Merge lp:~fred-yang/nova/TrustedComputingPools into lp:~hudson-openstack/nova/trunk

[fred yang]

Enable Trusted Computing Pools into Openstack scheduler by adding new filter driver
Spec/Design - http://wiki.openstack.org/TrustedComputingPools
Blueprint discussed at Diablo Summit - https://blueprints.launchpad.net/nova/+spec/trusted-computing-pools

[Chris Behrens (cbehrens)]

This looks really interesting! I haven't done a thorough review yet, but it looks like around line 276, there's extreme indenting. Maybe there are tabs instead of spaces?

review: Needs Fixing

[Sandy Walsh (sandy-walsh)]

Thanks Fred ... perhaps we can start with a pep8 cleanup and ensure it complies with the HACKING document. Also if you could remove all the debug/commented out code?

Then we can get into the nitty gritty of it.

review: Needs Fixing

[Johannes Erdfelt (johannes.erdfelt)]

I don't know enough about the scheduler to comment on the functionality of the patch, but I do have a style comment. It doesn't seem necessary to split tlvl_string and tlvl_value as separate lists. Especially since the code combines them into a dict at runtime. It's probably cleaner to create a dict literal instead.

[Paul Voccio (pvo)]

 Wanted to echo removing comments and some of the formatting the others
 mentioned here.

 I got some 3 failures with the S3APITestCase. Not sure if this is related or
 not yet.
>
 Please also add yourself to the Authors file. This failed on the unit tests
 for me.

>
> ======================================================================
> FAIL: test_authors_up_to_date (nova.tests.test_misc.ProjectTestCase)
> ----------------------------------------------------------------------
> Traceback (most recent call last):
> File "/root/bzr/TrustedComputingPools/nova/tests/test_misc.py", line 93, in
> test_authors_up_to_date
> '%r not listed in Authors' % missing)
> AssertionError: set([u'<email address hidden>']) not listed in Authors

review: Needs Fixing

[fred yang (fred-yang)]

Woop! Learning the process. Should I submit the Authors file now, or I can do another clean-up to submit
Thanks,
-Fred

> Wanted to echo removing comments and some of the formatting the others
> mentioned here.
>
> I got some 3 failures with the S3APITestCase. Not sure if this is related or
> not yet.
> >
> Please also add yourself to the Authors file. This failed on the unit tests
> for me.
>
> >
> > ======================================================================
> > FAIL: test_authors_up_to_date (nova.tests.test_misc.ProjectTestCase)
> > ----------------------------------------------------------------------
> > Traceback (most recent call last):
> > File "/root/bzr/TrustedComputingPools/nova/tests/test_misc.py", line 93,
> in
> > test_authors_up_to_date
> > '%r not listed in Authors' % missing)
> > AssertionError: set([u'<email address hidden>']) not listed in Authors

[fred yang (fred-yang)]

Will start from pep 8 tool to clearn up ...
Thanks,
-Fred

> Thanks Fred ... perhaps we can start with a pep8 cleanup and ensure it
> complies with the HACKING document. Also if you could remove all the
> debug/commented out code?
>
> Then we can get into the nitty gritty of it.

[fred yang (fred-yang)]

Combining sting & value into a dict is good suggestion
Thanks,
-Fred

> I don't know enough about the scheduler to comment on the functionality of the
> patch, but I do have a style comment. It doesn't seem necessary to split
> tlvl_string and tlvl_value as separate lists. Especially since the code
> combines them into a dict at runtime. It's probably cleaner to create a dict
> literal instead.

Unmerged revisions

1587. By fred yang on 2011-09-18

First Trusted Computing Pools enabling

=== added directory 'nova/scheduler/attestation'
=== added file 'nova/scheduler/attestation/__init__.py'
--- nova/scheduler/attestation/__init__.py	1970-01-01 00:00:00 +0000
+++ nova/scheduler/attestation/__init__.py	2011-09-20 01:13:28 +0000
@@ -0,0 +1,24 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright (c) 2010 Openstack, LLC.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+:mod:`nova.scheduler.attestation` -- API service to attestation server
+=====================================================
+
+.. automodule:: nova.scheduler.attestation
+   :platform: Unix
+   :synopsis: Module that provide https client to attestation server
+"""

=== added file 'nova/scheduler/attestation/attestation.py'
--- nova/scheduler/attestation/attestation.py	1970-01-01 00:00:00 +0000
+++ nova/scheduler/attestation/attestation.py	2011-09-20 01:13:28 +0000
@@ -0,0 +1,124 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010-2011 OpenStack, LLC
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Client classes for callers to attestation server
+"""
+
+import json
+from nova import log as logging
+
+from nova.scheduler.attestation import client
+LOG = logging.getLogger('nova.scheduler.attestation')
+
+class v10Client(client.BaseClient):
+
+    """Main client class for accessing Attestation server"""
+
+    DEFAULT_PORT = 4443
+
+    def __init__(self, host, port=None, use_ssl=False, doc_root="/v1",
+                 auth_user=None, auth_passwd=None, 
+                 key_file=None, cert_file=None, ca_file=None):
+        """
+        Creates a new client to a Attestation API service.
+
+        :param host: The host where Attestation resides
+        :param port: The port where Attestation resides (defaults to 9292)
+        :param use_ssl: Should we use HTTPS? (defaults to False)
+        :param doc_root: Prefix for all URLs we request from host
+        :param auth_tok: The auth token to pass to the server
+        """
+        port = port or self.DEFAULT_PORT
+        self.doc_root = doc_root
+        super(v10Client, self).__init__(host, port, use_ssl, 
+                                        auth_user, auth_passwd,
+                                        key_file, cert_file, ca_file)
+
+    def do_request(self, method, action, body=None, headers=None, params=None):
+        action = "%s/%s" % (self.doc_root, action)
+        return super(v10Client, self).do_request(method, action, body,
+                                                         headers, params)
+
+    def post_hosts(self, hosts, PcrMask=None):
+        """
+        Post a list of hosts to attestation server to get trustworthiness
+        as well as PCR index back if specified - 
+        Return RequestId
+
+        :hosts: hosts list to be posted
+        :PcrMask: PCR index to be retrieved
+        :TODO:  limit the hosts count to be less than 500
+        """
+        body = {}
+        body['count'] = len(hosts)
+        if PcrMask:
+            body['PCRmask'] = PcrMask
+        #body['hosts'] = '+'.join(hosts)
+        body['hosts'] = hosts
+        cooked = json.dumps(body)
+        headers = {}
+        headers['Context-Type'] = 'application/json'
+        headers['Accept'] = 'application/json'
+        res = self.do_request("POST", "PostHosts", cooked, headers)
+        rheader = res.getheaders()
+        LOG.debug(_("post_hosts got return headers %(rheader)s " % locals()))
+        
+        raw = json.loads(res.read())
+        RequestId = raw['RequestId']
+        LOG.debug(_("post_hosts got %(raw)s %(RequestId)s" % locals()))
+        return RequestId
+
+    def get_hosts(self, rid):
+        """
+        Get trustworthiness from previously posted hosts
+        """
+
+        #TODO:  perform mark and limit read to pull all data
+        body = {}
+        body['RequestId'] = rid
+        cooked = json.dumps(body)
+        headers = {}
+        headers['Context-Type'] = 'application/json'
+        headers['Accept'] = 'application/json'
+        res = self.do_request("GET", "RequestId", cooked, headers)
+        rheader = res.getheaders()
+        LOG.debug(_("get_hosts got return headers %(rheader)s " % locals()))
+        raw = json.loads(res.read())
+        data = raw['RequestId']
+        return data
+        
+    def poll_hosts(self, hosts, PcrMask=None):
+        """
+        same as post_hosts, but sync & wait for operation done to return data
+        """
+        body = {}
+        body['count'] = len(hosts)
+        if PcrMask:
+            body['PCRmask'] = PcrMask
+        #body['hosts'] = '+'.join(hosts)
+        body['hosts'] = hosts
+        headers = {}
+        headers['Context-Type'] = 'application/json'
+        headers['Accept'] = 'application/json'
+        body = json.dumps(body)
+        res = self.do_request("POST", "PollHosts", body, headers)
+        rheader = res.getheaders()
+        LOG.debug(_("Poll_hosts headers %(rheader)s " % locals()))
+        raw = json.loads(res.read())
+        data = raw['PollHosts']
+        return data

