scripts/util/migrate-dynamicroles.py

#!/usr/bin/python3
# -*- coding: utf-8 -*-
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

import os
import sys
import uuid

from contextlib import closing
from optparse import OptionParser

try:
    import mysql.connector
except ImportError:
    print("mysql.connector cannot be imported, please install mysql-connector-python")
    sys.exit(1)

dryrun = False


def runSql(conn, query):
    if dryrun:
        print("Running SQL query: " + query)
        return
    with closing(conn.cursor()) as cursor:
        cursor.execute(query)


def migrateApiRolePermissions(apis, conn):
    # All allow for root admin role Admin(id:1)
    runSql(conn, "INSERT INTO `cloud`.`role_permissions` (`uuid`, `role_id`, `rule`, `permission`, `sort_order`) values (UUID(), 1, '*', 'ALLOW', 0);")
    # Migrate rules based on commands.properties rule for ResourceAdmin(id:2), DomainAdmin(id:3), User(id:4)
    octetKey = {2:2, 3:4, 4:8}
    for role in [2, 3, 4]:
        sortOrder = 0
        for api in sorted(apis.keys()):
            # Ignore auth commands
            if api in ['login', 'logout', 'samlSso', 'samlSlo', 'listIdps', 'listAndSwitchSamlAccount', 'getSPMetadata']:
                continue
            if (octetKey[role] & int(apis[api])) > 0:
                runSql(conn, "INSERT INTO `cloud`.`role_permissions` (`uuid`, `role_id`, `rule`, `permission`, `sort_order`) values (UUID(), %d, '%s', 'ALLOW', %d);" % (role, api, sortOrder))
                sortOrder += 1
    print("Static role permissions from commands.properties have been migrated into the db")


def enableDynamicApiChecker(conn):
    runSql(conn, "UPDATE `cloud`.`configuration` SET value='true' where name='dynamic.apichecker.enabled'")
    conn.commit()
    conn.close()
    print("Dynamic role based API checker has been enabled!")


def main():
    parser = OptionParser()
    parser.add_option("-b", "--db", action="store", type="string", dest="db", default="cloud",
                        help="The name of the database, default: cloud")
    parser.add_option("-u", "--user", action="store", type="string", dest="user", default="cloud",
                        help="User name a MySQL user with privileges on cloud database")
    parser.add_option("-p", "--password", action="store", type="string", dest="password", default="cloud",
                        help="Password of a MySQL user with privileges on cloud database")
    parser.add_option("-H", "--host", action="store", type="string", dest="host", default="127.0.0.1",
                        help="Host or IP of the MySQL server")
    parser.add_option("-P", "--port", action="store", type="int", dest="port", default=3306,
                        help="Host or IP of the MySQL server")
    parser.add_option("-f", "--properties-file", action="store", type="string", dest="commandsfile", default="/etc/cloudstack/management/commands.properties",
                        help="The commands.properties file")
    parser.add_option("-D", "--default", action="store_true", dest="defaultRules", default=False,
                        help="")
    parser.add_option("-d", "--dryrun", action="store_true", dest="dryrun", default=False,
                        help="Dry run and debug operations this tool will perform")
    (options, args) = parser.parse_args()

    print("Apache CloudStack Role Permission Migration Tool")
    print("(c) Apache CloudStack Authors and the ASF, under the Apache License, Version 2.0\n")

    global dryrun
    if options.dryrun:
        dryrun = True

    conn = mysql.connector.connect(
            host=options.host,
            user=options.user,
            passwd=options.password,
            port=int(options.port),
            db=options.db)

    if options.defaultRules:
        print("Applying the default role permissions, ignoring any provided properties files(s).")
        enableDynamicApiChecker(conn)
        sys.exit(0)

    if not os.path.isfile(options.commandsfile):
        print("Provided commands.properties cannot be accessed or does not exist.")
        print("Please check passed options, or run only with --default option to use the default role permissions.")
        sys.exit(1)

    while True:
        choice = input("Running this migration tool will remove any " +
                           "default-role permissions from cloud.role_permissions. " +
                           "Do you want to continue? [y/N]").lower()
        if choice == 'y':
            break
        else:
            print("Aborting!")
            sys.exit(1)

    # Generate API to permission octet map
    apiMap = {}
    with open(options.commandsfile) as f:
        for line in f.readlines():
            if not line or line == '' or line == '\n' or line == '\r\n' or line.startswith('#'):
                continue
            name, value = line.split('=')
            apiMap[name.strip()] = value.strip().split(';')[-1]

    # Rename and deprecate old commands.properties file
    if not dryrun:
        os.rename(options.commandsfile, options.commandsfile + '.deprecated')
    print("The commands.properties file has been deprecated and moved at: " + options.commandsfile + '.deprecated')

    # Truncate any rules in cloud.role_permissions table
    runSql(conn, "DELETE FROM `cloud`.`role_permissions` WHERE `role_id` in (1,2,3,4);")

    # Migrate rules from commands.properties to cloud.role_permissions
    migrateApiRolePermissions(apiMap, conn)

    enableDynamicApiChecker(conn)

if __name__ == '__main__':
    main()