freeipa/make-lint

247 lines
8.8 KiB
Plaintext
Raw Normal View History

#!/usr/bin/python
#
# Authors:
# Jakub Hrozek <jhrozek@redhat.com>
# Jan Cholasta <jcholast@redhat.com>
#
# Copyright (C) 2011 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
import os
import sys
from optparse import OptionParser
from fnmatch import fnmatch, fnmatchcase
try:
from pylint import checkers
from pylint.lint import PyLinter
from pylint.reporters.text import ParseableTextReporter
from pylint.checkers.typecheck import TypeChecker
from logilab.astng import Class, Instance, InferenceError
except ImportError:
print >> sys.stderr, "To use {0}, please install pylint.".format(sys.argv[0])
sys.exit(32)
# File names to ignore when searching for python source files
IGNORE_FILES = ('.*', '*~', '*.in', '*.pyc', '*.pyo')
IGNORE_PATHS = ('build', 'rpmbuild', 'dist', 'install/po/test_i18n.py', 'lite-server.py',
'make-lint', 'make-test', 'tests')
class IPATypeChecker(TypeChecker):
# 'class': ('generated', 'properties',)
ignore = {
'ipalib.base.NameSpace': ['find'],
'ipalib.cli.Collector': ['__options'],
'ipalib.config.Env': ['*'],
'ipalib.plugable.API': ['Command', 'Object', 'Method', 'Property',
'Backend', 'log', 'plugins'],
'ipalib.plugable.Plugin': ['Command', 'Object', 'Method', 'Property',
'Backend', 'env', 'debug', 'info', 'warning', 'error', 'critical',
'exception', 'context', 'log'],
'ipalib.plugins.misc.env': ['env'],
'ipalib.parameters.Param': ['cli_name', 'cli_short_name', 'label',
'doc', 'required', 'multivalue', 'primary_key', 'normalizer',
'default', 'default_from', 'autofill', 'query', 'attribute',
'include', 'exclude', 'flags', 'hint', 'alwaysask', 'sortorder',
'csv', 'csv_separator', 'csv_skipspace'],
'ipalib.parameters.Bool': ['truths', 'falsehoods'],
'ipalib.parameters.Int': ['minvalue', 'maxvalue'],
'ipalib.parameters.Decimal': ['minvalue', 'maxvalue', 'precision'],
'ipalib.parameters.Data': ['minlength', 'maxlength', 'length',
'pattern', 'pattern_errmsg'],
'ipalib.parameters.Enum': ['values'],
'ipalib.parameters.File': ['stdin_if_missing'],
'urlparse.SplitResult': ['netloc'],
'ipaserver.rpcserver.KerberosSession' : ['api', 'log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipaserver.rpcserver.HTTP_Status' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
add session manager and cache krb auth This patch adds a session manager and support for caching authentication in the session. Major elements of the patch are: * Add a session manager to support cookie based sessions which stores session data in a memcached entry. * Add ipalib/krb_utils.py which contains functions to parse ccache names, format principals, format KRB timestamps, and a KRB_CCache class which reads ccache entry and allows one to extract information such as the principal, credentials, credential timestamps, etc. * Move krb constants defined in ipalib/rpc.py to ipa_krb_utils.py so that all kerberos items are co-located. * Modify javascript in ipa.js so that the IPA.command() RPC call checks for authentication needed error response and if it receives it sends a GET request to /ipa/login URL to refresh credentials. * Add session_auth_duration config item to constants.py, used to configure how long a session remains valid. * Add parse_time_duration utility to ipalib/util.py. Used to parse the session_auth_duration config item. * Update the default.conf.5 man page to document session_auth_duration config item (also added documentation for log_manager config items which had been inadvertantly omitted from a previous commit). * Add SessionError object to ipalib/errors.py * Move Kerberos protection in Apache config from /ipa to /ipa/xml and /ipa/login * Add SessionCCache class to session.py to manage temporary Kerberos ccache file in effect for the duration of an RPC command. * Adds a krblogin plugin used to implement the /ipa/login handler. login handler sets the session expiration time, currently 60 minutes or the expiration of the TGT, whichever is shorter. It also copies the ccache provied by mod_auth_kerb into the session data. The json handler will later extract and validate the ccache belonging to the session. * Refactored the WSGI handlers so that json and xlmrpc could have independent behavior, this also moves where create and destroy context occurs, now done in the individual handler rather than the parent class. * The json handler now looks up the session data, validates the ccache bound to the session, if it's expired replies with authenicated needed error. * Add documentation to session.py. Fully documents the entire process, got questions, read the doc. * Add exclusions to make-lint as needed.