=== added file 'nova/scheduler/attestation/client.py'
--- nova/scheduler/attestation/client.py	1970-01-01 00:00:00 +0000
+++ nova/scheduler/attestation/client.py	2011-09-20 01:13:28 +0000
@@ -0,0 +1,223 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright (c) 2010 Openstack, LLC.
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#   
+#         http://www.apache.org/licenses/LICENSE-2.0
+#   
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+    
+"""     
+Attestation Client service
+"""     
+
+import httplib
+import logging
+import socket
+import urllib
+import ssl
+
+from nova import log as logging
+from nova import exception
+LOG = logging.getLogger('nova.scheduler.attestation.client')
+
+class HTTPSClientAuthConnection(httplib.HTTPSConnection):
+    """ Class to make a HTTPS connection, with support for full client-based SSL Authentication"""
+
+    def __init__(self, host, port, key_file, cert_file, ca_file, timeout=None):
+        httplib.HTTPSConnection.__init__(self, host, port, 
+                                        key_file=key_file, cert_file=cert_file)
+        self.host = host
+        self.post = port
+        self.key_file = key_file
+        self.cert_file = cert_file
+        self.ca_file = ca_file
+        self.timeout = timeout
+
+    def connect(self):
+        """ Connect to a host on a given (SSL) port.
+            Use ca_file pointing somewhere, use it to check Server Certificate.
+            Redefined/copied and extended from httplib.py:1105 (Python 2.6.x).
+        """
+        host = self.host
+        port = self.port
+        sock = socket.create_connection((self.host, self.port), self.timeout)
+        if self._tunnel_host:
+            self.sock = sock
+            self._tunnel()
+        # If there's no CA File, don't force Server Certificate Check
+        if self.ca_file:
+            self.sock = ssl.wrap_socket(sock, self.key_file, self.cert_file,
+                        ssl_version=ssl.PROTOCOL_SSLv23,
+                        ca_certs=self.ca_file,
+                        cert_reqs=ssl.CERT_REQUIRED)
+            LOG.debug(_("Https server certified " % locals()))
+            s = self.sock
+            cert = s.getpeercert()
+        else:
+            self.sock = ssl.wrap_socket(sock, self.key_file, self.cert_file, 
+						cert_reqs=ssl.CERT_NONE)
+
+
+class BaseClient(object):
+
+    """A base client class"""
+
+    CHUNKSIZE = 65536
+
+    def __init__(self, host, port, use_ssl, auth_user, auth_passwd,
+				 key_file=None, cert_file=None, ca_file=None):
+        """
+        Creates a new client to some service.
+
+        :param host: The host where service resides
+        :param port: The port where service resides
+        :param use_ssl: Should we use HTTPS?
+        :param auth_user: user name to connect with attestation server
+        :param auth_passwd: password to get attestation server authentication
+        """
+        self.host = host
+        self.port = port
+        self.use_ssl = use_ssl
+        self.auth_user = auth_user
+        self.auth_passwd = auth_passwd
+        self.connection = None
+        self.key_file = key_file
+        self.cert_file = cert_file
+        self.ca_file = ca_file
+
+    def set_auth_blob(self, auth_user, auth_passwd):
+        """
+        Updates the authentication token for this client connection.
+        """
+        self.auth_user = auth_user
+        self.auth_passwd = auth_passwd
+
+    def get_connection(self):
+        """
+        Returns the proper connection type
+        """
+        host = self.host
+        port = self.port
+        if self.use_ssl:
+			return HTTPSClientAuthConnection(self.host, self.port, 
+											 key_file=self.key_file, 
+											 cert_file=self.cert_file, 
+											 ca_file=self.ca_file)
+        else:
+            return httplib.HTTPConnection(self.host, self.port)
+
+    def do_request(self, method, action, body=None, headers=None, params=None):
+        """
+        Connects to the server and issues a request.  Handles converting
+        any returned HTTP error status codes to OpenStack/Glance exceptions
+        and closing the server connection. Returns the result data, or
+        raises an appropriate exception.
+
+        """
+        if type(params) is dict:
+
+            # remove any params that are None
+            for (key, value) in params.items():
+                if value is None:
+                    del params[key]
+
+            action += '?' + urllib.urlencode(params)
+
+        try:
+            c = self.get_connection()
+            headers = headers or {}
+            if 'x-auth-user' not in headers and self.auth_user:
+                headers['x-auth-user'] = self.auth_user
+            if 'x-auth-passwd' not in headers and self.auth_passwd:
+                headers['x-auth-passwd'] = self.auth_passwd
+
+            # Do a simple request or a chunked request, depending
+            # on whether the body param is a file-like object and
+            # the method is PUT or POST
+            #if hasattr(body, 'read') and method.lower() in ('post', 'put'):
+            if body:
+                # query is in body
+                c.putrequest(method, action)
+
+                for header, value in headers.items():
+                    c.putheader(header, value)
+                #c.putheader('Content-type', 'text/json')
+                c.putheader('Content-length', len(body))
+                c.putheader('Transfer-Encoding', 'chunked')
+                c.endheaders()
+
+                #chunk = body.read(self.CHUNKSIZE)
+                c.send('%s' % (body))
+                c.send('0\r\n\r\n')
+            else:
+                # Simple request.through uri
+                c.request(method, action, body, headers)
+            res = c.getresponse()
+            #status_code = self.get_status_code(res)
+            status_code = res.status
+            if status_code in (httplib.OK,
+                               httplib.CREATED,
+                               httplib.ACCEPTED,
+                               httplib.NO_CONTENT):
+                return res
+            elif status_code == httplib.UNAUTHORIZED:
+                raise exception.NotAuthorized
+            elif status_code == httplib.FORBIDDEN:
+                raise exception.NotAuthorized
+            elif status_code == httplib.NOT_FOUND:
+                raise exception.NotFound
+            elif status_code == httplib.CONFLICT:
+                raise exception.Duplicate(res.read())
+            elif status_code == httplib.BAD_REQUEST:
+                raise exception.Invalid(res.read())
+            elif status_code == httplib.INTERNAL_SERVER_ERROR:
+                raise Exception("Internal Server error: %s" % res.read())
+            else:
+                raise Exception("Unknown error occurred! %s" % res.read())
+
+        except (socket.error, IOError), e:
+            raise Exception("Unable to connect to server. Got error: %s" % e)
+
+    def get_status_code(self, response):
+        """
+        Returns the integer status code from the response, which
+        can be either a Webob.Response (used in testing) or httplib.Response
+        """
+        if hasattr(response, 'status_int'):
+            return response.status_int
+        else:
+            return response.status
+
+    def _extract_params(self, actual_params, allowed_params):
+        """
+        Extract a subset of keys from a dictionary. The filters key
+        will also be extracted, and each of its values will be returned
+        as an individual param.
+
+        :param actual_params: dict of keys to filter
+        :param allowed_params: list of keys that 'actual_params' will be
+                               reduced to
+        :retval subset of 'params' dict
+        """
+        try:
+            # expect 'filters' param to be a dict here
+            result = dict(actual_params.get('filters'))
+        except TypeError:
+            result = {}
+
+        for allowed_param in allowed_params:
+            if allowed_param in actual_params:
+                result[allowed_param] = actual_params[allowed_param]
+
+        return result

