clean up based on cerberus review

7 files changed, 51 insertions, 112 deletions

diff --git a/nova/api/auth.py b/nova/api/auth.py
index f73cae01e..a94f28739 100644
--- a/nova/api/auth.py
+++ b/nova/api/auth.py
@@ -43,35 +43,3 @@ class InjectContext(wsgi.Middleware):
     def __call__(self, req):
         req.environ['nova.context'] = self.context
         return self.application
-
-
-class KeystoneContext(wsgi.Middleware):
-    """Make a request context from keystone headers"""
-
-    @webob.dec.wsgify(RequestClass=wsgi.Request)
-    def __call__(self, req):
-        try:
-            user_id = req.headers['X_USER']
-        except KeyError:
-            return webob.exc.HTTPUnauthorized()
-        # get the roles
-        roles = [r.strip() for r in req.headers.get('X_ROLE', '').split(',')]
-        project_id = req.headers['X_TENANT']
-        # Get the auth token
-        auth_token = req.headers.get('X_AUTH_TOKEN',
-                                     req.headers.get('X_STORAGE_TOKEN'))
-
-        # Build a context, including the auth_token...
-        remote_address = getattr(req, 'remote_address', '127.0.0.1')
-        remote_address = req.remote_addr
-        if FLAGS.use_forwarded_for:
-            remote_address = req.headers.get('X-Forwarded-For', remote_address)
-        ctx = context.RequestContext(user_id,
-                                     project_id,
-                                     roles=roles,
-                                     auth_token=auth_token,
-                                     strategy='keystone',
-                                     remote_address=remote_address)
-
-        req.environ['nova.context'] = ctx
-        return self.application
diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index 3b217e62e..14bf8676a 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -46,9 +46,6 @@ flags.DEFINE_integer('lockout_minutes', 15,
                      'Number of minutes to lockout if triggered.')
 flags.DEFINE_integer('lockout_window', 15,
                      'Number of minutes for lockout window.')
-flags.DEFINE_string('keystone_ec2_url',
-                    'http://localhost:5000/v2.0/ec2tokens',
-                    'URL to get token from ec2 request.')
 flags.DECLARE('use_forwarded_for', 'nova.api.auth')
 
 
@@ -142,54 +139,6 @@ class Lockout(wsgi.Middleware):
         return res
 
 
-class ToToken(wsgi.Middleware):
-    """Authenticate an EC2 request with keystone and convert to token."""
-
-    @webob.dec.wsgify(RequestClass=wsgi.Request)
-    def __call__(self, req):
-        # Read request signature and access id.
-        try:
-            signature = req.params['Signature']
-            access = req.params['AWSAccessKeyId']
-        except KeyError:
-            raise webob.exc.HTTPBadRequest()
-
-        # Make a copy of args for authentication and signature verification.
-        auth_params = dict(req.params)
-        # Not part of authentication args
-        auth_params.pop('Signature')
-
-        # Authenticate the request.
-        creds = {'ec2Credentials': {'access': access,
-                                    'signature': signature,
-                                    'host': req.host,
-                                    'verb': req.method,
-                                    'path': req.path,
-                                    'params': auth_params,
-                                   }}
-        creds_json = utils.dumps(creds)
-        headers = {'Content-Type': 'application/json'}
-        o = urlparse(FLAGS.keystone_ec2_url)
-        if o.scheme == "http":
-            conn = httplib.HTTPConnection(o.netloc)
-        else:
-            conn = httplib.HTTPSConnection(o.netloc)
-        conn.request('POST', o.path, body=creds_json, headers=headers)
-        response = conn.getresponse().read()
-        conn.close()
-
-        # NOTE(vish): We could save a call to keystone by
-        #             having keystone return token, tenant,
-        #             user, and roles from this call.
-        result = utils.loads(response)
-        # TODO(vish): check for errors
-
-        token_id = result['auth']['token']['id']
-        # Authenticated!
-        req.headers['X-Auth-Token'] = token_id
-        return self.application
-
-
 class NoAuth(wsgi.Middleware):
     """Add user:project as 'nova.context' to WSGI environ."""
 
