# Copyright 2015 Open Platform for NFV Project, Inc. and its contributors # This software is distributed under the terms and conditions of the 'Apache-2.0' # license which can be found in the file 'LICENSE' in this package distribution # or at 'http://www.apache.org/licenses/LICENSE-2.0'. import webob import logging import json import re import httplib from cStringIO import StringIO from oslo_config import cfg from keystonemiddleware.i18n import _, _LC, _LE, _LI, _LW _OPTS = [ cfg.StrOpt('auth_uri', default="http://127.0.0.1:35357/v3", help='Complete public Identity API endpoint.'), cfg.StrOpt('auth_version', default=None, help='API version of the admin Identity API endpoint.'), cfg.StrOpt('authz_login', default="admin", help='Name of the administrator who will connect to the Keystone Moon backends.'), cfg.StrOpt('authz_password', default="nomoresecrete", help='Password of the administrator who will connect to the Keystone Moon backends.'), cfg.StrOpt('logfile', default="/tmp/authz.log", help='File where logs goes.'), ] _MOON_KEYSTONEMIDDLEWARE_AGENT_GROUP = 'moon_keystonemiddleware_agent' CONF = cfg.CONF CONF.register_opts(_OPTS, group=_MOON_KEYSTONEMIDDLEWARE_AGENT_GROUP) CONF.debug = True # from http://developer.openstack.org/api-ref-objectstorage-v1.html SWIFT_API = ( ("^/v1/(?P[\w_-]+)$", "GET", "get_account_details"), ("^/v1/(?P[\w_-]+)$", "POST", "modify_account"), ("^/v1/(?P[\w_-]+)$", "HEAD", "get_account"), ("^/v1/(?P[\w_-]+)/(?P[\w-]+)$", "GET", "get_container"), ("^/v1/(?P[\w_-]+)/(?P[\w-]+)$", "PUT", "create_container"), ("^/v1/(?P[\w_-]+)/(?P[\w-]+)$", "POST", "update_container_metadata"), ("^/v1/(?P[\w_-]+)/(?P[\w-]+)$", "DELETE", "delete_container"), ("^/v1/(?P[\w_-]+)/(?P[\w-]+)$", "HEAD", "get_container_metadata"), ("^/v1/(?P[\w_-]+)/(?P[\w-]+)/(?P.+)$", "GET", "get_object"), ("^/v1/(?P[\w_-]+)/(?P[\w-]+)/(?P.+)$", "PUT", "create_object"), ("^/v1/(?P[\w_-]+)/(?P[\w-]+)/(?P.+)$", "COPY", "copy_object"), ("^/v1/(?P[\w_-]+)/(?P[\w-]+)/(?P.+)$", "POST", "update_object_metadata"), ("^/v1/(?P[\w_-]+)/(?P[\w-]+)/(?P.+)$", "DELETE", "delete_object"), ("^/v1/(?P[\w_-]+)/(?P[\w-]+)/(?P.+)$", "HEAD", "get_object_metadata"), ) class MoonAgentKeystoneMiddleware(object): """Moon's agent for KeystoneMiddleware to interact calls.""" post_data = { "auth": { "identity": { "methods": [ "password" ], "password": { "user": { "domain": { "id": "Default" }, "name": "admin", "password": "nomoresecrete" } } } } } def __init__(self, app, conf): self.conf = conf self._LOG = logging.getLogger(conf.get('log_name', __name__)) # FIXME: events are duplicated in log file moon_agent_fh = logging.FileHandler(CONF.moon_keystonemiddleware_agent["logfile"]) self._LOG.setLevel(logging.DEBUG) self._LOG.addHandler(moon_agent_fh) self._LOG.info(_LI('Starting Moon KeystoneMiddleware Agent')) self._conf = conf self._app = app # Auth self.auth_host = conf.get('auth_host', "127.0.0.1") self.auth_port = int(conf.get('auth_port', 35357)) auth_protocol = conf.get('auth_protocol', 'http') self._conf["_request_uri"] = '%s://%s:%s' % (auth_protocol, self.auth_host, # TODO: ??? for auth or authz self.auth_port) # SSL insecure = conf.get('insecure', False) cert_file = conf.get('certfile') key_file = conf.get('keyfile') if insecure: self._conf["_verify"] = False elif cert_file and key_file: self._conf["_verify"] = (cert_file, key_file) elif cert_file: self._conf["_verify"] = cert_file else: self._conf["_verify"] = None # Moon registered mgrs self.local_registered_mgr_dict = dict() # TODO: load from the sql backend from keystonemiddleware.moon_mgrs.authz_mgr.authz_mgr import AuthzMgr self.local_registered_mgr_dict["authz_mgr"] = AuthzMgr(self._conf) def __set_token(self): self.post_data["auth"]["identity"]["password"]["user"]["name"] = self.conf.get('authz_login', "admin") self.post_data["auth"]["identity"]["password"]["user"]["password"] = self.conf.get('authz_password', "nomoresecrete") data = self.get_url("/v3/auth/tokens", post_data=self.post_data) if "token" not in data: raise Exception("Authentication problem ({})".format(data)) self.token = data["token"] def __unset_token(self): data = self.get_url("/v3/auth/tokens", method="DELETE", authtoken=True) if "content" in data and len(data["content"]) > 0: self._LOG.error("Error while unsetting token {}".format(data["content"])) self.token = None def get_url(self, url, post_data=None, delete_data=None, method="GET", authtoken=None): if post_data: method = "POST" if delete_data: method = "DELETE" self._LOG.debug("\033[32m{} {}\033[m".format(method, url)) conn = httplib.HTTPConnection(self.auth_host, self.auth_port) headers = { "Content-type": "application/x-www-form-urlencoded", "Accept": "text/plain,text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", } if authtoken: if self.x_subject_token: if method == "DELETE": headers["X-Subject-Token"] = self.x_subject_token