1 | #!/usr/local/bin/python |
---|
2 | |
---|
3 | import os,sys |
---|
4 | import re |
---|
5 | import string |
---|
6 | import copy |
---|
7 | import pickle |
---|
8 | import logging |
---|
9 | import random |
---|
10 | import subprocess |
---|
11 | |
---|
12 | from util import * |
---|
13 | from deter import fedid, generate_fedid |
---|
14 | from authorizer import authorizer, abac_authorizer |
---|
15 | from service_error import service_error |
---|
16 | from remote_service import xmlrpc_handler, soap_handler, service_caller |
---|
17 | |
---|
18 | from deter import topdl |
---|
19 | |
---|
20 | from access import access_base |
---|
21 | |
---|
22 | # Make log messages disappear if noone configures a fedd logger. This is |
---|
23 | # something of an incantation, but basically it creates a logger object |
---|
24 | # registered to fedd.access if no other module above us has. It's an extra |
---|
25 | # belt for the suspenders. |
---|
26 | class nullHandler(logging.Handler): |
---|
27 | def emit(self, record): pass |
---|
28 | |
---|
29 | fl = logging.getLogger("fedd.access") |
---|
30 | fl.addHandler(nullHandler()) |
---|
31 | |
---|
32 | |
---|
33 | # The plug-in itself. |
---|
34 | class access(access_base): |
---|
35 | """ |
---|
36 | This is a demonstration plug-in for fedd. It responds to all the |
---|
37 | experiment_control requests and keeps internal state. The allocations it |
---|
38 | makes are simple integers associated with each valid request. It makes use |
---|
39 | of the general routines in access.access_base. |
---|
40 | |
---|
41 | Detailed comments in the code and info at |
---|
42 | """ |
---|
43 | def __init__(self, config=None, auth=None): |
---|
44 | """ |
---|
45 | Initializer. Pulls parameters out of the ConfigParser's access |
---|
46 | section, and initializes simple internal state. This version reads a |
---|
47 | maximum integer to assign from the configuration file, while most other |
---|
48 | configuration entries are read by the base class. |
---|
49 | |
---|
50 | An access database in the cannonical format is also read as well as a |
---|
51 | state database that is a hash of internal state. Routines to |
---|
52 | manipulate these are in the base class, but specializations appear |
---|
53 | here. |
---|
54 | |
---|
55 | The access database maps users to a simple string. |
---|
56 | """ |
---|
57 | |
---|
58 | # Calling the base initializer, which reads canonical configuration |
---|
59 | # information and initializes canonical members. |
---|
60 | access_base.__init__(self, config, auth) |
---|
61 | # Reading the maximum integer parameter from the configuration file |
---|
62 | |
---|
63 | self.src_addr = config.get('access', 'interface_address') |
---|
64 | self.router = config.get('access', 'gateway') |
---|
65 | self.hostname = config.get('access', 'hostname') |
---|
66 | # Storage for ephemeral ssh keys and host files |
---|
67 | self.localdir = config.get('access', 'localdir') |
---|
68 | # File containing the routing entries for external networks |
---|
69 | self.external_networks = config.get('access', 'external_networks') |
---|
70 | # Comma-separated list of interfaces to export (may be empty) |
---|
71 | self.export_interfaces = config.get('access', 'export_interfaces') |
---|
72 | if self.export_interfaces is not None: |
---|
73 | self.export_interfaces = \ |
---|
74 | [ x.strip() for x in self.export_interfaces.split(',')] |
---|
75 | else: |
---|
76 | self.export_interfaces = [] |
---|
77 | |
---|
78 | # Comma separated list of connected nets to export - these won't work |
---|
79 | # in external_networks |
---|
80 | self.export_networks = config.get('access', 'export_networks') |
---|
81 | if self.export_networks is not None: |
---|
82 | self.export_networks = \ |
---|
83 | [ x.strip() for x in self.export_networks.split(',')] |
