re-added cloudpipe

Conflicts:

	bin/nova-manage
	nova/auth/users.py
	nova/compute/network.py

5 files changed, 278 insertions, 0 deletions

diff --git a/nova/cloudpipe/__init__.py b/nova/cloudpipe/__init__.py
new file mode 100644
index 000000000..e8ac53976
--- /dev/null
+++ b/nova/cloudpipe/__init__.py
@@ -0,0 +1,26 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+# Copyright [2010] [Anso Labs, LLC]
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+
+"""
+:mod:`nova.cloudpipe` -- VPN Server Management
+=====================================================
+
+.. automodule:: nova.cloudpipe
+   :platform: Unix
+   :synopsis: An OpenVPN server for every nova user.
+.. moduleauthor:: Devin Carlen <devin.carlen@gmail.com>
+.. moduleauthor:: Vishvananda Ishaya <vishvananda@yahoo.com>
+.. moduleauthor:: Joshua McKenty <jmckenty@gmail.com>
+"""
diff --git a/nova/cloudpipe/api.py b/nova/cloudpipe/api.py
new file mode 100644
index 000000000..5395e9724
--- /dev/null
+++ b/nova/cloudpipe/api.py
@@ -0,0 +1,70 @@
+#!/usr/bin/python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+# Copyright [2010] [Anso Labs, LLC]
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+
+"""
+Tornado REST API Request Handlers for CloudPipe
+"""
+
+import logging
+import urllib
+
+from nova import vendor
+import tornado.web
+
+from nova import crypto
+from nova.auth import users
+
+_log = logging.getLogger("api")
+_log.setLevel(logging.DEBUG)
+
+
+class CloudPipeRequestHandler(tornado.web.RequestHandler):
+    def get(self, path):
+        path = self.request.path
+        _log.debug( "Cloudpipe path is %s" % path)
+        self.manager = users.UserManager.instance()
+        if path.endswith("/getca/"):
+            self.send_root_ca()
+        elif path.endswith("/getcert/"):
+            _log.debug( "Getting zip for %s" % (path[9:]))
+            try:
+                self.send_signed_zip(self.path[9:])
+            except Exception, err:
+                _log.debug('ERROR: %s\n' % str(err))
+                raise tornado.web.HTTPError(404)
+        self.finish()
+
+    def get_username_from_ip(self, ip):
+        cc = self.application.controllers['Cloud']
+        instance = cc.get_instance_by_ip(ip)
+        return instance['owner_id']
+
+    def send_root_ca(self):
+        _log.debug( "Getting root ca")
+        username = self.get_username_from_ip(self.request.remote_ip)
+        self.set_header("Content-Type", "text/plain")
+        self.write(crypto.fetch_ca(username))
+
+    def send_signed_zip(self, username):
+        self.set_header("Content-Type", "application/zip")
+        self.write(self.manager.get_signed_zip(username))
+
+    def post(self, *args, **kwargs):
+        self.manager = users.UserManager.instance()
+        username = self.get_username_from_ip(self.request.remote_ip)
+        cert = self.get_argument('cert', '')
+        self.write(self.manager.sign_cert(urllib.unquote(cert), username))
+        self.finish()
diff --git a/nova/cloudpipe/bootscript.sh b/nova/cloudpipe/bootscript.sh
new file mode 100755
index 000000000..bb710617e
--- /dev/null
+++ b/nova/cloudpipe/bootscript.sh
@@ -0,0 +1,58 @@
+#!/bin/bash
+# Copyright [2010] [Anso Labs, LLC]
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+
+# This gets zipped and run on the cloudpipe-managed OpenVPN server
+
+export SUPERVISOR="http://10.255.255.1:8773/cloudpipe"
+export VPN_IP=`ifconfig  | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f2 | awk '{print $1}'`
+export BROADCAST=`ifconfig  | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f3 | awk '{print $1}'`
+export DHCP_MASK=`ifconfig  | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f4 | awk '{print $1}'`
+export GATEWAY=`netstat -r | grep default | cut -d' ' -f10`
+export SUBJ=/C=US/ST=California/L=Mountain View/O=Anso Labs/OU=Nova Dev/CN=customer-vpn-$VPN_IP
+
+DHCP_LOWER=`echo $BROADCAST | awk -F. '{print $1"."$2"."$3"." $4 - 10 }'`
+DHCP_UPPER=`echo $BROADCAST | awk -F. '{print $1"."$2"."$3"." $4 - 1 }'`
+
+# generate a server DH
+openssl dhparam -out /etc/openvpn/dh1024.pem 1024
+
+# generate a server priv key
+openssl genrsa -out /etc/openvpn/server.key 2048
+
+# generate a server CSR
+openssl req -new -key /etc/openvpn/server.key -out /etc/openvpn/server.csr -batch -subj "$SUBJ"
+
+# URLEncode the CSR
