July 2014 - Kimchi-devel - oVirt List Archives

[PATCH] Do not auto create default network
by alinefm＠linux.vnet.ibm.com 28 Jul '14

28 Jul '14

From: Aline Manera <alinefm(a)linux.vnet.ibm.com> Kimchi does not depends on default network as a template and a guest can be created without any network interface. So do not auto create the default network when starting up Kimchi and let users create and configure their networks and templates as they want. It is part of issue #392 Signed-off-by: Aline Manera <alinefm(a)linux.vnet.ibm.com> --- src/kimchi/mockmodel.py | 8 +------- src/kimchi/model/networks.py | 44 -------------------------------------------- src/kimchi/osinfo.py | 2 +- tests/test_model.py | 19 +++++++------------ tests/test_osinfo.py | 2 +- tests/test_rest.py | 19 +++++-------------- tests/test_vmtemplate.py | 2 +- 7 files changed, 16 insertions(+), 80 deletions(-) diff --git a/src/kimchi/mockmodel.py b/src/kimchi/mockmodel.py index 1584471..2a74044 100644 --- a/src/kimchi/mockmodel.py +++ b/src/kimchi/mockmodel.py @@ -81,7 +81,7 @@ def reset(self): self._mock_screenshots = {} self._mock_templates = {} self._mock_storagepools = {'default': MockStoragePool('default')} - self._mock_networks = {'default': MockNetwork('default')} + self._mock_networks = {} self._mock_interfaces = self.dummy_interfaces() self._mock_swupdate = MockSoftwareUpdate() self.next_taskid = 1 @@ -659,12 +659,6 @@ def _is_network_used_by_template(self, network): return False def _is_network_in_use(self, name): - # The network "default" is used for Kimchi proposal and should not be - # deactivate or deleted. Otherwise, we will allow user create - # inconsistent templates from scratch - if name == 'default': - return True - vms = self._get_vms_attach_to_a_network(name) return bool(vms) or self._is_network_used_by_template(name) diff --git a/src/kimchi/model/networks.py b/src/kimchi/model/networks.py index bc93da5..45659ea 100644 --- a/src/kimchi/model/networks.py +++ b/src/kimchi/model/networks.py @@ -41,44 +41,6 @@ class NetworksModel(object): def __init__(self, **kargs): self.conn = kargs['conn'] - if 'qemu:///' in self.conn.get().getURI(): - self._default_network_check() - - def _default_network_check(self): - def create_default_network(): - try: - subnet = self._get_available_address(knetwork.DefaultNetsPool) - params = {"name": "default", "connection": "nat", - "subnet": subnet} - self.create(params) - return conn.networkLookupByName("default") - except Exception as e: - kimchi_log.error("Fatal: Cannot create default network " - "because of %s, exit kimchid", e.message) - sys.exit(1) - - conn = self.conn.get() - try: - net = conn.networkLookupByName("default") - except libvirt.libvirtError: - net = create_default_network() - - if net.isActive() == 0: - try: - net.create() - except libvirt.libvirtError as e: - # FIXME we can not distinguish this error from other internal - # error by error code. - if ("network is already in use by interface" - in e.message.lower()): - # libvirt do not support update IP element, so delete the - # the network and create new one. - net.undefine() - create_default_network() - else: - kimchi_log.error("Fatal: Cannot activate default network " - "because of %s, exit kimchid", e.message) - sys.exit(1) def create(self, params): conn = self.conn.get() @@ -267,12 +229,6 @@ def lookup(self, name): 'persistent': True if network.isPersistent() else False} def _is_network_in_use(self, name): - # The network "default" is used for Kimchi proposal and should not be - # deactivate or deleted. Otherwise, we will allow user create - # inconsistent templates from scratch - if name == 'default': - return True - vms = self._get_vms_attach_to_a_network(name) return bool(vms) or self._is_network_used_by_template(name) diff --git a/src/kimchi/osinfo.py b/src/kimchi/osinfo.py index 39c9163..cec2c50 100644 --- a/src/kimchi/osinfo.py +++ b/src/kimchi/osinfo.py @@ -91,7 +91,7 @@ }, } -defaults = {'networks': ['default'], +defaults = {'networks': [], 'storagepool': '/storagepools/default', 'domain': 'kvm', 'arch': os.uname()[4], 'graphics': {'type': 'vnc', 'listen': '0.0.0.0'}} diff --git a/tests/test_model.py b/tests/test_model.py index da9dae5..e717872 100644 --- a/tests/test_model.py +++ b/tests/test_model.py @@ -154,12 +154,7 @@ def test_vm_ifaces(self): rollback.prependDefer(inst.network_deactivate, net_name) ifaces = inst.vmifaces_get_list('kimchi-ifaces') - self.assertEquals(1, len(ifaces)) - - iface = inst.vmiface_lookup('kimchi-ifaces', ifaces[0]) - self.assertEquals(17, len(iface['mac'])) - self.assertEquals("default", iface['network']) - self.assertIn("model", iface) + self.assertEquals(0, len(ifaces)) # attach network interface to vm iface_args = {"type": "network", @@ -176,11 +171,11 @@ def