X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=sfa%2Ftrust%2Fhierarchy.py;h=92c0794522b94413be2673d0dc5d84ede5e3078c;hb=8c0bf91e46675c699393dc209794ade4733ef3da;hp=43b318ee5d3f569ae6d585be8a85dd79fbf24c88;hpb=432cca980c7eed80284776f05566cf628088f7aa;p=sfa.git diff --git a/sfa/trust/hierarchy.py b/sfa/trust/hierarchy.py index 43b318ee..92c07945 100644 --- a/sfa/trust/hierarchy.py +++ b/sfa/trust/hierarchy.py @@ -23,8 +23,10 @@ from sfa.util.config import Config from sfa.trust.sfaticket import SfaTicket ## -# The AuthInfo class contains the information for an authority. This information -# includes the GID, private key, and database connection information. +# The AuthInfo class contains the information for an authority. This +# information includes the GID, private key, and database connection +# information. + class AuthInfo: hrn = None @@ -34,7 +36,8 @@ class AuthInfo: ## # Initialize and authority object. # - # @param xrn the human readable name of the authority (urn will be converted to hrn) + # @param xrn the human readable name of the authority + # (urn will be converted to hrn) # @param gid_filename the filename containing the GID # @param privkey_filename the filename containing the private key @@ -64,14 +67,14 @@ class AuthInfo: def get_gid_object(self): if not self.gid_object: - self.gid_object = GID(filename = self.gid_filename) + self.gid_object = GID(filename=self.gid_filename) return self.gid_object ## # Get the private key in the form of a Keypair object def get_pkey_object(self): - return Keypair(filename = self.privkey_filename) + return Keypair(filename=self.privkey_filename) ## # Replace the GID with a new one. The file specified by gid_filename is @@ -87,10 +90,11 @@ class AuthInfo: # The Hierarchy class is responsible for managing the tree of authorities. # Each authority is a node in the tree and exists as an AuthInfo object. # -# The tree is stored on disk in a hierarchical manner than reflects the -# structure of the tree. Each authority is a subdirectory, and each subdirectory -# contains the GID and pkey files for that authority (as well as -# subdirectories for each sub-authority) +# The tree is stored on disk in a hierarchical manner than reflects +# the structure of the tree. Each authority is a subdirectory, and +# each subdirectory contains the GID and pkey files for that authority +# (as well as subdirectories for each sub-authority) + class Hierarchy: ## @@ -98,7 +102,7 @@ class Hierarchy: # # @param basedir the base directory to store the hierarchy in - def __init__(self, basedir = None): + def __init__(self, basedir=None): self.config = Config() if not basedir: basedir = os.path.join(self.config.SFA_DATA_DIR, "authorities") @@ -107,7 +111,8 @@ class Hierarchy: # Given a hrn, return the filenames of the GID, private key # files. # - # @param xrn the human readable name of the authority (urn will be convertd to hrn) + # @param xrn the human readable name of the authority + # (urn will be convertd to hrn) def get_auth_filenames(self, xrn): hrn, type = urn_to_hrn(xrn) @@ -119,8 +124,8 @@ class Hierarchy: parent_hrn = get_authority(hrn) directory = os.path.join(self.basedir, hrn.replace(".", "/")) - gid_filename = os.path.join(directory, leaf+".gid") - privkey_filename = os.path.join(directory, leaf+".pkey") + gid_filename = os.path.join(directory, leaf + ".gid") + privkey_filename = os.path.join(directory, leaf + ".pkey") return (directory, gid_filename, privkey_filename) @@ -131,63 +136,70 @@ class Hierarchy: # @param the human readable name of the authority to check def auth_exists(self, xrn): - hrn, type = urn_to_hrn(xrn) + hrn, type = urn_to_hrn(xrn) (directory, gid_filename, privkey_filename) = \ self.get_auth_filenames(hrn) - - return os.path.exists(gid_filename) and