Merged from trunk

10 files changed, 404 insertions, 57 deletions

diff --git a/nova/api/auth.py b/nova/api/auth.py
new file mode 100644
index 000000000..cd3e3e8a0
--- /dev/null
+++ b/nova/api/auth.py
@@ -0,0 +1,75 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright (c) 2011 OpenStack, LLC
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+"""
+Common Auth Middleware.
+
+"""
+
+import webob.dec
+import webob.exc
+
+from nova import context
+from nova import flags
+from nova import wsgi
+
+
+FLAGS = flags.FLAGS
+flags.DEFINE_boolean('use_forwarded_for', False,
+                     'Treat X-Forwarded-For as the canonical remote address. '
+                     'Only enable this if you have a sanitizing proxy.')
+
+
+class InjectContext(wsgi.Middleware):
+    """Add a 'nova.context' to WSGI environ."""
+
+    def __init__(self, context, *args, **kwargs):
+        self.context = context
+        super(InjectContext, self).__init__(*args, **kwargs)
+
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
+    def __call__(self, req):
+        req.environ['nova.context'] = self.context
+        return self.application
+
+
+class KeystoneContext(wsgi.Middleware):
+    """Make a request context from keystone headers"""
+
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
+    def __call__(self, req):
+        try:
+            user_id = req.headers['X_USER']
+        except KeyError:
+            return webob.exc.HTTPUnauthorized()
+        # get the roles
+        roles = [r.strip() for r in req.headers.get('X_ROLE', '').split(',')]
+        project_id = req.headers['X_TENANT']
+        # Get the auth token
+        auth_token = req.headers.get('X_AUTH_TOKEN',
+                                     req.headers.get('X_STORAGE_TOKEN'))
+
+        # Build a context, including the auth_token...
+        remote_address = req.remote_addr
+        if FLAGS.use_forwarded_for:
+            remote_address = req.headers.get('X-Forwarded-For', remote_address)
+        ctx = context.RequestContext(user_id,
+                                     project_id,
+                                     roles=roles,
+                                     auth_token=auth_token,
+                                     remote_address=remote_address)
+
+        req.environ['nova.context'] = ctx
+        return self.application
diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index 96df97393..17969099d 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -20,6 +20,7 @@ Starting point for routing EC2 requests.
 
 """
 
+import httplib2
 import webob
 import webob.dec
 import webob.exc
@@ -37,15 +38,16 @@ from nova.auth import manager
 
 FLAGS = flags.FLAGS
 LOG = logging.getLogger("nova.api")
-flags.DEFINE_boolean('use_forwarded_for', False,
-                     'Treat X-Forwarded-For as the canonical remote address. '
-                     'Only enable this if you have a sanitizing proxy.')
 flags.DEFINE_integer('lockout_attempts', 5,
                      'Number of failed auths before lockout.')
 flags.DEFINE_integer('lockout_minutes', 15,
                      'Number of minutes to lockout if triggered.')
 flags.DEFINE_integer('lockout_window', 15,
                      'Number of minutes for lockout window.')
+flags.DEFINE_string('keystone_ec2_url',
+                    'http://localhost:5000/v2.0/ec2tokens',
+                    'URL to get token from ec2 request.')
+flags.DECLARE('use_forwarded_for', 'nova.api.auth')
 
 
 class RequestLogging(wsgi.Middleware):
@@ -138,6 +140,49 @@ class Lockout(wsgi.Middleware):
         return res
 
 
+class ToToken(wsgi.Middleware):
+    """Authenticate an EC2 request with keystone and convert to token."""
+
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
+    def __call__(self, req):
+        # Read request signature and access id.
+        try:
+            signature = req.params['Signature']
+            access = req.params['AWSAccessKeyId']
+        except KeyError:
+            raise webob.exc.HTTPBadRequest()
+
+        # Make a copy of args for authentication and signature verification.
+        auth_params = dict(req.params)
+        # Not part of authentication args
+        auth_params.pop('Signature')
+
+        # Authenticate the request.
+        client = httplib2.Http()
+        creds = {'ec2Credentials': {'access': access,
+                                    'signature': signature,
+                                    'host': req.host,
+                                    'verb': req.method,
+                                    'path': req.path,
+                                    'params': auth_params,
+                                   }}
+        headers = {'Content-Type': 'application/json'},
+        resp, content = client.request(FLAGS.keystone_ec2_url,
+                                       'POST',
+                                       headers=headers,
+                                       body=utils.dumps(creds))
+        # NOTE(vish): We could save a call to keystone by
+        #             having keystone return token, tenant,
+        #             user, and roles from this call.
+        result = utils.loads(content)
+        # TODO(vish): check for errors
+        token_id = result['auth']['token']['id']
+
+        # Authenticated!
+        req.headers['X-Auth-Token'] = token_id
+        return self.application
+
+
 class Authenticate(wsgi.Middleware):
     """Authenticate an EC2 request and add 'nova.context' to WSGI environ."""
 
