Statistics
| Branch: | Tag: | Revision:

root / daemons / ganeti-rapi @ 16b037a9

History | View | Annotate | Download (7.2 kB)

1 8c229cc7 Oleksiy Mishchenko
#!/usr/bin/python
2 8c229cc7 Oleksiy Mishchenko
#
3 8c229cc7 Oleksiy Mishchenko
4 8c229cc7 Oleksiy Mishchenko
# Copyright (C) 2006, 2007 Google Inc.
5 8c229cc7 Oleksiy Mishchenko
#
6 8c229cc7 Oleksiy Mishchenko
# This program is free software; you can redistribute it and/or modify
7 8c229cc7 Oleksiy Mishchenko
# it under the terms of the GNU General Public License as published by
8 8c229cc7 Oleksiy Mishchenko
# the Free Software Foundation; either version 2 of the License, or
9 8c229cc7 Oleksiy Mishchenko
# (at your option) any later version.
10 8c229cc7 Oleksiy Mishchenko
#
11 8c229cc7 Oleksiy Mishchenko
# This program is distributed in the hope that it will be useful, but
12 8c229cc7 Oleksiy Mishchenko
# WITHOUT ANY WARRANTY; without even the implied warranty of
13 8c229cc7 Oleksiy Mishchenko
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14 8c229cc7 Oleksiy Mishchenko
# General Public License for more details.
15 8c229cc7 Oleksiy Mishchenko
#
16 8c229cc7 Oleksiy Mishchenko
# You should have received a copy of the GNU General Public License
17 8c229cc7 Oleksiy Mishchenko
# along with this program; if not, write to the Free Software
18 8c229cc7 Oleksiy Mishchenko
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
19 8c229cc7 Oleksiy Mishchenko
# 02110-1301, USA.
20 8c229cc7 Oleksiy Mishchenko
21 7260cfbe Iustin Pop
"""Ganeti Remote API master script.
22 7260cfbe Iustin Pop
23 8c229cc7 Oleksiy Mishchenko
"""
24 8c229cc7 Oleksiy Mishchenko
25 7260cfbe Iustin Pop
# pylint: disable-msg=C0103,W0142
26 7260cfbe Iustin Pop
27 7260cfbe Iustin Pop
# C0103: Invalid name ganeti-watcher
28 7260cfbe Iustin Pop
29 441e7cfd Oleksiy Mishchenko
import logging
30 8c229cc7 Oleksiy Mishchenko
import optparse
31 8c229cc7 Oleksiy Mishchenko
import sys
32 8c229cc7 Oleksiy Mishchenko
import os
33 b5b67ef9 Michael Hanselmann
import os.path
34 8c229cc7 Oleksiy Mishchenko
35 8c229cc7 Oleksiy Mishchenko
from ganeti import constants
36 3cd62121 Michael Hanselmann
from ganeti import http
37 16a8967d Michael Hanselmann
from ganeti import daemon
38 5675cd1f Iustin Pop
from ganeti import ssconf
39 77e1d753 Iustin Pop
from ganeti import luxi
40 1f8588f6 Iustin Pop
from ganeti import serializer
41 3cd62121 Michael Hanselmann
from ganeti.rapi import connector
42 3cd62121 Michael Hanselmann
43 30e4e741 Iustin Pop
import ganeti.http.auth   # pylint: disable-msg=W0611
44 bc2929fc Michael Hanselmann
import ganeti.http.server
45 3cd62121 Michael Hanselmann
46 bc2929fc Michael Hanselmann
47 7e9760c3 Michael Hanselmann
class RemoteApiRequestContext(object):
48 7e9760c3 Michael Hanselmann
  """Data structure for Remote API requests.
49 7e9760c3 Michael Hanselmann
50 7e9760c3 Michael Hanselmann
  """
51 7e9760c3 Michael Hanselmann
  def __init__(self):
52 7e9760c3 Michael Hanselmann
    self.handler = None
53 7e9760c3 Michael Hanselmann
    self.handler_fn = None
54 b5b67ef9 Michael Hanselmann
    self.handler_access = None
55 ab221ddf Michael Hanselmann
    self.body_data = None
56 7e9760c3 Michael Hanselmann
57 7e9760c3 Michael Hanselmann
58 1f8588f6 Iustin Pop
class JsonErrorRequestExecutor(http.server.HttpServerRequestExecutor):
59 1f8588f6 Iustin Pop
  """Custom Request Executor class that formats HTTP errors in JSON.
60 1f8588f6 Iustin Pop
61 1f8588f6 Iustin Pop
  """
62 16b037a9 Michael Hanselmann
  error_content_type = http.HTTP_APP_JSON
63 1f8588f6 Iustin Pop
64 1f8588f6 Iustin Pop
  def _FormatErrorMessage(self, values):
65 1f8588f6 Iustin Pop
    """Formats the body of an error message.
