Stephen Finucane
79805827bb
Before enabling PEP8 checks for these files, the actual PEP8 issues need to be resolved. There are a number of "types" of issues that need to be fixed: * E112 expected an indented block * E241 multiple spaces after ',' * E265 block comment should start with '# ' * E302 expected 2 blank lines, found 1 * H102 Apache 2.0 license header not found * H237 module module is removed in Python 3 * H303 No wildcard (*) import. * H404 multi line docstring should start without a leading new line * H231 Python 3.x incompatible 'except x,y:' construct * F403 from module import *' used; unable to detect undefined names * F841 local variable 'name' is assigned to but never used * N344 Use six.iteritems() instead of dict.iteritems(). The fixes for the above are all pretty self-explanatory, but there is one exception. The 'N344' issues are not ignorable due to how the "hacking" check is implemented. Rather than ignoring them, skip the issue altogether by replacing 'iteritems' with 'items'. The difference in memory usage that this incurs should not be noticable. Change-Id: Ie26e3daca3b408c9ea43613bcb9996618b9abc69 Partial-Bug: #1302831
141 lines
4.1 KiB
Python
Executable File
141 lines
4.1 KiB
Python
Executable File
#!/usr/bin/env python
|
|
|
|
# Copyright (c) 2013 OpenStack Foundation
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
# NOTE: XenServer still only supports Python 2.4 in it's dom0 userspace
|
|
# which means the Nova xenapi plugins must use only Python 2.4 features
|
|
|
|
# TODO(sfinucan): Resolve all 'noqa' items once the above is no longer true
|
|
|
|
"""Inject network configuration into iPXE ISO for boot."""
|
|
|
|
import logging
|
|
import os
|
|
import shutil
|
|
|
|
import utils
|
|
|
|
# FIXME(sirp): should this use pluginlib from 5.6?
|
|
import pluginlib_nova
|
|
pluginlib_nova.configure_logging('ipxe')
|
|
|
|
|
|
ISOLINUX_CFG = """SAY iPXE ISO boot image
|
|
TIMEOUT 30
|
|
DEFAULT ipxe.krn
|
|
LABEL ipxe.krn
|
|
KERNEL ipxe.krn
|
|
INITRD netcfg.ipxe
|
|
"""
|
|
|
|
NETCFG_IPXE = """#!ipxe
|
|
:start
|
|
imgfree
|
|
ifclose net0
|
|
set net0/ip %(ip_address)s
|
|
set net0/netmask %(netmask)s
|
|
set net0/gateway %(gateway)s
|
|
set dns %(dns)s
|
|
ifopen net0
|
|
goto menu
|
|
|
|
:menu
|
|
chain %(boot_menu_url)s
|
|
goto boot
|
|
|
|
:boot
|
|
sanboot --no-describe --drive 0x80
|
|
"""
|
|
|
|
|
|
def _write_file(filename, data):
|
|
# If the ISO was tampered with such that the destination is a symlink,
|
|
# that could allow a malicious user to write to protected areas of the
|
|
# dom0 filesystem. /HT to comstud for pointing this out.
|
|
#
|
|
# Short-term, checking that the destination is not a symlink should be
|
|
# sufficient.
|
|
#
|
|
# Long-term, we probably want to perform all file manipulations within a
|
|
# chroot jail to be extra safe.
|
|
if os.path.islink(filename):
|
|
raise RuntimeError('SECURITY: Cannot write to symlinked destination')
|
|
|
|
logging.debug("Writing to file '%s'" % filename)
|
|
f = open(filename, 'w')
|
|
try:
|
|
f.write(data)
|
|
finally:
|
|
f.close()
|
|
|
|
|
|
def _unbundle_iso(sr_path, filename, path):
|
|
logging.debug("Unbundling ISO '%s'" % filename)
|
|
read_only_path = utils.make_staging_area(sr_path)
|
|
try:
|
|
utils.run_command(['mount', '-o', 'loop', filename, read_only_path])
|
|
try:
|
|
shutil.copytree(read_only_path, path)
|
|
finally:
|
|
utils.run_command(['umount', read_only_path])
|
|
finally:
|
|
utils.cleanup_staging_area(read_only_path)
|
|
|
|
|
|
def _create_iso(mkisofs_cmd, filename, path):
|
|
logging.debug("Creating ISO '%s'..." % filename)
|
|
orig_dir = os.getcwd()
|
|
os.chdir(path)
|
|
try:
|
|
utils.run_command([mkisofs_cmd, '-quiet', '-l', '-o', filename,
|
|
'-c', 'boot.cat', '-b', 'isolinux.bin',
|
|
'-no-emul-boot', '-boot-load-size', '4',
|
|
'-boot-info-table', '.'])
|
|
finally:
|
|
os.chdir(orig_dir)
|
|
|
|
|
|
def inject(session, sr_path, vdi_uuid, boot_menu_url, ip_address, netmask,
|
|
gateway, dns, mkisofs_cmd):
|
|
|
|
iso_filename = '%s.img' % os.path.join(sr_path, 'iso', vdi_uuid)
|
|
|
|
# Create staging area so we have a unique path but remove it since
|
|
# shutil.copytree will recreate it
|
|
staging_path = utils.make_staging_area(sr_path)
|
|
utils.cleanup_staging_area(staging_path)
|
|
|
|
try:
|
|
_unbundle_iso(sr_path, iso_filename, staging_path)
|
|
|
|
# Write Configs
|
|
_write_file(os.path.join(staging_path, 'netcfg.ipxe'),
|
|
NETCFG_IPXE % {"ip_address": ip_address,
|
|
"netmask": netmask,
|
|
"gateway": gateway,
|
|
"dns": dns,
|
|
"boot_menu_url": boot_menu_url})
|
|
|
|
_write_file(os.path.join(staging_path, 'isolinux.cfg'),
|
|
ISOLINUX_CFG)
|
|
|
|
_create_iso(mkisofs_cmd, iso_filename, staging_path)
|
|
finally:
|
|
utils.cleanup_staging_area(staging_path)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
utils.register_plugin_calls(inject)
|