test_vm_ifaces(self): self.assertEquals("virtio", iface["model"]) # update vm interface - iface_args = {"network": "default", + iface_args = {"network": "test-network", "model": "e1000"} inst.vmiface_update('kimchi-ifaces', mac, iface_args) iface = inst.vmiface_lookup('kimchi-ifaces', mac) - self.assertEquals("default", iface['network']) + self.assertEquals("test-network", iface['network']) self.assertEquals("e1000", iface["model"]) @unittest.skipUnless(utils.running_as_root(), 'Must be run as root') @@ -565,14 +560,14 @@ def test_template_create(self): info = inst.template_lookup('test') for key in params.keys(): self.assertEquals(params[key], info[key]) - self.assertEquals("default", info["networks"][0]) + self.assertEquals(0, len(info["networks"])) # create template with non-existent network params['name'] = 'new-test' params['networks'] = ["no-exist"] self.assertRaises(InvalidParameter, inst.templates_create, params) - params['networks'] = ['default', 'test-network'] + params['networks'] = ['test-network'] inst.templates_create(params) rollback.prependDefer(inst.template_delete, params['name']) info = inst.template_lookup(params['name']) @@ -667,10 +662,10 @@ def test_template_update(self): info = inst.template_lookup('new-test') for key in params.keys(): self.assertEquals(params[key], info[key]) - self.assertEquals("default", info["networks"][0]) + self.assertEquals(0, len(info["networks"])) params = {'name': 'new-test', 'memory': 1024, 'cpus': 1, - 'networks': ['default', 'test-network']} + 'networks': ['test-network']} inst.template_update('new-test', params) info = inst.template_lookup('new-test') for key in params.keys(): diff --git a/tests/test_osinfo.py b/tests/test_osinfo.py index 104e7b8..7524f84 100644 --- a/tests/test_osinfo.py +++ b/tests/test_osinfo.py @@ -28,7 +28,7 @@ def test_default_lookup(self): entry = lookup(None, None) self.assertEquals('unknown', entry['os_distro']) self.assertEquals('unknown', entry['os_version']) - self.assertEquals(['default'], entry['networks']) + self.assertEquals([], entry['networks']) def test_fedora_lookup(self): cd = ('http://fedora.mirrors.tds.net/pub/fedora/releases/17/Live/' diff --git a/tests/test_rest.py b/tests/test_rest.py index 3ea1927..306064c 100644 --- a/tests/test_rest.py +++ b/tests/test_rest.py @@ -603,14 +603,7 @@ def test_vm_iface(self): '/networks/test-network', '{}', 'DELETE') ifaces = json.loads(self.request('/vms/test-vm/ifaces').read()) - self.assertEquals(1, len(ifaces)) - - for iface in ifaces: - res = json.loads(self.request('/vms/test-vm/ifaces/%s' % - iface['mac']).read()) - self.assertEquals('default', res['network']) - self.assertEquals(17, len(res['mac'])) - self.assertEquals('virtio', res['model']) + self.assertEquals(0, len(ifaces)) # attach network interface to vm req = json.dumps({"type": "network", @@ -794,7 +787,7 @@ def test_template_customise_network(self): '/templates/test', '{}', 'DELETE') tmpl_res = json.loads(resp.read()) self.assertTrue(type(tmpl_res['networks']) is list) - self.assertEquals("default", tmpl_res['networks'][0]) + self.assertEquals(0, len(tmpl_res['networks'])) tmpl['name'] = "failed_tmpl" # Create a Template with non-array network fails with 400 @@ -832,7 +825,7 @@ def test_template_customise_network(self): self.assertEquals(400, resp.status) # Update a Template with existent network, successful - tmpl['networks'] = ["default", "test-network"] + tmpl['networks'] = ["test-network"] req = json.dumps(tmpl) resp = self.request('/templates/test', req, 'PUT') self.assertEquals(200, resp.status) @@ -1407,9 +1400,7 @@ def test_interfaces(self): def test_get_networks(self): networks = json.loads(request(host, ssl_port, '/networks').read()) - self.assertEquals(1, len(networks)) - self.assertEquals('default', networks[0]['name']) - self.assertEquals([], networks[0]['vms']) + self.assertEquals(0, len(networks)) # Now add a couple of Networks to the mock model for i in xrange(5): @@ -1424,7 +1415,7 @@ def test_get_networks(self): self.assertEquals([], network["vms"]) networks = json.loads(request(host, ssl_port, '/networks').read()) - self.assertEquals(6, len(networks)) + self.assertEquals(5, len(networks)) network = json.loads(request(host, ssl_port, '/networks/network-1').read()) diff --git a/tests/test_vmtemplate.py b/tests/test_vmtemplate.py index 821ca24..8dceced 100644 --- a/tests/test_vmtemplate.py +++ b/tests/test_vmtemplate.py @@ -29,7 +29,7 @@ class VMTemplateTests(unittest.TestCase): def test_minimal_construct(self): fields = (('name', 'test'), ('os_distro', 'unknown'), ('os_version', 'unknown'), ('cpus', 1), - ('memory', 1024), ('cdrom', ''), ('networks', ['default']), + ('memory', 1024), ('cdrom', ''), ('networks', []), ('disk_bus', 'ide'), ('nic_model', 'e1000'), ('graphics', {'type': 'vnc', 'listen': '0.0.0.0'})) -- 1.9.3

