Under the covers, the autoinstaller uses our own patched version of +xen-create-image, which is a tool based on debootstrap. If you log +into the serial console while the install is running, you can watch +it. +""", + 'ParaVM Console': """ +ParaVM machines do not support local console access over VNC. To +access the serial console of these machines, you can SSH with Kerberos +to %s, using the name of the machine as your +username.""" % config.console.hostname, + 'HVM/ParaVM': """ +HVM machines use the virtualization features of the processor, while +ParaVM machines rely on a modified kernel to communicate directly with +the hypervisor. HVMs support boot CDs of any operating system, and +the VNC console applet. The three-minute autoinstaller produces +ParaVMs. ParaVMs typically are more efficient, and always support the +console server.
+ +More details are on the +wiki, including steps to prepare an HVM guest to boot as a ParaVM +(which you can skip by using the autoinstaller to begin with.)
+ +We recommend using a ParaVM when possible and an HVM when necessary.
+""",
+ 'CPU Weight': """
+Don't ask us! We're as mystified as you are.""",
+ 'Owner': """
+The owner field is used to determine quotas. It must be the name of a
+locker that you are an AFS administrator of. In particular, you or an
+AFS group you are a member of must have AFS rlidwka bits on the
+locker. You can check who administers the LOCKER locker using the
+commands 'attach LOCKER; fs la /mit/LOCKER' on Athena.) See also administrator.""",
+ 'Administrator': """
+The administrator field determines who can access the console and
+power on and off the machine. This can be either a user or a moira
+group.""",
+ 'Quotas': """
+Quotas are determined on a per-locker basis. Each locker may have a
+maximum of 512 mebibytes of active ram, 50 gibibytes of disk, and 4
+active machines.""",
+ 'Console': """
+Framebuffer: At a Linux boot prompt in your VM, try
+setting fb=false to disable the framebuffer. If you don't,
+your machine will run just fine, but the applet's display of the
+console will suffer artifacts.
+""",
+ 'Windows': """
+Windows Vista: The Vista image is licensed for all MIT students and will automatically activate off the network; see the licensing confirmation e-mail for details. The installer requires 512 MiB RAM and at least 7.5 GiB disk space (15 GiB or more recommended).
+Windows XP: This is the volume license CD image. You will need your own volume license key to complete the install. We do not have these available for the general MIT community; ask your department if they have one, or visit http://msca.mit.edu/ if you are staff/faculty to request one.
+"""
+ }
+
+ if not subject:
+ subject = sorted(help_mapping.keys())
+ if not isinstance(subject, list):
+ subject = [subject]
+
+ return dict(simple=simple,
+ subjects=subject,
+ mapping=help_mapping)
+ help._cp_config['tools.require_login.on'] = False
+
+ def parseCreate(self, fields):
+ kws = dict([(kw, fields[kw]) for kw in
+ 'name description owner memory disksize vmtype cdrom autoinstall'.split()
+ if fields[kw]])
+ validate = validation.Validate(cherrypy.request.login,
+ cherrypy.request.state,
+ strict=True, **kws)
+ return dict(contact=cherrypy.request.login, name=validate.name,
+ description=validate.description, memory=validate.memory,
+ disksize=validate.disksize, owner=validate.owner,
+ machine_type=getattr(validate, 'vmtype', Defaults.type),
+ cdrom=getattr(validate, 'cdrom', None),
+ autoinstall=getattr(validate, 'autoinstall', None))
+
+ @cherrypy.expose
+ @cherrypy.tools.mako(filename="/list.mako")
+ @cherrypy.tools.require_POST()
+ def create(self, **fields):
+ """Handler for create requests."""
+ try:
+ parsed_fields = self.parseCreate(fields)
+ machine = controls.createVm(cherrypy.request.login,
+ cherrypy.request.state, **parsed_fields)
+ except InvalidInput, err:
+ pass
+ else:
+ err = None
+ cherrypy.request.state.clear() #Changed global state
+ d = getListDict(cherrypy.request.login, cherrypy.request.state)
+ d['err'] = err
+ if err:
+ for field, value in fields.items():
+ setattr(d['defaults'], field, value)
+ else:
+ d['new_machine'] = parsed_fields['name']
+ return d
+
+ @cherrypy.expose
+ @cherrypy.tools.mako(filename="/helloworld.mako")
+ def helloworld(self, **kwargs):
+ return {'request': cherrypy.request, 'kwargs': kwargs}
+ helloworld._cp_config['tools.require_login.on'] = False
+
+ @cherrypy.expose
+ def errortest(self):
+ """Throw an error, to test the error-tracing mechanisms."""
+ print >>sys.stderr, "look ma, it's a stderr"
+ raise RuntimeError("test of the emergency broadcast system")
+
+ class MachineView(View):
+ def __getattr__(self, name):
+ """Synthesize attributes to allow RESTful URLs like
+ /machine/13/info. This is hairy. CherryPy 3.2 adds a
+ method called _cp_dispatch that allows you to explicitly
+ handle URLs that can't be mapped, and it allows you to
+ rewrite the path components and continue processing.
+
+ This function gets the next path component being resolved
+ as a string. _cp_dispatch will get an array of strings
+ representing any subsequent path components as well."""
