Psomadakis <psomas@grnet.gr>

Signed-off-by: Dimitris Aragriorgs <dimara@grnet.gr>

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>

pkt.lladdr
ns.lladdr
sendp
Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>

If get_physindev is supported in nfqueue then the clients are indexed
by their tap ifindex. If not then clients are indexed by their macs.
Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>

Get all info from binding file. Do not parse routing tables. Keep
track of clients depending on their mac. Support clients connected
on bridges. Insteed of patching NFQUEUE add new slot in bindings
that shows the physical device the incomming request originates (tap).
Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>

    On some occasions the clients do not send an fqdn as hostname,
    so another way to send a domain is needed.

    For that, a new optional config directive is introduced, called
    "domain", as a way to hardcode the domain we serve.

    If this directive is not defined, the traditional
    'find domain through hostname' technique is used.

Handle pidfile creation properly, as part of daemonization process.
Parse config file and setup logging before daemonization.
Redirect stderr to logfile upon daemonization, otherwise numerous
unexpected exceptions get lost.

Use the traceback module to log unhandled exceptions to the logfile when
running as a daemon.
Signed-off-by: Apollon Oikonomopoulos <apollon@noc.grnet.gr>

Ignore interfaces with no IPv6 subnets on the respective routing tables and log
a debug message.
Signed-off-by: Apollon Oikonomopoulos <apollon@noc.grnet.gr>

We ignore requests on interfaces we don't have any information about.
Furthermore, we set a verdict of ACCEPT on these packets and let the kernel
handle them.
Signed-off-by: Apollon Oikonomopoulos <apollon@noc.grnet.gr>

If we have a client on the "main" routing table, then we must ignore all IPv6
link-local subnet declarations that appear in this routing table, possibly
"masking out" the intended network route.
Signed-off-by: Apollon Oikonomopoulos <apollon@noc.grnet.gr>

In case something went wrong during parse_binding_file, return None instead
of an obsolete tuple.
Signed-off-by: Apollon Oikonomopoulos <apollon@noc.grnet.gr>

Wrap the main loop in a try..finally statement, calling our cleanup handler to
free all obtained resources.
Signed-off-by: Apollon Oikonomopoulos <apollon@noc.grnet.gr>

Implement our own sendp() method, which has the following benefits:

 * Keep a single socket and re-use it for all outgoing packets
 * Speed up send operations by 2x
 * Get rid of CAP_NET_RAW as we setup the socket during initialization
Signed-off-by: Apollon Oikonomopoulos <apollon@noc.grnet.gr>

This is needed for nfqueue to work properly. Without this, the kernel
never acknowledges the verdicts we set, the queue fills up and the
kernel drops packets. Worst of all, this happens completely silently.
Signed-off-by: Apollon Oikonomopoulos <apollon@noc.grnet.gr>

It was meant to be re.group and not re.group*s* all along.
Signed-off-by: Apollon Oikonomopoulos <apollon@noc.grnet.gr>

The name form for these methods is mandated by pyinotify itself,
so there's nothing we can do about it.
Signed-off-by: Apollon Oikonomopoulos <apollon@noc.grnet.gr>

Refactor code to meet pylint's recommendations

* Pass format string arguments as such in logging functions
* Move parse_binding_file and parse_routing_table to top-level functions
* Clean-up imports
* Update docstrings
Signed-off-by: Apollon Oikonomopoulos <apollon@noc.grnet.gr>