Xc " @ s d Z d d k l Z d d k l Z d d k Z d d k Z d d k Z d d k Z d d k Z d d k
Z
d d k l Z l
Z
l Z l Z l Z l Z l Z l Z l Z d d k Z d d k l Z d d k l Z l Z l Z l Z l Z l Z d d k l Z d d k! l" Z" l# Z# d d
k$ l% Z% d d k& l' Z' d d k( l) Z) d d
k( l* Z* d d k+ l, Z, d d k- l. Z. d d k( l/ Z/ d d k0 Z0 d d k1 Z1 d d k2 Z( d d k2 l3 Z3 l4 Z4 d d k5 l6 Z6 d d k7 l8 Z8 d d k9 l: Z: l; Z; l< Z< l= Z= l> Z> l? Z? d d k@ lA ZA d d k lB ZB d ZC d eC ZD d ZE d ZF d ZG d ZH d ZI d d ZJ d eL d d ZM d d! ZN d d" ZO d# e f d$ YZP d% eP f d& YZQ d' eQ f d( YZR d) eR f d* YZS d+ e f d, YZT d S(- s?
RPC client and shared RPC client/server functionality.
This module adds some additional functionality on top of the ``xmlrpclib``
module in the Python standard library. For documentation on the
``xmlrpclib`` module, see:
http://docs.python.org/library/xmlrpclib.html
Also see the `ipaserver.rpcserver` module.
i( t NoneType( t DecimalN( t Binaryt Faultt dumpst loadst ServerProxyt Transportt
ProtocolErrort MININTt MAXINT( t Connectible( t
public_errorst PublicErrort UnknownErrort NetworkErrort
KerberosErrort XMLRPCMarshallError( t errors( t contextt
Connection( t get_current_principal( t root_logger( t ipautil( t kernel_keyring( t Cookie( t _( t dnsclient( t NSSHTTPSt
NSSConnection( t NSPRError( t urlparse( t KRB5KDC_ERR_S_PRINCIPAL_UNKNOWNt KRB5KRB_AP_ERR_TKT_EXPIREDt
KRB5_FCC_PERMt KRB5_FCC_NOFILEt KRB5_CC_FORMATt KRB5_REALM_CANT_RESOLVE( t DN( t apit ipa_sessions
%s_cookie:%%sc C s t | S( sc
Return the key name used for storing the client session data for
the given principal.
( t KEYRING_COOKIE_NAME( t principal( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyt client_session_keyring_keynameH s c C sN y t | } Wn' t j
o } t t | n Xt i | | d S( s
Given a principal create or update the session data for that
principal in the persistent secure storage.
Raises ValueError if unable to perform the action for any reason.
N( R+ t Exceptiont
ValueErrort strR t
update_key( R* t datat keynamet e( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyt% update_persistent_client_session_dataP s
c C sG y t | } Wn' t j
o } t t | n Xt i | S( s
Given a principal return the stored session data for that
principal from the persistent secure storage.
Raises ValueError if unable to perform the action for any reason.
( R+ R, R- R. R t read_key( R* R1 R2 ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyt# read_persistent_client_session_data` s
c C sK y t | } Wn' t j
o } t t | n Xt i | d S( s
Given a principal remove the session data for that
principal from the persistent secure storage.
Raises ValueError if unable to perform the action for any reason.
N( R+ R, R- R. R t del_key( R* R1 R2 ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyt% delete_persistent_client_session_datap s
c C s t | t t f j o t d | D St | t o t d | i D St | t j o t | St | t j o t | St | t
t f o% | t j p
| t
j o t | St | t o t | S| S( s
Wrap all ``str`` in ``xmlrpclib.Binary``.
Because ``xmlrpclib.dumps()`` will itself convert all ``unicode`` instances
into UTF-8 encoded ``str`` instances, we don't do it here.
So in total, when encoding data for an XML-RPC packet, the following
transformations occur:
* All ``str`` instances are treated as binary data and are wrapped in
an ``xmlrpclib.Binary()`` instance.
* Only ``unicode`` instances are treated as character data. They get
converted to UTF-8 encoded ``str`` instances (although as mentioned,
not by this function).
Also see `xml_unwrap()`.
:param value: The simple scalar or simple compound value to wrap.
c s s x | ] } t | Vq Wd S( N( t xml_wrap( t .0t v( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pys s c s s+ x$ | ] \ } } | t | f Vq Wd S( N( R8 ( R9 t kR: ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pys s ( t typet listt tuplet
isinstancet dictt iteritemsR. R R t unicodet intt longR R
R& ( t value( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyR8 s 0 s UTF-8c s t | t t f j o t f d | D St | t j o! t f d | i D St | t j o | i St | t o | i S| S( sE
Unwrap all ``xmlrpc.Binary``, decode all ``str`` into ``unicode``.
