source: fedd/fedd_util.py @ c922f23

#!/usr/local/bin/python

import os, sys
import subprocess
import tempfile
import logging
import copy

from M2Crypto import SSL, X509, EVP
from M2Crypto.m2xmlrpclib import SSL_Transport
import M2Crypto.httpslib
from pyasn1.codec.der import decoder

from fedd_services import *
from fedd_internal_services import *
from service_error import *
from xmlrpclib import ServerProxy, dumps, loads, Fault, Error, Binary


# The version of M2Crypto on users is pretty old and doesn't have all the
# features that are useful.  The legacy code is somewhat more brittle than the
# main line, but will work.
if "as_der" not in dir(EVP.PKey):
    from asn1_raw import get_key_bits_from_file, get_key_bits_from_cert
    legacy = True
else:
    legacy = False

class fedd_ssl_context(SSL.Context):
    """
    Simple wrapper around an M2Crypto.SSL.Context to initialize it for fedd.
    """
    def __init__(self, my_cert, trusted_certs=None, password=None):
        """
        construct a fedd_ssl_context

        @param my_cert: PEM file with my certificate in it
        @param trusted_certs: PEM file with trusted certs in it (optional)
        """
        SSL.Context.__init__(self)

        # load_cert takes a callback to get a password, not a password, so if
        # the caller provided a password, this creates a nonce callback using a
        # lambda form.
        if password != None and not callable(password):
            # This is cute.  password = lambda *args: password produces a
            # function object that returns itself rather than one that returns
            # the object itself.  This is because password is an object
            # reference and after the assignment it's a lambda.  So we assign
            # to a temp.
            pwd = password
            password =lambda *args: pwd

        if password != None:
            self.load_cert(my_cert, callback=password)
        else:
            self.load_cert(my_cert)
        if trusted_certs != None: self.load_verify_locations(trusted_certs)
        self.set_verify(SSL.verify_peer, 10)

class fedid:
    """
    Wrapper around the federated ID from an X509 certificate. 
    """
    HASHSIZE=20
    def __init__(self, bits=None, hexstr=None, cert=None, file=None):
        if bits != None:
            self.set_bits(bits)
        elif hexstr != None:
            self.set_hexstr(hexstr)
        elif cert != None:
            self.set_cert(cert)
        elif file != None:
            self.set_file(file)
        else:
            self.buf = None

    def __hash__(self):
        return hash(self.buf)

    def __eq__(self, other):
        if isinstance(other, type(self)):
            return self.buf == other.buf
        elif isinstance(other, type(str())):
            return self.buf == other;
        else:
            return False

    def __ne__(self, other): return not self.__eq__(other)

    def __str__(self):
        if self.buf != None:
            return str().join([ "%02x" % ord(x) for x in self.buf])
        else: return ""

    def __repr__(self):
        return "fedid(hexstr='%s')" % self.__str__()

    def pack_soap(self):
        return self.buf

    def pack_xmlrpc(self):
        return self.buf

    def digest_bits(self, bits):
        """Internal function.  Compute the fedid from bits and store in buf"""
        d = EVP.MessageDigest('sha1')
        d.update(bits)
        self.buf = d.final()


    def set_hexstr(self, hexstr):
        h = hexstr.replace(':','')
        self.buf= str().join([chr(int(h[i:i+2],16)) \
                for i in range(0,2*fedid.HASHSIZE,2)])

    def get_hexstr(self):
        """Return the hexstring representation of the fedid"""
        return __str__(self)

    def set_bits(self, bits):
        """Set the fedid to bits(a 160 bit buffer)"""
        self.buf = bits

    def get_bits(self):
        """Get the 160 bit buffer from the fedid"""
        return self.buf

    def set_file(self, file):
        """Get the fedid from a certificate file

        Calculate the SHA1 hash over the bit string of the public key as
        defined in RFC3280.
        """
        self.buf = None
        if legacy: self.digest_bits(get_key_bits_from_file(file))
        else: self.set_cert(X509.load_cert(file))

    def set_cert(self, cert):
        """Get the fedid from a certificate.