4 3

[PATCH] PowerPC bootable ISO detection code
by Daniel Barboza 27 Jul '14

27 Jul '14

From: Daniel Henrique Barboza <danielhb(a)linux.vnet.ibm.com> PowerPC ISO images does not follow the same rules as Intel's. Intel ISOs uses ISO9660 extension called 'El Torito', which describes the format of the Boot Record. PowerPC firmware, on the other hand, looks for a file '/ppc/bootinfo.txt' which describes how to boot the image. This patch creates a function that opens the ISO file without mounting it and, following ISO9660 standards, read the filesystem trying to find the boot file that enables PowerPC booting. Signed-off-by: Daniel Henrique Barboza <danielhb(a)linux.vnet.ibm.com> --- src/kimchi/isoinfo.py | 166 +++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 165 insertions(+), 1 deletion(-) diff --git a/src/kimchi/isoinfo.py b/src/kimchi/isoinfo.py index c394a32..72b956d 100644 --- a/src/kimchi/isoinfo.py +++ b/src/kimchi/isoinfo.py @@ -18,6 +18,7 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA import glob +import platform import os import re import struct @@ -132,6 +133,12 @@ class IsoImage(object): EL_TORITO_BOOT_RECORD = struct.Struct("=B5sB32s32sI") EL_TORITO_VALIDATION_ENTRY = struct.Struct("=BBH24sHBB") EL_TORITO_BOOT_ENTRY = struct.Struct("=BBHBBHL20x") + # Path table info starting in ISO9660 offset 132. We force little + # endian byte order (the '<' sign) because Power systems can run on + # both. + # First int is path table size, next 4 bytes are discarded (it is + # the same info but in big endian) and next int is the location. + PATH_TABLE_SIZE_LOC = struct.Struct("<I 4s I") def __init__(self, path): self.path = path @@ -224,6 +231,160 @@ class IsoImage(object): raise IsoFormatError("KCHISO0005E", {'filename': self.path}) + def _scan_ppc(self): + """ + PowerPC firmware does not use the conventional El Torito boot + specification. Instead, it looks for a file '/ppc/bootinfo.txt' + which contains boot information. A PPC image is bootable if + this file exists in the filesystem [1]. + + To detect if a PPC ISO is bootable, we could simply mount the + ISO and search for the boot file as we would with any other + file in the filesystem. We can also look for the boot file + searching byte by byte the ISO image. This is possible because + the PPC ISO image follows the ISO9660 standard [2]. Mounting + the ISO requires extra resources and it takes longer than + searching the image data, thus we chose the latter approach + in this code. + + To locate a file we must access the Path Table, which contains + the records of all the directories in the ISO. After locating + the directory/subdirectory that contains the file, we access + the Directory Record to find it. + + + .. [1] https://www.ibm.com/developerworks/community/wikis/home?\ +lang=en#!/wiki/W51a7ffcf4dfd_4b40_9d82_446ebc23c550/page/PowerLinux\ +%20Boot%20howto + .. [2] http://wiki.osdev.org/ISO_9660 + """ + + # To locate any file we must access the Path Table, which + # contains the records of all the directories in the ISO. + # ISO9660 dictates that the Path Table location information + # is at offset 132, inside the Primary Volume Descriptor, + # after the SystemArea (16*SECTOR_SIZE). + # + # In the Path table info we're forcing little endian byte + # order (the '<' sign) because Power systems can run on + # both. + # + # First int is path table size, next 4 bytes are discarded (it is + # the same info but in big endian) and next int is the location. + PATH_TABLE_LOC_OFFSET = 16 * IsoImage.SECTOR_SIZE + 132 + PATH_TABLE_SIZE_LOC = struct.Struct("<I 4s I") + + path_table_loc_data = self._get_iso_data(PATH_TABLE_LOC_OFFSET, + PATH_TABLE_SIZE_LOC.size) + path_size, unused, path_loc = self._unpack(PATH_TABLE_SIZE_LOC, + path_table_loc_data) + # Fetch the Path Table using location and size found above + path_table_offset = path_loc * IsoImage.SECTOR_SIZE + path_table_data = self._get_iso_data(path_table_offset, path_size) + + # Loop inside the path table to find the directory 'ppc'. + # The contents of the registers are: + # - length of the directory identifier (1 byte) + # - extended attribute record length (1 byte) + # - location of directory register (4 bytes) + # - directory number of parent dir (2 bytes) + # - directory name (size varies according to length) + # - padding field - 1 byte if the length is odd, not present if even + DIR_NAMELEN_LOCATION_PARENT = struct.Struct("<B B I H") + dir_struct_size = DIR_NAMELEN_LOCATION_PARENT.size + i = 0 + while i < path_size: + dir_data = path_table_data[i: i+dir_struct_size] + i += dir_struct_size + # We won't use the Extended Attribute Record + dir_namelen, unused, dir_loc, dir_parent = \ + self._unpack(DIR_NAMELEN_LOCATION_PARENT, dir_data) + if dir_parent == 1: + # read the dir name using the namelen + dir_name = path_table_data[i: i+dir_namelen].rstrip() + if dir_name == 'ppc': + # stop searching, dir was found + break + # Need to consider the optional padding field as well + i += dir_namelen + dir_namelen % 2 + + if i > path_size: + # Didn't find the '/ppc' directory. ISO is not bootable. + self.bootable = False + return + + # Get the 'ppc' directory record using 'dir_loc'. + ppc_dir_offset = dir_loc * IsoImage.SECTOR_SIZE + + # We need to find the sector size of this dir entry. The + # size of the File Section is located 10 bytes after + # the dir location. + DIR_SIZE_FMT = struct.Struct("<10sI") + data = self._get_iso_data(ppc_dir_offset, DIR_SIZE_FMT.size) + unused, dir_size = self._unpack(DIR_SIZE_FMT, data) + # If the dir is in the middle of a sector, the sector is + # padded zero and won't be utilized. We need to round up + # the result + dir_sectorsize = dir_size / IsoImage.SECTOR_SIZE + if dir_size % IsoImage.SECTOR_SIZE: + dir_sectorsize += 1 + + # Fixed-size directory record fields: + # - length of directory record (1 byte) + # - extended attr. record length (1 byte) + # - location of extend in both-endian format (8 bytes) + # - data length (size of extend) in both-endian (8 bytes) + # - recording date and time (7 bytes) + # - file flags (1 byte) + # - file unit size interleaved (1 byte) + # - interleave gap size (1 byte) + # - volume sequence number (4 bytes) + # - length of file identifier (1 byte) + # + # Of all these fields, we will use only 3 of them, 'ignoring' + # 30 bytes total. + STATIC_DIR_RECORD_FMT = struct.Struct("<B 24s B 6s B") + static_rec_size = STATIC_DIR_RECORD_FMT.size + + # Maximum offset possible of all the records of this directory + DIR_REC_MAX = ppc_dir_offset + dir_sectorsize*IsoImage.SECTOR_SIZE + # Max size of a given directory record + MAX_DIR_SIZE = 255 + # Name of the boot file + BOOT_FILE_NAME = "bootinfo.txt" + + # Loop until one of the following happens: + # - boot file is found + # - end of directory record listing for the 'ppc' dir + while ppc_dir_offset < DIR_REC_MAX: + record_data = self._get_iso_data(ppc_dir_offset, MAX_DIR_SIZE) + dir_rec_len, unused, file_flags, unused2, file_name_len = \ + self._unpack(STATIC_DIR_RECORD_FMT, record_data) + + # if dir_rec_len = 0, increment offset (skip the + # dir_rec_len byte) and continue the loop + if dir_rec_len == 0: + ppc_dir_offset += 1 + continue + + # Get filename of the file/dir we're at. + filename = record_data[static_rec_size: + static_rec_size + file_name_len].rstrip() + # The second bit of the file_flags indicate if this record + # is a directory. + if filename == BOOT_FILE_NAME and (file_flags & 2) != 1: + self.bootable = True + return + + # Update offset and keep looking. There is a padding here + # if the length of the file identifier is EVEN. + padding = 0 + if not file_name_len % 2: + padding = 1 + ppc_dir_offset += dir_rec_len + padding + # If reached this point the file wasn't found = not bootable + self.bootable = False + def _scan_primary_vol(self, data): """ Scan one sector for a Primary Volume Descriptor and extract the @@ -269,7 +430,10 @@ class IsoImage(object): return self._scan_primary_vol(data) - self._scan_el_torito(data) + if platform.machine().startswith('ppc'): + self._scan_ppc() + else: + self._scan_el_torito(data) class Matcher(object): -- 1.8.3.1

1 0

[V2 0/2] Authorization: Add users/groups to VM
by huoyuxin＠linux.vnet.ibm.com 25 Jul '14

25 Jul '14

From: Yu Xin Huo <huoyuxin(a)linux.vnet.ibm.com> Yu Xin Huo (2): Add users/groups to VM po files update for permission po/en_US.po | 9 +++ po/kimchi.pot | 9 +++ po/pt_BR.po | 9 +++ po/zh_CN.po | 9 +++ ui/css/theme-default/guest-edit.css | 116 +++++++++++++++++++++++++++++++++++ ui/images/theme-default/group.png | Bin 0 -> 1703 bytes ui/images/theme-default/user.png | Bin 0 -> 1322 bytes ui/js/src/kimchi.api.js | 28 ++++++++ ui/js/src/kimchi.guest_edit_main.js | 112 ++++++++++++++++++++++++++++++++- ui/pages/guest-edit.html.tmpl | 37 +++++++++++ 10 files changed, 326 insertions(+), 3 deletions(-) create mode 100644 ui/images/theme-default/group.png create mode 100644 ui/images/theme-default/user.png

3 7

[PATCH 0/9] authorization: Filter resources by users and groups
by alinefm＠linux.vnet.ibm.com 24 Jul '14