@@ -147,7 +192,7 @@ class Authenticate(wsgi.Middleware):
         try:
             signature = req.params['Signature']
             access = req.params['AWSAccessKeyId']
-        except KeyError, e:
+        except KeyError:
             raise webob.exc.HTTPBadRequest()
 
         # Make a copy of args for authentication and signature verification.
diff --git a/nova/api/ec2/metadatarequesthandler.py b/nova/api/ec2/metadatarequesthandler.py
index 1dc275c90..0198bf490 100644
--- a/nova/api/ec2/metadatarequesthandler.py
+++ b/nova/api/ec2/metadatarequesthandler.py
@@ -30,6 +30,7 @@ from nova.api.ec2 import cloud
 
 LOG = logging.getLogger('nova.api.ec2.metadata')
 FLAGS = flags.FLAGS
+flags.DECLARE('use_forwarded_for', 'nova.api.auth')
 
 
 class MetadataRequestHandler(wsgi.Application):
diff --git a/nova/api/openstack/common.py b/nova/api/openstack/common.py
index b2a675653..d9eb832f2 100644
--- a/nova/api/openstack/common.py
+++ b/nova/api/openstack/common.py
@@ -241,7 +241,8 @@ def check_img_metadata_quota_limit(context, metadata):
     quota_metadata = quota.allowed_metadata_items(context, num_metadata)
     if quota_metadata < num_metadata:
         expl = _("Image metadata limit exceeded")
-        raise webob.exc.HTTPBadRequest(explanation=expl)
+        raise webob.exc.HTTPRequestEntityTooLarge(explanation=expl,
+                                                headers={'Retry-After': 0})
 
 
 class MetadataXMLDeserializer(wsgi.XMLDeserializer):
diff --git a/nova/api/openstack/contrib/floating_ips.py b/nova/api/openstack/contrib/floating_ips.py
index 44b35c385..40086f778 100644
--- a/nova/api/openstack/contrib/floating_ips.py
+++ b/nova/api/openstack/contrib/floating_ips.py
@@ -15,8 +15,9 @@
 #    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 #    License for the specific language governing permissions and limitations
 #    under the License
-from webob import exc
+import webob
 
+from nova import compute
 from nova import exception
 from nova import log as logging
 from nova import network
@@ -71,18 +72,22 @@ class FloatingIPController(object):
         try:
             floating_ip = self.network_api.get_floating_ip(context, id)
         except exception.NotFound:
-            return faults.Fault(exc.HTTPNotFound())
+            return faults.Fault(webob.exc.HTTPNotFound())
 
         return _translate_floating_ip_view(floating_ip)
 
     def index(self, req):
         context = req.environ['nova.context']
 
-        floating_ips = self.network_api.list_floating_ips(context)
+        try:
+            # FIXME(ja) - why does self.network_api.list_floating_ips raise?
+            floating_ips = self.network_api.list_floating_ips(context)
+        except exception.FloatingIpNotFoundForProject:
+            floating_ips = []
 
         return _translate_floating_ips_view(floating_ips)
 
-    def create(self, req):
+    def create(self, req, body=None):
         context = req.environ['nova.context']
 
         try:
@@ -95,63 +100,67 @@ class FloatingIPController(object):
             else:
                 raise
 
-        return {'allocated': {
-            "id": ip['id'],
-            "floating_ip": ip['address']}}
+        return _translate_floating_ip_view(ip)
 
     def delete(self, req, id):
         context = req.environ['nova.context']
-        ip = self.network_api.get_floating_ip(context, id)
+        floating_ip = self.network_api.get_floating_ip(context, id)
 
-        if 'fixed_ip' in ip:
-            self.disassociate(req, id)
+        if 'fixed_ip' in floating_ip:
+            self.network_api.disassociate_floating_ip(context,
+                                                      floating_ip['address'])
 
