From e9b31deb2ec0f5b6ef9b29c8ccabed8538b2c480 Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Wed, 2 Mar 2011 01:21:54 -0800 Subject: [PATCH 01/18] initial commit of vnc support --- nova/flags.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/nova/flags.py b/nova/flags.py index 8cf199b2..4f2be82b 100644 --- a/nova/flags.py +++ b/nova/flags.py @@ -281,6 +281,12 @@ DEFINE_string('ajax_console_proxy_url', in the form "http://127.0.0.1:8000"') DEFINE_string('ajax_console_proxy_port', 8000, 'port that ajax_console_proxy binds') +DEFINE_string('vnc_console_proxy_topic', 'vnc_proxy', + 'the topic vnc proxy nodes listen on') +DEFINE_string('vnc_console_proxy_url', + 'http://127.0.0.1:6080', + 'location of vnc console proxy, \ + in the form "http://127.0.0.1:6080"') DEFINE_bool('verbose', False, 'show debug output') DEFINE_boolean('fake_rabbit', False, 'use a fake rabbit') DEFINE_bool('fake_network', False, From a2a7736d01a5ef62827e75dbc5aa4908f37436d1 Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Tue, 22 Mar 2011 13:25:53 -0700 Subject: [PATCH 02/18] add in eventlet version of vnc proxy --- bin/nova-vnc-proxy | 203 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 203 insertions(+) create mode 100644 bin/nova-vnc-proxy diff --git a/bin/nova-vnc-proxy b/bin/nova-vnc-proxy new file mode 100644 index 00000000..5f913a82 --- /dev/null +++ b/bin/nova-vnc-proxy @@ -0,0 +1,203 @@ +#!/usr/bin/env python +# pylint: disable-msg=C0103 +# vim: tabstop=4 shiftwidth=4 softtabstop=4 + +# Copyright 2010 United States Government as represented by the +# Administrator of the National Aeronautics and Space Administration. +# All Rights Reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +"""VNC Console Proxy Server""" + +from base64 import b64encode, b64decode +import eventlet +from eventlet import wsgi +from eventlet import websocket +import os +import random +import sys +import time +from webob import Request + +possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]), + os.pardir, + os.pardir)) +if os.path.exists(os.path.join(possible_topdir, 'nova', '__init__.py')): + sys.path.insert(0, possible_topdir) + +from nova import flags +from nova import log as logging +from nova import rpc +from nova import utils + +FLAGS = flags.FLAGS +flags.DEFINE_string('vnc_novnc_dir', '/code/noVNC/vnclet/noVNC', + 'Full path to noVNC directory') +flags.DEFINE_boolean('vnc_debug', True, + 'Enable debugging features, like token bypassing') +flags.DEFINE_integer('vnc_proxy_port', 7000, + 'Port that the VNC proxy should bind to') +flags.DEFINE_string('vnc_proxy_address', '0.0.0.0', + 'Address that the VNC proxy should bind to') + + +class WebsocketVNCProxy(object): + """Class to proxy from websocket to vnc server""" + + def sock2ws(self, source, dest): + try: + while True: + d = source.recv(32384) + if d == '': + break + d = b64encode(d) + dest.send(d) + except: + source.close() + dest.close() + + def ws2sock(self, source, dest): + try: + while True: + d = source.wait() + if d is None: + break + d = b64decode(d) + dest.sendall(d) + except: + source.close() + dest.close() + + def proxy_connection(self, environ, start_response): + @websocket.WebSocketWSGI + def _handle(client): + server = eventlet.connect((client.environ['vnc_host'], + client.environ['vnc_port'])) + t1 = eventlet.spawn(self.ws2sock, client, server) + t2 = eventlet.spawn(self.sock2ws, server, client) + t1.wait() + t2.wait() + _handle(environ, start_response) + + def serve(self, environ, start_response): + req = Request(environ) + if req.path == '/data': + return self.proxy_connection(environ, start_response) + else: + if req.path == '/': + fname = '/vnc_auto.html' + else: + fname = req.path + + fname = FLAGS.vnc_novnc_dir + fname + + base, ext = os.path.splitext(fname) + if ext == '.js': + mimetype = 'application/javascript' + elif ext == '.css': + mimetype = 'text/css' + elif ext in ['.svg', '.jpg', '.png', '.gif']: + mimetype = 'image' + else: + mimetype = 'text/html' + + start_response('200 OK', [('content-type', mimetype)]) + return [open(os.path.join(fname)).read()] + + +class DebugAuthMiddleware(object): + """ Debug middleware for testing purposes. Skips