66 1f8588f6 Iustin Pop
67 1f8588f6 Iustin Pop
    @type values: dict
68 1f8588f6 Iustin Pop
    @param values: dictionary with keys code, message and explain.
69 1f8588f6 Iustin Pop
    @rtype: string
70 1f8588f6 Iustin Pop
    @return: the body of the message
71 1f8588f6 Iustin Pop
72 1f8588f6 Iustin Pop
    """
73 1f8588f6 Iustin Pop
    return serializer.DumpJson(values, indent=True)
74 1f8588f6 Iustin Pop
75 1f8588f6 Iustin Pop
76 b5b67ef9 Michael Hanselmann
class RemoteApiHttpServer(http.auth.HttpServerRequestAuthentication,
77 b5b67ef9 Michael Hanselmann
                          http.server.HttpServer):
78 3cd62121 Michael Hanselmann
  """REST Request Handler Class.
79 3cd62121 Michael Hanselmann
80 3cd62121 Michael Hanselmann
  """
81 b5b67ef9 Michael Hanselmann
  AUTH_REALM = "Ganeti Remote API"
82 b5b67ef9 Michael Hanselmann
83 16a8967d Michael Hanselmann
  def __init__(self, *args, **kwargs):
84 bc2929fc Michael Hanselmann
    http.server.HttpServer.__init__(self, *args, **kwargs)
85 b5b67ef9 Michael Hanselmann
    http.auth.HttpServerRequestAuthentication.__init__(self)
86 3cd62121 Michael Hanselmann
    self._resmap = connector.Mapper()
87 3cd62121 Michael Hanselmann
88 b5b67ef9 Michael Hanselmann
    # Load password file
89 b5b67ef9 Michael Hanselmann
    if os.path.isfile(constants.RAPI_USERS_FILE):
90 b5b67ef9 Michael Hanselmann
      self._users = http.auth.ReadPasswordFile(constants.RAPI_USERS_FILE)
91 b5b67ef9 Michael Hanselmann
    else:
92 b5b67ef9 Michael Hanselmann
      self._users = None
93 b5b67ef9 Michael Hanselmann
94 7e9760c3 Michael Hanselmann
  def _GetRequestContext(self, req):
95 7e9760c3 Michael Hanselmann
    """Returns the context for a request.
96 7e9760c3 Michael Hanselmann
97 7e9760c3 Michael Hanselmann
    The context is cached in the req.private variable.
98 7e9760c3 Michael Hanselmann
99 7e9760c3 Michael Hanselmann
    """
100 7e9760c3 Michael Hanselmann
    if req.private is None:
101 85414b69 Iustin Pop
      (HandlerClass, items, args) = \
102 85414b69 Iustin Pop
                     self._resmap.getController(req.request_path)
103 7e9760c3 Michael Hanselmann
104 7e9760c3 Michael Hanselmann
      ctx = RemoteApiRequestContext()
105 7e9760c3 Michael Hanselmann
      ctx.handler = HandlerClass(items, args, req)
106 7e9760c3 Michael Hanselmann
107 7e9760c3 Michael Hanselmann
      method = req.request_method.upper()
108 7e9760c3 Michael Hanselmann
      try:
109 7e9760c3 Michael Hanselmann
        ctx.handler_fn = getattr(ctx.handler, method)
110 f4ad2ef0 Iustin Pop
      except AttributeError:
111 6e99c5a0 Iustin Pop
        raise http.HttpBadRequest("Method %s is unsupported for path %s" %
112 6e99c5a0 Iustin Pop
                                  (method, req.request_path))
113 7e9760c3 Michael Hanselmann
114 b5b67ef9 Michael Hanselmann
      ctx.handler_access = getattr(ctx.handler, "%s_ACCESS" % method, None)
115 b5b67ef9 Michael Hanselmann
116 b5b67ef9 Michael Hanselmann
      # Require permissions definition (usually in the base class)
117 b5b67ef9 Michael Hanselmann
      if ctx.handler_access is None:
118 b5b67ef9 Michael Hanselmann
        raise AssertionError("Permissions definition missing")
119 b5b67ef9 Michael Hanselmann
120 ab221ddf Michael Hanselmann
      # This is only made available in HandleRequest
121 ab221ddf Michael Hanselmann
      ctx.body_data = None
122 ab221ddf Michael Hanselmann
123 7e9760c3 Michael Hanselmann
      req.private = ctx
124 7e9760c3 Michael Hanselmann
125 7e9760c3 Michael Hanselmann
    return req.private
126 7e9760c3 Michael Hanselmann
127 85414b69 Iustin Pop
  def GetAuthRealm(self, req):
128 85414b69 Iustin Pop
    """Override the auth realm for queries.
