Changeset de7cb08

Timestamp:

Nov 24, 2010 10:36:28 AM (14 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

c573278

Parents:

e62245e

Message:

use combo key

File:

• fedd/access_to_abac.py (modified) (4 diffs)

fedd/access_to_abac.py

@@ -7 +7 @@
 from string import join
 from federation.fedid import fedid
+from federation.util import abac_split_cert, abac_pem_type
 from optparse import OptionParser, OptionValueError
 
@@ -287 +288 @@
 opts, args = p.parse_args()
 
+cert, key = None, None
+delete_certs = False
+
 if opts.file:
     args.append(opts.file)
@@ -293 +297 @@
 if len(args) < 1:
     sys.exit('No filenames given to parse')
+
+if opts.key:
+    if not os.access(opts.key, os.R_OK):
+        key = opts.key
+    else:
+        sys.exit('Cannot read key (%s)' % opts.key)
+
+if opts.dir:
+    if not os.path.isdir(opts.dir):
+        sys.exit('%s is not a directory' % opts.dir)
+    elif not os.access(opts.dir, os.W_OK):
+        sys.exit('%s is not writable' % opts.dir)
+
+if opts.delegate: delegation_link = 'acting_for'
+else: delegation_link = None
+
+mapper = opts.mapper
 
 if opts.cert: 
@@ -299 +320 @@
     except EnvironmentError, e:
         sys.exit('Bad --cert: %s (%s)' % (e.strerror, e.filename or '?!'))
+
+    if not opts.key:
+        if abac_pem_type(opts.cert) == 'both':
+            key, cert = abac_split_cert(opts.cert)
+            delete_certs = True
+    else:
+        cert = opts.cert
 else: 
     print >>sys.stderr, 'No --cert, using dummy fedid'
     me = fedid(hexstr='0123456789012345678901234567890123456789')
-
-if opts.key and not os.access(opts.key, os.R_OK):
-    sys.exit('Cannot read key (%s)' % opts.key)
-
-if opts.dir:
-    if not os.path.isdir(opts.dir):
-        sys.exit('%s is not a directory' % opts.dir)
-    elif not os.access(opts.dir, os.W_OK):
-        sys.exit('%s is not writable' % opts.dir)
-
-if opts.delegate: delegation_link = 'acting_for'
-else: delegation_link = None
-
-mapper = opts.mapper
-
-# Do the parsing
-for fn in args:
-    creds = set()
-    to_id = { }
-    try:
-        f = open(fn, "r")
-        for i, l in enumerate(f):
+    cert = None
+
+# The try block makes sure that credentials split into tmp files are deleted
+try:
+    # Do the parsing
+    for fn in args:
+        creds = set()
+        to_id = { }
+        try:
+            f = open(fn, "r")
+            for i, l in enumerate(f):
+                try:
+                    if comment_re.match(l):
+                        continue
+                    else:
+                        m =  line_re.match(l)
+                        if m:
+                            p, da = m.group(1, 4)
+                            gp, gu = m.group(2, 3)
+                            if gp == '<any>': gp = None
+                            if gu == '<any>': gu = None
+
+                            creds.add(credential(me, da, 
+                                    [attribute(p, x, delegation_link) \
+                                            for x in (gp, gu) \
+                                                if x is not None]))
+                            if m.group(5) and mapper:
+                                mapper(m.group(5), creds, me, to_id, p, gp, gu,
+                                        delegation_link)
+                        else:
+                            raise parse_error('Syntax error')
+                except parse_error, e:
+                    f.close()
+                    raise parse_error('Error on line %d of %s: %s' % \
+                            (i, fn, e.message))
+                    
+            f.close()
+        except parse_error, e:
+            print >> sys.stderr, "%s" % e
+            continue
+
+        except EnvironmentError, e:
+            print >>sys.stderr, "File error %s: %s" % \
+                    (e.filename or '!?', e.strerror) 
+            continue
+
+        # Credential output
+        if opts.create_creds:
+            if all([cert, key, opts.dir]):
+                try:
+                    create_creds([c for c in creds if c.principal == me],
+                            cert, key, opts.dir, opts.debug)
+                except credential_error, e:
+                    sys.exit('Credential creation failed: %s' % e)
+            else:
+                print >>sys.stderr, 'Cannot create credentials.  Missing parameter'
+
+        # Local map output
+        if opts.map or opts.debug:
             try:
-                if comment_re.match(l):
-                    continue
+                if opts.map and opts.map != '-' and not opts.debug:
+                    f = open(opts.map, 'w')
                 else:
-                    m =  line_re.match(l)
-                    if m:
-                        p, da = m.group(1, 4)
-                        gp, gu = m.group(2, 3)
-                        if gp == '<any>': gp = None
-                        if gu == '<any>': gu = None
-
-                        creds.add(credential(me, da, 
-                                [attribute(p, x, delegation_link) \
-                                        for x in (gp, gu) \
-                                            if x is not None]))
-                        if m.group(5) and mapper:
-                            mapper(m.group(5), creds, me, to_id, p, gp, gu,
-                                    delegation_link)
-                    else:
-                        raise parse_error('Syntax error')
-            except parse_error, e:
-                f.close()
-                raise parse_error('Error on line %d of %s: %s' % \
-                        (i, fn, e.message))
-                
-        f.close()
-    except parse_error, e:
-        print >> sys.stderr, "%s" % e
-        continue
-
-    except EnvironmentError, e:
-        print >>sys.stderr, "File error %s: %s" % \
-                (e.filename or '!?', e.strerror) 
-        continue
-
-    # Credential output
-    if opts.create_creds:
-        if all([opts.cert, opts.key, opts.dir]):
-            try:
-                create_creds([c for c in creds if c.principal == me],
-                        opts.cert, opts.key, opts.dir, opts.debug)
-            except credential_error, e:
-                sys.exit('Credential creation failed: %s' % e)
-        else:
-            print >>sys.stderr, 'Cannot create credentials.  Missing parameter'
-
-    # Local map output
-    if opts.map or opts.debug:
-        try:
-            if opts.map and opts.map != '-' and not opts.debug:
-                f = open(opts.map, 'w')
-            else:
-                f = sys.stdout
-            for k, c in to_id.items():
-                for a in set(["%s.%s" % (x.principal, x.attr) for x in c]):
-                    print >>f, "%s -> (%s)" % ( a, join(k, ', '))
-        except EnvironmentError, e:
-            sys.exit("Cannot open %s: %s" % (e.filename or '!?', e.strerror))
+                    f = sys.stdout
+                for k, c in to_id.items():
+                    for a in set(["%s.%s" % (x.principal, x.attr) for x in c]):
+                        print >>f, "%s -> (%s)" % ( a, join(k, ', '))
+            except EnvironmentError, e:
+                sys.exit("Cannot open %s: %s" % (e.filename or '!?', e.strerror))
+finally:
+    if delete_certs:
+        if cert: os.unlink(cert)
+        if key: os.unlink(key)