security check + and allows host and port of vnc endpoint to be specified in + the url. + """ + + def __init__(self, app): + self.app = app + + def __call__(self, environ, start_response): + req = Request(environ) + environ['vnc_host'] = req.params.get('host') + environ['vnc_port'] = int(req.params.get('port')) + resp = req.get_response(self.app) + return resp(environ, start_response) + + +class NovaAuthMiddleware(object): + """Implementation of Middleware to Handle Nova Auth""" + + def __init__(self, app): + self.app = app + self.register_listeners() + + def __call__(self, environ, start_response): + req = Request(environ) + + if req.path == '/data': + token = req.params.get('token') + if not token in self.tokens: + start_response('403 Forbidden', + [('content-type', 'text/html')]) + return 'Not Authorized' + + environ['vnc_host'] = self.tokens[token]['args']['host'] + environ['vnc_port'] = int(self.tokens[token]['args']['port']) + + resp = req.get_response(self.app) + return resp(environ, start_response) + + def register_listeners(self): + middleware = self + middleware.tokens = {} + + class Callback: + def __call__(self, data, message): + if data['method'] == 'authorize_vnc_console': + middleware.tokens[data['args']['token']] = \ + {'args': data['args'], 'last_activity_at': time.time()} + + def delete_expired_tokens(): + now = time.time() + to_delete = [] + for k, v in middleware.tokens.items(): + if now - v['last_activity_at'] > 600: + to_delete.append(k) + + for k in to_delete: + del middleware.tokens[k] + + conn = rpc.Connection.instance(new=True) + consumer = rpc.TopicConsumer( + connection=conn, + topic=FLAGS.vnc_console_proxy_topic) + consumer.register_callback(Callback()) + + utils.LoopingCall(consumer.fetch, auto_ack=True, + enable_callbacks=True).start(0.1) + utils.LoopingCall(delete_expired_tokens).start(1) + + +if __name__ == "__main__": + utils.default_flagfile() + FLAGS(sys.argv) + logging.setup() + + listener = eventlet.listen((FLAGS.vnc_proxy_address, FLAGS.vnc_proxy_port)) + proxy = WebsocketVNCProxy() + + if FLAGS.vnc_debug: + proxy = DebugAuthMiddleware(proxy.serve) + else: + proxy = NovaAuthMiddleware(proxy.serve) + + wsgi.server(listener, proxy, max_size=1000) From 676eb4d1622b0c225be790a52d20d6af39f6a794 Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Tue, 22 Mar 2011 13:26:23 -0700 Subject: [PATCH 03/18] intermediate progress on vnc-nova integration. checking in to show vish. --- nova/flags.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/nova/flags.py b/nova/flags.py index 4f2be82b..0360b1e3 100644 --- a/nova/flags.py +++ b/nova/flags.py @@ -287,6 +287,10 @@ DEFINE_string('vnc_console_proxy_url', 'http://127.0.0.1:6080', 'location of vnc console proxy, \ in the form "http://127.0.0.1:6080"') +DEFINE_string('vnc_host_iface', '0.0.0.0', + 'the compute host interface on which vnc server should listen') +DEFINE_bool('vnc_enabled', True, + 'enable vnc related features') DEFINE_bool('verbose', False, 'show debug output') DEFINE_boolean('fake_rabbit', False, 'use a fake rabbit') DEFINE_bool('fake_network', False, From 47634b59c59582f014f5b5f03f42df73b02e8caa Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Tue, 22 Mar 2011 13:28:19 -0700 Subject: [PATCH 04/18] make executable --- bin/nova-vnc-proxy | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 bin/nova-vnc-proxy diff --git a/bin/nova-vnc-proxy b/bin/nova-vnc-proxy old mode 100644 new mode 100755 From 04eedd71c538f90cf804309a3f3a617ad3cc4f5e Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Wed, 23 Mar 2011 01:57:38 -0700 Subject: [PATCH 05/18] separating out components of vnc console --- bin/nova-vnc-proxy | 177 +++++++-------------------------------------- 1 file changed, 26 insertions(+), 151 deletions(-) diff --git a/bin/nova-vnc-proxy b/bin/nova-vnc-proxy index 5f913a82..52e96609 100755 --- a/bin/nova-vnc-proxy +++ b/bin/nova-vnc-proxy @@ -20,15 +20,10 @@ """VNC Console Proxy Server""" -from base64 import b64encode, b64decode import eventlet -from eventlet import wsgi -from eventlet import websocket +import gettext import os -import random import sys -import time -from webob import Request possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]), os.pardir, @@ -36,168 +31,48 @@ possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]), if os.path.exists(os.path.join(possible_topdir, 'nova', '__init__.py')): sys.path.insert(0, possible_topdir) +gettext.install('nova', unicode=1) + from nova import flags from nova import log as logging -from nova import rpc from nova import utils +from nova import wsgi +from nova.vnc import auth +from nova.vnc import proxy FLAGS = flags.FLAGS -flags.DEFINE_string('vnc_novnc_dir', '/code/noVNC/vnclet/noVNC', +flags.DEFINE_string('vnc_proxy_wwwroot', '/code/noVNC/vnclet/noVNC', 'Full path to noVNC directory') -flags.DEFINE_boolean('vnc_debug', True, +flags.DEFINE_boolean('vnc_debug', False, 'Enable debugging features, like token bypassing') flags.DEFINE_integer('vnc_proxy_port', 7000, 'Port that the VNC proxy should bind to') -flags.DEFINE_string('vnc_proxy_address', '0.0.0.0', +flags.DEFINE_string('vnc_proxy_host', '0.0.0.0', 'Address that the VNC proxy should bind to') - - -class WebsocketVNCProxy(object): - """Class to proxy from websocket to vnc server""" - - def sock2ws(self, source, dest): - try: - while True: - d = source.recv(32384) - if d == '': - break - d = b64encode(d) - dest.send(d) - except: - source.close() - dest.close() - - def ws2sock(self, source, dest): - try: - while True: - d = source.wait() - if d is None: - break - d = b64decode(d) - dest.sendall(d) - except: - source.close() - dest.close() - - def proxy_connection(self, environ, start_response): - @websocket.WebSocketWSGI - def _handle(client): - server = eventlet.connect((client.environ['vnc_host'], - client.environ['vnc_port'])) - t1 = eventlet.spawn(self.ws2sock, client, server) - t2 = eventlet.spawn(self.sock2ws, server, client) - t1.wait() - t2.wait() - _handle(environ, start_response) - - def serve(self, environ, start_response): - req = Request(environ) - if req.path == '/data': - return self.proxy_connection(environ, start_response) - else: - if req.path == '/': - fname = '/vnc_auto.html' - else: - fname = req.path - - fname = FLAGS.vnc_novnc_dir + fname - - base, ext = os.path.splitext(fname) - if ext == '.js': - mimetype = 'application/javascript' - elif ext == '.css': - mimetype = 'text/css' - elif ext in ['.svg', '.jpg', '.png', '.gif']: - mimetype = 'image' - else: - mimetype = 'text/html' - - start_response('200 OK', [('content-type', mimetype)]) - return [open(os.path.join(fname)).read()] - - -class DebugAuthMiddleware(object): - """ Debug middleware for testing purposes. Skips security check - and allows host and port of vnc endpoint to be specified in - the url. - """ - - def __init__(self, app): - self.app = app - - def __call__(self, environ, start_response): - req = Request(environ) - environ['vnc_host'] = req.params.get('host') - environ['vnc_port'] = int(req.params.get('port')) - resp = req.get_response(self.app) - return resp(environ, start_response) - - -class NovaAuthMiddleware(object): - """Implementation of Middleware to Handle Nova Auth""" - - def __init__(self, app): - self.app = app - self.register_listeners() - - def __call__(self, environ, start_response): - req = Request(environ) - - if req.path == '/data': - token = req.params.get('token') - if not token in self.tokens: - start_response('403 Forbidden', - [('content-type', 'text/html')]) - return 'Not Authorized' - - environ['vnc_host'] = self.tokens[token]['args']['host'] - environ['vnc_port'] = int(self.tokens[token]['args']['port']) - - resp = req.get_response(self.app) - return resp(environ, start_response) - - def register_listeners(self): - middleware = self - middleware.tokens = {} - - class Callback: - def __call__(self, data, message): - if data['method'] == 'authorize_vnc_console': - middleware.tokens[data['args']['token']] = \ - {'args': data['args'], 'last_activity_at': time.time()} - - def delete_expired_tokens(): - now = time.time() - to_delete = [] - for k, v in middleware.tokens.items(): - if now - v['last_activity_at'] > 600: - to_delete.append(k) - - for k in to_delete: - del middleware.tokens[k] - - conn = rpc.Connection.instance(new=True) - consumer = rpc.TopicConsumer( - connection=conn, - topic=FLAGS.vnc_console_proxy_topic) - consumer.register_callback(Callback()) - - utils.LoopingCall(consumer.fetch, auto_ack=True, - enable_callbacks=True).start(0.1) - utils.LoopingCall(delete_expired_tokens).start(1) - +flags.DEFINE_flag(flags.HelpFlag()) +flags.DEFINE_flag(flags.HelpshortFlag()) +flags.DEFINE_flag(flags.HelpXMLFlag()) if __name__ == "__main__": utils.default_flagfile() FLAGS(sys.argv) logging.setup() - listener = eventlet.listen((FLAGS.vnc_proxy_address, FLAGS.vnc_proxy_port)) - proxy = WebsocketVNCProxy() + app = proxy.WebsocketVNCProxy(FLAGS.vnc_proxy_wwwroot) if FLAGS.vnc_debug: - proxy = DebugAuthMiddleware(proxy.serve) + app = proxy.DebugMiddleware(app.serve) else: - proxy = NovaAuthMiddleware(proxy.serve) + app = auth.NovaAuthMiddleware(app.serve) - wsgi.server(listener, proxy, max_size=1000) + + listener = eventlet.listen((FLAGS.vnc_proxy_host, FLAGS.vnc_proxy_port)) + + + from eventlet import wsgi + wsgi.server(listener, app, max_size=1000) + + +# server = wsgi.Server() +# server.start(app, FLAGS.vnc_proxy_port, host=FLAGS.vnc_proxy_host) +# server.wait() From f3d7969263cbcb7e4e76aaad357d08768e0d58ba Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Wed, 23 Mar 2011 02:06:16 -0700 Subject: [PATCH 06/18] use the nova Server object --- bin/nova-vnc-proxy | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) diff --git a/bin/nova-vnc-proxy b/bin/nova-vnc-proxy index 52e96609..5891652c 100755 --- a/bin/nova-vnc-proxy +++ b/bin/nova-vnc-proxy @@ -61,18 +61,10 @@ if __name__ == "__main__": app = proxy.WebsocketVNCProxy(FLAGS.vnc_proxy_wwwroot) if FLAGS.vnc_debug: - app = proxy.DebugMiddleware(app.serve) + app = proxy.DebugMiddleware(app) else: - app = auth.NovaAuthMiddleware(app.serve) + app = auth.NovaAuthMiddleware(app) - - listener = eventlet.listen((FLAGS.vnc_proxy_host, FLAGS.vnc_proxy_port)) - - - from eventlet import wsgi - wsgi.server(listener, app, max_size=1000) - - -# server = wsgi.Server() -# server.start(app, FLAGS.vnc_proxy_port, host=FLAGS.vnc_proxy_host) -# server.wait() + server = wsgi.Server() + server.start(app, FLAGS.vnc_proxy_port, host=FLAGS.vnc_proxy_host) + server.wait() From c98b2efa9520131dec8f0c52a89059feea861fcd Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Wed, 23 Mar 2011 02:33:11 -0700 Subject: [PATCH 07/18] more progress --- bin/nova-vnc-proxy | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/bin/nova-vnc-proxy b/bin/nova-vnc-proxy index 5891652c..838c871d 100755 --- a/bin/nova-vnc-proxy +++ b/bin/nova-vnc-proxy @@ -37,9 +37,12 @@ from nova import flags from nova import log as logging from nova import utils from nova import wsgi +from nova import version from nova.vnc import auth from nova.vnc import proxy +LOG = logging.getLogger('nova.vnc-proxy') + FLAGS = flags.FLAGS flags.DEFINE_string('vnc_proxy_wwwroot', '/code/noVNC/vnclet/noVNC', 'Full path to noVNC directory') @@ -58,13 +61,18 @@ if __name__ == "__main__": FLAGS(sys.argv) logging.setup() + LOG.audit(_("Starting nova-vnc-proxy node (version %s)"), + version.version_string_with_vcs()) + app = proxy.WebsocketVNCProxy(FLAGS.vnc_proxy_wwwroot) + with_logging = auth.LoggingMiddleware(app) + if FLAGS.vnc_debug: - app = proxy.DebugMiddleware(app) + with_auth = proxy.DebugMiddleware(with_logging) else: - app = auth.NovaAuthMiddleware(app) + with_auth = auth.NovaAuthMiddleware(with_logging) server = wsgi.Server() - server.start(app, FLAGS.vnc_proxy_port, host=FLAGS.vnc_proxy_host) + server.start(with_auth, FLAGS.vnc_proxy_port, host=FLAGS.vnc_proxy_host) server.wait() From 7e515b92864cbc768835d8fba0cbd733fc8ebd39 Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Wed, 23 Mar 2011 15:53:46 -0700 Subject: [PATCH 08/18] general cleanup, use whitelist for webserver security --- bin/nova-vnc-proxy | 22 ++++++++++++++++++---- nova/flags.py | 2 +- 2 files changed, 19 insertions(+), 5 deletions(-) diff --git a/bin/nova-vnc-proxy b/bin/nova-vnc-proxy index 838c871d..4cd1e908 100755 --- a/bin/nova-vnc-proxy +++ b/bin/nova-vnc-proxy @@ -44,14 +44,16 @@ from nova.vnc import proxy LOG = logging.getLogger('nova.vnc-proxy') FLAGS = flags.FLAGS -flags.DEFINE_string('vnc_proxy_wwwroot', '/code/noVNC/vnclet/noVNC', +flags.DEFINE_string('vnc_proxy_wwwroot', '/code/noVNC/', 