---|
84 | else: |
---|
85 | self.export_networks = [] |
---|
86 | |
---|
87 | # values for locations of zebra and ospfd. |
---|
88 | self.zebra = config.get('access', 'zebra') |
---|
89 | if self.zebra is None: |
---|
90 | self.zebra = '/usr/local/sbin/zebra' |
---|
91 | self.ospfd = config.get('access', 'ospfd') |
---|
92 | if self.ospfd is None: |
---|
93 | self.ospfd = '/usr/local/sbin/ospfd' |
---|
94 | |
---|
95 | # If this is a linux box that will be NATing, the iptables value |
---|
96 | # must be the path of the iptables command and the nat_interface must |
---|
97 | # be the nat interface. |
---|
98 | self.iptables = config.get('access', 'iptables') |
---|
99 | self.nat_interface = config.get('access', 'nat_interface') |
---|
100 | |
---|
101 | self.ssh_identity = None |
---|
102 | |
---|
103 | # hostname is the name of the ssh endpoint for the other side. That |
---|
104 | # side needs it to set up routing tables. If hostname is not |
---|
105 | # available, but an IP address is, use that. |
---|
106 | if self.hostname is None: |
---|
107 | if self.src_addr is None: |
---|
108 | raise service_error(service_error.server_config, |
---|
109 | 'Hostname or interface_address must be set in config') |
---|
110 | self.hostname = self.src_addr |
---|
111 | |
---|
112 | self.ssh_port = config.get('access', 'ssh_port', '22') |
---|
113 | |
---|
114 | # authorization information |
---|
115 | self.auth_type = config.get('access', 'auth_type') \ |
---|
116 | or 'abac' |
---|
117 | self.auth_dir = config.get('access', 'auth_dir') |
---|
118 | accessdb = config.get("access", "accessdb") |
---|
119 | # initialize the authorization system. We make a call to |
---|
120 | # read the access database that maps from authorization information |
---|
121 | # into local information. The local information is parsed by the |
---|
122 | # translator above. |
---|
123 | if self.auth_type == 'abac': |
---|
124 | # Load the current authorization state |
---|
125 | self.auth = abac_authorizer(load=self.auth_dir) |
---|
126 | self.access = [ ] |
---|
127 | if accessdb: |
---|
128 | try: |
---|
129 | self.read_access(accessdb) |
---|
130 | except EnvironmentError, e: |
---|
131 | self.log.error("Cannot read %s: %s" % \ |
---|
132 | (config.get("access", "accessdb"), e)) |
---|
133 | raise e |
---|
134 | else: |
---|
135 | raise service_error(service_error.internal, |
---|
136 | "Unknown auth_type: %s" % self.auth_type) |
---|
137 | |
---|
138 | # The superclass has read the state, but if this is the first run ever, |
---|
139 | # we must initialise the running flag. This plugin only supports one |
---|
140 | # connection, so StartSegment will fail when self.state['running'] is |
---|
141 | # true. |
---|
142 | self.state_lock.acquire() |
---|
143 | if 'running' not in self.state: |
---|
144 | self.state['running'] = False |
---|
145 | self.state_lock.release() |
---|
146 | |
---|
147 | # These dictionaries register the plug-in's local routines for handline |
---|
148 | # these four messages with the server code above. There's a version |
---|
149 | # for SOAP and XMLRPC, depending on which interfaces the plugin |
---|
150 | # supports. There's rarely a technical reason not to support one or |
---|
151 | # the other - the plugin code almost never deals with the transport - |
---|
152 | # but if a plug-in writer wanted to disable XMLRPC, they could leave |
---|
153 | # the self.xmlrpc_services dictionary empty. |
---|
154 | self.soap_services = {\ |
---|
155 | 'RequestAccess': soap_handler("RequestAccess", self.RequestAccess), |
---|
156 | 'ReleaseAccess': soap_handler("ReleaseAccess", self.ReleaseAccess), |
---|
157 | 'StartSegment': soap_handler("StartSegment", self.StartSegment), |
---|
158 | 'TerminateSegment': soap_handler("TerminateSegment", |
---|
159 | self.TerminateSegment), |