        Calculate the SHA1 hash over the bit string of the public key as
        defined in RFC3280.
        """

        self.buf = None
        if (cert != None):
            if legacy:
                self.digest_bits(get_key_bits_from_cert(cert))
            else:
                b = []
                k = cert.get_pubkey()

                # Getting the key was easy, but getting the bit string of the
                # key requires a side trip through ASN.1
                dec = decoder.decode(k.as_der())

                # kv is a tuple of the bits in the key.  The loop below
                # recombines these into bytes and then into a buffer for the
                # SSL digest function.
                kv =  dec[0].getComponentByPosition(1)
                for i in range(0, len(kv), 8):
                    v = 0
                    for j in range(0, 8):
                        v = (v << 1) + kv[i+j]
                    b.append(v)
                # The comprehension turns b from a list of bytes into a buffer
                # (string) of bytes
                self.digest_bits(str().join([chr(x) for x in b]))

def pack_id(id):
    """
    Return a dictionary with the field name set by the id type.  Handy for
    creating dictionaries to be converted to messages.
    """
    if isinstance(id, type(fedid())): return { 'fedid': id }
    elif id.startswith("http:") or id.startswith("https:"): return { 'uri': id }
    else: return { 'localname': id}

def unpack_id(id):
    """return id as a type determined by the key"""
    if id.has_key("fedid"): return fedid(id["fedid"])
    else:
        for k in ("localname", "uri", "kerberosUsername"):
            if id.has_key(k): return id[k]
    return None

def pack_soap(container, name, contents):
    """
    Convert the dictionary in contents into a tree of ZSI classes.

    The holder classes are constructed from factories in container and assigned
    to either the element or attribute name.  This is used to recursively
    create the SOAP message.
    """
    if getattr(contents, "__iter__", None) != None:
        attr =getattr(container, "new_%s" % name, None)
        if attr: obj = attr()
        else:
            raise TypeError("%s does not have a new_%s attribute" % \
                    (container, name))
        for e, v in contents.iteritems():
            assign = getattr(obj, "set_element_%s" % e, None) or \
                    getattr(obj, "set_attribute_%s" % e, None)
            if isinstance(v, type(dict())):
                assign(pack_soap(obj, e, v))
            elif getattr(v, "__iter__", None) != None:
                assign([ pack_soap(obj, e, val ) for val in v])
            elif getattr(v, "pack_soap", None) != None:
                assign(v.pack_soap())
            else:
                assign(v)
        return obj
    else: return contents

def unpack_soap(element):
    """
    Convert a tree of ZSI SOAP classes intro a hash.  The inverse of pack_soap

    Elements or elements that are empty are ignored.
    """
    methods = [ m for m in dir(element) \
            if m.startswith("get_element") or m.startswith("get_attribute")]
    if len(methods) > 0:
        rv = { }
        for m in methods:
            if m.startswith("get_element_"): n = m.replace("get_element_","",1)
            else: n = m.replace("get_attribute_", "", 1)
            sub = getattr(element, m)()
            if sub != None:
                if isinstance(sub, basestring):
                    rv[n] = sub
                elif getattr(sub, "__iter__", None) != None:
                    if len(sub) > 0: rv[n] = [unpack_soap(e) for e in sub]
                else:
                    rv[n] = unpack_soap(sub)
        return rv
    else: 
        return element
def apply_to_tags(e, map):
    """
    Map is an iterable of ordered pairs (tuples) that map a key to a function.
    This function walks the given message and replaces any object with a key in
    the map with the result of applying that function to the object.
    """
    dict_type = type(dict())
    list_type = type(list())
    str_type = type(str())

    if isinstance(e, dict_type):
        for k in e.keys():
            for tag, fcn in map:
                if k == tag:
                    if isinstance(e[k], list_type):
                        e[k] = [ fcn(b) for b in e[k]]
                    else:
                        e[k] = fcn(e[k])
                elif isinstance(e[k], dict_type):
                    apply_to_tags(e[k], map)
                elif isinstance(e[k], list_type):
                    for ee in e[k]:
                        apply_to_tags(ee, map)
    # Other types end the recursion - they should be leaves
    return e

# These are all just specializations of apply_to_tags
def fedids_to_obj(e, tags=('fedid',)):
    """
    Turn the fedids in a message that are encoded as bitstrings into fedid
    objects.
    """
    map = [ (t, lambda x: fedid(bits=x)) for t in tags]
    return apply_to_tags(e, map)

def encapsulate_binaries(e, tags):
    """Walk through a message and encapsulate any dictionary entries in 
    tags into a binary object."""

