Changeset b3c4896 for fedd/federation

Timestamp:

Jul 8, 2011 6:30:39 PM (13 years ago)

Author:

Ted Faber <faber@…>

Branches:

axis_example, compt_changes, info-ops, master

Children:

0c9393e

Parents:

cedf721 (diff), e15435c (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent.

Message:

Merge branch 'axis_example' of ​git://fedd.deterlab.net/fedd into axis_example

Location:

fedd/federation

Files:

• remote_service.py (modified) (3 diffs)
• util.py (modified) (5 diffs)

fedd/federation/remote_service.py

@@ -30 +30 @@
     fedd_internal_services = fedd_internal_client
     service_port_name = 'getfeddPort'
-    internal_service_port_name = 'getfedd_internalPort'
-
+    internal_service_port_name = 'getfedd_internal_port'
 from util import fedd_ssl_context
 from fedid import fedid
@@ -61 +60 @@
     # A map used to convert fedid fields to fedid objects (when the field is
     # already a string)
-    fedid_to_object = ( ('fedid', lambda x: fedid(bits=x)),)
+    fedid_to_object = {'fedid': lambda x: fedid(bits=x)}
     # A map used by apply_to_tags to convert fedids from xmlrpclib.Binary
     # objects to fedid objects in one sweep.
-    decap_fedids = (('fedid', lambda x: fedid(bits=x.data)),)
+    decap_fedids = {'fedid': lambda x: fedid(bits=x.data), 
+            'credential': lambda x: x.data}
     # A map used to encapsulate fedids into xmlrpclib.Binary objects
-    encap_fedids = (('fedid', to_binary),)
+    encap_fedids = {'fedid': to_binary, 'credential': to_binary}
 
     # fields that are never unicoded, because they represent non strings.
@@ -142 +142 @@
         if isinstance(e, dict):
             for k in e.keys():
-                for tag, fcn in map:
-                    if k == tag:
-                        if isinstance(e[k], list):
-                            e[k] = [ fcn(b) for b in e[k]]
-                        else:
-                            e[k] = fcn(e[k])
-                    elif isinstance(e[k], dict):
-                        remote_service_base.apply_to_tags(e[k], map)
-                    elif isinstance(e[k], list):
-                        for ee in e[k]:
-                            remote_service_base.apply_to_tags(ee, map)
+                if k in map:
+                    fcn = map[k]
+                    if isinstance(e[k], list):
+                        e[k] = [ fcn(b) for b in e[k]]
+                    else:
+                        e[k] = fcn(e[k])
+                elif isinstance(e[k], dict):
+                    remote_service_base.apply_to_tags(e[k], map)
+                elif isinstance(e[k], list):
+                    for ee in e[k]:
+                        remote_service_base.apply_to_tags(ee, map)
         # Other types end the recursion - they should be leaves
         return e

fedd/federation/util.py

@@ -19 +19 @@
 from service_error import service_error
 from urlparse import urlparse
+from M2Crypto import m2
 
 
@@ -27 +28 @@
 if not getattr(SSL.cb, 'ssl_verify_callback_allow_unknown_ca', None):
     from M2Crypto.SSL.Context import map
-    from M2Crypto import m2
-
-    def ssl_verify_callback(ssl_ctx_ptr, x509_ptr, errnum, errdepth, ok):
+
+    def fedd_ssl_verify_callback(ssl_ctx_ptr, x509_ptr, errnum, errdepth, ok):
         unknown_issuer = [
             m2.X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY,
@@ -36 +36 @@
             m2.X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT
             ]
+        # m2.X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN should also be allowed
+        if getattr(m2, 'X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN', None):
+            unknown_issuer.append(getattr(m2, 
+                'X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN', None))
         ssl_ctx = map()[ssl_ctx_ptr]
 
@@ -49 +53 @@
         return ok
 else:
-    def ssl_verify_callback(ssl_ctx_ptr, x509_ptr, errnum, errdepth, ok):
-        raise ValueError("This should never be called")
+    def fedd_ssl_verify_callback(ok, store):
+        '''
+        m2.X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN should also be allowed
+        '''
+        errnum = store.get_error()
+        if errnum == m2.X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
+            ok = 1
+            return ok
+        else:
+            return SSL.cb.ssl_verify_callback_allow_unknown_ca(ok, store)
 
 class fedd_ssl_context(SSL.Context):
@@ -89 +101 @@
             self.set_verify(SSL.verify_peer, 10)
         else:
-            # More legacy code.  Recent versions of M2Crypto express the
-            # allow_unknown_ca option through a callback turned to allow it.
-            # Older versions use a standard callback that respects the
-            # attribute.  This should work under both regines.
-            callb = getattr(SSL.cb, 'ssl_verify_callback_allow_unknown_ca', 
-                    ssl_verify_callback)
+            # Install the proper callback to allow self-signed certs
             self.set_allow_unknown_ca(True)
-            self.set_verify(SSL.verify_peer, 10, callback=callb)
+            self.set_verify(SSL.verify_peer, 10, 
+                    callback=fedd_ssl_verify_callback)
 
 class file_expanding_opts(OptionParser):