---|
160 | } |
---|
161 | self.xmlrpc_services = {\ |
---|
162 | 'RequestAccess': xmlrpc_handler('RequestAccess', |
---|
163 | self.RequestAccess), |
---|
164 | 'ReleaseAccess': xmlrpc_handler('ReleaseAccess', |
---|
165 | self.ReleaseAccess), |
---|
166 | 'StartSegment': xmlrpc_handler("StartSegment", self.StartSegment), |
---|
167 | 'TerminateSegment': xmlrpc_handler('TerminateSegment', |
---|
168 | self.TerminateSegment), |
---|
169 | } |
---|
170 | self.call_SetValue = service_caller('SetValue', log=self.log) |
---|
171 | self.call_GetValue = service_caller('GetValue', log=self.log) |
---|
172 | |
---|
173 | # ReleaseAccess come from the base class, this is a slightly modified |
---|
174 | # RequestAccess from the base that includes a fedAttr to force this side to |
---|
175 | # be active. |
---|
176 | def RequestAccess(self, req, fid): |
---|
177 | """ |
---|
178 | Handle an access request. Success here maps the requester into the |
---|
179 | local access control space and establishes state about that user keyed |
---|
180 | to a fedid. We also save a copy of the certificate underlying that |
---|
181 | fedid so this allocation can access configuration information and |
---|
182 | shared parameters on the experiment controller. |
---|
183 | """ |
---|
184 | |
---|
185 | self.log.info("RequestAccess called by %s" % fid) |
---|
186 | # The dance to get into the request body |
---|
187 | if req.has_key('RequestAccessRequestBody'): |
---|
188 | req = req['RequestAccessRequestBody'] |
---|
189 | else: |
---|
190 | raise service_error(service_error.req, "No request!?") |
---|
191 | |
---|
192 | # Base class lookup routine. If this fails, it throws a service |
---|
193 | # exception denying access that triggers a fault response back to the |
---|
194 | # caller. |
---|
195 | found, owners, proof = self.lookup_access(req, fid) |
---|
196 | self.log.info( |
---|
197 | "[RequestAccess] Access granted local creds %s" % found) |
---|
198 | # Make a fedid for this allocation |
---|
199 | allocID, alloc_cert = generate_fedid(subj="alloc", log=self.log) |
---|
200 | aid = unicode(allocID) |
---|
201 | |
---|
202 | # Store the data about this allocation: |
---|
203 | self.state_lock.acquire() |
---|
204 | self.state[aid] = { } |
---|
205 | self.state[aid]['user'] = found |
---|
206 | self.state[aid]['owners'] = owners |
---|
207 | self.state[aid]['auth'] = set() |
---|
208 | # Authorize the creating fedid and the principal representing the |
---|
209 | # allocation to manipulate it. |
---|
210 | self.append_allocation_authorization(aid, |
---|
211 | ((fid, allocID), (allocID, allocID))) |
---|
212 | self.write_state() |
---|
213 | self.state_lock.release() |
---|
214 | |
---|
215 | # Create a directory to stash the certificate in, ans stash it. |
---|
216 | try: |
---|
217 | f = open("%s/%s.pem" % (self.certdir, aid), "w") |
---|
218 | print >>f, alloc_cert |
---|
219 | f.close() |
---|
220 | except EnvironmentError, e: |
---|
221 | raise service_error(service_error.internal, |
---|
222 | "Can't open %s/%s : %s" % (self.certdir, aid, e)) |
---|
223 | self.log.debug('[RequestAccess] Returning allocation ID: %s' % allocID) |
---|
224 | msg = { |
---|
225 | 'allocID': { 'fedid': allocID }, |
---|
226 | 'fedAttr': [{ 'attribute': 'nat_portals', 'value': 'True' }], |
---|
227 | 'proof': proof.to_dict() |
---|
228 | } |
---|
229 | return msg |
---|
230 | |
---|
231 | def validate_topology(self, top): |
---|
232 | ''' |
---|
233 | Validate the topology. Desktops can only be single connections. |
---|
234 | Though the topology will include a portal and a node, the access |
---|
235 | controller will implement both on one node. |
---|
236 | |
---|
237 | As more capabilities are added to the contoller the constraints here |
---|
238 | will relax. |
---|
239 | ''' |
---|
240 | |
---|