2012-02-06 12:29:56 -06:00
'ipalib.krb_utils.KRB5_CCache' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
Tweak the session auth to reflect developer consensus. * Increase the session ID from 48 random bits to 128. * Implement the sesison_logout RPC command. It permits the UI to send a command that destroys the users credentials in the current session. * Restores the original web URL's and their authentication protections. Adds a new URL for sessions /ipa/session/json. Restores the original Kerberos auth which was for /ipa and everything below. New /ipa/session/json URL is treated as an exception and turns all authenticaion off. Similar to how /ipa/ui is handled. * Refactor the RPC handlers in rpcserver.py such that there is one handler per URL, specifically one handler per RPC and AuthMechanism combination. * Reworked how the URL names are used to map a URL to a handler. Previously it only permitted one level in the URL path hierarchy. We now dispatch on more that one URL path component. * Renames the api.Backend.session object to wsgi_dispatch. The use of the name session was historical and is now confusing since we've implemented sessions in a different location than the api.Backend.session object, which is really a WSGI dispatcher, hence the new name wsgi_dispatch. * Bullet-proof the setting of the KRB5CCNAME environment variable. ldap2.connect already sets it via the create_context() call but just in case that's not called or not called early enough (we now have other things besides ldap which need the ccache) we explicitly set it early as soon as we know it. * Rework how we test for credential validity and expiration. The previous code did not work with s4u2proxy because it assumed the existance of a TGT. Now we first try ldap credentials and if we can't find those fallback to the TGT. This logic was moved to the KRB5_CCache object, it's an imperfect location for it but it's the only location that makes sense at the moment given some of the current code limitations. The new methods are KRB5_CCache.valid() and KRB5_CCache.endtime(). * Add two new classes to session.py AuthManager and SessionAuthManager. Their purpose is to emit authication events to interested listeners. At the moment the logout event is the only event, but the framework should support other events as they arise. * Add BuildRequires python-memcached to freeipa.spec.in * Removed the marshaled_dispatch method, it was cruft, no longer referenced. https://fedorahosted.org/freeipa/ticket/2362
2012-02-15 09:26:42 -06:00
'ipalib.session.AuthManager' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipalib.session.SessionAuthManager' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
add session manager and cache krb auth This patch adds a session manager and support for caching authentication in the session. Major elements of the patch are: * Add a session manager to support cookie based sessions which stores session data in a memcached entry. * Add ipalib/krb_utils.py which contains functions to parse ccache names, format principals, format KRB timestamps, and a KRB_CCache class which reads ccache entry and allows one to extract information such as the principal, credentials, credential timestamps, etc. * Move krb constants defined in ipalib/rpc.py to ipa_krb_utils.py so that all kerberos items are co-located. * Modify javascript in ipa.js so that the IPA.command() RPC call checks for authentication needed error response and if it receives it sends a GET request to /ipa/login URL to refresh credentials. * Add session_auth_duration config item to constants.py, used to configure how long a session remains valid. * Add parse_time_duration utility to ipalib/util.py. Used to parse the session_auth_duration config item. * Update the default.conf.5 man page to document session_auth_duration config item (also added documentation for log_manager config items which had been inadvertantly omitted from a previous commit). * Add SessionError object to ipalib/errors.py * Move Kerberos protection in Apache config from /ipa to /ipa/xml and /ipa/login * Add SessionCCache class to session.py to manage temporary Kerberos ccache file in effect for the duration of an RPC command. * Adds a krblogin plugin used to implement the /ipa/login handler. login handler sets the session expiration time, currently 60 minutes or the expiration of the TGT, whichever is shorter. It also copies the ccache provied by mod_auth_kerb into the session data. The json handler will later extract and validate the ccache belonging to the session. * Refactored the WSGI handlers so that json and xlmrpc could have independent behavior, this also moves where create and destroy context occurs, now done in the individual handler rather than the parent class. * The json handler now looks up the session data, validates the ccache bound to the session, if it's expired replies with authenicated needed error. * Add documentation to session.py. Fully documents the entire process, got questions, read the doc. * Add exclusions to make-lint as needed.
