Merge lp:~ivoks/charm-helpers/ssh_ip into lp:charm-helpers

[Ante Karamatić]

Pass an IP to ssh_ip instead of listen_to

Current 'listen_to' setting in hardening is not very useful in cloud environments. Each unit has its own IP and therefore it's impossible to configure the application with a single config file. This patch extends functionality and figures out an IP on every unit and passes it as ssh_ip variable in the template.

Supports interface names, IPs and CIDRs.

This depends on https://code.launchpad.net/~ivoks/charm-helpers/no_ip_valueerror/+merge/306445

[Liam Young (gnuoy)]

Could you add a doc string to get_listening please

review: Needs Fixing

[lp:~ivoks/charm-helpers/ssh_ip]

633. By Ante Karamatić on 2016-09-22

Add doc string

634. By Ante Karamatić on 2016-09-22

Fix typo

[Liam Young (gnuoy)]

LGTM, thanks

=== modified file 'charmhelpers/contrib/hardening/ssh/checks/config.py'
--- charmhelpers/contrib/hardening/ssh/checks/config.py	2016-07-06 14:41:05 +0000
+++ charmhelpers/contrib/hardening/ssh/checks/config.py	2016-09-22 13:26:59 +0000
@@ -14,6 +14,11 @@
 
 import os
 
+from charmhelpers.contrib.network.ip import (
+    get_address_in_network,
+    get_iface_addr,
+    is_ip,
+)
 from charmhelpers.core.hookenv import (
     log,
     DEBUG,
@@ -121,6 +126,36 @@
 
         return cipher[weak_ciphers]
 
+    def get_listening(self, listen=['0.0.0.0']):
+        """Returns a list of addresses SSH can list on
+
+        Turns input into a sensible list of IPs SSH can listen on. Input
+        must be a python list of interface names, IPs and/or CIDRs.
+        
+        :param listen: list of IPs, CIDRs, interface names
+
+        :returns: list of IPs available on the host
+        """
+        if listen == ['0.0.0.0']:
+            return listen
+
+        value = []
+        for network in listen:
+            try:
+                ip = get_address_in_network(network=network, fatal=True)
+            except ValueError:
+                if is_ip(network):
+                    ip = network
+                else:
+                    try:
+                        ip = get_iface_addr(iface=network, fatal=False)[0]
+                    except IndexError:
+                        continue
+            value.append(ip)
+        if value == []:
+            return ['0.0.0.0']
+        return value
+
     def __call__(self):
         settings = utils.get_settings('ssh')
         if settings['common']['network_ipv6_enable']:
@@ -180,7 +215,7 @@
             addr_family = 'inet'
 
         ctxt = {
-            'ssh_ip': settings['server']['listen_to'],
+            'ssh_ip': self.get_listening(settings['server']['listen_to']),
             'password_auth_allowed':
             settings['server']['password_authentication'],
             'ports': settings['common']['ports'],