mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-24 08:00:02 -06:00
9269e5d6dd
In summary this patch does: * Follow the defined rules for cookies when: - receiving a cookie (process the attributes) - storing a cookie (store cookie + attributes) - sending a cookie + validate the cookie domain against the request URL + validate the cookie path against the request URL + validate the cookie expiration + if valid then send only the cookie, no attribtues * Modifies how a request URL is stored during a XMLRPC request/response sequence. * Refactors a bit of the request/response logic to allow for making the decision whether to send a session cookie instead of full Kerberous auth easier. * The server now includes expiration information in the session cookie it sends to the client. The server always had the information available to prevent using an expired session cookie. Now that expiration timestamp is returned to the client as well and now the client will not send an expired session cookie back to the server. * Adds a new module and unit test for cookies (see below) Formerly we were always returning the session cookie no matter what the domain or path was in the URL. We were also sending the cookie attributes which are for the client only (used to determine if to return a cookie). The attributes are not meant to be sent to the server and the previous behavior was a protocol violation. We also were not checking the cookie expiration. Cookie library issues: We need a library to create, parse, manipulate and format cookies both in a client context and a server context. Core Python has two cookie libraries, Cookie.py and cookielib.py. Why did we add a new cookie module instead of using either of these two core Python libaries? Cookie.py is designed for server side generation but can be used to parse cookies on the client. It's the library we were using in the server. However when I tried to use it in the client I discovered it has some serious bugs. There are 7 defined cookie elements, it fails to correctly parse 3 of the 7 elements which makes it unusable because we depend on those elements. Since Cookie.py was designed for server side cookie processing it's not hard to understand how fails to correctly parse a cookie because that's a client side need. (Cookie.py also has an awkward baroque API and is missing some useful functionality we would have to build on top of it). cookielib.py is designed for client side. It's fully featured and obeys all the RFC's. It would be great to use however it's tightly coupled with another core library, urllib2.py. The http request and response objects must be urllib2 objects. But we don't use urllib2, rather we use httplib because xmlrpclib uses httplib. I don't see a reason why a cookie library should be so tightly coupled to a protocol library, but it is and that means we can't use it (I tried to just pick some isolated entrypoints for our use but I kept hitting interaction/dependency problems). I decided to solve the cookie library problems by writing a minimal cookie library that does what we need and no more than that. It is a new module in ipapython shared by both client and server and comes with a new unit test. The module has plenty of documentation, no need to repeat it here. Request URL issues: We also had problems in rpc.py whereby information from the request which is needed when we process the response is not available. Most important was the requesting URL. It turns out that the way the class and object relationships are structured it's impossible to get this information. Someone else must have run into the same issue because there was a routine called reconstruct_url() which attempted to recreate the request URL from other available information. Unfortunately reconstruct_url() was not callable from inside the response handler. So I decided to store the information in the thread context and when the request is received extract it from the thread context. It's perhaps not an ideal solution but we do similar things elsewhere so at least it's consistent. I removed the reconstruct_url() function because the exact information is now in the context and trying to apply heuristics to recreate the url is probably not robust. Ticket https://fedorahosted.org/freeipa/ticket/3022