os.path.exists(privkey_filename) + + return os.path.exists(gid_filename) \ + and os.path.exists(privkey_filename) ## # Create an authority. A private key for the authority and the associated # GID are created and signed by the parent authority. # - # @param xrn the human readable name of the authority to create (urn will be converted to hrn) - # @param create_parents if true, also create the parents if they do not exist + # @param xrn the human readable name of the authority to create + # (urn will be converted to hrn) + # @param create_parents + # if true, also create the parents if they do not exist def create_auth(self, xrn, create_parents=False): hrn, type = urn_to_hrn(str(xrn)) - logger.debug("Hierarchy: creating authority: %s"% hrn) + logger.debug("Hierarchy: creating authority: {}".format(hrn)) # create the parent authority if necessary parent_hrn = get_authority(hrn) parent_urn = hrn_to_urn(parent_hrn, 'authority') - if (parent_hrn) and (not self.auth_exists(parent_urn)) and (create_parents): + if (parent_hrn) and (not self.auth_exists(parent_urn)) \ + and (create_parents): self.create_auth(parent_urn, create_parents) - (directory, gid_filename, privkey_filename,) = \ - self.get_auth_filenames(hrn) + directory, gid_filename, privkey_filename = self.get_auth_filenames( + hrn) # create the directory to hold the files try: os.makedirs(directory) # if the path already exists then pass - except OSError, (errno, strerr): + except OSError as xxx_todo_changeme: + (errno, strerr) = xxx_todo_changeme.args if errno == 17: pass if os.path.exists(privkey_filename): - logger.debug("using existing key %r for authority %r"%(privkey_filename,hrn)) - pkey = Keypair(filename = privkey_filename) + logger.debug("using existing key {} for authority {}" + .format(privkey_filename, hrn)) + pkey = Keypair(filename=privkey_filename) else: - pkey = Keypair(create = True) + pkey = Keypair(create=True) pkey.save_to_file(privkey_filename) gid = self.create_gid(xrn, create_uuid(), pkey) gid.save_to_file(gid_filename, save_parents=True) + return gid def create_top_level_auth(self, hrn=None): """ - Create top level records (includes root and sub authorities (local/remote) + Create top level records + (includes root and sub authorities (local/remote) """ # create the authority if it doesnt alrady exist if not self.auth_exists(hrn): self.create_auth(hrn, create_parents=True) - - + def get_interface_auth_info(self, create=True): hrn = self.config.SFA_INTERFACE_HRN if not self.auth_exists(hrn): - if create==True: - self.create_top_level_auth(hrn) + if create: + self.create_top_level_auth(hrn) else: raise MissingAuthority(hrn) return self.get_auth_info(hrn) @@ -196,12 +208,15 @@ class Hierarchy: # does not exist, then an exception is thrown. As a side effect, disk files # and a subdirectory may be created to store the authority. # - # @param xrn the human readable name of the authority to create (urn will be converted to hrn). + # @param xrn the human readable name of the authority to create + # (urn will be converted to hrn). def get_auth_info(self, xrn): hrn, type = urn_to_hrn(xrn) if not self.auth_exists(hrn): - logger.warning("Hierarchy: missing authority - xrn=%s, hrn=%s"%(xrn,hrn)) + logger.warning( + "Hierarchy: missing authority - xrn={}, hrn={}" + .format(xrn, hrn)) raise MissingAuthority(hrn) (directory, gid_filename, privkey_filename, ) = \ @@ -226,19 +241,20 @@ class Hierarchy: # @param uuid the unique identifier to store in the GID # @param pkey the public key to store in the GID - def create_gid(self, xrn, uuid, pkey, CA=False, email=None, force_parent=None): + def create_gid(self, xrn, uuid, pkey, + CA=False, email=None, force_parent=None): hrn, type = urn_to_hrn(xrn) if not type: type = 'authority' parent_hrn = force_parent if