+
+ try:
+ cherrypy.request.params['machine_id'] = int(name)
+ return self
+ except ValueError:
+ return None
+
+ @cherrypy.expose
+ @cherrypy.tools.mako(filename="/info.mako")
+ def info(self, machine_id):
+ """Handler for info on a single VM."""
+ machine = validation.Validate(cherrypy.request.login,
+ cherrypy.request.state,
+ machine_id=machine_id).machine
+ d = infoDict(cherrypy.request.login, cherrypy.request.state, machine)
+ return d
+ index = info
+
+ @cherrypy.expose
+ @cherrypy.tools.mako(filename="/info.mako")
+ @cherrypy.tools.require_POST()
+ def modify(self, machine_id, **fields):
+ """Handler for modifying attributes of a machine."""
+ try:
+ modify_dict = modifyDict(cherrypy.request.login,
+ cherrypy.request.state,
+ machine_id, fields)
+ except InvalidInput, err:
+ result = None
+ machine = validation.Validate(cherrypy.request.login,
+ cherrypy.request.state,
+ machine_id=machine_id).machine
+ else:
+ machine = modify_dict['machine']
+ result = 'Success!'
+ err = None
+ info_dict = infoDict(cherrypy.request.login,
+ cherrypy.request.state, machine)
+ info_dict['err'] = err
+ if err:
+ for field, value in fields.items():
+ setattr(info_dict['defaults'], field, value)
+ info_dict['result'] = result
+ return info_dict
+
+ @cherrypy.expose
+ @cherrypy.tools.mako(filename="/vnc.mako")
+ def vnc(self, machine_id):
+ """VNC applet page.
+
+ Note that due to same-domain restrictions, the applet connects to
+ the webserver, which needs to forward those requests to the xen
+ server. The Xen server runs another proxy that (1) authenticates
+ and (2) finds the correct port for the VM.
+
+ You might want iptables like:
+
+ -t nat -A PREROUTING -s ! 18.181.0.60 -i eth1 -p tcp -m tcp \
+ --dport 10003 -j DNAT --to-destination 18.181.0.60:10003
+ -t nat -A POSTROUTING -d 18.181.0.60 -o eth1 -p tcp -m tcp \
+ --dport 10003 -j SNAT --to-source 18.187.7.142
+ -A FORWARD -d 18.181.0.60 -i eth1 -o eth1 -p tcp -m tcp \
+ --dport 10003 -j ACCEPT
+
+ Remember to enable iptables!
+ echo 1 > /proc/sys/net/ipv4/ip_forward
+ """
+ machine = validation.Validate(cherrypy.request.login,
+ cherrypy.request.state,
+ machine_id=machine_id).machine
+ token = controls.vnctoken(machine)
+ host = controls.listHost(machine)
+ if host:
+ port = 10003 + [h.hostname for h in config.hosts].index(host)
+ else:
+ port = 5900 # dummy
+
+ status = controls.statusInfo(machine)
+ has_vnc = hasVnc(status)
+
+ d = dict(on=status,
+ has_vnc=has_vnc,
+ machine=machine,
+ hostname=cherrypy.request.local.name,
+ port=port,
+ authtoken=token)
+ return d
+
+ @cherrypy.expose
+ @cherrypy.tools.mako(filename="/command.mako")
+ @cherrypy.tools.require_POST()
+ def command(self, command_name, machine_id, **kwargs):
+ """Handler for running commands like boot and delete on a VM."""
+ back = kwargs.get('back')
+ if command_name == 'delete':
+ back = 'list'
+ try:
+ d = controls.commandResult(cherrypy.request.login,
+ cherrypy.request.state,
+ command_name, machine_id, kwargs)
+ except InvalidInput, err:
+ if not back:
+ raise
+ print >> sys.stderr, err
+ result = str(err)
+ else:
+ result = 'Success!'
+ if not back:
+ return d
+ if back == 'list':
+ cherrypy.request.state.clear() #Changed global state
+ raise cherrypy.InternalRedirect('/list?result=%s'
+ % urllib.quote(result))
+ elif back == 'info':
+ raise cherrypy.HTTPRedirect(cherrypy.request.base
+ + '/machine/%d/' % machine_id,
+ status=303)
+ else:
+ raise InvalidInput('back', back, 'Not a known back page.')
+
+ machine = MachineView()
+
+
+class Defaults:
+ """Class to store default values for fields."""
+ memory = 256
+ disk = 4.0
+ cdrom = ''
+ autoinstall = ''
+ name = ''
+ description = ''
+ administrator = ''
+ type = 'linux-hvm'
+
+ def __init__(self, max_memory=None, max_disk=None, **kws):
+ if max_memory is not None:
+ self.memory = min(self.memory, max_memory)
+ if max_disk is not None:
+ self.disk = min(self.disk, max_disk)
+ for key in kws:
+ setattr(self, key, kws[key])
+
+def hasVnc(status):
+ """Does the machine with a given status list support VNC?"""
+ if status is None:
+ return False
+ for l in status:
+ if l[0] == 'device' and l[1][0] == 'vfb':
+ d = dict(l[1][1:])
+ return 'location' in d
+ return False
+
+
+def getListDict(username, state):
+ """Gets the list of local variables used by list.tmpl."""
