OpenStack Identity (Keystone) Middleware
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

_api.py 12KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313
  1. # Licensed under the Apache License, Version 2.0 (the "License"); you may
  2. # not use this file except in compliance with the License. You may obtain
  3. # a copy of the License at
  4. #
  5. # http://www.apache.org/licenses/LICENSE-2.0
  6. #
  7. # Unless required by applicable law or agreed to in writing, software
  8. # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  9. # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
  10. # License for the specific language governing permissions and limitations
  11. # under the License.
  12. import collections
  13. import re
  14. from oslo_log import log as logging
  15. from oslo_serialization import jsonutils
  16. from pycadf import cadftaxonomy as taxonomy
  17. from pycadf import cadftype
  18. from pycadf import credential
  19. from pycadf import endpoint
  20. from pycadf import eventfactory as factory
  21. from pycadf import host
  22. from pycadf import identifier
  23. from pycadf import resource
  24. from pycadf import tag
  25. import six
  26. from six.moves import configparser
  27. from six.moves.urllib import parse as urlparse
  28. # NOTE(blk-u): Compatibility for Python 2. SafeConfigParser and
  29. # SafeConfigParser.readfp are deprecated in Python 3. Remove this when we drop
  30. # support for Python 2.
  31. if six.PY2:
  32. class _ConfigParser(configparser.SafeConfigParser):
  33. read_file = configparser.SafeConfigParser.readfp
  34. else:
  35. _ConfigParser = configparser.ConfigParser
  36. Service = collections.namedtuple('Service',
  37. ['id', 'name', 'type', 'admin_endp',
  38. 'public_endp', 'private_endp'])
  39. AuditMap = collections.namedtuple('AuditMap',
  40. ['path_kw',
  41. 'custom_actions',
  42. 'service_endpoints',
  43. 'default_target_endpoint_type'])
  44. class PycadfAuditApiConfigError(Exception):
  45. """Error raised when pyCADF fails to configure correctly."""
  46. pass
  47. class ClientResource(resource.Resource):
  48. def __init__(self, project_id=None, **kwargs):
  49. super(ClientResource, self).__init__(**kwargs)
  50. if project_id is not None:
  51. self.project_id = project_id
  52. class KeystoneCredential(credential.Credential):
  53. def __init__(self, identity_status=None, **kwargs):
  54. super(KeystoneCredential, self).__init__(**kwargs)
  55. if identity_status is not None:
  56. self.identity_status = identity_status
  57. class OpenStackAuditApi(object):
  58. def __init__(self, cfg_file, log=logging.getLogger(__name__)):
  59. """Configure to recognize and map known api paths."""
  60. path_kw = {}
  61. custom_actions = {}
  62. endpoints = {}
  63. default_target_endpoint_type = None
  64. if cfg_file:
  65. try:
  66. map_conf = _ConfigParser()
  67. map_conf.read_file(open(cfg_file))
  68. try:
  69. default_target_endpoint_type = map_conf.get(
  70. 'DEFAULT', 'target_endpoint_type')
  71. except configparser.NoOptionError: # nosec
  72. # Ignore the undefined config option,
  73. # default_target_endpoint_type remains None which is valid.
  74. pass
  75. try:
  76. custom_actions = dict(map_conf.items('custom_actions'))
  77. except configparser.Error: # nosec
  78. # custom_actions remains {} which is valid.
  79. pass
  80. try:
  81. path_kw = dict(map_conf.items('path_keywords'))
  82. except configparser.Error: # nosec
  83. # path_kw remains {} which is valid.
  84. pass
  85. try:
  86. endpoints = dict(map_conf.items('service_endpoints'))
  87. except configparser.Error: # nosec
  88. # endpoints remains {} which is valid.
