environs: turn environment configuration into a concrete type

environs/ec2/ec2.go

 package ec2
 
 import (
         "fmt"
         "launchpad.net/goamz/aws"
         "launchpad.net/goamz/ec2"
         "launchpad.net/goamz/s3"
         "launchpad.net/juju-core/environs"
         "launchpad.net/juju-core/environs/config"
         "launchpad.net/juju-core/log"
@@ skipping 80 matching lines @@
 func (inst *instance) WaitDNSName() (string, error) {
         for a := longAttempt.Start(); a.Next(); {
                 name, err := inst.DNSName()
                 if err == nil || err != environs.ErrNoDNSName {
                         return name, err
                 }
         }
         return "", fmt.Errorf("timed out trying to get DNS address for %v", inst.Id())
 }
 
-func (inst *instance) OpenPorts(machineId int, ports []state.Port) error {
-        return fmt.Errorf("ec2 OpenPorts not implemented")
-}
-
-func (inst *instance) ClosePorts(machineId int, ports []state.Port) error {
-        return fmt.Errorf("ec2 ClosePorts not implemented")
-}
-
-func (inst *instance) Ports(machineId int) (ports []state.Port, err error) {
-        return nil, fmt.Errorf("ec2 Ports not implemented")
-}
-
 func (p environProvider) Open(cfg *config.Config) (environs.Environ, error) {
         log.Printf("environs/ec2: opening environment %q", cfg.Name())
         e := new(environ)
-        e.SetConfig(cfg)
+        err := e.SetConfig(cfg)
+        if err != nil {
+                return nil, err
+        }
         return e, nil
 }
 
 func (e *environ) SetConfig(cfg *config.Config) error {
         config, err := newConfig(cfg)
         if err != nil {
                 return err
         }
         if aws.Regions[config.region].EC2Endpoint == "" {
-                return fmt.Errorf("no ec2 endpoint found for region %q, opening %q", config.region, config.name)
+                return fmt.Errorf("environment %q references unknown EC2 region %q", config.name, config.region)
         }
         e.configMutex.Lock()
         defer e.configMutex.Unlock()
         // TODO(dfc) bug #1018207, renaming an environment once it is in use should be forbidden
         e.name = config.name
         e.configUnlocked = config
         e.ec2Unlocked = ec2.New(config.auth, aws.Regions[config.region])
         e.s3Unlocked = s3.New(config.auth, aws.Regions[config.region])
 
         // create new storage instances, existing instances continue
@@ skipping 372 matching lines @@
         }
         return firstErr
 }
 
 func (e *environ) machineGroupName(machineId int) string {
         return fmt.Sprintf("%s-%d", e.groupName(), machineId)
 }
 
 func (e *environ) groupName() string {
         return "juju-" + e.name
+}
+
+func (inst *instance) OpenPorts(machineId int, ports []state.Port) error {
+        if len(ports) == 0 {
+                return nil
+        }
+        // Give permissions for anyone to access the given ports.
+        ipPerms := portsToIPPerms(ports)
+        g := ec2.SecurityGroup{Name: inst.e.machineGroupName(machineId)}
+        _, err := inst.e.ec2().AuthorizeSecurityGroup(g, ipPerms)
+        if err != nil && ec2ErrCode(err) == "InvalidPermission.Duplicate" {
+                if len(ports) == 1 {
+                        return nil
+                }
+                // If there's more than one port and we get a duplicate error,
+                // then we go through authorizing each port individually,
+                // otherwise the ports that were *not* duplicates will have
+                // been ignored
+                for i := range ipPerms {
+                        _, err := inst.e.ec2().AuthorizeSecurityGroup(g, ipPerms[i:i+1])
+                        if err != nil && ec2ErrCode(err) != "InvalidPermission.Duplicate" {
+                                return fmt.Errorf("cannot open port %v: %v", ipPerms[i], err)
+                        }
+                }
+                return nil
+        }
+        if err != nil {
+                return fmt.Errorf("cannot open ports: %v", err)
+        }
+        return nil
+}
+
+func (inst *instance) ClosePorts(machineId int, ports []state.Port) error {
+        if len(ports) == 0 {
+                return nil
+        }
+        // Revoke permissions for anyone to access the given ports.
+        // Note that ec2 allows the revocation of permissions that aren't
+        // granted, so this is naturally idempotent.
+        g := ec2.SecurityGroup{Name: inst.e.machineGroupName(machineId)}
+        _, err := inst.e.ec2().RevokeSecurityGroup(g, portsToIPPerms(ports))
+        if err != nil {
+                return fmt.Errorf("cannot close ports: %v", err)
+        }
+        return nil
+}
+
+func portsToIPPerms(ports []state.Port) []ec2.IPPerm {
+        ipPerms := make([]ec2.IPPerm, len(ports))
+        for i, p := range ports {
+                ipPerms[i] = ec2.IPPerm{
+                        Protocol:  p.Protocol,
+                        FromPort:  p.Number,
+                        ToPort:    p.Number,
+                        SourceIPs: []string{"0.0.0.0/0"},
+                }
+        }
+        return ipPerms
+}
+
+func (inst *instance) Ports(machineId int) (ports []state.Port, err error) {
+        g := ec2.SecurityGroup{Name: inst.e.machineGroupName(machineId)}
+        resp, err := inst.e.ec2().SecurityGroups([]ec2.SecurityGroup{g}, nil)
+        if err != nil {
+                return nil, err
+        }
+        if len(resp.Groups) != 1 {
+                return nil, fmt.Errorf("expected one security group, got %d", len(resp.Groups))
+        }
+        for _, p := range resp.Groups[0].IPPerms {
+                if len(p.SourceIPs) != 1 {
+                        log.Printf("environs/ec2: unexpected IP permission found: %v", p)
+                        continue
+                }
+                for i := p.FromPort; i <= p.ToPort; i++ {
+                        ports = append(ports, state.Port{
+                                Protocol: p.Protocol,
+                                Number:   i,
+                        })
+                }
+        }
+        state.SortPorts(ports)
+        return ports, nil
 }
 
 // setUpGroups creates the security groups for the new machine, and
 // returns them.
 //·
 // Instances are tagged with a group so they can be distinguished from
 // other instances that might be running on the same EC2 account.  In
 // addition, a specific machine security group is created for each
 // machine, so that its firewall rules can be configured per machine.
 func (e *environ) setUpGroups(machineId int) ([]ec2.SecurityGroup, error) {
@@ skipping 134 matching lines @@
 
 // If the err is of type *ec2.Error, ec2ErrCode returns
 // its code, otherwise it returns the empty string.
 func ec2ErrCode(err error) string {
         ec2err, _ := err.(*ec2.Error)
         if ec2err == nil {
                 return ""
         }
         return ec2err.Code
 }