summaryrefslogtreecommitdiffstats
path: root/ipalib/rpc.py
Commit message (Collapse)AuthorAgeFilesLines
* Prevent churn on ccachesSimo Sorce2017-03-281-1/+16
| | | | | | | | | | | | | | | | | | | | We slice down the received cookie so that just the content that matter is preserved. Thi is ok because servers can't trust anything else anyway and will accept a cookie with the ancillary data missing. By removing variable parts like the expiry component added by mod_session or the Expiration or Max-Age metadata we keep only the part of the cookie that changes only when a new session is generated. This way when storing the cookie we actually add a new entry in the ccache only when the session actually changes, and this prevents churn on FILE based ccaches. Related https://pagure.io/freeipa/issue/6775 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Handle failed authentication via cookieSimo Sorce2017-03-281-20/+32
| | | | | | | | | | | | | | If cookie authentication fails and we get back a 401 see if we tried a SPNEGO auth by checking if we had a GSSAPI context. If not it means our session cookie was invalid or expired or some other error happened on the server that requires us to try a full SPNEGO handshake, so go ahead and try it. Fixes https://pagure.io/freeipa/issue/6775 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add debug logging for keep-aliveChristian Heimes2017-03-201-1/+20
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Use connection keep-aliveChristian Heimes2017-03-201-1/+1
| | | | | | | | | | | | | Do not forcefully close the connection after every request. This enables HTTP connection keep-alive, also known as persistent TCP and TLS/SSL connection. Keep-alive speed up consecutive HTTP requests by 15% (for local, low-latency network connections to a fast server) to multiple times (high latency connections or remote peers). https://pagure.io/freeipa/issue/6641 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Add debug log in case cookie retrieval went wrongStanislav Laznicka2017-03-201-1/+4
| | | | | | https://pagure.io/freeipa/issue/6774 Reviewed-By: Martin Basti <mbasti@redhat.com>
* rpc: fix crash in verbose modeJan Cholasta2017-03-131-5/+6
| | | | | | | | | | Fix a crash caused by feeding incorrect data to `json.dumps()` in `JSONServerProxy.__request()` introduced by commit 8159c2883bf66980582d1227c364df4e592bdd7e. https://pagure.io/freeipa/issue/6734 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Store session cookie in a ccache optionSimo Sorce2017-03-101-22/+5
| | | | | | | | | | | Instead of using the kernel keyring, store the session cookie within the ccache. This way kdestroy will really wipe away all credentials. Ticket: https://pagure.io/freeipa/issue/6661 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix cookie with Max-Age processingStanislav Laznicka2017-03-061-4/+8
| | | | | | | | | | When cookie has Max-Age set it tries to get expiration by adding to a timestamp. Without this patch the timestamp would be set to None and thus the addition of timestamp + max_age fails https://pagure.io/freeipa/issue/6718 Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Remove NSSConnection from the Python RPC moduleStanislav Laznicka2017-03-011-56/+14
| | | | | | | | | | | | | | | | | | | | NSSConnection was causing a lot of trouble in the past and there is a lot of logic around it just to make it not fail. What's more, when using NSS to create an SSL connection in FIPS mode, NSS always requires database password which makes the `ipa` command totally unusable. NSSConnection is therefore replaced with Python's httplib.HTTPSConnection which is OpenSSL based. The HTTPSConnection is set up to handle authentication with client certificate for connections to Dogtag server as RA agent. It allows to handle client cert/private key in separate files and also encrypted private key files. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Explain more performance tricks in doc stringChristian Heimes2017-02-151-2/+5
| | | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Pretty print JSON in debug mode (debug level >= 2)Christian Heimes2017-02-151-43/+57
| | | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Convert list to tuplesChristian Heimes2017-02-151-1/+5
| | | | | | | | | Some tests assume that JSON deserializier returns tuples instead of lists. I don't think it is necessary but let's pass the tests for now. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Faster JSON encoder/decoderChristian Heimes2017-02-151-79/+132
| | | | | | | | | | | | | | | | | | Improve performance of FreeIPA's JSON serializer and deserializer. * Don't indent and sort keys. Both options trigger a slow path in Python's json package. Without indention and sorting, encoding mostly happens in optimized C code. * Replace O(n) type checks with O(1) type lookup and eliminate the use of isinstance(). * Check each client capability only once for every conversion. * Use decoder's obj_hook feature to traverse the object tree once and to eliminate calls to isinstance(). Closes: https://fedorahosted.org/freeipa/ticket/6655 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Insure removal of session on identity changeSimo Sorce2017-02-151-0/+6