force_parent else get_authority(hrn) # Using hrn_to_urn() here to make sure the urn is in the right format # If xrn was a hrn instead of a urn, then the gid's urn will be - # of type None + # of type None urn = hrn_to_urn(hrn, type) gid = GID(subject=hrn, uuid=uuid, hrn=hrn, urn=urn, email=email) # is this a CA cert if hrn == self.config.SFA_INTERFACE_HRN or not parent_hrn: - # root or sub authority + # root or sub authority gid.set_intermediate_ca(True) elif type and 'authority' in type: # authority type @@ -256,11 +272,17 @@ class Hierarchy: else: # we need the parent's private key in order to sign this GID parent_auth_info = self.get_auth_info(parent_hrn) - gid.set_issuer(parent_auth_info.get_pkey_object(), parent_auth_info.hrn) + gid.set_issuer(parent_auth_info.get_pkey_object(), + parent_auth_info.hrn) gid.set_parent(parent_auth_info.get_gid_object()) gid.set_pubkey(pkey) gid.encode() + if 'http' in self.config.SFA_REGISTRY_HOST: + url = 'caIssuers;URI:' + str(self.config.SFA_REGISTRY_HOST) +':'+ str(self.config.SFA_REGISTRY_PORT) + else: + url = 'caIssuers;URI:https://' + str(self.config.SFA_REGISTRY_HOST) +':'+ str(self.config.SFA_REGISTRY_PORT) + gid.set_data(url, 'authorityInfoAccess') gid.sign() return gid @@ -281,7 +303,7 @@ class Hierarchy: # update the gid if we need to if gid_is_expired or xrn or uuid or pubkey: - + if not xrn: xrn = gid.get_urn() if not uuid: @@ -298,11 +320,12 @@ class Hierarchy: # credential will contain the authority privilege and will be signed by # the authority's parent. # - # @param hrn the human readable name of the authority (urn is converted to hrn) + # @param hrn the human readable name of the authority + # (urn is converted to hrn) # @param authority type of credential to return (authority | sa | ma) def get_auth_cred(self, xrn, kind="authority"): - hrn, type = urn_to_hrn(xrn) + hrn, type = urn_to_hrn(xrn) auth_info = self.get_auth_info(hrn) gid = auth_info.get_gid_object() @@ -311,19 +334,20 @@ class Hierarchy: cred.set_gid_object(gid) cred.set_privileges(kind) cred.get_privileges().delegate_all_privileges(True) - #cred.set_pubkey(auth_info.get_gid_object().get_pubkey()) + # cred.set_pubkey(auth_info.get_gid_object().get_pubkey()) parent_hrn = get_authority(hrn) if not parent_hrn or hrn == self.config.SFA_INTERFACE_HRN: # if there is no parent hrn, then it must be self-signed. this # is where we terminate the recursion - cred.set_issuer_keys(auth_info.get_privkey_filename(), auth_info.get_gid_filename()) + cred.set_issuer_keys( + auth_info.get_privkey_filename(), auth_info.get_gid_filename()) else: # we need the parent's private key in order to sign this GID parent_auth_info = self.get_auth_info(parent_hrn) - cred.set_issuer_keys(parent_auth_info.get_privkey_filename(), parent_auth_info.get_gid_filename()) + cred.set_issuer_keys(parent_auth_info.get_privkey_filename( + ), parent_auth_info.get_gid_filename()) - cred.set_parent(self.get_auth_cred(parent_hrn, kind)) cred.encode() @@ -339,7 +363,8 @@ class Hierarchy: # This looks almost the same as get_auth_cred, but works for tickets # XXX does similarity imply there should be more code re-use? # - # @param xrn the human readable name of the authority (urn is converted to hrn) + # @param xrn the human readable name of the authority + # (urn is converted to hrn) def get_auth_ticket(self, xrn): hrn, type = urn_to_hrn(xrn) @@ -360,11 +385,11 @@ class Hierarchy: else: # we need the parent's private key in order to sign this GID parent_auth_info = self.get_auth_info(parent_hrn) - ticket.set_issuer(parent_auth_info.get_pkey_object(), parent_auth_info.hrn) + ticket.set_issuer( + parent_auth_info.get_pkey_object(), parent_auth_info.hrn) ticket.set_parent(self.get_auth_cred(parent_hrn)) ticket.encode() ticket.sign() return ticket -