summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRobin Norwood <rnorwood@redhat.com>2007-09-25 10:38:51 -0400
committerRobin Norwood <rnorwood@redhat.com>2007-09-25 10:38:51 -0400
commit6bf3d8bee599802c95832cbdae904ffce1053938 (patch)
tree6711d28ed442ffbe5fddfdc6ccd1678ec05aa74c
parent5024f7f62ff32345660fae783ac7a97d506fe1da (diff)
parentfca2c8e36dfec0ced3957ba8f6e62bf62a99c84b (diff)
downloadthird_party-func-6bf3d8bee599802c95832cbdae904ffce1053938.tar.gz
third_party-func-6bf3d8bee599802c95832cbdae904ffce1053938.tar.xz
third_party-func-6bf3d8bee599802c95832cbdae904ffce1053938.zip
Merge branch 'master' of git+ssh://git.fedoraproject.org/git/hosted/func
Conflicts: func.spec setup.py
-rw-r--r--client/sslclient.py44
-rw-r--r--func.spec4
-rw-r--r--func/CommonErrors.py62
-rw-r--r--func/SSLCommon.py122
-rw-r--r--func/SSLConnection.py161
-rw-r--r--server/AuthedXMLRPCServer.py144
-rw-r--r--setup.py11
7 files changed, 541 insertions, 7 deletions
diff --git a/client/sslclient.py b/client/sslclient.py
new file mode 100644
index 0000000..5575deb
--- /dev/null
+++ b/client/sslclient.py
@@ -0,0 +1,44 @@
+#!/usr/bin/python
+
+import os
+import sys
+import xmlrpclib
+import urllib
+
+import SSLCommon
+
+
+class SSL_Transport(xmlrpclib.Transport):
+
+ user_agent = "pyOpenSSL_XMLRPC/%s - %s" % ('0.1', xmlrpclib.Transport.user_agent)
+
+ def __init__(self, ssl_context, timeout=None, use_datetime=0):
+ if sys.version_info[:3] >= (2, 5, 0):
+ xmlrpclib.Transport.__init__(self, use_datetime)
+ self.ssl_ctx=ssl_context
+ self._timeout = timeout
+
+ def make_connection(self, host):
+ # Handle username and password.
+ try:
+ host, extra_headers, x509 = self.get_host_info(host)
+ except AttributeError:
+ # Yay for Python 2.2
+ pass
+ _host, _port = urllib.splitport(host)
+ return SSLCommon.HTTPS(_host, int(_port), ssl_context=self.ssl_ctx, timeout=self._timeout)
+
+
+class SSLXMLRPCServerProxy(xmlrpclib.ServerProxy):
+ def __init__(self, uri, pkey_file, cert_file, ca_cert_file, timeout=None):
+ self.ctx = SSLCommon.CreateSSLContext(pkey_file, cert_file, ca_cert_file)
+ xmlrpclib.ServerProxy.__init__(self, uri, SSL_Transport(ssl_context=self.ctx, timeout=timeout))
+
+
+
+if __name__ == "__main__":
+ s = SSLXMLRPCServerProxy('https://localhost:51234/', '/etc/pki/func/slave.pem', '/etc/pki/func/slave.crt', '/etc/pki/func/ca/funcmaster.crt')
+ f = s.ping(1, 2)
+ print f
+
+ \ No newline at end of file
diff --git a/func.spec b/func.spec
index 004f527..52ec37a 100644
--- a/func.spec
+++ b/func.spec
@@ -35,14 +35,16 @@ rm -fr $RPM_BUILD_ROOT
%files
%{_bindir}/funcd
+%{_bindir}/certmaster
/etc/init.d/funcd
+/etc/init.d/certmaster
%config(noreplace) /etc/func/settings
%dir %{python_sitelib}/func
%dir %{python_sitelib}/func/minion
%dir %{python_sitelib}/func/overlord
%{python_sitelib}/func/minion/*.py*
%{python_sitelib}/func/overlord/*.py*
-
+%{python_sitelib}/func/*.py*
%dir %{python_sitelib}/func/minion/modules
%{python_sitelib}/func/minion/modules/*.py*
%dir /var/log/func
diff --git a/func/CommonErrors.py b/func/CommonErrors.py
new file mode 100644
index 0000000..13ef505
--- /dev/null
+++ b/func/CommonErrors.py
@@ -0,0 +1,62 @@
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Library General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+#
+# Copyright 2005 Dan Williams <dcbw@redhat.com> and Red Hat, Inc.
