Load Balancing as a Service (LBaaS) for OpenStack
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
octavia/octavia/api/v2/controllers/base.py

339 lines
14 KiB

# Copyright 2014 Rackspace
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
from cryptography.hazmat.backends import default_backend
from cryptography import x509
from oslo_config import cfg
from oslo_log import log as logging
from pecan import request as pecan_request
from pecan import rest as pecan_rest
from stevedore import driver as stevedore_driver
from wsme import types as wtypes
from octavia.common import constants
from octavia.common import data_models
from octavia.common import exceptions
from octavia.common import policy
from octavia.db import repositories
from octavia.i18n import _
CONF = cfg.CONF
LOG = logging.getLogger(__name__)
class BaseController(pecan_rest.RestController):
RBAC_TYPE = None
def __init__(self):
super(BaseController, self).__init__()
self.cert_manager = stevedore_driver.DriverManager(
namespace='octavia.cert_manager',
name=CONF.certificates.cert_manager,
invoke_on_load=True,
).driver
self.repositories = repositories.Repositories()
@staticmethod
def _convert_db_to_type(db_entity, to_type, children=False):
"""Converts a data model into an Octavia WSME type
:param db_entity: data model to convert
:param to_type: converts db_entity to this type
"""
if isinstance(to_type, list):
to_type = to_type[0]
def _convert(db_obj):
return to_type.from_data_model(db_obj, children=children)
if isinstance(db_entity, list):
converted = [_convert(db_obj) for db_obj in db_entity]
else:
converted = _convert(db_entity)
return converted
@staticmethod
def _get_db_obj(session, repo, data_model, id, show_deleted=True):
"""Gets an object from the database and returns it."""
db_obj = repo.get(session, id=id, show_deleted=show_deleted)
if not db_obj:
LOG.debug('%(name)s %(id)s not found',
{'name': data_model._name(), 'id': id})
raise exceptions.NotFound(
resource=data_model._name(), id=id)
return db_obj
def _get_db_lb(self, session, id, show_deleted=True):
"""Get a load balancer from the database."""
return self._get_db_obj(session, self.repositories.load_balancer,
data_models.LoadBalancer, id,
show_deleted=show_deleted)
def _get_db_listener(self, session, id, show_deleted=True):
"""Get a listener from the database."""
return self._get_db_obj(session, self.repositories.listener,
data_models.Listener, id,
show_deleted=show_deleted)
def _get_listener_and_loadbalancer_id(self, db_l7policy):
"""Get listener and loadbalancer ids from the l7policy db_model."""
load_balancer_id = db_l7policy.listener.load_balancer_id
listener_id = db_l7policy.listener_id
return load_balancer_id, listener_id
def _get_db_pool(self, session, id, show_deleted=True):
"""Get a pool from the database."""
return self._get_db_obj(session, self.repositories.pool,
data_models.Pool, id,
show_deleted=show_deleted)
def _get_db_member(self, session, id, show_deleted=True):
"""Get a member from the database."""
return self._get_db_obj(session, self.repositories.member,
data_models.Member, id,
show_deleted=show_deleted)
def _get_db_hm(self, session, id, show_deleted=True):
"""Get a health monitor from the database."""
return self._get_db_obj(session, self.repositories.health_monitor,
data_models.HealthMonitor, id,
show_deleted=show_deleted)
def _get_db_flavor(self, session, id):
"""Get a flavor from the database."""
return self._get_db_obj(session, self.repositories.flavor,
data_models.Flavor, id)
def _get_db_flavor_profile(self, session, id):
"""Get a flavor profile from the database."""
return self._get_db_obj(session, self.repositories.flavor_profile,
data_models.FlavorProfile, id)
def _get_db_availability_zone(self, session, name):
"""Get an availability zone from the database."""
db_obj = self.repositories.availability_zone.get(session, name=name)
if not db_obj:
LOG.debug('%(obj_name)s %(name)s not found',
{'obj_name': data_models.AvailabilityZone._name(),
'name': name})
raise exceptions.NotFound(
resource=data_models.AvailabilityZone._name(), id=name)
return db_obj
def _get_db_availability_zone_profile(self, session, id):
"""Get an availability zone profile from the database."""
return self._get_db_obj(session,
self.repositories.availability_zone_profile,
data_models.AvailabilityZoneProfile, id)
def _get_db_l7policy(self, session, id, show_deleted=True):
"""Get a L7 Policy from the database."""
return self._get_db_obj(session, self.repositories.l7policy,
data_models.L7Policy, id,
show_deleted=show_deleted)
def _get_db_l7rule(self, session, id, show_deleted=True):
"""Get a L7 Rule from the database."""
return self._get_db_obj(session, self.repositories.l7rule,
data_models.L7Rule, id,
show_deleted=show_deleted)
def _get_db_amp(self, session, id, show_deleted=True):
"""Gets an Amphora from the database."""
return self._get_db_obj(session, self.repositories.amphora,
data_models.Amphora, id,
show_deleted=show_deleted)
def _get_lb_project_id(self, session, id, show_deleted=True):
"""Get the project_id of the load balancer from the database."""
lb = self._get_db_obj(session, self.repositories.load_balancer,
data_models.LoadBalancer, id,
show_deleted=show_deleted)
return lb.project_id
def _get_lb_project_id_provider(self, session, id, show_deleted=True):
"""Get the project_id of the load balancer from the database."""
lb = self._get_db_obj(session, self.repositories.load_balancer,
data_models.LoadBalancer, id,
show_deleted=show_deleted)
return lb.project_id, lb.provider
def _get_l7policy_project_id(self, session, id, show_deleted=True):
"""Get the project_id of the load balancer from the database."""
l7policy = self._get_db_obj(session, self.repositories.l7policy,
data_models.LoadBalancer, id,
show_deleted=show_deleted)
return l7policy.project_id
def _get_default_quotas(self, project_id):
"""Gets the project's default quotas."""
quotas = data_models.Quotas(
project_id=project_id,
load_balancer=CONF.quotas.default_load_balancer_quota,
listener=CONF.quotas.default_listener_quota,
pool=CONF.quotas.default_pool_quota,
health_monitor=CONF.quotas.default_health_monitor_quota,
member=CONF.quotas.default_member_quota)
return quotas
def _get_db_quotas(self, session, project_id):
"""Gets the project's quotas from the database, or responds with the
default quotas.
