Coverage for ipalib/rpc : 60%
Hot-keys on this page
r m x p toggle line displays
j k next/prev highlighted chunk
0 (zero) top of page
1 (one) first highlighted chunk
|
# Authors: # Jason Gerard DeRose <jderose@redhat.com> # Rob Crittenden <rcritten@redhat.com> # # Copyright (C) 2008 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>.
RPC client and shared RPC client/server functionality.
This module adds some additional functionality on top of the ``xmlrpclib`` module in the Python standard library. For documentation on the ``xmlrpclib`` module, see:
http://docs.python.org/library/xmlrpclib.html
Also see the `ipaserver.rpcserver` module. """
ProtocolError, MININT, MAXINT)
KRB5_FCC_PERM, KRB5_FCC_NOFILE, KRB5_CC_FORMAT, KRB5_REALM_CANT_RESOLVE
""" Wrap all ``str`` in ``xmlrpclib.Binary``.
Because ``xmlrpclib.dumps()`` will itself convert all ``unicode`` instances into UTF-8 encoded ``str`` instances, we don't do it here.
So in total, when encoding data for an XML-RPC packet, the following transformations occur:
* All ``str`` instances are treated as binary data and are wrapped in an ``xmlrpclib.Binary()`` instance.
* Only ``unicode`` instances are treated as character data. They get converted to UTF-8 encoded ``str`` instances (although as mentioned, not by this function).
Also see `xml_unwrap()`.
:param value: The simple scalar or simple compound value to wrap. """ (k, xml_wrap(v)) for (k, v) in value.iteritems() ) # transfer Decimal as a string return unicode(value)
""" Unwrap all ``xmlrpc.Binary``, decode all ``str`` into ``unicode``.
When decoding data from an XML-RPC packet, the following transformations occur:
* The binary payloads of all ``xmlrpclib.Binary`` instances are returned as ``str`` instances.
* All ``str`` instances are treated as UTF-8 encoded Unicode strings. They are decoded and the resulting ``unicode`` instance is returned.
Also see `xml_wrap()`.
:param value: The value to unwrap. :param encoding: The Unicode encoding to use (defaults to ``'UTF-8'``). """ (k, xml_unwrap(v, encoding)) for (k, v) in value.iteritems() )
""" Encode an XML-RPC data packet, transparently wraping ``params``.
This function will wrap ``params`` using `xml_wrap()` and will then encode the XML-RPC data packet using ``xmlrpclib.dumps()`` (from the Python standard library).
For documentation on the ``xmlrpclib.dumps()`` function, see:
http://docs.python.org/library/xmlrpclib.html#convenience-functions
Also see `xml_loads()`.
:param params: A ``tuple`` or an ``xmlrpclib.Fault`` instance. :param methodname: The name of the method to call if this is a request. :param methodresponse: Set this to ``True`` if this is a response. :param encoding: The Unicode encoding to use (defaults to ``'UTF-8'``). """ else: methodname=methodname, methodresponse=methodresponse, encoding=encoding, allow_none=True, )
""" Decode the XML-RPC packet in ``data``, transparently unwrapping its params.
This function will decode the XML-RPC packet in ``data`` using ``xmlrpclib.loads()`` (from the Python standard library). If ``data`` contains a fault, ``xmlrpclib.loads()`` will itself raise an ``xmlrpclib.Fault`` exception.
Assuming an exception is not raised, this function will then unwrap the params in ``data`` using `xml_unwrap()`. Finally, a ``(params, methodname)`` tuple is returned containing the unwrapped params and the name of the method being called. If the packet contains no method name, ``methodname`` will be ``None``.
For documentation on the ``xmlrpclib.loads()`` function, see:
http://docs.python.org/library/xmlrpclib.html#convenience-functions
Also see `xml_dumps()`.
:param data: The XML-RPC packet to decode. """
"""Transport sending Accept-Language header"""
except locale.Error: # fallback to default locale lang = 'en_us'
('Accept-Language', lang.replace('_', '-')) ) ('Referer', 'https://%s/ipa/xml' % str(host)) )
"""Handles an HTTPS transaction to an XML-RPC server."""
""" If there is another connections open it may have already initialized NSS. This is likely to lead to an NSS shutdown failure. One way to mitigate this is to tell NSS to not initialize if it has already been done in another open connection.