253 lines
9.6 KiB
Python
Executable File
253 lines
9.6 KiB
Python
Executable File
#!/usr/bin/python
|
|
#
|
|
# Authors:
|
|
# Jakub Hrozek <jhrozek@redhat.com>
|
|
# Jan Cholasta <jcholast@redhat.com>
|
|
#
|
|
# Copyright (C) 2011 Red Hat
|
|
# see file 'COPYING' for use and warranty information
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
import os
|
|
import sys
|
|
from optparse import OptionParser
|
|
from fnmatch import fnmatch, fnmatchcase
|
|
|
|
try:
|
|
from pylint import checkers
|
|
from pylint.lint import PyLinter
|
|
from pylint.reporters.text import ParseableTextReporter
|
|
from pylint.checkers.typecheck import TypeChecker
|
|
from logilab.astng import Class, Instance, InferenceError
|
|
except ImportError:
|
|
print >> sys.stderr, "To use {0}, please install pylint.".format(sys.argv[0])
|
|
sys.exit(32)
|
|
|
|
# File names to ignore when searching for python source files
|
|
IGNORE_FILES = ('.*', '*~', '*.in', '*.pyc', '*.pyo')
|
|
IGNORE_PATHS = ('build', 'rpmbuild', 'dist', 'install/po/test_i18n.py', 'lite-server.py',
|
|
'make-lint', 'make-test', 'tests')
|
|
|
|
class IPATypeChecker(TypeChecker):
|
|
# 'class': ('generated', 'properties',)
|
|
ignore = {
|
|
'ipalib.base.NameSpace': ['find'],
|
|
'ipalib.cli.Collector': ['__options'],
|
|
'ipalib.config.Env': ['*'],
|
|
'ipalib.plugable.API': ['Command', 'Object', 'Method', 'Property',
|
|
'Backend', 'log', 'plugins'],
|
|
'ipalib.plugable.Plugin': ['Command', 'Object', 'Method', 'Property',
|
|
'Backend', 'env', 'debug', 'info', 'warning', 'error', 'critical',
|
|
'exception', 'context', 'log'],
|
|
'ipalib.plugins.misc.env': ['env'],
|
|
'ipalib.parameters.Param': ['cli_name', 'cli_short_name', 'label',
|
|
'doc', 'required', 'multivalue', 'primary_key', 'normalizer',
|
|
'default', 'default_from', 'autofill', 'query', 'attribute',
|
|
'include', 'exclude', 'flags', 'hint', 'alwaysask', 'sortorder',
|
|
'csv', 'csv_separator', 'csv_skipspace'],
|
|
'ipalib.parameters.Bool': ['truths', 'falsehoods'],
|
|
'ipalib.parameters.Int': ['minvalue', 'maxvalue'],
|
|
'ipalib.parameters.Decimal': ['minvalue', 'maxvalue', 'precision'],
|
|
'ipalib.parameters.Data': ['minlength', 'maxlength', 'length',
|
|
'pattern', 'pattern_errmsg'],
|
|
'ipalib.parameters.Enum': ['values'],
|
|
'ipalib.parameters.File': ['stdin_if_missing'],
|
|
'urlparse.SplitResult': ['scheme', 'netloc', 'path', 'query', 'fragment', 'username', 'password', 'hostname', 'port'],
|
|
'urlparse.ParseResult': ['scheme', 'netloc', 'path', 'params', 'query', 'fragment', 'username', 'password', 'hostname', 'port'],
|
|
'ipaserver.install.ldapupdate.LDAPUpdate' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
|
|
'ipaserver.plugins.ldap2.SchemaCache' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
|
|
'ipaserver.plugins.ldap2.IPASimpleLDAPObject' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
|
|
'ipaserver.plugins.ldap2.ldap2' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
|
|
'ipaserver.rpcserver.KerberosSession' : ['api', 'log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
|
|
'ipaserver.rpcserver.HTTP_Status' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
|
|
'ipalib.krb_utils.KRB5_CCache' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
|
|
'ipalib.session.AuthManager' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
|
|
'ipalib.session.SessionAuthManager' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
|
|
'ipalib.session.SessionManager' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
|
|
'ipalib.session.SessionCCache' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
|
|
'ipalib.session.MemcacheSessionManager' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
|
|
'ipapython.admintool.AdminTool' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
|
|
'ipapython.cookie.Cookie' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
|
|
}
|
|
|
|
def _related_classes(self, klass):
|
|
yield klass
|
|
for base in klass.ancestors():
|
|
yield base
|
|
|
|
def _class_full_name(self, klass):
|
|
return klass.root().name + '.' + klass.name
|
|
|
|
def _find_ignored_attrs(self, owner):
|
|
attrs = []
|
|
for klass in self._related_classes(owner):
|
|
name = self._class_full_name(klass)
|
|
if name in self.ignore:
|
|
attrs += self.ignore[name]