'Full path to noVNC directory') flags.DEFINE_boolean('vnc_debug', False, 'Enable debugging features, like token bypassing') -flags.DEFINE_integer('vnc_proxy_port', 7000, +flags.DEFINE_integer('vnc_proxy_port', 6080, 'Port that the VNC proxy should bind to') -flags.DEFINE_string('vnc_proxy_host', '0.0.0.0', +flags.DEFINE_string('vnc_proxy_iface', '0.0.0.0', 'Address that the VNC proxy should bind to') +flags.DEFINE_integer('vnc_token_ttl', 300, + 'How many seconds before deleting tokens') flags.DEFINE_flag(flags.HelpFlag()) flags.DEFINE_flag(flags.HelpshortFlag()) flags.DEFINE_flag(flags.HelpXMLFlag()) @@ -64,8 +66,20 @@ if __name__ == "__main__": LOG.audit(_("Starting nova-vnc-proxy node (version %s)"), version.version_string_with_vcs()) + if not os.path.exists(FLAGS.vnc_proxy_wwwroot): + LOG.info(_("Missing vnc_proxy_wwwroot (version %s)"), + FLAGS.vnc_proxy_wwwroot) + LOG.info(_("You need a slightly modified version of noVNC " + "to work with the nova-vnc-proxy")) + LOG.info(_("Check out the most recent nova noVNC code here: %s"), + "git://github.com/sleepsonthefloor/noVNC.git") + exit(1) + app = proxy.WebsocketVNCProxy(FLAGS.vnc_proxy_wwwroot) + LOG.audit(_("Allowing access to the following files: %s"), + app.get_whitelist()) + with_logging = auth.LoggingMiddleware(app) if FLAGS.vnc_debug: @@ -74,5 +88,5 @@ if __name__ == "__main__": with_auth = auth.NovaAuthMiddleware(with_logging) server = wsgi.Server() - server.start(with_auth, FLAGS.vnc_proxy_port, host=FLAGS.vnc_proxy_host) + server.start(with_auth, FLAGS.vnc_proxy_port, host=FLAGS.vnc_proxy_iface) server.wait() diff --git a/nova/flags.py b/nova/flags.py index 0360b1e3..a0ea1079 100644 --- a/nova/flags.py +++ b/nova/flags.py @@ -287,7 +287,7 @@ DEFINE_string('vnc_console_proxy_url', 'http://127.0.0.1:6080', 'location of vnc console proxy, \ in the form "http://127.0.0.1:6080"') -DEFINE_string('vnc_host_iface', '0.0.0.0', +DEFINE_string('vnc_compute_host_iface', '0.0.0.0', 'the compute host interface on which vnc server should listen') DEFINE_bool('vnc_enabled', True, 'enable vnc related features') From ab8b2dc4149244e90718eae96a39a5b53435f81f Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Wed, 23 Mar 2011 16:11:50 -0700 Subject: [PATCH 09/18] make missing noVNC error condition a bit more fool-proof --- bin/nova-vnc-proxy | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/bin/nova-vnc-proxy b/bin/nova-vnc-proxy index 4cd1e908..ea2533dc 100755 --- a/bin/nova-vnc-proxy +++ b/bin/nova-vnc-proxy @@ -44,7 +44,7 @@ from nova.vnc import proxy LOG = logging.getLogger('nova.vnc-proxy') FLAGS = flags.FLAGS -flags.DEFINE_string('vnc_proxy_wwwroot', '/code/noVNC/', +flags.DEFINE_string('vnc_proxy_wwwroot', '/var/lib/nova/noVNC/', 'Full path to noVNC directory') flags.DEFINE_boolean('vnc_debug', False, 'Enable debugging features, like token bypassing') @@ -66,13 +66,15 @@ if __name__ == "__main__": LOG.audit(_("Starting nova-vnc-proxy node (version %s)"), version.version_string_with_vcs()) - if not os.path.exists(FLAGS.vnc_proxy_wwwroot): + if not (os.path.exists(FLAGS.vnc_proxy_wwwroot) and + os.path.exists(FLAGS.vnc_proxy_wwwroot + '/vnc_auto.html')): LOG.info(_("Missing vnc_proxy_wwwroot (version %s)"), FLAGS.vnc_proxy_wwwroot) LOG.info(_("You need a slightly modified version of noVNC " - "to work with the nova-vnc-proxy")) - LOG.info(_("Check out the most recent nova noVNC code here: %s"), - "git://github.com/sleepsonthefloor/noVNC.git") + "to work with the nova-vnc-proxy")) + LOG.info(_("Check out the most recent nova noVNC code: %s"), + "git://github.com/sleepsonthefloor/noVNC.git") + LOG.info(_("And drop it in %s"), FLAGS.vnc_proxy_wwwroot) exit(1) app = proxy.WebsocketVNCProxy(FLAGS.vnc_proxy_wwwroot) From 326b236eb953096934429e9c2af72ebee76057bf Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Thu, 24 Mar 2011 00:10:28 -0700 Subject: [PATCH 10/18] minor tweak from termie feedback --- bin/nova-vnc-proxy | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/bin/nova-vnc-proxy b/bin/nova-vnc-proxy index ea2533dc..e7b647c0 100755 --- a/bin/nova-vnc-proxy +++ b/bin/nova-vnc-proxy @@ -1,5 +1,4 @@ #!