<s> import os <EOL> from types import StringTypes <EOL> import datetime <EOL> from StringIO import StringIO <EOL> from tempfile import mkstemp <EOL> from xml . dom . minidom import Document , parseString <EOL> HAVELXML = False <EOL> try : <EOL> from lxml import etree <EOL> HAVELXML = True <EOL> except : <EOL> pass <EOL> HAVELXML = False <EOL> from xml . parsers . expat import ExpatError <EOL> from foam . sfa . util . faults import CredentialNotVerifiable , ChildRightsNotSubsetOfParent <EOL> from foam . sfa . util . sfatime import utcparse <EOL> from foam . sfa . trust . credential_legacy import CredentialLegacy <EOL> from foam . sfa . trust . rights import Right , Rights , determine_rights <EOL> from foam . sfa . trust . gid import GID <EOL> from foam . sfa . util . xrn import urn_to_hrn , hrn_authfor_hrn <EOL> DEFAULT_CREDENTIAL_LIFETIME = <NUM_LIT> * <NUM_LIT> <EOL> signature_template = '''<STR_LIT>''' <EOL> def str2bool ( str ) : <EOL> if str . lower ( ) in [ '<STR_LIT:true>' , '<STR_LIT:1>' ] : <EOL> return True <EOL> return False <EOL> def getTextNode ( element , subele ) : <EOL> sub = element . getElementsByTagName ( subele ) [ <NUM_LIT:0> ] <EOL> if len ( sub . childNodes ) > <NUM_LIT:0> : <EOL> return sub . childNodes [ <NUM_LIT:0> ] . nodeValue <EOL> else : <EOL> return None <EOL> def append_sub ( doc , parent , element , text ) : <EOL> ele = doc . createElement ( element ) <EOL> ele . appendChild ( doc . createTextNode ( text ) ) <EOL> parent . appendChild ( ele ) <EOL> class Signature ( object ) : <EOL> def __init__ ( self , string = None ) : <EOL> self . refid = None <EOL> self . issuer_gid = None <EOL> self . xml = None <EOL> if string : <EOL> self . xml = string <EOL> self . decode ( ) <EOL> def get_refid ( self ) : <EOL> if not self . refid : <EOL> self . decode ( ) <EOL> return self . refid <EOL> def get_xml ( self ) : <EOL> if not self . xml : <EOL> self . encode ( ) <EOL> return self . xml <EOL> def set_refid ( self , id ) : <EOL> self . refid = id <EOL> def get_issuer_gid ( self ) : <EOL> if not self . gid : <EOL> self . decode ( ) <EOL> return self . gid <EOL> def set_issuer_gid ( self , gid ) : <EOL> self . gid = gid <EOL> def decode ( self ) : <EOL> try : <EOL> doc = parseString ( self . xml ) <EOL> except ExpatError , e : <EOL> raise e <EOL> sig = doc . getElementsByTagName ( "<STR_LIT>" ) [ <NUM_LIT:0> ] <EOL> self . set_refid ( sig . getAttribute ( "<STR_LIT>" ) . strip ( "<STR_LIT>" ) ) <EOL> keyinfo = sig . getElementsByTagName ( "<STR_LIT>" ) [ <NUM_LIT:0> ] <EOL> szgid = getTextNode ( keyinfo , "<STR_LIT>" ) <EOL> szgid = "<STR_LIT>" % szgid <EOL> self . set_issuer_gid ( GID ( string = szgid ) ) <EOL> def encode ( self ) : <EOL> self . xml = signature_template % ( self . get_refid ( ) , self . get_refid ( ) ) <EOL> def filter_creds_by_caller ( creds , caller_hrn_list ) : <EOL> """<STR_LIT>""" <EOL> if not isinstance ( creds , list ) : creds = [ creds ] <EOL> if not isinstance ( caller_hrn_list , list ) : <EOL> caller_hrn_list = [ caller_hrn_list ] <EOL> caller_creds = [ ] <EOL> for cred in creds : <EOL> try : <EOL> tmp_cred = Credential ( string = cred ) <EOL> if tmp_cred . get_gid_caller ( ) . get_hrn ( ) in caller_hrn_list : <EOL> caller_creds . append ( cred ) <EOL> except : pass <EOL> return caller_creds <EOL> class Credential ( object ) : <EOL> def __init__ ( self , create = False , subject = None , string = None , filename = None ) : <EOL> self . gidCaller = None <EOL> self . gidObject = None <EOL> self . expiration = None <EOL> self . privileges = None <EOL> self . issuer_privkey = None <EOL> self . issuer_gid = None <EOL> self . issuer_pubkey = None <EOL> self . parent = None <EOL> self . signature = None <EOL> self . xml = None <EOL> self . refid = None <EOL> self . legacy = None <EOL> if string or filename : <EOL> if string : <EOL> str = string <EOL> elif filename : <EOL> str = file ( filename ) . read ( ) <EOL> if str . strip ( ) . startswith ( "<STR_LIT>" ) : <EOL> self . legacy = CredentialLegacy ( False , string = str ) <EOL> self . translate_legacy ( str ) <EOL> else : <EOL> self . xml = str <EOL> self . decode ( ) <EOL> self . xmlsec_path = '<STR_LIT>' <EOL> paths = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] <EOL> for path in paths : <EOL> if os . path . isfile ( path + '<STR_LIT:/>' + '<STR_LIT>' ) : <EOL> self . xmlsec_path = path + '<STR_LIT:/>' + '<STR_LIT>' <EOL> break <EOL> if not self . xmlsec_path : <EOL> print "<STR_LIT>" <EOL> def get_subject ( self ) : <EOL> if not self . gidObject : <EOL> self . decode ( ) <EOL> return self . gidObject . get_subject ( ) <EOL> def get_summary_tostring ( self ) : <EOL> if not self . gidObject : <EOL> self . decode ( ) <EOL> obj = self . gidObject . get_printable_subject ( ) <EOL> caller = self . gidCaller . get_printable_subject ( ) <EOL> exp = self . get_expiration ( ) <EOL> return "<STR_LIT>" % ( caller , obj , exp ) <EOL> def get_signature ( self ) : <EOL> if not self . signature : <EOL> self . decode ( ) <EOL> return self . signature <EOL> def set_signature ( self , sig ) : <EOL> self . signature = sig <EOL> def translate_legacy ( self , str ) : <EOL> legacy = CredentialLegacy ( False , string = str ) <EOL> self . gidCaller = legacy . get_gid_caller ( ) <EOL> self . gidObject = legacy . get_gid_object ( ) <EOL> lifetime = legacy . get_lifetime ( ) <EOL> if not lifetime : <EOL> self . set_expiration ( datetime . datetime . utcnow ( ) + datetime . timedelta ( seconds = DEFAULT_CREDENTIAL_LIFETIME ) ) <EOL> else : <EOL> self . set_expiration ( int ( lifetime ) ) <EOL> self . lifeTime = legacy . get_lifetime ( ) <EOL> self . set_privileges ( legacy . get_privileges ( ) ) <EOL> self . get_privileges ( ) . delegate_all_privileges ( legacy . get_delegate ( ) ) <EOL> def set_issuer_keys ( self , privkey , gid ) : <EOL> self . issuer_privkey = privkey <EOL> self . issuer_gid = gid <EOL> def set_parent ( self , cred ) : <EOL> self . parent = cred <EOL> self . updateRefID ( ) <EOL> def set_gid_caller ( self , gid ) : <EOL> self . gidCaller = gid <EOL> self . gidOriginCaller = gid <EOL> def get_gid_caller ( self ) : <EOL> if not self . gidCaller : <EOL> self . decode ( ) <EOL> return self . gidCaller <EOL> def set_gid_object ( self , gid ) : <EOL> self . gidObject = gid <EOL> def get_gid_object ( self ) : <EOL> if not self . gidObject : <EOL> self . decode ( ) <EOL> return self . gidObject <EOL> def set_expiration ( self , expiration ) : <EOL> if isinstance ( expiration , ( int , float ) ) : <EOL> self . expiration = datetime . datetime . fromtimestamp ( expiration ) <EOL> elif isinstance ( expiration , datetime . datetime ) : <EOL> self . expiration = expiration <EOL> elif isinstance ( expiration , StringTypes ) : <EOL> self . expiration = utcparse ( expiration ) <EOL> else : <EOL> print "<STR_LIT>" <EOL> def get_expiration ( self ) : <EOL> if not self . expiration : <EOL> self . decode ( ) <EOL> return self . expiration <EOL> def get_lifetime ( self ) : <EOL> return self . get_expiration ( ) <EOL> def set_privileges ( self , privs ) : <EOL> if isinstance ( privs , str ) : <EOL> self . privileges = Rights ( string = privs ) <EOL> else : <EOL> self . privileges = privs <EOL> def get_privileges ( self ) : <EOL> if not self . privileges : <EOL> self . decode ( ) <EOL> return self . privileges <EOL> def can_perform ( self , op_name ) : <EOL> rights = self . get_privileges ( ) <EOL> if not rights : <EOL> return False <EOL> return rights . can_perform ( op_name ) <EOL> def encode ( self ) : <EOL> doc = Document ( ) <EOL> signed_cred = doc . createElement ( "<STR_LIT>" ) <EOL> signed_cred . setAttribute ( "<STR_LIT>" , "<STR_LIT>" ) <EOL> signed_cred . setAttribute ( "<STR_LIT>" , "<STR_LIT>" ) <EOL> signed_cred . setAttribute ( "<STR_LIT>" , "<STR_LIT>" ) <EOL> doc . appendChild ( signed_cred ) <EOL> cred = doc . createElement ( "<STR_LIT>" ) <EOL> cred . setAttribute ( "<STR_LIT>" , self . get_refid ( ) ) <EOL> signed_cred . appendChild ( cred ) <EOL> append_sub ( doc , cred , "<STR_LIT:type>" , "<STR_LIT>" ) <EOL> append_sub ( doc , cred , "<STR_LIT>" , "<STR_LIT>" ) <EOL> append_sub ( doc , cred , "<STR_LIT>" , self . gidCaller . save_to_string ( ) ) <EOL> append_sub ( doc , cred , "<STR_LIT>" , self . gidCaller . get_urn ( ) ) <EOL> append_sub ( doc , cred , "<STR_LIT>" , self . gidObject . save_to_string ( ) ) <EOL> append_sub ( doc , cred , "<STR_LIT>" , self . gidObject . get_urn ( ) ) <EOL> append_sub ( doc , cred , "<STR_LIT>" , "<STR_LIT>" ) <EOL> if not self . expiration : <EOL> self . set_expiration ( datetime . datetime . utcnow ( ) + datetime . timedelta ( seconds = DEFAULT_CREDENTIAL_LIFETIME ) ) <EOL> self . expiration = self . expiration . replace ( microsecond = <NUM_LIT:0> ) <EOL> append_sub ( doc , cred , "<STR_LIT>" , self . expiration . isoformat ( ) ) <EOL> privileges = doc . createElement ( "<STR_LIT>" ) <EOL> cred . appendChild ( privileges ) <EOL> if self . privileges : <EOL> rights = self . get_privileges ( ) <EOL> for right in rights . rights : <EOL> priv = doc . createElement ( "<STR_LIT>" ) <EOL> append_sub ( doc , priv , "<STR_LIT:name>" , right . kind ) <EOL> append_sub ( doc , priv , "<STR_LIT>" , str ( right . delegate ) . lower ( ) ) <EOL> privileges . appendChild ( priv ) <EOL> if self . parent : <EOL> sdoc = parseString ( self . parent . get_xml ( ) ) <EOL> parentRoot = sdoc . documentElement <EOL> if parentRoot . tagName == "<STR_LIT>" and parentRoot . hasAttributes ( ) : <EOL> for attrIx in range ( <NUM_LIT:0> , parentRoot . attributes . length ) : <EOL> attr = parentRoot . attributes . item ( attrIx ) <EOL> oldAttr = signed_cred . setAttributeNode ( attr . cloneNode ( True ) ) <EOL> if oldAttr and oldAttr . value != attr . value : <EOL> msg = "<STR_LIT>" % ( self . parent . gidCaller . get_urn ( ) , self . gidCaller . get_urn ( ) , self . gidObject . get_urn ( ) , oldAttr . name , oldAttr . value , attr . value ) <EOL> p_cred = doc . importNode ( sdoc . getElementsByTagName ( "<STR_LIT>" ) [ <NUM_LIT:0> ] , True ) <EOL> p = doc . createElement ( "<STR_LIT>" ) <EOL> p . appendChild ( p_cred ) <EOL> cred . appendChild ( p ) <EOL> signatures = doc . createElement ( "<STR_LIT>" ) <EOL> signed_cred . appendChild ( signatures ) <EOL> if self . parent : <EOL> for cur_cred in self . get_credential_list ( ) [ <NUM_LIT:1> : ] : <EOL> sdoc = parseString ( cur_cred . get_signature ( ) . get_xml ( ) ) <EOL> ele = doc . importNode ( sdoc . getElementsByTagName ( "<STR_LIT>" ) [ <NUM_LIT:0> ] , True ) <EOL> signatures . appendChild ( ele ) <EOL> self . xml = doc . toxml ( ) <EOL> def save_to_random_tmp_file ( self ) : <EOL> fp , filename = mkstemp ( suffix = '<STR_LIT>' , text = True ) <EOL> fp = os . fdopen ( fp , "<STR_LIT:w>" ) <EOL> self . save_to_file ( filename , save_parents = True , filep = fp ) <EOL> return filename <EOL> def save_to_file ( self , filename , save_parents = True , filep = None ) : <EOL> if not self . xml : <EOL> self . encode ( ) <EOL> if filep : <EOL> f = filep <EOL> else : <EOL> f = open ( filename , "<STR_LIT:w>" ) <EOL> f . write ( self . xml ) <EOL> f . close ( ) <EOL> def save_to_string ( self , save_parents = True ) : <EOL> if not self . xml : <EOL> self . encode ( ) <EOL> return self . xml <EOL> def get_refid ( self ) : <EOL> if not self . refid : <EOL> self . refid = '<STR_LIT>' <EOL> return self . refid <EOL> def set_refid ( self , rid ) : <EOL> self . refid = rid <EOL> def updateRefID ( self ) : <EOL> if not self . parent : <EOL> self . set_refid ( '<STR_LIT>' ) <EOL> return [ ] <EOL> refs = [ ] <EOL> next_cred = self . parent <EOL> while next_cred : <EOL> refs . append ( next_cred . get_refid ( ) ) <EOL> if next_cred . parent : <EOL> next_cred = next_cred . parent <EOL> else : <EOL> next_cred = None <EOL> rid = self . get_refid ( ) <EOL> while rid in refs : <EOL> val = int ( rid [ <NUM_LIT:3> : ] ) <EOL> rid = "<STR_LIT>" % ( val + <NUM_LIT:1> ) <EOL> self . set_refid ( rid ) <EOL> return refs <EOL> def get_xml ( self ) : <EOL> if not self . xml : <EOL> self . encode ( ) <EOL> return self . xml <EOL> def sign ( self ) : <EOL> if not self . issuer_privkey : <EOL> print "<STR_LIT>" <EOL> return <EOL> if not self . issuer_gid : <EOL> print "<STR_LIT>" <EOL> return <EOL> doc = parseString ( self . get_xml ( ) ) <EOL> sigs = doc . getElementsByTagName ( "<STR_LIT>" ) [ <NUM_LIT:0> ] <EOL> signature = Signature ( ) <EOL> signature . set_refid ( self . get_refid ( ) ) <EOL> sdoc = parseString ( signature . get_xml ( ) ) <EOL> sig_ele = doc . importNode ( sdoc . getElementsByTagName ( "<STR_LIT>" ) [ <NUM_LIT:0> ] , True ) <EOL> sigs . appendChild ( sig_ele ) <EOL> self . xml = doc . toxml ( ) <EOL> chain = GID ( filename = self . issuer_gid ) <EOL> gid_files = [ ] <EOL> while chain : <EOL> gid_files . append ( chain . save_to_random_tmp_file ( False ) ) <EOL> if chain . get_parent ( ) : <EOL> chain = chain . get_parent ( ) <EOL> else : <EOL> chain = None <EOL> ref = '<STR_LIT>' % self . get_refid ( ) <EOL> filename = self . save_to_random_tmp_file ( ) <EOL> command = '<STR_LIT>' % ( self . xmlsec_path , ref , self . issuer_privkey , "<STR_LIT:U+002C>" . join ( gid_files ) , filename ) <EOL> signed = os . popen ( command ) . read ( ) <EOL> os . remove ( filename ) <EOL> for gid_file in gid_files : <EOL> os . remove ( gid_file ) <EOL> self . xml = signed <EOL> if self . legacy : <EOL> self . legacy = None <EOL> self . decode ( ) <EOL> def decode ( self ) : <EOL> if not self . xml : <EOL> return <EOL> doc = parseString ( self . xml ) <EOL> sigs = [ ] <EOL> signed_cred = doc . getElementsByTagName ( "<STR_LIT>" ) <EOL> if len ( signed_cred ) > <NUM_LIT:0> : <EOL> creds = signed_cred [ <NUM_LIT:0> ] . getElementsByTagName ( "<STR_LIT>" ) <EOL> signatures = signed_cred [ <NUM_LIT:0> ] . getElementsByTagName ( "<STR_LIT>" ) <EOL> if len ( signatures ) > <NUM_LIT:0> : <EOL> sigs = signatures [ <NUM_LIT:0> ] . getElementsByTagName ( "<STR_LIT>" ) <EOL> else : <EOL> creds = doc . getElementsByTagName ( "<STR_LIT>" ) <EOL> if creds is None or len ( creds ) == <NUM_LIT:0> : <EOL> raise CredentialNotVerifiable ( "<STR_LIT>" ) <EOL> cred = creds [ <NUM_LIT:0> ] <EOL> self . set_refid ( cred . getAttribute ( "<STR_LIT>" ) ) <EOL> self . set_expiration ( utcparse ( getTextNode ( cred , "<STR_LIT>" ) ) ) <EOL> self . gidCaller = GID ( string = getTextNode ( cred , "<STR_LIT>" ) ) <EOL> self . gidObject = GID ( string = getTextNode ( cred , "<STR_LIT>" ) ) <EOL> privs = cred . getElementsByTagName ( "<STR_LIT>" ) [ <NUM_LIT:0> ] <EOL> rlist = Rights ( ) <EOL> for priv in privs . getElementsByTagName ( "<STR_LIT>" ) : <EOL> kind = getTextNode ( priv , "<STR_LIT:name>" ) <EOL> deleg = str2bool ( getTextNode ( priv , "<STR_LIT>" ) ) <EOL> if kind == '<STR_LIT:*>' : <EOL> _ , type = urn_to_hrn ( self . gidObject . get_urn ( ) ) <EOL> rl = determine_rights ( type , self . gidObject . get_urn ( ) ) <EOL> for