Changeset 9d40cc9

Timestamp:

Aug 26, 2012 1:04:57 PM (12 years ago)

Author:

ABDULLA ALWABEL <abdullaalwabel@…>

Branches:

master

Children:

2f45140

Parents:

d070d9f (diff), eb117fe (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent.

Message:

Merge branch 'master' of ​git://fedd.deterlab.net/fedd

Files:

• fedd/federation/emulab_access.py (modified) (2 diffs)
• fedd/federation/emulab_segment.py (modified) (2 diffs, 1 prop)
• fedd/federation/experiment_partition.py (modified) (4 diffs)
• starbed_plugin/starbed.py (modified) (11 diffs)
• starbed_plugin/topdltok.py (modified) (3 diffs)

fedd/federation/emulab_access.py

@@ -1052 +1052 @@
             raise service_error(service_error.internal, 
                     "Can't find experiment name for %s" % aid)
+        
         stopper = self.stop_segment(keyfile=self.ssh_privkey_file,
                 debug=self.create_debug, boss=self.boss, ops=self.ops,
@@ -1058 +1059 @@
         self.log.info("TerminateSegment succeeded for %s %s %s" % \
                 (fid, proj, ename))
+        self.state_lock.acquire()
+        # Remove the started flag/info - the segment is no longer started
+        if aid in self.allocation:
+            del self.allocation[aid]['started']
+            self.write_state()
+        self.state_lock.release()
         return { 'allocID': req['allocID'], 'proof': proof.to_dict() }
 

fedd/federation/emulab_segment.py

@@ -30 +30 @@
         # Configuration directories on the remote machine
         proj_dir = "/proj/%s/exp/%s/tmp" % (pid, eid)
-        softdir = "/proj/%s/software/%s" % (pid, eid)
+        softdir_root = "/proj/%s/software/" % pid
+        softdir = "%s/%s" % (softdir_root, eid)
         # Local software dir
         lsoftdir = "%s/software" % tmpdir
@@ -46 +47 @@
 
         # Script the filesystem changes
+        
+        # Set umask to 007.  Since we are operating
+        # within /proj, we want to permit all proj users
+        # read and write.  This is especially necessary
+        # since creating directory hierarchy (mkdir -p).
+        print >>scriptfile, "umask 007"
         print >>scriptfile, "/bin/rm -rf %s" % proj_dir
         # Clear and create the software directory
         print >>scriptfile, "/bin/rm -rf %s/*" % softdir
-        print >>scriptfile, 'mkdir -p %s' % proj_dir
+        print >>scriptfile, 'mkdir %s' % proj_dir
+        print >>scriptfile, 'chmod 0770 %s' % proj_dir
         if os.path.isdir(lsoftdir):
-            print >>scriptfile, 'mkdir -p %s' % softdir
+            print >>scriptfile, 'mkdir %s' % softdir_root
+            print >>scriptfile, 'chmod 0770 %s' % softdir_root
+            print >>scriptfile, 'mkdir %s' % softdir
             print >>scriptfile, 'chmod 0770 %s' % softdir
         print >>scriptfile, "rm -f %s" % scriptbase

fedd/federation/experiment_partition.py

@@ -453 +453 @@
                         new_portal = True
                         portal_type = "experiment"
-                        myname = "%stunnel%d" % (dname.lower(),
+                        myname = "%s%stunnel%d" % (sname.lower(), dname.lower(),
                                 len(portals[st][dt]))
-                        desthost = "%stunnel%d" % (sname.lower(), 
-                                len(portals[st][dt]))
+                        desthost = "%s%stunnel%d" % (dname.lower(),
+                                sname.lower(), len(portals[st][dt]))
                     else:
                         new_i = topdl.Interface(
@@ -472 +472 @@
                     new_portal = True
                     portals[st][dt] = [ ]
-                    myname = "%stunnel%d" % (dname.lower(),
+                    myname = "%s%stunnel%d" % (sname.lower(), dname.lower(),
                             len(portals[st][dt]))
-                    desthost = "%stunnel%d" % (sname.lower(),
+                    desthost = "%s%stunnel%d" % (dname.lower(), sname.lower(),
                             len(portals[st][dt]))
 