129 85414b69 Iustin Pop
130 85414b69 Iustin Pop
    """
131 85414b69 Iustin Pop
    ctx = self._GetRequestContext(req)
132 85414b69 Iustin Pop
    if ctx.handler_access:
133 85414b69 Iustin Pop
      return self.AUTH_REALM
134 85414b69 Iustin Pop
    else:
135 85414b69 Iustin Pop
      return None
136 85414b69 Iustin Pop
137 b5b67ef9 Michael Hanselmann
  def Authenticate(self, req, username, password):
138 b5b67ef9 Michael Hanselmann
    """Checks whether a user can access a resource.
139 b5b67ef9 Michael Hanselmann
140 b5b67ef9 Michael Hanselmann
    """
141 b5b67ef9 Michael Hanselmann
    ctx = self._GetRequestContext(req)
142 b5b67ef9 Michael Hanselmann
143 b5b67ef9 Michael Hanselmann
    # Check username and password
144 b5b67ef9 Michael Hanselmann
    valid_user = False
145 b5b67ef9 Michael Hanselmann
    if self._users:
146 b5b67ef9 Michael Hanselmann
      user = self._users.get(username, None)
147 0b08f096 Michael Hanselmann
      if user and self.VerifyBasicAuthPassword(req, username, password,
148 0b08f096 Michael Hanselmann
                                               user.password):
149 b5b67ef9 Michael Hanselmann
        valid_user = True
150 b5b67ef9 Michael Hanselmann
151 b5b67ef9 Michael Hanselmann
    if not valid_user:
152 b5b67ef9 Michael Hanselmann
      # Unknown user or password wrong
153 b5b67ef9 Michael Hanselmann
      return False
154 b5b67ef9 Michael Hanselmann
155 b5b67ef9 Michael Hanselmann
    if (not ctx.handler_access or
156 b5b67ef9 Michael Hanselmann
        set(user.options).intersection(ctx.handler_access)):
157 b5b67ef9 Michael Hanselmann
      # Allow access
158 b5b67ef9 Michael Hanselmann
      return True
159 b5b67ef9 Michael Hanselmann
160 b5b67ef9 Michael Hanselmann
    # Access forbidden
161 b5b67ef9 Michael Hanselmann
    raise http.HttpForbidden()
162 b5b67ef9 Michael Hanselmann
163 16a8967d Michael Hanselmann
  def HandleRequest(self, req):
164 16a8967d Michael Hanselmann
    """Handles a request.
165 3cd62121 Michael Hanselmann
166 3cd62121 Michael Hanselmann
    """
167 7e9760c3 Michael Hanselmann
    ctx = self._GetRequestContext(req)
168 3cd62121 Michael Hanselmann
169 ab221ddf Michael Hanselmann
    # Deserialize request parameters
170 ab221ddf Michael Hanselmann
    if req.request_body:
171 ab221ddf Michael Hanselmann
      # RFC2616, 7.2.1: Any HTTP/1.1 message containing an entity-body SHOULD
172 ab221ddf Michael Hanselmann
      # include a Content-Type header field defining the media type of that
173 ab221ddf Michael Hanselmann
      # body. [...] If the media type remains unknown, the recipient SHOULD
174 ab221ddf Michael Hanselmann
      # treat it as type "application/octet-stream".
175 ab221ddf Michael Hanselmann
      req_content_type = req.request_headers.get(http.HTTP_CONTENT_TYPE,
176 ab221ddf Michael Hanselmann
                                                 http.HTTP_APP_OCTET_STREAM)
177 16b037a9 Michael Hanselmann
      if req_content_type.lower() != http.HTTP_APP_JSON.lower():
178 ab221ddf Michael Hanselmann
        raise http.HttpUnsupportedMediaType()
179 ab221ddf Michael Hanselmann
180 ab221ddf Michael Hanselmann
      try:
181 ab221ddf Michael Hanselmann
        ctx.body_data = serializer.LoadJson(req.request_body)
182 ab221ddf Michael Hanselmann
      except Exception:
183 ab221ddf Michael Hanselmann
        raise http.HttpBadRequest(message="Unable to parse JSON data")
184 ab221ddf Michael Hanselmann
    else:
185 ab221ddf Michael Hanselmann
      ctx.body_data = None
186 ab221ddf Michael Hanselmann
187 3cd62121 Michael Hanselmann
    try:
188 7e9760c3 Michael Hanselmann
      result = ctx.handler_fn()
189 77e1d753 Iustin Pop
    except luxi.TimeoutError:
190 77e1d753 Iustin Pop
      raise http.HttpGatewayTimeout()
191 77e1d753 Iustin Pop
    except luxi.ProtocolError, err:
192 77e1d753 Iustin Pop
      raise http.HttpBadGateway(str(err))
193 16a8967d Michael Hanselmann
    except:
194 e09fdcfa Iustin Pop
      method = req.request_method.upper()
195 16a8967d Michael Hanselmann
      logging.exception("Error while handling the %s request", method)
196 16a8967d Michael Hanselmann
      raise
197 3cd62121 Michael Hanselmann
198 16b037a9 Michael Hanselmann
    req.resp_headers[http.HTTP_CONTENT_TYPE] = http.HTTP_APP_JSON
199 ab221ddf Michael Hanselmann
200 ab221ddf Michael Hanselmann
    return serializer.DumpJson(result)
201 8c229cc7 Oleksiy Mishchenko
202 8c229cc7 Oleksiy Mishchenko
203 6c948699 Michael Hanselmann
def CheckRapi(options, args):
204 6c948699 Michael Hanselmann
  """Initial checks whether to run or exit with a failure.