241 | comps = [] |
---|
242 | for e in top.elements: |
---|
243 | if isinstance(e, topdl.Computer): comps.append(e) |
---|
244 | if len(comps) > 2: |
---|
245 | raise service_error(service_error.req, |
---|
246 | "Desktop only supports 1-node subexperiments") |
---|
247 | |
---|
248 | portals = 0 |
---|
249 | for c in comps: |
---|
250 | if c.get_attribute('portal') is not None: |
---|
251 | portals += 1 |
---|
252 | continue |
---|
253 | if len(c.interface) > 1: |
---|
254 | raise service_error(service_error.req, |
---|
255 | "Desktop Node has more than one interface") |
---|
256 | i = c.interface[0] |
---|
257 | if len(i.subs) > 1: |
---|
258 | raise service_error(service_error.req, |
---|
259 | "Desktop Node has more than one substate on interface") |
---|
260 | sub = i.subs[0] |
---|
261 | for i in sub.interfaces: |
---|
262 | if i.element not in comps: |
---|
263 | raise service_error(service_error.req, |
---|
264 | "Desktop Node connected to non-portal") |
---|
265 | |
---|
266 | if portals > 1: |
---|
267 | raise service_error(service_error.req, |
---|
268 | "Desktop segment has more than one portal") |
---|
269 | return True |
---|
270 | |
---|
271 | def validate_connInfo(self, connInfo): |
---|
272 | if len(connInfo) != 1: |
---|
273 | raise service_error(service_error.req, |
---|
274 | "Desktop segment requests multiple connections") |
---|
275 | if connInfo[0]['type'] != 'ssh': |
---|
276 | raise service_error(service_error.req, |
---|
277 | "Desktop segment requires ssh connecton") |
---|
278 | return True |
---|
279 | |
---|
280 | def export_store_info(self, certfile, connInfo): |
---|
281 | ''' |
---|
282 | Tell the other portal node where to reach this desktop. The other side |
---|
283 | uses this information to set up routing, though the ssh_port is unused |
---|
284 | as the Desktop always initiates ssh connections. |
---|
285 | ''' |
---|
286 | values = { 'peer': self.hostname, 'ssh_port': self.ssh_port } |
---|
287 | for c in connInfo: |
---|
288 | for p in c.get('parameter', []): |
---|
289 | if p.get('type','') == 'input': continue |
---|
290 | pname = p.get('name', '') |
---|
291 | key = p.get('key', '') |
---|
292 | surl = p.get('store', '') |
---|
293 | if pname not in values: |
---|
294 | self.log('Unknown export parameter: %s' % pname) |
---|
295 | continue |
---|
296 | val = values[pname] |
---|
297 | req = { 'name': key, 'value': val } |
---|
298 | self.log.debug('Setting %s (%s) to %s on %s' % \ |
---|
299 | (pname, key, val, surl)) |
---|
300 | self.call_SetValue(surl, req, certfile) |
---|
301 | |
---|
302 | def set_route(self, dest, script, gw=None, src=None): |
---|
303 | if sys.platform.startswith('freebsd'): |
---|
304 | if src is not None and gw is not None: |
---|
305 | raise service_error(service_error.internal, |
---|
306 | 'FreeBSD will not route based on src address') |
---|
307 | elif src is not None: |
---|
308 | raise service_error(service_error.internal, |
---|
309 | 'FreeBSD will not route based on src address') |
---|
310 | elif gw is not None: |
---|
311 | print >>script, 'route add %s %s' % (dest, gw) |
---|
312 | elif sys.platform.startswith('linux'): |
---|
313 | if src is not None and gw is not None: |
---|
314 | print >>script, 'ip route add %s via %s src %s' % \ |
---|
315 | (dest, gw, src) |
---|
316 | elif src is not None: |
---|
317 | print >>script, 'ip route add %s src %s' % \ |
---|
318 | (dest, src) |
---|
319 | elif gw is not None: |
---|
320 | print >>script, 'ip route add %s via %s' % (dest, gw) |
---|
321 | else: |
---|
322 | raise service_error(service_error.internal, |
---|
323 | 'Unknown platform %s' % sys.platform) |
---|
324 | |
---|
325 | def unset_route(self, dest, script): |
---|
326 | rv = 0 |
---|
327 | if sys.platform.startswith('freebsd'): |
---|
328 | print >>script, 'route delete %s' % dest |
---|
