summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--nova/api/__init__.py2
-rw-r--r--nova/api/ec2/__init__.py222
-rw-r--r--nova/api/ec2/admin.py (renamed from nova/endpoint/admin.py)31
-rw-r--r--nova/api/ec2/apirequest.py133
-rw-r--r--nova/api/ec2/cloud.py (renamed from nova/endpoint/cloud.py)165
-rw-r--r--nova/api/ec2/context.py33
-rw-r--r--nova/api/ec2/images.py (renamed from nova/endpoint/images.py)0
-rw-r--r--nova/auth/rbac.py69
-rw-r--r--nova/cloudpipe/pipelib.py4
-rw-r--r--nova/endpoint/__init__.py0
-rwxr-xr-xnova/endpoint/api.py347
-rw-r--r--nova/objectstore/handler.py4
-rw-r--r--nova/tests/api_unittest.py143
-rw-r--r--nova/tests/auth_unittest.py2
-rw-r--r--nova/tests/cloud_unittest.py9
-rw-r--r--nova/tests/network_unittest.py4
-rw-r--r--nova/tests/quota_unittest.py39
-rw-r--r--run_tests.py3
18 files changed, 483 insertions, 727 deletions
diff --git a/nova/api/__init__.py b/nova/api/__init__.py
index 9f116dada..821f1deea 100644
--- a/nova/api/__init__.py
+++ b/nova/api/__init__.py
@@ -35,7 +35,7 @@ class API(wsgi.Router):
mapper = routes.Mapper()
mapper.connect("/", controller=self.versions)
mapper.connect("/v1.0/{path_info:.*}", controller=rackspace.API())
- mapper.connect("/ec2/{path_info:.*}", controller=ec2.API())
+ mapper.connect("/services/{path_info:.*}", controller=ec2.API())
super(API, self).__init__(mapper)
@webob.dec.wsgify
diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index 6eec0abf7..a7b10e428 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -1,6 +1,7 @@
# vim: tabstop=4 shiftwidth=4 softtabstop=4
-# Copyright 2010 OpenStack LLC.
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
# All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
@@ -15,28 +16,219 @@
# License for the specific language governing permissions and limitations
# under the License.
-"""
-WSGI middleware for EC2 API controllers.
-"""
+"""Starting point for routing EC2 requests"""
+import logging
import routes
+import webob
import webob.dec
+import webob.exc
+from nova import exception
from nova import wsgi
+from nova.api.ec2 import apirequest
+from nova.api.ec2 import context
+from nova.api.ec2 import admin
+from nova.api.ec2 import cloud
+from nova.auth import manager
-class API(wsgi.Router):
- """Routes EC2 requests to the appropriate controller."""
+_log = logging.getLogger("api")
+_log.setLevel(logging.DEBUG)
+
+
+class API(wsgi.Middleware):
+
+ """Routing for all EC2 API requests."""
def __init__(self):
- mapper = routes.Mapper()
- mapper.connect(None, "{all:.*}", controller=self.dummy)
- super(API, self).__init__(mapper)
+ self.application = Authenticate(Router(Authorizer(Executor())))
+
+
+class Authenticate(wsgi.Middleware):
+
+ """Authenticate an EC2 request and add 'ec2.context' to WSGI environ."""
+
+ @webob.dec.wsgify
+ def __call__(self, req):
+ # Read request signature and access id.
+ try:
+ signature = req.params['Signature']
+ access = req.params['AWSAccessKeyId']
+ except:
+ raise webob.exc.HTTPBadRequest()
+
+ # Make a copy of args for authentication and signature verification.
+ auth_params = dict(req.params)
+ auth_params.pop('Signature') # not part of authentication args
+
+ # Authenticate the request.
+ try:
+ (user, project) = manager.AuthManager().authenticate(
+ access,
+ signature,
+ auth_params,
+ req.method,
+ req.host,
+ req.path)
+ except exception.Error, ex:
+ logging.debug("Authentication Failure: %s" % ex)
+ raise webob.exc.HTTPForbidden()
+
+ # Authenticated!
+ req.environ['ec2.context'] = context.APIRequestContext(user, project)
+ return self.application
+
+
+class Router(wsgi.Middleware):
+
+ """Add ec2.'controller', .'action', and .'action_args' to WSGI environ."""
+
+ def __init__(self, application):
+ super(Router, self).__init__(application)
+ self.map = routes.Mapper()
+ self.map.connect("/{controller_name}/")
+ self.controllers = dict(Cloud=cloud.CloudController(),
+ Admin=admin.AdminController())
+
+ @webob.dec.wsgify
+ def __call__(self, req):
+ # Obtain the appropriate controller and action for this request.
+ try:
+ match = self.map.match(req.path_info)
+ controller_name = match['controller_name']
+ controller = self.controllers[controller_name]
+ except:
+ raise webob.exc.HTTPNotFound()
+ non_args = ['Action', 'Signature', 'AWSAccessKeyId', 'SignatureMethod',
+ 'SignatureVersion', 'Version', 'Timestamp']
+ args = dict(req.params)
+ try:
+ action = req.params['Action'] # raise KeyError if omitted
+ for non_arg in non_args:
+ args.pop(non_arg) # remove, but raise KeyError if omitted
+ except:
+ raise webob.exc.HTTPBadRequest()
+
+ _log.debug('action: %s' % action)
+ for key, value in args.items():
+ _log.debug('arg: %s\t\tval: %s' % (key, value))
+
+ # Success!
+ req.environ['ec2.controller'] = controller
+ req.environ['ec2.action'] = action
+ req.environ['ec2.action_args'] = args
+ return self.application
+
+
+class Authorizer(wsgi.Middleware):
+
+ """Authorize an EC2 API request.
+
+ Return a 401 if ec2.controller and ec2.action in WSGI environ may not be
+ executed in ec2.context.
+ """
+
+ def __init__(self, application):
+ super(Authorizer, self).__init__(application)
+ self.action_roles = {
+ 'CloudController': {
+ 'DescribeAvailabilityzones': ['all'],
+ 'DescribeRegions': ['all'],
+ 'DescribeSnapshots': ['all'],
+ 'DescribeKeyPairs': ['all'],
+ 'CreateKeyPair': ['all'],
+ 'DeleteKeyPair': ['all'],
+ 'DescribeSecurityGroups': ['all'],
+ 'CreateSecurityGroup': ['netadmin'],
+ 'DeleteSecurityGroup': ['netadmin'],
+ 'GetConsoleOutput': ['projectmanager', 'sysadmin'],
+ 'DescribeVolumes': ['projectmanager', 'sysadmin'],
+ 'CreateVolume': ['projectmanager', 'sysadmin'],
+ 'AttachVolume': ['projectmanager', 'sysadmin'],
+ 'DetachVolume': ['projectmanager', 'sysadmin'],
+ 'DescribeInstances': ['all'],
+ 'DescribeAddresses': ['all'],
+ 'AllocateAddress': ['netadmin'],
+ 'ReleaseAddress': ['netadmin'],
+ 'AssociateAddress': ['netadmin'],
+ 'DisassociateAddress': ['netadmin'],
+ 'RunInstances': ['projectmanager', 'sysadmin'],
+ 'TerminateInstances': ['projectmanager', 'sysadmin'],
+ 'RebootInstances': ['projectmanager', 'sysadmin'],
+ 'DeleteVolume': ['projectmanager', 'sysadmin'],
+ 'DescribeImages': ['all'],
+ 'DeregisterImage': ['projectmanager', 'sysadmin'],
+ 'RegisterImage': ['projectmanager', 'sysadmin'],
+ 'DescribeImageAttribute': ['all'],
+ 'ModifyImageAttribute': ['projectmanager', 'sysadmin'],
+ },
+ 'AdminController': {
+ # All actions have the same permission: [] (the default)
+ # admins will be allowed to run them
+ # all others will get HTTPUnauthorized.