=== added file 'nova/scheduler/attestation/service.py'
--- nova/scheduler/attestation/service.py	1970-01-01 00:00:00 +0000
+++ nova/scheduler/attestation/service.py	2011-09-20 01:13:28 +0000
@@ -0,0 +1,204 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright (c) 2010 Openstack, LLC.
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#   
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+        
+"""         
+Attestation Service 
+"""         
+                
+import datetime 
+            
+from nova import flags
+from nova import log as logging
+from nova import utils
+
+from nova.scheduler.attestation import attestation
+
+
+LOG = logging.getLogger('nova.scheduler.attestaion.service')
+FLAGS = flags.FLAGS
+flags.DEFINE_integer('attestation_geo_required', 0,
+                     'require to use PCR22 as geo indicator')
+flags.DEFINE_integer('attestation_max_hosts', 300,
+                     'max number of hosts per request')
+
+flags.DEFINE_string('attestation_server', 'localhost',
+                    'attestation server http')
+flags.DEFINE_string('attestation_server_ca_file', None,
+                    'attestation server Cert file for Identity verification')
+flags.DEFINE_string('attestation_port', '4443',
+                    'attestation server port')
+flags.DEFINE_string('attestation_auth_user', 'MustSetupThisUser',
+                    'attestation access user - must change')
+flags.DEFINE_string('attestation_auth_passwd', 'MustChangeThisPasswd',
+                    'attestation access passwd - must change')
+
+class AttestationService(object):
+    def __init__(self):
+        self.host = FLAGS.attestation_server
+        self.port = FLAGS.attestation_port
+        self.auth_user = FLAGS.attestation_auth_user
+        self.auth_passwd = FLAGS.attestation_auth_passwd
+        self.ca_file = FLAGS.attestation_server_ca_file
+        self.use_ssl = True
+        self.doc = "v1.0"
+        self.attestation = attestation.v10Client(self.host, self.port, 
+                    self.use_ssl, self.doc, self.auth_user, self.auth_passwd,
+                    ca_file = self.ca_file)
+        self.req_count = FLAGS.attestation_max_hosts or 300    
+                                        # max number of hosts per request
+                                        # TODO: retrive from server
+        self.requests = {}   # tracks request ids with host list
+        self.req_id = []
+
+    tlvl_string = ['trusted', 'untrusted', 'unknown']
+    tlvl_value = ['lvl10', 'lvl01', 'lvl01']
+
+    def _post_hosts(self, hosts, PcrMask=None):
+        total = len(hosts)
+        max = self.req_count
+        n = (total + max - 1) // max
+        count_per_loop = total // n
+        start = 0
+        if FLAGS.attestation_geo_required:
+            PcrMask = '400000'  # also read PCR22 in
+        #TODO:  need error handling
+        while total:
+            if total < count_per_loop:
+                count_per_loop = total
+            list = hosts[start:count_per_loop]
+            rid = self.attestation.post_hosts(list, PcrMask)
+            self.req_id.append(rid)
+            total -= count_per_loop
+            start += count_per_loop
+        return {}
+
+    def _get_hosts(self, hosts):
+        """
+        get result from previously posted rid
+        """
+        if not len(self.req_id):
+            return {}
+        data = []
+        done = []
+        index =  0
+        for rid in self.req_id:
+            res = self.attestation.get_hosts(rid)
+            hosts = self._process_packet(res, rid)
+            if isinstance(hosts, dict):
+                # got result
+                data.append(hosts)
+                done.append(rid)
+            else:
+                # TODO: something wrong, need clean-up
+                # return hosts to get caller to issue command again
+                return 'BAD_DATA'
+            index += 1
+            
+        report = self._pack_host_data(data)
+        for rid in done:
+            self.req_id.remove(rid)
+        return report
+            
+    def _poll_hosts(self, hosts, PcrMask=None):
+        total = len(hosts)
+        max = self.req_count
+        n = (total + max - 1) // max
+        count_per_loop = total // n
+        start = 0
+        if FLAGS.attestation_geo_required:
+            PcrMask = '400000'  # also read PCR22 in
+        #TODO:  need error handling
+        res = []
+        while total:
+            if total < count_per_loop:
+                count_per_loop = total
+            list = hosts[start:count_per_loop]
+            data = self.attestation.poll_hosts(list, PcrMask)
+            if isinstance(data, dict):
+                res.append(data)
+            total -= count_per_loop
+            start += count_per_loop
+        report = self._pack_host_data(res)
+        return report
+
+    commands = {
+        'post_hosts': _post_hosts,
+        'get_hosts': _get_hosts,
+        'poll_hosts': _poll_hosts,
+    }
+
+    def do_attestation(self, cmd, hosts=None):
+        """
+        cmd: [post_hosts, get_hosts, poll_hosts]
+        """
+        method = self.commands[cmd.lower()]  # Let exception fly.
+        report = method(self, hosts)
+        return report
+        
+    def _pack_host_data(self, data):
+        report = {}
+        cvt = dict(zip(self.tlvl_string, self.tlvl_value))
+        for item in data:
+            count = item['count']
+            hosts = item['hosts']
+            for host, state in hosts.iteritems():
+                entry = {}
+                entry['trust_lvl'] = cvt.get(state['trust_lvl'], {})
+                entry['vtime'] = state['timestamp']
+                if FLAGS.attestation_geo_required:
+                    entry['geo'] = state[PCR22]
+                report[host] = entry
+                count -= 1
+            if count:
+                LOG.warn(_("Get hosts missed count %(count)s" % locals()))
+        return report
+            
+
+    def _process_packet(self, packet, rid):
+        """
+        Expected input format
+            { 'jobid' : rid,
+              'jobstatus' : 0/1/2   (processing/success/failed)
+              'jobcode' : 0 or others
+              'jobresult' : "error information"
+              (continue hosts information if success)
+              'count' : 2
+              'hosts' : [
+                  {host1 : {
+                    'trust_lvl': trusted|untrusted|unknown
+                    'timestamp': UTC
+                    'PCRxx' : xxx},
+                   host2 : {
+                    'trust_lvl': trusted|untrusted|unknown
+                    'timestamp': UTC
+                    'PCRxx' : xxx},
+                    }]
+                }
+        """
+        if not packet['jobid'] == rid:
+                LOG.warn(_("Incoming packet has wrong RequestId" % locals()))
+                return 2
+        status = packet['jobstatus']
+        if status is 2:
+                result = packet['jobresult']
+                LOG.warn(_("Incoming packet error %(result)s " % locals()))
+                return 2
+        if status is 1:
+                return packet
+        return {}

