freeipa/make-lint
John Dennis 9269e5d6dd Compliant client side session cookie behavior
In summary this patch does:

* Follow the defined rules for cookies when:

  - receiving a cookie (process the attributes)

  - storing a cookie (store cookie + attributes)

  - sending a cookie

    + validate the cookie domain against the request URL

    + validate the cookie path against the request URL

    + validate the cookie expiration

    + if valid then send only the cookie, no attribtues

* Modifies how a request URL is stored during a XMLRPC
  request/response sequence.

* Refactors a bit of the request/response logic to allow for making
  the decision whether to send a session cookie instead of full
  Kerberous auth easier.

* The server now includes expiration information in the session cookie
  it sends to the client. The server always had the information
  available to prevent using an expired session cookie. Now that
  expiration timestamp is returned to the client as well and now the
  client will not send an expired session cookie back to the server.

* Adds a new module and unit test for cookies (see below)

Formerly we were always returning the session cookie no matter what
the domain or path was in the URL. We were also sending the cookie
attributes which are for the client only (used to determine if to
return a cookie). The attributes are not meant to be sent to the
server and the previous behavior was a protocol violation. We also
were not checking the cookie expiration.

Cookie library issues:

We need a library to create, parse, manipulate and format cookies both
in a client context and a server context. Core Python has two cookie
libraries, Cookie.py and cookielib.py. Why did we add a new cookie
module instead of using either of these two core Python libaries?

Cookie.py is designed for server side generation but can be used to
parse cookies on the client. It's the library we were using in the
server. However when I tried to use it in the client I discovered it
has some serious bugs. There are 7 defined cookie elements, it fails
to correctly parse 3 of the 7 elements which makes it unusable because
we depend on those elements. Since Cookie.py was designed for server
side cookie processing it's not hard to understand how fails to
correctly parse a cookie because that's a client side need. (Cookie.py
also has an awkward baroque API and is missing some useful
functionality we would have to build on top of it).

cookielib.py is designed for client side. It's fully featured and obeys
all the RFC's. It would be great to use however it's tightly coupled
with another core library, urllib2.py. The http request and response
objects must be urllib2 objects. But we don't use urllib2, rather we use
httplib because xmlrpclib uses httplib. I don't see a reason why a
cookie library should be so tightly coupled to a protocol library, but
it is and that means we can't use it (I tried to just pick some isolated
entrypoints for our use but I kept hitting interaction/dependency problems).

I decided to solve the cookie library problems by writing a minimal
cookie library that does what we need and no more than that. It is a
new module in ipapython shared by both client and server and comes
with a new unit test. The module has plenty of documentation, no need
to repeat it here.

Request URL issues:

We also had problems in rpc.py whereby information from the request
which is needed when we process the response is not available. Most
important was the requesting URL. It turns out that the way the class
and object relationships are structured it's impossible to get this
information. Someone else must have run into the same issue because
there was a routine called reconstruct_url() which attempted to
recreate the request URL from other available
information. Unfortunately reconstruct_url() was not callable from
inside the response handler. So I decided to store the information in
the thread context and when the request is received extract it from
the thread context. It's perhaps not an ideal solution but we do
similar things elsewhere so at least it's consistent. I removed the
reconstruct_url() function because the exact information is now in the
context and trying to apply heuristics to recreate the url is probably
not robust.