When decoding data from an XML-RPC packet, the following transformations
occur:
* The binary payloads of all ``xmlrpclib.Binary`` instances are
returned as ``str`` instances.
* All ``str`` instances are treated as UTF-8 encoded Unicode strings.
They are decoded and the resulting ``unicode`` instance is returned.
Also see `xml_wrap()`.
:param value: The value to unwrap.
:param encoding: The Unicode encoding to use (defaults to ``'UTF-8'``).
c 3 s" x | ] } t | Vq Wd S( N( t
xml_unwrap( R9 R: ( t encoding( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pys s c 3 s. x' | ] \ } } | t | f Vq Wd S( N( RF ( R9 R; R: ( RG ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pys s (
R< R= R> R@ RA R. t decodeR? R R0 ( RE RG ( ( RG s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyRF s c
C sE t | t j o t | } n t | d | d | d | d t S( s
Encode an XML-RPC data packet, transparently wraping ``params``.
This function will wrap ``params`` using `xml_wrap()` and will
then encode the XML-RPC data packet using ``xmlrpclib.dumps()`` (from the
Python standard library).
For documentation on the ``xmlrpclib.dumps()`` function, see:
http://docs.python.org/library/xmlrpclib.html#convenience-functions
Also see `xml_loads()`.
:param params: A ``tuple`` or an ``xmlrpclib.Fault`` instance.
:param methodname: The name of the method to call if this is a request.
:param methodresponse: Set this to ``True`` if this is a response.
:param encoding: The Unicode encoding to use (defaults to ``'UTF-8'``).
t
methodnamet methodresponseRG t
allow_none( R< R> R8 R t True( t paramsRI RJ RG ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyt xml_dumps s c C s7 t | i t j o t | i | i i | S| S( N( R< t faultStringR. R t faultCodeRH ( R2 RG ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyt decode_fault s c C sN y& t | \ } } t | | f SWn! t j
o } t | n Xd S( st
Decode the XML-RPC packet in ``data``, transparently unwrapping its params.
This function will decode the XML-RPC packet in ``data`` using
``xmlrpclib.loads()`` (from the Python standard library). If ``data``
contains a fault, ``xmlrpclib.loads()`` will itself raise an
``xmlrpclib.Fault`` exception.
Assuming an exception is not raised, this function will then unwrap the
params in ``data`` using `xml_unwrap()`. Finally, a
``(params, methodname)`` tuple is returned containing the unwrapped params
and the name of the method being called. If the packet contains no method
name, ``methodname`` will be ``None``.
For documentation on the ``xmlrpclib.loads()`` function, see:
http://docs.python.org/library/xmlrpclib.html#convenience-functions
Also see `xml_dumps()`.
:param data: The XML-RPC packet to decode.
N( R RF R RQ ( R0 RG RM t methodR2 ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyt xml_loads s
t LanguageAwareTransportc B s e Z d Z d Z RS( s( Transport sending Accept-Language headerc C s t i | | \ } } } y, t i t i d i d d i } Wn t i j
o
d } n Xt | t p
g } n | i
d | i d d f | i
d d t | f | | | f S(
Nt t .i t en_uss Accept-LanguageR t -t Referers https://%s/ipa/xml(
R t
get_host_infot localet setlocalet LC_ALLt splitt lowert ErrorR? R= t appendt replaceR. ( t selft hostt
extra_headerst x509t lang( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyRZ s ,
( t __name__t
__module__t __doc__RZ ( ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyRT
s t SSLTransportc B s e Z d Z d Z d Z RS( s2 Handles an HTTPS transaction to an XML-RPC server.c C sv xo t i i D]^ } t | t p q n t | i i t p q n t | i i d o | i i i Sq Wd S( s
If there is a connections open it may have already initialized
NSS database. Return the database location used by the connection.