diff --git a/nova/api/ec2/cloud.py b/nova/api/ec2/cloud.py
index fb1afa43a..23ac30494 100644
--- a/nova/api/ec2/cloud.py
+++ b/nova/api/ec2/cloud.py
@@ -594,18 +594,31 @@ class CloudController(object):
         g['ipPermissions'] = []
         for rule in group.rules:
             r = {}
-            r['ipProtocol'] = rule.protocol
-            r['fromPort'] = rule.from_port
-            r['toPort'] = rule.to_port
             r['groups'] = []
             r['ipRanges'] = []
             if rule.group_id:
                 source_group = db.security_group_get(context, rule.group_id)
                 r['groups'] += [{'groupName': source_group.name,
                                  'userId': source_group.project_id}]
+                if rule.protocol:
+                    r['ipProtocol'] = rule.protocol
+                    r['fromPort'] = rule.from_port
+                    r['toPort'] = rule.to_port
+                    g['ipPermissions'] += [dict(r)]
+                else:
+                    for protocol, min_port, max_port in (('icmp', -1, -1),
+                                                         ('tcp', 1, 65535),
+                                                         ('udp', 1, 65536)):
+                        r['ipProtocol'] = protocol
+                        r['fromPort'] = min_port
+                        r['toPort'] = max_port
+                        g['ipPermissions'] += [dict(r)]
             else:
+                r['ipProtocol'] = rule.protocol
+                r['fromPort'] = rule.from_port
+                r['toPort'] = rule.to_port
                 r['ipRanges'] += [{'cidrIp': rule.cidr}]
-            g['ipPermissions'] += [r]
+                g['ipPermissions'] += [r]
         return g
 
     def _rule_args_to_dict(self, context, kwargs):
diff --git a/nova/api/openstack/contrib/rescue.py b/nova/api/openstack/contrib/rescue.py
index 3de128895..2e5dbab73 100644
--- a/nova/api/openstack/contrib/rescue.py
+++ b/nova/api/openstack/contrib/rescue.py
@@ -18,11 +18,14 @@ import webob
 from webob import exc
 
 from nova import compute
+from nova import flags
 from nova import log as logging
+from nova import utils
 from nova.api.openstack import extensions as exts
 from nova.api.openstack import faults
 
 
+FLAGS = flags.FLAGS
 LOG = logging.getLogger("nova.api.contrib.rescue")
 
 
@@ -30,7 +33,7 @@ def wrap_errors(fn):
     """"Ensure errors are not passed along."""
     def wrapped(*args):
         try:
-            fn(*args)
+            return fn(*args)
         except Exception, e:
             return faults.Fault(exc.HTTPInternalServerError())
     return wrapped
@@ -46,9 +49,13 @@ class Rescue(exts.ExtensionDescriptor):
     def _rescue(self, input_dict, req, instance_id):
         """Rescue an instance."""
         context = req.environ["nova.context"]
-        self.compute_api.rescue(context, instance_id)
+        if input_dict['rescue'] and 'adminPass' in input_dict['rescue']:
+            password = input_dict['rescue']['adminPass']
+        else:
+            password = utils.generate_password(FLAGS.password_length)
+        self.compute_api.rescue(context, instance_id, rescue_password=password)
 
-        return webob.Response(status_int=202)
+        return {'adminPass': password}
 
     @wrap_errors
     def _unrescue(self, input_dict, req, instance_id):
diff --git a/nova/api/openstack/contrib/virtual_interfaces.py b/nova/api/openstack/contrib/virtual_interfaces.py
index dab61efc8..1981cd372 100644
--- a/nova/api/openstack/contrib/virtual_interfaces.py
+++ b/nova/api/openstack/contrib/virtual_interfaces.py
@@ -15,15 +15,10 @@
 
 """The virtual interfaces extension."""
 
-from webob import exc
-import webob
-
-from nova import compute
-from nova import exception
 from nova import log as logging
+from nova import network
 from nova.api.openstack import common
 from nova.api.openstack import extensions
-from nova.api.openstack import faults
 from nova.api.openstack import wsgi
 
 
@@ -50,19 +45,14 @@ class ServerVirtualInterfaceController(object):
     """
 
     def __init__(self):
-        self.compute_api = compute.API()
+        self.network_api = network.API()
         super(ServerVirtualInterfaceController, self).__init__()
 
     def _items(self, req, server_id, entity_maker):
         """Returns a list of VIFs, transformed through entity_maker."""
         context = req.environ['nova.context']
 
-        try:
-            instance = self.compute_api.get(context, server_id)
-        except exception.NotFound:
-            return faults.Fault(exc.HTTPNotFound())
-
-        vifs = instance['virtual_interfaces']
+        vifs = self.network_api.get_vifs_by_instance(context, server_id)
         limited_list = common.limited(vifs, req)
         res = [entity_maker(context, vif) for vif in limited_list]
         return {'virtual_interfaces': res}
diff --git a/nova/api/openstack/create_instance_helper.py b/nova/api/openstack/create_instance_helper.py
index e27ddf78b..79f17e27f 100644
--- a/nova/api/openstack/create_instance_helper.py
+++ b/nova/api/openstack/create_instance_helper.py
@@ -317,14 +317,14 @@ class CreateInstanceHelper(object):
 
     def _get_server_admin_password_old_style(self, server):
         """ Determine the admin password for a server on creation """
-        return utils.generate_password(16)
+        return utils.generate_password(FLAGS.password_length)
 
     def _get_server_admin_password_new_style(self, server):
         """ Determine the admin password for a server on creation """
         password = server.get('adminPass')
 
         if password is None:
-            return utils.generate_password(16)
+            return utils.generate_password(FLAGS.password_length)
         if not isinstance(password, basestring) or password == '':
             msg = _("Invalid adminPass")
             raise exc.HTTPBadRequest(explanation=msg)
diff --git a/nova/api/openstack/servers.py b/nova/api/openstack/servers.py
index b2d192c99..3b19e695f 100644
--- a/nova/api/openstack/servers.py
+++ b/nova/api/openstack/servers.py
@@ -513,16 +513,22 @@ class Controller(object):
 
     @novaclient_exception_converter
     @scheduler_api.redirect_handler
-    def rescue(self, req, id):
+    def rescue(self, req, id, body={}):
         """Permit users to rescue the server."""
         context = req.environ["nova.context"]
         try:
-            self.compute_api.rescue(context, id)
+            if 'rescue' in body and body['rescue'] and \
+                    'adminPass' in body['rescue']:
+                password = body['rescue']['adminPass']
+            else:
+                password = utils.generate_password(FLAGS.password_length)
+            self.compute_api.rescue(context, id, rescue_password=password)
         except Exception:
             readable = traceback.format_exc()
             LOG.exception(_("compute.api::rescue %s"), readable)
             raise exc.HTTPUnprocessableEntity()
-        return webob.Response(status_int=202)
+
+        return {'adminPass': password}
 
     @novaclient_exception_converter
     @scheduler_api.redirect_handler
@@ -659,7 +665,7 @@ class ControllerV10(Controller):
             LOG.debug(msg)
             raise exc.HTTPBadRequest(explanation=msg)
 
-        password = utils.generate_password(16)
+        password = utils.generate_password(FLAGS.password_length)
 
         try:
             self.compute_api.rebuild(context, instance_id, image_id, password)
@@ -692,7 +698,11 @@ class ControllerV11(Controller):
 
     def _get_key_name(self, req, body):
         if 'server' in body:
-            return body['server'].get('key_name')
+            try:
+                return body['server'].get('key_name')
+            except AttributeError:
+                msg = _("Malformed server entity")
+                raise exc.HTTPBadRequest(explanation=msg)
 
     def _image_ref_from_req_data(self, data):
         try:
@@ -802,8 +812,10 @@ class ControllerV11(Controller):
             self._validate_metadata(metadata)
         self._decode_personalities(personalities)
 
-        password = info["rebuild"].get("adminPass",
-                                       utils.generate_password(16))
+        if 'rebuild' in info and 'adminPass' in info['rebuild']:
+            password = info['rebuild']['adminPass']
+        else:
+            password = utils.generate_password(FLAGS.password_length)
 
         try:
             self.compute_api.rebuild(context, instance_id, image_href,