From c095b70179cfb926f6acf947f205e3584717b6e0 Mon Sep 17 00:00:00 2001
From: Ahmad Hassan <ahmad.hassan@hp.com>
Date: Mon, 3 Oct 2011 10:35:56 +0100
Subject: Enable admin access to EC2 API server

Add a flag which allows you to enable or disable EC2 admin api through
nova flag. Is is similar to allow_admin_api for OS API.
Fixes bug 869908.

Change-Id: I0c786f7cd5f5c3470edc23f0b9b84e5dff1714e2
---
 nova/api/ec2/__init__.py   |  4 ++++
 nova/api/ec2/apirequest.py | 14 +++++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

(limited to 'nova/api')

diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index 4b4c0f536..fde1377db 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -391,6 +391,10 @@ class Executor(wsgi.Application):
             LOG.info(_('NotAuthorized raised: %s'), unicode(ex),
                     context=context)
             return self._error(req, context, type(ex).__name__, unicode(ex))
+        except exception.InvalidRequest as ex:
+            LOG.debug(_('InvalidRequest raised: %s'), unicode(ex),
+                     context=context)
+            return self._error(req, context, type(ex).__name__, unicode(ex))
         except Exception as ex:
             extra = {'environment': req.environ}
             LOG.exception(_('Unexpected error raised: %s'), unicode(ex),
diff --git a/nova/api/ec2/apirequest.py b/nova/api/ec2/apirequest.py
index 9a3e55925..61b5ba3a5 100644
--- a/nova/api/ec2/apirequest.py
+++ b/nova/api/ec2/apirequest.py
@@ -24,10 +24,14 @@ import datetime
 # TODO(termie): replace minidom with etree
 from xml.dom import minidom
 
+from nova import flags
 from nova import log as logging
+from nova import exception
 from nova.api.ec2 import ec2utils
+from nova.api.ec2.admin import AdminController
 
 LOG = logging.getLogger("nova.api.request")
+FLAGS = flags.FLAGS
 
 
 def _underscore_to_camelcase(str):
@@ -53,6 +57,14 @@ class APIRequest(object):
 
     def invoke(self, context):
         try:
+            # Raise NotImplemented exception for Admin specific request if
+            # admin flag is set to false in nova.conf
+            if (isinstance(self.controller, AdminController) and
+                          (not FLAGS.allow_ec2_admin_api)):
+                ## Raise InvalidRequest exception for EC2 Admin interface ##
+                LOG.exception("Unsupported API request")
+                raise exception.InvalidRequest()
+
             method = getattr(self.controller,
                              ec2utils.camelcase_to_underscore(self.action))
         except AttributeError:
@@ -63,7 +75,7 @@ class APIRequest(object):
             LOG.exception(_error)
             # TODO: Raise custom exception, trap in apiserver,
             #       and reraise as 400 error.
-            raise Exception(_error)
+            raise exception.InvalidRequest()
 
         args = ec2utils.dict_from_dotted_str(self.args.items())
 
-- 
cgit