X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=sfa%2Fclient%2Fsfaclientlib.py;h=7736e52a45084928a44d2e17baf704086b447692;hb=ecc85e0b923922cf7117d29b380f5284edb88f21;hp=dce22014d1d4bc13970260aa04688ea8fbff0192;hpb=23666284b256845f8c04b287b9560f87f8629bc9;p=sfa.git diff --git a/sfa/client/sfaclientlib.py b/sfa/client/sfaclientlib.py index dce22014..7736e52a 100644 --- a/sfa/client/sfaclientlib.py +++ b/sfa/client/sfaclientlib.py @@ -1,7 +1,9 @@ # Thierry Parmentelat -- INRIA -# -# a minimal library for writing "lightweight" SFA clients -# +""" +a minimal library for writing "lightweight" SFA clients +""" + +from __future__ import print_function # xxx todo # this library should probably check for the expiration date of the various @@ -9,6 +11,7 @@ import sys import os,os.path +import subprocess from datetime import datetime from sfa.util.xrn import Xrn @@ -24,7 +27,7 @@ from sfa.trust.certificate import Keypair, Certificate from sfa.trust.credential import Credential from sfa.trust.gid import GID ########## -# a helper class to implement the bootstrapping of crypto. material +# a helper class to implement the bootstrapping of cryptoa. material # assuming we are starting from scratch on the client side # what's needed to complete a full slice creation cycle # (**) prerequisites: @@ -52,7 +55,11 @@ from sfa.trust.gid import GID # obtained at the registry with Resolve # using the (step2) user-credential as credential # default filename is ..cred - +# +# (**) additionnally, it might make sense to upgrade a GID file +# into a pkcs12 certificate usable in a browser +# this bundled format allows for embedding the private key +# ########## Implementation notes # @@ -88,6 +95,11 @@ from sfa.trust.gid import GID # for Java is documented below # http://nam.ece.upatras.gr/fstoolkit/trac/wiki/JavaSFAClient # +# (*) pkcs12 +# +# the implementation of the pkcs12 wrapping, which is a late addition, +# is done through direct calls to openssl +# #################### class SfaClientException (Exception): pass @@ -111,7 +123,7 @@ class SfaClientBootstrap: ######################################## *_produce methods ### step1 # unconditionnally create a self-signed certificate - def self_signed_cert_produce (self,output): + def self_signed_cert_produce (self, output): self.assert_private_key() private_key_filename = self.private_key_filename() keypair=Keypair(filename=private_key_filename) @@ -121,7 +133,7 @@ class SfaClientBootstrap: self_signed.sign () self_signed.save_to_file (output) self.logger.debug("SfaClientBootstrap: Created self-signed certificate for %s in %s"%\ - (self.hrn,output)) + (self.hrn, output)) return output ### step2 @@ -132,7 +144,8 @@ class SfaClientBootstrap: certificate_filename = self.self_signed_cert_filename() certificate_string = self.plain_read (certificate_filename) self.assert_private_key() - registry_proxy = SfaServerProxy (self.registry_url, self.private_key_filename(), + registry_proxy = SfaServerProxy (self.registry_url, + self.private_key_filename(), certificate_filename) try: credential_string=registry_proxy.GetSelfCredential (certificate_string, self.hrn, "user") @@ -187,19 +200,35 @@ class SfaClientBootstrap: records = registry_proxy.Resolve (hrn, credential_string) records=[record for record in records if record['type']==type] if not records: - raise RecordNotFound, "hrn %s (%s) unknown to registry %s"%(hrn,type,self.registry_url) + raise RecordNotFound("hrn %s (%s) unknown to registry %s"%(hrn,type,self.registry_url)) record=records[0] self.plain_write (output, record['gid']) self.logger.debug("SfaClientBootstrap: Wrote GID for %s (%s) in %s"% (hrn,type,output)) return output +# http://trac.myslice.info/wiki/MySlice/Developer/SFALogin +### produce a pkcs12 bundled