+CSRTEXT=`cat /etc/openvpn/server.csr`
+CSRTEXT=$(python -c "import urllib; print urllib.quote('''$CSRTEXT''')")
+
+# SIGN the csr and save as server.crt
+# CURL fetch to the supervisor, POSTing the CSR text, saving the result as the CRT file
+curl $SUPERVISOR -d "cert=$CSRTEXT" > /etc/openvpn/server.crt
+curl $SUPERVISOR/getca/ > /etc/openvpn/ca.crt
+
+# Customize the server.conf.template
+cd /etc/openvpn
+
+sed -e s/VPN_IP/$VPN_IP/g server.conf.template > server.conf
+sed -i -e s/DHCP_SUBNET/$DHCP_MASK/g server.conf
+sed -i -e s/DHCP_LOWER/$DHCP_LOWER/g server.conf
+sed -i -e s/DHCP_UPPER/$DHCP_UPPER/g server.conf
+sed -i -e s/max-clients\ 1/max-clients\ 10/g server.conf
+
+echo "\npush \"route 10.255.255.1 255.255.255.255 $GATEWAY\"\n" >> server.conf
+echo "\npush \"route 10.255.255.253 255.255.255.255 $GATEWAY\"\n" >> server.conf
+
+/etc/init.d/openvpn start
diff --git a/nova/cloudpipe/client.ovpn.template b/nova/cloudpipe/client.ovpn.template
new file mode 100644
index 000000000..d6cf8e19c
--- /dev/null
+++ b/nova/cloudpipe/client.ovpn.template
@@ -0,0 +1,41 @@
+# Copyright [2010] [Anso Labs, LLC]
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+
+# NOVA user connection
+# Edit the following lines to point to your cert files:
+cert $certfile
+key $keyfile
+
+ca cacert.pem
+
+client
+dev tap
+proto udp
+
+remote $ip $port
+resolv-retry infinite
+nobind
+
+# Downgrade privileges after initialization (non-Windows only)
+user nobody
+group nogroup
+comp-lzo
+
+# Set log file verbosity.
+verb 2
+
+keepalive 10 120
+ping-timer-rem
+persist-tun
+persist-key
diff --git a/nova/cloudpipe/pipelib.py b/nova/cloudpipe/pipelib.py
new file mode 100644
index 000000000..f69486f3e
--- /dev/null
+++ b/nova/cloudpipe/pipelib.py
@@ -0,0 +1,83 @@
+# Copyright [2010] [Anso Labs, LLC]
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+
+"""
+CloudPipe - Build a user-data payload zip file, and launch
+an instance with it.
+
+"""
+
+import logging
+import os
+import tempfile
+from zipfile import ZipFile, ZIP_DEFLATED
+
+from nova import flags
+from nova.auth import users
+from nova import utils
+from nova.endpoint import api
+
+FLAGS = flags.FLAGS
+
+flags.DEFINE_string('boot_script_template',
+                    utils.abspath('cloudpipe/bootscript.sh'),
+                    'Template for script to run on cloudpipe instance boot')
+
+class CloudPipe(object):
+    def __init__(self, cloud_controller):
+        self.controller = cloud_controller
+        self.manager = users.UserManager.instance()
+
+    def launch_vpn_instance(self, username):
+        logging.debug( "Launching VPN for %s" % (username))
+        user = self.manager.get_user(username)
+        # Make a payload.zip
+        tmpfolder = tempfile.mkdtemp()
+        filename = "payload.zip"
+        zippath = os.path.join(tmpfolder, filename)
+        z = ZipFile(zippath, "w", ZIP_DEFLATED)
+
+        z.write(FLAGS.boot_script_template,'autorun.sh')
+        z.close()
+
+        self.setup_keypair(username)
+        zippy = open(zippath, "r")
+        context = api.APIRequestContext(handler=None, user=user)
+
+        reservation = self.controller.run_instances(context,
+            user_data=zippy.read().encode("base64"),
+            max_count=1,
+            min_count=1,
+            image_id=FLAGS.vpn_image_id,
+            key_name="vpn-key",
+            security_groups=["vpn-secgroup"])
+        zippy.close()
+
+    def setup_keypair(self, username):
+        try:
+            private_key, fingerprint = self.manager.generate_key_pair(username, "vpn-key")
+            os.mkdir("%s/%s" % (FLAGS.keys_path, username))
+            private_key.save(os.path.abspath("%s/%s" % (FLAGS.keys_path, username)))
+        except:
+            pass
+
+    # def setup_secgroups(self, username):
+    #     conn = self.euca.connection_for(username)
+    #     try:
+    #         secgroup = conn.create_security_group("vpn-secgroup", "vpn-secgroup")
+    #         secgroup.authorize(ip_protocol = "udp", from_port = "1194", to_port = "1194", cidr_ip = "0.0.0.0/0")
+    #         secgroup.authorize(ip_protocol = "tcp", from_port = "80", to_port = "80", cidr_ip = "0.0.0.0/0")
+    #         secgroup.authorize(ip_protocol = "tcp", from_port = "22", to_port = "22", cidr_ip = "0.0.0.0/0")
+    #     except:
+    #         pass