vagrant-xapi 0.0.1 → 1.0.0

data/lib/vagrant-xapi/api/transport.rb

@@ -0,0 +1,249 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "openssl"
+require "socket"
+require "uri"
+
+require_relative "errors"
+
+module VagrantPlugins
+  module Xapi
+    module Api
+      # HTTPS transport to one XAPI host: TLS setup (CA, custom CA bundle or a
+      # SHA-256 fingerprint pin), a small pool of keep-alive connections, and
+      # translation of low-level network errors into Api errors.
+      #
+      # There is deliberately no way to disable certificate verification.
+      class Transport
+        NETWORK_ERRORS = [
+          Errno::ECONNREFUSED, Errno::ECONNRESET, Errno::EHOSTUNREACH,
+          Errno::ENETUNREACH, Errno::ETIMEDOUT, Errno::EPIPE, SocketError,
+          Net::OpenTimeout, Net::ReadTimeout, Net::WriteTimeout, EOFError,
+          IOError
+        ].freeze
+
+        TIMEOUT_ERRORS = [Net::OpenTimeout, Net::ReadTimeout, Net::WriteTimeout, Errno::ETIMEDOUT].freeze
+
+        attr_reader :host, :port
+
+        # @param tls [Hash] :verify (Boolean, must be true unless :fingerprint),
+        #   :ca_file (String), :fingerprint (one or more SHA-256 pins, see
+        #   normalize_fingerprints)
+        def initialize(host:, port: 443, tls: {}, timeout: 60)
+          @host = host
+          @port = port
+          @tls = tls || {}
+          @timeout = timeout
+          @fingerprints = self.class.normalize_fingerprints(@tls[:fingerprint])
+          @pool = []
+          @mutex = Mutex.new
+        end
+
+        def self.normalize_fingerprint(value)
+          return nil if value.nil? || value.to_s.strip.empty?
+
+          value.to_s.delete(":").strip.downcase
+        end
+
+        # Pins as an Array of lowercase hex strings. Takes one fingerprint,
+        # several separated by commas or whitespace, or an Array of them (e.g.
+        # the certificates of all hosts of a pool).
+        def self.normalize_fingerprints(value)
+          Array(value).flat_map { |v| v.to_s.split(/[\s,]+/) }.filter_map { |v| normalize_fingerprint(v) }.uniq
+        end
+
+        # Yields a started Net::HTTP. Connections are reused between calls.
+        def with_connection(read_timeout: nil)
+          # Only a handshake of this call may name a certificate in an error.
+          Thread.current[:vagrant_xapi_peer_cert] = nil
+          http = checkout
+          http.read_timeout = read_timeout || @timeout
+          ok = false
+          begin
+            result = yield http
+            ok = true
+            result
+          ensure
+            ok ? checkin(http) : discard(http)
+          end
+        rescue OpenSSL::SSL::SSLError => e
+          raise TlsError.new(@host, tls_hint(e))
+        rescue *TIMEOUT_ERRORS => e
+          raise TimeoutError.new("#{@host}:#{@port}", e.message)
+        rescue *NETWORK_ERRORS => e
+          raise ConnectionError.new("#{@host}:#{@port}", e.message)
+        end
+
+        # A fresh, started connection for long transfers (not pooled).
+        def new_connection(read_timeout:)
+          http = build
+          http.read_timeout = read_timeout
+          http.write_timeout = read_timeout if http.respond_to?(:write_timeout=)
+          start(http)
+        rescue OpenSSL::SSL::SSLError => e
+          raise TlsError.new(@host, tls_hint(e))
+        rescue *TIMEOUT_ERRORS => e
+          raise TimeoutError.new("#{@host}:#{@port}", e.message)
+        rescue *NETWORK_ERRORS => e
+          raise ConnectionError.new("#{@host}:#{@port}", e.message)
+        end
+
+        # Opens a raw TLS socket (used for the VNC console tunnel).
+        def open_tls_socket
+          Thread.current[:vagrant_xapi_peer_cert] = nil
+          tcp = Socket.tcp(@host, @port, connect_timeout: @timeout)
+          ctx = OpenSSL::SSL::SSLContext.new
+          configure_context(ctx)
+          ssl = OpenSSL::SSL::SSLSocket.new(tcp, ctx)
+          ssl.hostname = @host if ssl.respond_to?(:hostname=)
+          ssl.sync_close = true
+          ssl.connect
+          ssl.post_connection_check(@host) unless pinned?