-        self.network_api.release_floating_ip(context, address=ip['address'])
+        self.network_api.release_floating_ip(context,
+                                             address=floating_ip['address'])
+        return webob.exc.HTTPAccepted()
 
-        return {'released': {
-            "id": ip['id'],
-            "floating_ip": ip['address']}}
+    def _get_ip_by_id(self, context, value):
+        """Checks that value is id and then returns its address."""
+        return self.network_api.get_floating_ip(context, value)['address']
 
-    def associate(self, req, id, body):
-        """ /floating_ips/{id}/associate  fixed ip in body """
-        context = req.environ['nova.context']
-        floating_ip = self._get_ip_by_id(context, id)
 
-        fixed_ip = body['associate_address']['fixed_ip']
+class Floating_ips(extensions.ExtensionDescriptor):
+    def __init__(self):
+        self.compute_api = compute.API()
+        self.network_api = network.API()
+        super(Floating_ips, self).__init__()
 
-        try:
-            self.network_api.associate_floating_ip(context,
-                                                   floating_ip, fixed_ip)
-        except rpc.RemoteError:
-            raise
-
-        return {'associated':
-                {
-                "floating_ip_id": id,
-                "floating_ip": floating_ip,
-                "fixed_ip": fixed_ip}}
-
-    def disassociate(self, req, id, body=None):
-        """ POST /floating_ips/{id}/disassociate """
+    def _add_floating_ip(self, input_dict, req, instance_id):
+        """Associate floating_ip to an instance."""
         context = req.environ['nova.context']
-        floating_ip = self.network_api.get_floating_ip(context, id)
-        address = floating_ip['address']
-        fixed_ip = floating_ip['fixed_ip']['address']
 
         try:
-            self.network_api.disassociate_floating_ip(context, address)
-        except rpc.RemoteError:
-            raise
+            address = input_dict['addFloatingIp']['address']
+        except TypeError:
+            msg = _("Missing parameter dict")
+            raise webob.exc.HTTPBadRequest(explanation=msg)
+        except KeyError:
+            msg = _("Address not specified")
+            raise webob.exc.HTTPBadRequest(explanation=msg)
 
-        return {'disassociated': {'floating_ip': address,
-                                  'fixed_ip': fixed_ip}}
+        self.compute_api.associate_floating_ip(context, instance_id, address)
 
-    def _get_ip_by_id(self, context, value):
-        """Checks that value is id and then returns its address."""
-        return self.network_api.get_floating_ip(context, value)['address']
+        return webob.Response(status_int=202)
 
+    def _remove_floating_ip(self, input_dict, req, instance_id):
+        """Dissociate floating_ip from an instance."""
+        context = req.environ['nova.context']
+
+        try:
+            address = input_dict['removeFloatingIp']['address']
+        except TypeError:
+            msg = _("Missing parameter dict")
+            raise webob.exc.HTTPBadRequest(explanation=msg)
+        except KeyError:
+            msg = _("Address not specified")
+            raise webob.exc.HTTPBadRequest(explanation=msg)
+
+        floating_ip = self.network_api.get_floating_ip_by_ip(context, address)
+        if 'fixed_ip' in floating_ip:
+            self.network_api.disassociate_floating_ip(context, address)
+
+        return webob.Response(status_int=202)
 
-class Floating_ips(extensions.ExtensionDescriptor):
     def get_name(self):
         return "Floating_ips"
 
@@ -172,9 +181,18 @@ class Floating_ips(extensions.ExtensionDescriptor):
 
         res = extensions.ResourceExtension('os-floating-ips',
                          FloatingIPController(),
-                         member_actions={
-                            'associate': 'POST',
-                            'disassociate': 'POST'})
+                         member_actions={})
         resources.append(res)
 