=== modified file 'nova/scheduler/filters/__init__.py'
--- nova/scheduler/filters/__init__.py	2011-08-15 22:09:39 +0000
+++ nova/scheduler/filters/__init__.py	2011-09-20 01:13:28 +0000
@@ -34,3 +34,4 @@
 from all_hosts_filter import AllHostsFilter
 from instance_type_filter import InstanceTypeFilter
 from json_filter import JsonFilter
+from json_filter_integrity import JsonFilterIntegrity

=== added file 'nova/scheduler/filters/json_filter_integrity.py'
--- nova/scheduler/filters/json_filter_integrity.py	1970-01-01 00:00:00 +0000
+++ nova/scheduler/filters/json_filter_integrity.py	2011-09-20 01:13:28 +0000
@@ -0,0 +1,124 @@
+# Copyright (c) 2011 Openstack, LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Supporting trusted compute pool host filtering for Json
+"""
+
+import json
+
+from nova import exception
+from nova import flags
+from nova import log as logging
+from nova import utils
+from nova.scheduler.filters import json_filter
+
+LOG = logging.getLogger('nova.scheduler.filter.json_filter_integrity')
+
+FLAGS = flags.FLAGS
+flags.DEFINE_integer('trust_pool_enforced', 1,
+                     'enforce compute nodes to be trusted or non-trusted')
+
+#currently supported commands
+trust_value = ['trusted']
+untrust_value = ['Untrusted']
+basic_cmd = ['=']
+extra_cmd = ['>=']
+tlvl_string = ['trusted', 'untrusted']
+tlvl_value = ['lvl10', 'lvl01']
+
+class JsonFilterIntegrity(json_filter.JsonFilter):
+    """Host Filter to allow simple JSON-based grammar for
+    selecting hosts.
+    """
+
+    def _trust_pool_reconfirm(self, zone_manager, hosts):
+        return zone_manager.integrity_service.reconfirm(hosts)
+
+
+    def _convert_trust_query(self, cmd, arg):
+        """pre-scan query to sanitize trust_lvl request"""
+        if len(arg) != 2:
+            raise exception.Error(_("Bad $trust_state combination"))
+
+        # convert to internal value
+        cvt = dict(zip(tlvl_string, tlvl_value))
+        value = cvt.get(arg[1].lower(), {})
+        if value:
+            tmp = [arg[0], value]
+        else:
+            tmp = arg
+        v = arg[1]
+        if cmd in extra_cmd and v in trust_value:
+            return tmp
+        if cmd in basic_cmd and (v in trust_value or v in untrust_value):
+            return tmp
+        raise exception.Error(_("Bad $trust_state combination"))
+
+    def _process_tfilter(self, zone_manager, query, host, services, c):
+        """Recursively parse the query structure."""
+        if len(query) == 0:
+            return c, True
+        cmd = query[0]
+        method = self.commands[cmd]  # Let exception fly.
+        cooked_args = []
+        for arg in query[1:]:
+            if isinstance(arg, list):
+                c, arg = self._process_tfilter(
+                                zone_manager, arg, host, services, c)
+            elif isinstance(arg, basestring):
+                arg = self._parse_string(arg, host, services)
+            if arg != None:
+                cooked_args.append(arg)
+
+        if cooked_args and isinstance(cooked_args[0], str): 
+            if len(cooked_args[0]) > 3 and  cooked_args[0][0:3] == 'lvl':
+                cooked_args = self._convert_trust_query(cmd, cooked_args)
+                c += 1
+        
+        result = method(self, cooked_args)
+        return c, result
+
+    def filter_hosts(self, zone_manager, query):
+        """Return a list of hosts that can fulfill filter."""
+        expanded = json.loads(query)
+        filtered_hosts = []
+        for host, services in zone_manager.service_states.iteritems():
+            c = 0
+            c, r = self._process_tfilter(
+                            zone_manager, expanded, host, services, c)
+            if isinstance(r, list):
+                r = True in r
+            if r:
+                filtered_hosts.append((host, services))
+
+        if not c and FLAGS.trust_pool_enforced:
+            lists = []
+            # There is no trust_lvl from query, so force all request
+            # to only untrusted nodes
+            cvt = dict(zip(tlvl_string, tlvl_value))
+            untrusted = cvt.get('untrusted', {})
+            query = ["=", "$trust_state.trust_lvl", untrusted]
+            for host, services in filtered_hosts:
+                r = self._process_filter(zone_manager, query, host, services)
+                if isinstance(r, list):
+                    r = True in r
+                if r:
+                    lists.append((host, services))
+            filtered_hosts = lists
+        filtered_hosts = self._trust_pool_reconfirm(
+                                        zone_manager, filtered_hosts)
+        LOG.debug(_("Found hosts %(filtered_hosts)s" % locals()))
+        return filtered_hosts

