From c910b470e61a35230bc7ddaced13c3d51fac32fd Mon Sep 17 00:00:00 2001 From: andy Date: Thu, 24 Jun 2010 04:11:53 +0100 Subject: re-added cloudpipe Conflicts: bin/nova-manage nova/auth/users.py nova/compute/network.py --- nova/cloudpipe/__init__.py | 26 ++++++++++++ nova/cloudpipe/api.py | 70 +++++++++++++++++++++++++++++++ nova/cloudpipe/bootscript.sh | 58 ++++++++++++++++++++++++++ nova/cloudpipe/client.ovpn.template | 41 ++++++++++++++++++ nova/cloudpipe/pipelib.py | 83 +++++++++++++++++++++++++++++++++++++ 5 files changed, 278 insertions(+) create mode 100644 nova/cloudpipe/__init__.py create mode 100644 nova/cloudpipe/api.py create mode 100755 nova/cloudpipe/bootscript.sh create mode 100644 nova/cloudpipe/client.ovpn.template create mode 100644 nova/cloudpipe/pipelib.py (limited to 'nova/cloudpipe') diff --git a/nova/cloudpipe/__init__.py b/nova/cloudpipe/__init__.py new file mode 100644 index 000000000..e8ac53976 --- /dev/null +++ b/nova/cloudpipe/__init__.py @@ -0,0 +1,26 @@ +# vim: tabstop=4 shiftwidth=4 softtabstop=4 +# Copyright [2010] [Anso Labs, LLC] +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +""" +:mod:`nova.cloudpipe` -- VPN Server Management +===================================================== + +.. automodule:: nova.cloudpipe + :platform: Unix + :synopsis: An OpenVPN server for every nova user. +.. moduleauthor:: Devin Carlen +.. moduleauthor:: Vishvananda Ishaya +.. moduleauthor:: Joshua McKenty +""" diff --git a/nova/cloudpipe/api.py b/nova/cloudpipe/api.py new file mode 100644 index 000000000..5395e9724 --- /dev/null +++ b/nova/cloudpipe/api.py @@ -0,0 +1,70 @@ +#!/usr/bin/python +# vim: tabstop=4 shiftwidth=4 softtabstop=4 +# Copyright [2010] [Anso Labs, LLC] +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +""" +Tornado REST API Request Handlers for CloudPipe +""" + +import logging +import urllib + +from nova import vendor +import tornado.web + +from nova import crypto +from nova.auth import users + +_log = logging.getLogger("api") +_log.setLevel(logging.DEBUG) + + +class CloudPipeRequestHandler(tornado.web.RequestHandler): + def get(self, path): + path = self.request.path + _log.debug( "Cloudpipe path is %s" % path) + self.manager = users.UserManager.instance() + if path.endswith("/getca/"): + self.send_root_ca() + elif path.endswith("/getcert/"): + _log.debug( "Getting zip for %s" % (path[9:])) + try: + self.send_signed_zip(self.path[9:]) + except Exception, err: + _log.debug('ERROR: %s\n' % str(err)) + raise tornado.web.HTTPError(404) + self.finish() + + def get_username_from_ip(self, ip): + cc = self.application.controllers['Cloud'] + instance = cc.get_instance_by_ip(ip) + return instance['owner_id'] + + def send_root_ca(self): + _log.debug( "Getting root ca") + username = self.get_username_from_ip(self.request.remote_ip) + self.set_header("Content-Type", "text/plain") + self.write(crypto.fetch_ca(username)) + + def send_signed_zip(self, username): + self.set_header("Content-Type", "application/zip") + self.write(self.manager.get_signed_zip(username)) + + def post(self, *args, **kwargs): + self.manager = users.UserManager.instance() + username = self.get_username_from_ip(self.request.remote_ip) + cert = self.get_argument('cert', '') + self.write(self.manager.sign_cert(urllib.unquote(cert), username)) + self.finish() diff --git a/nova/cloudpipe/bootscript.sh b/nova/cloudpipe/bootscript.sh new file mode 100755 index 000000000..bb710617e --- /dev/null +++ b/nova/cloudpipe/bootscript.sh @@ -0,0 +1,58 @@ +#!/bin/bash +# Copyright [2010] [Anso Labs, LLC] +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# This gets zipped and run on the cloudpipe-managed OpenVPN server + +export SUPERVISOR="http://10.255.255.1:8773/cloudpipe" +export VPN_IP=`ifconfig | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f2 | awk '{print $1}'` +export BROADCAST=`ifconfig | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f3 | awk '{print $1}'` +export DHCP_MASK=`ifconfig | grep 'inet addr:'| grep -v '127.0.0.1' | cut -d: -f4 | awk '{print $1}'` +export GATEWAY=`netstat -r | grep default | cut -d' ' -f10` +export SUBJ=/C=US/ST=California/L=Mountain View/O=Anso Labs/OU=Nova Dev/CN=customer-vpn-$VPN_IP + +DHCP_LOWER=`echo $BROADCAST | awk -F. '{print $1"."$2"."$3"." $4 - 10 }'` +DHCP_UPPER=`echo $BROADCAST | awk -F. '{print $1"."