  89. pass
  90. except configparser.ParsingError as err:
  91. raise PycadfAuditApiConfigError(
  92. 'Error parsing audit map file: %s' % err)
  93. self._log = log
  94. self._MAP = AuditMap(
  95. path_kw=path_kw, custom_actions=custom_actions,
  96. service_endpoints=endpoints,
  97. default_target_endpoint_type=default_target_endpoint_type)
  98. @staticmethod
  99. def _clean_path(value):
  100. """Clean path if path has json suffix."""
  101. return value[:-5] if value.endswith('.json') else value
  102. def get_action(self, req):
  103. """Take a given Request, parse url path to calculate action type.
  104. Depending on req.method:
  105. if POST:
  106. - path ends with 'action', read the body and use as action;
  107. - path ends with known custom_action, take action from config;
  108. - request ends with known path, assume is create action;
  109. - request ends with unknown path, assume is update action.
  110. if GET:
  111. - request ends with known path, assume is list action;
  112. - request ends with unknown path, assume is read action.
  113. if PUT, assume update action.
  114. if DELETE, assume delete action.
  115. if HEAD, assume read action.
  116. """
  117. path = req.path[:-1] if req.path.endswith('/') else req.path
  118. url_ending = self._clean_path(path[path.rfind('/') + 1:])
  119. method = req.method
  120. if url_ending + '/' + method.lower() in self._MAP.custom_actions:
  121. action = self._MAP.custom_actions[url_ending + '/' +
  122. method.lower()]
  123. elif url_ending in self._MAP.custom_actions:
  124. action = self._MAP.custom_actions[url_ending]
  125. elif method == 'POST':
  126. if url_ending == 'action':
  127. try:
  128. if req.json:
  129. body_action = list(req.json.keys())[0]
  130. action = taxonomy.ACTION_UPDATE + '/' + body_action
  131. else:
  132. action = taxonomy.ACTION_CREATE
  133. except ValueError:
  134. action = taxonomy.ACTION_CREATE
  135. elif url_ending not in self._MAP.path_kw:
  136. action = taxonomy.ACTION_UPDATE
  137. else:
  138. action = taxonomy.ACTION_CREATE
  139. elif method == 'GET':
  140. if url_ending in self._MAP.path_kw:
  141. action = taxonomy.ACTION_LIST
  142. else:
  143. action = taxonomy.ACTION_READ
  144. elif method == 'PUT' or method == 'PATCH':
  145. action = taxonomy.ACTION_UPDATE
  146. elif method == 'DELETE':
  147. action = taxonomy.ACTION_DELETE
  148. elif method == 'HEAD':
  149. action = taxonomy.ACTION_READ
  150. else:
  151. action = taxonomy.UNKNOWN
  152. return action
  153. def _get_service_info(self, endp):
  154. service = Service(
  155. type=self._MAP.service_endpoints.get(
  156. endp['type'],
  157. taxonomy.UNKNOWN),
  158. name=endp['name'],
  159. id=endp['endpoints'][0].get('id', endp['name']),
  160. admin_endp=endpoint.Endpoint(
  161. name='admin',
  162. url=endp['endpoints'][0].get('adminURL', taxonomy.UNKNOWN)),
  163. private_endp=endpoint.Endpoint(
  164. name='private',
  165. url=endp['endpoints'][0].get('internalURL', taxonomy.UNKNOWN)),
  166. public_endp=endpoint.Endpoint(
  167. name='public',
  168. url=endp['endpoints'][0].get('publicURL', taxonomy.UNKNOWN)))
  169. return service
  170. def _build_typeURI(self, req, service_type):
  171. """Build typeURI of target.
  172. Combines service type and corresponding path for greater detail.
  173. """
  174. type_uri = ''
  175. prev_key = None
  176. for key in re.split('/', req.path):
  177. key = self._clean_path(key)
  178. if key in self._MAP.path_kw:
  179. type_uri += '/' + key
  180. elif prev_key in self._MAP.path_kw:
  181. type_uri += '/' + self._MAP.path_kw[prev_key]
  182. prev_key = key
  183. return service_type + type_uri
  184. def _build_target(self, req, service):
  185. """Build target resource."""