+ },
+ }
- @staticmethod
@webob.dec.wsgify
- def dummy(req):
- """Temporary dummy controller."""
- msg = "dummy response -- please hook up __init__() to cloud.py instead"
- return repr({'dummy': msg,
- 'kwargs': repr(req.environ['wsgiorg.routing_args'][1])})
+ def __call__(self, req):
+ context = req.environ['ec2.context']
+ controller_name = req.environ['ec2.controller'].__class__.__name__
+ action = req.environ['ec2.action']
+ allowed_roles = self.action_roles[controller_name].get(action, [])
+ if self._matches_any_role(context, allowed_roles):
+ return self.application
+ else:
+ raise webob.exc.HTTPUnauthorized()
+
+ def _matches_any_role(self, context, roles):
+ """Return True if any role in roles is allowed in context."""
+ if 'all' in roles:
+ return True
+ if 'none' in roles:
+ return False
+ return any(context.project.has_role(context.user.id, role)
+ for role in roles)
+
+
+class Executor(wsgi.Application):
+
+ """Execute an EC2 API request.
+
+ Executes 'ec2.action' upon 'ec2.controller', passing 'ec2.context' and
+ 'ec2.action_args' (all variables in WSGI environ.) Returns an XML
+ response, or a 400 upon failure.
+ """
+
+ @webob.dec.wsgify
+ def __call__(self, req):
+ context = req.environ['ec2.context']
+ controller = req.environ['ec2.controller']
+ action = req.environ['ec2.action']
+ args = req.environ['ec2.action_args']
+
+ api_request = apirequest.APIRequest(controller, action)
+ try:
+ result = api_request.send(context, **args)
+ req.headers['Content-Type'] = 'text/xml'
+ return result
+ except exception.ApiError as ex:
+
+ if ex.code:
+ return self._error(req, ex.code, ex.message)
+ else:
+ return self._error(req, type(ex).__name__, ex.message)
+ # TODO(vish): do something more useful with unknown exceptions
+ except Exception as ex:
+ return self._error(req, type(ex).__name__, str(ex))
+
+ def _error(self, req, code, message):
+ resp = webob.Response()
+ resp.status = 400
+ resp.headers['Content-Type'] = 'text/xml'
+ resp.body = ('<?xml version="1.0"?>\n'
+ '<Response><Errors><Error><Code>%s</Code>'
+ '<Message>%s</Message></Error></Errors>'
+ '<RequestID>?</RequestID></Response>') % (code, message)
+ return resp
+
diff --git a/nova/endpoint/admin.py b/nova/api/ec2/admin.py
index c6dcb5320..36feae451 100644
--- a/nova/endpoint/admin.py
+++ b/nova/api/ec2/admin.py
@@ -58,46 +58,27 @@ def host_dict(host):
return {}
-def admin_only(target):
- """Decorator for admin-only API calls"""
- def wrapper(*args, **kwargs):
- """Internal wrapper method for admin-only API calls"""
- context = args[1]
- if context.user.is_admin():
- return target(*args, **kwargs)
- else:
- return {}
-
- return wrapper
-
-
class AdminController(object):
"""
API Controller for users, hosts, nodes, and workers.
- Trivial admin_only wrapper will be replaced with RBAC,
- allowing project managers to administer project users.
"""
def __str__(self):
return 'AdminController'
- @admin_only
def describe_user(self, _context, name, **_kwargs):
"""Returns user data, including access and secret keys."""
return user_dict(manager.AuthManager().get_user(name))
- @admin_only
def describe_users(self, _context, **_kwargs):
"""Returns all users - should be changed to deal with a list."""
return {'userSet':
[user_dict(u) for u in manager.AuthManager().get_users()] }
- @admin_only
def register_user(self, _context, name, **_kwargs):
"""Creates a new user, and returns generated credentials."""
return user_dict(manager.AuthManager().create_user(name))
- @admin_only
def deregister_user(self, _context, name, **_kwargs):
"""Deletes a single user (NOT undoable.)
Should throw an exception if the user has instances,
@@ -107,13 +88,11 @@ class AdminController(object):
return True
- @admin_only
def describe_roles(self, context, project_roles=True, **kwargs):
"""Returns a list of allowed roles."""
roles = manager.AuthManager().get_roles(project_roles)
return { 'roles': [{'role': r} for r in roles]}
- @admin_only
def describe_user_roles(self, context, user, project=None, **kwargs):
"""Returns a list of roles for the given user.
Omitting project will return any global roles that the user has.
@@ -122,7 +101,6 @@ class AdminController(object):
roles = manager.AuthManager().get_user_roles(user, project=project)
return { 'roles': [{'role': r} for r in roles]}
- @admin_only
def modify_user_role(self, context, user, role, project=None,
operation='add', **kwargs):
"""Add or remove a role for a user and project."""
@@ -135,7 +113,6 @@ class AdminController(object):
return True
- @admin_only
def generate_x509_for_user(self, _context, name, project=None, **kwargs):
"""Generates and returns an x509 certificate for a single user.
Is usually called from a client that will wrap this with
@@ -147,19 +124,16 @@ class AdminController(object):
user = manager.AuthManager().get_user(name)
return user_dict(user, base64.b64encode(project.get_credentials(user)))
- @admin_only
def describe_project(self, context, name, **kwargs):
"""Returns project data, including member ids."""
return project_dict(manager.AuthManager().get_project(name))
- @admin_only
def describe_projects(self, context, user=None, **kwargs):
"""Returns all projects - should be changed to deal with a list."""
return {'projectSet':
[project_dict(u) for u in
manager.AuthManager().get_projects(user=user)]}
- @admin_only
def register_project(self, context, name, manager_user, description=None,
member_users=None, **kwargs):
"""Creates a new project"""
@@ -170,20 +144,17 @@ class AdminController(object):
description=None,
member_users=None))
- @admin_only
def deregister_project(self, context, name):
"""Permanently deletes a project."""
manager.AuthManager().delete_project(name)
return True
- @admin_only
def describe_project_members(self, context, name, **kwargs):
project = manager.AuthManager().get_project(name)
result = {
'members': [{'member': m} for m in project.member_ids]}
return result
- @admin_only
def modify_project_member(self, context, user, project, operation, **kwargs):
"""Add or remove a user from a project."""
if operation =='add':
@@ -196,7 +167,6 @@ class AdminController(object):
# FIXME(vish): these host commands don't work yet, perhaps some of the
# required data can be retrieved from service objects?
- @admin_only
def describe_hosts(self, _context, **_kwargs):
"""Returns status info for all nodes. Includes:
* Disk Space
@@ -208,7 +178,6 @@ class AdminController(object):
"""
return {'hostSet': [host_dict(h) for h in db.host_get_all()]}
- @admin_only
def describe_host(self, _context, name, **_kwargs):
"""Returns status info for single node."""
return host_dict(db.host_get(name))
diff --git a/nova/api/ec2/apirequest.py b/nova/api/ec2/apirequest.py
new file mode 100644
index 000000000..a3b20118f
--- /dev/null
+++ b/nova/api/ec2/apirequest.py
@@ -0,0 +1,133 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+"""
+APIRequest class
+"""
+
+import logging
+import re
+# TODO(termie): replace minidom with etree
+from xml.dom import minidom
+
+_log = logging.getLogger("api")
+_log.setLevel(logging.DEBUG)
+
+
+_c2u = re.compile('(((?<=[a-z])[A-Z])|([A-Z](?![A-Z]|$)))')
+
+
+def _camelcase_to_underscore(str):
+ return _c2u.sub(r'_\1', str).lower().strip('_')
+
+
+def _underscore_to_camelcase(str):
+ return ''.join([x[:1].upper() + x[1:] for x in str.split('_')])
+
+
+def _underscore_to_xmlcase(str):
+ res = _underscore_to_camelcase(str)
+ return res[:1].lower() + res[1:]
+
+
+class APIRequest(object):
+ def __init__(self, controller, action):
+ self.controller = controller
+ self.action = action
+
+ def send(self, context, **kwargs):
+ try:
+ method = getattr(self.controller,
+ _camelcase_to_underscore(self.action))
+ except AttributeError:
+ _error = ('Unsupported API request: controller = %s,'
+ 'action = %s') % (self.controller, self.action)
+ _log.warning(_error)
+ # TODO: Raise custom exception, trap in apiserver,
+ # and reraise as 400 error.