/usr/bin/env python -# pylint: disable-msg=C0103 # vim: tabstop=4 shiftwidth=4 softtabstop=4 # Copyright 2010 United States Government as represented by the @@ -50,7 +49,7 @@ flags.DEFINE_boolean('vnc_debug', False, 'Enable debugging features, like token bypassing') flags.DEFINE_integer('vnc_proxy_port', 6080, 'Port that the VNC proxy should bind to') -flags.DEFINE_string('vnc_proxy_iface', '0.0.0.0', +flags.DEFINE_string('vnc_proxy_host', '0.0.0.0', 'Address that the VNC proxy should bind to') flags.DEFINE_integer('vnc_token_ttl', 300, 'How many seconds before deleting tokens') @@ -90,5 +89,5 @@ if __name__ == "__main__": with_auth = auth.NovaAuthMiddleware(with_logging) server = wsgi.Server() - server.start(with_auth, FLAGS.vnc_proxy_port, host=FLAGS.vnc_proxy_iface) + server.start(with_auth, FLAGS.vnc_proxy_port, host=FLAGS.vnc_proxy_host) server.wait() From 9a0bad2e2012b91992a331115b88abda1c51db4d Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Thu, 24 Mar 2011 15:55:29 -0700 Subject: [PATCH 11/18] incorporate feedback from termie --- bin/nova-vnc-proxy | 5 ++--- nova/flags.py | 4 ++-- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/bin/nova-vnc-proxy b/bin/nova-vnc-proxy index ea2533dc..e7b647c0 100755 --- a/bin/nova-vnc-proxy +++ b/bin/nova-vnc-proxy @@ -1,5 +1,4 @@ #!/usr/bin/env python -# pylint: disable-msg=C0103 # vim: tabstop=4 shiftwidth=4 softtabstop=4 # Copyright 2010 United States Government as represented by the @@ -50,7 +49,7 @@ flags.DEFINE_boolean('vnc_debug', False, 'Enable debugging features, like token bypassing') flags.DEFINE_integer('vnc_proxy_port', 6080, 'Port that the VNC proxy should bind to') -flags.DEFINE_string('vnc_proxy_iface', '0.0.0.0', +flags.DEFINE_string('vnc_proxy_host', '0.0.0.0', 'Address that the VNC proxy should bind to') flags.DEFINE_integer('vnc_token_ttl', 300, 'How many seconds before deleting tokens') @@ -90,5 +89,5 @@ if __name__ == "__main__": with_auth = auth.NovaAuthMiddleware(with_logging) server = wsgi.Server() - server.start(with_auth, FLAGS.vnc_proxy_port, host=FLAGS.vnc_proxy_iface) + server.start(with_auth, FLAGS.vnc_proxy_port, host=FLAGS.vnc_proxy_host) server.wait() diff --git a/nova/flags.py b/nova/flags.py index a0ea1079..1d246920 100644 --- a/nova/flags.py +++ b/nova/flags.py @@ -287,8 +287,8 @@ DEFINE_string('vnc_console_proxy_url', 'http://127.0.0.1:6080', 'location of vnc console proxy, \ in the form "http://127.0.0.1:6080"') -DEFINE_string('vnc_compute_host_iface', '0.0.0.0', - 'the compute host interface on which vnc server should listen') +DEFINE_string('vnc_server_host', '0.0.0.0', + 'the host interface on which vnc server should listen') DEFINE_bool('vnc_enabled', True, 'enable vnc related features') DEFINE_bool('verbose', False, 'show debug output') From 11f8e42224214640338c6d18918340056f5caff6 Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Mon, 28 Mar 2011 15:30:25 -0700 Subject: [PATCH 12/18] add period, test github --- bin/nova-vnc-proxy | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/nova-vnc-proxy b/bin/nova-vnc-proxy index e7b647c0..d39a9613 100755 --- a/bin/nova-vnc-proxy +++ b/bin/nova-vnc-proxy @@ -17,7 +17,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -"""VNC Console Proxy Server""" +"""VNC Console Proxy Server.""" import eventlet import gettext From 5a1ac29b8dc9048812454ed6b499b10d27103aaa Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Mon, 28 Mar 2011 15:38:09 -0700 Subject: [PATCH 13/18] address some of termie's recommendations --- bin/nova-vnc-proxy | 3 +++ nova/tests/test_compute.py | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/bin/nova-vnc-proxy b/bin/nova-vnc-proxy index d39a9613..e26bc6d8 100755 --- a/bin/nova-vnc-proxy +++ b/bin/nova-vnc-proxy @@ -40,8 +40,10 @@ from nova import version from nova.vnc import auth from nova.vnc import proxy + LOG = logging.getLogger('nova.vnc-proxy') + FLAGS = flags.FLAGS flags.DEFINE_string('vnc_proxy_wwwroot', '/var/lib/nova/noVNC/', 'Full path to noVNC directory') @@ -57,6 +59,7 @@ flags.DEFINE_flag(flags.HelpFlag()) flags.DEFINE_flag(flags.HelpshortFlag()) flags.DEFINE_flag(flags.HelpXMLFlag()) + if __name__ == "__main__": utils.default_flagfile() FLAGS(sys.argv) diff --git a/nova/tests/test_compute.py b/nova/tests/test_compute.py index 0be08a77..038824ef 100644 --- a/nova/tests/test_compute.py +++ b/nova/tests/test_compute.py @@ -290,7 +290,7 @@ class ComputeTestCase(test.TestCase): self.compute.terminate_instance(self.context, instance_id) def test_vnc_console(self): - """Make sure we can a vnc console for an instance""" + """Make sure we can a vnc console for an instance.""" instance_id = self._create_instance() self.compute.run_instance(self.context, instance_id) From f59aeae0b9a5c5c5b328350dc9b19b92110de0e9 Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Tue, 29 Mar 2011 12:54:35 -0700 Subject: [PATCH 14/18] use manager pattern for auth token proxy --- bin/{nova-vnc-proxy => nova-vncproxy} | 31 ++++++++++++++++----------- nova/flags.py | 2 +- 2 files changed, 19 insertions(+), 14 deletions(-) rename bin/{nova-vnc-proxy => nova-vncproxy} (75%) diff --git a/bin/nova-vnc-proxy b/bin/nova-vncproxy similarity index 75% rename from bin/nova-vnc-proxy rename to bin/nova-vncproxy index e26bc6d8..0fad8397 100755 --- a/bin/nova-vnc-proxy +++ b/bin/nova-vncproxy @@ -1,8 +1,7 @@ #!/usr/bin/env python # vim: tabstop=4 shiftwidth=4 softtabstop=4 -# Copyright 2010 United States Government as represented by the -# Administrator of the National Aeronautics and Space Administration. +# Copyright (c) 2010 Openstack, LLC. # All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); @@ -34,6 +33,7 @@ gettext.install('nova', unicode=1) from nova import flags from nova import log as logging +from nova import service from nova import utils from nova import wsgi from nova import version @@ -45,16 +45,19 @@ LOG = logging.getLogger('nova.vnc-proxy') FLAGS = flags.FLAGS -flags.DEFINE_string('vnc_proxy_wwwroot', '/var/lib/nova/noVNC/', +flags.DEFINE_string('vncproxy_wwwroot', '/var/lib/nova/noVNC/', 'Full path to noVNC directory') flags.DEFINE_boolean('vnc_debug', False, 'Enable debugging features, like token bypassing') -flags.DEFINE_integer('vnc_proxy_port', 6080, +flags.DEFINE_integer('vncproxy_port', 6080, 'Port that the VNC proxy should bind to') -flags.DEFINE_string('vnc_proxy_host', '0.0.0.0', +flags.DEFINE_string('vncproxy_host', '0.0.0.0', 'Address that the VNC proxy should bind to') flags.DEFINE_integer('vnc_token_ttl', 300, 'How many seconds before deleting tokens') +flags.DEFINE_string('vncproxy_manager', 'nova.vnc.auth.VNCProxyAuthManager', + 'Manager for vncproxy auth') + flags.DEFINE_flag(flags.HelpFlag()) flags.DEFINE_flag(flags.HelpshortFlag()) flags.DEFINE_flag(flags.HelpXMLFlag()) @@ -68,18 +71,20 @@ if __name__ == "__main__": LOG.audit(_("Starting nova-vnc-proxy node (version %s)"), version.version_string_with_vcs()) - if not (os.path.exists(FLAGS.vnc_proxy_wwwroot) and - os.path.exists(FLAGS.vnc_proxy_wwwroot + '/vnc_auto.html')): - LOG.info(_("Missing vnc_proxy_wwwroot (version %s)"), - FLAGS.vnc_proxy_wwwroot) + service.serve() + + if not (os.path.exists(FLAGS.vncproxy_wwwroot) and + os.path.exists(FLAGS.vncproxy_wwwroot + '/vnc_auto.html')): + LOG.info(_("Missing vncproxy_wwwroot (version %s)"), + FLAGS.vncproxy_wwwroot) LOG.info(_("You need a slightly modified version of noVNC " "to work with the nova-vnc-proxy")) LOG.info(_("Check out the most recent nova noVNC code: %s"), "git://github.com/sleepsonthefloor/noVNC.git") - LOG.info(_("And drop it in %s"), FLAGS.vnc_proxy_wwwroot) + LOG.info(_("And drop it in %s"), FLAGS.vncproxy_wwwroot) exit(1) - app = proxy.WebsocketVNCProxy(FLAGS.vnc_proxy_wwwroot) + app = proxy.WebsocketVNCProxy(FLAGS.vncproxy_wwwroot) LOG.audit(_("Allowing access to the following files: %s"), app.get_whitelist()) @@ -89,8 +94,8 @@ if __name__ == "__main__": if FLAGS.vnc_debug: with_auth = proxy.DebugMiddleware(with_logging) else: - with_auth = auth.NovaAuthMiddleware(with_logging) + with_auth = auth.VNCNovaAuthMiddleware(with_logging) server = wsgi.Server() - server.start(with_auth, FLAGS.vnc_proxy_port, host=FLAGS.vnc_proxy_host) + server.start(with_auth, FLAGS.vncproxy_port, host=FLAGS.vncproxy_host) server.wait() diff --git a/nova/flags.py b/nova/flags.py index ba543f46..b5c0cd38 100644 --- a/nova/flags.py +++ b/nova/flags.py @@ -281,7 +281,7 @@ DEFINE_string('ajax_console_proxy_url', in the form "http://127.0.0.1:8000"') DEFINE_string('ajax_console_proxy_port', 8000, 'port that ajax_console_proxy binds') -DEFINE_string('vnc_console_proxy_topic', 'vnc_proxy', +DEFINE_string('vnc_console_proxy_topic', 'vncproxy', 'the topic vnc proxy nodes listen on') DEFINE_string('vnc_console_proxy_url', 'http://127.0.0.1:6080', From a92b415fb906fa33bda7ac19e10f8bff03dc6208 Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Tue, 29 Mar 2011 13:32:03 -0700 Subject: [PATCH 15/18] fix flag names --- nova/flags.