X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=sfa%2Ftrust%2Fhierarchy.py;h=023481638df25085c4e10ba2c04f8bbe16a9aa1a;hb=ca1b51aeaa338bd3998956c732f77b68836deb03;hp=0ae7e4bec5b8534994635d8e8bd564f2504fe459;hpb=dbce495b6f2e7d8dccbfb18c5507907d784c143b;p=sfa.git diff --git a/sfa/trust/hierarchy.py b/sfa/trust/hierarchy.py index 0ae7e4be..02348163 100644 --- a/sfa/trust/hierarchy.py +++ b/sfa/trust/hierarchy.py @@ -9,44 +9,41 @@ # subdirectory are several files: # *.GID - GID file # *.PKEY - private key file -# *.DBINFO - database info ## import os -from sfa.util.sfalogging import sfa_logger +from sfa.util.faults import MissingAuthority +from sfa.util.sfalogging import logger +from sfa.util.xrn import get_leaf, get_authority, hrn_to_urn, urn_to_hrn from sfa.trust.certificate import Keypair -from sfa.trust.credential import * +from sfa.trust.credential import Credential from sfa.trust.gid import GID, create_uuid -from sfa.util.namespace import get_leaf, get_authority, hrn_to_urn, urn_to_hrn from sfa.util.config import Config -from sfa.util.sfaticket import SfaTicket +from sfa.trust.sfaticket import SfaTicket ## # The AuthInfo class contains the information for an authority. This information # includes the GID, private key, and database connection information. + class AuthInfo: hrn = None gid_object = None gid_filename = None privkey_filename = None - dbinfo_filename = None - ## # Initialize and authority object. # # @param xrn the human readable name of the authority (urn will be converted to hrn) # @param gid_filename the filename containing the GID # @param privkey_filename the filename containing the private key - # @param dbinfo_filename the filename containing the database info - def __init__(self, xrn, gid_filename, privkey_filename, dbinfo_filename): + def __init__(self, xrn, gid_filename, privkey_filename): hrn, type = urn_to_hrn(xrn) self.hrn = hrn self.set_gid_filename(gid_filename) self.privkey_filename = privkey_filename - self.dbinfo_filename = dbinfo_filename ## # Set the filename of the GID @@ -68,23 +65,14 @@ class AuthInfo: def get_gid_object(self): if not self.gid_object: - self.gid_object = GID(filename = self.gid_filename) + self.gid_object = GID(filename=self.gid_filename) return self.gid_object ## # Get the private key in the form of a Keypair object def get_pkey_object(self): - return Keypair(filename = self.privkey_filename) - - ## - # Get the dbinfo in the form of a dictionary - - def get_dbinfo(self): - f = file(self.dbinfo_filename) - dict = eval(f.read()) - f.close() - return dict + return Keypair(filename=self.privkey_filename) ## # Replace the GID with a new one. The file specified by gid_filename is @@ -102,37 +90,41 @@ class AuthInfo: # # The tree is stored on disk in a hierarchical manner than reflects the # structure of the tree. Each authority is a subdirectory, and each subdirectory -# contains the GID, pkey, and dbinfo files for that authority (as well as +# contains the GID and pkey files for that authority (as well as # subdirectories for each sub-authority) + class Hierarchy: ## # Create the hierarchy object. # # @param basedir the base directory to store the hierarchy in - def __init__(self, basedir = None): + def __init__(self, basedir=None): + self.config = Config() if not basedir: - self.config = Config() basedir = os.path.join(self.config.SFA_DATA_DIR, "authorities") self.basedir = basedir ## - # Given a hrn, return the filenames of the GID, private key, and dbinfo + # Given a hrn, return the filenames of the GID, private key # files. # # @param xrn the human readable name of the authority (urn will be convertd to hrn) def get_auth_filenames(self, xrn): hrn, type = urn_to_hrn(xrn) - leaf = get_leaf(hrn) + if '\\' in hrn: + hrn = hrn.replace('\\', '') + leaf = hrn + else: + leaf = get_leaf(hrn) parent_hrn = get_authority(hrn) directory = os.path.join(self.basedir, hrn.replace(".", "/")) - gid_filename = os.path.join(directory, leaf+".gid") - privkey_filename = os.path.join(directory, leaf+".pkey") - dbinfo_filename = os.path.join(directory, leaf+".dbinfo") + gid_filename = os.path.join(directory, leaf + ".gid") + privkey_filename = os.path.join(directory, leaf + ".pkey") - return (directory, gid_filename, privkey_filename, dbinfo_filename) + return (directory, gid_filename, privkey_filename) ## # Check to see if an authority exists. An authority exists if it's disk @@ -141,59 +133,68 @@ class Hierarchy: # @param the human readable name of the authority to check def auth_exists(self, xrn): - hrn, type = urn_to_hrn(xrn) - (directory, gid_filename, privkey_filename, dbinfo_filename) = \ + hrn, type = urn_to_hrn(xrn) + (directory, gid_filename, privkey_filename) = \ self.get_auth_filenames(hrn) - - return os.path.exists(gid_filename) and \ - os.path.exists(privkey_filename) and \ - os.path.exists(dbinfo_filename) + + return os.path.exists(gid_filename) and os.path.exists(privkey_filename) ## # Create an authority. A private key for the authority and the associated # GID are created and signed by the parent authority. # - # @param xrn the human readable name of the authority to create (urn will be converted to hrn) + # @param xrn the human readable name of the authority to create (urn will be converted to hrn) # @param create_parents if true, also create the parents if they do not exist def create_auth(self, xrn, create_parents=False): - hrn, type = urn_to_hrn(xrn) - sfa_logger().debug("Hierarchy: creating authority: " + hrn) + hrn, type = urn_to_hrn(str(xrn)) + logger.debug("Hierarchy: creating authority: %s" % hrn) # create the parent authority if necessary parent_hrn = get_authority(hrn) parent_urn = hrn_to_urn(parent_hrn, 'authority') if (parent_hrn) and (not self.auth_exists(parent_urn)) and (create_parents): self.create_auth(parent_urn, create_parents) - - (directory, gid_filename, privkey_filename, dbinfo_filename) = \ - self.get_auth_filenames(hrn) + directory, gid_filename, privkey_filename = self.get_auth_filenames( + hrn) # create the directory to hold the files try: os.makedirs(directory) # if the path already exists then pass - except OSError, (errno, strerr): + except OSError as xxx_todo_changeme: + (errno, strerr) = xxx_todo_changeme.args if errno == 17: pass if os.path.exists(privkey_filename): - sfa_logger().debug("using existing key %r for authority %r"%(privkey_filename,hrn)) - pkey = Keypair(filename = privkey_filename) + logger.debug("using existing key %r for authority %r" + % (privkey_filename, hrn)) + pkey = Keypair(filename=privkey_filename) else: - pkey = Keypair(create = True) + pkey = Keypair(create=True) pkey.save_to_file(privkey_filename) gid = self.create_gid(xrn, create_uuid(), pkey) gid.save_to_file(gid_filename, save_parents=True) + return gid - # XXX TODO: think up a better way for the dbinfo to work - - dbinfo = Config().get_plc_dbinfo() - dbinfo_file = file(dbinfo_filename, "w") - dbinfo_file.write(str(dbinfo)) - dbinfo_file.close() + def create_top_level_auth(self, hrn=None): + """ + Create top level records (includes root and sub authorities (local/remote) + """ + # create the authority if it doesnt alrady exist + if not self.auth_exists(hrn): + self.create_auth(hrn, create_parents=True) + def get_interface_auth_info(self, create=True): + hrn = self.config.SFA_INTERFACE_HRN + if not self.auth_exists(hrn): + if create == True: + self.create_top_level_auth(hrn) + else: + raise MissingAuthority(hrn) + return self.get_auth_info(hrn) ## # Return the AuthInfo object for the specified authority. If the authority # does not exist, then an exception is thrown. As a side effect, disk files @@ -204,13 +205,14 @@ class Hierarchy: def get_auth_info(self, xrn): hrn, type = urn_to_hrn(xrn) if not self.auth_exists(hrn): - sfa_logger().warning("Hierarchy: mising authority - xrn=%s, hrn=%s"%(xrn,hrn)) + logger.warning( + "Hierarchy: missing authority - xrn=%s, hrn=%s" % (xrn, hrn)) raise