=== added file 'nova/scheduler/manager_integrity.py'
--- nova/scheduler/manager_integrity.py	1970-01-01 00:00:00 +0000
+++ nova/scheduler/manager_integrity.py	2011-09-20 01:13:28 +0000
@@ -0,0 +1,240 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright (c) 2010 Openstack, LLC.
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Scheduler Service
+"""
+
+import functools
+import datetime
+
+from nova import context
+from nova import db
+from nova import flags
+from nova import log as logging
+from nova import manager
+from nova import rpc
+from nova import utils
+from nova.scheduler import manager
+from nova.scheduler.attestation import service
+
+LOG = logging.getLogger('nova.scheduler.manager_integrity')
+FLAGS = flags.FLAGS
+flags.DEFINE_bool('integrity_reconfirm', False,
+                     'real-time reconfirm integrity')
+flags.DEFINE_bool('trusted_pool_debug', False,
+                     'work-around before attestation server is ready')
+
+class IntegrityService(object):
+    """
+    Trusted computing pool service - filters and provide cache for
+    compute nodes' trustworthiness through attestation
+    """
+
+    def __init__(self, zone_manager):
+        self.zone_manager = zone_manager
+        self.zone_manager.inflight_hosts = {}  #{host:utc (for testing)}
+        self.zone_manager.tick_snapshots = {} #{host:{count:tick, update:UTC}}
+        self.zone_manager.trust_cache = {} #{host:trust_lvl}
+        self.zone_manager.attestation_service = AttestationService()
+
+    def snapshot_update(self, host, service):
+        """
+        update lastest compute node's report status into last snapshots
+        tick_snapshots = {host:{'count':report_count,'updated_at':updated_at}}
+        tick_snapshot{} is used for checking if a node has been rebooted since
+        """
+        updated_at = service['updated_at'] or service['created_at']
+        self.zone_manager.tick_snapshots[host] = {'updated_at' : updated_at,
+                            'report_count':service['report_count']}
+
+    def _do_attestation(self, method, hosts):
+        """expect integrity_report {'host':{trust_lvl:lvl, vtime:UTC}}"""
+        return self.zone_manager.attestation_service.do_attestation(
+                            method, hosts)
+
+    def cache_states_update(self, integrity_report):
+        """called right after do_attestation"""
+        for host, state in integrity_report.iteritems():
+            self.zone_manager.trust_cache[host] = state['trust_lvl']
+            self.zone_manager.update_service_capabilities(
+                                                'trust_state', host, state)
+            del self.zone_manager.inflight_hosts[host]
+
+    def post_hosts(self, hosts):
+        """POST list list of hosts to attestation server"""
+        lists = []
+        now = utils.utcnow()
+        for host in hosts:
+            self.zone_manager.inflight_hosts[host] = now
+            lists.append(host)
+        if lists:
+            self._do_attestation('POST_HOSTS', lists)
+            #LOG.debug(_("POST_HOSTS %(lists)s" % locals()))
+
+    def get_hosts(self, context=None):
+        """GET previously posted attestation results """
+        """TODO: need to break hosts into controable size for GET"""
+        hosts = []
+        for host, time in self.zone_manager.inflight_hosts.iteritems():
+            hosts.append(host)
+        # expect integrity_report {'host':{Trust_lvl:lvl, vtime:UTC}}
+        if hosts:
+            integrity_report = self._do_attestation('GET_HOSTS', hosts)
+            self.cache_states_update(integrity_report)
+
+    def post_get_host(self, host, context=None):
+        """POST and GET for a host's integrity report"""
+        # expect integrity_report {'host':{Trust_lvl:lvl, vtime:UTC}}
+        intergity_report = self._do_attestation('POLL_HOSTS', host)
+        self.cache_states_update(integrity_report)
+
+    def service_is_down(self, service):
+        """check if a compute node has missed a heatbeat since"""
+        heartbeat = service['updated_at'] or service['created_at']
+        x = utils.utcnow()
+        elapsed = utils.utcnow() - heartbeat 
+        return elapsed >= datetime.timedelta(seconds=FLAGS.service_down_time)
+
+    def host_is_rebooted(self, service, snapshot):
+        """
+        check if a host was rebooted if report_count was discontinuous
+        this should only be called after service_is_down() verifed
+        """
+        e_tick = service['report_count'] - snapshot['report_count']
+        e_time = service['updated_at'] - snapshot['updated_at']
+        unit =  datetime.timedelta(seconds=FLAGS.report_interval)
+        #LOG.debug(_("e_tick %(e_tick)s e_time %(e_time)s" % locals()))
+        return not e_tick * unit <= e_time <= (e_tick+1) * unit
+
+    def cached_data_removal(self, host, service):
+        if host in self.zone_manager.inflight_hosts:
+            del self.zone_manager.inflight_hosts[host]
+        #self.service_state_integrity_update(host, {})
+        self.zone_manager.update_service_capabilities('trust_state', host, {})
+        
+    def collect_new_hosts(self, context):
+        """locate hosts who were rebooted in the last FLAG.report_interval"""
+        services = db.service_get_all_by_topic(context, 'compute')
+        hosts = []
+        for service in services:
+            snapshot = self.zone_manager.tick_snapshots.get(service.host, {})
+            if self.service_is_down(service):
+                if snapshot:
+                    del self.zone_manager.tick_snapshots[service.host]
+                    self.cached_data_removal(service.host, service)
+            else:
+                if not snapshot or self.host_is_rebooted(service, snapshot):
+                    self.cached_data_removal(service.host, service)
+                    hosts.append(service.host)
+                self.snapshot_update(service.host, service)
+        return hosts
+
+    def cache_setup(self, context=None):
+        """
+        Populate service_states{} with cached integrity data
+        runs as periodic task from scheduler for every FLAG.report_interval
+        """
+        self.get_hosts(context)
+        hosts = self.collect_new_hosts(context)
+        self.post_hosts(hosts)
+
+    def reconfirm(self, lists):
+        """
+        verify if we need to do the very last minute verifcation
+        see if any candidate host got rebooted since last snapshot
+        """
+        if FLAGS.integrity_reconfirm:
+            hosts = []
+            for host, service in lists:
+                hosts.append(host)
+            integrity_report = self._do_attestation('POLL_HOSTS', hosts)
+            self.cache_states_update(integrity_report)
+            hosts = []
+            for host, service in lists:
+                lvl = service['trust_state'].get('trust_lvl', {})
+                if integrity_report[host].get('trust_lvl', {}) == lvl:
+                    hosts.append((host, service))
+                else:                    
+                    LOG.warn(_("mis-matched %(host)s trust_lvl %(lvl)s" 
+                                            % locals()))
+            return hosts
+
+        #TODO:: need a better mechanism
+        # collect all good hosts
+        ctx = context.get_admin_context()
+        services = db.service_get_all_by_topic(ctx, 'compute')
+        hosts_good = {}
+        for service in services:
+            if not self.service_is_down(service):
+                snapshot = self.zone_manager.tick_snapshots.get(service.host,{})
+                if snapshot and not self.host_is_rebooted(service, snapshot):
+                    hosts_good[service.host] = 'v'
+
+        hosts = []
+        for host, service in lists:
+            if hosts_good.get(host, None):
+                lvl = service['trust_state'].get('trust_lvl', {})
+                if self.zone_manager.trust_cache[host] == lvl: 
+                    hosts.append((host, service))
+        return hosts
+        
+
+class AttestationService(object):
+    def __init__(self):
+        if FLAGS.trusted_pool_debug is True:
+            """
+            only used for unit test
+            """
+            utc = utils.utcnow() - datetime.timedelta(0)
+            self.tlvl_db = {}
+            # tlvl_string = ['trusted', 'untrusted']
+            # tlvl_value = ['lvl10', 'lvl01']
+            # must match with host_filter_integrity.py
+            self.tlvl_db['storky'] = {'trust_lvl':'lvl10', 'vtime':utc}
+            self.tlvl_db['stocky'] = {'trust_lvl':'lvl01', 'vtime':utc}
+        else:
+            self.attestation = service.AttestationService()
+
+    def do_attestation(self, cmd, hosts):
+        #TODO: final code must do tlvl_string to tlvl_value conversion
+        if FLAGS.trusted_pool_debug is True:
+            report = {}
+            utc = utils.utcnow() - datetime.timedelta(0)
+            for host in hosts:
+                lvl = self.tlvl_db[host].get('trust_lvl', {})
+                report[host] = {'trust_lvl':lvl,'vtime':utc}
+            return report
+        else:
+            return  self.attestation.do_attestation(cmd, hosts)
+
+class SchedulerManager(manager.SchedulerManager):
+    """inject a periodic_task into schedule for building integrity cache"""
+    def __init__(self, scheduler_driver=None, *args, **kwargs):
+        super(SchedulerManager, self).__init__(*args, **kwargs)
+        self.zone_manager.integrity_service= IntegrityService(self.zone_manager)
+
+    def setup_test_attestation(self, module):
+        """ testing purpost"""
+        self.zone_manager.integrity_service._do_attestation = module
+
+    def periodic_tasks(self, context=None):
+		super(SchedulerManager, self).periodic_tasks(context)
+		"""Setup integrity cache for this zone"""
+		self.zone_manager.integrity_service.cache_setup(context)