+ machines = state.machines
+ on = {}
+ has_vnc = {}
+ installing = {}
+ xmlist = state.xmlist
+ for m in machines:
+ if m not in xmlist:
+ has_vnc[m] = 'Off'
+ m.uptime = None
+ else:
+ m.uptime = xmlist[m]['uptime']
+ installing[m] = bool(xmlist[m].get('autoinstall'))
+ if xmlist[m]['console']:
+ has_vnc[m] = True
+ elif m.type.hvm:
+ has_vnc[m] = "WTF?"
+ else:
+ has_vnc[m] = "ParaVM"
+ max_memory = validation.maxMemory(username, state)
+ max_disk = validation.maxDisk(username)
+ defaults = Defaults(max_memory=max_memory,
+ max_disk=max_disk,
+ owner=username)
+ def sortkey(machine):
+ return (machine.owner != username, machine.owner, machine.name)
+ machines = sorted(machines, key=sortkey)
+ d = dict(user=username,
+ cant_add_vm=validation.cantAddVm(username, state),
+ max_memory=max_memory,
+ max_disk=max_disk,
+ defaults=defaults,
+ machines=machines,
+ has_vnc=has_vnc,
+ installing=installing)
+ return d
+
+def getHostname(nic):
+ """Find the hostname associated with a NIC.
+
+ XXX this should be merged with the similar logic in DNS and DHCP.
+ """
+ if nic.hostname:
+ hostname = nic.hostname
+ elif nic.machine:
+ hostname = nic.machine.name
+ else:
+ return None
+ if '.' in hostname:
+ return hostname
+ else:
+ return hostname + '.' + config.dns.domains[0]
+
+def getNicInfo(data_dict, machine):
+ """Helper function for info, get data on nics for a machine.
+
+ Modifies data_dict to include the relevant data, and returns a list
+ of (key, name) pairs to display "name: data_dict[key]" to the user.
+ """
+ data_dict['num_nics'] = len(machine.nics)
+ nic_fields_template = [('nic%s_hostname', 'NIC %s Hostname'),
+ ('nic%s_mac', 'NIC %s MAC Addr'),
+ ('nic%s_ip', 'NIC %s IP'),
+ ]
+ nic_fields = []
+ for i in range(len(machine.nics)):
+ nic_fields.extend([(x % i, y % i) for x, y in nic_fields_template])
+ data_dict['nic%s_hostname' % i] = getHostname(machine.nics[i])
+ data_dict['nic%s_mac' % i] = machine.nics[i].mac_addr
+ data_dict['nic%s_ip' % i] = machine.nics[i].ip
+ if len(machine.nics) == 1:
+ nic_fields = [(x, y.replace('NIC 0 ', '')) for x, y in nic_fields]
+ return nic_fields
+
+def getDiskInfo(data_dict, machine):
+ """Helper function for info, get data on disks for a machine.
+
+ Modifies data_dict to include the relevant data, and returns a list
+ of (key, name) pairs to display "name: data_dict[key]" to the user.
+ """
+ data_dict['num_disks'] = len(machine.disks)
+ disk_fields_template = [('%s_size', '%s size')]
+ disk_fields = []
+ for disk in machine.disks:
+ name = disk.guest_device_name
+ disk_fields.extend([(x % name, y % name) for x, y in
+ disk_fields_template])
+ data_dict['%s_size' % name] = "%0.1f GiB" % (disk.size / 1024.)
+ return disk_fields
+
+def modifyDict(username, state, machine_id, fields):
+ """Modify a machine as specified by CGI arguments.
+
+ Return a dict containing the machine that was modified.
+ """
+ olddisk = {}
+ session.begin()
+ try:
+ kws = dict((kw, fields[kw]) for kw in
+ 'owner admin contact name description memory vmtype disksize'.split()
+ if fields.get(kw))
+ kws['machine_id'] = machine_id
+ validate = validation.Validate(username, state, **kws)
+ machine = validate.machine
+ oldname = machine.name
+
+ if hasattr(validate, 'memory'):
+ machine.memory = validate.memory
+
+ if hasattr(validate, 'vmtype'):
+ machine.type = validate.vmtype
+
+ if hasattr(validate, 'disksize'):
+ disksize = validate.disksize
+ disk = machine.disks[0]
+ if disk.size != disksize:
+ olddisk[disk.guest_device_name] = disksize
+ disk.size = disksize
+ session.save_or_update(disk)
+
+ update_acl = False
+ if hasattr(validate, 'owner') and validate.owner != machine.owner:
+ machine.owner = validate.owner
+ update_acl = True
+ if hasattr(validate, 'name'):
+ machine.name = validate.name
+ for n in machine.nics:
+ if n.hostname == oldname:
+ n.hostname = validate.name
+ if hasattr(validate, 'description'):
+ machine.description = validate.description
+ if hasattr(validate, 'admin') and validate.admin != machine.administrator:
+ machine.administrator = validate.admin
+ update_acl = True
+ if hasattr(validate, 'contact'):
+ machine.contact = validate.contact
+
+ session.save_or_update(machine)
+ if update_acl:
+ cache_acls.refreshMachine(machine)
+ session.commit()
+ except:
+ session.rollback()
+ raise
+ for diskname in olddisk:
+ controls.resizeDisk(oldname, diskname, str(olddisk[diskname]))
+ if hasattr(validate, 'name'):
+ controls.renameMachine(machine, oldname, validate.name)
+ return dict(machine=machine)
+
+def infoDict(username, state, machine):
+ """Get the variables used by info.tmpl."""