t dbdirN( R t __dict__t valuesR? R t connt _ServerProxy__transportRk t hasattrRl t None( Rc RE ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyt get_connection_dbdir' s c C s | i | \ } | _ } d } | i } | o | | j } n | t i i j } t i \ } } } } }
| d j oD | d j o7 t | d d | d | d t i
i d t i
i } n4 t
| d d | d | d t i
i d t i
i } | | _ | i | S( Ns /etc/pki/nssdbi i i Rl t no_initt tls_version_mint tls_version_max( RZ t _extra_headersRs t ipapythont nsslibt
current_dbdirt syst version_infoR R' t envRu Rv R Rl t connect( Rc Rd Rf Rl t connection_dbdirRt t majort minort microt releaselevelt serialRo ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyt make_connection5 s"
( Rh Ri Rj Rs R ( ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyRk $ s t
KerbTransportc B sQ e Z d Z e i e i BZ d d Z d Z d Z
d d Z d Z RS( sK
Handles Kerberos Negotiation authentication to an XML-RPC server.
c C s t i | \ } } | d t j o t i d | n | d t j o t i n | d t j o t i n| | d t j o t i
n[ | d t j o t i n: | d t
j o t i n t i d | d | d S( Ni t serviceR R ( R t get_gsserrorR R t ServiceErrorR# t
NoCCacheErrorR! t
TicketExpiredR" t BadCCachePermsR$ t BadCCacheFormatR% t CannotResolveKDCR ( Rc R2 R R R ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyt _handle_exception[ s c
C sx t i | | \ } } } t | t p
g } n t t d d
} | o! | i d | f | | | f Sd | i d d } y t i
| | i \ } } Wn% t i j
o } | i
| n Xy t i | d Wn+ t i j
o } | i
| d | n Xx9 | D]1 \ } }
| d j o | i | |
f PqqW| i d d t i | f | | | f S( s
Two things can happen here. If we have a session we will add
a cookie for that. If not we will set an Authorization header.
t session_cookieR s HTTP@t :i RU R t
Authorizations negotiate %sN( Rk RZ R? R= t getattrR Rr Ra R^ t kerberost authGSSClientInitt flagst GSSErrorR t authGSSClientStept removet authGSSClientResponse( Rc Rd Re Rf R R t rct vcR2 t hR: ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyRZ l s0
c C s | d j o d St t d d } t t d d } t i d | y t i | t | } Wn) t j
o } t i d | | d SX| d j o d St
| } t i d | | y t | | Wn t j
o } n Xd S( s
Given the contents of a Set-Cookie header scan the header and
extract each cookie contained within until the session cookie
is located. Examine the session cookie if the domain and path
are specified, if not update the cookie with those values from
the request URL. Then write the session cookie into the key
store for the principal. If the cookie header is None or the
session cookie is not present in the header no action is
taken.
Context Dependencies:
The per thread context is expected to contain:
principal
The current pricipal the HTTP request was issued for.
request_url
The URL of the HTTP request.
NR* t request_urls received Set-Cookie '%s's& unable to parse cookie header '%s': %ss$ storing cookie '%s' for principal %s( Rr R R R t debugR t get_named_cookie_from_stringt COOKIE_NAMER, t errorR. R3 ( Rc t
cookie_headerR* R R R2 t
cookie_string( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyt store_session_cookie s&
i c C s | i | } | o | i d n yz | i | | | | i | | | i | | i | | | i i } | i d j o | | _ | i
| SWn5 t j
o
n! t j
o | i
n X| i d d o | i n t | | | i | i | i d S( Ni i s content-lengthi ( R t set_debuglevelt send_requestt send_hostt send_user_agentt send_contentt _connt getresponset statust verboset parse_responseR R, t closet getheadert readR t reasont msg( Rc Rd t handlert request_bodyR R t response( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyt request s.
c C s& | i | i d t i | | S( Ns
Set-Cookie( R R Rk R ( Rc R ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyR s N(
Rh Ri Rj R t GSS_C_MUTUAL_FLAGt GSS_C_SEQUENCE_FLAGR Rr R RZ R R R ( ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyR U s ' / $t DelegatedKerbTransportc B s% e Z d Z e i e i Be i BZ RS( sb
Handles Kerberos Negotiation authentication and TGT delegation to an
XML-RPC server.
( Rh Ri Rj R t GSS_C_DELEG_FLAGR R R ( ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyR s
t xmlclientc B sY e Z d Z d Z d Z d Z d Z d e e e d Z
d Z d Z RS( sq
Forwarding backend plugin for XML-RPC client.