+ raise Exception(_error)
+
+ args = {}
+ for key, value in kwargs.items():
+ parts = key.split(".")
+ key = _camelcase_to_underscore(parts[0])
+ if len(parts) > 1:
+ d = args.get(key, {})
+ d[parts[1]] = value[0]
+ value = d
+ else:
+ value = value[0]
+ args[key] = value
+
+ for key in args.keys():
+ if isinstance(args[key], dict):
+ if args[key] != {} and args[key].keys()[0].isdigit():
+ s = args[key].items()
+ s.sort()
+ args[key] = [v for k, v in s]
+
+ result = method(context, **args)
+ return self._render_response(result, context.request_id)
+
+ def _render_response(self, response_data, request_id):
+ xml = minidom.Document()
+
+ response_el = xml.createElement(self.action + 'Response')
+ response_el.setAttribute('xmlns',
+ 'http://ec2.amazonaws.com/doc/2009-11-30/')
+ request_id_el = xml.createElement('requestId')
+ request_id_el.appendChild(xml.createTextNode(request_id))
+ response_el.appendChild(request_id_el)
+ if(response_data == True):
+ self._render_dict(xml, response_el, {'return': 'true'})
+ else:
+ self._render_dict(xml, response_el, response_data)
+
+ xml.appendChild(response_el)
+
+ response = xml.toxml()
+ xml.unlink()
+ _log.debug(response)
+ return response
+
+ def _render_dict(self, xml, el, data):
+ try:
+ for key in data.keys():
+ val = data[key]
+ el.appendChild(self._render_data(xml, key, val))
+ except:
+ _log.debug(data)
+ raise
+
+ def _render_data(self, xml, el_name, data):
+ el_name = _underscore_to_xmlcase(el_name)
+ data_el = xml.createElement(el_name)
+
+ if isinstance(data, list):
+ for item in data:
+ data_el.appendChild(self._render_data(xml, 'item', item))
+ elif isinstance(data, dict):
+ self._render_dict(xml, data_el, data)
+ elif hasattr(data, '__dict__'):
+ self._render_dict(xml, data_el, data.__dict__)
+ elif isinstance(data, bool):
+ data_el.appendChild(xml.createTextNode(str(data).lower()))
+ elif data != None:
+ data_el.appendChild(xml.createTextNode(str(data)))
+
+ return data_el
diff --git a/nova/endpoint/cloud.py b/nova/api/ec2/cloud.py
index 261e3e001..367511e3b 100644
--- a/nova/endpoint/cloud.py
+++ b/nova/api/ec2/cloud.py
@@ -28,8 +28,6 @@ import logging
import os
import time
-from twisted.internet import defer
-
from nova import crypto
from nova import db
from nova import exception
@@ -37,9 +35,8 @@ from nova import flags
from nova import quota
from nova import rpc
from nova import utils
-from nova.auth import rbac
from nova.compute.instance_types import INSTANCE_TYPES
-from nova.endpoint import images
+from nova.api.ec2 import images
FLAGS = flags.FLAGS
@@ -56,25 +53,22 @@ def _gen_key(context, user_id, key_name):
This is a module level method because it is slow and we need to defer
it into a process pool."""
+ # NOTE(vish): generating key pair is slow so check for legal
+ # creation before creating key_pair
try:
- # NOTE(vish): generating key pair is slow so check for legal
- # creation before creating key_pair
- try:
- db.key_pair_get(context, user_id, key_name)
- raise exception.Duplicate("The key_pair %s already exists"
- % key_name)
- except exception.NotFound:
- pass
- private_key, public_key, fingerprint = crypto.generate_key_pair()
- key = {}
- key['user_id'] = user_id
- key['name'] = key_name
- key['public_key'] = public_key
- key['fingerprint'] = fingerprint
- db.key_pair_create(context, key)
- return {'private_key': private_key, 'fingerprint': fingerprint}
- except Exception as ex:
- return {'exception': ex}
+ db.key_pair_get(context, user_id, key_name)
+ raise exception.Duplicate("The key_pair %s already exists"
+ % key_name)
+ except exception.NotFound:
+ pass
+ private_key, public_key, fingerprint = crypto.generate_key_pair()
+ key = {}
+ key['user_id'] = user_id
+ key['name'] = key_name
+ key['public_key'] = public_key
+ key['fingerprint'] = fingerprint
+ db.key_pair_create(context, key)
+ return {'private_key': private_key, 'fingerprint': fingerprint}
class CloudController(object):
@@ -172,12 +166,10 @@ class CloudController(object):
data['product-codes'] = []
return data
- @rbac.allow('all')
def describe_availability_zones(self, context, **kwargs):
return {'availabilityZoneInfo': [{'zoneName': 'nova',
'zoneState': 'available'}]}
- @rbac.allow('all')
def describe_regions(self, context, region_name=None, **kwargs):
if FLAGS.region_list:
regions = []
@@ -192,7 +184,6 @@ class CloudController(object):
regions = [r for r in regions if r['regionName'] in region_name]
return {'regionInfo': regions }
- @rbac.allow('all')
def describe_snapshots(self,
context,
snapshot_id=None,
@@ -208,7 +199,6 @@ class CloudController(object):
'volumeSize': 0,
'description': 'fixme'}]}
- @rbac.allow('all')
def describe_key_pairs(self, context, key_name=None, **kwargs):
key_pairs = db.key_pair_get_all_by_user(context, context.user.id)
if not key_name is None:
@@ -226,23 +216,13 @@ class CloudController(object):
return {'keypairsSet': result}
- @rbac.allow('all')
def create_key_pair(self, context, key_name, **kwargs):
- dcall = defer.Deferred()
- pool = context.handler.application.settings.get('pool')
- def _complete(kwargs):
- if 'exception' in kwargs:
- dcall.errback(kwargs['exception'])
- return
- dcall.callback({'keyName': key_name,
- 'keyFingerprint': kwargs['fingerprint'],
- 'keyMaterial': kwargs['private_key']})
+ data = _gen_key(None, context.user.id, key_name)
+ return {'keyName': key_name,
+ 'keyFingerprint': data['fingerprint'],
+ 'keyMaterial': data['private_key']}
# TODO(vish): when context is no longer an object, pass it here
- pool.apply_async(_gen_key, [None, context.user.id, key_name],
- callback=_complete)
- return dcall
- @rbac.allow('all')
def delete_key_pair(self, context, key_name, **kwargs):
try:
db.key_pair_destroy(context, context.user.id, key_name)
@@ -251,22 +231,18 @@ class CloudController(object):
pass
return True
- @rbac.allow('all')
def describe_security_groups(self, context, group_names, **kwargs):
groups = {'securityGroupSet': []}
# Stubbed for now to unblock other things.
return groups
- @rbac.allow('netadmin')
def create_security_group(self, context, group_name, **kwargs):
return True
- @rbac.allow('netadmin')
def delete_security_group(self, context, group_name, **kwargs):
return True
- @rbac.allow('projectmanager', 'sysadmin')
def get_console_output(self, context, instance_id, **kwargs):
# instance_id is passed in as a list of instances
instance_ref = db.instance_get_by_str(context, instance_id[0])
@@ -276,7 +252,6 @@ class CloudController(object):
"args": {"context": None,
"instance_id": instance_ref['id']}})
- @rbac.allow('projectmanager', 'sysadmin')
def describe_volumes(self, context, **kwargs):
if context.user.is_admin():
volumes = db.volume_get_all(context)
@@ -312,7 +287,6 @@ class CloudController(object):
v['attachmentSet'] = [{}]
return v
- @rbac.allow('projectmanager', 'sysadmin')
def create_volume(self, context, size, **kwargs):
# check quota
if quota.allowed_volumes(context, 1, size) < 1:
@@ -339,7 +313,6 @@ class CloudController(object):
return {'volumeSet': [self._format_volume(context, volume_ref)]}
- @rbac.allow('projectmanager', 'sysadmin')
def attach_volume(self, context, volume_id, instance_id, device, **kwargs):
volume_ref = db.volume_get_by_str(context, volume_id)