         return resources
+
+    def get_actions(self):
+        """Return the actions the extension adds, as required by contract."""
+        actions = [
+                extensions.ActionExtension("servers", "addFloatingIp",
+                                            self._add_floating_ip),
+                extensions.ActionExtension("servers", "removeFloatingIp",
+                                            self._remove_floating_ip),
+        ]
+
+        return actions
diff --git a/nova/api/openstack/contrib/rescue.py b/nova/api/openstack/contrib/rescue.py
new file mode 100644
index 000000000..3de128895
--- /dev/null
+++ b/nova/api/openstack/contrib/rescue.py
@@ -0,0 +1,83 @@
+#   Copyright 2011 Openstack, LLC.
+#
+#   Licensed under the Apache License, Version 2.0 (the "License"); you may
+#   not use this file except in compliance with the License. You may obtain
+#   a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#   WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#   License for the specific language governing permissions and limitations
+#   under the License.
+
+"""The rescue mode extension."""
+
+import webob
+from webob import exc
+
+from nova import compute
+from nova import log as logging
+from nova.api.openstack import extensions as exts
+from nova.api.openstack import faults
+
+
+LOG = logging.getLogger("nova.api.contrib.rescue")
+
+
+def wrap_errors(fn):
+    """"Ensure errors are not passed along."""
+    def wrapped(*args):
+        try:
+            fn(*args)
+        except Exception, e:
+            return faults.Fault(exc.HTTPInternalServerError())
+    return wrapped
+
+
+class Rescue(exts.ExtensionDescriptor):
+    """The Rescue controller for the OpenStack API."""
+    def __init__(self):
+        super(Rescue, self).__init__()
+        self.compute_api = compute.API()
+
+    @wrap_errors
+    def _rescue(self, input_dict, req, instance_id):
+        """Rescue an instance."""
+        context = req.environ["nova.context"]
+        self.compute_api.rescue(context, instance_id)
+
+        return webob.Response(status_int=202)
+
+    @wrap_errors
+    def _unrescue(self, input_dict, req, instance_id):
+        """Unrescue an instance."""
+        context = req.environ["nova.context"]
+        self.compute_api.unrescue(context, instance_id)
+
+        return webob.Response(status_int=202)
+
+    def get_name(self):
+        return "Rescue"
+
+    def get_alias(self):
+        return "os-rescue"
+
+    def get_description(self):
+        return "Instance rescue mode"
+
+    def get_namespace(self):
+        return "http://docs.openstack.org/ext/rescue/api/v1.1"
+
+    def get_updated(self):
+        return "2011-08-18T00:00:00+00:00"
+
+    def get_actions(self):
+        """Return the actions the extension adds, as required by contract."""
+        actions = [
+                exts.ActionExtension("servers", "rescue", self._rescue),
+                exts.ActionExtension("servers", "unrescue", self._unrescue),
+        ]
+
+        return actions
diff --git a/nova/api/openstack/contrib/virtual_interfaces.py b/nova/api/openstack/contrib/virtual_interfaces.py
new file mode 100644
index 000000000..dab61efc8
--- /dev/null
+++ b/nova/api/openstack/contrib/virtual_interfaces.py
@@ -0,0 +1,108 @@
+# Copyright (C) 2011 Midokura KK
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""The virtual interfaces extension."""
+
+from webob import exc
+import webob
+
+from nova import compute
+from nova import exception
+from nova import log as logging
+from nova.api.openstack import common
+from nova.api.openstack import extensions
+from nova.api.openstack import faults
+from nova.api.openstack import wsgi
+
+
+LOG = logging.getLogger("nova.api.virtual_interfaces")
+
+
+def _translate_vif_summary_view(_context, vif):
+    """Maps keys for VIF summary view."""
+    d = {}
+    d['id'] = vif['uuid']
+    d['mac_address'] = vif['address']
+    return d
+
+
+def _get_metadata():
+    metadata = {
+        "attributes": {
+                'virtual_interface': ["id", "mac_address"]}}
+    return metadata
+
+
+class ServerVirtualInterfaceController(object):
+    """The instance VIF API controller for the Openstack API.
+    """
+
+    def __init__(self):
+        self.compute_api = compute.API()
+        super(ServerVirtualInterfaceController, self).__init__()
+
+    def _items(self, req, server_id, entity_maker):
+        """Returns a list of VIFs, transformed through entity_maker."""
+        context = req.environ['nova.context']
+
+        try:
+            instance = self.compute_api.get(context, server_id)
+        except exception.NotFound:
+            return faults.Fault(exc.HTTPNotFound())
+
+        vifs = instance['virtual_interfaces']
+        limited_list = common.limited(vifs, req)
+        res = [entity_maker(context, vif) for vif in limited_list]
+        return {'virtual_interfaces': res}
+
+    def index(self, req, server_id):
+        """Returns the list of VIFs for a given instance."""
+        return self._items(req, server_id,
+                           entity_maker=_translate_vif_summary_view)
+
+
+class Virtual_interfaces(extensions.ExtensionDescriptor):
+
+    def get_name(self):
+        return "VirtualInterfaces"
+
+    def get_alias(self):
+        return "virtual_interfaces"
+
+    def get_description(self):
+        return "Virtual interface support"
+
+    def get_namespace(self):
+        return "http://docs.openstack.org/ext/virtual_interfaces/api/v1.1"
+
+    def get_updated(self):
+        return "2011-08-17T00:00:00+00:00"
+
+    def get_resources(self):
+        resources = []
+
+        metadata = _get_metadata()
+        body_serializers = {
+            'application/xml': wsgi.XMLDictSerializer(metadata=metadata,
+                                                      xmlns=wsgi.XMLNS_V11)}
+        serializer = wsgi.ResponseSerializer(body_serializers, None)
+        res = extensions.ResourceExtension(
+            'os-virtual-interfaces',
+            controller=ServerVirtualInterfaceController(),
+            parent=dict(member_name='server', collection_name='servers'),
+            serializer=serializer)
+        resources.append(res)
+
+        return resources
diff --git a/nova/api/openstack/create_instance_helper.py b/nova/api/openstack/create_instance_helper.py
index cf1e21cc6..73e48dca5 100644
--- a/nova/api/openstack/create_instance_helper.py
+++ b/nova/api/openstack/create_instance_helper.py
@@ -131,6 +131,7 @@ class CreateInstanceHelper(object):
             raise exc.HTTPBadRequest(explanation=msg)
 