Also see the `ipaserver.rpcserver.xmlserver` plugin.
c C s0 t t | i t d t D | _ d S( Nc s s" x | ] } | i | f Vq Wd S( N( t errno( R9 R2 ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pys s ( t superR t __init__R@ R t _xmlclient__errors( Rc ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyR s c C s t i | \ } } } } } } g } d | i i } t i | t i t i }
xZ |
D]R } | i t i j o9 | i i i
d } | i d t i
| | f qY qY Wt t | } | }
|
| j o! | i |
| i d |
n | i d |
| S( sP
Create a list of urls consisting of the available IPA servers.
s _ldap._tcp.%s.RV s https://%s%si ( R R} t domainR t queryt DNS_C_INt DNS_T_SRVt dns_typet rdatat servert rstripRa R t
format_netlocR= t setR t insert( Rc t
xmlrpc_urit schemet netloct pathRM R t fragmentt serverst namet rst rt rsrvt
cfg_server( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyt get_url_list s ! (
c C s\ y t | } Wn t j
o
} d SXy t i | t } Wn t j
o
} d SX| S( s
Retrieves the session cookie for the given principal from the
persistent secure storage. Returns None if not found or unable
to retrieve the session cookie for any reason, otherwise
returns a Cookie object containing the session cookie.
N( R5 R, Rr R R R ( Rc R* R R2 R ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyt* get_session_cookie_from_persistent_storage s
c
C s | } t t d d
} | i | } | d
j o | i i d | | S| i d | | y | i | Wn t i j
oC } | i d | | y t | Wn t
j
o } n X| St i j
o } | i d | | St
j
o } | i d | | SX| i i d | i
t t d | i
t i | \ } } } } }
} d } t i | | | | |
| f } | S( sE
Attempt to load a session cookie for the current principal
from the persistent secure storage. If the cookie is
successfully loaded adjust the input url's to point to the
session path and insert the session cookie into the per thread
context for later insertion into the HTTP request. If the
cookie is not successfully loaded then the original url is
returned and the per thread context is not modified.
Context Dependencies:
The per thread context is expected to contain:
principal
The current pricipal the HTTP request was issued for.
The per thread context will be updated with:
session_cookie
A cookie string to be inserted into the Cookie header
of the HTPP request.
R* sF failed to find session_cookie in persistent storage for principal '%s'sK found session_cookie in persistent storage for principal '%s', cookie: '%s's, deleting session data for principal '%s': %ss, not sending session cookie, URL mismatch: %ss- not sending session cookie, unknown error: %ss( setting session_cookie into context '%s'R s /ipa/session/xmlN( R R Rr R t logR t http_return_okR t ExpiredR7 R, t URLMismatchR t http_cookiet setattrR t
urlunparse(
Rc t urlt original_urlR* R R2 R R R RM R R t session_url( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyt apply_session_cookie2 s<
!!c C s
yC | i i } t } t t d | | p | i | } n Wn t j
o n X| i | } d } xc| D][} t d t
d d }
| |
d <| i d o) | o t |
d t | i i" d d }
|
d j o | i d |
qrn t# t | i! t$ | | i% |
d j o( t t | i! d } |
| i i" _& n | i' | | | St d | d | i( nc t) i* j
o$ } t d | d t | n1 t+ t, f j
o } t- d t | n Xd S( s
Forward call to command named ``name`` over XML-RPC.
This method will encode and forward an XML-RPC request, and will then
decode and return the corresponding XML-RPC response.
:param command: The name of the command being forwarded.
:param args: Positional arguments to pass to remote command.
:param kw: Keyword arguments to pass to remote command.
s# %s.forward(): %r not in api.CommandR s Forwarding %r to server %rs" Caught fault %d from server %s: %sR R R R R R i R* t
KRB5CCNAMERl s Using dbdir %sN(. t CommandR- R R R Rr R Ro R8 RF R RQ R RP RO R R R R R. R R R R7 R, R t ost environt getR} R R R t idRp R R t
disconnectRl t forwardt errmsgt socketR t
OverflowErrort TypeErrorR ( Rc R t argsR R R RM R R2 R R R* R Rl t current_conn( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyR sb
6
N(
Rh Ri Rj R R R R Rr t FalseRL R R R ( ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyR s @ M (U Rj t typesR t decimalR t threadingR{ R R R[ t datetimet xmlrpclibR R R R R R R R R
R t ipalib.backendR t
ipalib.errorsR R
R R R R t ipalibR t ipalib.requestR R t ipalib.utilR t ipapython.ipa_log_managerR Rx R R t ipapython.cookieR t ipalib.textR R t httplibR t ipapython.nsslibR R t nss.errorR t urllib2R t ipalib.krb_utilsR R! R" R# R$ R% t ipapython.dnR& R' R R) R+ R3 R5 R7 R8 RF Rr R RN RQ RS RT Rk R R R ( ( ( s. /usr/lib/python2.6/site-packages/ipalib/rpc.pyt s\ @ . .
( ! 1