+ status = controls.statusInfo(machine)
+ has_vnc = hasVnc(status)
+ if status is None:
+ main_status = dict(name=machine.name,
+ memory=str(machine.memory))
+ uptime = None
+ cputime = None
+ else:
+ main_status = dict(status[1:])
+ main_status['host'] = controls.listHost(machine)
+ start_time = float(main_status.get('start_time', 0))
+ uptime = datetime.timedelta(seconds=int(time.time()-start_time))
+ cpu_time_float = float(main_status.get('cpu_time', 0))
+ cputime = datetime.timedelta(seconds=int(cpu_time_float))
+ display_fields = [('name', 'Name'),
+ ('description', 'Description'),
+ ('owner', 'Owner'),
+ ('administrator', 'Administrator'),
+ ('contact', 'Contact'),
+ ('type', 'Type'),
+ 'NIC_INFO',
+ ('uptime', 'uptime'),
+ ('cputime', 'CPU usage'),
+ ('host', 'Hosted on'),
+ ('memory', 'RAM'),
+ 'DISK_INFO',
+ ('state', 'state (xen format)'),
+ ]
+ fields = []
+ machine_info = {}
+ machine_info['name'] = machine.name
+ machine_info['description'] = machine.description
+ machine_info['type'] = machine.type.hvm and 'HVM' or 'ParaVM'
+ machine_info['owner'] = machine.owner
+ machine_info['administrator'] = machine.administrator
+ machine_info['contact'] = machine.contact
+
+ nic_fields = getNicInfo(machine_info, machine)
+ nic_point = display_fields.index('NIC_INFO')
+ display_fields = (display_fields[:nic_point] + nic_fields +
+ display_fields[nic_point+1:])
+
+ disk_fields = getDiskInfo(machine_info, machine)
+ disk_point = display_fields.index('DISK_INFO')
+ display_fields = (display_fields[:disk_point] + disk_fields +
+ display_fields[disk_point+1:])
+
+ main_status['memory'] += ' MiB'
+ for field, disp in display_fields:
+ if field in ('uptime', 'cputime') and locals()[field] is not None:
+ fields.append((disp, locals()[field]))
+ elif field in machine_info:
+ fields.append((disp, machine_info[field]))
+ elif field in main_status:
+ fields.append((disp, main_status[field]))
+ else:
+ pass
+ #fields.append((disp, None))
+
+ max_mem = validation.maxMemory(machine.owner, state, machine, False)
+ max_disk = validation.maxDisk(machine.owner, machine)
+ defaults = Defaults()
+ for name in 'machine_id name description administrator owner memory contact'.split():
+ if getattr(machine, name):
+ setattr(defaults, name, getattr(machine, name))
+ defaults.type = machine.type.type_id
+ defaults.disk = "%0.2f" % (machine.disks[0].size/1024.)
+ d = dict(user=username,
+ on=status is not None,
+ machine=machine,
+ defaults=defaults,
+ has_vnc=has_vnc,
+ uptime=str(uptime),
+ ram=machine.memory,
+ max_mem=max_mem,
+ max_disk=max_disk,
+ fields = fields)
+ return d
+
+def send_error_mail(subject, body):
+ import subprocess
+
+ to = config.web.errormail
+ mail = """To: %s
+From: root@%s
+Subject: %s
+
+%s
+""" % (to, config.web.hostname, subject, body)
+ p = subprocess.Popen(['/usr/sbin/sendmail', '-f', to, to],
+ stdin=subprocess.PIPE)
+ p.stdin.write(mail)
+ p.stdin.close()
+ p.wait()
+
+random.seed() #sigh
Index: /package_tags/invirt-web/0.1.5/code/static/VncViewer.jar
===================================================================
--- /package_tags/invirt-web/0.1.5/code/static/VncViewer.jar (revision 2955)
+++ /package_tags/invirt-web/0.1.5/code/static/VncViewer.jar (revision 2955)
@@ -0,0 +1,1 @@
+link /usr/share/invirt-vnc-client/VncViewer.jar
Index: /package_tags/invirt-web/0.1.5/code/static/layout.css
===================================================================
--- /package_tags/invirt-web/0.1.5/code/static/layout.css (revision 2955)
+++ /package_tags/invirt-web/0.1.5/code/static/layout.css (revision 2955)
@@ -0,0 +1,30 @@
+/*
+ Good layout ideas stolen from Debathena.
+ Hey, we use some different fonts (in style.css.)
+ And the background color is unmistakably different.
+ Some other things are tweaked too.
+*/
+
+/* This file contains screen-only layout declarations that won't be
+ used for printing. */
+
+/* Make
| ', ' |
We are in the process of modifying the service. Things likely will not work.
+STDERR:
${error_text}
+Welcome, ${cherrypy.request.login}. +% if cherrypy.request.state.isadmin: +You are currently authenticated as an administrator. +% endif +
+% endif + + + +% endif + +% if not simple: +xvm.mit.edu is a virtualization service for the +MIT community. We offer virtual machines—your +own complete system on which you can start from our three-minute +Debian or Ubuntu install or install the operating +system of your choice. The service is free +to any Athena account holder.
