summaryrefslogtreecommitdiffstats
path: root/ipalib/rpc.py
Commit message (Collapse)AuthorAgeFilesLines
* Fixing translation problemsAleksei Slaikovskii2018-01-311-1/+3
| | | | | | | | | | | | | | | | | | | ipa rpc server did set the LANG environment variable on each request and it was not thread safe which led to unpredictable mixed languages output. Also, there were mistakes regarding setting the Accept-Language HTTP header. Now on each request we're setting the "languages" property in the context thread local variable and client is setting the Accept-Language HTTP header correctly. Also, as the server is caching the schema and the schema can be generated for several languages it's good to store different schema fingerprint for each language separately. pagure: https://pagure.io/freeipa/issue/7238 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* LGTM: Membership test with a non-containerChristian Heimes2018-01-091-8/+12
| | | | | | | | | | | Silence false positive by using isinstance(value, dict). Also clean up and optimize most common cases. https://pagure.io/freeipa/issue/7344 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Fix pylint warnings inconsistent-return-statementsChristian Heimes2017-12-181-1/+1
| | | | | | | | | | Add consistent return to all functions and methods that are covered by tox -e pylint[23]. I haven't checked if return None is always a good idea or if we should rather raise an error. See: https://pagure.io/freeipa/issue/7326 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Use the CA chain file from the RPC contextRob Crittenden2017-12-041-1/+1
| | | | | | | | | | | | | | The value can be passed in the create_connection() call but wasn't used outside that call. It already defaults to api.env.tls_ca_cert so the context.ca_certfile should be used instead so the caller can override the cert chain on a per-connection basis. This may be handy in the future when there is IPA-to-IPA trust, or for IPA-to-IPA migration. https://pagure.io/freeipa/issue/7145 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* parameters: introduce CertificateSigningRequestStanislav Laznicka2017-10-251-0/+5
| | | | | | | | | | Previously, CSRs were handled as a Str parameter which brought trouble to Python 3 because of its more strict type requirements. We introduce a CertificateSigningRequest parameter which allows to use python-cryptography x509.CertificateSigningRequest to represent CSRs in the framework. https://pagure.io/freeipa/issue/7131
* rpc: don't decode cookie_string if it's NoneStanislav Laznicka2017-09-201-0/+2
| | | | | | This removes an ugly debug message from client installation Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* rpc: don't encode bytesStanislav Laznicka2017-08-301-1/+1
| | | | | | | | | bytes.encode() appeared in rpc.py by a mistake, should have been bytes.decode() https://pagure.io/freeipa/issue/4985 Reviewed-By: Felipe Volpone <fbarreto@redhat.com>
* Create a Certificate parameterStanislav Laznicka2017-07-271-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | Up until now, Bytes parameter was used for certificate parameters throughout the framework. However, the Bytes parameter does nothing special for certificates, like validation, so this had to be done for each of the parameters which were supposed to represent a certificate. This commit introduces a special Certificate parameter which takes care of certificate validation so this does not have to be done separately. It also makes sure that the certificates represented by this parameter are always converted to DER format so that we can work with them in a unified manner throughout the framework. This commit also makes it possible to pass bytes directly during instantiation of the Certificate parameter and they are still represented correctly after their conversion in the _convert_scalar() method. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* logging: do not log into the root loggerJan Cholasta2017-07-141-12/+13
| | | | | | | Deprecate `ipa_log_manager.root_logger` and replace all calls to it with module-level logger calls. Reviewed-By: Martin Basti <mbasti@redhat.com>
* logging: remove object-specific loggersJan Cholasta2017-07-141-22/+28
| | | | | | | | | | Remove all object-specific loggers, with the exception of `Plugin.log`, which is now deprecated. Replace affected logger calls with module-level logger calls. Deprecate object-specific loggers in `ipa_log_manager.get_logger`. Reviewed-By: Martin Basti <mbasti@redhat.com>
* session_storage: Correctly handle string/byte typesStanislav Laznicka2017-06-091-1/+4
| | | | | | | | | | In session_storage.py, store_data() stores data as the bytes data type but get_data() is returning a string. Have get_data() return bytes as well. https://pagure.io/freeipa/issue/4985 Reviewed-By: Martin Basti <mbasti@redhat.com>
* rpc: avoid possible recursion in create_connectionStanislav Laznicka2017-06-021-66/+74
| | | | | | | | | | There was a recursion in RPCClient.create_connection() which under rare circumstances would not have an ending condition. This commit removes it and cleans up the code a bit as well. https://pagure.io/freeipa/issue/6796 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* rpc: preparations for recursion fixStanislav Laznicka2017-06-021-10/+17
| | | | | | | | | | | | | Made several improvements to coding style: - same use of KerberosError throughout the module - removed some unused variables - moved code from try-except blocks if it didn't have to be there - preparations for putting most of RPCClient.create_connection() to loop https://pagure.io/freeipa/issue/6796 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Avoid possible endless recursion in RPC callStanislav Laznicka2017-06-021-41/+54