+
+import socket
+
+
+def canIgnoreSSLError(e):
+ """
+ Identify common network errors that mean we cannot connect to the server
+ """
+
+ # This is a bit complicated by the fact that different versions of
+ # M2Crypto & OpenSSL seem to return different error codes for the
+ # same type of error
+ s = "%s" % e
+ if e[0] == 104: # Connection refused
+ return True
+ elif e[0] == 111: # Connection reset by peer
+ return True
+ elif e[0] == 61: # Connection refused
+ return True
+ elif e[0] == 54: # Connection reset by peer
+ return True
+ elif s == "no certificate returned":
+ return True
+ elif s == "wrong version number":
+ return True
+ elif s == "unexpected eof":
+ return True
+
+ return False
+
+
+def canIgnoreSocketError(e):
+ """
+ Identify common network errors that mean we cannot connect to the server
+ """
+
+ try:
+ if e[0] == 111: # Connection refused
+ return True
+ elif e[0] == 104: # Connection reset by peer
+ return True
+ elif e[0] == 61: # Connection refused
+ return True
+ except IndexError:
+ return True
+
+ return False
diff --git a/func/SSLCommon.py b/func/SSLCommon.py
new file mode 100644
index 0000000..bdfd719
--- /dev/null
+++ b/func/SSLCommon.py
@@ -0,0 +1,122 @@
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Library General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+#
+# Copyright 2005 Dan Williams <dcbw@redhat.com> and Red Hat, Inc.
+
+import os, sys
+import CommonErrors
+from OpenSSL import SSL
+import SSLConnection
+import httplib
+import socket
+import SocketServer
+
+def our_verify(connection, x509, errNum, errDepth, preverifyOK):
+ # print "Verify: errNum = %s, errDepth = %s, preverifyOK = %s" % (errNum, errDepth, preverifyOK)
+
+ # preverifyOK should tell us whether or not the client's certificate
+ # correctly authenticates against the CA chain
+ return preverifyOK
+
+
+def CreateSSLContext(pkey, cert, ca_cert):
+ for f in pkey, cert, ca_cert:
+ if f and not os.access(f, os.R_OK):
+ print "%s does not exist or is not readable." % f
+ os._exit(1)
+
+ ctx = SSL.Context(SSL.SSLv3_METHOD) # SSLv3 only
+ ctx.use_certificate_file(cert)
+ ctx.use_privatekey_file(pkey)
+ ctx.load_client_ca(ca_cert)
+ ctx.load_verify_locations(ca_cert)
+ verify = SSL.VERIFY_PEER | SSL.VERIFY_FAIL_IF_NO_PEER_CERT
+ ctx.set_verify(verify, our_verify)
+ ctx.set_verify_depth(10)
+ ctx.set_options(SSL.OP_NO_SSLv2 | SSL.OP_NO_TLSv1)
+ return ctx
+
+
+
+class BaseServer(SocketServer.TCPServer):
+ allow_reuse_address = 1
+
+ def __init__(self, server_addr, req_handler):
+ self._quit = False
+ self.allow_reuse_address = 1
+ SocketServer.TCPServer.__init__(self, server_addr, req_handler)
+
+ def stop(self):
+ self._quit = True
+
+ def serve_forever(self):
+ while not self._quit:
+ self.handle_request()
+ self.server_close()
+
+
+class BaseSSLServer(BaseServer):
+ """ SSL-enabled variant """
+
+ def __init__(self, server_address, req_handler, pkey, cert, ca_cert, timeout=None):
+ self._timeout = timeout
+ self.ssl_ctx = CreateSSLContext(pkey, cert, ca_cert)
+
+ BaseServer.__init__(self, server_address, req_handler)
+
+ sock = socket.socket(self.address_family, self.socket_type)
+ con = SSL.Connection(self.ssl_ctx, sock)
+ self.socket = SSLConnection.SSLConnection(con)
+ if sys.version_info[:3] >= (2, 3, 0):
+ self.socket.settimeout(self._timeout)
+ self.server_bind()
+ self.server_activate()
+
+ host, port = self.socket.getsockname()[:2]
+ self.server_name = socket.getfqdn(host)
+ self.server_port = port
+
+
+class HTTPSConnection(httplib.HTTPConnection):
+ "This class allows communication via SSL."