|
|
return attrs
|
|
|
|
def visit_getattr(self, node):
|
|
try:
|
|
inferred = list(node.expr.infer())
|
|
except InferenceError:
|
|
inferred = []
|
|
|
|
for owner in inferred:
|
|
if not isinstance(owner, Class) and type(owner) is not Instance:
|
|
continue
|
|
|
|
ignored = self._find_ignored_attrs(owner)
|
|
for pattern in ignored:
|
|
if fnmatchcase(node.attrname, pattern):
|
|
return
|
|
|
|
super(IPATypeChecker, self).visit_getattr(node)
|
|
|
|
class IPALinter(PyLinter):
|
|
ignore = (TypeChecker,)
|
|
|
|
def __init__(self):
|
|
super(IPALinter, self).__init__()
|
|
|
|
self.missing = set()
|
|
|
|
def register_checker(self, checker):
|
|
if type(checker) in self.ignore:
|
|
return
|
|
super(IPALinter, self).register_checker(checker)
|
|
|
|
def add_message(self, msg_id, line=None, node=None, args=None):
|
|
if line is None and node is not None:
|
|
line = node.fromlineno
|
|
|
|
# Record missing packages
|
|
if msg_id == 'F0401' and self.is_message_enabled(msg_id, line):
|
|
self.missing.add(args)
|
|
|
|
super(IPALinter, self).add_message(msg_id, line, node, args)
|
|
|
|
def find_files(path, basepath):
|
|
entries = os.listdir(path)
|
|
|
|
# If this directory is a python package, look no further
|
|
if '__init__.py' in entries:
|
|
return [path]
|
|
|
|
result = []
|
|
for filename in entries:
|
|
filepath = os.path.join(path, filename)
|
|
|
|
for pattern in IGNORE_FILES:
|
|
if fnmatch(filename, pattern):
|
|
filename = None
|
|
break
|
|
if filename is None:
|
|
continue
|
|
|
|
for pattern in IGNORE_PATHS:
|
|
patpath = os.path.join(basepath, pattern).replace(os.sep, '/')
|
|
if filepath == patpath:
|
|
filename = None
|
|
break
|
|
if filename is None:
|
|
continue
|
|
|
|
if os.path.islink(filepath):
|
|
continue
|
|
|
|
# Recurse into subdirectories
|
|
if os.path.isdir(filepath):
|
|
result += find_files(filepath, basepath)
|
|
continue
|
|
|
|
# Add all *.py files
|
|
if filename.endswith('.py'):
|
|
result.append(filepath)
|
|
continue
|
|
|
|
# Add any other files beginning with a shebang and having
|
|
# the word "python" on the first line
|
|
file = open(filepath, 'r')
|
|
line = file.readline(128)
|
|
file.close()
|
|
|
|
if line[:2] == '#!' and line.find('python') >= 0:
|
|
result.append(filepath)
|
|
|
|
return result
|
|
|
|
def main():
|
|
optparser = OptionParser()
|
|
optparser.add_option('--no-fail', help='report success even if errors were found',
|
|
dest='fail', default=True, action='store_false')
|
|
optparser.add_option('--enable-noerror', help='enable warnings and other non-error messages',
|
|
dest='errors_only', default=True, action='store_false')
|
|
|
|
options, args = optparser.parse_args()
|
|
cwd = os.getcwd()
|
|
|
|
if len(args) == 0:
|
|
files = find_files(cwd, cwd)
|
|
else:
|
|
files = args
|
|
|
|
for filename in files:
|
|
dirname = os.path.dirname(filename)
|
|
if dirname not in sys.path:
|
|
sys.path.insert(0, dirname)
|
|
|
|
linter = IPALinter()
|
|
checkers.initialize(linter)
|
|
linter.register_checker(IPATypeChecker(linter))
|
|
|
|
if options.errors_only:
|
|
linter.disable_noerror_messages()
|
|
linter.enable('F')
|
|
linter.set_reporter(ParseableTextReporter())
|
|
linter.set_option('include-ids', True)
|
|
linter.set_option('reports', False)
|
|
linter.set_option('persistent', False)
|
|
|
|
linter.check(files)
|
|
|
|
if linter.msg_status != 0:
|
|
print >> sys.stderr, """
|
|
===============================================================================
|
|
Errors were found during the static code check.
|
|
"""
|
|
|
|
if len(linter.missing) > 0:
|
|
print >> sys.stderr, "There are some missing imports:"
|
|
for mod in sorted(linter.missing):
|
|
print >> sys.stderr, " " + mod
|
|
print >> sys.stderr, """
|
|
Please make sure all of the required and optional (python-krbV, python-rhsm)
|
|
python packages are installed.
|
|
"""
|
|
|
|
print >> sys.stderr, """\
|
|
If you are certain that any of the reported errors are false positives, please
|
|
mark them in the source code according to the pylint documentation.
|
|
===============================================================================
|
|
"""
|
|
|
|
if options.fail:
|
|
return linter.msg_status
|
|
else:
|
|
return 0
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|