2012-02-06 12:29:56 -06:00
'ipalib.session.SessionManager' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipalib.session.SessionCCache' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipalib.session.MemcacheSessionManager' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipapython.admintool.AdminTool' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
}
def _related_classes(self, klass):
yield klass
for base in klass.ancestors():
yield base
def _class_full_name(self, klass):
return klass.root().name + '.' + klass.name
def _find_ignored_attrs(self, owner):
attrs = []
for klass in self._related_classes(owner):
name = self._class_full_name(klass)
if name in self.ignore:
attrs += self.ignore[name]
return attrs
def visit_getattr(self, node):
try:
inferred = list(node.expr.infer())
except InferenceError:
inferred = []
for owner in inferred:
if not isinstance(owner, Class) and type(owner) is not Instance:
continue
ignored = self._find_ignored_attrs(owner)
for pattern in ignored:
if fnmatchcase(node.attrname, pattern):
return
super(IPATypeChecker, self).visit_getattr(node)
class IPALinter(PyLinter):
ignore = (TypeChecker,)
def __init__(self):
super(IPALinter, self).__init__()
self.missing = set()
def register_checker(self, checker):
if type(checker) in self.ignore:
return
super(IPALinter, self).register_checker(checker)
def add_message(self, msg_id, line=None, node=None, args=None):
if line is None and node is not None:
line = node.fromlineno
# Record missing packages
if msg_id == 'F0401' and self.is_message_enabled(msg_id, line):
self.missing.add(args)
super(IPALinter, self).add_message(msg_id, line, node, args)
def find_files(path, basepath):
entries = os.listdir(path)
# If this directory is a python package, look no further
if '__init__.py' in entries:
return [path]
result = []
for filename in entries:
filepath = os.path.join(path, filename)
for pattern in IGNORE_FILES:
if fnmatch(filename, pattern):
filename = None
break
if filename is None:
continue
for pattern in IGNORE_PATHS:
patpath = os.path.join(basepath, pattern).replace(os.sep, '/')
if filepath == patpath:
filename = None
break
if filename is None:
continue
if os.path.islink(filepath):
continue
# Recurse into subdirectories
if os.path.isdir(filepath):
result += find_files(filepath, basepath)
continue
# Add all *.py files
if filename.endswith('.py'):
result.append(filepath)
continue
# Add any other files beginning with a shebang and having
# the word "python" on the first line
file = open(filepath, 'r')
line = file.readline(128)
file.close()
if line[:2] == '#!' and line.find('python') >= 0:
result.append(filepath)
return result
def main():
optparser = OptionParser()
optparser.add_option('--no-fail', help='report success even if errors were found',
dest='fail', default=True, action='store_false')
optparser.add_option('--enable-noerror', help='enable warnings and other non-error messages',
dest='errors_only', default=True, action='store_false')
options, args = optparser.parse_args()
cwd = os.getcwd()
if len(args) == 0:
files = find_files(cwd, cwd)
else:
files = args
for filename in files:
dirname = os.path.dirname(filename)
if dirname not in sys.path:
sys.path.insert(0, dirname)
linter = IPALinter()
checkers.initialize(linter)
linter.register_checker(IPATypeChecker(linter))
if options.errors_only:
linter.disable_noerror_messages()
linter.enable('F')
linter.set_reporter(ParseableTextReporter())
linter.set_option('include-ids', True)
linter.set_option('reports', False)
linter.set_option('persistent', False)
linter.check(files)
if linter.msg_status != 0:
print >> sys.stderr, """
===============================================================================
Errors were found during the static code check.
"""
if len(linter.missing) > 0:
print >> sys.stderr, "There are some missing imports:"
for mod in sorted(linter.missing):
print >> sys.stderr, " " + mod
print >> sys.stderr, """
Please make sure all of the required and optional (python-krbV, python-rhsm)
python packages are installed.
"""
print >> sys.stderr, """\
If you are certain that any of the reported errors are false positives, please
mark them in the source code according to the pylint documentation.
===============================================================================
"""
if options.fail:
return linter.msg_status
else:
return 0
if __name__ == "__main__":
sys.exit(main())