+
+ response_class = httplib.HTTPResponse
+
+ def __init__(self, host, port=None, ssl_context=None, strict=None, timeout=None):
+ httplib.HTTPConnection.__init__(self, host, port, strict)
+ self.ssl_ctx = ssl_context
+ self._timeout = timeout
+
+ def connect(self):
+ sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+ con = SSL.Connection(self.ssl_ctx, sock)
+ self.sock = SSLConnection.SSLConnection(con)
+ if sys.version_info[:3] >= (2, 3, 0):
+ self.sock.settimeout(self._timeout)
+ self.sock.connect((self.host, self.port))
+
+
+class HTTPS(httplib.HTTP):
+ """Compatibility with 1.5 httplib interface
+
+ Python 1.5.2 did not have an HTTPS class, but it defined an
+ interface for sending http requests that is also useful for
+ https.
+ """
+
+ _connection_class = HTTPSConnection
+
+ def __init__(self, host='', port=None, ssl_context=None, strict=None, timeout=None):
+ self._setup(self._connection_class(host, port, ssl_context, strict, timeout))
+
diff --git a/func/SSLConnection.py b/func/SSLConnection.py
new file mode 100644
index 0000000..47529b4
--- /dev/null
+++ b/func/SSLConnection.py
@@ -0,0 +1,161 @@
+#!/usr/bin/python
+#
+# Higher-level SSL objects used by rpclib
+#
+# Copyright (c) 2002 Red Hat, Inc.
+#
+# Author: Mihai Ibanescu <misa@redhat.com>
+# Modifications by Dan Williams <dcbw@redhat.com>
+
+
+from OpenSSL import SSL, crypto
+import os, string, time, socket, select
+
+
+class SSLConnection:
+ """
+ This whole class exists just to filter out a parameter
+ passed in to the shutdown() method in SimpleXMLRPC.doPOST()
+ """
+
+ DEFAULT_TIMEOUT = 20
+
+ def __init__(self, conn):
+ """
+ Connection is not yet a new-style class,
+ so I'm making a proxy instead of subclassing.
+ """
+ self.__dict__["conn"] = conn
+ self.__dict__["close_refcount"] = 0
+ self.__dict__["closed"] = False
+ self.__dict__["timeout"] = self.DEFAULT_TIMEOUT
+
+ def __del__(self):
+ self.__dict__["conn"].close()
+
+ def __getattr__(self,name):
+ return getattr(self.__dict__["conn"], name)
+
+ def __setattr__(self,name, value):
+ setattr(self.__dict__["conn"], name, value)
+
+ def settimeout(self, timeout):
+ if timeout == None:
+ self.__dict__["timeout"] = self.DEFAULT_TIMEOUT
+ else:
+ self.__dict__["timeout"] = timeout
+ self.__dict__["conn"].settimeout(timeout)
+
+ def shutdown(self, how=1):
+ """
+ SimpleXMLRpcServer.doPOST calls shutdown(1),
+ and Connection.shutdown() doesn't take
+ an argument. So we just discard the argument.
+ """
+ self.__dict__["conn"].shutdown()
+
+ def accept(self):
+ """
+ This is the other part of the shutdown() workaround.
+ Since servers create new sockets, we have to infect
+ them with our magic. :)
+ """
+ c, a = self.__dict__["conn"].accept()
+ return (SSLConnection(c), a)
+
+ def makefile(self, mode, bufsize):
+ """
+ We need to use socket._fileobject Because SSL.Connection
+ doesn't have a 'dup'. Not exactly sure WHY this is, but
+ this is backed up by comments in socket.py and SSL/connection.c
+
+ Since httplib.HTTPSResponse/HTTPConnection depend on the
+ socket being duplicated when they close it, we refcount the
+ socket object and don't actually close until its count is 0.
+ """
+ self.__dict__["close_refcount"] = self.__dict__["close_refcount"] + 1
+ return PlgFileObject(self, mode, bufsize)
+
+ def close(self):
+ if self.__dict__["closed"]:
+ return
+ self.__dict__["close_refcount"] = self.__dict__["close_refcount"] - 1
+ if self.__dict__["close_refcount"] == 0:
+ self.shutdown()
+ self.__dict__["conn"].close()
+ self.__dict__["closed"] = True
+
+ def sendall(self, data, flags=0):
+ """
+ - Use select() to simulate a socket timeout without setting the socket
+ to non-blocking mode.
+ - Don't use pyOpenSSL's sendall() either, since it just loops on WantRead
+ or WantWrite, consuming 100% CPU, and never times out.