+ +%if os.path.exists("/etc/invirt/motd.html"): +${open('/etc/invirt/motd.html').read()|n}
+MIT users:
+→ Log in to XVM using MIT certificates ++
→ Log in to XVM using Kerberos Tickets ++ +
In order to log in, you'll need to obtain MIT certificates
+ +The XVM code base is a free software project under +development, licensed under GPLv2+. If you're interested in using it, +we'd be happy to help you set it up in your environment. Our Subversion +repository is
https://xvm.mit.edu:1111/+ +
xvm.mit.edu is provided by SIPB, +the student computing group at MIT, with generous funding from IS&T. Like all SIPB projects, we +are independently run by our own team of volunteers, and we welcome new +contributors.
+ +Questions and feedback welcome at xvm@mit.edu.
Index: /package_tags/invirt-web/0.1.5/code/templates/vnc.mako =================================================================== --- /package_tags/invirt-web/0.1.5/code/templates/vnc.mako (revision 2955) +++ /package_tags/invirt-web/0.1.5/code/templates/vnc.mako (revision 2955) @@ -0,0 +1,23 @@ +<%page expression_filter="h" /> +<%inherit file="skeleton.mako" /> + +<%def name="title()"> +Console to ${machine.name} + + + +% if not on: +Your machine appears to be off.
+% elif not has_vnc: +Your machine appears to not be accepting VNC connections. Perhaps you have a ParaVM machine?
+% endif + +See tips about framebuffer and other issues.
+ Index: /package_tags/invirt-web/0.1.5/code/unauth.fcgi =================================================================== --- /package_tags/invirt-web/0.1.5/code/unauth.fcgi (revision 2955) +++ /package_tags/invirt-web/0.1.5/code/unauth.fcgi (revision 2955) @@ -0,0 +1,3 @@ +#!/bin/sh + +exec ./invirt.fcgi unauth "$@" Index: /package_tags/invirt-web/0.1.5/code/validation.py =================================================================== --- /package_tags/invirt-web/0.1.5/code/validation.py (revision 2955) +++ /package_tags/invirt-web/0.1.5/code/validation.py (revision 2955) @@ -0,0 +1,311 @@ +#!/usr/bin/python + +import cache_acls +import getafsgroups +import re +import string +import dns.resolver +from invirt.database import Machine, NIC, Type, Disk, CDROM, Autoinstall, Owner +from invirt.config import structs as config +from invirt.common import InvalidInput, CodeError + +MIN_MEMORY_SINGLE = 16 +MIN_DISK_SINGLE = 0.1 + +class Validate: + def __init__(self, username, state, machine_id=None, name=None, description=None, owner=None, + admin=None, contact=None, memory=None, disksize=None, + vmtype=None, cdrom=None, autoinstall=None, strict=False): + # XXX Successive quota checks aren't a good idea, since you + # can't necessarily change the locker and disk size at the + # same time. + created_new = (machine_id is None) + + if strict: + if name is None: + raise InvalidInput('name', name, "You must provide a machine name.") + if description is None: + raise InvalidInput('description', description, "You must provide a description.") + if memory is None: + raise InvalidInput('memory', memory, "You must provide a memory size.") + if disksize is None: + raise InvalidInput('disk', disksize, "You must provide a disk size.") + + if machine_id is not None: + self.machine = testMachineId(username, state, machine_id) + machine = getattr(self, 'machine', None) + + owner = testOwner(username, owner, machine) + if owner is not None: + self.owner = owner + self.admin = testAdmin(username, admin, machine) + contact = testContact(username, contact, machine) + if contact is not None: + self.contact = contact + name = testName(username, name, machine) + if name is not None: + self.name = name + description = testDescription(username, description, machine) + if description is not None: + self.description = description + if memory is not None: + self.memory = validMemory(self.owner, state, memory, machine, + on=not created_new) + if disksize is not None: + self.disksize = validDisk(self.owner, state, disksize, machine) + if vmtype is not None: + self.vmtype = validVmType(vmtype) + if cdrom is not None: + if not CDROM.query().get(cdrom): + raise CodeError("Invalid cdrom type '%s'" % cdrom) + self.cdrom = cdrom + if autoinstall is not None: + #raise InvalidInput('autoinstall', 'install', + # "The autoinstaller has been temporarily disabled") + self.autoinstall = Autoinstall.query().get(autoinstall) + + +def getMachinesByOwner(owner, machine=None): + """Return the machines owned by the same as a machine. + + If the machine is None, return the machines owned by the same + user. + """ + if machine: + owner = machine.owner + return Machine.query().filter_by(owner=owner) + +def maxMemory(owner, g, machine=None, on=True): + """Return the maximum memory for a machine or a user. + + If machine is None, return the memory available for a new + machine. Else, return the maximum that machine can have. + + on is whether the machine should be turned on. If false, the max + memory for the machine to change to, if it is left off, is + returned. + """ + (quota_total, quota_single) = Owner.getMemoryQuotas(machine.owner if machine else owner) + + if not on: + return quota_single + machines = getMachinesByOwner(owner, machine) + active_machines = [m for m in machines if m.name in g.xmlist_raw] + mem_usage = sum([x.memory for x in active_machines if x != machine]) + return min(quota_single, quota_total-mem_usage) + +def maxDisk(owner, machine=None): + """Return the maximum disk that a machine can reach. + + If machine is None, the maximum disk for a new machine. Otherwise, + return the maximum that a given machine can be changed to. + """ + (quota_total, quota_single) = Owner.getDiskQuotas(machine.owner if machine else owner) + + if machine is not None: + machine_id = machine.machine_id + else: + machine_id = None + disk_usage = Disk.query().filter(Disk.c.machine_id != machine_id).\ + join('machine').\ + filter_by(owner=owner).sum(Disk.c.size) or 0 + return min(quota_single, quota_total-disk_usage/1024.) + +def cantAddVm(owner, g): + machines = getMachinesByOwner(owner) + active_machines = [m for m in machines if m.name in g.xmlist_raw] + (quota_total, quota_active) = Owner.getVMQuotas(owner) + if machines.count() >= quota_total: + return 'You have too many VMs to create a new one.' + if len(active_machines) >= quota_active: + return ('You already have the maximum number of VMs turned on. ' + 'To create more, turn one off.') + return False + +def haveAccess(user, state, machine): + """Return whether a user has administrative access to a machine""" + return (user in cache_acls.accessList(machine) + or (machine.adminable and state.isadmin)) + +def owns(user, machine): + """Return whether a user owns a machine""" + return user in expandLocker(machine.owner) + +def validMachineName(name): + """Check that name is valid for a machine name""" + if not name: + return False + charset = string.lowercase + string.digits + '-' + if '-' in (name[0], name[-1]) or len(name) > 63: + return False + for x in name: + if x not in charset: + return False + return True + +def validMemory(owner, g, memory, machine=None, on=True): + """Parse and validate limits for memory for a given owner and machine. + + on is whether the memory must be valid after the machine is + switched on. + """ + try: + memory = int(memory) + if memory < MIN_MEMORY_SINGLE: + raise ValueError + except ValueError: + raise InvalidInput('memory', memory, + "Minimum %s MiB" % MIN_MEMORY_SINGLE) + max_val = maxMemory(owner, g, machine, on) + if not g.isadmin and memory > max_val: + raise InvalidInput('memory', memory, + 'Maximum %s MiB for %s' % (max_val, owner)) + return memory + +def validDisk(owner, g, disk, machine=None): + """Parse and validate limits for disk for a given owner and machine.""" + try: + disk = float(disk) + if not g.isadmin and disk > maxDisk(owner, machine): + raise InvalidInput('disk', disk, + "Maximum %s G" % maxDisk(owner, machine)) + disk = int(disk * 1024) + if disk < MIN_DISK_SINGLE * 1024: + raise ValueError + except ValueError: + raise InvalidInput('disk', disk, + "Minimum %s GiB" % MIN_DISK_SINGLE) + return disk + +def validVmType(vm_type): + if vm_type is None: + return None + t = Type.query().get(vm_type) + if t is None: + raise CodeError("Invalid vm type '%s'" % vm_type) + return t + +def testMachineId(user, state, machine_id, exists=True): + """Parse, validate and check authorization for a given user and machine. + + If exists is False, don't check that it exists. + """ + if machine_id is None: + raise InvalidInput('machine_id', machine_id, + "Must specify a machine ID.") + try: + machine_id = int(machine_id) + except ValueError: + raise InvalidInput('machine_id', machine_id, "Must be an integer.") + machine = Machine.query().get(machine_id) + if exists and machine is None: + raise InvalidInput('machine_id', machine_id, "Does not exist.") + if machine is not None and not haveAccess(user, state, machine): + raise InvalidInput('machine_id', machine_id, + "You do not have access to this machine.") + return machine + +def testAdmin(user, admin, machine): + """Determine whether a user can set the admin of a machine to this value. + + Return the value to set the admin field to (possibly 'system:' + + admin). XXX is modifying this a good idea? + """ + if admin is None: + return None + if machine is not None and admin == machine.administrator: + return admin + if admin == user: + return admin + if ':' not in admin: + if cache_acls.isUser(admin): + return admin + admin = 'system:' + admin + try: + if user in getafsgroups.getAfsGroupMembers(admin, config.authz.afs.cells[0].cell): + return admin + except getafsgroups.AfsProcessError, e: + errmsg = str(e) + if errmsg.startswith("pts: User or group doesn't exist"): + errmsg = 'The group "%s" does not exist.' % admin + raise InvalidInput('administrator', admin, errmsg) + #XXX Should we require that user is in the admin group? + return admin + +def testOwner(user, owner, machine=None): + """Determine whether a user can set the owner of a machine to this value. + + If machine is None, this is the owner of a new machine. + """ + if machine is not None and owner in (machine.owner, None): + return machine.owner + if owner is None: + raise InvalidInput('owner', owner, "Owner must be specified") + if '@' in owner: + raise InvalidInput('owner', owner, "No cross-realm Hesiod lockers allowed") + try: + if user not in cache_acls.expandLocker(owner): + raise InvalidInput('owner', owner, 'You do not have access to the ' + + owner + ' locker') + except getafsgroups.AfsProcessError, e: + raise InvalidInput('owner', owner, str(e)) + return owner + +def testContact(user, contact, machine=None): + if contact is None or (machine is not None and contact == machine.contact): + return None + if not re.match("^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$", contact, re.I): + raise InvalidInput('contact', contact, "Not a valid email.") + return contact + +def testName(user, name, machine=None): + if name is None: + return None + name = name.lower() + if machine is not None and name == machine.name: + return None + try: + hostname = '%s.