Changeset 7206e5a for fedd/federation/experiment_control.py

Timestamp:

Sep 23, 2010 5:44:47 PM (14 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

835cf55

Parents:

09b1e9d

Message:

checkpoint: new works pretty well

File:

• fedd/federation/experiment_control.py (modified) (14 diffs)

fedd/federation/experiment_control.py

@@ -30 +30 @@
 from synch_store import synch_store
 from experiment_partition import experiment_partition
+from authorizer import abac_authorizer
 
 import topdl
@@ -282 +283 @@
                 "ssh_privkey_file")
         dt = config.get("experiment_control", "direct_transit")
+        self.auth_type = config.get('experiment_control', 'auth_type') \
+                or 'legacy'
+        self.auth_dir = config.get('experiment_control', 'auth_dir')
         if dt: self.direct_transit = [ tb.strip() for tb in dt.split(",")]
         else: self.direct_transit = [ ]
@@ -319 +323 @@
         self.local_access = { }
 
-        if auth:
-            self.auth = auth
-        else:
-            self.log.error(\
-                    "[access]: No authorizer initialized, creating local one.")
-            auth = authorizer()
+        if self.auth_type == 'legacy':
+            if auth:
+                self.auth = auth
+            else:
+                self.log.error( "[access]: No authorizer initialized, " +\
+                        "creating local one.")
+                auth = authorizer()
+        elif self.auth_type == 'abac':
+            self.auth = abac_authorizer(load=self.auth_dir)
+        else:
+            raise service_error(service_error.internal, 
+                    "Unknown auth_type: %s" % self.auth_type)
 
 
@@ -475 +485 @@
                 eid = get_experiment_id(s)
                 if eid : 
-                    # Give the owner rights to the experiment
-                    self.auth.set_attribute(s['owner'], eid)
-                    # And holders of the eid as well
-                    self.auth.set_attribute(eid, eid)
-                    # allow overrides to control experiments as well
-                    for o in self.overrides:
-                        self.auth.set_attribute(o, eid)
-                    # Set permissions to allow reading of the software repo, if
-                    # any, as well.
-                    for a in self.get_alloc_ids(s):
-                        self.auth.set_attribute(a, 'repo/%s' % eid)
+                    if self.auth_type == 'legacy':
+                        # XXX: legacy
+                        # Give the owner rights to the experiment
+                        self.auth.set_attribute(s['owner'], eid)
+                        # And holders of the eid as well
+                        self.auth.set_attribute(eid, eid)
+                        # allow overrides to control experiments as well
+                        for o in self.overrides:
+                            self.auth.set_attribute(o, eid)
+                        # Set permissions to allow reading of the software
+                        # repo, if any, as well.
+                        for a in self.get_alloc_ids(s):
+                            self.auth.set_attribute(a, 'repo/%s' % eid)
                 else:
                     raise KeyError("No experiment id")
@@ -546 +558 @@
 
         # Initialize the authorization attributes
-        for fid in self.accessdb.keys():
-            self.auth.set_attribute(fid, 'create')
-            self.auth.set_attribute(fid, 'new')
+        # XXX: legacy
+        if self.auth_type == 'legacy':
+            for fid in self.accessdb.keys():
+                self.auth.set_attribute(fid, 'create')
+                self.auth.set_attribute(fid, 'new')
 
     def read_mapdb(self, file):
@@ -589 +603 @@
         # Set the initial permissions on data in the store.  XXX: This ad hoc
         # authorization attribute initialization is getting out of hand.
-        for k in self.synch_store.all_keys():
-            try:
-                if k.startswith('fedid:'):
-                    fid = fedid(hexstr=k[6:46])
-                    if self.state.has_key(fid):
-                        for a in self.get_alloc_ids(self.state[fid]):
-                            self.auth.set_attribute(a, k)
-            except ValueError, e:
-                self.log.warn("Cannot deduce permissions for %s" % k)
+        # XXX: legacy
+        if self.auth_type == 'legacy':
+            for k in self.synch_store.all_keys():
+                try:
+                    if k.startswith('fedid:'):
+                        fid = fedid(hexstr=k[6:46])
+                        if self.state.has_key(fid):
+                            for a in self.get_alloc_ids(self.state[fid]):
+                                self.auth.set_attribute(a, k)
+                except ValueError, e:
+                    self.log.warn("Cannot deduce permissions for %s" % k)
 
