source: fedd/federation/experiment_control_legacy.py @ de2ef5c

#!/usr/local/bin/python

import os,sys

import re
import random
import string
import subprocess
import tempfile
import copy
import pickle
import logging
import signal
import time

import traceback
# For parsing visualization output and splitter output
import xml.parsers.expat

from threading import Lock, Thread, Condition
from subprocess import call, Popen, PIPE
from string import join

from urlparse import urlparse
from urllib2 import urlopen

from util import *
from fedid import fedid, generate_fedid
from remote_service import xmlrpc_handler, soap_handler, service_caller
from service_error import service_error
from synch_store import synch_store
from experiment_partition import experiment_partition
from authorizer import abac_authorizer
from thread_pool import thread_pool, pooled_thread

import topdl
import list_log
from ip_allocator import ip_allocator
from ip_addr import ip_addr


class experiment_control_legacy:
    """
    This contains the legacy access control requests that can be included in
    the experiment control component.  This will eventually be completely
    removed.  It is also only functional in the context of an experiment
    control object.
    """

    def get_legacy_access(self, tb, tbparam, fid, masters, tbmap, expid=None,
            expcert=None):
        """
        Get access to testbed through fedd and set the parameters for that tb
        """
        def get_export_project(svcs):
            """
            Look through for the list of federated_service for this testbed
            objects for a project_export service, and extract the project
            parameter.
            """

            pe = [s for s in svcs if s.name=='project_export']
            if len(pe) == 1:
                return pe[0].params.get('project', None)
            elif len(pe) == 0:
                return None
            else:
                raise service_error(service_error.req,
                        "More than one project export is not supported")

        try:
            access_user = self.accessdb[fid]
        except KeyError:
            raise service_error(service_error.internal,
                    "Access map and authorizer out of sync in " + \
                            "create_experiment for fedid %s"  % fid)

        uri = tbmap.get(testbed_base(tb), None)
        if not uri:
            raise service_error(service_error.server_config, 
                    "Unknown testbed: %s" % tb)

        export_svcs = masters.get(tb,[])
        import_svcs = [ s for m in masters.values() \
                for s in m \
                    if tb in s.importers ]

        export_project = get_export_project(export_svcs)

        # Tweak search order so that if there are entries in access_user that 
        # have a project matching the export project, we try them first 
        if export_project: 
            access_sequence = [ (p, u) for p, u in access_user \
                    if p == export_project] 
            access_sequence.extend([(p, u) for p, u in access_user \
                    if p != export_project]) 
        else: 
            access_sequence = access_user 

        for p, u in access_sequence: 
            self.log.debug(("[get_access] Attempting access from (%s, %s) " + \
                    "to %s") %  ((p or "None"), u, uri))

            if p:
                # Request with user and project specified
                req = {\
                        'credential': [ "project: %s" % p, "user: %s"  % u],
                    }
            else:
                # Request with only user specified
                req = {\
                        'credential': [ 'user: %s' % u ],
                    }

            # Make the service request from the services we're importing and
            # exporting.  Keep track of the export request ids so we can
            # collect the resulting info from the access response.
            e_keys = { }
            if import_svcs or export_svcs:
                req['service'] = [ ]

                for i, s in enumerate(import_svcs):
                    idx = 'import%d' % i
                    sr = {'id': idx, 'name': s.name, 'visibility': 'import' }
                    if s.params:
                        sr['fedAttr'] = [ { 'attribute': k, 'value': v } \
                                for k, v in s.params.items()]
                    req['service'].append(sr)

                for i, s in enumerate(export_svcs):
                    idx = 'export%d' % i
                    e_keys[idx] = s
                    sr = {'id': idx, 'name': s.name, 'visibility': 'export' }
                    if s.params:
                        sr['fedAttr'] = [ { 'attribute': k, 'value': v } 
                                for k, v in s.params.items()]
                    req['service'].append(sr)
            try:
                if self.local_access.has_key(uri):
                    # Local access call
                    req = { 'RequestAccessRequestBody' : req }
                    r = self.local_access[uri].RequestAccess(req, 
                            fedid(file=self.cert_file))
                    r = { 'RequestAccessResponseBody' : r }
                else:
                    r = self.call_RequestAccess(uri, req, 
                            self.cert_file, self.cert_pwd, self.trusted_certs)
            except service_error, e:
                if e.code == service_error.access:
                    self.log.debug("[get_access] Access denied")
                    r = None
                    continue
                else:
                    raise e

            if r.has_key('RequestAccessResponseBody'):
                # Through to here we have a valid response, not a fault.
                # Access denied is a fault, so something better or worse than
                # access denied has happened.
                r = r['RequestAccessResponseBody']
                self.log.debug("[get_access] Access granted")
                break
            else:
                raise service_error(service_error.protocol,
                        "Bad proxy response")
        
        if not r:
            raise service_error(service_error.access, 
                    "Access denied by %s (%s)" % (tb, uri))

        tbparam[tb] = { 
                "allocID" : r['allocID'],
                "uri": uri,
                }

        # Collect the responses corresponding to the services this testbed
        # exports.  These will be the service requests that we will include in
        # the start segment requests (with appropriate visibility values) to
        # import and export the segments.
        for s in r.get('service', []):
            id = s.get('id', None)
            if id and id in e_keys:
                e_keys[id].reqs.append(s)

        # Add attributes to parameter space.  We don't allow attributes to
        # overlay any parameters already installed.
        for a in r.get('fedAttr', []):
            try:
                if a['attribute'] and \
                        isinstance(a['attribute'], basestring)\
                        and not tbparam[tb].has_key(a['attribute'].lower()):
                    tbparam[tb][a['attribute'].lower()] = a['value']
            except KeyError:
                self.log.error("Bad attribute in response: %s" % a)