@@ -500 +500 @@
         tsubstrate, segment_element = \
                 self.new_portal_substrate(st, dt, eid, tbparams, expid)
-        myname = "%stunnel" % dt
-        desthost = "%stunnel" % st
+        myname = "%s%stunnel" % (st, dt)
+        desthost = "%s%stunnel" % (dt, st)
 
         portal, info = self.new_portal_node(st, dt, tbparams, masters,
@@ -518 +518 @@
             substrate, tbparams, expid, tb_name):
         # Add to the master testbed
-        if testbed_suffix(dt): myname = "%stunnel" % "-".join(split_testbed(dt))
-        else: myname = "%stunnel" % dt
+        if testbed_suffix(dt): myname = "%s%stunnel" % \
+                ("-".join(split_testbed(dt)), st)
+        else: myname = "%s%stunnel" % (dt, st)
 
         desthost = "%s" % ip_addr(dip)

starbed_plugin/starbed.py

@@ -3 +3 @@
 import os,sys
 import subprocess
+import signal
 import re
 import string
@@ -11 +12 @@
 import tempfile
 from federation.util import *
-from federation.fedid import fedid, generate_fedid
-from federation.authorizer import authorizer
+from deter import fedid,generate_fedid
+from federation.authorizer import authorizer, abac_authorizer
 from federation.service_error import service_error
 from federation.remote_service import xmlrpc_handler, soap_handler, service_caller
 
-import federation.topdl as topdl
-
+from deter import topdl
 from federation.access import access_base
-from federation.legacy_access import legacy_access
 from federation.proof import proof
 from topdltok import klanguage
@@ -38 +37 @@
 
     @staticmethod 
-    def parse_access_string(s):
+    def access_tuple(str):
         """
-        Parse a parenthesized string from the access db by removing the parens.
-        If the string isn't in parens, we just return it with whitespace
-        trimmed in either case.
+        Convert a string (user,passwd,project) into an access_project.
+        It returns a tuple of the form (user,passwd,project).
         """
-        st = s.strip()
-        if st.startswith("(") and st.endswith(")"): return st[1:-1]
-        else: return st
-
+        str = str.strip()
+        if str.startswith('(') and str.endswith(')') and str.count(',') == 2:
+                user,passwd,project = str[1:-1].split(',')
+                return (user.strip(), passwd.strip(), project.strip())
+        else:
+                raise self.parse_error(
+                    'Bad mapping (unbalanced parens or malformed string is should be of the form (user,passwd,project)')
+        
     def __init__(self, config=None, auth=None):
         self.rmanager = config.get('definition','rmanager')
@@ -56 +58 @@
         self.wolagent = config.get('definition','wolagent')
         self.encd = config.get('definition','encd')
-        self.user = config.get('definition','user')
-        self.project= config.get('definition','project')
-        self.rpassword = config.get('definition','rpassword') 
-
-        access_base.__init__(self, config, auth)
+
+        access_base.__init__(self, config, auth)
+
+        #Available ports for kuma!
+        ports = config.get('globals','freeports')
+        self.domain = config.get('globals','domain')
+        try:
+                if not ports or ports.count('-') != 1:
+                        raise TypeError("bad ports") 
+                else:
+                        a,b = ports.split('-')
+                        a = int(a)
+                        b = int(b)
+                        if a < b: 
+                                start = a
+                                end = b
+                        else: 
+                                start = b
+                                end = a
+                        if abs(start-end) < 2:
+                                raise TypeError("Bad ports")
+                        self.available_ports = set(range(start,end) )
+        except TypeError as e:
+                self.available_ports = set(range(3456,3458))
+                self.log.warning("Setting default freeports due to missing or malformed configuration. %s" % (e))
+        #Get reserved ports saved in state and remove them from the available set!
+        self.state_lock.acquire()
+        ###### work ####
+        for k in self.state.keys():
+                #remove any reserved ENCD or ESQP ports from available ports so kuma wouldn't pick an occupied port!
+                if 'ENCD' in self.state[k]: 
+                        self.available_ports.discard(self.state[k]['ENCD'])
+                elif 'ESQP' in self.state[k]:
+                        self.available_ports.discard(self.state[k]['ESQP'])
+        self.state_lock.release()
+        
 