%s.' % (name, config.dns.domains[0]) + resolver = dns.resolver.Resolver() + resolver.nameservers = ['127.0.0.1'] + try: + resolver.query(hostname, 'A') + except dns.resolver.NoAnswer, e: + # If we can get the TXT record, then we can verify it's + # reserved. If this lookup fails, let it bubble up and be + # dealt with + answer = resolver.query(hostname, 'TXT') + txt = answer[0].strings[0] + if txt.startswith('reserved'): + raise InvalidInput('name', name, 'The name you have requested has been %s. For more information, contact us at %s' % (txt, config.dns.contact)) + + # If the hostname didn't exist, it would have thrown an + # exception by now - error out + raise InvalidInput('name', name, 'Name is already taken.') + except dns.resolver.NXDOMAIN, e: + if not validMachineName(name): + raise InvalidInput('name', name, 'You must provide a machine name. Max 63 chars, alnum plus \'-\', does not begin or end with \'-\'.') + return name + except InvalidInput: + raise + except: + # Any other error is a validation failure + raise InvalidInput('name', name, 'We were unable to verify that this name is available. If you believe this is in error, please contact us at %s' % config.dns.contact) + +def testDescription(user, description, machine=None): + if description is None or description.strip() == '': + return None + return description.strip() + +def testHostname(user, hostname, machine): + for nic in machine.nics: + if hostname == nic.hostname: + return hostname + # check if doesn't already exist + if NIC.select_by(hostname=hostname): + raise InvalidInput('hostname', hostname, + "Already exists") + if not re.match("^[A-Z0-9-]{1,22}$", hostname, re.I): + raise InvalidInput('hostname', hostname, "Not a valid hostname; " + "must only use number, letters, and dashes.") + return hostname Index: /package_tags/invirt-web/0.1.5/code/view.py =================================================================== --- /package_tags/invirt-web/0.1.5/code/view.py (revision 2955) +++ /package_tags/invirt-web/0.1.5/code/view.py (revision 2955) @@ -0,0 +1,168 @@ +import os, sys + +import cherrypy +from mako.template import Template +from mako.lookup import TemplateLookup +import simplejson +import datetime, decimal +from StringIO import StringIO +from invirt.config import structs as config +from webcommon import State + + +class MakoHandler(cherrypy.dispatch.LateParamPageHandler): + """Callable which processes a dictionary, returning the rendered body.""" + + def __init__(self, template, next_handler, + content_type='text/html; charset=utf-8'): + self.template = template + self.next_handler = next_handler + self.content_type = content_type + + def __call__(self): + env = globals().copy() + env.update(self.next_handler()) + cherrypy.response.headers['Content-Type'] = self.content_type + return self.template.render(**env) + + +class MakoLoader(object): + + def __init__(self): + self.lookups = {} + + def get_lookup(self, directories, module_directory=None, + collection_size=-1, imports=[], **kwargs): + # Find the appropriate template lookup. + key = (tuple(directories), module_directory) + try: + lookup = self.lookups[key] + except KeyError: + lookup = TemplateLookup(directories=directories, + module_directory=module_directory, + collection_size=collection_size, + default_filters=['decode.utf8'], + input_encoding='utf-8', + output_encoding='utf-8', + imports=imports, + ) + self.lookups[key] = lookup + return lookup + + def __call__(self, filename, directories, module_directory=None, + collection_size=-1, content_type='text/html; charset=utf-8', + imports=[]): + cherrypy.request.lookup = lookup = self.get_lookup( + directories, module_directory, collection_size, imports) + cherrypy.request.template = t = lookup.get_template(filename) + cherrypy.request.handler = MakoHandler( + t, cherrypy.request.handler, content_type) + +cherrypy.tools.mako = cherrypy.Tool('on_start_resource', MakoLoader()) + + +def revertStandardError(): + """Move stderr to stdout, and return the contents of the old stderr.""" + errio = sys.stderr + if not isinstance(errio, StringIO): + return '' + sys.stderr = sys.stdout + errio.seek(0) + return errio.read() + + +def catchStderr(): + old_handler = cherrypy.request.handler + def wrapper(*args, **kwargs): + sys.stderr = StringIO() + ret = old_handler(*args, **kwargs) + e = revertStandardError() + if e: + if isinstance(ret, dict): + ret["error_text"] = e + return ret + if old_handler: + cherrypy.request.handler = wrapper + +cherrypy.tools.catch_stderr = cherrypy.Tool('before_handler', catchStderr) + + +class JSONEncoder(simplejson.JSONEncoder): + def