24 Jul '14

From: Aline Manera <alinefm(a)linux.vnet.ibm.com> Also move autorization mechanism to controller to be able to distinguish resource and collection configuration If we use UrlSubNode to also handle the authorization configuration, we won't be able to specify different configuration to collection and its resource as Kimchi uses the same base URL to both. Example: @UrlSubNode("vms", True, ["POST", "PUT", "DELETE"], 'guests') It meant that all the methods listed were exclusive for admin users. Which it is not correct, as a user assigned to a VM can also perform POST, PUT and DELETE actions. So fix it by moving the authorization mechanism to controller Aline Manera (5): authorization: Filter resources by users and groups authorization: Restrict Collection access based on admin_methods parameter authorization: Restrict access to Resource instance authorization: Update control files to set role_key and admin_methods authorization: Remove authorization config from UrlSubNode Crístian Viana (4): Return some groups for every user in mockmodel Move "fake_user" credentials to mockmodel List "admin" as a valid system user in mockmodel authorization: Update test cases based on last changes src/kimchi/auth.py | 16 +---------- src/kimchi/control/base.py | 56 +++++++++++++++++++++++++++++++----- src/kimchi/control/debugreports.py | 8 +++++- src/kimchi/control/host.py | 26 +++++++++++++++-- src/kimchi/control/interfaces.py | 6 +++- src/kimchi/control/networks.py | 6 +++- src/kimchi/control/storagepools.py | 6 +++- src/kimchi/control/storageservers.py | 8 +++++- src/kimchi/control/templates.py | 6 +++- src/kimchi/control/utils.py | 14 +++++---- src/kimchi/control/vms.py | 6 +++- src/kimchi/exception.py | 4 +++ src/kimchi/i18n.py | 1 + src/kimchi/mockmodel.py | 5 +++- src/kimchi/server.py | 4 --- tests/test_authorization.py | 30 +++++++++++++++++-- tests/test_rest.py | 19 ++++++------ tests/utils.py | 9 +++--- 18 files changed, 172 insertions(+), 58 deletions(-) -- 1.9.3

3 11

[V3 0/2] Authorization: Add Users/Groups to VM
by huoyuxin＠linux.vnet.ibm.com 24 Jul '14

24 Jul '14

From: Yu Xin Huo <huoyuxin(a)linux.vnet.ibm.com> Yu Xin Huo (2): authorization: add users/groups to vm authorization: update po files po/en_US.po | 9 +++ po/kimchi.pot | 9 +++ po/pt_BR.po | 9 +++ po/zh_CN.po | 9 +++ ui/css/theme-default/guest-edit.css | 104 ++++++++++++++++++++++++++++++ ui/images/theme-default/group.png | Bin 0 -> 1703 bytes ui/images/theme-default/user.png | Bin 0 -> 1322 bytes ui/js/src/kimchi.api.js | 28 ++++++++ ui/js/src/kimchi.guest_edit_main.js | 120 ++++++++++++++++++++++++++++++++++- ui/pages/guest-edit.html.tmpl | 42 ++++++++++++ 10 files changed, 327 insertions(+), 3 deletions(-) create mode 100644 ui/images/theme-default/group.png create mode 100644 ui/images/theme-default/user.png

2 5

[PATCH] issue #374: Use base64 encoding to launch VM console
by alinefm＠linux.vnet.ibm.com 24 Jul '14

24 Jul '14

From: Aline Manera <alinefm(a)linux.vnet.ibm.com> websockify.py uses urlparse.parse_qs() to parse token parameter in the console URL /vnc_auto.html?port=64667&path=?token=issue%2B374&encrypt=1 And even encoding the VM name using encodeURIComponent() it replaces the plus sign for a white space, {'token': ['issue 374']} That way the console (noVNC/Spice) will never be able to find the console port based on VM name, as it was wrongly recorded. To fix it, uses base64 for encoding the VM name while setting up the console configuration and accessing it using noVNC or Spice. Signed-off-by: Aline Manera <alinefm(a)linux.vnet.ibm.com> --- src/kimchi/vnc.py | 2 ++ ui/js/src/kimchi.api.js | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/kimchi/vnc.py b/src/kimchi/vnc.py index 002b950..660b9c6 100644 --- a/src/kimchi/vnc.py +++ b/src/kimchi/vnc.py @@ -18,6 +18,7 @@ # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +import base64 import errno import os import subprocess @@ -53,6 +54,7 @@ def new_ws_proxy(): def add_proxy_token(name, port): with open(os.path.join(WS_TOKENS_DIR, name), 'w') as f: + name = base64.b64encode(name) f.write('%s: localhost:%s' % (name.encode('utf-8'), port)) diff --git a/ui/js/src/kimchi.api.js b/ui/js/src/kimchi.api.js index 021be63..97d5800 100644 --- a/ui/js/src/kimchi.api.js +++ b/ui/js/src/kimchi.api.js @@ -352,7 +352,7 @@ var kimchi = { }).done(function() { url = 'https://' + location.hostname + ':' + proxy_port; url += "/console.html?url=vnc_auto.html&port=" + proxy_port; - url += "&path=?token=" + encodeURIComponent(vm); + url += "&path=?token=" + btoa(vm); url += "&kimchi=" + location.port; url += '&encrypt=1'; window.open(url); @@ -377,7 +377,7 @@ var kimchi = { url = 'https://' + location.hostname + ':' + proxy_port; url += "/console.html?url=spice.html&port=" + proxy_port; url += "&listen=" + location.hostname; - url += "&token=" + encodeURIComponent(vm); + url += "&token=" + btoa(vm); url += "&kimchi=" + location.port; url += '&encrypt=1'; window.open(url); -- 1.9.3

3 2

[PATCH] issue #374: Use base64 encoding to launch VM console
by alinefm＠linux.vnet.ibm.com 24 Jul '14

24 Jul '14

From: Aline Manera <alinefm(a)linux.vnet.ibm.com> websockify.py uses urlparse.parse_qs() to parse token parameter in the console URL /vnc_auto.html?port=64667&path=?token=issue%2B374&encrypt=1 And even encoding the VM name using encodeURIComponent() it replaces the plus sign for a white space, {'token': ['issue 374']} That way websockify will never be able to find the console port based on VM name. To fix it, use base64 for encoding the VM name while setting up the console configuration and accessing it using noVNC or Spice. Signed-off-by: Aline Manera <alinefm(a)linux.vnet.ibm.com> --- src/kimchi/vnc.py | 2 ++ ui/js/src/kimchi.api.js | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/kimchi/vnc.py b/src/kimchi/vnc.py index 002b950..9380e21 100644 --- a/src/kimchi/vnc.py +++ b/src/kimchi/vnc.py @@ -18,6 +18,7 @@ # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +import base64 import errno import os import subprocess @@ -53,6 +54,7 @@ def new_ws_proxy(): def add_proxy_token(name, port): with open(os.path.join(WS_TOKENS_DIR, name), 'w') as f: + name = base64.urlsafe_b64encode(name) f.write('%s: localhost:%s' % (name.encode('utf-8'), port)) diff --git a/ui/js/src/kimchi.api.js b/ui/js/src/kimchi.api.js index 021be63..99ac730 100644 --- a/ui/js/src/kimchi.api.js +++ b/ui/js/src/kimchi.api.js @@ -352,7 +352,7 @@ var kimchi = { }).done(function() { url = 'https://' + location.hostname + ':' + proxy_port; url += "/console.html?url=vnc_auto.html&port=" + proxy_port; - url += "&path=?token=" + encodeURIComponent(vm); + url += "&path=?token=" + kimchi.urlSafeB64Encode(vm); url += "&kimchi=" + location.port; url += '&encrypt=1'; window.open(url); @@ -377,7 +377,7 @@ var kimchi = { url = 'https://' + location.hostname + ':' + proxy_port; url += "/console.html?url=spice.html&port=" + proxy_port; url += "&listen=" + location.hostname; - url += "&token=" + encodeURIComponent(vm); + url += "&token=" + kimchi.urlSafeB64Encode(vm); url += "&kimchi=" + location.port; url += '&encrypt=1'; window.open(url); -- 1.9.3

