X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=cmdline%2Fsfi.py;h=211213f28b7f01e389c67650ff539773cd410a26;hb=3833476b299fc4ce3cc303361365ac28eae9a8f7;hp=481fbf2fe5d6ade15627d15a7454a244c43e5f48;hpb=5a04ddd0df353a10f926ceaddfddd88f17997e85;p=sfa.git diff --git a/cmdline/sfi.py b/cmdline/sfi.py index 481fbf2f..211213f2 100755 --- a/cmdline/sfi.py +++ b/cmdline/sfi.py @@ -6,12 +6,17 @@ from __future__ import with_statement import sys import os, os.path import tempfile +from types import StringTypes, ListType from optparse import OptionParser -from geni.util.cert import Keypair, Certificate + +from geni.util.certificate import Keypair, Certificate from geni.util.credential import Credential from geni.util.geniclient import GeniClient, ServerException from geni.util.gid import create_uuid -from geni.util.record import GeniRecord +from geni.util.record import * +from geni.util.rspec import Rspec + +# xxx todo xxx auto-load ~/.sfi/sfi_config sfi_dir = os.path.expanduser("~/.sfi/") slicemgr = None @@ -36,6 +41,10 @@ def set_servers(options): sm_url = os.environ["SFI_SM"] else: print "No Known Slice Manager" + print "Try:" + print " export SFI_SM=http://your.slicemanager.url:12347/" + print "Or add this argument to the command line:" + print " --slicemgr=http://your.slicemanager.url:12347/" sys.exit(1) # Set Registry URL @@ -45,6 +54,10 @@ def set_servers(options): reg_url = os.environ["SFI_REGISTRY"] else: print "No Known Registry Server" + print "Try:" + print " export SFI_REGISTRY=http://your.registry.url:12345/" + print "Or add this argument to the command line:" + print " --registry=http://your.registry.url:12345/" sys.exit(1) if options.verbose : @@ -58,6 +71,10 @@ def set_servers(options): user = os.environ["SFI_USER"] else: print "No Known User Name" + print "Try:" + print " export SFI_USER=$SFI_AUTH.username" + print "Or add this argument to the command line:" + print " --user=username" sys.exit(1) # Set authority HRN @@ -181,6 +198,42 @@ def get_slice_cred(name): print "Failed to get slice credential" sys.exit(-1) +def delegate_cred(cred, hrn, type = 'authority'): + # the gid and hrn of the object we are delegating + object_gid = cred.get_gid_object() + object_hrn = object_gid.get_hrn() + cred.set_delegate(True) + if not cred.get_delegate(): + raise Exception, "Error: Object credential %(object_hrn)s does not have delegate bit set" % locals() + + + records = registry.resolve(cred, hrn) + records = filter_records(type, records) + + if not records: + raise Exception, "Error: Didn't find a %(type)s record for %(hrn)s" % locals() + + # the gid of the user who will be delegated too + delegee_gid = records[0].get_gid_object() + delegee_hrn = delegee_gid.get_hrn() + + # the key and hrn of the user who will be delegating + user_key = Keypair(filename = get_key_file()) + user_hrn = cred.get_gid_caller().get_hrn() + + dcred = Credential(subject=object_hrn + " delegated to " + delegee_hrn) + dcred.set_gid_caller(delegee_gid) + dcred.set_gid_object(object_gid) + dcred.set_privileges(cred.get_privileges()) + dcred.set_delegate(True) + dcred.set_pubkey(object_gid.get_pubkey()) + dcred.set_issuer(user_key, user_hrn) + dcred.set_parent(cred) + dcred.encode() + dcred.sign() + + return dcred + def get_rspec_file(rspec): if (os.path.isabs(rspec)): file = rspec @@ -217,7 +270,6 @@ def load_publickey_string(fn): os.remove(outfn) return key_string - # # Generate sub-command parser # @@ -233,7 +285,8 @@ def create_cmd_parser(command, additional_cmdargs = None): "delete": "name", "reset": "name", "start": "name", - "stop": "name" + "stop": "name", + "delegate": "name" } if additional_cmdargs: @@ -261,6 +314,12 @@ def create_cmd_parser(command, additional_cmdargs = None): if command in ("show", "list", "resources"): parser.add_option("-o", "--output", dest="file", help="output XML to file", metavar="FILE", default=None) + if command in ("delegate"): + parser.add_option("-u", "--user", + action="store_true", dest="delegate_user", default=False, + help="delegate user credential") + parser.add_option("-s", "--slice", dest="delegate_slice", + help="delegate slice credential", metavar="HRN", default=None) return parser def create_parser(): @@ -304,11 +363,11 @@ def main(): (cmd_opts, cmd_args) = create_cmd_parser(command).parse_args(args[1:]) verbose = options.verbose if verbose : - print "Resgistry %s, sm %s, dir %s, user %s, auth %s" % (options.registry, - options.sm, - options.dir, - options.user, - options.auth) + print "Resgistry %s, sm %s, dir %s, user %s, auth %s" % (options.registry, + options.sm, + options.dir, + options.user, + options.auth) print "Command %s" %command if command in ("resources"): print "resources cmd_opts %s" %cmd_opts.format @@ -321,6 +380,7 @@ def main(): try: dispatch(command, cmd_opts, cmd_args) except KeyError: + raise print "Command not found:", command sys.exit(1) @@ -340,7 +400,8 @@ def list(opts, args): # filter on person, slice, site, node, etc. # THis really should be in the filter_records funct def comment... list = filter_records(opts.type, list) - display_records(list) + for record in list: + print "%s (%s)" % (record['hrn'], record['type']) if opts.file: save_records_to_file(opts.file, list) return @@ -353,11 +414,77 @@ def show(opts, args): records = filter_records(opts.type, records) if not records: print "No record of type", opts.type - display_records(records, True) + for record in records: + if record['type'] in ['user']: + record = UserRecord(dict = record) + elif record['type'] in ['slice']: + record = SliceRecord(dict = record) + elif record['type'] in ['node']: + record = NodeRecord(dict = record) + elif record['type'] in ['authority', 'ma', 'sa']: + record = AuthorityRecord(dict = record) + else: + record = GeniRecord(dict = record) + record.dump() + if opts.file: save_records_to_file(opts.file, records) return +def delegate(opts, args): + global registry + user_cred = get_user_cred() + if opts.delegate_user: + object_cred = user_cred + elif opts.delegate_slice: + object_cred = get_slice_cred(opts.delegate_slice) + else: + print "Must specify either --user or --slice " + return + + # the gid and hrn of the object we are delegating + object_gid = object_cred.get_gid_object() + object_hrn = object_gid.get_hrn() + + if not object_cred.get_delegate(): + print "Error: Object credential", object_hrn, "does not have delegate bit set" + return + + records = registry.resolve(user_cred, args[0]) + records = filter_records("user", records) + + if not records: + print "Error: Didn't find a user record for", args[0] + return + + # the gid of the user who will be delegated too + delegee_gid = records[0].get_gid_object() + delegee_hrn = delegee_gid.get_hrn() + + # the key and hrn of the user who will be delegating + user_key = Keypair(filename = get_key_file()) + user_hrn = user_cred.get_gid_caller().get_hrn() + + dcred = Credential(subject=object_hrn + " delegated to " + delegee_hrn) + dcred.set_gid_caller(delegee_gid) + dcred.set_gid_object(object_gid) + dcred.set_privileges(object_cred.get_privileges()) + dcred.set_delegate(True) + dcred.set_pubkey(object_gid.get_pubkey()) + dcred.set_issuer(user_key, user_hrn) + dcred.set_parent(object_cred) + dcred.encode() + dcred.sign() + + if opts.delegate_user: + dest_fn = os.path.join(sfi_dir, get_leaf(delegee_hrn) + "_" + get_leaf(object_hrn) + ".cred") + elif opts.delegate_slice: + dest_fn = os.path_join(sfi_dir, get_leaf(delegee_hrn) + "_slice_" + get_leaf(object_hrn) + ".cred") + + dcred.save_to_file(dest_fn, save_parents = True) + + print "delegated credential for", object_hrn, "to", delegee_hrn, "and wrote to", dest_fn + # removed named registry record # - have to first retrieve the record to be removed def remove(opts, args): @@ -372,20 +499,6 @@ def add(opts, args): rec_file = get_record_file(args[0]) record = load_record_from_file(rec_file) - # check