default(self, obj): + if isinstance(obj, datetime.datetime): + return str(obj) + elif isinstance(obj, decimal.Decimal): + return float(obj) + else: + return simplejson.JSONEncoder.default(self, obj) + + +def jsonify_tool_callback(*args, **kwargs): + if not cherrypy.request.cached: + response = cherrypy.response + response.headers['Content-Type'] = 'text/javascript' + response.body = JSONEncoder().iterencode(response.body) + +cherrypy.tools.jsonify = cherrypy.Tool('before_finalize', + jsonify_tool_callback, priority=30) + + +def require_login(): + """If the user isn't logged in, raise 403 with an error.""" + if cherrypy.request.login is False: + raise cherrypy.HTTPError(403, + "You are not authorized to access that resource") + +cherrypy.tools.require_login = cherrypy.Tool('on_start_resource', + require_login, priority=150) + + +def require_POST(): + """If the request isn't a POST request, raise 405 Method Not Allowed""" + if cherrypy.request.method != "POST": + raise cherrypy.HTTPError(405, + "You must submit this request with POST") + +cherrypy.tools.require_POST = cherrypy.Tool('on_start_resource', + require_POST, priority=150) + + +def remote_user_login(): + """Get remote user from SSL or GSSAPI, and store in request object. + +Get the current user based on environment variables set by SSL or +GSSAPI, and store it in the attribute cherrpy.request.login. + +Per the CherryPy API (http://www.cherrypy.org/wiki/RequestObject#login), +the attribute is set to the username on successful login, to False on +failed login, and is left at None if the user attempted no authentication. +""" + environ = cherrypy.request.wsgi_environ + user = environ.get('REMOTE_USER') + if user is None: + return + if environ.get('AUTH_TYPE') == 'Negotiate': + # Convert the krb5 principal into a krb4 username + if not user.endswith('@%s' % config.kerberos.realm): + cherrypy.request.login = False # failed to log in + else: + cherrypy.request.login = user.split('@')[0].replace('/', '.') + else: + cherrypy.request.login = user + +cherrypy.tools.remote_user_login = cherrypy.Tool('on_start_resource', + remote_user_login, priority=50) + + +def invirtwebstate_init(): + """Initialize the cherrypy.request.state object from Invirt""" + if not hasattr(cherrypy.request, "state"): + cherrypy.request.state = State(cherrypy.request.login) + +cherrypy.tools.invirtwebstate = cherrypy.Tool('on_start_resource', + invirtwebstate_init, priority=100) + + +class View(object): + _cp_config = {'tools.mako.directories': + [os.path.join(os.path.dirname(__file__),'templates')]} Index: /package_tags/invirt-web/0.1.5/code/webcommon.py =================================================================== --- /package_tags/invirt-web/0.1.5/code/webcommon.py (revision 2955) +++ /package_tags/invirt-web/0.1.5/code/webcommon.py (revision 2955) @@ -0,0 +1,43 @@ +"""Exceptions for the web interface.""" + +import time +from invirt import database +from invirt.database import Machine, MachineAccess + +import controls + +def cachedproperty(func): + name = '__cache_' + func.__name__ + '_' + str(id(func)) + def getter(self): + try: + return getattr(self, name) + except AttributeError: + value = func(self) + setattr(self, name, value) + return value + return property(getter) + +class State(object): + """State for a request""" + def __init__(self, user, isadmin=False): + self.username = user + self.isadmin = isadmin + + def getMachines(self): + if self.isadmin: + return Machine.query().all() + else: + return Machine.query().join('acl').filter_by(user=self.username) + + machines = cachedproperty(getMachines) + xmlist_raw = cachedproperty(lambda self: controls.getList()) + xmlist = cachedproperty(lambda self: + dict((m, self.xmlist_raw[m.name]) + for m in self.machines + if m.name in self.xmlist_raw)) + + def clear(self): + """Clear the state so future accesses reload it.""" + for attr in list(self.__dict__): + if attr.startswith('__cache_'): + delattr(self, attr) Index: /package_tags/invirt-web/0.1.5/code/xen-ips =================================================================== --- /package_tags/invirt-web/0.1.5/code/xen-ips (revision 2955) +++ /package_tags/invirt-web/0.1.5/code/xen-ips (revision 2955) @@ -0,0 +1,56 @@ +#!/usr/bin/python +import random +from invirt import database +import sqlalchemy.exceptions +import sys + +# stolen directly from xend/server/netif.py +def randomMAC(): + """Generate a random MAC address. + + Uses OUI (Organizationally Unique Identifier) 00-16-3E, allocated to + Xensource, Inc. The OUI list is available at + http://standards.ieee.org/regauth/oui/oui.txt. + + The remaining 3 fields are random, with the first bit of the first + random field set 0. + + @return: MAC address string + """ + mac = [ 0x00, 0x16, 0x3e, + random.randint(0x00, 0x7f), + random.randint(0x00, 0xff), + random.randint(0x00, 0xff) ] + return ':'.join(map(lambda x: "%02x" % x, mac)) + +# ... and stolen from xend/uuid.py +def randomUUID(): + """Generate a random UUID.""" + + return [ random.randint(0, 255) for _ in range(0, 16) ] + +def uuidToString(u): + return "-".join(["%02x" * 4, "%02x" * 2, "%02x" * 2, "%02x" * 2, + "%02x" * 6]) % tuple(u) + + +def usage(): + print >> sys.stderr, "USAGE: " + sys.argv[0] + "