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nova/flags.py b/nova/flags.py index b5c0cd38..b0c116f6 100644 --- a/nova/flags.py +++ b/nova/flags.py @@ -281,13 +281,13 @@ DEFINE_string('ajax_console_proxy_url', in the form "http://127.0.0.1:8000"') DEFINE_string('ajax_console_proxy_port', 8000, 'port that ajax_console_proxy binds') -DEFINE_string('vnc_console_proxy_topic', 'vncproxy', +DEFINE_string('vncproxy_topic', 'vncproxy', 'the topic vnc proxy nodes listen on') -DEFINE_string('vnc_console_proxy_url', +DEFINE_string('vncproxy_url', 'http://127.0.0.1:6080', 'location of vnc console proxy, \ in the form "http://127.0.0.1:6080"') -DEFINE_string('vnc_server_host', '0.0.0.0', +DEFINE_string('vncserver_host', '0.0.0.0', 'the host interface on which vnc server should listen') DEFINE_bool('vnc_enabled', True, 'enable vnc related features') From f9ff0a2e5dac4c7cecd7b1ba0fc4e648cfd9a892 Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Tue, 29 Mar 2011 13:47:47 -0700 Subject: [PATCH 16/18] move flags per termie's feedback --- nova/flags.py | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/nova/flags.py b/nova/flags.py index b0c116f6..f011ab38 100644 --- a/nova/flags.py +++ b/nova/flags.py @@ -281,16 +281,6 @@ DEFINE_string('ajax_console_proxy_url', in the form "http://127.0.0.1:8000"') DEFINE_string('ajax_console_proxy_port', 8000, 'port that ajax_console_proxy binds') -DEFINE_string('vncproxy_topic', 'vncproxy', - 'the topic vnc proxy nodes listen on') -DEFINE_string('vncproxy_url', - 'http://127.0.0.1:6080', - 'location of vnc console proxy, \ - in the form "http://127.0.0.1:6080"') -DEFINE_string('vncserver_host', '0.0.0.0', - 'the host interface on which vnc server should listen') -DEFINE_bool('vnc_enabled', True, - 'enable vnc related features') DEFINE_bool('verbose', False, 'show debug output') DEFINE_boolean('fake_rabbit', False, 'use a fake rabbit') DEFINE_bool('fake_network', False, From 271feeccc63878e3f365edbdf147e1b6e9da457b Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Tue, 29 Mar 2011 14:53:38 -0700 Subject: [PATCH 17/18] incorporate feedback from termie --- bin/nova-vncproxy | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/nova-vncproxy b/bin/nova-vncproxy index 0fad8397..ccb97e3a 100755 --- a/bin/nova-vncproxy +++ b/bin/nova-vncproxy @@ -71,8 +71,6 @@ if __name__ == "__main__": LOG.audit(_("Starting nova-vnc-proxy node (version %s)"), version.version_string_with_vcs()) - service.serve() - if not (os.path.exists(FLAGS.vncproxy_wwwroot) and os.path.exists(FLAGS.vncproxy_wwwroot + '/vnc_auto.html')): LOG.info(_("Missing vncproxy_wwwroot (version %s)"), @@ -96,6 +94,8 @@ if __name__ == "__main__": else: with_auth = auth.VNCNovaAuthMiddleware(with_logging) + service.serve() + server = wsgi.Server() server.start(with_auth, FLAGS.vncproxy_port, host=FLAGS.vncproxy_host) server.wait() From a6e467de366ff0f99e4eab50348e29f7cb70f6af Mon Sep 17 00:00:00 2001 From: Anthony Young Date: Tue, 29 Mar 2011 15:22:16 -0700 Subject: [PATCH 18/18] clarify test --- nova/tests/test_compute.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nova/tests/test_compute.py b/nova/tests/test_compute.py index 038824ef..1b0f426d 100644 --- a/nova/tests/test_compute.py +++ b/nova/tests/test_compute.py @@ -286,7 +286,7 @@ class ComputeTestCase(test.TestCase): console = self.compute.get_ajax_console(self.context, instance_id) - self.assert_(console) + self.assert_(set(['token', 'host', 'port']).issubset(console.keys())) self.compute.terminate_instance(self.context, instance_id) def test_vnc_console(self):