| | | | | | | | | This commit removes recursion in RPCClient.forward() which may lack end condition. https://pagure.io/freeipa/issue/6796 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Prevent churn on ccachesSimo Sorce2017-03-281-1/+16
| | | | | | | | | | | | | | | | | | | | We slice down the received cookie so that just the content that matter is preserved. Thi is ok because servers can't trust anything else anyway and will accept a cookie with the ancillary data missing. By removing variable parts like the expiry component added by mod_session or the Expiration or Max-Age metadata we keep only the part of the cookie that changes only when a new session is generated. This way when storing the cookie we actually add a new entry in the ccache only when the session actually changes, and this prevents churn on FILE based ccaches. Related https://pagure.io/freeipa/issue/6775 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Handle failed authentication via cookieSimo Sorce2017-03-281-20/+32
| | | | | | | | | | | | | | If cookie authentication fails and we get back a 401 see if we tried a SPNEGO auth by checking if we had a GSSAPI context. If not it means our session cookie was invalid or expired or some other error happened on the server that requires us to try a full SPNEGO handshake, so go ahead and try it. Fixes https://pagure.io/freeipa/issue/6775 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add debug logging for keep-aliveChristian Heimes2017-03-201-1/+20
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Use connection keep-aliveChristian Heimes2017-03-201-1/+1
| | | | | | | | | | | | | Do not forcefully close the connection after every request. This enables HTTP connection keep-alive, also known as persistent TCP and TLS/SSL connection. Keep-alive speed up consecutive HTTP requests by 15% (for local, low-latency network connections to a fast server) to multiple times (high latency connections or remote peers). https://pagure.io/freeipa/issue/6641 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Add debug log in case cookie retrieval went wrongStanislav Laznicka2017-03-201-1/+4
| | | | | | https://pagure.io/freeipa/issue/6774 Reviewed-By: Martin Basti <mbasti@redhat.com>
* rpc: fix crash in verbose modeJan Cholasta2017-03-131-5/+6
| | | | | | | | | | Fix a crash caused by feeding incorrect data to `json.dumps()` in `JSONServerProxy.__request()` introduced by commit 8159c2883bf66980582d1227c364df4e592bdd7e. https://pagure.io/freeipa/issue/6734 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Store session cookie in a ccache optionSimo Sorce2017-03-101-22/+5
| | | | | | | | | | | Instead of using the kernel keyring, store the session cookie within the ccache. This way kdestroy will really wipe away all credentials. Ticket: https://pagure.io/freeipa/issue/6661 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix cookie with Max-Age processingStanislav Laznicka2017-03-061-4/+8
| | | | | | | | | | When cookie has Max-Age set it tries to get expiration by adding to a timestamp. Without this patch the timestamp would be set to None and thus the addition of timestamp + max_age fails https://pagure.io/freeipa/issue/6718 Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Remove NSSConnection from the Python RPC moduleStanislav Laznicka2017-03-011-56/+14
| | | | | | | | | | | | | | | | | | | | NSSConnection was causing a lot of trouble in the past and there is a lot of logic around it just to make it not fail. What's more, when using NSS to create an SSL connection in FIPS mode, NSS always requires database password which makes the `ipa` command totally unusable. NSSConnection is therefore replaced with Python's httplib.HTTPSConnection which is OpenSSL based. The HTTPSConnection is set up to handle authentication with client certificate for connections to Dogtag server as RA agent. It allows to handle client cert/private key in separate files and also encrypted private key files. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Explain more performance tricks in doc stringChristian Heimes2017-02-151-2/+5
| | | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Pretty print JSON in debug mode (debug level >= 2)Christian Heimes2017-02-151-43/+57
| | | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Convert list to tuplesChristian Heimes2017-02-151-1/+5
| | | | | | | | | Some tests assume that JSON deserializier returns tuples instead of lists. I don't think it is necessary but let's pass the tests for now. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Faster JSON encoder/decoderChristian Heimes2017-02-151-79/+132
| | | | | | | | | | | | | | | | | | Improve performance of FreeIPA's JSON serializer and deserializer. * Don't indent and sort keys. Both options trigger a slow path in Python's json package. Without indention and sorting, encoding mostly happens in optimized C code. * Replace O(n) type checks with O(1) type lookup and eliminate the use of isinstance(). * Check each client capability only once for every conversion. * Use decoder's obj_hook feature to traverse the object tree once and to eliminate calls to isinstance(). Closes: https://fedorahosted.org/freeipa/ticket/6655 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Insure removal of session on identity changeSimo Sorce2017-02-151-0/+6
| | | | | | | | | | | If we are changing identiy (different principal) insure we remove the session cookie stored on the rpc context so that we do not mistakenly connect with the previous identity credentials. https://fedorahosted.org/freeipa/ticket/6543 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow rpc callers to pass ccache and service namesSimo Sorce2017-02-151-6/+14
| | | | | | | | | | This allows code to use multiple ccaches without having to muck with the process global environment variables (KRB5CCNAME). https://fedorahosted.org/freeipa/ticket/6543 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: send Decimal number as string instead of base64 encoded valueMartin Basti2017-02-081-1/+1