=== added file 'nova/tests/scheduler/test_json_filter_integrity.py'
--- nova/tests/scheduler/test_json_filter_integrity.py	1970-01-01 00:00:00 +0000
+++ nova/tests/scheduler/test_json_filter_integrity.py	2011-09-20 01:13:28 +0000
@@ -0,0 +1,251 @@
+# Copyright 2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+"""
+Tests For Scheduler Host Filters.
+"""
+
+import json
+
+import time
+import datetime
+from nova import utils
+from nova import exception
+from nova import flags
+from nova import test
+from nova.scheduler.filters import json_filter
+from nova.scheduler.filters import json_filter_integrity
+from nova import log as logging
+
+FLAGS = flags.FLAGS
+
+
+class FakeZoneManager:
+    pass
+
+
+class HostFilterTestCase(test.TestCase):
+    """Test case for host filters."""
+
+    def _host_caps(self, multiplier):
+        # Returns host capabilities in the following way:
+        # host1 = memory:free 10 (100max)
+        #         disk:available 100 (1000max)
+        # hostN = memory:free 10 + 10N
+        #         disk:available 100 + 100N
+        # in other words: hostN has more resources than host0
+        # which means ... don't go above 10 hosts.
+        return {'host_name-description': 'XenServer %s' % multiplier,
+                'host_hostname': 'xs-%s' % multiplier,
+                'host_memory_total': 100,
+                'host_memory_overhead': 10,
+                'host_memory_free': 10 + multiplier * 10,
+                'host_memory_free-computed': 10 + multiplier * 10,
+                'host_other-config': {},
+                'host_ip_address': '192.168.1.%d' % (100 + multiplier),
+                'host_cpu_info': {},
+                'disk_available': 100 + multiplier * 100,
+                'disk_total': 1000,
+                'disk_used': 0,
+                'host_uuid': 'xxx-%d' % multiplier,
+                'host_name-label': 'xs-%s' % multiplier}
+
+    def setUp(self):
+        self.old_flag = FLAGS.default_host_filter
+        FLAGS.default_host_filter = \
+                    'nova.scheduler.filters.json_filter_integrity.AllHostsFilter'
+        self.instance_type = dict(name='tiny',
+                memory_mb=50,
+                vcpus=10,
+                local_gb=500,
+                flavorid=1,
+                swap=500,
+                rxtx_quota=30000,
+                rxtx_cap=200,
+                extra_specs={})
+
+        self.zone_manager = FakeZoneManager()
+        states = {}
+        now = utils.utcnow() - datetime.timedelta(0)
+        for x in xrange(10):
+            state={}
+            if x in [0, 2, 4, 6, 9]:
+                lvl = 'lvl10'
+                state= {'compute': self._host_caps(x), 
+                        'trust_state':{'trust_lvl':lvl, 'vtime':now}}
+            elif x in [1, 3, 5, 8]:
+                lvl = 'lvl01'
+                state= {'compute': self._host_caps(x), 
+                        'trust_state':{'trust_lvl':lvl, 'vtime':now}}
+            else:
+                lvl = 'inflight'
+                state= {'compute': self._host_caps(x)} 
+            states['host%02d' % (x)] = state
+        self.zone_manager.service_states = states
+
+    def tearDown(self):
+        FLAGS.default_host_filter = self.old_flag
+
+    def dummy_reconfirm(self, zone_manager, hosts):
+        return hosts
+
+    def test_json_filter_integrity(self):
+        hf = json_filter_integrity.JsonFilterIntegrity()
+        #self.zone_manager.integrity_service_confirm=self.dummy_reconfirm
+        hf._trust_pool_reconfirm = self.dummy_reconfirm
+        # filter all hosts that can support 50 ram and 500 disk
+
+        name, cooked = hf.instance_type_to_filter(self.instance_type)
+        self.assertEquals('nova.scheduler.filters.json_filter_integrity.JsonFilterIntegrity', 
+                            name)
+        hosts = hf.filter_hosts(self.zone_manager, cooked)
+        self.assertEquals(2, len(hosts))
+        just_hosts = [host for host, caps in hosts]
+        just_hosts.sort()
+        self.assertEquals('host05', just_hosts[0])
+        self.assertEquals('host08', just_hosts[1])
+
+        raw=[]
+        cooked = json.dumps(raw)
+        hosts = hf.filter_hosts(self.zone_manager, cooked)
+        self.assertEquals(4, len(hosts))
+
+        raw= ['>=', '$compute.host_memory_free', 20]
+        cooked = json.dumps(raw)
+        hosts = hf.filter_hosts(self.zone_manager, cooked)
+        self.assertEquals(4, len(hosts))
+
+        raw= ['>=', '$trust_state.trust_lvl', 'trusted']
+        cooked = json.dumps(raw)
+        hosts = hf.filter_hosts(self.zone_manager, cooked)