| | | | | | | | | | | If we are changing identiy (different principal) insure we remove the session cookie stored on the rpc context so that we do not mistakenly connect with the previous identity credentials. https://fedorahosted.org/freeipa/ticket/6543 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow rpc callers to pass ccache and service namesSimo Sorce2017-02-151-6/+14
| | | | | | | | | | This allows code to use multiple ccaches without having to muck with the process global environment variables (KRB5CCNAME). https://fedorahosted.org/freeipa/ticket/6543 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: send Decimal number as string instead of base64 encoded valueMartin Basti2017-02-081-1/+1
| | | | | | | | | | | | | | | for Decimal only from client to server direction uses __base64__ notation. Server replies with pure string for Decimal data, and also server is able to parse string and create decimal values where needed. without this we need ugly py3 code: - return {'__base64__': base64.b64encode(str(val))} + return {'__base64__': base64.b64encode( + str(val).encode('ascii')).decode('ascii')} https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix reference before assignmentFraser Tweedale2017-02-061-0/+1
| | | | | | | | | | In 'store_session_cookie', if the server does not set the session cookie for some reason, the 'session_cookie' variable does not get assigned, resulting in UnboundLocalError. Set an initial value of 'None'. Fixes: https://fedorahosted.org/freeipa/ticket/6636 Reviewed-By: Martin Basti <mbasti@redhat.com>
* py3: decode bytes for json.loads()Martin Basti2017-01-241-1/+2
| | | | | | | | | | | | In py 3.5 json.loads requires to have string as input, all bytes must be decoded. Note: python 3.6 supports bytes for json.loads() https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add compatibility code to retrieve headersSimo Sorce2016-12-141-1/+5
| | | | | | | | | | Python3 removed the getheaders() function and replaced it with a get_all() one. Add compat code. https://fedorahosted.org/freeipa/ticket/6558 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Properly handle multiple cookies in rpc lib.Simo Sorce2016-12-081-3/+11
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Properly handle multiple cookies in rpcclientSimo Sorce2016-12-081-1/+1
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Python3 pylint fixesChristian Heimes2016-11-251-0/+2
| | | | | | | | | | | Sprinkle 'pylint disable' comments over the code base to silence a bunch of pylint warnings on Python 3. All silenced warnings are harmless and not bugs. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix error message encodingSimo Sorce2016-10-251-1/+2
| | | | | | | | | - Use the correct unicode string for an error message, otherwise an exception will generate another exception about incorrect type, masking the original error. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* pylint: enable the import-error checkJan Cholasta2016-10-241-0/+1
| | | | | | | | | | Check for import errors with pylint to make sure new python package dependencies are not overlooked. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Pylint: fix the rest of unused local variablesMartin Basti2016-10-111-9/+7
| | | | Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Pylint: enable check for unused-variablesMartin Basti2016-09-271-0/+2
| | | | | | | | | | | | | | | Unused variables may: * make code less readable * create dead code * potentialy hide issues/errors Enabled check should prevent to leave unused variable in code Check is locally disabled for modules that fix is not clear or easy or have too many occurences of unused variables Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipalib: introduce Principal parameterMartin Babinsky2016-07-011-0/+6
| | | | | | | | | | | This patch introduces a separate Principal parameter that allows the framework to syntactically validate incoming/outcoming principals by using a single shared codebase. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* rpc: do not validate command name in RPCClient.forwardJan Cholasta2016-06-031-4/+0
| | | | | | | | | | | The validation is already done on the server. This allows manually forwarding commands unknown to the client but known to the server. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: optimize JSON-RPC response handlingJan Cholasta2016-06-031-3/+3
| | | | | | | | | | Speed up JSON-RPC response handling by putting received response data fragments in a list and joining them at once instead of concatenating each fragment one by one. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: allow overriding NSS DB directory in API configJan Cholasta2016-06-031-5/+4