and see if we need to create a gid for this record. The creator - # of the record signals this by filling in the create_gid, create_gid_hrn, - # and create_gid_key members. - # (note: we'd use an unsigned GID in the record instead, but pyOpenSSL is - # broken and has no way for us to get the key back out of the gid) - geni_info = record.get_geni_info() - if "create_gid" in geni_info: - gid = registry.create_gid(auth_cred, geni_info["create_gid_hrn"], create_uuid(), geni_info["create_gid_key"]) - record.set_gid(gid) - - del geni_info["create_gid"] - del geni_info["create_gid_hrn"] - del geni_info["create_gid_key"] - return registry.register(auth_cred, record) # update named registry entry @@ -398,17 +511,21 @@ def update(opts, args): if record.get_name() == user_cred.get_gid_object().get_hrn(): cred = user_cred else: - create = get_auth_cred() + cred = get_auth_cred() elif record.get_type() in ["slice"]: try: cred = get_slice_cred(record.get_name()) except ServerException, e: - if "PermissionError" in e.args[0]: + # XXX smbaker -- once we have better error return codes, update this + # to do something better than a string compare + if "Permission error" in e.args[0]: cred = get_auth_cred() else: raise - elif record.get_type() in ["sa", "ma", "node"]: + elif record.get_type() in ["authority"]: cred = get_auth_cred() + elif record.get_type() == 'node': + cred = get_auth_cred() else: raise "unknown record type" + record.get_type() return registry.update(cred, record) @@ -438,8 +555,8 @@ def update(opts, args): # list instantiated slices def slices(opts, args): global slicemgr - user_cred = get_user_cred() - results = slicemgr.slices(user_cred) + user_cred = get_user_cred() + results = slicemgr.get_slices(user_cred) display_list(results) return @@ -448,13 +565,14 @@ def resources(opts, args): global slicemgr if args: slice_cred = get_slice_cred(args[0]) - result = slicemgr.resources(slice_cred, args[0]) + result = slicemgr.get_resources(slice_cred, args[0]) else: user_cred = get_user_cred() - result = slicemgr.resources(user_cred) - display_rspec(result) + result = slicemgr.get_resources(user_cred) + format = opts.format + display_rspec(result, format) if (opts.file is not None): - save_rspec_to_file(opts.file, result) + save_rspec_to_file(result, opts.file) return # created named slice with given rspec @@ -478,20 +596,23 @@ def delete(opts, args): # start named slice def start(opts, args): global slicemgr + slice_hrn = args[0] slice_cred = get_slice_cred(args[0]) - return slicemgr.start_slice(slice_cred) + return slicemgr.start_slice(slice_cred, slice_hrn) # stop named slice def stop(opts, args): global slicemgr + slice_hrn = args[0] slice_cred = get_slice_cred(args[0]) - return slicemgr.stop_slice(slice_cred) + return slicemgr.stop_slice(slice_cred, slice_hrn) # reset named slice def reset(opts, args): global slicemgr + slice_hrn = args[0] slice_cred = get_slice_cred(args[0]) - return slicemgr.reset_slice(slice_cred) + return slicemgr.reset_slice(slice_cred, slice_hrn) # # @@ -500,9 +621,33 @@ def reset(opts, args): # # -def display_rspec(rspec): - print rspec - return +def display_rspec(rspec, format = 'rspec'): + if format in ['dns']: + spec = Rspec() + spec.parseString(rspec) + hostnames = [] + nodespecs = spec.getDictsByTagName('NodeSpec') + for nodespec in nodespecs: + if nodespec.has_key('name') and nodespec['name']: + if isinstance(nodespec['name'], ListType): + hostnames.extend(nodespec['name']) + elif isinstance(nodespec['name'], StringTypes): + hostnames.append(nodespec['name']) + result = hostnames + elif format in ['ip']: + spec = Rspec() + spec.parseString(rspec) + ips = [] + ifspecs = spec.getDictsByTagName('IfSpec') + for ifspec in ifspecs: + if ifspec.has_key('addr') and ifspec['addr']: + ips.append(ifspec['addr']) + result = ips + else: + result = rspec + + print result + return def display_list(results): for result in results: