Merge "Merge branch 'master' into services-r7" into services-r7

cloud_controller/Gemfile

@@ -10,7 +10,7 @@ gem 'logging', '>= 1.5.0'
 # VCAP common components
 gem 'vcap_common', '~> 1.0.2', :require => ['vcap/common', 'vcap/component']
 gem 'vcap_logging', :require => ['vcap/logging']
-gem 'vcap_staging', '~> 0.1.27'
+gem 'vcap_staging', '~> 0.1.30'
 
 # For queuing staging tasks
 gem 'em-hiredis'

cloud_controller/Gemfile.lock

@@ -137,7 +137,7 @@ GEM
       yajl-ruby (~> 0.8.3)
     vcap_logging (0.1.3)
     vcap_stager (0.1.6)
-    vcap_staging (0.1.28)
+    vcap_staging (0.1.30)
       nokogiri (>= 1.4.4)
       rake
       rspec
@@ -177,5 +177,5 @@ DEPENDENCIES
   vcap_common (~> 1.0.2)
   vcap_logging
   vcap_stager (~> 0.1.6)
-  vcap_staging (~> 0.1.27)
+  vcap_staging (~> 0.1.30)
   yajl-ruby (~> 0.8.3)

cloud_controller/Rakefile

@@ -1,5 +1,5 @@
 require File.expand_path('../config/application', __FILE__)
-require 'ci/reporter/rake/rspec'
+require 'ci/reporter/rake/rspec' if Rails.env != 'production'
 
 CloudController::Application.load_tasks
 

cloud_controller/app/controllers/users_controller.rb

@@ -47,7 +47,7 @@ def info
     target_user = ::User.find_by_email(params['email'])
     if target_user
       if target_user.email == user.email || @current_user.admin?
-        render :json => { :email => target_user.email }
+        render :json => { :email => target_user.email, :admin => target_user.admin? }
       else
         raise CloudError.new(CloudError::FORBIDDEN)
       end

cloud_controller/app/models/app_package.rb

@@ -97,8 +97,6 @@ def self.blocking_defer(&blk)
     end
   end
 
-private
-
   def package_dir
     self.class.package_dir
   end
@@ -114,7 +112,11 @@ def save_package(path)
   # maximum allowed by the AppConfig.
   def check_package_size
     unless @uploaded_file
-      raise AppPackageError, "Invalid uploaded file"
+      # When the entire set of files that make up the application is already
+      # in the resource pool, the client may not send us any additional contents
+      # i.e. the payload is empty.
+      CloudController.logger.debug "No uploaded file for application, contents assumed to be present in resource pool"
+      return
     end
 
     # Avoid stat'ing files in the resource pool if possible
@@ -175,15 +177,28 @@ def unpack_upload
     working_dir
   end
 
+  # enforce property that any file in resource list must be located in the
+  # apps directory e.g. '../../foo' or a symlink pointing outside working_dir
+  # should raise an exception.
+  def resolve_path(working_dir, tainted_path)
+    expanded_dir  = File.realdirpath(working_dir)
+    expanded_path = File.realdirpath(tainted_path, expanded_dir)
+    pattern = "#{expanded_dir}/*"
+    unless File.fnmatch?(pattern, expanded_path)
+      raise ArgumentError, "Resource path sanity check failed #{pattern}:#{expanded_path}!!!!"
+    end
+    expanded_path
+  end
+
   # Do resource pool synch, needs to be called with a Fiber context
   def synchronize_pool_with(working_dir)
     timed_section(CloudController.logger, 'process_app_resources') do
       AppPackage.blocking_defer do
         pool = CloudController.resource_pool
         pool.add_directory(working_dir)
         @resource_descriptors.each do |descriptor|
-          target = File.join(working_dir, descriptor[:fn])
-          pool.copy(descriptor, target)
+          path = resolve_path(working_dir, descriptor[:fn])
+          pool.copy(descriptor, path)
         end
       end
     end

cloud_controller/config/cloud_controller.yml

@@ -155,7 +155,7 @@ runtimes:
   ruby19:
     version: 1.9.2
   node:
-    version: 0.4.[2-9]
+    version: 0.4.12
   java:
     version: 1.6.0
     debug_modes:

cloud_controller/spec/controllers/users_controller_spec.rb

@@ -18,6 +18,7 @@
       json = Yajl::Parser.parse(response.body)
       json.should be_kind_of(Hash)
       json['email'].should == @user.email
+      json['admin'].should == @user.admin?
     end
 
     it 'should return an user info as an admin requesting for an existent user' do
@@ -29,6 +30,7 @@
       json = Yajl::Parser.parse(response.body)
       json.should be_kind_of(Hash)
       json['email'].should == @user.email
+      json['admin'].should == @user.admin?
     end
 
     it 'should return an error as an admin requesting for a non-existent user' do

cloud_controller/spec/models/app_package_spec.rb

@@ -1,10 +1,45 @@
 require 'spec_helper'
+require 'tmpdir'
 
 describe AppPackage do
   before :all do
     EM.instance_variable_set(:@next_tick_queue, [])
   end
 
+  describe '#resolve_path' do
+    before(:all) do
+      @tmpdir = Dir.mktmpdir
+      @dummy_zip = Tempfile.new('app_package_test')
+      @app_package = AppPackage.new(nil, @dummy_zip)
+    end
+
+    after(:all) do
+      FileUtils.rm_rf @tmpdir
+    end
+
+    it 'should succeed if the given path points to a file in the apps directory' do
+      testpath = File.join(@tmpdir,'testfile')
+      File.new(testpath, 'w+')
+      @app_package.resolve_path(@tmpdir, 'testfile').should == File.realdirpath(testpath)
+    end
+
+    it 'should fail if the given path does not resolve to a file in the applications directory' do
+      expect do
+       @app_package.resolve_path(@tmpdir, '../foo')
+      end.to raise_error(ArgumentError)
+    end
+
+    it 'should fail if the given path contains a symlink that points outside of the applications directory' do
+      Dir.chdir(@tmpdir) {
+        File.symlink('/etc', 'foo')
+      }
+      expect do
+       @app_package.resolve_path(@tmpdir, 'foo/bar')
+      end.to raise_error(ArgumentError)
+    end
+  end
+
+
   describe '#unpack_upload' do
     it 'should raise an instance of AppPackageError if unzip exits with a nonzero status code' do
       invalid_zip = Tempfile.new('app_package_test')

common/Gemfile.lock

@@ -1,8 +1,8 @@
 PATH
   remote: .
   specs:
-    vcap_common (1.0.0)
-      eventmachine (~> 0.12.11.cloudfoundry.3)
+    vcap_common (1.0.2)
+      eventmachine
       logging (>= 1.5.0)
       nats (~> 0.4.10)
       posix-spawn (~> 0.3.6)

common/vcap_common.gemspec

@@ -9,7 +9,7 @@ spec = Gem::Specification.new do |s|
   s.authors = ["Derek Collison"]
   s.email = ["derek.collison@gmail.com"]
 
-  s.add_dependency('eventmachine', '~> 0.12.11.cloudfoundry.3')
+  s.add_dependency('eventmachine')
   s.add_dependency('thin', '~> 1.2.11')
   s.add_dependency('yajl-ruby', '~> 0.8.3')
   s.add_dependency('nats', '~> 0.4.10')

dea/config/dea.yml

@@ -55,7 +55,7 @@ runtimes:
     environment:
   node:
     executable: node
-    version: 0.4.[2-9]
+    version: 0.4.12
     version_flag: '-v'
     environment:
   java:

dea/config/dea2.yml

@@ -31,7 +31,7 @@ runtimes:
     environment:
   node:
     executable: node
-    version: 0.4.[2-9]
+    version: 0.4.12
     version_flag: '-v'
     environment:
   java:

dea/lib/dea/agent.rb

@@ -569,25 +569,33 @@ def process_dea_start(message)
         instance[:secure_user] = user[:user]
       end
 
-      start_operation = proc do
+      start_operation = lambda do
         @logger.debug('Completed download')
 
-        port = VCAP.grab_ephemeral_port
-        instance[:port] = port
-
-        starting = "Starting up instance #{instance[:log_id]} on port:#{port}"
+        port = grab_port
+        if port
+          instance[:port] = port
+        else
+          @logger.warn("Unable to allocate port for instance#{instance[:log_id]}")
+          stop_droplet(instance)
+          return
+        end
 
         if debug
-          debug_port = VCAP.grab_ephemeral_port
-          instance[:debug_ip] = VCAP.local_ip
-          instance[:debug_port] = debug_port
-          instance[:debug_mode] = debug
-
-          @logger.info("#{starting} with debugger:#{debug_port}")
-        else
-          @logger.info(starting)
+          debug_port = grab_port
+          if debug_port
+            instance[:debug_ip] = VCAP.local_ip
+            instance[:debug_port] = debug_port
+            instance[:debug_mode] = debug
+          else
+            @logger.warn("Unable to allocate debug port for instance#{instance[:log_id]}")
+            stop_droplet(instance)
+            return
+          end
         end
 
+        @logger.info("Starting up instance #{instance[:log_id]} on port:#{instance[:port]} " +
+                     "#{"debuger:" if instance[:debug_port]}#{instance[:debug_port]}")
         @logger.debug("Clients: #{@num_clients}")
         @logger.debug("Reserved Memory Usage: #{@reserved_mem} MB of #{@max_memory} MB TOTAL")
 
@@ -644,7 +652,7 @@ def process_dea_start(message)
             process.send_data("umask 077\n")
           end
           app_env.each { |env| process.send_data("export #{env}\n") }
-          process.send_data("./startup -p #{port}\n")
+          process.send_data("./startup -p #{instance[:port]}\n")
           process.send_data("exit\n")
         end
 
@@ -845,13 +853,8 @@ def instance_mem_usage_in_mb(instance)
       (instance[:mem_quota] / (1024*1024)).to_i
     end
 
-    def grab_ephemeral_port
-      socket = TCPServer.new('0.0.0.0', 0)
-      socket.setsockopt(Socket::SOL_SOCKET, Socket::SO_REUSEADDR, true)
-      Socket.do_not_reverse_lookup = true
-      port = socket.addr[1]
-      socket.close
-      return port
+    def grab_port
+      VCAP.grab_ephemeral_port
     end
 
     def detect_app_ready(instance, manifest, &block)

dev_setup/README

@@ -63,5 +63,12 @@ o To use a custom deployment config
    To Stop:
       $HOME/projects/vcap/dev_setup/bin/vcap_dev -d $HOME/projects -n dea stop
 
+o To use a custom domain
+  e.g. If you do not want your CloudFoundry domain as vcap.me
+  $HOME/projects/vcap/dev_setup/bin/vcap_dev_setup -D myowndomain.com
+
+  Later, you will target your CloudFoundry installation with:
+    vmc target api.myowndomain.com
+
 NOTE: To learn more about custom deployment config files and multi host setups
 see the README file vcap/dev_setup/deployments/README.

dev_setup/bin/vcap

@@ -146,7 +146,7 @@ class Component
         # should help for now.
         if is_cloud_controller?
           cc_dir = File.expand_path(File.join(DIR, '..', 'cloud_controller'))
-          Dir.chdir(cc_dir) { `rake db:migrate` }
+          Dir.chdir(cc_dir) { `bundle exec rake db:migrate` }
         end
         exec("#{component_start_path}")
       end
@@ -299,7 +299,7 @@ module Run
     end
 
     cc_dir = File.expand_path(File.join(DIR, '..', 'cloud_controller'))
-    run_command("Resetting the CloudController database", "cd #{cc_dir} 2>&1 && rake db:drop 2>&1")
+    run_command("Resetting the CloudController database", "cd #{cc_dir} 2>&1 && bundle exec rake db:drop 2>&1")
     puts
 
     cc_log_dir = File.join(cc_dir, 'log')

dev_setup/bin/vcap_dev_setup

@@ -12,6 +12,7 @@ OPTIONS:
   -p           http proxy i.e. -p http://username:password@host:port/
   -c           deployment config
   -d           cloudfoundry home
+  -D           cloudfoundry domain (default: vcap.me)
   -r           cloud foundry repo
   -b           cloud foundry repo branch/tag/SHA
 EOF
@@ -27,7 +28,7 @@ fi
 
 APT_CONFIG="-o Acquire::http::No-Cache=True -o Acquire::BrokenProxy=true -o Acquire::Retries=3"
 
-while getopts "had:p:c:r:b:" OPTION
+while getopts "had:p:c:D:r:b:" OPTION
 do
   case $OPTION in
     h)
@@ -43,6 +44,9 @@ do
     d)
       CLOUDFOUNDRY_HOME=$OPTARG
       ;;
+    D)
+      CLOUDFOUNDRY_DOMAIN=$OPTARG
+      ;;
     r)
       VCAP_REPO=$OPTARG
       ;;
@@ -60,6 +64,10 @@ if [ -z "$CLOUDFOUNDRY_HOME" ]; then
   CLOUDFOUNDRY_HOME=~/cloudfoundry
 fi
 
+if [ -z "$CLOUDFOUNDRY_DOMAIN" ]; then
+  CLOUDFOUNDRY_DOMAIN=vcap.me
+fi
+
 if [ -z "$VCAP_REPO" ]; then
   VCAP_REPO=https://github.com/cloudfoundry/vcap.git
 fi
@@ -130,8 +138,12 @@ if [ -n "$CLOUDFOUNDRY_HOME" ]; then
   ARGS="-d $CLOUDFOUNDRY_HOME"
 fi
 
+if [ -n "$CLOUDFOUNDRY_DOMAIN" ]; then
+  ARGS="$ARGS -D $CLOUDFOUNDRY_DOMAIN"
+fi
+
 if [ -n "$CONFIG_FILE" ]; then
   ARGS="$ARGS -c $CONFIG_FILE"
 fi
 
-$CLOUDFOUNDRY_HOME/vcap/dev_setup/lib/chefsolo_launch.rb $ARGS
+$CLOUDFOUNDRY_HOME/vcap/dev_setup/lib/chefsolo_launch.rb $ARGS

dev_setup/cookbooks/cloud_controller/templates/default/cloud_controller.yml.erb

@@ -112,7 +112,7 @@ runtimes:
   ruby19:
     version: 1.9.2
   node:
-    version: 0.4.[2-9]
+    version: 0.4.12
   java:
     version: 1.6.0
     debug_modes:

dev_setup/cookbooks/cloud_controller/templates/default/node.yml.erb

@@ -2,7 +2,7 @@
 name: "node"
 runtimes:
   - node:
-      version: '0.4.5'
+      version: '0.4.12'
       description: 'Node.js'
       executable: <%= File.join(node[:nodejs][:path], "bin", "node") %>
       default: true

dev_setup/cookbooks/dea/templates/default/dea.yml.erb

@@ -62,7 +62,7 @@ runtimes:
 <% if node[:dea][:runtimes].include?("nodejs") %>
   node:
     executable: <%= File.join(node[:nodejs][:path], "bin", "node") %>
-    version: 0.4.[2-9]
+    version: 0.4.12
     version_flag: '-v'
     environment:
 <% end %>

dev_setup/cookbooks/nginx/templates/default/ubuntu-nginx.conf.erb

@@ -44,7 +44,7 @@ http {
 
     server {
         listen       *:80;
-        server_name  "<%= node[:deployment][:domain] %>";
+        server_name  _;
 
         access_log   <%= node[:nginx][:vcap_log] %> main;
         server_name_in_redirect off;