| | | | | | | | | Add new `nss_dir` API config option to allow rpcclient to use a non-default NSS DB for the connection. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: respect API config in RPCClient.create_connectionJan Cholasta2016-06-031-2/+8
| | | | | | | | | | When connecting rpcclient, get the default values of the `verbose`, `fallback` and `delegate` options from API config rather than hard-code them. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* dns: move code shared by client and server to separate moduleJan Cholasta2016-06-031-0/+2
| | | | | | | | Move the shared code to a new ipalib.dns module. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: include structured error information in responsesJan Cholasta2016-05-251-1/+3
| | | | | | | | | | | | | | Include keyword arguments of exceptions in RPC responses. This is limited to JSON-RPC, as XML-RPC does not support additional data in error responses. Include keyword arguments of messages in RPC responses. Include keyword arguments of exceptions in batch command result. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: do not crash when unable to parse JSONJan Cholasta2016-05-251-1/+1
| | | | | | | | | When unable to parse JSON response from the server, properly raise JSONError not to cause a crash. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib.rpc: Send base64-encoded data as string under Python 3Petr Viktorin2016-05-051-1/+4
| | | | | | | | | | Python 3's JSON library cannot deal with bytes, so decode base64-encoded data to string. Part of the work for https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix bytes/string handling in rpcMichael Simacek2016-02-171-7/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove unused importsMartin Basti2015-12-231-1/+0
| | | | | | | This patch removes unused imports, alse pylint has been configured to check unused imports. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* silence pylint in Python 3-specific portion of ipalib/rpc.pyMartin Babinsky2015-10-271-1/+1
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipalib.rpc: Update for Python 3Petr Viktorin2015-10-271-6/+29
| | | | | | | | The client XML-RPC implementation is tied to rpclib internals, so with a change in Python it needs to be updated. And rpclib changed in Python 3. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipapython.nsslib: Remove NSSHTTPSPetr Viktorin2015-10-271-1/+1
| | | | | | This workaround is unused in Python 2.7+. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipapython.nsslib, ipalib.rpc: Remove code for Python 2.6 and belowPetr Viktorin2015-10-271-21/+12
| | | | | | IPA hasn't supported these pythons for a while now. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix more bytes/unicode issuesPetr Viktorin2015-10-221-2/+2
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* rpc: Name argument to KerberosErrorPetr Viktorin2015-10-131-1/+1
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Remove uses of the `types` modulePetr Viktorin2015-10-071-3/+2
| | | | | | | | | | | In Python 3, the types module no longer provide alternate names for built-in types, e.g. `types.StringType` can just be spelled `str`. NoneType is also removed; it needs to be replaced with type(None) Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use six.moves.xmlrpc.client instead of xmlrpclibPetr Viktorin2015-10-071-22/+30
| | | | | | | | The module is renamed to xmlrpc.client in Python 3. Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use six.moves.urllib instead of urllib/urllib2/urlparsePetr Viktorin2015-10-071-6/+7
| | | | | | | | In Python 3, these modules are reorganized. Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* rpc: Don't use undocumented urllib functionsPetr Viktorin2015-10-071-3/+4
| | | | | | | | | | | | The "splittype" and "splithost" functions in urllib.parse are undocumented and reserved for internal use, see http://bugs.python.org/issue11009 Use urlsplit instead. Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Rewrap errors in get_principal to CCacheErrorMichael Simacek2015-09-221-4/+6
| | | | | | | | | Causes nicer error message when kerberos credentials are not available. https://fedorahosted.org/freeipa/ticket/5272 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Use bytes instead of str where appropriateJan Cholasta2015-09-171-3/+3
| | | | | | Under Python 2, "str" and "bytes" are synonyms. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Alias "unicode" to "str" under Python 3Jan Cholasta2015-09-171-0/+3
| | | | | | | | | The six way of doing this is to replace all occurences of "unicode" with "six.text_type". However, "unicode" is non-ambiguous and (arguably) easier to read. Also, using it makes the patches smaller, which should help with backporting. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-01 12:33:24 +0000