Changeset 0a49bd7 for fedd/federation/authorizer.py

Timestamp:

Jan 15, 2011 5:52:15 PM (13 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

aaf7f41

Parents:

ac15159 (diff), 944b746 (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent.

git-author:

Ted Faber <faber@…> (01/15/11 17:51:40)

git-committer:

Ted Faber <faber@…> (01/15/11 17:52:15)

Message:

merge from current

File:

• fedd/federation/authorizer.py (modified) (13 diffs)

fedd/federation/authorizer.py

@@ -1 +1 @@
 #/usr/local/bin/python
 
-from string import join
 from tempfile import mkstemp
 from subprocess import call
@@ -12 +11 @@
 from service_error import service_error
 from util import abac_pem_type, abac_split_cert
+from proof import proof
 
 
@@ -116 +116 @@
         if attrs: attrs.discard(attr)
 
-    def check_attribute(self, name, attr):
+    def check_attribute(self, name, attr, with_proof=False):
         """
         Return True if name has attr (or if attr is global).  Tuple names match
@@ -130 +130 @@
         self.valid_name(name)
         if attr in self.globals:
-            return True
+            if with_proof: return True, proof("me", name, attr)
+            else: return True
 
         if isinstance(name, tuple):
@@ -137 +138 @@
                 if self.attrs.has_key(lookup):
                     if attr in self.attrs[lookup]:
-                        return True
-        else:
-            return  attr in self.attrs.get(self.auth_name(name), set())
+                        if with_proof: return True, proof("me", name, attr)
+                        else: return True
+                # Drop through
+                if with_proof: return False, proof("me", name, attr)
+                else: return False
+        else:
+            if with_proof:
+                return attr in self.attrs.get(self.auth_name(name), set()), \
+                        proof("me", name, attr)
+            else:
+                return attr in self.attrs.get(self.auth_name(name), set())
 
     def set_global_attribute(self, attr):
@@ -209 +218 @@
         if self.me is not None and abac_pem_type(self.me) == 'both':
             if self.save_dir:
-                self.key, self.me = abac_split_cert(self.me,
-                        keyfile="%s/key.pem" % self.save_dir, 
-                        certfile = "%s/cert.pem" % self.save_dir)
+                keyfile="%s/key.pem" % self.save_dir 
+                certfile = "%s/cert.pem" % self.save_dir
+
+                # Clear a spot for the new key and cert files.
+                for fn in (keyfile, certfile):
+                    if os.access(fn, os.F_OK):
+                        os.unlink(fn)
+
+                self.key, self.me = abac_split_cert(self.me, keyfile, certfile)
             else:
                 raise abac_authorizer.bad_cert_error("Combination " + \
@@ -223 +238 @@
             if rv != 0:
                 raise abac_authorizer.bad_name(
-                        'Cannot load identity from %s' % me.cert)
+                        'Cannot load identity from %s' % me)
         else:
             self.fedid = None
@@ -235 +250 @@
         if load:
             self.load(load)
+
+    # Modify the pickling operations so that the context and lock are not
+    # pickled
+
+    def __getstate__(self):
+        d = self.__dict__.copy()
+        del d['lock']
+        del d['context']
+        return d
+
+    def __setstate__(self, d):
+        # Import everything from the pickle dict (except what we excluded in
+        # __getstate__)
+        self.__dict__.update(d)
+        # Initialize the unpicklables
+        self.context = ABAC.Context()
+        self.lock = Lock()
 
     @staticmethod
@@ -352 +384 @@
 
 
-    def check_attribute(self, name, attr):
-        # XXX proof soon
+    def check_attribute(self, name, attr, with_proof=False):
         if isinstance(name, tuple):
             raise abac_authorizer.bad_name(
@@ -376 +407 @@
             # Sigh. Unicode vs swig and swig seems to lose.  Make sure
             # everything we pass into ABAC is a str not a unicode.
-            rv, proof = self.context.query(a, n)
+            rv, p = self.context.query(a, n)
             # XXX delete soon
-            if not rv and attr in self.globals: rv = True
-            self.lock.release()
-
-            return rv
+            if not rv and attr in self.globals: 
+                rv = True
+                p = None
+            self.lock.release()
+            if with_proof: return rv, proof(self.fedid, name, a, p)
+            else: return rv
 
     def set_global_attribute(self, attr):
@@ -421 +454 @@
             if not os.access(dir, os.F_OK):
                 os.mkdir(dir)
-            # These are unpicklable, so set them aside
-            context = self.context
-            lock = self.lock
-            self.context = None
-            self.lock = None
 
             f = open("%s/state" % dir, "w")
@@ -433 +461 @@
             if not os.access("%s/certs" %dir, os.F_OK):
                 os.mkdir("%s/certs" % dir)
-            seenid = set()
-            seenattr = set()
-
-            #restore unpicklable state 
-            self.context = context
-            self.lock = lock
-            #remove old certs
+
+            # Clear the certs subdir
             for fn in [ f for f in os.listdir("%s/certs" % dir) \
                     if abac_authorizer.cred_file_re.match(f)]:
                 os.unlink('%s/certs/%s' % (dir, fn))
+
+            # Save the context
             ii = 0
             ai = 0
+            seenid = set()
+            seenattr = set()
             for c in self.context.credentials():
                 id = c.issuer_cert()
@@ -463 +490 @@
                     seenattr.add(attr)
         except EnvironmentError, e:
-            # If we've mislaid self.lock, release lock (they're the same object)
-            if self.lock: self.lock.release()
-            elif lock: lock.release()
+            self.lock.release()
             raise e
         except pickle.PickleError, e:
-            # If we've mislaid self.lock, release lock (they're the same object)
-            if self.lock: self.lock.release()
-            elif lock: lock.release()
+            self.lock.release()
             raise e
         self.lock.release()