205 8c229cc7 Oleksiy Mishchenko
206 8c229cc7 Oleksiy Mishchenko
  """
207 f93427cd Iustin Pop
  if args: # rapi doesn't take any arguments
208 f93427cd Iustin Pop
    print >> sys.stderr, ("Usage: %s [-f] [-d] [-p port] [-b ADDRESS]" %
209 f93427cd Iustin Pop
                          sys.argv[0])
210 be73fc79 Guido Trotter
    sys.exit(constants.EXIT_FAILURE)
211 8c229cc7 Oleksiy Mishchenko
212 04ccf5e9 Guido Trotter
  ssconf.CheckMaster(options.debug)
213 8c229cc7 Oleksiy Mishchenko
214 8c229cc7 Oleksiy Mishchenko
215 2d54e29c Iustin Pop
def ExecRapi(options, _):
216 6c948699 Michael Hanselmann
  """Main remote API function, executed with the PID file held.
217 8c229cc7 Oleksiy Mishchenko
218 8c229cc7 Oleksiy Mishchenko
  """
219 04ccf5e9 Guido Trotter
  # Read SSL certificate
220 2ed6a7d6 Iustin Pop
  if options.ssl:
221 04ccf5e9 Guido Trotter
    ssl_params = http.HttpSslParams(ssl_key_path=options.ssl_key,
222 04ccf5e9 Guido Trotter
                                    ssl_cert_path=options.ssl_cert)
223 2ed6a7d6 Iustin Pop
  else:
224 2ed6a7d6 Iustin Pop
    ssl_params = None
225 2ed6a7d6 Iustin Pop
226 04ccf5e9 Guido Trotter
  mainloop = daemon.Mainloop()
227 04ccf5e9 Guido Trotter
  server = RemoteApiHttpServer(mainloop, options.bind_address, options.port,
228 04ccf5e9 Guido Trotter
                               ssl_params=ssl_params, ssl_verify_peer=False,
229 04ccf5e9 Guido Trotter
                               request_executor_class=JsonErrorRequestExecutor)
230 04ccf5e9 Guido Trotter
  server.Start()
231 04ccf5e9 Guido Trotter
  try:
232 04ccf5e9 Guido Trotter
    mainloop.Run()
233 04ccf5e9 Guido Trotter
  finally:
234 04ccf5e9 Guido Trotter
    server.Stop()
235 5675cd1f Iustin Pop
236 3cd62121 Michael Hanselmann
237 04ccf5e9 Guido Trotter
def main():
238 04ccf5e9 Guido Trotter
  """Main function.
239 441e7cfd Oleksiy Mishchenko
240 04ccf5e9 Guido Trotter
  """
241 04ccf5e9 Guido Trotter
  parser = optparse.OptionParser(description="Ganeti Remote API",
242 04ccf5e9 Guido Trotter
                    usage="%prog [-f] [-d] [-p port] [-b ADDRESS]",
243 04ccf5e9 Guido Trotter
                    version="%%prog (ganeti) %s" % constants.RAPI_VERSION)
244 04ccf5e9 Guido Trotter
245 04ccf5e9 Guido Trotter
  dirs = [(val, constants.RUN_DIRS_MODE) for val in constants.SUB_RUN_DIRS]
246 04ccf5e9 Guido Trotter
  dirs.append((constants.LOG_OS_DIR, 0750))
247 0648750e Michael Hanselmann
  daemon.GenericMain(constants.RAPI, parser, dirs, CheckRapi, ExecRapi,
248 0648750e Michael Hanselmann
                     default_ssl_cert=constants.RAPI_CERT_FILE,
249 0648750e Michael Hanselmann
                     default_ssl_key=constants.RAPI_CERT_FILE)
250 8c229cc7 Oleksiy Mishchenko
251 8c229cc7 Oleksiy Mishchenko
252 6c948699 Michael Hanselmann
if __name__ == "__main__":
253 8c229cc7 Oleksiy Mishchenko
  main()