# TODO(vish): abstract status checking?
@@ -355,14 +328,13 @@ class CloudController(object):
"volume_id": volume_ref['id'],
"instance_id": instance_ref['id'],
"mountpoint": device}})
- return defer.succeed({'attachTime': volume_ref['attach_time'],
- 'device': volume_ref['mountpoint'],
- 'instanceId': instance_ref['id'],
- 'requestId': context.request_id,
- 'status': volume_ref['attach_status'],
- 'volumeId': volume_ref['id']})
-
- @rbac.allow('projectmanager', 'sysadmin')
+ return {'attachTime': volume_ref['attach_time'],
+ 'device': volume_ref['mountpoint'],
+ 'instanceId': instance_ref['id'],
+ 'requestId': context.request_id,
+ 'status': volume_ref['attach_status'],
+ 'volumeId': volume_ref['id']}
+
def detach_volume(self, context, volume_id, **kwargs):
volume_ref = db.volume_get_by_str(context, volume_id)
instance_ref = db.volume_get_instance(context, volume_ref['id'])
@@ -382,12 +354,12 @@ class CloudController(object):
# If the instance doesn't exist anymore,
# then we need to call detach blind
db.volume_detached(context)
- return defer.succeed({'attachTime': volume_ref['attach_time'],
- 'device': volume_ref['mountpoint'],
- 'instanceId': instance_ref['str_id'],
- 'requestId': context.request_id,
- 'status': volume_ref['attach_status'],
- 'volumeId': volume_ref['id']})
+ return {'attachTime': volume_ref['attach_time'],
+ 'device': volume_ref['mountpoint'],
+ 'instanceId': instance_ref['str_id'],
+ 'requestId': context.request_id,
+ 'status': volume_ref['attach_status'],
+ 'volumeId': volume_ref['id']}
def _convert_to_set(self, lst, label):
if lst == None or lst == []:
@@ -396,9 +368,8 @@ class CloudController(object):
lst = [lst]
return [{label: x} for x in lst]
- @rbac.allow('all')
def describe_instances(self, context, **kwargs):
- return defer.succeed(self._format_describe_instances(context))
+ return self._format_describe_instances(context)
def _format_describe_instances(self, context):
return { 'reservationSet': self._format_instances(context) }
@@ -460,7 +431,6 @@ class CloudController(object):
return list(reservations.values())
- @rbac.allow('all')
def describe_addresses(self, context, **kwargs):
return self.format_addresses(context)
@@ -486,8 +456,6 @@ class CloudController(object):
addresses.append(address_rv)
return {'addressesSet': addresses}
- @rbac.allow('netadmin')
- @defer.inlineCallbacks
def allocate_address(self, context, **kwargs):
# check quota
if quota.allowed_floating_ips(context, 1) < 1:
@@ -495,64 +463,55 @@ class CloudController(object):
context.project.id)
raise QuotaError("Address quota exceeded. You cannot "
"allocate any more addresses")
- network_topic = yield self._get_network_topic(context)
- public_ip = yield rpc.call(network_topic,
+ network_topic = self._get_network_topic(context)
+ public_ip = rpc.call(network_topic,
{"method": "allocate_floating_ip",
"args": {"context": None,
"project_id": context.project.id}})
- defer.returnValue({'addressSet': [{'publicIp': public_ip}]})
+ return {'addressSet': [{'publicIp': public_ip}]}
- @rbac.allow('netadmin')
- @defer.inlineCallbacks
def release_address(self, context, public_ip, **kwargs):
# NOTE(vish): Should we make sure this works?
floating_ip_ref = db.floating_ip_get_by_address(context, public_ip)
- network_topic = yield self._get_network_topic(context)
+ network_topic = self._get_network_topic(context)
rpc.cast(network_topic,
{"method": "deallocate_floating_ip",
"args": {"context": None,
"floating_address": floating_ip_ref['str_id']}})
- defer.returnValue({'releaseResponse': ["Address released."]})
+ return {'releaseResponse': ["Address released."]}
- @rbac.allow('netadmin')
- @defer.inlineCallbacks
def associate_address(self, context, instance_id, public_ip, **kwargs):
instance_ref = db.instance_get_by_str(context, instance_id)
fixed_ip_ref = db.fixed_ip_get_by_instance(context, instance_ref['id'])
floating_ip_ref = db.floating_ip_get_by_address(context, public_ip)
- network_topic = yield self._get_network_topic(context)
+ network_topic = self._get_network_topic(context)
rpc.cast(network_topic,
{"method": "associate_floating_ip",
"args": {"context": None,
"floating_address": floating_ip_ref['str_id'],
"fixed_address": fixed_ip_ref['str_id']}})
- defer.returnValue({'associateResponse': ["Address associated."]})
+ return {'associateResponse': ["Address associated."]}
- @rbac.allow('netadmin')
- @defer.inlineCallbacks
def disassociate_address(self, context, public_ip, **kwargs):
floating_ip_ref = db.floating_ip_get_by_address(context, public_ip)
- network_topic = yield self._get_network_topic(context)
+ network_topic = self._get_network_topic(context)
rpc.cast(network_topic,
{"method": "disassociate_floating_ip",
"args": {"context": None,
"floating_address": floating_ip_ref['str_id']}})
- defer.returnValue({'disassociateResponse': ["Address disassociated."]})
+ return {'disassociateResponse': ["Address disassociated."]}
- @defer.inlineCallbacks
def _get_network_topic(self, context):
"""Retrieves the network host for a project"""
network_ref = db.project_get_network(context, context.project.id)
host = network_ref['host']
if not host:
- host = yield rpc.call(FLAGS.network_topic,
+ host = rpc.call(FLAGS.network_topic,
{"method": "set_network_host",
"args": {"context": None,
"project_id": context.project.id}})
- defer.returnValue(db.queue_get_for(context, FLAGS.network_topic, host))
+ return db.queue_get_for(context, FLAGS.network_topic, host)
- @rbac.allow('projectmanager', 'sysadmin')
- @defer.inlineCallbacks
def run_instances(self, context, **kwargs):
instance_type = kwargs.get('instance_type', 'm1.small')
if instance_type not in INSTANCE_TYPES:
@@ -638,7 +597,7 @@ class CloudController(object):
# TODO(vish): This probably should be done in the scheduler
# network is setup when host is assigned
- network_topic = yield self._get_network_topic(context)
+ network_topic = self._get_network_topic(context)
rpc.call(network_topic,
{"method": "setup_fixed_ip",
"args": {"context": None,
@@ -651,12 +610,9 @@ class CloudController(object):
"instance_id": inst_id}})
logging.debug("Casting to scheduler for %s/%s's instance %s" %
(context.project.name, context.user.name, inst_id))
- defer.returnValue(self._format_run_instances(context,
- reservation_id))
+ return self._format_run_instances(context, reservation_id)
- @rbac.allow('projectmanager', 'sysadmin')
- @defer.inlineCallbacks
def terminate_instances(self, context, instance_id, **kwargs):
logging.debug("Going to start terminating instances")
for id_str in instance_id:
@@ -680,7 +636,7 @@ class CloudController(object):