certificate from GID and private key +# xxx for now we put a hard-wired password that's just, well, 'password' +# when leaving this empty on the mac, result can't seem to be loaded in keychain.. + def my_pkcs12_produce (self, filename): + password=raw_input("Enter password for p12 certificate: ") + openssl_command=['openssl', 'pkcs12', "-export"] + openssl_command += [ "-password", "pass:%s"%password ] + openssl_command += [ "-inkey", self.private_key_filename()] + openssl_command += [ "-in", self.my_gid_filename()] + openssl_command += [ "-out", filename ] + if subprocess.call(openssl_command) ==0: + print("Successfully created %s"%filename) + else: + print("Failed to create %s"%filename) + # Returns True if credential file is valid. Otherwise return false. def validate_credential(self, filename): valid = True cred = Credential(filename=filename) # check if credential is expires - if cred.get_expiration() < datetime.now(): + if cred.get_expiration() < datetime.utcnow(): valid = False return valid @@ -250,8 +279,14 @@ class SfaClientBootstrap: return self.fullpath ("%s.sscert"%self.hrn) def my_credential_filename (self): return self.credential_filename (self.hrn, "user") + # the tests use sfi -u ; meaning that the slice credential filename + # needs to keep track of the user too def credential_filename (self, hrn, type): - return self.fullpath ("%s.%s.cred"%(hrn,type)) + if type in ['user']: + basename="%s.%s.cred"%(hrn,type) + else: + basename="%s-%s.%s.cred"%(self.hrn,hrn,type) + return self.fullpath (basename) def slice_credential_filename (self, hrn): return self.credential_filename(hrn,'slice') def authority_credential_filename (self, hrn): @@ -260,7 +295,8 @@ class SfaClientBootstrap: return self.gid_filename (self.hrn, "user") def gid_filename (self, hrn, type): return self.fullpath ("%s.%s.gid"%(hrn,type)) - + def my_pkcs12_filename (self): + return self.fullpath ("%s.p12"%self.hrn) # optimizing dependencies # originally we used classes GID or Credential or Certificate @@ -280,13 +316,17 @@ class SfaClientBootstrap: def assert_filename (self, filename, kind): if not os.path.isfile (filename): - raise IOError,"Missing %s file %s"%(kind,filename) + raise IOError("Missing %s file %s"%(kind,filename)) return True - def assert_private_key (self): return self.assert_filename (self.private_key_filename(),"private key") - def assert_self_signed_cert (self): return self.assert_filename (self.self_signed_cert_filename(),"self-signed certificate") - def assert_my_credential (self): return self.assert_filename (self.my_credential_filename(),"user's credential") - def assert_my_gid (self): return self.assert_filename (self.my_gid_filename(),"user's GID") + def assert_private_key (self): + return self.assert_filename (self.private_key_filename(),"private key") + def assert_self_signed_cert (self): + return self.assert_filename (self.self_signed_cert_filename(),"self-signed certificate") + def assert_my_credential (self): + return self.assert_filename (self.my_credential_filename(),"user's credential") + def assert_my_gid (self): + return self.assert_filename (self.my_gid_filename(),"user's GID") # decorator to make up the other methods @@ -314,7 +354,7 @@ class SfaClientBootstrap: message="Could not produce/retrieve %s (%s -- %s)"%\ (filename,error[0],error[1]) self.logger.log_exc(message) - raise Exception, message + raise Exception(message) return wrapped return wrap @@ -327,6 +367,9 @@ class SfaClientBootstrap: @get_or_produce (my_gid_filename, my_gid_produce) def my_gid (self): pass + @get_or_produce (my_pkcs12_filename, my_pkcs12_produce) + def my_pkcs12 (self): pass + @get_or_produce (credential_filename, credential_produce, validate_credential) def credential (self, hrn, type): pass