<s> import os <EOL> from vt_manager . communication . sfa . util . faults import MissingAuthority <EOL> from vt_manager . communication . sfa . util . xrn import get_leaf , get_authority , hrn_to_urn , urn_to_hrn <EOL> from vt_manager . communication . sfa . trust . certificate import Keypair <EOL> from vt_manager . communication . sfa . trust . credential import Credential <EOL> from vt_manager . communication . sfa . trust . gid import GID , create_uuid <EOL> from vt_manager . communication . sfa . sfa_config import config <EOL> from vt_manager . communication . sfa . trust . sfaticket import SfaTicket <EOL> class AuthInfo : <EOL> hrn = None <EOL> gid_object = None <EOL> gid_filename = None <EOL> privkey_filename = None <EOL> def __init__ ( self , xrn , gid_filename , privkey_filename ) : <EOL> hrn , type = urn_to_hrn ( xrn ) <EOL> self . hrn = hrn <EOL> self . set_gid_filename ( gid_filename ) <EOL> self . privkey_filename = privkey_filename <EOL> def set_gid_filename ( self , fn ) : <EOL> self . gid_filename = fn <EOL> self . gid_object = None <EOL> def get_privkey_filename ( self ) : <EOL> return self . privkey_filename <EOL> def get_gid_filename ( self ) : <EOL> return self . gid_filename <EOL> def get_gid_object ( self ) : <EOL> if not self . gid_object : <EOL> self . gid_object = GID ( filename = self . gid_filename ) <EOL> return self . gid_object <EOL> def get_pkey_object ( self ) : <EOL> return Keypair ( filename = self . privkey_filename ) <EOL> def update_gid_object ( self , gid ) : <EOL> gid . save_to_file ( self . gid_filename ) <EOL> self . gid_object = gid <EOL> class Hierarchy : <EOL> def __init__ ( self , basedir = None ) : <EOL> self . config = config <EOL> if not basedir : <EOL> basedir = os . path . join ( self . config . SFA_DATA_DIR , "<STR_LIT>" ) <EOL> self . basedir = basedir <EOL> def get_auth_filenames ( self , xrn ) : <EOL> hrn , type = urn_to_hrn ( xrn ) <EOL> leaf = get_leaf ( hrn ) <EOL> parent_hrn = get_authority ( hrn ) <EOL> directory = os . path . join ( self . basedir , hrn . replace ( "<STR_LIT:.>" , "<STR_LIT:/>" ) ) <EOL> gid_filename = os . path . join ( directory , leaf + "<STR_LIT>" ) <EOL> privkey_filename = os . path . join ( directory , leaf + "<STR_LIT>" ) <EOL> return ( directory , gid_filename , privkey_filename ) <EOL> def auth_exists ( self , xrn ) : <EOL> hrn , type = urn_to_hrn ( xrn ) <EOL> ( directory , gid_filename , privkey_filename ) = self . get_auth_filenames ( hrn ) <EOL> print directory , gid_filename , privkey_filename <EOL> return os . path . exists ( gid_filename ) and os . path . exists ( privkey_filename ) <EOL> def create_auth ( self , xrn , create_parents = False ) : <EOL> hrn , type = urn_to_hrn ( str ( xrn ) ) <EOL> parent_hrn = get_authority ( hrn ) <EOL> parent_urn = hrn_to_urn ( parent_hrn , '<STR_LIT>' ) <EOL> if ( parent_hrn ) and ( not self . auth_exists ( parent_urn ) ) and ( create_parents ) : <EOL> self . create_auth ( parent_urn , create_parents ) <EOL> ( directory , gid_filename , privkey_filename , ) = self . get_auth_filenames ( hrn ) <EOL> try : <EOL> os . makedirs ( directory ) <EOL> except OSError , ( errno , strerr ) : <EOL> if errno == <NUM_LIT> : <EOL> pass <EOL> if os . path . exists ( privkey_filename ) : <EOL> pkey = Keypair ( filename = privkey_filename ) <EOL> else : <EOL> pkey = Keypair ( create = True ) <EOL> pkey . save_to_file ( privkey_filename ) <EOL> gid = self . create_gid ( xrn , create_uuid ( ) , pkey ) <EOL> gid . save_to_file ( gid_filename , save_parents = True ) <EOL> def create_top_level_auth ( self , hrn = None ) : <EOL> """<STR_LIT>""" <EOL> if not self . auth_exists ( hrn ) : <EOL> self . create_auth ( hrn , create_parents = True ) <EOL> def get_interface_auth_info ( self , create = True ) : <EOL> hrn = self . config . SFA_INTERFACE_HRN <EOL> if not self . auth_exists ( hrn ) : <EOL> if create == True : <EOL> self . create_top_level_auth ( hrn ) <EOL> else : <EOL> raise MissingAuthority ( hrn ) <EOL> return self . get_auth_info ( hrn ) <EOL> def get_auth_info ( self , xrn ) : <EOL> hrn , type = urn_to_hrn ( xrn ) <EOL> if not self . auth_exists ( hrn ) : <EOL> raise MissingAuthority ( hrn ) <EOL> ( directory , gid_filename , privkey_filename , ) = self . get_auth_filenames ( hrn ) <EOL> auth_info = AuthInfo ( hrn , gid_filename , privkey_filename ) <EOL> gid = auth_info . get_gid_object ( ) <EOL> gid_refreshed = self . refresh_gid ( gid ) <EOL> if gid != gid_refreshed : <EOL> auth_info . update_gid_object ( gid_refreshed ) <EOL> return auth_info <EOL> def create_gid ( self , xrn , uuid , pkey , CA = False , email = None ) : <EOL> hrn , type = urn_to_hrn ( xrn ) <EOL> if not type : <EOL> type = '<STR_LIT>' <EOL> parent_hrn = get_authority ( hrn ) <EOL> urn = hrn_to_urn ( hrn , type ) <EOL> subject = self . get_subject ( hrn ) <EOL> if not subject : <EOL> subject = hrn <EOL> gid = GID ( subject = subject , uuid = uuid , hrn = hrn , urn = urn , email = email ) <EOL> if hrn == self . config . SFA_INTERFACE_HRN or not parent_hrn : <EOL> gid . set_intermediate_ca ( True ) <EOL> elif type and '<STR_LIT>' in type : <EOL> gid . set_intermediate_ca ( False ) <EOL> elif CA : <EOL> gid . set_intermediate_ca ( True ) <EOL> else : <EOL> gid . set_intermediate_ca ( False ) <EOL> if not parent_hrn or hrn == self . config . SFA_INTERFACE_HRN : <EOL> gid . set_issuer ( pkey , subject ) <EOL> else : <EOL> parent_auth_info = self . get_auth_info ( parent_hrn ) <EOL> parent_gid = parent_auth_info . get_gid_object ( ) <EOL> gid . set_issuer ( parent_auth_info . get_pkey_object ( ) , parent_gid . get_extended_subject ( ) ) <EOL> gid . set_parent ( parent_auth_info . get_gid_object ( ) ) <EOL> gid . set_pubkey ( pkey ) <EOL> gid . encode ( ) <EOL> gid . sign ( ) <EOL> return gid <EOL> def get_subject ( self , hrn ) : <EOL> if len ( hrn . split ( '<STR_LIT:.>' ) ) > <NUM_LIT:1> : <EOL> subject = auth_config . SUBJECT <EOL> else : <EOL> subject = auth_config . PARENT_SUBJECT <EOL> return subject <EOL> def refresh_gid ( self , gid , xrn = None , uuid = None , pubkey = None ) : <EOL> gid_is_expired = False <EOL> if gid_is_expired or xrn or uuid or pubkey : <EOL> if not xrn : <EOL> xrn = gid . get_urn ( ) <EOL> if not uuid : <EOL> uuid = gid . get_uuid ( ) <EOL> if not pubkey : <EOL> pubkey = gid . get_pubkey ( ) <EOL> gid = self . create_gid ( xrn , uuid , pubkey ) <EOL> return gid <EOL> def get_auth_cred ( self , xrn , kind = "<STR_LIT>" ) : <EOL> hrn , type = urn_to_hrn ( xrn ) <EOL> auth_info = self . get_auth_info ( hrn ) <EOL> gid = auth_info . get_gid_object ( ) <EOL> cred = Credential ( subject = hrn ) <EOL> cred . set_gid_caller ( gid ) <EOL> cred . set_gid_object ( gid ) <EOL> cred . set_privileges ( kind ) <EOL> cred . get_privileges ( ) . delegate_all_privileges ( True ) <EOL> parent_hrn = get_authority ( hrn ) <EOL> if not parent_hrn or hrn == self . config . SFA_INTERFACE_HRN : <EOL> cred . set_issuer_keys ( auth_info . get_privkey_filename ( ) , auth_info . get_gid_filename ( ) ) <EOL> else : <EOL> parent_auth_info = self . get_auth_info ( parent_hrn ) <EOL> cred . set_issuer_keys ( parent_auth_info . get_privkey_filename ( ) , parent_auth_info . get_gid_filename ( ) ) <EOL> cred . set_parent ( self . get_auth_cred ( parent_hrn , kind ) ) <EOL> cred . encode ( ) <EOL> cred . sign ( ) <EOL> return cred <EOL> def get_auth_ticket ( self , xrn ) : <EOL> hrn , type = urn_to_hrn ( xrn ) <EOL> auth_info = self . get_auth_info ( hrn ) <EOL> gid = auth_info . get_gid_object ( ) <EOL> ticket = SfaTicket ( subject = hrn ) <EOL> ticket . set_gid_caller ( gid ) <EOL> ticket . set_gid_object ( gid ) <EOL> ticket . set_delegate ( True ) <EOL> ticket . set_pubkey ( auth_info . get_gid_object ( ) . get_pubkey ( ) ) <EOL> parent_hrn = get_authority ( hrn ) <EOL> if not parent_hrn : <EOL> ticket . set_issuer ( auth_info . get_pkey_object ( ) , hrn ) <EOL> else : <EOL> parent_auth_info = self . get_auth_info ( parent_hrn ) <EOL> ticket . set_issuer ( parent_auth_info . get_pkey_object ( ) , parent_auth_info . hrn ) <EOL> ticket . set_parent ( self . get_auth_cred ( parent_hrn ) ) <EOL> ticket . encode ( ) <EOL> ticket . sign ( ) <EOL> return ticket </s>