         # authorization information
         self.auth_type = config.get('access', 'auth_type') \
-                or 'legacy'
+                or 'abac'
         self.auth_dir = config.get('access', 'auth_dir')
         accessdb = config.get("access", "accessdb")
-        print "authentication type = %s" %(self.auth_type);
-        if self.auth_type == 'starbed':
-                self.log.debug("starbed authtication methond");
+        if self.auth_type == 'abac':
+            #  Load the current authorization state
+            self.auth = abac_authorizer(load=self.auth_dir)
+            self.access = [ ]
+            if accessdb:
+                try:
+                    self.read_access(accessdb, self.access_tuple)
+                except EnvironmentError, e:
+                    self.log.error("Cannot read %s: %s" % \
+                            (config.get("access", "accessdb"), e))
+                    raise e
         else:
             raise service_error(service_error.internal, 
                     "Unknown auth_type: %s" % self.auth_type)
 
+        #if self.auth_type == 'starbed':
+        #       self.log.debug("starbed authtication methond");
+        #else:
+        #    raise service_error(service_error.internal, 
+        #           "Unknown auth_type: %s" % self.auth_type)
+
+        #TO DO: clean state !
         # These dictionaries register the plug-in's local routines for handline
         # these four messages with the server code above.  There's a version
@@ -98 +146 @@
             }
         self.log.debug("Starbed AC started!")
-    # RequestAccess and ReleaseAccess come from the base class
     def RequestAccess(self, req, fid):
+        self.log.info("RequestAccess called by %s" % fid)
         # The dance to get into the request body
         if req.has_key('RequestAccessRequestBody'):
@@ -105 +153 @@
         else:
             raise service_error(service_error.req, "No request!?")
-        #self.log.debug("req = %s\n-------\n fid=%s\n" % (req,fid))
+        if self.auth.import_credentials(
+                data_list=req.get('abac_credential', [])):
+            self.auth.save()
+        else:
+            self.log.debug('failed to import incoming credentials')
+        if self.auth_type == 'abac':
+            found, owners, proof = self.lookup_access(req, fid)
+        else:
+            raise service_error(service_error.internal, 
+                    'Unknown auth_type: %s' % self.auth_type)
+        # keep track of what's been added
         allocID, alloc_cert = generate_fedid(subj="alloc", log=self.log)
         aid = unicode(allocID)
         self.state_lock.acquire()
         self.state[aid] = { }
-        self.state[aid]['user'] = 'alwabel'
-        self.state[aid]['owners'] = 'alwabel'
-        self.state[aid]['auth'] = set()
+        self.state[aid]['user'] = found[0]
+        self.state[aid]['passwd'] = found[1]
+        self.state[aid]['project'] = found[2]
+        self.state[aid]['owners'] = owners
+        self.append_allocation_authorization(aid, 
+                ((fid, allocID), (allocID, allocID)))
         self.write_state()
-        self.state_lock.release()
-        #self.log.debug("to_dict() = %s " % (proof("me","faber","attr",[]).to_dict()));
-        return { 'allocID': { 'fedid': allocID }, 'proof' : proof("me", "faber","attr",[]).to_dict() }
+        self.state_lock.release() 
+        
+        try:
+            f = open("%s/%s.pem" % (self.certdir, aid), "w")
+            print >>f, alloc_cert
+            f.close()
+        except EnvironmentError, e:
+            self.log.info("RequestAccess failed for by %s: internal error" \
+                    % fid)
+            raise service_error(service_error.internal, 
+                    "Can't open %s/%s : %s" % (self.certdir, aid, e))
+        self.log.debug('RequestAccess Returning allocation ID: %s' % allocID)
+        return { 'allocID': { 'fedid': allocID }, 'proof': proof.to_dict() }
     def ReleaseAccess(self, req, fid):
-        self.log.debug("request releasing access!");
+        self.log.info("ReleaseAccess called by %s" % fid)
+        if req.has_key('ReleaseAccessRequestBody'):
+                req = req['ReleaseAccessRequestBody']
+        else:
+                raise service_error(service_error.req, "No request!?")
+        try:
+                if req['allocID'].has_key('localname'):
+                        auth_attr = aid = req['allocID']['localname']
+                elif req['allocID'].has_key('fedid'):
+                        aid = unicode(req['allocID']['fedid'])
+                        auth_attr = req['allocID']['fedid']
+                else:
+                        raise service_error(service_error.req,