# NOTE(vish): Right now we don't really care if the ip is
# disassociated. We may need to worry about
# checking this later. Perhaps in the scheduler?
- network_topic = yield self._get_network_topic(context)
+ network_topic = self._get_network_topic(context)
rpc.cast(network_topic,
{"method": "disassociate_floating_ip",
"args": {"context": None,
@@ -703,9 +659,8 @@ class CloudController(object):
"instance_id": instance_ref['id']}})
else:
db.instance_destroy(context, instance_ref['id'])
- defer.returnValue(True)
+ return True
- @rbac.allow('projectmanager', 'sysadmin')
def reboot_instances(self, context, instance_id, **kwargs):
"""instance_id is a list of instance ids"""
for id_str in instance_id:
@@ -715,9 +670,8 @@ class CloudController(object):
{"method": "reboot_instance",
"args": {"context": None,
"instance_id": instance_ref['id']}})
- return defer.succeed(True)
+ return True
- @rbac.allow('projectmanager', 'sysadmin')
def delete_volume(self, context, volume_id, **kwargs):
# TODO: return error if not authorized
volume_ref = db.volume_get_by_str(context, volume_id)
@@ -730,31 +684,26 @@ class CloudController(object):
{"method": "delete_volume",
"args": {"context": None,
"volume_id": volume_ref['id']}})
- return defer.succeed(True)
+ return True
- @rbac.allow('all')
def describe_images(self, context, image_id=None, **kwargs):
# The objectstore does its own authorization for describe
imageSet = images.list(context, image_id)
- return defer.succeed({'imagesSet': imageSet})
+ return {'imagesSet': imageSet}
- @rbac.allow('projectmanager', 'sysadmin')
def deregister_image(self, context, image_id, **kwargs):
# FIXME: should the objectstore be doing these authorization checks?
images.deregister(context, image_id)
- return defer.succeed({'imageId': image_id})
+ return {'imageId': image_id}
- @rbac.allow('projectmanager', 'sysadmin')
def register_image(self, context, image_location=None, **kwargs):
# FIXME: should the objectstore be doing these authorization checks?
if image_location is None and kwargs.has_key('name'):
image_location = kwargs['name']
image_id = images.register(context, image_location)
logging.debug("Registered %s as %s" % (image_location, image_id))
+ return {'imageId': image_id}
- return defer.succeed({'imageId': image_id})
-
- @rbac.allow('all')
def describe_image_attribute(self, context, image_id, attribute, **kwargs):
if attribute != 'launchPermission':
raise exception.ApiError('attribute not supported: %s' % attribute)
@@ -765,9 +714,8 @@ class CloudController(object):
result = {'image_id': image_id, 'launchPermission': []}
if image['isPublic']:
result['launchPermission'].append({'group': 'all'})
- return defer.succeed(result)
+ return result
- @rbac.allow('projectmanager', 'sysadmin')
def modify_image_attribute(self, context, image_id, attribute, operation_type, **kwargs):
# TODO(devcamcar): Support users and groups other than 'all'.
if attribute != 'launchPermission':
@@ -778,5 +726,4 @@ class CloudController(object):
raise exception.ApiError('only group "all" is supported')
if not operation_type in ['add', 'remove']:
raise exception.ApiError('operation_type must be add or remove')
- result = images.modify(context, image_id, operation_type)
- return defer.succeed(result)
+ return images.modify(context, image_id, operation_type)
diff --git a/nova/api/ec2/context.py b/nova/api/ec2/context.py
new file mode 100644
index 000000000..c53ba98d9
--- /dev/null
+++ b/nova/api/ec2/context.py
@@ -0,0 +1,33 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+"""
+APIRequestContext
+"""
+
+import random
+
+
+class APIRequestContext(object):
+ def __init__(self, user, project):
+ self.user = user
+ self.project = project
+ self.request_id = ''.join(
+ [random.choice('ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-')
+ for x in xrange(20)]
+ )
diff --git a/nova/endpoint/images.py b/nova/api/ec2/images.py
index 4579cd81a..4579cd81a 100644
--- a/nova/endpoint/images.py
+++ b/nova/api/ec2/images.py
diff --git a/nova/auth/rbac.py b/nova/auth/rbac.py
deleted file mode 100644
index d157f44b3..000000000
--- a/nova/auth/rbac.py
+++ /dev/null
@@ -1,69 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2010 United States Government as represented by the
-# Administrator of the National Aeronautics and Space Administration.
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-"""Role-based access control decorators to use fpr wrapping other
-methods with."""
-
-from nova import exception
-
-
-def allow(*roles):
- """Allow the given roles access the wrapped function."""
-
- def wrap(func): # pylint: disable-msg=C0111
-
- def wrapped_func(self, context, *args,
- **kwargs): # pylint: disable-msg=C0111
- if context.user.is_superuser():
- return func(self, context, *args, **kwargs)
- for role in roles:
- if __matches_role(context, role):
- return func(self, context, *args, **kwargs)
- raise exception.NotAuthorized()
-
- return wrapped_func
-
- return wrap
-
-
-def deny(*roles):
- """Deny the given roles access the wrapped function."""
-
- def wrap(func): # pylint: disable-msg=C0111
-
- def wrapped_func(self, context, *args,
- **kwargs): # pylint: disable-msg=C0111
- if context.user.is_superuser():
- return func(self, context, *args, **kwargs)
- for role in roles:
- if __matches_role(context, role):
- raise exception.NotAuthorized()
- return func(self, context, *args, **kwargs)
-
- return wrapped_func
-
- return wrap
-
-
-def __matches_role(context, role):
- """Check if a role is allowed."""
- if role == 'all':
- return True
- if role == 'none':
- return False
- return context.project.has_role(context.user.id, role)
diff --git a/nova/cloudpipe/pipelib.py b/nova/cloudpipe/pipelib.py
index de6a97fb6..b13a60292 100644
--- a/nova/cloudpipe/pipelib.py
+++ b/nova/cloudpipe/pipelib.py
@@ -32,7 +32,7 @@ from nova import exception
from nova import flags
from nova import utils
from nova.auth import manager
-from nova.endpoint import api
+from nova.api.ec2 import context
FLAGS = flags.FLAGS
@@ -60,7 +60,7 @@ class CloudPipe(object):
key_name = self.setup_key_pair(project.project_manager_id, project_id)
zippy = open(zippath, "r")
- context = api.APIRequestContext(handler=None, user=project.project_manager, project=project)
+ context = context.APIRequestContext(user=project.project_manager, project=project)
reservation = self.controller.run_instances(context,
# run instances expects encoded userdata, it is decoded in the get_metadata_call
diff --git a/nova/endpoint/__init__.py b/nova/endpoint/__init__.py
deleted file mode 100644
index e69de29bb..000000000
--- a/nova/endpoint/__init__.py
+++ /dev/null
diff --git a/nova/endpoint/api.py b/nova/endpoint/api.py
deleted file mode 100755
index 12eedfe67..000000000
--- a/nova/endpoint/api.py
+++ /dev/null
@@ -1,347 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2010 United States Government as represented by the
-# Administrator of the National Aeronautics and Space Administration.
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-"""
-Tornado REST API Request Handlers for Nova functions
-Most calls are proxied into the responsible controller.
