Changeset 353db8c for fedd/federation/util.py

Timestamp:

Nov 23, 2010 5:00:48 PM (13 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

6e63513

Parents:

3ff5e2a

Message:

Vairous ABAC tweaks, mostly concerned with making key splitting less visible.

File:

• fedd/federation/util.py (modified) (2 diffs)

fedd/federation/util.py

@@ -2 +2 @@
 
 import re
+import os
 import string
 import logging
@@ -262 +263 @@
             return base
 
+def abac_pem_type(cert):
+    key_re = re.compile('\s*-----BEGIN RSA PRIVATE KEY-----$')
+    cert_re = re.compile('\s*-----BEGIN CERTIFICATE-----$') 
+    type = None
+    f = open(cert, 'r')
+    for line in f:
+        if key_re.match(line):
+            if type is None: type = 'key'
+            elif type == 'cert': type = 'both'
+        elif cert_re.match(line):
+            if type is None: type = 'cert'
+            elif type == 'key': type = 'both'
+        if type == 'both': break
+    f.close()
+    return type
+
+def abac_split_cert(cert, keyfile=None, certfile=None):
+    """
+    Split the certificate file in cert into a certificate file and a key file
+    in cf and kf respectively.  The ABAC tools generally cannot handle combined
+    certificates/keys.  If kf anc cf are given, they are used, otherwise tmp
+    files are created.  Created tmp files must be deleted.  Problems opening or
+    writing files will cause exceptions.
+    """
+    class diversion:
+        '''
+        Wraps up the reqular expression to start and end a diversion, as well as
+        the open file that gets the lines.
+        '''
+        def __init__(self, start, end, fn):
+            self.start = re.compile(start)
+            self.end = re.compile(end)
+            # Open the file securely with minimal permissions. NB file cannot
+            # exist before this call.
+            self.f = os.fdopen(os.open(fn,
+                (os.O_WRONLY | os.O_CREAT | os.O_TRUNC | os.O_EXCL), 0600),
+                'w')
+
+        def close(self):
+            self.f.close()
+
+    if not keyfile:
+        f, keyfile = mkstemp(suffix=".pem")
+        os.close(f);
+    if not certfile:
+        f, certfile = mkstemp(suffix=".pem")
+        os.close(f);
+
+    # Initialize the diversions
+    divs = [diversion(s, e, fn) for s, e,fn in (
+        ('\s*-----BEGIN RSA PRIVATE KEY-----$', 
+            '\s*-----END RSA PRIVATE KEY-----$',
+            keyfile),
+        ('\s*-----BEGIN CERTIFICATE-----$', 
+            '\s*-----END CERTIFICATE-----$',
+            certfile))]
+
+    # walk through the file, beginning a diversion when a start regexp
+    # matches until the end regexp matches.  While in the two regexps,
+    # print each line to the open diversion file (including the two
+    # matches).
+    active = None
+    f = open(cert, 'r')
+    for l in f:
+        if active:
+            if active.end.match(l):
+                print >>active.f, l,
+                active = None
+        else:
+            for d in divs:
+                if d.start.match(l):
+                    active = d
+                    break
+        if active: print >>active.f, l,
+
+    # This is probably unnecessary.  Close all the diversion files.
+    for d in divs: d.close()
+    return keyfile, certfile
+
 def find_pickle_problem(o, st=None):
     """