+          check_pin!(ssl.peer_cert) if pinned?
+          ssl
+        rescue OpenSSL::SSL::SSLError => e
+          raise TlsError.new(@host, tls_hint(e))
+        rescue *TIMEOUT_ERRORS => e
+          raise TimeoutError.new("#{@host}:#{@port}", e.message)
+        rescue *NETWORK_ERRORS => e
+          raise ConnectionError.new("#{@host}:#{@port}", e.message)
+        end
+
+        def shutdown
+          conns = @mutex.synchronize { @pool.dup.tap { @pool.clear } }
+          conns.each { |c| discard(c) }
+        end
+
+        private
+
+        def pinned?
+          !@fingerprints.empty?
+        end
+
+        def checkout
+          http = @mutex.synchronize { @pool.pop }
+          return http if http&.started?
+
+          start(build)
+        end
+
+        def checkin(http)
+          @mutex.synchronize do
+            if @pool.size < 8
+              @pool << http
+            else
+              discard(http)
+            end
+          end
+        end
+
+        def discard(http)
+          http.finish if http&.started?
+        rescue StandardError
+          nil
+        end
+
+        def build
+          http = Net::HTTP.new(@host, @port)
+          http.use_ssl = true
+          http.open_timeout = @timeout
+          http.read_timeout = @timeout
+          http.keep_alive_timeout = 30
+          http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+          http.verify_callback = verify_callback
+          if pinned?
+            # The pin replaces CA and hostname checks; only the leaf counts.
+            http.verify_hostname = false if http.respond_to?(:verify_hostname=)
+          elsif @tls[:ca_file]
+            http.ca_file = @tls[:ca_file]
+          else
+            store = OpenSSL::X509::Store.new
+            store.set_default_paths
+            http.cert_store = store
+          end
+          http
+        end
+
+        def configure_context(ctx)
+          ctx.verify_mode = OpenSSL::SSL::VERIFY_PEER
+          ctx.verify_callback = verify_callback
+          if pinned?
+            nil # the callback checks the pins
+          elsif @tls[:ca_file]
+            ctx.ca_file = @tls[:ca_file]
+          else
+            store = OpenSSL::X509::Store.new
+            store.set_default_paths
+            ctx.cert_store = store
+          end
+        end
+
+        # Remembers the certificate the server presents (per thread, so a
+        # failed check can show its fingerprint). With pins it also decides:
+        # only the leaf counts, and it must match one of them; otherwise
+        # OpenSSL's own verdict (CA and hostname) stands.
+        def verify_callback
+          pins = pinned? ? @fingerprints : nil
+          lambda do |ok, store_ctx|
+            leaf = store_ctx.chain&.first || (store_ctx.error_depth.zero? ? store_ctx.current_cert : nil)
+            Thread.current[:vagrant_xapi_peer_cert] = leaf if leaf
+            next ok unless pins
+            next true if store_ctx.error_depth.positive?
+
+            pins.include?(OpenSSL::Digest::SHA256.hexdigest(store_ctx.current_cert.to_der))
+          end
+        end
+
+        def start(http)
+          Thread.current[:vagrant_xapi_peer_cert] = nil
+          http.start
+          check_pin!(http.peer_cert) if pinned?
+          http
+        end
+
+        # The verify_callback already enforces the pin during the handshake;
+        # this is a second check once the peer certificate is known.
+        def check_pin!(cert)
+          return if cert.nil?
+
+          actual = OpenSSL::Digest::SHA256.hexdigest(cert.to_der)
+          return if @fingerprints.include?(actual)
+
+          configured = @fingerprints.map { |fp| format_fp(fp) }.join(", ")
+          raise TlsError.new(@host, "certificate fingerprint #{format_fp(actual)} does not match " \
+                                    "the configured tls_fingerprint #{configured}")
+        end
+
+        def format_fp(hex)
+          return "(none)" if hex.nil?
+
+          hex.scan(/../).join(":").upcase
+        end
+
+        # The error with what to do about it, and the SHA-256 fingerprint of
+        # the certificate the server presented: like SSH's first connection,
+        # to check against the host and pin it.
+        def tls_hint(error)
+          msg = error.message
+          # Other TLS errors (e.g. "unexpected eof" on a reused connection)
+          # are no certificate problem: no advice to pin anything.
+          return msg unless msg.include?("certificate verify failed")
+
+          seen = Thread.current[:vagrant_xapi_peer_cert]
+          fp = seen && format_fp(OpenSSL::Digest::SHA256.hexdigest(seen.to_der))
+          if pinned?