+ """
+ timeout = self.__dict__["timeout"]
+ con = self.__dict__["conn"]
+ (read, write, excpt) = select.select([], [con], [], timeout)
+ if not con in write:
+ raise socket.timeout((110, "Operation timed out."))
+
+ starttime = time.time()
+ origlen = len(data)
+ sent = -1
+ while len(data):
+ curtime = time.time()
+ if curtime - starttime > timeout:
+ raise socket.timeout((110, "Operation timed out."))
+
+ try:
+ sent = con.send(data, flags)
+ except SSL.SysCallError, e:
+ if e[0] == 32: # Broken Pipe
+ self.close()
+ sent = 0
+ else:
+ raise socket.error(e)
+ except (SSL.WantWriteError, SSL.WantReadError):
+ time.sleep(0.2)
+ continue
+
+ data = data[sent:]
+ return origlen - len(data)
+
+ def recv(self, bufsize, flags=0):
+ """
+ Use select() to simulate a socket timeout without setting the socket
+ to non-blocking mode
+ """
+ timeout = self.__dict__["timeout"]
+ con = self.__dict__["conn"]
+ (read, write, excpt) = select.select([con], [], [], timeout)
+ if not con in read:
+ raise socket.timeout((110, "Operation timed out."))
+
+ starttime = time.time()
+ while True:
+ curtime = time.time()
+ if curtime - starttime > timeout:
+ raise socket.timeout((110, "Operation timed out."))
+
+ try:
+ return con.recv(bufsize, flags)
+ except SSL.ZeroReturnError:
+ return None
+ except SSL.WantReadError:
+ time.sleep(0.2)
+ return None
+
+class PlgFileObject(socket._fileobject):
+ def close(self):
+ """
+ socket._fileobject doesn't actually _close_ the socket,
+ which we want it to do, so we have to override.
+ """
+ try:
+ if self._sock:
+ self.flush()
+ self._sock.close()
+ finally:
+ self._sock = None
+
diff --git a/server/AuthedXMLRPCServer.py b/server/AuthedXMLRPCServer.py
new file mode 100644
index 0000000..f76f325
--- /dev/null
+++ b/server/AuthedXMLRPCServer.py
@@ -0,0 +1,144 @@
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Library General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+#
+# Copyright 2005 Dan Williams <dcbw@redhat.com> and Red Hat, Inc.
+# Modifications by Seth Vidal - 2007
+
+import os, sys
+import socket
+import time
+import SocketServer
+import xmlrpclib
+import SimpleXMLRPCServer
+import SSLCommon
+import OpenSSL
+
+
+
+class AuthedSimpleXMLRPCRequestHandler(SimpleXMLRPCServer.SimpleXMLRPCRequestHandler):
+
+ # For some reason, httplib closes the connection right after headers
+ # have been sent if the connection is _not_ HTTP/1.1, which results in
+ # a "Bad file descriptor" error when the client tries to read from the socket
+ protocol_version = "HTTP/1.1"
+
+ def setup(self):
+ """
+ We need to use socket._fileobject Because SSL.Connection
+ doesn't have a 'dup'. Not exactly sure WHY this is, but
+ this is backed up by comments in socket.py and SSL/connection.c
+ """
+ self.connection = self.request # for doPOST
+ self.rfile = socket._fileobject(self.request, "rb", self.rbufsize)
+ self.wfile = socket._fileobject(self.request, "wb", self.wbufsize)
+
+ def do_POST(self):
+ self.server._this_request = (self.request, self.client_address)
+ try:
+ SimpleXMLRPCServer.SimpleXMLRPCRequestHandler.do_POST(self)
+ except socket.timeout:
+ pass
+ except (socket.error, OpenSSL.SSL.SysCallError), e:
+ print "Error (%s): socket error - '%s'" % (self.client_address, e)
+
+
+class BaseAuthedXMLRPCServer:
+ def __init__(self, address, authinfo_callback=None):
+ self.allow_reuse_address = 1
+ self.logRequests = 1
+ self.authinfo_callback = authinfo_callback
+
+ self.funcs = {}
+ self.instance = None
+
+ def get_authinfo(self, request, client_address):
+ print 'down here'
+ if self.authinfo_callback:
+ return self.authinfo_callback(request, client_address)
+ return None
+
+