+        self.assertEquals(5, len(hosts))
+
+        raw= ['<', '$trust_state.trust_lvl', 'untrusted']
+        cooked = json.dumps(raw)
+        try:
+            hf.filter_hosts(self.zone_manager, cooked)
+            self.fail("UsageError")
+        except exception.Error, e:
+            pass
+        # Try some custom queries
+
+        raw = [ 'or',
+                   ['and',
+                       ['<', '$compute.host_memory_free', 30],
+                       ['<', '$compute.disk_available', 300],
+                   ],
+                   ['and',
+                       ['>', '$compute.host_memory_free', 70],
+                       ['>', '$compute.disk_available', 700],
+                   ]
+              ]
+        cooked = json.dumps(raw)
+        hosts = hf.filter_hosts(self.zone_manager, cooked)
+        self.assertEquals(2, len(hosts))
+
+        raw = [ 'or',
+                   ['and',
+                       ['<', '$compute.host_memory_free', 30],
+                       ['<', '$compute.disk_available', 300],
+                   ],
+                   ['and',
+                       ['>', '$compute.host_memory_free', 60],
+                       ['>', '$compute.disk_available', 600],
+                        ['>=', '$trust_state.trust_lvl', 'trusted']
+                   ]
+              ]
+        cooked = json.dumps(raw)
+        hosts = hf.filter_hosts(self.zone_manager, cooked)
+        self.assertEquals(4, len(hosts))
+
+        raw = ['=', '$trust_state.trust_lvl', 'trusted']
+
+        cooked = json.dumps(raw)
+        hosts = hf.filter_hosts(self.zone_manager, cooked)
+
+        self.assertEquals(5, len(hosts))
+        just_hosts = [host for host, caps in hosts]
+        just_hosts.sort()
+        for index, host in zip([0, 2, 4, 6, 9], just_hosts):
+            self.assertEquals('host%02d' % index, host)
+
+        raw = ['and',
+                  ['>=', '$compute.host_memory_free', 30],
+              ]
+        cooked = json.dumps(raw)
+        hosts = hf.filter_hosts(self.zone_manager, cooked)
+
+        self.assertEquals(3, len(hosts))
+        just_hosts = [host for host, caps in hosts]
+        just_hosts.sort()
+        for index, host in zip([3, 5, 8], just_hosts):
+            self.assertEquals('host%02d' % index, host)
+
+        raw = ['and',
+                  ['>=', '$compute.host_memory_free', 30],
+                ['=', '$trust_state.trust_lvl', 'Untrusted']
+              ]
+        cooked = json.dumps(raw)
+        hosts = hf.filter_hosts(self.zone_manager, cooked)
+
+        self.assertEquals(3, len(hosts))
+        just_hosts = [host for host, caps in hosts]
+        just_hosts.sort()
+        for index, host in zip([3, 5, 8], just_hosts):
+            self.assertEquals('host%02d' % index, host)
+
+        raw = ['and',
+                ['>=', '$trust_state.trust_lvl', 'trusted'],
+                  ['>=', '$compute.host_memory_free', 30]
+              ]
+        cooked = json.dumps(raw)
+        hosts = hf.filter_hosts(self.zone_manager, cooked)
+
+        self.assertEquals(4, len(hosts))
+        just_hosts = [host for host, caps in hosts]
+        just_hosts.sort()
+        for index, host in zip([2, 4, 6, 9], just_hosts):
+            self.assertEquals('host%02d' % index, host)
+
+        # Try some bogus input ...
+        raw = ['unknown command', ]
+        cooked = json.dumps(raw)
+        try:
+            hf.filter_hosts(self.zone_manager, cooked)
+            self.fail("Should give KeyError")
+        except KeyError, e:
+            pass
+
+        self.assertTrue(hf.filter_hosts(self.zone_manager, json.dumps([])))
+        self.assertTrue(hf.filter_hosts(self.zone_manager, json.dumps({})))
+        self.assertTrue(hf.filter_hosts(self.zone_manager, json.dumps(
+                ['not', True, False, True, False])))
+
+        try:
+            hf.filter_hosts(self.zone_manager, json.dumps(
+                'not', True, False, True, False))
+            self.fail("Should give KeyError")
+        except KeyError, e:
+            pass
+
+        self.assertFalse(hf.filter_hosts(self.zone_manager,
+                json.dumps(['=', '$foo', 100])))
+        self.assertFalse(hf.filter_hosts(self.zone_manager,
+                json.dumps(['=', '$.....', 100])))
+        self.assertFalse(hf.filter_hosts(self.zone_manager,
+                json.dumps(
+            ['>', ['and', ['or', ['not', ['<', ['>=', ['<=', ['in', ]]]]]]]])))
+
+        self.assertFalse(hf.filter_hosts(self.zone_manager,
+                json.dumps(['=', {}, ['>', '$missing....foo']])))