Ticket https://fedorahosted.org/freeipa/ticket/3022
2012-12-10 12:45:09 -05:00

253 lines
9.6 KiB
Python
Executable File

#!/usr/bin/python
#
# Authors:
# Jakub Hrozek <jhrozek@redhat.com>
# Jan Cholasta <jcholast@redhat.com>
#
# Copyright (C) 2011 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
import os
import sys
from optparse import OptionParser
from fnmatch import fnmatch, fnmatchcase
try:
from pylint import checkers
from pylint.lint import PyLinter
from pylint.reporters.text import ParseableTextReporter
from pylint.checkers.typecheck import TypeChecker
from logilab.astng import Class, Instance, InferenceError
except ImportError:
print >> sys.stderr, "To use {0}, please install pylint.".format(sys.argv[0])
sys.exit(32)
# File names to ignore when searching for python source files
IGNORE_FILES = ('.*', '*~', '*.in', '*.pyc', '*.pyo')
IGNORE_PATHS = ('build', 'rpmbuild', 'dist', 'install/po/test_i18n.py', 'lite-server.py',
'make-lint', 'make-test', 'tests')
class IPATypeChecker(TypeChecker):
# 'class': ('generated', 'properties',)
ignore = {
'ipalib.base.NameSpace': ['find'],
'ipalib.cli.Collector': ['__options'],
'ipalib.config.Env': ['*'],
'ipalib.plugable.API': ['Command', 'Object', 'Method', 'Property',
'Backend', 'log', 'plugins'],
'ipalib.plugable.Plugin': ['Command', 'Object', 'Method', 'Property',
'Backend', 'env', 'debug', 'info', 'warning', 'error', 'critical',
'exception', 'context', 'log'],
'ipalib.plugins.misc.env': ['env'],
'ipalib.parameters.Param': ['cli_name', 'cli_short_name', 'label',
'doc', 'required', 'multivalue', 'primary_key', 'normalizer',
'default', 'default_from', 'autofill', 'query', 'attribute',
'include', 'exclude', 'flags', 'hint', 'alwaysask', 'sortorder',
'csv', 'csv_separator', 'csv_skipspace'],
'ipalib.parameters.Bool': ['truths', 'falsehoods'],
'ipalib.parameters.Int': ['minvalue', 'maxvalue'],
'ipalib.parameters.Decimal': ['minvalue', 'maxvalue', 'precision'],
'ipalib.parameters.Data': ['minlength', 'maxlength', 'length',
'pattern', 'pattern_errmsg'],
'ipalib.parameters.Enum': ['values'],
'ipalib.parameters.File': ['stdin_if_missing'],
'urlparse.SplitResult': ['scheme', 'netloc', 'path', 'query', 'fragment', 'username', 'password', 'hostname', 'port'],
'urlparse.ParseResult': ['scheme', 'netloc', 'path', 'params', 'query', 'fragment', 'username', 'password', 'hostname', 'port'],
'ipaserver.install.ldapupdate.LDAPUpdate' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipaserver.plugins.ldap2.SchemaCache' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipaserver.plugins.ldap2.IPASimpleLDAPObject' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipaserver.plugins.ldap2.ldap2' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipaserver.rpcserver.KerberosSession' : ['api', 'log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipaserver.rpcserver.HTTP_Status' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipalib.krb_utils.KRB5_CCache' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipalib.session.AuthManager' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipalib.session.SessionAuthManager' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipalib.session.SessionManager' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipalib.session.SessionCCache' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipalib.session.MemcacheSessionManager' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipapython.admintool.AdminTool' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
'ipapython.cookie.Cookie' : ['log', 'debug', 'info', 'warning', 'error', 'critical', 'exception'],
}
def _related_classes(self, klass):
yield klass
for base in klass.ancestors():
yield base
def _class_full_name(self, klass):
return klass.root().name + '.' + klass.name
def _find_ignored_attrs(self, owner):
attrs = []
for klass in self._related_classes(owner):
name = self._class_full_name(klass)
if name in self.ignore:
attrs += self.ignore[name]
return attrs
def visit_getattr(self, node):
try:
inferred = list(node.expr.infer())
except InferenceError:
inferred = []
for owner in inferred:
if not isinstance(owner, Class) and type(owner) is not Instance:
continue
ignored = self._find_ignored_attrs(owner)
for pattern in ignored:
if fnmatchcase(node.attrname, pattern):
return
super(IPATypeChecker, self).visit_getattr(node)
class IPALinter(PyLinter):
ignore = (TypeChecker,)
def __init__(self):
super(IPALinter, self).__init__()
self.missing = set()
def register_checker(self, checker):
if type(checker) in self.ignore:
return
super(IPALinter, self).register_checker(checker)
def add_message(self, msg_id, line=None, node=None, args=None):
if line is None and node is not None:
line = node.fromlineno
# Record missing packages
if msg_id == 'F0401' and self.is_message_enabled(msg_id, line):
self.missing.add(args)
super(IPALinter, self).add_message(msg_id, line, node, args)
def find_files(path, basepath):
entries = os.listdir(path)
# If this directory is a python package, look no further
if '__init__.py' in entries:
return [path]
result = []
for filename in entries:
filepath = os.path.join(path, filename)
for pattern in IGNORE_FILES:
if fnmatch(filename, pattern):
filename = None
break
if filename is None:
continue
for pattern in IGNORE_PATHS:
patpath = os.path.join(basepath, pattern).replace(os.sep, '/')
if filepath == patpath:
filename = None
break
if filename is None:
continue
if os.path.islink(filepath):
continue
# Recurse into subdirectories
if os.path.isdir(filepath):
result += find_files(filepath, basepath)
continue
# Add all *.py files
if filename.endswith('.py'):
result.append(filepath)
continue
# Add any other files beginning with a shebang and having
# the word "python" on the first line
file = open(filepath, 'r')
line = file.readline(128)
file.close()
if line[:2] == '#!' and line.find('python') >= 0:
result.append(filepath)
return result
def main():
optparser = OptionParser()
optparser.add_option('--no-fail', help='report success even if errors were found',
dest='fail', default=True, action='store_false')
optparser.add_option('--enable-noerror', help='enable warnings and other non-error messages',
dest='errors_only', default=True, action='store_false')
options, args = optparser.parse_args()
cwd = os.getcwd()
if len(args) == 0:
files = find_files(cwd, cwd)
else:
files = args
for filename in files:
dirname = os.path.dirname(filename)
if dirname not in sys.path:
sys.path.insert(0, dirname)
linter = IPALinter()
checkers.initialize(linter)
linter.register_checker(IPATypeChecker(linter))
if options.errors_only:
linter.disable_noerror_messages()
linter.enable('F')
linter.set_reporter(ParseableTextReporter())
linter.set_option('include-ids', True)
linter.set_option('reports', False)
linter.set_option('persistent', False)
linter.check(files)
if linter.msg_status != 0:
print >> sys.stderr, """
===============================================================================
Errors were found during the static code check.
"""
if len(linter.missing) > 0:
print >> sys.stderr, "There are some missing imports:"
for mod in sorted(linter.missing):
print >> sys.stderr, " " + mod
print >> sys.stderr, """
Please make sure all of the required and optional (python-krbV, python-rhsm)
python packages are installed.
"""
print >> sys.stderr, """\
If you are certain that any of the reported errors are false positives, please
mark them in the source code according to the pylint documentation.
===============================================================================
"""
if options.fail:
return linter.msg_status
else:
return 0
if __name__ == "__main__":
sys.exit(main())