329 | elif sys.platform.startswith('linux'): |
---|
330 | print >>script, 'ip route delete %s' % dest |
---|
331 | |
---|
332 | def find_a_peer(self, addr): |
---|
333 | ''' |
---|
334 | Find another node in the experiment that's on our subnet. This is a |
---|
335 | hack to handle the problem that we really cannot require the desktop to |
---|
336 | dynamically route. Will be improved by distributing static routes. |
---|
337 | ''' |
---|
338 | |
---|
339 | peer = None |
---|
340 | hosts = os.path.join(self.localdir, 'hosts') |
---|
341 | p = addr.rfind('.') |
---|
342 | if p == -1: |
---|
343 | raise service_error(service_error.req, 'bad address in topology') |
---|
344 | prefix = addr[0:p] |
---|
345 | addr_re = re.compile('(%s.\\d+)' % prefix) |
---|
346 | try: |
---|
347 | f = open(hosts, 'r') |
---|
348 | for line in f: |
---|
349 | m = addr_re.search(line) |
---|
350 | if m is not None and m.group(1) != addr: |
---|
351 | peer = m.group(1) |
---|
352 | break |
---|
353 | else: |
---|
354 | raise service_error(service_error.req, |
---|
355 | 'No other nodes in this subnet??') |
---|
356 | except EnvironmentError, e: |
---|
357 | raise service_error(service_error.internal, |
---|
358 | 'Cannot open %s: %s' % (e.filename, e.strerror)) |
---|
359 | return peer |
---|
360 | |
---|
361 | |
---|
362 | |
---|
363 | |
---|
364 | def configure_desktop(self, top, connInfo): |
---|
365 | ''' |
---|
366 | Build the connection. Establish routing to the peer if using a |
---|
367 | separate interface, wait until the other end confirms setup, establish |
---|
368 | the ssh layer-two tunnel (tap), assign the in-experiment IP address to |
---|
369 | the tunnel and establish routing to the experiment through the tap. |
---|
370 | ''' |
---|
371 | |
---|
372 | |
---|
373 | # get the peer and ssh port from the portal and our IP from the other |
---|
374 | peer = None |
---|
375 | port = None |
---|
376 | my_addr = None |
---|
377 | my_name = None |
---|
378 | for e in top.elements: |
---|
379 | if not isinstance(e, topdl.Computer): continue |
---|
380 | if e.get_attribute('portal') is None: |
---|
381 | my_name = e.name |
---|
382 | # there should be one interface with one IPv4 address |
---|
383 | if len(e.interface) <1 : |
---|
384 | raise service_error(service_error.internal, |
---|
385 | 'No interface on experiment node!?!?') |
---|
386 | my_addr = e.interface[0].get_attribute('ip4_address') |
---|
387 | else: |
---|
388 | for ci in connInfo: |
---|
389 | if ci.get('portal', '') != e.name: continue |
---|
390 | peer = ci.get('peer') |
---|
391 | port = '22' |
---|
392 | for a in ci.get('fedAttr', []): |
---|
393 | if a['attribute'] == 'ssh_port': port = a['value'] |
---|
394 | |
---|
395 | # XXX scan hosts for IP addresses and compose better routing entry |
---|
396 | |
---|
397 | if not all([peer, port, my_addr]): |
---|
398 | raise service_error(service_error.req, |
---|
399 | 'Cannot find all config parameters %s %s %s' % (peer, port, my_addr)) |
---|
400 | |
---|
401 | exp_peer = self.find_a_peer(my_addr) |
---|
402 | |
---|
403 | cscript = os.path.join(self.localdir, 'connect') |
---|
404 | dscript = os.path.join(self.localdir, 'disconnect') |
---|
405 | local_hosts = os.path.join(self.localdir, 'hosts') |
---|
406 | zebra_conf = os.path.join(self.localdir, 'zebra.conf') |
---|
407 | ospfd_conf = os.path.join(self.localdir, 'ospfd.conf') |
---|
408 | try: |
---|
409 | f = open(cscript, 'w') |
---|
410 | print >>f, '#!/bin/sh' |
---|
411 | # This picks the outgoing interface to the experiment using the |
---|
412 | # routing system. |
---|
413 | self.set_route(peer, f, self.router, self.src_addr) |
---|
414 | # Wait until the other end reports that it is configured py placing |
---|
415 | # a file this end can access into its local file system. Try once |
---|
416 | # a minute. |