Returns True if another connection is using the same db. """ for value in context.__dict__.values(): if not isinstance(value, Connection): continue if not isinstance(value.conn._ServerProxy__transport, SSLTransport): continue if hasattr(value.conn._ServerProxy__transport, 'dbdir') and \ value.conn._ServerProxy__transport.dbdir == dbdir: return True return False
host, self._extra_headers, x509 = self.get_host_info(host) # Python 2.7 changed the internal class used in xmlrpclib from # HTTP to HTTPConnection. We need to use the proper subclass
# If we an existing connection exists using the same NSS database # there is no need to re-initialize. Pass thsi into the NSS # connection creator. dbdir = '/etc/pki/nssdb' no_init = self.__nss_initialized(dbdir) (major, minor, micro, releaselevel, serial) = sys.version_info if major == 2 and minor < 7: conn = NSSHTTPS(host, 443, dbdir=dbdir, no_init=no_init) else: conn = NSSConnection(host, 443, dbdir=dbdir, no_init=no_init) self.dbdir=dbdir conn.connect() return conn
""" Handles Kerberos Negotiation authentication to an XML-RPC server. """
(major, minor) = ipautil.get_gsserror(e) if minor[1] == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: raise errors.ServiceError(service=service) elif minor[1] == KRB5_FCC_NOFILE: raise errors.NoCCacheError() elif minor[1] == KRB5KRB_AP_ERR_TKT_EXPIRED: raise errors.TicketExpired() elif minor[1] == KRB5_FCC_PERM: raise errors.BadCCachePerms() elif minor[1] == KRB5_CC_FORMAT: raise errors.BadCCacheFormat() elif minor[1] == KRB5_REALM_CANT_RESOLVE: raise errors.CannotResolveKDC() else: raise errors.KerberosError(major=major, minor=minor)
""" Two things can happen here. If we have a session we will add a cookie for that. If not we will set an Authorization header. """ (host, extra_headers, x509) = SSLTransport.get_host_info(self, host)
if not isinstance(extra_headers, list): extra_headers = []
session_data = getattr(context, 'session_data', None) if session_data: extra_headers.append(('Cookie', session_data)) return (host, extra_headers, x509)
# Set the remote host principal service = "HTTP@" + host.split(':')[0]
try: (rc, vc) = kerberos.authGSSClientInit(service, self.flags) except kerberos.GSSError, e: self._handle_exception(e)
try: kerberos.authGSSClientStep(vc, "") except kerberos.GSSError, e: self._handle_exception(e, service=service)
for (h, v) in extra_headers: if h == 'Authorization': extra_headers.remove((h, v)) break
extra_headers.append( ('Authorization', 'negotiate %s' % kerberos.authGSSClientResponse(vc)) )
return (host, extra_headers, x509)
session_cookie = response.getheader('Set-Cookie') if session_cookie: principal = getattr(context, 'principal', None) try: kernel_keyring.update_key(COOKIE_NAME % principal, session_cookie) except ValueError, e: # Not fatal, we just can't use the session cookie we were # sent. pass return SSLTransport.parse_response(self, response)
""" Handles Kerberos Negotiation authentication and TGT delegation to an XML-RPC server. """ kerberos.GSS_C_SEQUENCE_FLAG
""" Forwarding backend plugin for XML-RPC client.
Also see the `ipaserver.rpcserver.xmlserver` plugin. """
""" The URL directly isn't stored in the ServerProxy. We can't store it in the connection object itself but we can reconstruct it from the ServerProxy. """ scheme = "https" else:
""" Create a list of urls consisting of the available IPA servers. """ # the configured URL defines what we use for the discovered servers
except DNSException, e: answers = []
# the list/set conversion won't preserve order so stick in the # local config file version here. # make sure the configured master server is there just once and # it is the first one servers.remove(cfg_server) servers.insert(0, cfg_server) else:
delegate=False): # We have a session cookie, try using the session URI to see if it # is still valid # No session key, do full Kerberos auth if delegate: kw['transport'] = DelegatedKerbTransport() else: kw['transport'] = KerbTransport() else: # if we have only 1 server and then let the # main requester handle any errors. This also means it # must handle a 401 but we save a ping. return serverproxy e = decode_fault(e) if e.faultCode in self.__errors: error = self.__errors[e.faultCode] raise error(message=e.faultString) else: raise UnknownError( code=e.faultCode, error=e.faultString, server=server, ) # We don't care about the response, just that we got one # kerberos error on one server is likely on all raise errors.KerberosError(major=str(krberr), minor='') # Unauthorized. Remove the session and try again. except ValueError: # This shouldn't happen if we have a session but # it isn't fatal. pass if not fallback: raise serverproxy = None except Exception, e: if not fallback: raise serverproxy = None
raise NetworkError(uri=_('any of the configured servers'), error=', '.join(servers))
""" Forward call to command named ``name`` over XML-RPC.
This method will encode and forward an XML-RPC request, and will then decode and return the corresponding XML-RPC response.
:param command: The name of the command being forwarded. :param args: Positional arguments to pass to remote command. :param kw: Keyword arguments to pass to remote command. """ '%s.forward(): %r not in api.Command' % (self.name, name) ) server, e.faultString) code=e.faultCode, error=e.faultString, server=server, ) except NSPRError, e: raise NetworkError(uri=server, error=str(e)) except ProtocolError, e: # By catching a 401 here we can detect the case where we have # a single IPA server and the session is invalid. Otherwise # we always have to do a ping(). session_data = getattr(context, 'session_data', None) if session_data and e.errcode == 401: # Unauthorized. Remove the session and try again. delattr(context, 'session_data') try: principal = getattr(context, 'principal', None) kernel_keyring.del_key(COOKIE_NAME % principal) except ValueError: # This shouldn't happen if we have a session but # it isn't fatal. pass
# Create a new serverproxy with the non-session URI. If there # is an existing connection we need to save the NSS dbdir so # we can skip an unnecessary NSS_Initialize() and avoid # NSS_Shutdown issues. serverproxy = self.create_connection(os.environ.get('KRB5CCNAME'), self.env.verbose, self.env.fallback, self.env.delegate)
dbdir = None current_conn = getattr(context, self.id, None) if current_conn is not None: dbdir = getattr(current_conn.conn._ServerProxy__transport, 'dbdir', None) if dbdir is not None: self.debug('Using dbdir %s' % dbdir) setattr(context, self.id, Connection(serverproxy, self.disconnect)) if dbdir is not None: current_conn = getattr(context, self.id, None) current_conn.conn._ServerProxy__transport.dbdir = dbdir return self.forward(name, *args, **kw) raise NetworkError(uri=server, error=e.errmsg) except socket.error, e: raise NetworkError(uri=server, error=str(e)) except (OverflowError, TypeError), e: raise XMLRPCMarshallError(error=str(e)) |