  186. target_typeURI = (
  187. self._build_typeURI(req, service.type)
  188. if service.type != taxonomy.UNKNOWN else service.type)
  189. target = resource.Resource(typeURI=target_typeURI,
  190. id=service.id, name=service.name)
  191. if service.admin_endp:
  192. target.add_address(service.admin_endp)
  193. if service.private_endp:
  194. target.add_address(service.private_endp)
  195. if service.public_endp:
  196. target.add_address(service.public_endp)
  197. return target
  198. def get_target_resource(self, req):
  199. """Retrieve target information.
  200. If discovery is enabled, target will attempt to retrieve information
  201. from service catalog. If not, the information will be taken from
  202. given config file.
  203. """
  204. service_info = Service(type=taxonomy.UNKNOWN, name=taxonomy.UNKNOWN,
  205. id=taxonomy.UNKNOWN, admin_endp=None,
  206. private_endp=None, public_endp=None)
  207. catalog = {}
  208. try:
  209. catalog = jsonutils.loads(req.environ['HTTP_X_SERVICE_CATALOG'])
  210. except KeyError:
  211. self._log.warning(
  212. 'Unable to discover target information because '
  213. 'service catalog is missing. Either the incoming '
  214. 'request does not contain an auth token or auth '
  215. 'token does not contain a service catalog. For '
  216. 'the latter, please make sure the '
  217. '"include_service_catalog" property in '
  218. 'auth_token middleware is set to "True"')
  219. default_endpoint = None
  220. for endp in catalog:
  221. if not endp['endpoints']:
  222. self._log.warning(
  223. 'Skipping service %s as it have no endpoints.',
  224. endp['name'])
  225. continue
  226. endpoint_urls = endp['endpoints'][0]
  227. admin_urlparse = urlparse.urlparse(
  228. endpoint_urls.get('adminURL', ''))
  229. public_urlparse = urlparse.urlparse(
  230. endpoint_urls.get('publicURL', ''))
  231. req_url = urlparse.urlparse(req.host_url)
  232. if req_url.port and (req_url.netloc == admin_urlparse.netloc
  233. or req_url.netloc == public_urlparse.netloc):
  234. service_info = self._get_service_info(endp)
  235. break
  236. elif (self._MAP.default_target_endpoint_type and
  237. endp['type'] == self._MAP.default_target_endpoint_type):
  238. default_endpoint = endp
  239. else:
  240. if default_endpoint:
  241. service_info = self._get_service_info(default_endpoint)
  242. return self._build_target(req, service_info)
  243. def _create_event(self, req):
  244. correlation_id = identifier.generate_uuid()
  245. action = self.get_action(req)
  246. initiator = ClientResource(
  247. typeURI=taxonomy.ACCOUNT_USER,
  248. id=req.environ.get('HTTP_X_USER_ID', taxonomy.UNKNOWN),
  249. name=req.environ.get('HTTP_X_USER_NAME', taxonomy.UNKNOWN),
  250. host=host.Host(address=req.client_addr, agent=req.user_agent),
  251. credential=KeystoneCredential(
  252. token=req.environ.get('HTTP_X_AUTH_TOKEN', ''),
  253. identity_status=req.environ.get('HTTP_X_IDENTITY_STATUS',
  254. taxonomy.UNKNOWN)),
  255. project_id=req.environ.get('HTTP_X_PROJECT_ID', taxonomy.UNKNOWN))
  256. target = self.get_target_resource(req)
  257. event = factory.EventFactory().new_event(
  258. eventType=cadftype.EVENTTYPE_ACTIVITY,
  259. outcome=taxonomy.OUTCOME_PENDING,
  260. action=action,
  261. initiator=initiator,
  262. target=target,
  263. observer=resource.Resource(id='target'))
  264. event.requestPath = req.path_qs
  265. event.add_tag(tag.generate_name_value_tag('correlation_id',
  266. correlation_id))
  267. return event