---|
417 | print >>f,'while ! /usr/bin/scp -P %s -o "StrictHostKeyChecking no" -i %s %s:/usr/local/federation/etc/prep_done /dev/null; do' % (port, self.ssh_identity, peer) |
---|
418 | print >>f, 'sleep 60; done' |
---|
419 | print >>f, ('ssh -w 0:0 -p %s -o "Tunnel ethernet" ' + \ |
---|
420 | '-o "StrictHostKeyChecking no" -i %s %s perl -I/usr/local/federation/lib /usr/local/federation/bin/setup_bridge.pl --tapno=0 --addr=%s &') % \ |
---|
421 | (port, self.ssh_identity, peer, my_addr) |
---|
422 | # This should give the tap a a chance to come up |
---|
423 | print >>f,'sleep 10' |
---|
424 | # Add experiment nodes to hosts |
---|
425 | print >>f, 'cp /etc/hosts /etc/hosts.DETER.fedd.hold' |
---|
426 | print >>f, 'echo "#--- BEGIN FEDD ADDITIONS ---" >> /etc/hosts' |
---|
427 | print >>f, 'cat %s >> /etc/hosts' % local_hosts |
---|
428 | print >>f, 'echo "#--- END FEDD ADDITIONS ---" >> /etc/hosts' |
---|
429 | # Assign tap address and route experiment connections through it. |
---|
430 | print >>f, 'ifconfig tap0 %s netmask 255.255.255.0 up' % \ |
---|
431 | my_addr |
---|
432 | print >>f, '%s -d -f %s' % (self.zebra, zebra_conf) |
---|
433 | print >>f, '%s -d -f %s' % (self.ospfd, ospfd_conf) |
---|
434 | if self.iptables is not None and self.nat_interface is not None: |
---|
435 | print >>f, '%s -t nat -A POSTROUTING -o %s -j MASQUERADE' %\ |
---|
436 | (self.iptables, self.nat_interface) |
---|
437 | print >>f, ('%s -A FORWARD -i %s -o tap0 -m state ' + |
---|
438 | '--state RELATED,ESTABLISHED -j ACCEPT') % \ |
---|
439 | (self.iptables, self.nat_interface) |
---|
440 | print >>f, '%s -A FORWARD -i tap0 -o %s -j ACCEPT' % \ |
---|
441 | (self.iptables, self.nat_interface) |
---|
442 | f.close() |
---|
443 | os.chmod(cscript, 0755) |
---|
444 | f = open(dscript, 'w') |
---|
445 | print >>f, '#!/bin/sh' |
---|
446 | if self.iptables is not None and self.nat_interface is not None: |
---|
447 | print >>f, '%s -t nat -D POSTROUTING -o %s -j MASQUERADE' %\ |
---|
448 | (self.iptables, self.nat_interface) |
---|
449 | print >>f, ('%s -D FORWARD -i %s -o tap0 -m state ' + |
---|
450 | '--state RELATED,ESTABLISHED -j ACCEPT') % \ |
---|
451 | (self.iptables, self.nat_interface) |
---|
452 | print >>f, '%s -D FORWARD -i tap0 -o %s -j ACCEPT' % \ |
---|
453 | (self.iptables, self.nat_interface) |
---|
454 | # Linux ? |
---|
455 | print >>f, 'ifconfig tap0 destroy' |
---|
456 | self.unset_route(peer, f) |
---|
457 | print >>f, 'mv /etc/hosts.DETER.fedd.hold /etc/hosts' |
---|
458 | print >>f, 'kill `cat /var/run/quagga/ospfd.pid`' |
---|
459 | print >>f, 'kill `cat /var/run/quagga/zebra.pid`' |
---|
460 | if self.iptables is not None and self.nat_interface is not None: |
---|
461 | print >>f, '%s -t nat -D POSTROUTING -o %s -j MASQUERADE' %\ |
---|
462 | (self.iptables, self.nat_interface) |
---|
463 | print >>f, ('%s -D FORWARD -i %s -o tap0 -m state ' + |
---|
464 | '--state RELATED,ESTABLISHED -j ACCEPT') % \ |
---|
465 | (self.iptables, self.nat_interface) |
---|
466 | print >>f, '%s -D FORWARD -i tap0 -o %s -j ACCEPT' % \ |
---|
467 | (self.iptables, self.nat_interface) |
---|
468 | f.close() |
---|
469 | os.chmod(dscript, 0755) |
---|
470 | f = open(zebra_conf, 'w') |
---|
471 | print >>f, 'hostname %s' % my_name |
---|
472 | print >>f, 'interface tap0' |
---|
473 | for i in self.export_interfaces: |
---|
474 | print >>f, 'interface %s' % i |
---|
475 | if self.external_networks is not None: |
---|
476 | try: |
---|
477 | extern = open(self.external_networks, 'r') |
---|
478 | if extern is not None: |
---|
479 | for l in extern: |
---|
480 | print >>f, "%s" % l.strip() |
---|
481 | extern.close() |
---|
482 | except EnvironmentError: |
---|
483 | # No external_networks or problem reading it, ignore |
---|
484 | pass |
---|
485 | f.close() |
---|
486 | os.chmod(zebra_conf, 0644) |
