import re
import string
import dns.resolver
-from invirt.database import Machine, NIC, Type, Disk, CDROM, Autoinstall
+from invirt import authz
+from invirt.database import Machine, NIC, Type, Disk, CDROM, Autoinstall, Owner
from invirt.config import structs as config
-from invirt.common import InvalidInput
+from invirt.common import InvalidInput, CodeError
-MAX_MEMORY_TOTAL = 512
-MAX_MEMORY_SINGLE = 256
MIN_MEMORY_SINGLE = 16
-MAX_DISK_TOTAL = 50
-MAX_DISK_SINGLE = 50
MIN_DISK_SINGLE = 0.1
-MAX_VMS_TOTAL = 10
-MAX_VMS_ACTIVE = 4
class Validate:
def __init__(self, username, state, machine_id=None, name=None, description=None, owner=None,
if strict:
if name is None:
raise InvalidInput('name', name, "You must provide a machine name.")
- if description is None:
+ if description is None or description.strip() == '':
raise InvalidInput('description', description, "You must provide a description.")
if memory is None:
raise InvalidInput('memory', memory, "You must provide a memory size.")
if vmtype is not None:
self.vmtype = validVmType(vmtype)
if cdrom is not None:
- if not CDROM.query().get(cdrom):
+ if not CDROM.query.get(cdrom):
raise CodeError("Invalid cdrom type '%s'" % cdrom)
self.cdrom = cdrom
if autoinstall is not None:
#raise InvalidInput('autoinstall', 'install',
# "The autoinstaller has been temporarily disabled")
- self.autoinstall = Autoinstall.query().get(autoinstall)
+ self.autoinstall = Autoinstall.query.get(autoinstall)
def getMachinesByOwner(owner, machine=None):
"""
if machine:
owner = machine.owner
- return Machine.query().filter_by(owner=owner)
+ return Machine.query.filter_by(owner=owner)
def maxMemory(owner, g, machine=None, on=True):
"""Return the maximum memory for a machine or a user.
memory for the machine to change to, if it is left off, is
returned.
"""
- if machine is not None and machine.memory > MAX_MEMORY_SINGLE:
- # If they've been blessed, let them have it
- return machine.memory
+ (quota_total, quota_single) = Owner.getMemoryQuotas(machine.owner if machine else owner)
+
if not on:
- return MAX_MEMORY_SINGLE
+ return quota_single
machines = getMachinesByOwner(owner, machine)
active_machines = [m for m in machines if m.name in g.xmlist_raw]
mem_usage = sum([x.memory for x in active_machines if x != machine])
- return min(MAX_MEMORY_SINGLE, MAX_MEMORY_TOTAL-mem_usage)
+ return min(quota_single, quota_total-mem_usage)
def maxDisk(owner, machine=None):
"""Return the maximum disk that a machine can reach.
If machine is None, the maximum disk for a new machine. Otherwise,
return the maximum that a given machine can be changed to.
"""
+ (quota_total, quota_single) = Owner.getDiskQuotas(machine.owner if machine else owner)
+
if machine is not None:
machine_id = machine.machine_id
else:
machine_id = None
- disk_usage = Disk.query().filter(Disk.c.machine_id != machine_id).\
- join('machine').\
- filter_by(owner=owner).sum(Disk.c.size) or 0
- return min(MAX_DISK_SINGLE, MAX_DISK_TOTAL-disk_usage/1024.)
+ disk_usage_query = Disk.query.filter(Disk.machine_id != machine_id).\
+ join('machine').filter_by(owner=owner)
+
+ disk_usage = sum([m.size for m in disk_usage_query]) or 0
+ return min(quota_single, quota_total-disk_usage/1024.)
def cantAddVm(owner, g):
machines = getMachinesByOwner(owner)
active_machines = [m for m in machines if m.name in g.xmlist_raw]
- if machines.count() >= MAX_VMS_TOTAL:
+ (quota_total, quota_active) = Owner.getVMQuotas(owner)
+ if machines.count() >= quota_total:
return 'You have too many VMs to create a new one.'
- if len(active_machines) >= MAX_VMS_ACTIVE:
+ if len(active_machines) >= quota_active:
return ('You already have the maximum number of VMs turned on. '
'To create more, turn one off.')
return False
def owns(user, machine):
"""Return whether a user owns a machine"""
- return user in expandLocker(machine.owner)
+ return user in authz.expandOwner(machine.owner)
def validMachineName(name):
"""Check that name is valid for a machine name"""
def validVmType(vm_type):
if vm_type is None:
return None
- t = Type.query().get(vm_type)
+ t = Type.query.get(vm_type)
if t is None:
raise CodeError("Invalid vm type '%s'" % vm_type)
return t
machine_id = int(machine_id)
except ValueError:
raise InvalidInput('machine_id', machine_id, "Must be an integer.")
- machine = Machine.query().get(machine_id)
+ machine = Machine.query.get(machine_id)
if exists and machine is None:
raise InvalidInput('machine_id', machine_id, "Does not exist.")
if machine is not None and not haveAccess(user, state, machine):
def testAdmin(user, admin, machine):
"""Determine whether a user can set the admin of a machine to this value.
- Return the value to set the admin field to (possibly 'system:' +
- admin). XXX is modifying this a good idea?
+ Return the value to set the admin field to (possibly 'system:' + admin).
"""
if admin is None:
return None
return admin
if admin == user:
return admin
+ # we do not require that the user be in the admin group;
+ # just that it is a non-empty set
+ if authz.expandAdmin(admin):
+ return admin
if ':' not in admin:
- if cache_acls.isUser(admin):
- return admin
- admin = 'system:' + admin
- try:
- if user in getafsgroups.getAfsGroupMembers(admin, config.authz[0].cell):
- return admin
- except getafsgroups.AfsProcessError, e:
- errmsg = str(e)
- if errmsg.startswith("pts: User or group doesn't exist"):
- errmsg = 'The group "%s" does not exist.' % admin
- raise InvalidInput('administrator', admin, errmsg)
- #XXX Should we require that user is in the admin group?
- return admin
+ if authz.expandAdmin('system:' + admin):
+ return 'system:' + admin
+ errmsg = 'No user "%s" or non-empty group "system:%s" found.' % (admin, admin)
+ else:
+ errmsg = 'No non-empty group "%s" found.' % (admin,)
+ raise InvalidInput('administrator', admin, errmsg)
def testOwner(user, owner, machine=None):
"""Determine whether a user can set the owner of a machine to this value.
If machine is None, this is the owner of a new machine.
"""
- if owner == user:
- return owner
if machine is not None and owner in (machine.owner, None):
return machine.owner
if owner is None:
raise InvalidInput('owner', owner, "Owner must be specified")
+ if '@' in owner:
+ raise InvalidInput('owner', owner, "No cross-realm Hesiod lockers allowed")
try:
- if user not in cache_acls.expandLocker(owner):
+ if user not in authz.expandOwner(owner):
raise InvalidInput('owner', owner, 'You do not have access to the '
+ owner + ' locker')
except getafsgroups.AfsProcessError, e:
raise InvalidInput('contact', contact, "Not a valid email.")
return contact
-def testDisk(user, disksize, machine=None):
- return disksize
-
def testName(user, name, machine=None):
if name is None:
return None
projects / invirt/packages/invirt-web.git / blobdiff