4 3

[PATCH V4 0/4] Authorization: disable non-root user functions in UI
by wenwang＠linux.vnet.ibm.com 24 Jul '14

24 Jul '14

From: Wen Wang <wenwang(a)linux.vnet.ibm.com> V3 -> V4: Removed the additional white border line in user mode(Aline) Minor change to the layout of the storage tab of user mode that makes the arrow-down/arrow-up more consistent(Aline) V2 -> V3: stored the mode into global _tabMode that can be used for each tab.(Aline) Making the buttons that is not avaiable for non-root users invisible by default and enable when user is admin.(Yu Xin) Fixed css inconsistent under "Storage" tab. Removed the onClick function if the buttons are not avaiable. V1 -> V2: Store "roles" parameter in cookie instead of each tab's mode.(Aline) read only "roles" from cookie instead of roles of each tab(Aline) Minor changes in method of removing "Action" title under network tab (Hongliang Wang) This patch defines user privilege according to different user roles In this release, only two roles are supported: "admin" and "user", conbined with four modes: "admin", "byInstance", "read-only" and "none", each of which has own privileges to different tabs as well as instances. modes are stored in cookie and functions of different roles are protected in the back-end. Wen Wang (4): Add roles into cookie Authorization: remove host/template tabs for non-root users Authorization: remove [+] icon from non-root users view Authorization: Remove actions based on roles ui/css/theme-default/network.css | 4 + ui/css/theme-default/storage.css | 22 ++++--- ui/js/src/kimchi.guest_main.js | 10 ++- ui/js/src/kimchi.login.js | 16 +++-- ui/js/src/kimchi.main.js | 26 +++++-- ui/js/src/kimchi.network.js | 12 +++- ui/js/src/kimchi.storage_main.js | 137 ++++++++++++++++++++----------------- ui/js/src/kimchi.template_main.js | 21 ++++-- ui/pages/tabs/guests.html.tmpl | 4 +- ui/pages/tabs/network.html.tmpl | 6 +- ui/pages/tabs/storage.html.tmpl | 6 +- ui/pages/tabs/templates.html.tmpl | 2 +- 12 files changed, 159 insertions(+), 107 deletions(-)

2 6

[V1 0/2] Add Users/Groups to VM
by huoyuxin＠linux.vnet.ibm.com 23 Jul '14

23 Jul '14

From: Yu Xin Huo <huoyuxin(a)linux.vnet.ibm.com> Yu Xin Huo (2): Add users/groups to VM update po po/en_US.po | 9 +++ po/kimchi.pot | 9 +++ po/pt_BR.po | 39 ++++++++----- po/zh_CN.po | 9 +++ ui/css/theme-default/guest-edit.css | 106 +++++++++++++++++++++++++++++++++ ui/images/theme-default/group.png | Bin 0 -> 1703 bytes ui/images/theme-default/user.png | Bin 0 -> 1322 bytes ui/js/src/kimchi.api.js | 28 +++++++++ ui/js/src/kimchi.guest_edit_main.js | 112 ++++++++++++++++++++++++++++++++++- ui/pages/guest-edit.html.tmpl | 33 ++++++++++ 10 files changed, 327 insertions(+), 18 deletions(-) create mode 100644 ui/images/theme-default/group.png create mode 100644 ui/images/theme-default/user.png

4 8

[PATCH 0/2 V2] [Fix BZ#111243 - pkvm 2.1-SP2]
by Rodrigo Trujillo 23 Jul '14

23 Jul '14

V2: - Patch disables vhost feature only in ubuntu 14.04 or lower V1: Patch 1 - Disables vhost feature Patch 2 - Uses/modify SUSE patch from kimchi upstream. Adds SLES and change RHEL version (6.5) in modern distros dict. Modern distros are going to use virtio. Rodrigo Trujillo (2): Disable vhost feature in Ubuntu LE Change modern distro versions src/kimchi/isoinfo.py | 1 + src/kimchi/osinfo.py | 9 ++++++--- src/kimchi/vmtemplate.py | 10 +++++++++- 3 files changed, 16 insertions(+), 4 deletions(-) -- 1.9.3

1 3

[PATCHv3 0/8] Support img based template
by lvroyce0210＠gmail.com 23 Jul '14

23 Jul '14

From: Royce Lv <lvroyce(a)linux.vnet.ibm.com> v2>v3, Clear unused iso link, Adding mockmodel and tests How to test: create a image using: POST /templates {'name':'mytemp', 'disks':[{'base':'a_base_img_path'}]} create a vm using: POST /vms {'template': '/templates/mytemp', 'pool'....} Known issues: 1.This is only available for NFS and dir pool, logical pool in kimchi now adopted raw format which does not suitable for qcow2 img(will fix later). iscsi, scsi pool volume size need to be checked and handled later. So in this version just support dir based pool. 2.Due to template integrity check need be refactored, this check will be added later. Royce Lv (8): Add image probe function Change doc and api specification Change 'cdrom' to a optional param Fix: Prevent iso links filling in osinfo.py Integrate image os probe in vm template create Create volume based on backing store image Update mockmodel of base img vm Add tests for image based template Makefile.am | 1 + contrib/DEBIAN/control.in | 4 +- contrib/kimchi.spec.fedora.in | 2 + contrib/kimchi.spec.suse.in | 2 + docs/API.md | 3 +- docs/README.md | 9 +++-- src/kimchi/API.json | 8 +++- src/kimchi/control/storagevolumes.py | 2 +- src/kimchi/control/templates.py | 2 +- src/kimchi/exception.py | 4 ++ src/kimchi/i18n.py | 8 +++- src/kimchi/imageinfo.py | 66 +++++++++++++++++++++++++++++++ src/kimchi/mockmodel.py | 31 ++++++++++++--- src/kimchi/model/templates.py | 13 +++--- src/kimchi/model/vms.py | 1 + src/kimchi/osinfo.py | 24 +----------- src/kimchi/vmtemplate.py | 76 ++++++++++++++++++++++++------------ tests/test_model.py | 25 ++++++++++++ tests/test_osinfo.py | 8 ---- tests/test_rest.py | 32 ++++++++++++++- tests/test_vmtemplate.py | 2 +- 21 files changed, 244 insertions(+), 79 deletions(-) create mode 100644 src/kimchi/imageinfo.py -- 1.8.3.2

3 18

[PATCH V3 0/4] Authorization: disable non-root user functions in UI
by wenwang＠linux.vnet.ibm.com 23 Jul '14