+            "#{msg} (the certificate#{" #{fp}" if fp} does not match tls_fingerprint)"
+          elsif fp
+            "#{msg}. The certificate's SHA-256 fingerprint is #{fp}. If that is the host's certificate " \
+              "(check it on the host), pin it with tls_fingerprint or VAGRANT_XAPI_TLS_FINGERPRINT, " \
+              "or use your own CA with tls_ca_file or VAGRANT_XAPI_TLS_CA_FILE"
+          else
+            "#{msg} (for a self-signed certificate set tls_fingerprint or VAGRANT_XAPI_TLS_FINGERPRINT, " \
+              "or tls_ca_file or VAGRANT_XAPI_TLS_CA_FILE)"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/vagrant-xapi/cap.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+require "json"
+
+require_relative "errors"
+require_relative "glue"
+require_relative "services/disks"
+require_relative "services/box_source"
+require_relative "services/snapshots"
+require_relative "services/tunnels"
+
+module VagrantPlugins
+  module Xapi
+    # Provider capabilities Vagrant core asks for.
+    module Cap
+      DISK_EXTS = %w[vhd qcow2 raw img].freeze
+      DEFAULT_DISK_EXT = "vhd"
+
+      module_function
+
+      def snapshot_list(machine)
+        return [] if machine.id.nil?
+
+        with_vm(machine) { |ctx, vm| Services::Snapshots.new(ctx).list(vm) } || []
+      end
+
+      # host port => guest port, for `vagrant port` and auto_correct
+      def forwarded_ports(machine)
+        return {} if machine.state.id != :running
+
+        Services::Tunnels.new(machine.data_dir).forwarded_ports
+      end
+
+      def public_address(machine)
+        return nil if machine.state.id != :running
+
+        info = machine.ssh_info
+        info && info[:host]
+      end
+
+      # Adapter number (1-based, like VirtualBox) => MAC without separators.
+      def nic_mac_addresses(machine)
+        with_vm(machine) do |ctx, vm|
+          ctx.client.call("VM.get_VIFs", vm).to_h do |vif|
+            rec = ctx.client.call("VIF.get_record", vif)
+            [rec["device"].to_i + 1, rec["MAC"].to_s.delete(":").upcase]
+          end
+        end || {}
+      end
+
+      def configure_disks(machine, defined_disks)
+        return {} if defined_disks.empty?
+
+        with_vm(machine) do |ctx, vm|
+          Services::Disks.new(ctx, default_sr: machine.provider_config.sr, converter: Glue.method(:convert_qcow2),
+                                   digest_cache: Services::DigestCache.new(Glue.data_home(machine.env).join("digests.json")))
+                         .configure(vm, defined_disks)
+        end || {}
+      end
+
+      def cleanup_disks(machine, defined_disks, disk_meta_file)
+        return if disk_meta_file.values.flatten.empty?
+
+        with_vm(machine) do |ctx, vm|
+          Services::Disks.new(ctx, default_sr: machine.provider_config.sr).cleanup(vm, defined_disks, disk_meta_file)
+        end
+      end
+
+      def validate_disk_ext(_machine, disk_ext)
+        DISK_EXTS.include?(disk_ext.to_s.downcase)
+      end
+
+      def default_disk_exts(_machine)
+        DISK_EXTS
+      end
+
+      def set_default_disk_ext(_machine)
+        DEFAULT_DISK_EXT
+      end
+
+      def with_vm(machine)
+        ctx = Glue.context(machine)
+        Errors.wrap do
+          vm = Glue.vm_ref(machine, ctx)
+          vm ? yield(ctx, vm) : nil
+        end
+      end
+    end
+  end
+end

data/lib/vagrant-xapi/command/adopt.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+require_relative "base"
+require_relative "../services/adoption"
+require_relative "../services/lookup"
+
+module VagrantPlugins
+  module Xapi
+    module Command
+      # vagrant xapi adopt [vm] UUID: attach an existing VM to this machine.
+      # A VM without our marking needs --force.
+      class Adopt < Base
+        def execute
+          options = { force: false }
+          opts = OptionParser.new do |o|
+            o.banner = "Usage: vagrant xapi adopt [vm-name] UUID [--force]"
+            o.on("-f", "--force", "Also adopt a VM without vagrant-xapi marking") { options[:force] = true }
+          end
+          argv = parse_options(opts)
+          return 0 if argv.nil?