$2"."$3"." $4 - 1 }'` + +# generate a server DH +openssl dhparam -out /etc/openvpn/dh1024.pem 1024 + +# generate a server priv key +openssl genrsa -out /etc/openvpn/server.key 2048 + +# generate a server CSR +openssl req -new -key /etc/openvpn/server.key -out /etc/openvpn/server.csr -batch -subj "$SUBJ" + +# URLEncode the CSR +CSRTEXT=`cat /etc/openvpn/server.csr` +CSRTEXT=$(python -c "import urllib; print urllib.quote('''$CSRTEXT''')") + +# SIGN the csr and save as server.crt +# CURL fetch to the supervisor, POSTing the CSR text, saving the result as the CRT file +curl $SUPERVISOR -d "cert=$CSRTEXT" > /etc/openvpn/server.crt +curl $SUPERVISOR/getca/ > /etc/openvpn/ca.crt + +# Customize the server.conf.template +cd /etc/openvpn + +sed -e s/VPN_IP/$VPN_IP/g server.conf.template > server.conf +sed -i -e s/DHCP_SUBNET/$DHCP_MASK/g server.conf +sed -i -e s/DHCP_LOWER/$DHCP_LOWER/g server.conf +sed -i -e s/DHCP_UPPER/$DHCP_UPPER/g server.conf +sed -i -e s/max-clients\ 1/max-clients\ 10/g server.conf + +echo "\npush \"route 10.255.255.1 255.255.255.255 $GATEWAY\"\n" >> server.conf +echo "\npush \"route 10.255.255.253 255.255.255.255 $GATEWAY\"\n" >> server.conf + +/etc/init.d/openvpn start diff --git a/nova/cloudpipe/client.ovpn.template b/nova/cloudpipe/client.ovpn.template new file mode 100644 index 000000000..d6cf8e19c --- /dev/null +++ b/nova/cloudpipe/client.ovpn.template @@ -0,0 +1,41 @@ +# Copyright [2010] [Anso Labs, LLC] +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# NOVA user connection +# Edit the following lines to point to your cert files: +cert $certfile +key $keyfile + +ca cacert.pem + +client +dev tap +proto udp + +remote $ip $port +resolv-retry infinite +nobind + +# Downgrade privileges after initialization (non-Windows only) +user nobody +group nogroup +comp-lzo + +# Set log file verbosity. +verb 2 + +keepalive 10 120 +ping-timer-rem +persist-tun +persist-key diff --git a/nova/cloudpipe/pipelib.py b/nova/cloudpipe/pipelib.py new file mode 100644 index 000000000..f69486f3e --- /dev/null +++ b/nova/cloudpipe/pipelib.py @@ -0,0 +1,83 @@ +# Copyright [2010] [Anso Labs, LLC] +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +""" +CloudPipe - Build a user-data payload zip file, and launch +an instance with it. + +""" + +import logging +import os +import tempfile +from zipfile import ZipFile, ZIP_DEFLATED + +from nova import flags +from nova.auth import users +from nova import utils +from nova.endpoint import api + +FLAGS = flags.FLAGS + +flags.DEFINE_string('boot_script_template', + utils.abspath('cloudpipe/bootscript.sh'), + 'Template for script to run on cloudpipe instance boot') + +class CloudPipe(object): + def __init__(self, cloud_controller): + self.controller = cloud_controller + self.manager = users.UserManager.instance() + + def launch_vpn_instance(self, username): + logging.debug( "Launching VPN for %s" % (username)) + user = self.manager.get_user(username) + # Make a payload.zip + tmpfolder = tempfile.mkdtemp() + filename = "payload.zip" + zippath = os.path.join(tmpfolder, filename) + z = ZipFile(zippath, "w", ZIP_DEFLATED) + + z.write(FLAGS.boot_script_template,'autorun.sh') + z.close() + + self.setup_keypair(username) + zippy = open(zippath, "r") + context = api.APIRequestContext(handler=None, user=user) + + reservation = self.controller.run_instances(context, + user_data=zippy.read().encode("base64"), + max_count=1, + min_count=1, + image_id=FLAGS.vpn_image_id, + key_name="vpn-key", + security_groups=["vpn-secgroup"]) + zippy.close() + + def setup_keypair(self, username): + try: + private_key, fingerprint = self.manager.generate_key_pair(username, "vpn-key") + os.mkdir("%s/%s" % (FLAGS.keys_path, username)) + private_key.save(os.path.abspath("%s/%s" % (FLAGS.keys_path, username))) + except: + pass + + # def setup_secgroups(self, username): + # conn = self.euca.connection_for(username) + # try: + # secgroup = conn.create_security_group("vpn-secgroup", "vpn-secgroup") + # secgroup.authorize(ip_protocol = "udp", from_port = "1194", to_port = "1194", cidr_ip = "0.0.0.0/0") + # secgroup.authorize(ip_protocol = "tcp", from_port = "80", to_port = "80", cidr_ip = "0.0.0.0/0") + # secgroup.authorize(ip_protocol = "tcp", from_port = "22", to_port = "22", cidr_ip = "0.0.0.0/0") + # except: + # pass -- cgit