-"""
-
-import logging
-import multiprocessing
-import random
-import re
-import urllib
-# TODO(termie): replace minidom with etree
-from xml.dom import minidom
-
-import tornado.web
-from twisted.internet import defer
-
-from nova import crypto
-from nova import exception
-from nova import flags
-from nova import utils
-from nova.auth import manager
-import nova.cloudpipe.api
-from nova.endpoint import cloud
-
-
-FLAGS = flags.FLAGS
-flags.DEFINE_integer('cc_port', 8773, 'cloud controller port')
-
-
-_log = logging.getLogger("api")
-_log.setLevel(logging.DEBUG)
-
-
-_c2u = re.compile('(((?<=[a-z])[A-Z])|([A-Z](?![A-Z]|$)))')
-
-
-def _camelcase_to_underscore(str):
- return _c2u.sub(r'_\1', str).lower().strip('_')
-
-
-def _underscore_to_camelcase(str):
- return ''.join([x[:1].upper() + x[1:] for x in str.split('_')])
-
-
-def _underscore_to_xmlcase(str):
- res = _underscore_to_camelcase(str)
- return res[:1].lower() + res[1:]
-
-
-class APIRequestContext(object):
- def __init__(self, handler, user, project):
- self.handler = handler
- self.user = user
- self.project = project
- self.request_id = ''.join(
- [random.choice('ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-')
- for x in xrange(20)]
- )
-
-
-class APIRequest(object):
- def __init__(self, controller, action):
- self.controller = controller
- self.action = action
-
- def send(self, context, **kwargs):
-
- try:
- method = getattr(self.controller,
- _camelcase_to_underscore(self.action))
- except AttributeError:
- _error = ('Unsupported API request: controller = %s,'
- 'action = %s') % (self.controller, self.action)
- _log.warning(_error)
- # TODO: Raise custom exception, trap in apiserver,
- # and reraise as 400 error.
- raise Exception(_error)
-
- args = {}
- for key, value in kwargs.items():
- parts = key.split(".")
- key = _camelcase_to_underscore(parts[0])
- if len(parts) > 1:
- d = args.get(key, {})
- d[parts[1]] = value[0]
- value = d
- else:
- value = value[0]
- args[key] = value
-
- for key in args.keys():
- if isinstance(args[key], dict):
- if args[key] != {} and args[key].keys()[0].isdigit():
- s = args[key].items()
- s.sort()
- args[key] = [v for k, v in s]
-
- d = defer.maybeDeferred(method, context, **args)
- d.addCallback(self._render_response, context.request_id)
- return d
-
- def _render_response(self, response_data, request_id):
- xml = minidom.Document()
-
- response_el = xml.createElement(self.action + 'Response')
- response_el.setAttribute('xmlns',
- 'http://ec2.amazonaws.com/doc/2009-11-30/')
- request_id_el = xml.createElement('requestId')
- request_id_el.appendChild(xml.createTextNode(request_id))
- response_el.appendChild(request_id_el)
- if(response_data == True):
- self._render_dict(xml, response_el, {'return': 'true'})
- else:
- self._render_dict(xml, response_el, response_data)
-
- xml.appendChild(response_el)
-
- response = xml.toxml()
- xml.unlink()
- _log.debug(response)
- return response
-
- def _render_dict(self, xml, el, data):
- try:
- for key in data.keys():
- val = data[key]
- el.appendChild(self._render_data(xml, key, val))
- except:
- _log.debug(data)
- raise
-
- def _render_data(self, xml, el_name, data):
- el_name = _underscore_to_xmlcase(el_name)
- data_el = xml.createElement(el_name)
-
- if isinstance(data, list):
- for item in data:
- data_el.appendChild(self._render_data(xml, 'item', item))
- elif isinstance(data, dict):
- self._render_dict(xml, data_el, data)
- elif hasattr(data, '__dict__'):
- self._render_dict(xml, data_el, data.__dict__)
- elif isinstance(data, bool):
- data_el.appendChild(xml.createTextNode(str(data).lower()))
- elif data != None:
- data_el.appendChild(xml.createTextNode(str(data)))
-
- return data_el
-
-
-class RootRequestHandler(tornado.web.RequestHandler):
- def get(self):
- # available api versions
- versions = [
- '1.0',
- '2007-01-19',
- '2007-03-01',
- '2007-08-29',
- '2007-10-10',
- '2007-12-15',
- '2008-02-01',
- '2008-09-01',
- '2009-04-04',
- ]
- for version in versions:
- self.write('%s\n' % version)
- self.finish()
-
-
-class MetadataRequestHandler(tornado.web.RequestHandler):
- def print_data(self, data):
- if isinstance(data, dict):
- output = ''
- for key in data:
- if key == '_name':
- continue
- output += key
- if isinstance(data[key], dict):
- if '_name' in data[key]:
- output += '=' + str(data[key]['_name'])
- else:
- output += '/'
- output += '\n'
- self.write(output[:-1]) # cut off last \n
- elif isinstance(data, list):
- self.write('\n'.join(data))
- else:
- self.write(str(data))
-
- def lookup(self, path, data):
- items = path.split('/')
- for item in items:
- if item:
- if not isinstance(data, dict):
- return data
- if not item in data:
- return None
- data = data[item]
- return data
-
- def get(self, path):
- cc = self.application.controllers['Cloud']
- meta_data = cc.get_metadata(self.request.remote_ip)
- if meta_data is None:
- _log.error('Failed to get metadata for ip: %s' %
- self.request.remote_ip)
- raise tornado.web.HTTPError(404)
- data = self.lookup(path, meta_data)
- if data is None:
- raise tornado.web.HTTPError(404)
- self.print_data(data)
- self.finish()
-
-
-class APIRequestHandler(tornado.web.RequestHandler):
- def get(self, controller_name):
- self.execute(controller_name)
-
- @tornado.web.asynchronous
- def execute(self, controller_name):
- # Obtain the appropriate controller for this request.
- try:
- controller = self.application.controllers[controller_name]
- except KeyError:
- self._error('unhandled', 'no controller named %s' % controller_name)
- return
-
- args = self.request.arguments
-
- # Read request signature.
- try:
- signature = args.pop('Signature')[0]
- except:
- raise tornado.web.HTTPError(400)
-
- # Make a copy of args for authentication and signature verification.
- auth_params = {}
- for key, value in args.items():
- auth_params[key] = value[0]
-
- # Get requested action and remove authentication args for final request.
- try:
- action = args.pop('Action')[0]
- access = args.pop('AWSAccessKeyId')[0]
- args.pop('SignatureMethod')
- args.pop('SignatureVersion')
- args.pop('Version')
- args.pop('Timestamp')
- except:
- raise tornado.web.HTTPError(400)
-
- # Authenticate the request.