23 Jul '14

From: Wen Wang <wenwang(a)linux.vnet.ibm.com> V2 -> V3: stored the mode into global _tabMode that can be used for each tab.(Aline) Making the buttons that is not avaiable for non-root users invisible by default and enable when user is admin.(Yu Xin) Fixed css inconsistent under "Storage" tab. Removed the onClick function if the buttons are not avaiable. V1 -> V2: Store "roles" parameter in cookie instead of each tab's mode.(Aline) read only "roles" from cookie instead of roles of each tab(Aline) Minor changes in method of removing "Action" title under network tab (Hongliang Wang) This patch defines user privilege according to different user roles In this release, only two roles are supported: "admin" and "user", conbined with four modes: "admin", "byInstance", "read-only" and "none", each of which has own privileges to different tabs as well as instances. modes are stored in cookie and functions of different roles are protected in the back-end. Wen Wang (4): Add roles into cookie Authorization: remove host/template tabs for non-root users Authorization: remove [+] icon from non-root users view Authorization: Remove actions based on roles ui/css/theme-default/storage.css | 22 ++++--- ui/js/src/kimchi.guest_main.js | 10 ++- ui/js/src/kimchi.login.js | 16 +++-- ui/js/src/kimchi.main.js | 26 +++++-- ui/js/src/kimchi.network.js | 10 +++- ui/js/src/kimchi.storage_main.js | 137 ++++++++++++++++++++----------------- ui/js/src/kimchi.template_main.js | 21 ++++-- ui/pages/tabs/guests.html.tmpl | 4 +- ui/pages/tabs/network.html.tmpl | 6 +- ui/pages/tabs/storage.html.tmpl | 6 +- ui/pages/tabs/templates.html.tmpl | 2 +- 11 files changed, 153 insertions(+), 107 deletions(-)

3 6

[PATCH V3 0/5] vm ticket in backend
by shaohef＠linux.vnet.ibm.com 22 Jul '14

22 Jul '14

From: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com> V2 -> V3: do not make ticket as sub-resource of a VM V1 -> V2: make ticket as sub-resource of a VM A ticket is the credential to access VM. Only who get the ticket can access a VM. test this patch set: set the ticket $ sudo curl -k -u <user>:<password> -H "Content-Type: application/json" -H \ "Accept: application/json" https://localhost:8001/vms/test-vm-8/ \ -X PUT -d '{"ticket": {"passwd": "abcd"}}' get the ticket $ sudo curl -k -u <user>:<password> -H "Content-Type: application/json" -H \ "Accept: application/json" https://localhost:8001/vms/test-vm-8/ ShaoHe Feng (5): vm ticket in backend: update API.md vm ticket in backend: update controller and API.json vm ticket in backend: update model vm ticket in backend: update mockmodel vm ticket in backend: update test case docs/API.md | 7 +++++ src/kimchi/API.json | 16 +++++++++++ src/kimchi/control/vms.py | 3 ++- src/kimchi/i18n.py | 2 ++ src/kimchi/mockmodel.py | 14 ++++++++++ src/kimchi/model/vms.py | 68 +++++++++++++++++++++++++++++++++++++++++++++++ tests/test_model.py | 15 +++++++++++ tests/test_rest.py | 12 +++++++++ 8 files changed, 136 insertions(+), 1 deletion(-) -- 1.9.3

2 7

[PATCH V2] add a base64 safe url encode and decode to js utils
by shaohef＠linux.vnet.ibm.com 22 Jul '14

22 Jul '14

From: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com> V1 -> V2: address zhengsheng's comment. add the base64 wiki to commit message. ShaoHe Feng (1): add a base64 safe url encode and decode to js utils ui/js/src/kimchi.utils.js | 8 ++++++++ 1 file changed, 8 insertions(+) -- 1.9.3

3 4

[RFC]Redirect to login page if user close the browser
by Wen Wang 22 Jul '14

22 Jul '14

Hi all, Now after closing the browser, paste the url you copied from either kimchi or vnc, you can access kimchi or vnc without asking for authentication with login page. I think it's better to redirect user to login page after closing the browser even if they pasted their url used before to enhance the security. Thanks Wang Wen

2 1

[PATCH V2 0/4] Authorization: disable non-root user functions in UI
by wenwang＠linux.vnet.ibm.com 22 Jul '14

22 Jul '14

From: Wen Wang <wenwang(a)linux.vnet.ibm.com> V1 -> V2: Store "roles" parameter in cookie instead of each tab's mode.(Aline) read only "roles" from cookie instead of roles of each tab(Aline) Minor changes in method of removing "Action" title under network tab (Hongliang Wang) This patch defines user privilege according to different user roles In this release, only two roles are supported: "admin" and "user", conbined with four modes: "admin", "byInstance", "read-only" and "none", each of which has own privileges to different tabs as well as instances. modes are stored in cookie and functions of different roles are protected in the back-end. Wen Wang (4): Add roles into cookie Authorization: remove host/template tabs for non-root users Authorization: remove [+] icon from non-root users view Authorization: Remove actions based on roles ui/css/theme-default/storage.css | 18 +++++++++--------- ui/js/src/kimchi.guest_main.js | 4 ++++ ui/js/src/kimchi.login.js | 16 +++++++++------- ui/js/src/kimchi.main.js | 24 ++++++++++++++++-------- ui/js/src/kimchi.network.js | 9 +++++++++ ui/js/src/kimchi.storage_main.js | 11 +++++++++++ 6 files changed, 58 insertions(+), 24 deletions(-)

3 7

[PATCH 0/4] Authorization: disable non-root user functions in UI
by wenwang＠linux.vnet.ibm.com 22 Jul '14

22 Jul '14

From: Wen Wang <wenwang(a)linux.vnet.ibm.com> This patch defines user privilege according to different user roles In this release, only two roles are supported: "admin" and "user", conbined with four modes: "admin", "byInstance", "read-only" and "none", each of which has own privileges to different tabs as well as instances. modes are stored in cookie and functions of different roles are protected in the back-end. Please apply Aline's patches first before this one. Below are the references: (1)[Kimchi-devel] [PATCH 0/4 V2] Let frontend redirect user after logging (2)[Kimchi-devel] [PATCH 0/5 V3] authorization: Backend changes Apply these two patches in order then this UI changes can work Wen Wang (4): Add modes into cookie Authorization: remove host/template tabs for non-root users Authorization: remove [+] icon from non-root users view Authorization: Remove actions based on roles ui/css/theme-default/storage.css | 18 +++++++++--------- ui/js/src/kimchi.guest_main.js | 4 ++++ ui/js/src/kimchi.login.js | 20 +++++++++++++------- ui/js/src/kimchi.main.js | 21 +++++++++++++-------- ui/js/src/kimchi.network.js | 9 +++++++++ ui/js/src/kimchi.storage_main.js | 11 +++++++++++ 6 files changed, 59 insertions(+), 24 deletions(-)

3 14

[PATCH 0/3 WIP] Let frontend redirect user after logging
by alinefm＠linux.vnet.ibm.com 21 Jul '14