 
@@ -1300 +1316 @@
                 if status and status == 'failed':
                     # remove the old access attribute
-                    self.auth.unset_attribute(fid, old_expid)
+                    self.auth.unset_attribute(fid, old_expid)
+                    self.auth.save()
                     overwrite = True
                     del self.state[eid]
@@ -1497 +1514 @@
                 self.auth.set_attribute(tbparams[tb]['allocID']['fedid'], 
                         "/%s/%s" % ( path, dest))
+            self.auth.save()
 
         # Convert the software locations in the segments into the local
@@ -1518 +1536 @@
         to instantiate them and start it all up.
         """
+        req = req.get('NewRequestBody', None)
+        if not req:
+            raise service_error(service_error.req,
+                    "Bad request format (no NewRequestBody)")
+
+        if self.auth.import_credentials(data_list=req.get('credential', [])):
+            self.auth.save()
+        
         if not self.auth.check_attribute(fid, 'new'):
             raise service_error(service_error.access, "New access denied")
@@ -1536 +1562 @@
         gid = "dummy"
 
-        req = req.get('NewRequestBody', None)
-        if not req:
-            raise service_error(service_error.req,
-                    "Bad request format (no NewRequestBody)")
-
         # Generate an ID for the experiment (slice) and a certificate that the
         # allocator can use to prove they own it.  We'll ship it back through
-        # the encrypted connection.
-        (expid, expcert) = generate_fedid("test", dir=tmpdir, log=self.log)
+        # the encrypted connection.  If the requester supplied one, use it.
+        if 'experimentAccess' in req and 'X509' in req['experimentAccess']:
+            expcert = req['experimentAccess']['X509']
+            tf = tempfile.NamedTemporaryFile()
+            tf.write(expcert)
+            tf.flush()
+            expid = fedid(file=tf.name)
+            tf.close()
+            self.state_lock.acquire()
+            if expid in self.state:
+                self.state_lock.release()
+                raise service_error(service_error.req, 
+                        'fedid %s identifies an existing experiment' % expid)
+            self.state_lock.release()
+        else:
+            (expid, expcert) = generate_fedid("test", dir=tmpdir, log=self.log)
 
         #now we're done with the tmpdir, and it should be empty
@@ -1557 +1592 @@
 
         # Let users touch the state
-        self.auth.set_attribute(fid, expid)
-        self.auth.set_attribute(expid, expid)
-        # Override fedids can manipulate state as well
-        for o in self.overrides:
-            self.auth.set_attribute(o, expid)
+        self.auth.set_attribute(fid, expid)
+        self.auth.set_attribute(expid, expid)
+        # Override fedids can manipulate state as well
+        for o in self.overrides:
+            self.auth.set_attribute(o, expid)
+        self.auth.save()
 
         rv = {
@@ -1793 +1829 @@
                 asignee = tbparams[tb]['allocID']['fedid']
                 for f in ("hosts", gw_secretkey_base, gw_pubkey_base):
-                    self.auth.set_attribute(asignee, "%s/%s" % (configpath, f))
+                    self.auth.set_attribute(asignee, "%s/%s" % \
+                            (configpath, f))
 
             part = experiment_partition(self.auth, self.store_url, tbmap,
@@ -1809 +1846 @@
                         self.auth.set_attribute(\
                                 tbparams[tb]['allocID']['fedid'], sk)
+            self.auth.save()
 
             self.wrangle_software(expid, top, topo, tbparams)
@@ -1851 +1889 @@
         # here on out, the state will stick around a while.
 
-        # Let users touch the state
-        self.auth.set_attribute(fid, expid)
-        self.auth.set_attribute(expid, expid)
-        # Override fedids can manipulate state as well
-        for o in self.overrides:
-            self.auth.set_attribute(o, expid)
+        # Let users touch the state
+        self.auth.set_attribute(fid, expid)
+        self.auth.set_attribute(expid, expid)
+        # Override fedids can manipulate state as well
+        for o in self.overrides:
+            self.auth.set_attribute(o, expid)
+        self.auth.save()
 
         # Create a logger that logs to the experiment's state object as well as