---|
487 | f = open(ospfd_conf, 'w') |
---|
488 | print >>f, 'hostname %s' % my_name |
---|
489 | print >>f, 'router ospf' |
---|
490 | print >>f, ' redistribute static' |
---|
491 | print >>f, ' network %s/24 area 0.0.0.2' % my_addr |
---|
492 | for i in self.export_networks: |
---|
493 | print >>f, ' network %s area 0.0.0.2' % i |
---|
494 | except EnvironmentError, e: |
---|
495 | raise service_error(service_error.internal, |
---|
496 | 'Cannot create connect %s: %s' % (e.filename, e.strerror)) |
---|
497 | script_log = open('/tmp/connect.log', 'w') |
---|
498 | subprocess.Popen(['sudo', '/bin/sh', cscript], stdout=script_log, |
---|
499 | stderr=script_log) |
---|
500 | return True |
---|
501 | |
---|
502 | def StartSegment(self, req, fid): |
---|
503 | """ |
---|
504 | Start a segment. In this simple skeleton, this means to parse the |
---|
505 | request and assign an unassigned integer to it. We store the integer |
---|
506 | in the persistent state. |
---|
507 | """ |
---|
508 | try: |
---|
509 | req = req['StartSegmentRequestBody'] |
---|
510 | # Get the request topology. If not present, a KeyError is thrown. |
---|
511 | topref = req['segmentdescription']['topdldescription'] |
---|
512 | # The fedid of the allocation we're attaching resources to |
---|
513 | auth_attr = req['allocID']['fedid'] |
---|
514 | except KeyError: |
---|
515 | raise service_error(service_error.req, "Badly formed request") |
---|
516 | |
---|
517 | # String version of the allocation ID for keying |
---|
518 | aid = "%s" % auth_attr |
---|
519 | # Authorization check |
---|
520 | access_ok, proof = self.auth.check_attribute(fid, auth_attr, |
---|
521 | with_proof=True) |
---|
522 | if not access_ok: |
---|
523 | raise service_error(service_error.access, "Access denied", |
---|
524 | proof=proof) |
---|
525 | else: |
---|
526 | # See if this is a replay of an earlier succeeded StartSegment - |
---|
527 | # sometimes SSL kills 'em. If so, replay the response rather than |
---|
528 | # redoing the allocation. |
---|
529 | self.state_lock.acquire() |
---|
530 | # Test and set :-) |
---|
531 | running = self.state['running'] |
---|
532 | self.state['running'] = True |
---|
533 | retval = self.state[aid].get('started', None) |
---|
534 | self.state_lock.release() |
---|
535 | if retval: |
---|
536 | self.log.warning( |
---|
537 | "[StartSegment] Duplicate StartSegment for %s: " \ |
---|
538 | % aid + \ |
---|
539 | "replaying response") |
---|
540 | return retval |
---|
541 | if running: |
---|
542 | self.log.debug('[StartSegment] already running') |
---|
543 | raise service_error(service_error.federant, |
---|
544 | 'Desktop is already in an experiment') |
---|
545 | |
---|
546 | certfile = "%s/%s.pem" % (self.certdir, aid) |
---|
547 | |
---|
548 | # Convert the topology into topdl data structures. Again, the |
---|
549 | # skeletion doesn't do anything with it, but this is how one parses a |
---|
550 | # topology request. |
---|
551 | if topref: topo = topdl.Topology(**topref) |
---|
552 | else: |
---|
553 | raise service_error(service_error.req, |
---|
554 | "Request missing segmentdescription'") |
---|
555 | |
---|
556 | err = None |
---|
557 | try: |
---|
558 | self.validate_topology(topo) |
---|
559 | |
---|
560 | # The attributes of the request. The ones we care about are the ssh |
---|
561 | # keys to operate the tunnel. |
---|
562 | attrs = req.get('fedAttr', []) |
---|
563 | for a in attrs: |
---|
564 | # Save the hosts and ssh_privkeys to our local dir |
---|
565 | if a['attribute'] in ('hosts', 'ssh_secretkey'): |
---|
566 | self.log.debug('Getting %s from %s' % \ |
---|
567 | (a['attribute'], a['value'])) |
---|
568 | get_url(a['value'], certfile, self.localdir, log=self.log) |
---|
569 | base = os.path.basename(a['value']) |
---|
570 | if a['attribute'] == 'ssh_secretkey': |