    def to_binary(o):
        pack = getattr(o, 'pack_xmlrpc', None)
        if callable(pack): return Binary(pack())
        else: return Binary(o)

    map = [ (t, to_binary) for t in tags]
    return apply_to_tags(e, map)

def decapsulate_binaries(e, tags):
    """Walk through a message and encapsulate any dictionary entries in 
    tags into a binary object."""

    map = [ (t, lambda x: x.data) for t in tags]
    return apply_to_tags(e, map)
#end of tag specializations

def strip_unicode(obj):
    """Walk through a message and convert all strings to non-unicode strings"""
    if isinstance(obj, dict):
        for k in obj.keys():
            obj[k] = strip_unicode(obj[k])
        return obj
    elif isinstance(obj, basestring):
        return str(obj)
    elif getattr(obj, "__iter__", None):
        return [ strip_unicode(x) for x in obj]
    else:
        return obj

def make_unicode(obj):
    """Walk through a message and convert all strings to unicode"""
    if isinstance(obj, dict):
        for k in obj.keys():
            obj[k] = make_unicode(obj[k])
        return obj
    elif isinstance(obj, basestring):
        return unicode(obj)
    elif getattr(obj, "__iter__", None):
        return [ make_unicode(x) for x in obj]
    else:
        return obj


def generate_fedid(subj, bits=2048, log=None, dir=None, trace=sys.stderr):
    """
    Create a new certificate and derive a fedid from it.

    The fedid and the certificate are returned as a tuple.
    """

    keypath = None
    certpath = None
    try:
        try:
            kd, keypath = tempfile.mkstemp(dir=dir, prefix="key",
                    suffix=".pem")
            cd, certpath = tempfile.mkstemp(dir=dir, prefix="cert",
                    suffix=".pem")

            cmd = ["/usr/bin/openssl", "req", "-text", "-newkey", 
                    "rsa:%d" % bits, "-keyout", keypath,  "-nodes", 
                    "-subj", "/CN=%s" % subj, "-x509", "-days", "30", 
                    "-out", certpath]

            if log:
                log.debug("[generate_fedid] %s" % " ".join(cmd))

            if trace: call_out = trace
            else: 
                call_out = open("/dev/null", "w")

            rv = subprocess.call(cmd, stdout=call_out, stderr=call_out)
            log.debug("rv = %d" % rv)
            if rv == 0:
                cert = ""
                for p in (certpath, keypath):
                    f = open(p)
                    for line in f:
                        cert += line
                
                fid = fedid(file=certpath)
                return (fid, cert)
            else:
                return (None, None)
        except IOError, e:
            raise e
    finally:
        if keypath: os.remove(keypath)
        if certpath: os.remove(certpath)


def make_soap_handler(typecode, method, constructor, body_name):
    """
    Generate the handler code to unpack and pack SOAP requests and responses
    and call the given method.

    The code to decapsulate and encapsulate parameters encoded in SOAP is the
    same modulo a few parameters.  This is basically a stub compiler for
    calling a fedd service trhough a soap interface.  The parameters are the
    typecode of the request parameters, the method to call (usually a bound
    instance of a method on a fedd service providing class), the constructor of
    a response packet and the name of the body element of that packet.  The
    handler takes a ParsedSoap object (the request) and returns an instance of
    the class created by constructor containing the response.  Failures of the
    constructor or badly created constructors will result in None being
    returned.
    """
    def handler(ps, fid):
        req = ps.Parse(typecode)

        msg = method(fedids_to_obj(unpack_soap(req)), fid)

        resp = constructor()
        set_element = getattr(resp, "set_element_%s" % body_name, None)
        if set_element and callable(set_element):
            try:
                set_element(pack_soap(resp, body_name, msg))
                return resp
            except (NameError, TypeError):
                return None
        else:
            return None

    return handler

def make_xmlrpc_handler(method, body_name):
    """
    Generate the handler code to unpack and pack SOAP requests and responses
    and call the given method.