+          raise Vagrant::Errors::CLIInvalidUsage, help: opts.help.chomp if argv.empty? || argv.size > 2
+
+          uuid = argv.pop
+          each_xapi_machine(argv, single: true) do |machine|
+            # Adopting the machine's own VM again updates its marking (e.g.
+            # after the project directory moved). An id that is no VM UUID
+            # (vagrant-xenserver's OpaqueRef) is replaced.
+            if machine.id && machine.id != uuid && Services::Lookup.uuid?(machine.id)
+              raise Errors::ServiceFailed.new(:adopt_machine_exists, machine: machine.name.to_s, uuid: machine.id.to_s)
+            end
+
+            adopt(machine, uuid, options[:force])
+          end
+          0
+        end
+
+        private
+
+        # Without --force only VMs of this Vagrant installation may be
+        # (re-)adopted: one that already belongs to this machine and project,
+        # or this machine's own VM after the project moved. The same machine
+        # name and project path alone are not enough: CI runners and
+        # colleagues often have the same checkout layout.
+        def own_vm?(machine, uuid, oc)
+          marking = Services::Marking
+          same_install = if oc.key?(marking::CLIENT_ID)
+                           oc[marking::CLIENT_ID] == Glue.client_id(@env)
+                         else
+                           oc[marking::USER] == marking.user && oc[marking::CLIENT] == marking.client_host
+                         end
+          return false unless same_install
+
+          same_place = oc[marking::MACHINE] == machine.name.to_s &&
+                       oc[marking::PROJECT] == Glue.project_path(machine)
+          same_place || machine.id == uuid
+        end
+
+        def adopt(machine, uuid, force)
+          ctx = Glue.context(machine)
+          client = ctx.client
+          vm = Services::Lookup.new(ctx).vm_by_uuid(uuid)
+          raise Errors::ServiceFailed.new(:vm_uuid_not_found, uuid: uuid) unless vm
+
+          rec = client.call("VM.get_record", vm)
+          if rec["is_a_template"] || rec["is_a_snapshot"] || rec["is_control_domain"]
+            raise Errors::ServiceFailed.new(:adopt_not_a_vm, uuid: uuid)
+          end
+          oc = rec["other_config"] || {}
+          if !Services::Marking.marked?(oc) && !force
+            raise Errors::ServiceFailed.new(:adopt_needs_force, uuid: uuid)
+          end
+          if Services::Marking.marked?(oc) && !force && !own_vm?(machine, uuid, oc)
+            raise Errors::ServiceFailed.new(:adopt_other_owner, uuid: uuid, machine: oc[Services::Marking::MACHINE].to_s,
+                                                                project: oc[Services::Marking::PROJECT].to_s,
+                                                                user: oc[Services::Marking::USER].to_s)
+          end
+
+          marking = Services::Marking.vm_marking(machine_name: machine.name, project: Glue.project_path(machine),
+                                                 client_id: Glue.client_id(@env))
+          adoption = Services::Adoption.new(ctx)
+          adoption.mark_vm(vm, marking)
+          # The user explicitly hands this VM to Vagrant: its own disks become
+          # ours. A disk that is sharable or also attached to another VM is
+          # not, so `vagrant destroy` never deletes it.
+          adoption.mark_disks(vm)
+          machine.id = rec["uuid"]
+          machine.ui.success(t("adopted", name: rec["name_label"], uuid: rec["uuid"]))
+        end
+      end
+    end
+  end
+end

data/lib/vagrant-xapi/command/base.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require "optparse"
+require "vagrant/util/busy"
+
+require_relative "../errors"
+require_relative "../extensions"
+require_relative "../glue"
+
+module VagrantPlugins
+  module Xapi
+    module Command
+      # Shared plumbing for the subcommands.
+      class Base < Vagrant.plugin("2", :command)
+        protected
+
+        # Runs the block for each xapi machine, translating errors.
+        def each_xapi_machine(names, single: false)
+          with_target_vms(names, provider: target_provider, single_target: single) do |machine|
+            unless Extensions.provider?(machine.provider_name)
+              machine.ui.warn(I18n.t("vagrant_xapi.commands.not_xapi"))
+              next
+            end
+            Errors.wrap { yield machine }
+          end
+        end
+
+        # A machine only used for its connection settings (templates, orphans).