---|
571 | self.ssh_identity = os.path.join(self.localdir, base) |
---|
572 | os.chmod(os.path.join(self.localdir, base), 0600) |
---|
573 | else: |
---|
574 | self.log.debug('Ignoring attribute %s' % a['attribute']) |
---|
575 | |
---|
576 | # Gather connection information and exchange parameters. |
---|
577 | connInfo = req.get('connection', []) |
---|
578 | self.validate_connInfo(connInfo) |
---|
579 | self.export_store_info(certfile, connInfo) |
---|
580 | self.import_store_info(certfile, connInfo) |
---|
581 | |
---|
582 | #build it |
---|
583 | self.configure_desktop(topo, connInfo) |
---|
584 | except service_error, e: |
---|
585 | err = e |
---|
586 | |
---|
587 | # Save the information |
---|
588 | if err is None: |
---|
589 | # It's possible that the StartSegment call gets retried (!). if |
---|
590 | # the 'started' key is in the allocation, we'll return it rather |
---|
591 | # than redo the setup. The integer allocation was saved when we |
---|
592 | # made it. |
---|
593 | self.state_lock.acquire() |
---|
594 | self.state[aid]['started'] = { |
---|
595 | 'allocID': req['allocID'], |
---|
596 | 'allocationLog': "Allocatation complete", |
---|
597 | 'segmentdescription': { 'topdldescription': topo.to_dict() }, |
---|
598 | 'proof': proof.to_dict(), |
---|
599 | } |
---|
600 | retval = copy.deepcopy(self.state[aid]['started']) |
---|
601 | self.write_state() |
---|
602 | self.state_lock.release() |
---|
603 | else: |
---|
604 | # Something bad happened - clear the "running" flag so we can try |
---|
605 | # again |
---|
606 | self.state_lock.acquire() |
---|
607 | self.state['running'] = False |
---|
608 | self.state_lock.release() |
---|
609 | raise err |
---|
610 | |
---|
611 | return retval |
---|
612 | |
---|
613 | def TerminateSegment(self, req, fid): |
---|
614 | """ |
---|
615 | Remove the resources associated with th eallocation and stop the music. |
---|
616 | In this example, this simply means removing the integer we allocated. |
---|
617 | """ |
---|
618 | # Gather the same access information as for Start Segment |
---|
619 | try: |
---|
620 | req = req['TerminateSegmentRequestBody'] |
---|
621 | except KeyError: |
---|
622 | raise service_error(service_error.req, "Badly formed request") |
---|
623 | |
---|
624 | auth_attr = req['allocID']['fedid'] |
---|
625 | aid = "%s" % auth_attr |
---|
626 | |
---|
627 | self.log.debug("Terminate request for %s" %aid) |
---|
628 | # Check authorization |
---|
629 | access_ok, proof = self.auth.check_attribute(fid, auth_attr, |
---|
630 | with_proof=True) |
---|
631 | if not access_ok: |
---|
632 | raise service_error(service_error.access, "Access denied", |
---|
633 | proof=proof) |
---|
634 | cscript = os.path.join(self.localdir, 'connect') |
---|
635 | dscript = os.path.join(self.localdir, 'disconnect') |
---|
636 | # Do the work of disconnecting |
---|
637 | if os.path.exists(dscript): |
---|
638 | self.log.debug('calling %s' % dscript) |
---|
639 | rv = subprocess.call(['sudo', '/bin/sh', dscript]) |
---|
640 | if rv != 0: |
---|
641 | self.log.warning('%s had an error: %d' % (dscript, rv)) |
---|
642 | else: |
---|
643 | self.log.warn('No disconnection script!?') |
---|
644 | |
---|
645 | try: |
---|
646 | for bfn in os.listdir(self.localdir): |
---|
647 | fn = os.path.join(self.localdir, bfn) |
---|
648 | self.log.debug('Removing %s' % fn) |
---|
649 | if os.path.exists(fn): |
---|
650 | os.remove(fn) |
---|
651 | except EnvironmentError, e: |
---|
652 | self.log.warn('Failed to remove %s: %s' % (e.filename, e.strerror)) |
---|
653 | |
---|
654 | self.ssh_identity = None |
---|
655 | |
---|
656 | self.state_lock.acquire() |
---|
657 | self.state['running'] = False |
---|
658 | self.state_lock.release() |
---|
659 | |
---|
660 | return { 'allocID': req['allocID'], 'proof': proof.to_dict() } |
---|