- try:
- (user, project) = manager.AuthManager().authenticate(
- access,
- signature,
- auth_params,
- self.request.method,
- self.request.host,
- self.request.path
- )
-
- except exception.Error, ex:
- logging.debug("Authentication Failure: %s" % ex)
- raise tornado.web.HTTPError(403)
-
- _log.debug('action: %s' % action)
-
- for key, value in args.items():
- _log.debug('arg: %s\t\tval: %s' % (key, value))
-
- request = APIRequest(controller, action)
- context = APIRequestContext(self, user, project)
- d = request.send(context, **args)
- # d.addCallback(utils.debug)
-
- # TODO: Wrap response in AWS XML format
- d.addCallbacks(self._write_callback, self._error_callback)
-
- def _write_callback(self, data):
- self.set_header('Content-Type', 'text/xml')
- self.write(data)
- self.finish()
-
- def _error_callback(self, failure):
- try:
- failure.raiseException()
- except exception.ApiError as ex:
- if ex.code:
- self._error(ex.code, ex.message)
- else:
- self._error(type(ex).__name__, ex.message)
- # TODO(vish): do something more useful with unknown exceptions
- except Exception as ex:
- self._error(type(ex).__name__, str(ex))
- raise
-
- def post(self, controller_name):
- self.execute(controller_name)
-
- def _error(self, code, message):
- self._status_code = 400
- self.set_header('Content-Type', 'text/xml')
- self.write('<?xml version="1.0"?>\n')
- self.write('<Response><Errors><Error><Code>%s</Code>'
- '<Message>%s</Message></Error></Errors>'
- '<RequestID>?</RequestID></Response>' % (code, message))
- self.finish()
-
-
-class APIServerApplication(tornado.web.Application):
- def __init__(self, controllers):
- tornado.web.Application.__init__(self, [
- (r'/', RootRequestHandler),
- (r'/cloudpipe/(.*)', nova.cloudpipe.api.CloudPipeRequestHandler),
- (r'/cloudpipe', nova.cloudpipe.api.CloudPipeRequestHandler),
- (r'/services/([A-Za-z0-9]+)/', APIRequestHandler),
- (r'/latest/([-A-Za-z0-9/]*)', MetadataRequestHandler),
- (r'/2009-04-04/([-A-Za-z0-9/]*)', MetadataRequestHandler),
- (r'/2008-09-01/([-A-Za-z0-9/]*)', MetadataRequestHandler),
- (r'/2008-02-01/([-A-Za-z0-9/]*)', MetadataRequestHandler),
- (r'/2007-12-15/([-A-Za-z0-9/]*)', MetadataRequestHandler),
- (r'/2007-10-10/([-A-Za-z0-9/]*)', MetadataRequestHandler),
- (r'/2007-08-29/([-A-Za-z0-9/]*)', MetadataRequestHandler),
- (r'/2007-03-01/([-A-Za-z0-9/]*)', MetadataRequestHandler),
- (r'/2007-01-19/([-A-Za-z0-9/]*)', MetadataRequestHandler),
- (r'/1.0/([-A-Za-z0-9/]*)', MetadataRequestHandler),
- ], pool=multiprocessing.Pool(4))
- self.controllers = controllers
diff --git a/nova/objectstore/handler.py b/nova/objectstore/handler.py
index 5c3dc286b..aabf6831f 100644
--- a/nova/objectstore/handler.py
+++ b/nova/objectstore/handler.py
@@ -55,7 +55,7 @@ from twisted.web import static
from nova import exception
from nova import flags
from nova.auth import manager
-from nova.endpoint import api
+from nova.api.ec2 import context
from nova.objectstore import bucket
from nova.objectstore import image
@@ -131,7 +131,7 @@ def get_context(request):
request.uri,
headers=request.getAllHeaders(),
check_type='s3')
- return api.APIRequestContext(None, user, project)
+ return context.APIRequestContext(user, project)
except exception.Error as ex:
logging.debug("Authentication Failure: %s", ex)
raise exception.NotAuthorized
diff --git a/nova/tests/api_unittest.py b/nova/tests/api_unittest.py
index fdb9e21d8..0732c39bb 100644
--- a/nova/tests/api_unittest.py
+++ b/nova/tests/api_unittest.py
@@ -23,60 +23,12 @@ from boto.ec2 import regioninfo
import httplib
import random
import StringIO
-from tornado import httpserver
-from twisted.internet import defer
+import webob
-from nova import flags
from nova import test
+from nova import api
+from nova.api.ec2 import cloud
from nova.auth import manager
-from nova.endpoint import api
-from nova.endpoint import cloud
-
-
-FLAGS = flags.FLAGS
-
-
-# NOTE(termie): These are a bunch of helper methods and classes to short
-# circuit boto calls and feed them into our tornado handlers,
-# it's pretty damn circuitous so apologies if you have to fix
-# a bug in it
-# NOTE(jaypipes) The pylint disables here are for R0913 (too many args) which
-# isn't controllable since boto's HTTPRequest needs that many
-# args, and for the version-differentiated import of tornado's
-# httputil.
-# NOTE(jaypipes): The disable-msg=E1101 and E1103 below is because pylint is
-# unable to introspect the deferred's return value properly
-
-def boto_to_tornado(method, path, headers, data, # pylint: disable-msg=R0913
- host, connection=None):
- """ translate boto requests into tornado requests
-
- connection should be a FakeTornadoHttpConnection instance
- """
- try:
- headers = httpserver.HTTPHeaders()
- except AttributeError:
- from tornado import httputil # pylint: disable-msg=E0611
- headers = httputil.HTTPHeaders()
- for k, v in headers.iteritems():
- headers[k] = v
-
- req = httpserver.HTTPRequest(method=method,
- uri=path,
- headers=headers,
- body=data,
- host=host,
- remote_ip='127.0.0.1',
- connection=connection)
- return req
-
-
-def raw_to_httpresponse(response_string):
- """translate a raw tornado http response into an httplib.HTTPResponse"""
- sock = FakeHttplibSocket(response_string)
- resp = httplib.HTTPResponse(sock)
- resp.begin()
- return resp
class FakeHttplibSocket(object):
@@ -89,85 +41,35 @@ class FakeHttplibSocket(object):
return self._buffer
-class FakeTornadoStream(object):
- """a fake stream to satisfy tornado's assumptions, trivial"""
- def set_close_callback(self, _func):
- """Dummy callback for stream"""
- pass
-
-
-class FakeTornadoConnection(object):
- """A fake connection object for tornado to pass to its handlers
-
- web requests are expected to write to this as they get data and call
- finish when they are done with the request, we buffer the writes and
- kick off a callback when it is done so that we can feed the result back
- into boto.
- """
- def __init__(self, deferred):
- self._deferred = deferred
- self._buffer = StringIO.StringIO()
-
- def write(self, chunk):
- """Writes a chunk of data to the internal buffer"""
- self._buffer.write(chunk)
-
- def finish(self):
- """Finalizes the connection and returns the buffered data via the
- deferred callback.
- """
- data = self._buffer.getvalue()
- self._deferred.callback(data)
-
- xheaders = None
-
- @property
- def stream(self): # pylint: disable-msg=R0201
- """Required property for interfacing with tornado"""
- return FakeTornadoStream()
-
-
class FakeHttplibConnection(object):
"""A fake httplib.HTTPConnection for boto to use
requests made via this connection actually get translated and routed into
- our tornado app, we then wait for the response and turn it back into
+ our WSGI app, we then wait for the response and turn it back into
the httplib.HTTPResponse that boto expects.
"""
def __init__(self, app, host, is_secure=False):
self.app = app
self.host = host
- self.deferred = defer.Deferred()
def request(self, method, path, data, headers):
- """Creates a connection to a fake tornado and sets
- up a deferred request with the supplied data and
- headers"""
- conn = FakeTornadoConnection(self.deferred)
- request = boto_to_tornado(connection=conn,
- method=method,
- path=path,
- headers=headers,
- data=data,
- host=self.host)
- self.app(request)
- self.deferred.addCallback(raw_to_httpresponse)
+ req = webob.Request.blank(path)
+ req.method = method
+ req.body = data
+ req.headers = headers
+ req.headers['Accept'] = 'text/html'
+ req.host = self.host
+ # Call the WSGI app, get the HTTP response
+ resp = str(req.get_response(self.app))
+ # For some reason, the response doesn't have "HTTP/1.0 " prepended; I
+ # guess that's a function the web server usually provides.
+ resp = "HTTP/1.0 %s" % resp
+ sock = FakeHttplibSocket(resp)
+ self.http_response = httplib.HTTPResponse(sock)
+ self.http_response.begin()
def getresponse(self):
- """A bit of deferred magic for catching the response
- from the previously deferred request"""
- @defer.inlineCallbacks
- def _waiter():
- """Callback that simply yields the deferred's
- return value."""