MissingAuthority(hrn) - (directory, gid_filename, privkey_filename, dbinfo_filename) = \ + (directory, gid_filename, privkey_filename, ) = \ self.get_auth_filenames(hrn) - auth_info = AuthInfo(hrn, gid_filename, privkey_filename, dbinfo_filename) + auth_info = AuthInfo(hrn, gid_filename, privkey_filename) # check the GID and see if it needs to be refreshed gid = auth_info.get_gid_object() @@ -229,15 +231,29 @@ class Hierarchy: # @param uuid the unique identifier to store in the GID # @param pkey the public key to store in the GID - def create_gid(self, xrn, uuid, pkey): + def create_gid(self, xrn, uuid, pkey, CA=False, email=None, force_parent=None): hrn, type = urn_to_hrn(xrn) + if not type: + type = 'authority' + parent_hrn = force_parent if force_parent else get_authority(hrn) # Using hrn_to_urn() here to make sure the urn is in the right format # If xrn was a hrn instead of a urn, then the gid's urn will be - # of type None + # of type None urn = hrn_to_urn(hrn, type) - gid = GID(subject=hrn, uuid=uuid, hrn=hrn, urn=urn) + gid = GID(subject=hrn, uuid=uuid, hrn=hrn, urn=urn, email=email) + # is this a CA cert + if hrn == self.config.SFA_INTERFACE_HRN or not parent_hrn: + # root or sub authority + gid.set_intermediate_ca(True) + elif type and 'authority' in type: + # authority type + gid.set_intermediate_ca(True) + elif CA: + gid.set_intermediate_ca(True) + else: + gid.set_intermediate_ca(False) - parent_hrn = get_authority(hrn) + # set issuer if not parent_hrn or hrn == self.config.SFA_INTERFACE_HRN: # if there is no parent hrn, then it must be self-signed. this # is where we terminate the recursion @@ -245,9 +261,9 @@ class Hierarchy: else: # we need the parent's private key in order to sign this GID parent_auth_info = self.get_auth_info(parent_hrn) - gid.set_issuer(parent_auth_info.get_pkey_object(), parent_auth_info.hrn) + gid.set_issuer(parent_auth_info.get_pkey_object(), + parent_auth_info.hrn) gid.set_parent(parent_auth_info.get_gid_object()) - gid.set_intermediate_ca(True) gid.set_pubkey(pkey) gid.encode() @@ -271,7 +287,7 @@ class Hierarchy: # update the gid if we need to if gid_is_expired or xrn or uuid or pubkey: - + if not xrn: xrn = gid.get_urn() if not uuid: @@ -292,7 +308,7 @@ class Hierarchy: # @param authority type of credential to return (authority | sa | ma) def get_auth_cred(self, xrn, kind="authority"): - hrn, type = urn_to_hrn(xrn) + hrn, type = urn_to_hrn(xrn) auth_info = self.get_auth_info(hrn) gid = auth_info.get_gid_object() @@ -301,19 +317,20 @@ class Hierarchy: cred.set_gid_object(gid) cred.set_privileges(kind) cred.get_privileges().delegate_all_privileges(True) - #cred.set_pubkey(auth_info.get_gid_object().get_pubkey()) + # cred.set_pubkey(auth_info.get_gid_object().get_pubkey()) parent_hrn = get_authority(hrn) if not parent_hrn or hrn == self.config.SFA_INTERFACE_HRN: # if there is no parent hrn, then it must be self-signed. this # is where we terminate the recursion - cred.set_issuer_keys(auth_info.get_privkey_filename(), auth_info.get_gid_filename()) + cred.set_issuer_keys( + auth_info.get_privkey_filename(), auth_info.get_gid_filename()) else: # we need the parent's private key in order to sign this GID parent_auth_info = self.get_auth_info(parent_hrn) - cred.set_issuer_keys(parent_auth_info.get_privkey_filename(), parent_auth_info.get_gid_filename()) + cred.set_issuer_keys(parent_auth_info.get_privkey_filename( + ), parent_auth_info.get_gid_filename()) - cred.set_parent(self.get_auth_cred(parent_hrn, kind)) cred.encode() @@ -350,11 +367,11 @@ class Hierarchy: else: # we need the parent's private key in order to sign this GID parent_auth_info = self.get_auth_info(parent_hrn) - ticket.set_issuer(parent_auth_info.get_pkey_object(), parent_auth_info.hrn) + ticket.set_issuer( + parent_auth_info.get_pkey_object(), parent_auth_info.hrn) ticket.set_parent(self.get_auth_cred(parent_hrn)) ticket.encode() ticket.sign() return ticket -