+                                "Only localnames and fedids are understood")
+        except KeyError:
+                raise service_error(service_error.req, "Badly formed request")
+        
+        self.log.debug("[access] deallocation requested for %s by %s" %  (aid, fid))
+        access_ok, proof = self.auth.check_attribute(fid, auth_attr, 
+                        with_proof=True)
+        
+        if not access_ok:
+                self.log.debug("[access] deallocation denied for %s", aid)
+                raise service_error(service_error.access, "Access Denied")
+        
+        self.state_lock.acquire()
+        if aid in self.state:
+                self.log.debug("Found allocation for %s" %aid)
+                self.clear_allocation_authorization(aid, state_attr='state')
+                del self.state[aid]
+                self.write_state()
+                self.state_lock.release()
+                # Remove the access cert
+                cf = "%s/%s.pem" % (self.certdir, aid)
+                self.log.debug("Removing %s" % cf)
+                os.remove(cf)
+                self.log.info("ReleaseAccess succeeded for %s" % fid)
+                return { 'allocID': req['allocID'], 'proof': proof.to_dict() } 
+        else:
+                self.state_lock.release()
+                raise service_error(service_error.req, "No such allocation")
+
     def StartSegment(self, req, fid):
         #self.log.debug("data = %s" %(req));
-
+        self.log.debug('StartSegment called by %s' % (fid) );
         try:
             req = req['StartSegmentRequestBody']
-            #print req;
+            self.log.debug(req)
             # Get the request topology.  If not present, a KeyError is thrown.
             topref = req['segmentdescription']['topdldescription']
@@ -139 +251 @@
                 with_proof=True)
         #self.log.debug("lllllacc = %s, proffe= %s" %( access_ok,proof.to_dict()))
-        #CAUSIO XXXX
-        if access_ok:
+        if not access_ok:
             raise service_error(service_error.access, "Access denied", 
                     proof=proof)
@@ -177 +288 @@
         #user = "alwabel"
         #project = "lace"
-
-        k = klanguage(self.rmanager,self.smanager,self.pmanager,self.fncp,self.user,self.project,self.tftpdman,self.wolagent,self.encd)
+        if len(self.available_ports) > 1:
+                self.state_lock.acquire()
+                #Pick two ports for ENCD and  ESQP
+                ENCD = random.choice([ i for i in self.available_ports])
+                ESQP = random.choice([ i for i in self.available_ports])
+                self.available_ports.discard(ENCD)
+                self.available_ports.discard(ESQP)
+                self.state[aid]['ENCD'] = ENCD
+                self.state[aid]['ESQP'] = ESQP
+                self.write_state()
+                self.state_lock.release()
+        else:
+                self.log.debug("[StartSegment] There is no enough ports for kuma!")
+                raise service_error(service_error.federant, "No available Ports for Kuma")
+        k = klanguage(self.rmanager,self.smanager,self.pmanager,self.fncp,self.state[aid]['user'],self.state[aid]['project'],self.tftpdman,self.wolagent,self.encd)
         k.k_from_topology(topo)
         level, kname = tempfile.mkstemp()
         k.to_file(kname)
-        pid = subprocess.Popen(['/usr/local/springos/bin/kuma', '-p',self.rpassword,kname])
-        #pid = subprocess.Popen([sys.executable, ['/usr/local/springos/bin/kuma', '-p',self.rpassword,kname] ])
+        #proc = subprocess.Popen(['/usr/local/springos/bin/kuma', '-p',self.state[aid]['passwd'],kname,'-P',str(ENCD),'-Q',str(ESQP)])
+        #pid = proc.pid
+        pid = 100000
+        self.log.debug(['/usr/local/springos/bin/kuma', '-p',self.state[aid]['passwd'],kname,'-P',str(ENCD),'-Q',str(ESQP)])
         #os.unlink(kname)
         # The attributes of the request.  Not used by this plug-in, but that's
@@ -198 +324 @@
         # than redo the setup.  The integer allocation was saved when we made
         # it.
+        self.state[aid]['pid'] = pid
+        self.state[aid]['descfile'] = kname
         self.state[aid]['started'] = { 
                 'allocID': req['allocID'],
@@ -204 +332 @@
                 #'proof' :  proof("me", "faber","attr",[]).to_dict(),
                 'proof': proof.to_dict(),
+                #'pid' : pid
+                'fedAttr': [
+                        { 'attribute': 'domain', 'value': self.domain } , 
+                        {'attribute': 'dragon', 'value' : '128.9.168.133'},
+                           ]
                 }
         retval = copy.deepcopy(self.state[aid]['started'])
         self.write_state()
         self.state_lock.release()
-
         return retval
 