- result = yield self.deferred
- defer.returnValue(result)
- d = _waiter()
- # NOTE(termie): defer.returnValue above should ensure that
- # this deferred has already been called by the time
- # we get here, we are going to cheat and return
- # the result of the callback
- return d.result # pylint: disable-msg=E1101
+ return self.http_response
def close(self):
"""Required for compatibility with boto/tornado"""
@@ -180,17 +82,16 @@ class ApiEc2TestCase(test.BaseTestCase):
super(ApiEc2TestCase, self).setUp()
self.manager = manager.AuthManager()
- self.cloud = cloud.CloudController()
self.host = '127.0.0.1'
- self.app = api.APIServerApplication({'Cloud': self.cloud})
+ self.app = api.API()
self.ec2 = boto.connect_ec2(
aws_access_key_id='fake',
aws_secret_access_key='fake',
is_secure=False,
region=regioninfo.RegionInfo(None, 'test', self.host),
- port=FLAGS.cc_port,
+ port=8773,
path='/services/Cloud')
self.mox.StubOutWithMock(self.ec2, 'new_http_connection')
@@ -198,7 +99,7 @@ class ApiEc2TestCase(test.BaseTestCase):
def expect_http(self, host=None, is_secure=False):
"""Returns a new EC2 connection"""
http = FakeHttplibConnection(
- self.app, '%s:%d' % (self.host, FLAGS.cc_port), False)
+ self.app, '%s:8773' % (self.host), False)
# pylint: disable-msg=E1103
self.ec2.new_http_connection(host, is_secure).AndReturn(http)
return http
diff --git a/nova/tests/auth_unittest.py b/nova/tests/auth_unittest.py
index cbf7b22e2..3235dea39 100644
--- a/nova/tests/auth_unittest.py
+++ b/nova/tests/auth_unittest.py
@@ -24,7 +24,7 @@ from nova import crypto
from nova import flags
from nova import test
from nova.auth import manager
-from nova.endpoint import cloud
+from nova.api.ec2 import cloud
FLAGS = flags.FLAGS
diff --git a/nova/tests/cloud_unittest.py b/nova/tests/cloud_unittest.py
index 317200e01..2f22982eb 100644
--- a/nova/tests/cloud_unittest.py
+++ b/nova/tests/cloud_unittest.py
@@ -35,8 +35,8 @@ from nova import test
from nova import utils
from nova.auth import manager
from nova.compute import power_state
-from nova.endpoint import api
-from nova.endpoint import cloud
+from nova.api.ec2 import context
+from nova.api.ec2 import cloud
FLAGS = flags.FLAGS
@@ -63,9 +63,8 @@ class CloudTestCase(test.BaseTestCase):
self.manager = manager.AuthManager()
self.user = self.manager.create_user('admin', 'admin', 'admin', True)
self.project = self.manager.create_project('proj', 'admin', 'proj')
- self.context = api.APIRequestContext(handler=None,
- user=self.user,
- project=self.project)
+ self.context = context.APIRequestContext(user=self.user,
+ project=self.project)
def tearDown(self):
self.manager.delete_project(self.project)
diff --git a/nova/tests/network_unittest.py b/nova/tests/network_unittest.py
index dc5277f02..da65b50a2 100644
--- a/nova/tests/network_unittest.py
+++ b/nova/tests/network_unittest.py
@@ -28,7 +28,7 @@ from nova import flags
from nova import test
from nova import utils
from nova.auth import manager
-from nova.endpoint import api
+from nova.api.ec2 import context
FLAGS = flags.FLAGS
@@ -49,7 +49,7 @@ class NetworkTestCase(test.TrialTestCase):
self.user = self.manager.create_user('netuser', 'netuser', 'netuser')
self.projects = []
self.network = utils.import_object(FLAGS.network_manager)
- self.context = api.APIRequestContext(None, project=None, user=self.user)
+ self.context = context.APIRequestContext(project=None, user=self.user)
for i in range(5):
name = 'project%s' % i
self.projects.append(self.manager.create_project(name,
diff --git a/nova/tests/quota_unittest.py b/nova/tests/quota_unittest.py
index cab9f663d..370ccd506 100644
--- a/nova/tests/quota_unittest.py
+++ b/nova/tests/quota_unittest.py
@@ -25,8 +25,8 @@ from nova import quota
from nova import test
from nova import utils
from nova.auth import manager
-from nova.endpoint import cloud
-from nova.endpoint import api
+from nova.api.ec2 import cloud
+from nova.api.ec2 import context
FLAGS = flags.FLAGS
@@ -48,9 +48,8 @@ class QuotaTestCase(test.TrialTestCase):
self.user = self.manager.create_user('admin', 'admin', 'admin', True)
self.project = self.manager.create_project('admin', 'admin', 'admin')
self.network = utils.import_object(FLAGS.network_manager)
- self.context = api.APIRequestContext(handler=None,
- project=self.project,
- user=self.user)
+ self.context = context.APIRequestContext(project=self.project,
+ user=self.user)
def tearDown(self): # pylint: disable-msg=C0103
manager.AuthManager().delete_project(self.project)
@@ -95,11 +94,11 @@ class QuotaTestCase(test.TrialTestCase):
for i in range(FLAGS.quota_instances):
instance_id = self._create_instance()
instance_ids.append(instance_id)
- self.assertFailure(self.cloud.run_instances(self.context,
- min_count=1,
- max_count=1,
- instance_type='m1.small'),
- cloud.QuotaError)
+ self.assertRaises(cloud.QuotaError, self.cloud.run_instances,
+ self.context,
+ min_count=1,
+ max_count=1,
+ instance_type='m1.small')
for instance_id in instance_ids:
db.instance_destroy(self.context, instance_id)
@@ -107,11 +106,11 @@ class QuotaTestCase(test.TrialTestCase):
instance_ids = []
instance_id = self._create_instance(cores=4)
instance_ids.append(instance_id)
- self.assertFailure(self.cloud.run_instances(self.context,
- min_count=1,
- max_count=1,
- instance_type='m1.small'),
- cloud.QuotaError)
+ self.assertRaises(cloud.QuotaError, self.cloud.run_instances,
+ self.context,
+ min_count=1,
+ max_count=1,
+ instance_type='m1.small')
for instance_id in instance_ids:
db.instance_destroy(self.context, instance_id)
@@ -120,10 +119,9 @@ class QuotaTestCase(test.TrialTestCase):
for i in range(FLAGS.quota_volumes):
volume_id = self._create_volume()
volume_ids.append(volume_id)
- self.assertRaises(cloud.QuotaError,
- self.cloud.create_volume,
- self.context,
- size=10)
+ self.assertRaises(cloud.QuotaError, self.cloud.create_volume,
+ self.context,
+ size=10)
for volume_id in volume_ids:
db.volume_destroy(self.context, volume_id)
@@ -151,5 +149,4 @@ class QuotaTestCase(test.TrialTestCase):
# make an rpc.call, the test just finishes with OK. It
# appears to be something in the magic inline callbacks
# that is breaking.
- self.assertFailure(self.cloud.allocate_address(self.context),
- cloud.QuotaError)
+ self.assertRaises(cloud.QuotaError, self.cloud.allocate_address, self.context)
diff --git a/run_tests.py b/run_tests.py
index 4121f4c06..bea97c0b3 100644
--- a/run_tests.py
+++ b/run_tests.py
@@ -49,7 +49,8 @@ from nova import datastore
from nova import flags
from nova import twistd
-from nova.tests.access_unittest import *
+#TODO(gundlach): rewrite and readd this after merge
+#from nova.tests.access_unittest import *
from nova.tests.auth_unittest import *
from nova.tests.api_unittest import *
from nova.tests.cloud_unittest import *
generated by cgit (git 2.34.1) at 2025-09-24 13:08:47 +0000