21 Jul '14

From: Aline Manera <alinefm(a)linux.vnet.ibm.com> This patch set removes useless files related to former login design and redirect user in frontend after logging - that way frontend can store user information for authorization matters. The patch 2 has 2 problems: 1) the next URL is encoded using base64 So in UI I need to decode it. How do I do that? 2) while using kimchi.cookie.get() to get the lastPage it returns the URL with "" So the redirection fails as it tries to redirect the user to "/#tabs/guests" How do I remove those "" around the cookie value? Any help is welcome! Aline Manera (3): Remove former login design files Remove special console rules from nginx configuration Let frontend redirect user after logging src/kimchi/auth.py | 6 -- src/kimchi/root.py | 19 +----- src/nginx.conf.in | 11 ---- ui/js/src/kimchi.login.js | 73 ++++++++++++++++++++++ ui/js/src/kimchi.login_window.js | 128 --------------------------------------- ui/pages/login-window.html.tmpl | 53 ---------------- ui/pages/login.html.tmpl | 36 ++--------- 7 files changed, 78 insertions(+), 248 deletions(-) create mode 100644 ui/js/src/kimchi.login.js delete mode 100644 ui/js/src/kimchi.login_window.js delete mode 100644 ui/pages/login-window.html.tmpl -- 1.9.3

4 9

[PATCH] Always use unicode in KimchiException message
by alinefm＠linux.vnet.ibm.com 21 Jul '14

21 Jul '14

From: Aline Manera <alinefm(a)linux.vnet.ibm.com> When KimchiException was raised inside a cherrypy application it returned a unicode message. But if the exception was raised independently the cherrypy server (ie, using model instance directly) it returned a string message. To keep the same behavior in all those situations, let KimchiException always returns a unicode message Signed-off-by: Aline Manera <alinefm(a)linux.vnet.ibm.com> --- src/kimchi/exception.py | 35 ++++++++++++++++++----------------- 1 file changed, 18 insertions(+), 17 deletions(-) diff --git a/src/kimchi/exception.py b/src/kimchi/exception.py index fcf60cc..d84ddb9 100644 --- a/src/kimchi/exception.py +++ b/src/kimchi/exception.py @@ -29,18 +29,29 @@ class KimchiException(Exception): def __init__(self, code='', args={}): self.code = code + for key, value in args.iteritems(): + if isinstance(value, unicode): + continue + + # value is not unicode: convert it + try: + # In case the value formats itself to an ascii string. + args[key] = unicode(str(value), 'utf-8') + except UnicodeEncodeError: + # In case the value is a KimchiException or it formats + # itself to a unicode string. + args[key] = unicode(value) + if cherrypy.request.app: - msg = self._get_translation(args) + msg = self._get_translation() else: - for key, value in args.iteritems(): - if isinstance(value, unicode): - args[key] = value.encode('utf-8') - msg = _messages.get(code, code) % args + msg = _messages.get(code, code) + msg = unicode(msg, 'utf-8') % args pattern = "%s: %s" % (code, msg) Exception.__init__(self, pattern) - def _get_translation(self, args): + def _get_translation(self): lang = validate_language(get_lang()) paths = cherrypy.request.app.root.paths domain = cherrypy.request.app.root.domain @@ -52,17 +63,7 @@ def _get_translation(self, args): except: translation = gettext - for key, value in args.iteritems(): - if not isinstance(value, unicode): - try: - # In case the value formats itself to an ascii string. - args[key] = unicode(str(value), 'utf-8') - except UnicodeEncodeError: - # In case the value is a KimchiException or it formats - # itself to a unicode string. - args[key] = unicode(value) - - return unicode(translation.gettext(text), 'utf-8') % args + return translation.gettext(text) class NotFoundError(KimchiException): -- 1.9.3

3 3

[PATCH 0/4 V2] Let frontend redirect user after logging
by alinefm＠linux.vnet.ibm.com 21 Jul '14

21 Jul '14

From: Aline Manera <alinefm(a)linux.vnet.ibm.com> V1 -> V2: - Turn back next_url parameter to fix problems mentioned by Wen Wang - Use urllib2.quote() to encode next_url in backend - Use decodeURIcomponent() to decode next_url in JS Aline Manera (4): Update test case to reflect new login design Remove former login design files Remove special console rules from nginx configuration Let frontend redirect user after logging src/kimchi/auth.py | 9 +-- src/kimchi/root.py | 19 +---- src/nginx.conf.in | 11 --- tests/test_rest.py | 2 +- ui/css/theme-default/login-window.css | 90 ------------------------ ui/js/src/kimchi.login.js | 71 +++++++++++++++++++ ui/js/src/kimchi.login_window.js | 128 ---------------------------------- ui/pages/login-window.html.tmpl | 53 -------------- ui/pages/login.html.tmpl | 36 ++-------- 9 files changed, 79 insertions(+), 340 deletions(-) delete mode 100644 ui/css/theme-default/login-window.css create mode 100644 ui/js/src/kimchi.login.js delete mode 100644 ui/js/src/kimchi.login_window.js delete mode 100644 ui/pages/login-window.html.tmpl -- 1.9.3

4 16

[PATCH 0/5 V3] authorization: Backend changes
by alinefm＠linux.vnet.ibm.com 21 Jul '14

21 Jul '14

From: Aline Manera <alinefm(a)linux.vnet.ibm.com> V2 -> V3: - Update backend authorization rules to reflect our last discussions - Use .getiterator() instead of .iter() while reading xml files - Get role according tab instead of sudo rights To do that I needed to add a new parameter to UrlSubNode() as Kimchi protects its API URIs and the user role is per tab, I need to know which URIs is used in each tab V1 -> V2: - Add "access" elements to describe role/view for each tab - Return a role map in /login For each tab, a role will be returned. That way we have more flexibility to change user role per tab - Add "access" parameter to VM.lookup() As the user will have full access to the VM assigned to it, return "access=full" for all them Aline Manera (5): authorization: Update authorization rules per API authorization: Update /login to return user roles instead of sudo parameter authorization: Add "access" elements to tabs.xml to describe user view authorization: Add "access" parameter to VM resource authorization: Get role according to tab instead of sudo rights config/ui/tabs.xml | 15 +++++++++++++ plugins/sample/ui/config/tab-ext.xml | 3 +++ src/kimchi/auth.py | 42 +++++++++++++++++++++++++----------- src/kimchi/control/debugreports.py | 2 +- src/kimchi/control/host.py | 2 +- src/kimchi/control/interfaces.py | 2 +- src/kimchi/control/networks.py | 2 +- src/kimchi/control/storagepools.py | 2 +- src/kimchi/control/storageservers.py | 2 +- src/kimchi/control/templates.py | 2 +- src/kimchi/control/utils.py | 4 +++- src/kimchi/control/vms.py | 2 +- src/kimchi/mockmodel.py | 3 ++- src/kimchi/model/vms.py | 3 ++- src/kimchi/server.py | 1 + src/kimchi/utils.py | 15 +++++++++++++ tests/test_authorization.py | 8 +++---- tests/test_mockmodel.py | 3 ++- tests/test_model.py | 3 ++- tests/test_rest.py | 8 +++++++ tests/utils.py | 6 +++--- 21 files changed, 97 insertions(+), 33 deletions(-) -- 1.9.3