"""
# At this point project_id should not ever be None or Unset
db_quotas = self.repositories.quotas.get(
session, project_id=project_id)
if not db_quotas:
LOG.debug("No custom quotas for project %s. Returning "
"defaults...", project_id)
db_quotas = self._get_default_quotas(project_id=project_id)
else:
# Fill in any that are using the configured defaults
if db_quotas.load_balancer is None:
db_quotas.load_balancer = (CONF.quotas.
default_load_balancer_quota)
if db_quotas.listener is None:
db_quotas.listener = CONF.quotas.default_listener_quota
if db_quotas.pool is None:
db_quotas.pool = CONF.quotas.default_pool_quota
if db_quotas.health_monitor is None:
db_quotas.health_monitor = (CONF.quotas.
default_health_monitor_quota)
if db_quotas.member is None:
db_quotas.member = CONF.quotas.default_member_quota
return db_quotas
def _auth_get_all(self, context, project_id):
# Check authorization to list objects under all projects
action = '{rbac_obj}{action}'.format(
rbac_obj=self.RBAC_TYPE, action=constants.RBAC_GET_ALL_GLOBAL)
target = {'project_id': project_id}
if not policy.get_enforcer().authorize(action, target,
context, do_raise=False):
# Not a global observer or admin
if project_id is None:
project_id = context.project_id
# Check authorization to list objects under this project
self._auth_validate_action(context, project_id,
constants.RBAC_GET_ALL)
if project_id is None:
query_filter = {}
else:
query_filter = {'project_id': project_id}
return query_filter
def _auth_validate_action(self, context, project_id, action):
# Check that the user is authorized to do an action in this object
action = '{rbac_obj}{action}'.format(
rbac_obj=self.RBAC_TYPE, action=action)
target = {'project_id': project_id}
policy.get_enforcer().authorize(action, target, context)
def _filter_fields(self, object_list, fields):
if CONF.api_settings.allow_field_selection:
for index, obj in enumerate(object_list):
members = self._get_attrs(obj)
for member in members:
if member not in fields:
setattr(obj, member, wtypes.Unset)
return object_list
@staticmethod
def _get_attrs(obj):
attrs = [attr for attr in dir(obj) if not callable(
getattr(obj, attr)) and not attr.startswith("_")]
return attrs
def _validate_tls_refs(self, tls_refs):
context = pecan_request.context.get('octavia_context')
bad_refs = []
for ref in tls_refs:
try:
self.cert_manager.set_acls(context, ref)
self.cert_manager.get_cert(context, ref, check_only=True)
except exceptions.UnreadablePKCS12:
raise
except Exception:
bad_refs.append(ref)
if bad_refs:
raise exceptions.CertificateRetrievalException(ref=bad_refs)
def _validate_client_ca_and_crl_refs(self, client_ca_ref, crl_ref):
context = pecan_request.context.get('octavia_context')
bad_refs = []
try:
self.cert_manager.set_acls(context, client_ca_ref)
ca_pem = self.cert_manager.get_secret(context, client_ca_ref)
except Exception:
bad_refs.append(client_ca_ref)
pem_crl = None
if crl_ref:
try:
self.cert_manager.set_acls(context, crl_ref)
pem_crl = self.cert_manager.get_secret(context, crl_ref)
except Exception:
bad_refs.append(crl_ref)
if bad_refs:
raise exceptions.CertificateRetrievalException(ref=bad_refs)
ca_cert = None
try:
# Test if it needs to be UTF-8 encoded
try:
ca_pem = ca_pem.encode('utf-8')
except AttributeError:
pass
ca_cert = x509.load_pem_x509_certificate(ca_pem, default_backend())
except Exception as e:
raise exceptions.ValidationException(detail=_(
"The client authentication CA certificate is invalid. "
"It must be a valid x509 PEM format certificate. "
"Error: %s") % str(e))
# Validate the CRL is for the client CA
if pem_crl:
ca_pub_key = ca_cert.public_key()
crl = None
# Test if it needs to be UTF-8 encoded
try:
pem_crl = pem_crl.encode('utf-8')
except AttributeError:
pass
try:
crl = x509.load_pem_x509_crl(pem_crl, default_backend())
except Exception as e:
raise exceptions.ValidationException(detail=_(
"The client authentication certificate revocation list "
"is invalid. It must be a valid x509 PEM format "
"certificate revocation list. Error: %s") % str(e))
if not crl.is_signature_valid(ca_pub_key):
raise exceptions.ValidationException(detail=_(
"The CRL specified is not valid for client certificate "
"authority reference supplied."))
@staticmethod
def _validate_protocol(listener_protocol, pool_protocol):
proto_map = constants.VALID_LISTENER_POOL_PROTOCOL_MAP
for valid_pool_proto in proto_map[listener_protocol]:
if pool_protocol == valid_pool_proto:
return
detail = _("The pool protocol '%(pool_protocol)s' is invalid while "
"the listener protocol is '%(listener_protocol)s'.") % {
"pool_protocol": pool_protocol,
"listener_protocol": listener_protocol}
raise exceptions.ValidationException(detail=detail)