import re
import string
import dns.resolver
-from invirt.database import Machine, NIC, Type, Disk, CDROM, Autoinstall
+from invirt import authz
+from invirt.database import Machine, NIC, Type, Disk, CDROM, Autoinstall, Owner
from invirt.config import structs as config
-from invirt.common import InvalidInput
+from invirt.common import InvalidInput, CodeError
-MAX_MEMORY_TOTAL = 512
-MAX_MEMORY_SINGLE = 256
MIN_MEMORY_SINGLE = 16
-MAX_DISK_TOTAL = 50
-MAX_DISK_SINGLE = 50
MIN_DISK_SINGLE = 0.1
-MAX_VMS_TOTAL = 10
-MAX_VMS_ACTIVE = 4
class Validate:
def __init__(self, username, state, machine_id=None, name=None, description=None, owner=None,
if strict:
if name is None:
raise InvalidInput('name', name, "You must provide a machine name.")
- if description is None:
+ if description is None or description.strip() == '':
raise InvalidInput('description', description, "You must provide a description.")
if memory is None:
raise InvalidInput('memory', memory, "You must provide a memory size.")
owner = testOwner(username, owner, machine)
if owner is not None:
self.owner = owner
- admin = testAdmin(username, admin, machine)
- if admin is not None:
- self.admin = admin
+ self.admin = testAdmin(username, admin, machine)
contact = testContact(username, contact, machine)
if contact is not None:
self.contact = contact
raise CodeError("Invalid cdrom type '%s'" % cdrom)
self.cdrom = cdrom
if autoinstall is not None:
+ #raise InvalidInput('autoinstall', 'install',
+ # "The autoinstaller has been temporarily disabled")
self.autoinstall = Autoinstall.query().get(autoinstall)
memory for the machine to change to, if it is left off, is
returned.
"""
- if machine is not None and machine.memory > MAX_MEMORY_SINGLE:
- # If they've been blessed, let them have it
- return machine.memory
+ (quota_total, quota_single) = Owner.getMemoryQuotas(machine.owner if machine else owner)
+
if not on:
- return MAX_MEMORY_SINGLE
+ return quota_single
machines = getMachinesByOwner(owner, machine)
active_machines = [m for m in machines if m.name in g.xmlist_raw]
mem_usage = sum([x.memory for x in active_machines if x != machine])
- return min(MAX_MEMORY_SINGLE, MAX_MEMORY_TOTAL-mem_usage)
+ return min(quota_single, quota_total-mem_usage)
def maxDisk(owner, machine=None):
"""Return the maximum disk that a machine can reach.
If machine is None, the maximum disk for a new machine. Otherwise,
return the maximum that a given machine can be changed to.
"""
+ (quota_total, quota_single) = Owner.getDiskQuotas(machine.owner if machine else owner)
+
if machine is not None:
machine_id = machine.machine_id
else:
disk_usage = Disk.query().filter(Disk.c.machine_id != machine_id).\
join('machine').\
filter_by(owner=owner).sum(Disk.c.size) or 0
- return min(MAX_DISK_SINGLE, MAX_DISK_TOTAL-disk_usage/1024.)
+ return min(quota_single, quota_total-disk_usage/1024.)
def cantAddVm(owner, g):
machines = getMachinesByOwner(owner)
active_machines = [m for m in machines if m.name in g.xmlist_raw]
- if machines.count() >= MAX_VMS_TOTAL:
+ (quota_total, quota_active) = Owner.getVMQuotas(owner)
+ if machines.count() >= quota_total:
return 'You have too many VMs to create a new one.'
- if len(active_machines) >= MAX_VMS_ACTIVE:
+ if len(active_machines) >= quota_active:
return ('You already have the maximum number of VMs turned on. '
'To create more, turn one off.')
return False
def owns(user, machine):
"""Return whether a user owns a machine"""
- return user in expandLocker(machine.owner)
+ return user in authz.expandOwner(machine.owner)
def validMachineName(name):
"""Check that name is valid for a machine name"""
def testAdmin(user, admin, machine):
"""Determine whether a user can set the admin of a machine to this value.
- Return the value to set the admin field to (possibly 'system:' +
- admin). XXX is modifying this a good idea?
+ Return the value to set the admin field to (possibly 'system:' + admin).
"""
if admin is None:
return None
if machine is not None and admin == machine.administrator:
- return None
+ return admin
if admin == user:
return admin
+ # we do not require that the user be in the admin group;
+ # just that it is a non-empty set
+ if authz.expandAdmin(admin):
+ return admin
if ':' not in admin:
- if cache_acls.isUser(admin):
- return admin
- admin = 'system:' + admin
- try:
- if user in getafsgroups.getAfsGroupMembers(admin, config.authz[0].cell):
- return admin
- except getafsgroups.AfsProcessError, e:
- errmsg = str(e)
- if errmsg.startswith("pts: User or group doesn't exist"):
- errmsg = 'The group "%s" does not exist.' % admin
- raise InvalidInput('administrator', admin, errmsg)
- #XXX Should we require that user is in the admin group?
- return admin
+ if authz.expandAdmin('system:' + admin):
+ return 'system:' + admin
+ errmsg = 'No user "%s" or non-empty group "system:%s" found.' % (admin, admin)
+ else:
+ errmsg = 'No non-empty group "%s" found.' % (admin,)
+ raise InvalidInput('administrator', admin, errmsg)
def testOwner(user, owner, machine=None):
"""Determine whether a user can set the owner of a machine to this value.
If machine is None, this is the owner of a new machine.
"""
- if owner == user:
- return owner
if machine is not None and owner in (machine.owner, None):
return machine.owner
if owner is None:
raise InvalidInput('owner', owner, "Owner must be specified")
+ if '@' in owner:
+ raise InvalidInput('owner', owner, "No cross-realm Hesiod lockers allowed")
try:
- if user not in cache_acls.expandLocker(owner):
+ if user not in authz.expandOwner(owner):
raise InvalidInput('owner', owner, 'You do not have access to the '
+ owner + ' locker')
except getafsgroups.AfsProcessError, e:
raise InvalidInput('contact', contact, "Not a valid email.")
return contact
-def testDisk(user, disksize, machine=None):
- return disksize
-
def testName(user, name, machine=None):
if name is None:
return None
projects / invirt/packages/invirt-web.git / blobdiff