| | | | | | | | | | | | | | | for Decimal only from client to server direction uses __base64__ notation. Server replies with pure string for Decimal data, and also server is able to parse string and create decimal values where needed. without this we need ugly py3 code: - return {'__base64__': base64.b64encode(str(val))} + return {'__base64__': base64.b64encode( + str(val).encode('ascii')).decode('ascii')} https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix reference before assignmentFraser Tweedale2017-02-061-0/+1
| | | | | | | | | | In 'store_session_cookie', if the server does not set the session cookie for some reason, the 'session_cookie' variable does not get assigned, resulting in UnboundLocalError. Set an initial value of 'None'. Fixes: https://fedorahosted.org/freeipa/ticket/6636 Reviewed-By: Martin Basti <mbasti@redhat.com>
* py3: decode bytes for json.loads()Martin Basti2017-01-241-1/+2
| | | | | | | | | | | | In py 3.5 json.loads requires to have string as input, all bytes must be decoded. Note: python 3.6 supports bytes for json.loads() https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add compatibility code to retrieve headersSimo Sorce2016-12-141-1/+5
| | | | | | | | | | Python3 removed the getheaders() function and replaced it with a get_all() one. Add compat code. https://fedorahosted.org/freeipa/ticket/6558 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Properly handle multiple cookies in rpc lib.Simo Sorce2016-12-081-3/+11
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Properly handle multiple cookies in rpcclientSimo Sorce2016-12-081-1/+1
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Python3 pylint fixesChristian Heimes2016-11-251-0/+2
| | | | | | | | | | | Sprinkle 'pylint disable' comments over the code base to silence a bunch of pylint warnings on Python 3. All silenced warnings are harmless and not bugs. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix error message encodingSimo Sorce2016-10-251-1/+2
| | | | | | | | | - Use the correct unicode string for an error message, otherwise an exception will generate another exception about incorrect type, masking the original error. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* pylint: enable the import-error checkJan Cholasta2016-10-241-0/+1
| | | | | | | | | | Check for import errors with pylint to make sure new python package dependencies are not overlooked. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Pylint: fix the rest of unused local variablesMartin Basti2016-10-111-9/+7
| | | | Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Pylint: enable check for unused-variablesMartin Basti2016-09-271-0/+2
| | | | | | | | | | | | | | | Unused variables may: * make code less readable * create dead code * potentialy hide issues/errors Enabled check should prevent to leave unused variable in code Check is locally disabled for modules that fix is not clear or easy or have too many occurences of unused variables Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipalib: introduce Principal parameterMartin Babinsky2016-07-011-0/+6
| | | | | | | | | | | This patch introduces a separate Principal parameter that allows the framework to syntactically validate incoming/outcoming principals by using a single shared codebase. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* rpc: do not validate command name in RPCClient.forwardJan Cholasta2016-06-031-4/+0
| | | | | | | | | | | The validation is already done on the server. This allows manually forwarding commands unknown to the client but known to the server. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: optimize JSON-RPC response handlingJan Cholasta2016-06-031-3/+3
| | | | | | | | | | Speed up JSON-RPC response handling by putting received response data fragments in a list and joining them at once instead of concatenating each fragment one by one. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: allow overriding NSS DB directory in API configJan Cholasta2016-06-031-5/+4
| | | | | | | | | Add new `nss_dir` API config option to allow rpcclient to use a non-default NSS DB for the connection. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: respect API config in RPCClient.create_connectionJan Cholasta2016-06-031-2/+8
| | | | | | | | | | When connecting rpcclient, get the default values of the `verbose`, `fallback` and `delegate` options from API config rather than hard-code them. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* dns: move code shared by client and server to separate moduleJan Cholasta2016-06-031-0/+2
| | | | | | | | Move the shared code to a new ipalib.dns module. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: include structured error information in responsesJan Cholasta2016-05-251-1/+3
| | | | | | | | | | | | | | Include keyword arguments of exceptions in RPC responses. This is limited to JSON-RPC, as XML-RPC does not support additional data in error responses. Include keyword arguments of messages in RPC responses. Include keyword arguments of exceptions in batch command result. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: do not crash when unable to parse JSONJan Cholasta2016-05-251-1/+1
| | | | | | | | | When unable to parse JSON response from the server, properly raise JSONError not to cause a crash. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib.rpc: Send base64-encoded data as string under Python 3Petr Viktorin2016-05-051-1/+4
| | | | | | | | | | Python 3's JSON library cannot deal with bytes, so decode base64-encoded data to string. Part of the work for https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix bytes/string handling in rpcMichael Simacek2016-02-171-7/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-29 01:41:34 +0000