    The code to marshall and unmarshall XMLRPC parameters to and from a fedd
    service is largely the same.  This helper creates such a handler.  The
    parameters are the method name, and the name of the body struct that
    contains the response.  A handler is created that takes the params response
    from an xmlrpclib.loads on the incoming rpc and a fedid and responds with
    a hash representing the struct ro be returned to the other side.  On error
    None is returned.  Fedid fields are decapsulated from binary and converted
    to fedid objects on input and encapsulated as Binaries on output.
    """
    def handler(params, fid):
        decap_fedids = (('fedid', lambda x: fedid(bits=x.data)),)

        p = apply_to_tags(params[0], decap_fedids)
        msg = method(p, fid)

        if msg != None:
            return make_unicode(encapsulate_binaries({ body_name: msg }, ('fedid',)))
        else:
            return None

    return handler

def make_service_callers(service_name, port_name, request_message, 
        request_body_name):

    def call_xmlrpc_service(self, url, req, cert_file=None, cert_pwd=None, 
            trusted_certs=None):
        """Send an XMLRPC request.  """
        decap_fedids = (('fedid', lambda x: fedid(bits=x.data)),)

        # No retry loop here.  Proxy servers must correctly authenticate
        # themselves without help
        try:
            ctx = fedd_ssl_context(cert_file, trusted_certs, password=cert_pwd)
        except SSL.SSLError:
            raise service_error(service_error.server_config,
                    "Server certificates misconfigured")

        # Of all the dumbass things.  The XMLRPC library in use here won't
        # properly encode unicode strings, so we make a copy of req with the
        # unicode objects converted.  We also convert the url to a basic string
        # if it isn't one already.
        r = strip_unicode(copy.deepcopy(req))
        url = str(url)
        
        transport = SSL_Transport(ctx)
        port = ServerProxy(url, transport=transport)
        try:
            remote_method = getattr(port, service_name, None)
            resp = remote_method(encapsulate_binaries({ request_body_name: r},
                ('fedid',)))
        except Fault, f:
            raise service_error(None, f.faultString, f.faultCode)
        except Error, e:
            raise service_error(service_error.proxy, 
                    "Remote XMLRPC Fault: %s" % e)

        return apply_to_tags(resp, decap_fedids) 

    def call_soap_service(self, url, req, loc_const, cert_file=None, cert_pwd=None, 
            trusted_certs=None):
        """
        Send req on to the real destination in dt and return the response

        Req is just the requestType object.  This function re-wraps it.  It
        also rethrows any faults.
        """
        # No retry loop here.  Proxy servers must correctly authenticate
        # themselves without help
        try:
            ctx = fedd_ssl_context(cert_file, trusted_certs, password=cert_pwd)
        except SSL.SSLError:
            raise service_error(service_error.server_config, 
                    "Server certificates misconfigured")

        loc = loc_const()
        get_port = getattr(loc, port_name, None)
        if not get_port:
            raise service_error(service_error.internal, 
                    "Cannot get port %s from locator" % port_name)
        port = get_port(url,
                transport=M2Crypto.httpslib.HTTPSConnection, 
                transdict={ 'ssl_context' : ctx })
        remote_method = getattr(port, service_name, None)
        if not remote_method:
            raise service_error(service_error.internal,
                    "Cannot get service from SOAP port")

        # Reconstruct the full request message
        msg = request_message()
        set_element = getattr(msg, "set_element_%s" % request_body_name, None)
        if not set_element:
            raise service_error(service_error.internal,
                    "Cannot get element setting method for %s" % \
                            request_body_name)
        set_element(pack_soap(msg, request_body_name, req))
        try:
            resp = remote_method(msg)
        except ZSI.ParseException, e:
            raise service_error(service_error.proxy,
                    "Bad format message (XMLRPC??): %s" %
                    str(e))
        r = unpack_soap(resp)
        return r

    return (call_soap_service, call_xmlrpc_service)

def set_log_level(config, sect, log):
    """ Set the logging level to the value passed in sect of config."""
    # The getattr sleight of hand finds the logging level constant
    # corrersponding to the string.  We're a little paranoid to avoid user
    # mayhem.
    if config.has_option(sect, "log_level"):
        level_str = config.get(sect, "log_level")
        try:
            level = int(getattr(logging, level_str.upper(), -1))

            if  logging.DEBUG <= level <= logging.CRITICAL:
                log.setLevel(level)
            else:
                log.error("Bad experiment_log value: %s" % level_str)

        except ValueError:
            log.error("Bad experiment_log value: %s" % level_str)