         zone_blob = server_dict.get('blob')
+        user_data = server_dict.get('user_data')
         availability_zone = server_dict.get('availability_zone')
         name = server_dict['name']
         self._validate_server_name(name)
@@ -173,6 +174,7 @@ class CreateInstanceHelper(object):
                                   min_count=min_count,
                                   max_count=max_count,
                                   security_group=sg_names,
+                                  user_data=user_data,
                                   availability_zone=availability_zone))
         except quota.QuotaError as error:
             self._handle_quota_error(error)
@@ -192,13 +194,20 @@ class CreateInstanceHelper(object):
         """
         if error.code == "OnsetFileLimitExceeded":
             expl = _("Personality file limit exceeded")
-            raise exc.HTTPBadRequest(explanation=expl)
+            raise exc.HTTPRequestEntityTooLarge(explanation=error.message,
+                                                headers={'Retry-After': 0})
         if error.code == "OnsetFilePathLimitExceeded":
             expl = _("Personality file path too long")
-            raise exc.HTTPBadRequest(explanation=expl)
+            raise exc.HTTPRequestEntityTooLarge(explanation=error.message,
+                                                headers={'Retry-After': 0})
         if error.code == "OnsetFileContentLimitExceeded":
             expl = _("Personality file content too long")
-            raise exc.HTTPBadRequest(explanation=expl)
+            raise exc.HTTPRequestEntityTooLarge(explanation=error.message,
+                                                headers={'Retry-After': 0})
+        if error.code == "InstanceLimitExceeded":
+            expl = _("Instance quotas have been exceeded")
+            raise exc.HTTPRequestEntityTooLarge(explanation=error.message,
+                                                headers={'Retry-After': 0})
         # if the original error is okay, just reraise it
         raise error
 
diff --git a/nova/api/openstack/server_metadata.py b/nova/api/openstack/server_metadata.py
index 2b235f79a..8ac3319c9 100644
--- a/nova/api/openstack/server_metadata.py
+++ b/nova/api/openstack/server_metadata.py
@@ -151,7 +151,8 @@ class Controller(object):
     def _handle_quota_error(self, error):
         """Reraise quota errors as api-specific http exceptions."""
         if error.code == "MetadataLimitExceeded":
-            raise exc.HTTPBadRequest(explanation=error.message)
+            raise exc.HTTPRequestEntityTooLarge(explanation=error.message,
+                                                headers={'Retry-After': 0})
         raise error
 
 
diff --git a/nova/api/openstack/servers.py b/nova/api/openstack/servers.py
index 335ecad86..41e63ec3c 100644
--- a/nova/api/openstack/servers.py
+++ b/nova/api/openstack/servers.py
@@ -923,6 +923,12 @@ class ServerXMLSerializer(wsgi.XMLDictSerializer):
         node.setAttribute('adminPass', server_dict['server']['adminPass'])
         return self.to_xml_string(node, True)
 
+    def update(self, server_dict):
+        xml_doc = minidom.Document()
+        node = self._server_to_xml_detailed(xml_doc,
+                                       server_dict['server'])
+        return self.to_xml_string(node, True)
+
 
 def create_resource(version='1.0'):
     controller = {