     def TerminateSegment(self, req, fid):
         self.log.debug("Terminate Segment");
-        """
-        Remove the resources associated with th eallocation and stop the music.
-        In this example, this simply means removing the integer we allocated.
-        """
         # Gather the same access information as for Start Segment
         try:
@@ -239 +367 @@
         self.state_lock.acquire()
         if aid in self.state:
-            assigned = self.state[aid].get('integer', None)
-            self.available_ints.add(assigned)
-            if 'integer' in self.state[aid]:
-                del self.state[aid]['integer']
+            pid = self.state[aid].get('pid', None)
+            if pid:
+                try:
+                        self.log.debug("kill process %s " % (pid))
+                        os.kill(int(pid), signal.SIGTERM)
+                        #os.kill(int(pid),9)
+                        os.wait()
+                except OSError as ex:
+                        self.log.warning("Cannot kill process %s " % (pid))
+            descfile = self.state[aid].get('descfile',None)
+            if descfile:
+                #os.unlink(descfile)
+                del self.state[aid]['descfile']
+            if 'ENCD' in self.state[aid]:
+                del self.state[aid]['ENCD']
+            if 'ESQP' in self.state[aid]:
+                del self.state[aid]['ESQP']
+            del self.state[aid]['started']
             self.write_state()
         self.state_lock.release()
    
         return { 'allocID': req['allocID'], 'proof': proof.to_dict() }
+    def InfoSegment(self, req, fid):
+        self.log.info("InfoSegment called by %s" % fid)
+

starbed_plugin/topdltok.py

@@ -1 +1 @@
 #!/usr/bin/python
-import federation.topdl as topdl
+#import federation.topdl as topdl
+from deter import topdl
 
 # convert dotted quad netmask to CIDR / notation (i.e., 255.255.255.0 -> 24)
@@ -60 +61 @@
                 ospfd = "/etc/quagga/ospfd.conf"
                 for elt in topo.elements:
-                        if isinstance(elt, topdl.Computer):
+                        if isinstance(elt, topdl.Computer) and (not elt.get_attribute('portal') or elt.get_attribute('portal') == 'false'):
                                 name = str(elt.name)
                                 nodedef = nodedef + 'nodeclass %sclass {\nmethod "thru"\npartition 1\nostype "FreeBSD"\n' % name
@@ -104 +105 @@
                 for sub in topo.substrates:
                         sname = str(sub.name)
+                        sname = sname.replace('-','')
                         laninst = laninst + "netset %s class %s num 1\n" % (sname,lanclass)
                         laninst += "%s[0].ipaddrrange = \"192.168.33.0/24\"\n" % (sname)