3 12

[RFC] ticket of VM
by Sheldon 21 Jul '14

21 Jul '14

Now I have send a patch V1, no more comments. These days, I talk with ZhengSheng about the ticket of VM. Now we are change our design as follow for we should care the VMs created by other tools. 1. make the ticket as the sub-resource of a VM. support GET(lookup) and PUT(update) method. 2. we will not set expire for ticket. 3. kimchi will set a initial random password for VM when create it. 4. PUT(update) method can set a password for a VM created by other tool. but if expire is set for this VM, kimchi will not change the password. or kimchi can change the password but not change the expire. 5. when GET method to retrieve the password, if the VM is create by other-tools. And expire is set, kimchi raise http 400 error when timeout. 6. pass the ticket to vnc/spice websocket in cookie, not in URL. vnc/spice login page get the ticket from cookie. -- Thanks and best regards! Sheldon Feng(冯少合)<shaohef(a)linux.vnet.ibm.com> IBM Linux Technology Center

3 5

Host Device Passthrough UI Task Discussion
by Zhou Zheng Sheng 21 Jul '14

21 Jul '14

Hi, As in Kimchi 1.3 TODO list (https://github.com/kimchi-project/kimchi/wiki/Todo-1.3) there is a task of passthrough support. It is to enable Kimchi to assign hos devices directly to a VM, thus greately improve VM performance. Currently we support assigning PCI device, USB device and SCSI LUN. For example, we can assign an NIC to VM to improve guest network throughput, or passthrough a USB camera to enable the guest OS to record video. The back-end patch also handles PCI device grouping (attach and detach all devices in the same iommu group together) and provides some other useful features. Since the due day is near, I think we can come up with an easy and simple UI for 1.3, and mark this feature as experimental. Then we improve it in future releases. So in this release we may only expose PCI devices to user and don't mention the iommu grouping logic. For this version I think we may provide the following operations to the user. In the VM edit window, initially, the user sees a list of PCI devices already assigned to the VM. This maps to GET vms/VM_NAME/hostdevs. In edit mode, the user can detach device. This maps to DELETE vms/VM_NAME/hostdevs/DEVICE_NAME. The user can also select device to attach to VM from a list. The listing of eligible devices is mapped to GET host/devices?_passthrough=true&_cap=pci. To attach a device, just POST a dict containing only the device name to vms/VM_NAME/hostdevs. I think these operations forms a basic interaction to enable user to consume this feature. It may be feasible to finish them before the due day. -- Zhou Zheng Sheng / 周征晟 E-mail: zhshzhou(a)linux.vnet.ibm.com Telephone: 86-10-82454397

5 6

[PATCH] add a base64 safe url encode and decode to js utils
by shaohef＠linux.vnet.ibm.com 21 Jul '14

21 Jul '14

From: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com> Most webs encode/decode url by base64 to escape the special characters. base64 encode/decode is similar to base64 safe url encode/decode. The difference is the alphabet. The base64 safe url alphabet uses '-' instead of '+' and '_' instead of '/'. after this patch: In backend, we can encode an url: >>> base64.urlsafe_b64encode("/vnc_auto.html?port=64667&path=?token=opensuse12&encrypt=1") 'L3ZuY19hdXRvLmh0bWw_cG9ydD02NDY2NyZwYXRoPT90b2tlbj1vcGVuc3VzZTEyJmVuY3J5cHQ9MQ==' and in UI, we can decode it: kimchi.urlSafeB64Decode("L3ZuY19hdXRvLmh0bWw_cG9ydD02NDY2NyZwYXRoPT90b2tlbj1vcGVuc3VzZTEyJmVuY3J5cHQ9MQ==") "/vnc_auto.html?port=64667&path=?token=opensuse12&encrypt=1" or In UI, we can encode an url: kimchi.urlSafeB64Encode("/vnc_auto.html?port=64667&path=?token=opensuse12&encrypt=1") "L3ZuY19hdXRvLmh0bWw_cG9ydD02NDY2NyZwYXRoPT90b2tlbj1vcGVuc3VzZTEyJmVuY3J5cHQ9MQ==" and in backend, we can decode it: >>> base64.urlsafe_b64decode("L3ZuY19hdXRvLmh0bWw_cG9ydD02NDY2NyZwYXRoPT90b2tlbj1vcGVuc3VzZTEyJmVuY3J5cHQ9MQ==") '/vnc_auto.html?port=64667&path=?token=opensuse12&encrypt=1' Signed-off-by: ShaoHe Feng <shaohef(a)linux.vnet.ibm.com> --- ui/js/src/kimchi.utils.js | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ui/js/src/kimchi.utils.js b/ui/js/src/kimchi.utils.js index c7103f8..480b9b5 100644 --- a/ui/js/src/kimchi.utils.js +++ b/ui/js/src/kimchi.utils.js @@ -183,3 +183,11 @@ kimchi.escapeStr = function(str) { return str; }; + +kimchi.urlSafeB64Decode = function(str) { + return atob(str.replace(/-/g, '+').replace(/_/g, '/')); +} + +kimchi.urlSafeB64Encode = function(str) { + return btoa(str).replace(/\+/g, '-').replace(/\//g, '_'); +} -- 1.9.3

2 1

[PATCH 0/4] Authorization: disable non-root user functions in UI
by wenwang＠linux.vnet.ibm.com 18 Jul '14

18 Jul '14

From: Wen Wang <wenwang(a)linux.vnet.ibm.com> This patch defines user privilege according to different user roles In this release, only two roles are supported: "admin" and "user", conbined with four modes: "admin", "byInstance", "read-only" and "none", each of which has own privileges to different tabs as well as instances. modes are stored in cookie and functions of different roles are protected in the back-end. Please apply Aline's patches first before this one. Below are the references: (1)[Kimchi-devel] [PATCH 0/4 V2] Let frontend redirect user after logging (2)[Kimchi-devel] [PATCH 0/5 V3] authorization: Backend changes Apply these two patches in order then this UI changes can work Wen Wang (4): Add modes into cookie Authorization: remove host/template tabs for non-root users Authorization: remove [+] icon from non-root users view Authorization: Remove actions based on roles ui/css/theme-default/storage.css | 18 +++++++++--------- ui/js/src/kimchi.guest_main.js | 4 ++++ ui/js/src/kimchi.login.js | 20 +++++++++++++------- ui/js/src/kimchi.main.js | 21 +++++++++++++-------- ui/js/src/kimchi.network.js | 9 +++++++++ ui/js/src/kimchi.storage_main.js | 11 +++++++++++ 6 files changed, 59 insertions(+), 24 deletions(-)

1 4