=== added file 'nova/tests/scheduler/test_manager_integrity.py'
--- nova/tests/scheduler/test_manager_integrity.py	1970-01-01 00:00:00 +0000
+++ nova/tests/scheduler/test_manager_integrity.py	2011-09-20 01:13:28 +0000
@@ -0,0 +1,202 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+"""
+Tests For Scheduler
+"""
+
+import time
+import datetime
+import mox
+import novaclient.exceptions
+import stubout
+import webob
+
+from mox import IgnoreArg
+from nova import context
+from nova import db
+from nova import exception
+from nova import flags
+from nova import service
+from nova import test
+from nova import rpc
+from nova import utils
+from nova.auth import manager as auth_manager
+from nova.scheduler import api
+from nova.scheduler import manager
+from nova.scheduler import manager_integrity
+from nova.scheduler import driver
+from nova.compute import power_state
+from nova.db.sqlalchemy import models
+from nova import log as logging
+
+
+FLAGS = flags.FLAGS
+
+class TestDriver(driver.Scheduler):
+    """Scheduler Driver for Tests"""
+    def schedule(context, topic, *args, **kwargs):
+        return 'fallback_host'
+
+    def schedule_named_method(context, topic, num):
+        return 'named_host'
+
+
+class SchedulerTestCase(test.TestCase):
+    """Test case for scheduler"""
+    def setUp(self):
+        super(SchedulerTestCase, self).setUp()
+        driver = 'nova.tests.scheduler.test_scheduler.TestDriver'
+        self.flags(scheduler_driver=driver)
+
+        self.old_interval_flag = FLAGS.report_interval
+        FLAGS.report_interval = 2
+        self.old_down_flag = FLAGS.service_down_time
+        FLAGS.service_down_time = 4
+
+
+    def tearDown(self):
+        self.stubs.UnsetAll()
+        FLAGS.report_interval = self.old_interval_flag
+        FLAGS.service_down_time = self.old_down_flag
+        super(SchedulerTestCase, self).tearDown()
+
+    def _create_ncompute_service(self, n):
+        """Create compute-manager(ComputeNode and Service record)."""
+        self.hosts=n
+        ctxt = context.get_admin_context()
+        now = utils.utcnow() - datetime.timedelta(0)
+        dic1 = {'host': 'dummy', 'binary': 'nova-compute', 'topic': 'compute',
+               'report_count': 0, 'updated_at':0, 'created_at':0,
+               'availability_zone': 'dummyzone'}
+
+        dic2 = {'service_id': 0,
+               'vcpus': 16, 'memory_mb': 32, 'local_gb': 100,
+               'vcpus_used': 16, 'memory_mb_used': 32, 'local_gb_used': 10,
+               'hypervisor_type': 'qemu', 'hypervisor_version': 12003,
+               'cpu_info': ''}
+
+        for idx in range(n):
+            dic1['host'] = 'host%02d' % idx
+            dic1['report_count'] = idx * 2
+            dic1['updated_at'] = now
+            dic1['created_at'] = now
+            s_ref = db.service_create(ctxt, dic1)
+            dic2['service_id'] = s_ref['id']
+            db.compute_node_create(ctxt, dic2)
+
+    def _create_integrity_db(self, n):
+        tlvl = {'trust_lvl':'trusted', 'vTime':0}
+        utc = utils.utcnow() - datetime.timedelta(0)
+        db = {}
+        for idx in range(n):
+            host = 'host%02d' % idx
+            if idx % 2:
+                lvl = 'lvl10'
+            else:
+                lvl = 'lvl00'
+            db[host] = {'trust_lvl':lvl, 'vTime':utc}
+        self.integrity_db = db
+
+    def _create_compute_service(self):
+        """Create compute-manager(ComputeNode and Service record)."""
+        ctxt = context.get_admin_context()
+        dic = {'host': 'dummy', 'binary': 'nova-compute', 'topic': 'compute',
+               'report_count': 0, 'availability_zone': 'dummyzone'}
+        s_ref = db.service_create(ctxt, dic)
+
+        dic = {'service_id': s_ref['id'],
+               'vcpus': 16, 'memory_mb': 32, 'local_gb': 100,
+               'vcpus_used': 16, 'memory_mb_used': 32, 'local_gb_used': 10,
+               'hypervisor_type': 'qemu', 'hypervisor_version': 12003,
+               'cpu_info': ''}
+        db.compute_node_create(ctxt, dic)
+
+        return db.service_get(ctxt, s_ref['id'])
+
+    def _create_db(self, ctxt, scheduler, n):
+        self._create_ncompute_service(n)
+
+        """
+        services=db.service_get_all_by_topic(ctxt, 'compute')
+        for service in services:
+            logging.debug(_("Host %s"), service.host)
+            logging.debug(_("Services %s "), service.report_count) 
+            logging.debug(_("Updated %s "), service.updated_at) 
+        """
+
+    def _do_attestation(self, cmd, hosts):
+        utc = utils.utcnow() - datetime.timedelta(0)
+        self.query = hosts
+        db = self.integrity_db
+        report = {}
+        for host in hosts:
+            lvl = db[host].get('trust_lvl', {})
+            txt = {'trust_lvl':lvl, 'vtime':utc}
+            report[host] = txt
+        return report
+
+    def _update_ticks(self, ctx, skips, count, dec, down=None):
+        now = utils.utcnow() - datetime.timedelta(0)
+        for idx in range(self.hosts):
+            if idx % skips:
+                d = 0
+            else:
+                if down:
+                    continue
+                d = dec
+            h = 'host%02d' % idx 
+            ref = db.service_get_by_args(ctx, h, 'nova-compute')
+            ref['updated_at'] = now
+            ref['report_count'] += count - d
+            db.service_update(ctx, ref['id'], ref)
+        
+    def test_trust(self):
+        hosts = 10
+        scheduler = manager_integrity.SchedulerManager()
+        scheduler.setup_test_attestation(self._do_attestation)
+        ctx = context.get_admin_context()
+        self._create_db(ctx, scheduler, hosts)
+        self._create_integrity_db(hosts)
+        scheduler.periodic_tasks(ctx)
+        self.assertEqual(10, len(self.query))
+        time.sleep(FLAGS.report_interval)
+
+        self._update_ticks(ctx, 1, 1, 0)
+        scheduler.periodic_tasks(ctx)
+
+        time.sleep(FLAGS.service_down_time)
+        self._update_ticks(ctx, 3, 2, 2)
+        scheduler.periodic_tasks(ctx)
+        self.assertEqual(4, len(self.query))
+        time.sleep(FLAGS.service_down_time * 2)
+        down = 1
+        self._update_ticks(ctx, 3, 4, 4, down)
+        scheduler.periodic_tasks(ctx)
+        for idx in [0, 3, 6, 9]:
+            txt = scheduler.zone_manager.service_states.get("host%2d" % idx,{})
+            self.assertEqual(0, len(txt))
+        for idx in [1, 2, 4, 5, 7, 8]:
+            host = "host%02d" %idx
+            service = scheduler.zone_manager.service_states[host]
+            txt = service.get('trust_state', {})
+            lvl = txt.get('trust_lvl')
+            if idx % 2:
+                self.assertEqual(lvl, 'lvl10')
+            else:
+                self.assertEqual(lvl, 'lvl00')
+