+class AuthedSSLXMLRPCServer(BaseAuthedXMLRPCServer, SSLCommon.BaseSSLServer, SimpleXMLRPCServer.SimpleXMLRPCServer):
+ """ Extension to allow more fine-tuned SSL handling """
+
+ def __init__(self, address, pkey, cert, ca_cert, authinfo_callback=None, timeout=None):
+ BaseAuthedXMLRPCServer.__init__(self, address, authinfo_callback)
+ SimpleXMLRPCServer.SimpleXMLRPCServer.__init__(self, address, AuthedSimpleXMLRPCRequestHandler)
+ SSLCommon.BaseSSLServer.__init__(self, address, AuthedSimpleXMLRPCRequestHandler, pkey, cert, ca_cert, timeout=timeout)
+
+
+
+class AuthedXMLRPCServer(BaseAuthedXMLRPCServer, SSLCommon.BaseServer, SimpleXMLRPCServer.SimpleXMLRPCServer):
+
+ def __init__(self, address, authinfo_callback=None):
+ BaseAuthedXMLRPCServer.__init__(self, address, authinfo_callback)
+ SSLCommon.BaseServer.__init__(self, address, AuthedSimpleXMLRPCRequestHandler)
+
+
+###########################################################
+# Testing stuff
+###########################################################
+
+class ReqHandler:
+ def ping(self, callerid, trynum):
+ print 'clearly not'
+ print callerid
+ print trynum
+ return "pong %d / %d" % (callerid, trynum)
+
+class TestServer(AuthedSSLXMLRPCServer):
+ """
+ SSL XMLRPC server that authenticates clients based on their certificate.
+ """
+
+ def __init__(self, address, pkey, cert, ca_cert):
+ AuthedSSLXMLRPCServer.__init__(self, address, pkey, cert, ca_cert, self.auth_cb)
+
+ def _dispatch(self, method, params):
+ if method == 'trait_names' or method == '_getAttributeNames':
+ return dir(self)
+ # if we have _this_request then we get the peer cert from it
+ # handling all the authZ checks in _dispatch() means we don't even call the method
+ # for whatever it wants to do and we have the method name.
+
+ if hasattr(self, '_this_request'):
+ r,a = self._this_request
+ p = r.get_peer_certificate()
+ print dir(p)
+ print p.get_subject()
+ else:
+ print 'no cert'
+
+ return "your mom"
+
+ def auth_cb(self, request, client_address):
+ peer_cert = request.get_peer_certificate()
+ return peer_cert.get_subject().CN
+
+
+if __name__ == '__main__':
+ if len(sys.argv) < 4:
+ print "Usage: python AuthdXMLRPCServer.py key cert ca_cert"
+ sys.exit(1)
+
+ pkey = sys.argv[1]
+ cert = sys.argv[2]
+ ca_cert = sys.argv[3]
+
+ print "Starting the server."
+ server = TestServer(('localhost', 51234), pkey, cert, ca_cert)
+ h = ReqHandler()
+ server.register_instance(h)
+ server.serve_forever()
+
diff --git a/setup.py b/setup.py
index 2049a44..d487a1a 100644
--- a/setup.py
+++ b/setup.py
@@ -10,7 +10,7 @@ NAME = "func"
VERSION = open("version", "r+").read().split()[0]
SHORT_DESC = "%s remote configuration and management api" % NAME
LONG_DESC = """
-A small pluggabe xml-rpc daemon used by %s to implement various web services hooks
+A small pluggable xml-rpc daemon used by %s to implement various web services hooks
""" % NAME
@@ -36,13 +36,12 @@ if __name__ == "__main__":
name="%s" % NAME,
version = VERSION,
author = "Lots",
- author_email = "et-mgmt-tools@redhat.com",
+ author_email = "func-list@redhat.com",
url = "https://hosted.fedoraproject.org/projects/func/",
license = "GPL",
- scripts = ["scripts/funcd",
- ],
+ scripts = ["scripts/funcd", "scripts/certmaster"],
# package_data = { '' : ['*.*'] },
- package_dir = {"%s" % NAME: "",
+ package_dir = {"%s" % NAME: "%s" % NAME,
"%s/minion" % NAME: "minion/",
"%s/minion/modules" % NAME: "modules/",
"%s/overlord" % NAME: "overlord/"
@@ -52,7 +51,7 @@ if __name__ == "__main__":
"%s/overlord" % NAME,
"%s/minion/modules" % NAME
],
- data_files = [(initpath, ["init-scripts/funcd"]),
+ data_files = [(initpath, ["init-scripts/funcd", "init-scripts/certmaster"]),
(etcpath, ["settings",]),
(etcpathdb, []),
(logpath, []),