+        def connection_machine
+          machine = nil
+          with_target_vms(nil, provider: target_provider) do |m|
+            machine ||= m if Extensions.provider?(m.provider_name)
+          end
+          raise Errors::ServiceFailed.new(:no_xapi_machine, {}) unless machine
+
+          machine
+        end
+
+        # Which of Extensions.provider_names to use: the one a machine of
+        # this project already runs with (Vagrant refuses another), else the
+        # first one the Vagrantfile configures, else :xapi.
+        def target_provider
+          active = @env.active_machines.map { |_name, provider| provider.to_sym }
+          names = Extensions.provider_names
+          configured = @env.vagrantfile.config.vm.__providers
+          (active & names).first || (configured & names).first || :xapi
+        rescue StandardError
+          :xapi
+        end
+
+        # Sets a flag on Ctrl-C instead of killing the process.
+        def interruptible
+          interrupted = false
+          callback = -> { interrupted = true }
+          Vagrant::Util::Busy.busy(callback) { yield -> { interrupted } }
+        end
+
+        def confirm(question, force)
+          return true if force
+
+          answer = @env.ui.ask("#{question} [y/N] ")
+          answer.to_s.strip.downcase.start_with?("y")
+        end
+
+        def t(key, **opts)
+          I18n.t("vagrant_xapi.commands.#{key}", **opts)
+        end
+
+        def human_size(bytes)
+          bytes = bytes.to_i
+          return "#{bytes} B" if bytes < 1024**2
+          return format("%.1f MiB", bytes / 1024.0**2) if bytes < 1024**3
+
+          format("%.1f GiB", bytes / 1024.0**3)
+        end
+      end
+    end
+  end
+end

data/lib/vagrant-xapi/command/console.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require "vagrant/util/platform"
+require "vagrant/util/subprocess"
+require "vagrant/util/which"
+
+require_relative "base"
+require_relative "../services/console"
+
+module VagrantPlugins
+  module Xapi
+    module Command
+      # vagrant xapi console [vm]: VNC console through the XAPI console
+      # tunnel on a local port. For when the VM boots but SSH does not work.
+      class Console < Base
+        def execute
+          options = { port: 0, open: true }
+          opts = OptionParser.new do |o|
+            o.banner = "Usage: vagrant xapi console [vm-name] [--port PORT] [--no-open]"
+            o.on("--port PORT", Integer, "Local port (default: a free one)") { |p| options[:port] = p }
+            o.on("--[no-]open", "Open the VNC viewer (default: yes)") { |v| options[:open] = v }
+          end
+          argv = parse_options(opts)
+          return 0 if argv.nil?
+
+          each_xapi_machine(argv, single: true) do |machine|
+            ctx = Glue.context(machine)
+            vm = Glue.vm_ref(machine, ctx)
+            raise Vagrant::Errors::VMNotCreatedError unless vm
+
+            password = console_password(machine)
+            console = Services::Console.new(ctx, password: password)
+            uri = console.location(vm)
+            server = console.listen(options[:port])
+            port = server.addr[1]
+            url = "vnc://127.0.0.1:#{port}"
+            if password
+              machine.ui.info(t("console_ready_password", url: url, password: password))
+            else
+              machine.ui.info(t("console_ready", url: url))
+            end
+            open_viewer(machine, viewer_url(url, password, port)) if options[:open]
+            interruptible do |stopped|
+              console.serve(server, uri, stop: stopped)
+            end
+            machine.ui.info(t("console_closed"))
+          end
+          0
+        end
+
+        private
+
+        # A one-time VNC password, unless this Ruby/OpenSSL cannot do VNC
+        # authentication (no 3DES); then the console runs without one.
+        def console_password(machine)
+          return Services::Rfb.password if Services::Rfb.available?
+
+          machine.ui.warn(t("console_no_password"))
+          nil
+        end
+
+        # macOS Screen Sharing takes the password from the URL, and `open`
+        # exits at once. On Linux, xdg-open starts the viewer with the URL in
+        # its command line for the whole session, readable by every local
+        # user; there the viewer asks for the password the terminal shows.
+        def viewer_url(url, password, port)
+          return url unless password && Vagrant::Util::Platform.darwin?
+
+          "vnc://:#{password}@127.0.0.1:#{port}"
+        end
+
+        def open_viewer(machine, url)
+          cmd = if Vagrant::Util::Platform.darwin?
+                  "open"
+                elsif Vagrant::Util::Which.which("xdg-open")
+                  "xdg-open"
+                end
+          if cmd
+            Vagrant::Util::Subprocess.execute(cmd, url)
+          else
+            machine.ui.detail(t("console_open_manually", url: url))
+          end
+        end
+      end
+    end
+  end
+end