headers["X-Auth-Token"] = self.x_subject_token else: headers["X-Auth-Token"] = self.x_subject_token if post_data: method = "POST" headers["Content-type"] = "application/json" post_data = json.dumps(post_data) conn.request(method, url, post_data, headers=headers) elif delete_data: method = "DELETE" conn.request(method, url, json.dumps(delete_data), headers=headers) else: conn.request(method, url, headers=headers) resp = conn.getresponse() headers = resp.getheaders() try: self.x_subject_token = dict(headers)["x-subject-token"] except KeyError: pass content = resp.read() conn.close() try: return json.loads(content) except ValueError: return {"content": content} def _find_openstack_component(self, env): if "nova.context" in env.keys(): return "nova" elif "swift.authorize" in env.keys(): return "swift" else: self._LOG.debug(env.keys()) return "unknown" def _get_action(self, env, component): """ Find and return the action of the request Actually, find only Nova action (start, destroy, pause, unpause, ...) :param env: the request :return: the action or "" """ action = "" self.input = "" if component == "nova": length = int(env.get('CONTENT_LENGTH', '0')) # TODO (dthom): compute for Nova, Cinder, Neutron, ... action = "" if length > 0: try: sub_action_object = env['wsgi.input'].read(length) self.input = sub_action_object action = json.loads(sub_action_object).keys()[0] body = StringIO(sub_action_object) env['wsgi.input'] = body except ValueError: self._LOG.error("Error in decoding sub-action") except Exception as e: self._LOG.error(str(e)) if not action or len(action) == 0 and "servers/detail" in env["PATH_INFO"]: return "list" if component == "swift": path = env["PATH_INFO"] method = env["REQUEST_METHOD"] for api in SWIFT_API: if re.match(api[0], path) and method == api[1]: action = api[2] length = int(env.get('CONTENT_LENGTH', '0')) # TODO (dthom): compute for Nova, Cinder, Neutron, ... _action = "" if length > 0: try: sub_action_object = env['wsgi.input'].read(length) self.input = sub_action_object _action = json.loads(sub_action_object).keys()[0] body = StringIO(sub_action_object) env['wsgi.input'] = body self._LOG.debug("wsgi.input={}".format(_action)) except ValueError: self._LOG.error("Error in decoding sub-action") except Exception as e: self._LOG.error(str(e)) return action @staticmethod def _get_resource(env, component): if component == "nova": # http://developer.openstack.org/api-ref-compute-v2.1.html # nova URLs: # //servers/ # list details for server_id # //servers//action # execute action to server_id # //servers//metadata # show metadata from server_id # //servers/details # list servers url = env.get("PATH_INFO").split("/") if url[-1] == "detail": return "servers" try: return url[3] except IndexError: return elif component == "swift": # remove the "/v1/" part of the URL return env.get("PATH_INFO").split("/", 2)[-1].replace("/", "-").replace(".", "-") return "unknown" def __call__(self, env, start_response): req = webob.Request(env) agent_data = dict() agent_data['user_id'] = env.get("HTTP_X_USER_ID") if not agent_data['user_id']: self._LOG.warning("No user_id found for {}".format(env.get("PATH_INFO"))) return self._app(env, start_response) agent_data['tenant_id'] = env.get("HTTP_X_TENANT_ID") if not agent_data['tenant_id']: self._LOG.warning("No tenant_id found for {}".format(env.get("PATH_INFO"))) return self._app(env, start_response) agent_data['OS_component'] = self._find_openstack_component(env) agent_data['action_id'] = self._get_action(env, agent_data['OS_component']) if not agent_data['action_id']: self._LOG.warning("No action_id found for {}".format(env.get("PATH_INFO"))) # If action is not found, we can't raise an exception because a lots of action is missing # in function self._get_action, it is not possible to get them all. return self._app(env, start_response) agent_data['resource_id'] = self._get_resource(env, agent_data['OS_component']) if not agent_data['resource_id'] : self._LOG.warning("No resource_id found for {}".format(env.get("PATH_INFO"))) return self._app(env, start_response) else: self._LOG.debug("resource_id={}".format(agent_data['resource_id'])) self.__set_token() for _mgr in self.local_registered_mgr_dict: # TODO: update from the sql backend self.local_registered_mgr_dict[_mgr].response_content = \ json.loads(self.local_registered_mgr_dict[_mgr].treat_request(self.x_subject_token, agent_data).content) self.__unset_token() aggregate_result = 1 for _mgr in self.local_registered_mgr_dict: if not self.local_registered_mgr_dict[_mgr].response_content: aggregate_result = 0 if aggregate_result: return self._app(env, start_response) def filter_factory(global_conf, **local_conf): """Returns a WSGI filter app for use with paste.deploy.""" conf = global_conf.copy() conf.update(local_conf) def moon_agent_filter(app): return MoonAgentKeystoneMiddleware(app, conf) return moon_agent_filter