r in rl . rights : <EOL> r . delegate = deleg <EOL> rlist . add ( r ) <EOL> else : <EOL> rlist . add ( Right ( kind . strip ( ) , deleg ) ) <EOL> self . set_privileges ( rlist ) <EOL> parent = cred . getElementsByTagName ( "<STR_LIT>" ) <EOL> if len ( parent ) > <NUM_LIT:0> : <EOL> parent_doc = parent [ <NUM_LIT:0> ] . getElementsByTagName ( "<STR_LIT>" ) [ <NUM_LIT:0> ] <EOL> parent_xml = parent_doc . toxml ( ) <EOL> self . parent = Credential ( string = parent_xml ) <EOL> self . updateRefID ( ) <EOL> for sig in sigs : <EOL> Sig = Signature ( string = sig . toxml ( ) ) <EOL> for cur_cred in self . get_credential_list ( ) : <EOL> if cur_cred . get_refid ( ) == Sig . get_refid ( ) : <EOL> cur_cred . set_signature ( Sig ) <EOL> def verify ( self , trusted_certs = None , schema = None , trusted_certs_required = True ) : <EOL> if not self . xml : <EOL> self . decode ( ) <EOL> if HAVELXML and not self . legacy : <EOL> if schema and os . path . exists ( schema ) : <EOL> tree = etree . parse ( StringIO ( self . xml ) ) <EOL> schema_doc = etree . parse ( schema ) <EOL> xmlschema = etree . XMLSchema ( schema_doc ) <EOL> if not xmlschema : <EOL> error = xmlschema . error_log . last_error <EOL> message = "<STR_LIT>" % ( self . get_summary_tostring ( ) , error . message , error . line ) <EOL> raise CredentialNotVerifiable ( message ) <EOL> if trusted_certs_required and trusted_certs is None : <EOL> trusted_certs = [ ] <EOL> trusted_cert_objects = [ ] <EOL> ok_trusted_certs = [ ] <EOL> if trusted_certs is not None : <EOL> for f in trusted_certs : <EOL> try : <EOL> trusted_cert_objects . append ( GID ( filename = f ) ) <EOL> ok_trusted_certs . append ( f ) <EOL> except Exception , exc : <EOL> print "<STR_LIT>" % ( f , exc ) <EOL> trusted_certs = ok_trusted_certs <EOL> if self . legacy : <EOL> self . legacy . verify_chain ( trusted_cert_objects ) <EOL> if self . legacy . client_gid : <EOL> self . legacy . client_gid . verify_chain ( trusted_cert_objects ) <EOL> if self . legacy . object_gid : <EOL> self . legacy . object_gid . verify_chain ( trusted_cert_objects ) <EOL> return True <EOL> if self . get_expiration ( ) < datetime . datetime . utcnow ( ) : <EOL> raise CredentialNotVerifiable ( "<STR_LIT>" % ( self . get_summary_tostring ( ) , self . expiration . isoformat ( ) ) ) <EOL> filename = self . save_to_random_tmp_file ( ) <EOL> if trusted_certs is not None : <EOL> cert_args = "<STR_LIT:U+0020>" . join ( [ '<STR_LIT>' % x for x in trusted_certs ] ) <EOL> if trusted_certs is not None : <EOL> for cur_cred in self . get_credential_list ( ) : <EOL> cur_cred . get_gid_object ( ) . verify_chain ( trusted_cert_objects ) <EOL> cur_cred . get_gid_caller ( ) . verify_chain ( trusted_cert_objects ) <EOL> refs = [ ] <EOL> refs . append ( "<STR_LIT>" % self . get_refid ( ) ) <EOL> parentRefs = self . updateRefID ( ) <EOL> for ref in parentRefs : <EOL> refs . append ( "<STR_LIT>" % ref ) <EOL> for ref in refs : <EOL> if trusted_certs is None : <EOL> break <EOL> verified = os . popen ( '<STR_LIT>' % ( self . xmlsec_path , ref , cert_args , filename ) ) . read ( ) <EOL> if not verified . strip ( ) . startswith ( "<STR_LIT:OK>" ) : <EOL> mstart = verified . find ( "<STR_LIT>" ) <EOL> msg = "<STR_LIT>" <EOL> if mstart > - <NUM_LIT:1> and len ( verified ) > <NUM_LIT:4> : <EOL> mstart = mstart + <NUM_LIT:4> <EOL> mend = verified . find ( '<STR_LIT:\\>' , mstart ) <EOL> msg = verified [ mstart : mend ] <EOL> raise CredentialNotVerifiable ( "<STR_LIT>" % ( self . get_summary_tostring ( ) , ref , msg , verified . strip ( ) ) ) <EOL> os . remove ( filename ) <EOL> if self . parent : <EOL> self . verify_parent ( self . parent ) <EOL> self . verify_issuer ( trusted_cert_objects ) <EOL> return True <EOL> def get_credential_list ( self ) : <EOL> cur_cred = self <EOL> list = [ ] <EOL> while cur_cred : <EOL> list . append ( cur_cred ) <EOL> if cur_cred . parent : <EOL> cur_cred = cur_cred . parent <EOL> else : <EOL> cur_cred = None <EOL> return list <EOL> def verify_issuer ( self , trusted_gids ) : <EOL> root_cred = self . get_credential_list ( ) [ - <NUM_LIT:1> ] <EOL> root_target_gid = root_cred . get_gid_object ( ) <EOL> root_cred_signer = root_cred . get_signature ( ) . get_issuer_gid ( ) <EOL> if root_target_gid . is_signed_by_cert ( root_cred_signer ) : <EOL> return <EOL> if trusted_gids and len ( trusted_gids ) > <NUM_LIT:0> : <EOL> root_cred_signer . verify_chain ( trusted_gids ) <EOL> else : <EOL> print "<STR_LIT>" <EOL> root_cred_signer_type = root_cred_signer . get_type ( ) <EOL> if ( root_cred_signer_type . find ( '<STR_LIT>' ) == <NUM_LIT:0> ) : <EOL> signerhrn = root_cred_signer . get_hrn ( ) <EOL> if hrn_authfor_hrn ( signerhrn , root_target_gid . get_hrn ( ) ) : <EOL> return <EOL> raise CredentialNotVerifiable ( "<STR_LIT>" % ( self . gidCaller . get_urn ( ) , self . gidObject . get_urn ( ) , root_cred_signer . get_hrn ( ) , root_target_gid . get_hrn ( ) ) ) <EOL> def verify_parent ( self , parent_cred ) : <EOL> if not parent_cred . get_privileges ( ) . is_superset ( self . get_privileges ( ) ) : <EOL> raise ChildRightsNotSubsetOfParent ( ( "<STR_LIT>" % parent_cred . get_refid ( ) ) + <EOL> self . parent . get_privileges ( ) . save_to_string ( ) + ( "<STR_LIT>" % ( self . get_summary_tostring ( ) , self . get_refid ( ) ) ) + <EOL> self . get_privileges ( ) . save_to_string ( ) ) <EOL> if not parent_cred . get_gid_object ( ) . save_to_string ( ) == self . get_gid_object ( ) . save_to_string ( ) : <EOL> raise CredentialNotVerifiable ( "<STR_LIT>" % ( self . get_summary_tostring ( ) , parent_cred . get_summary_tostring ( ) ) ) <EOL> if not parent_cred . get_expiration ( ) >= self . get_expiration ( ) : <EOL> raise CredentialNotVerifiable ( "<STR_LIT>" % ( self . get_summary_tostring ( ) , parent_cred . get_summary_tostring ( ) ) ) <EOL> if not parent_cred . get_gid_caller ( ) . save_to_string ( False ) == self . get_signature ( ) . get_issuer_gid ( ) . save_to_string ( False ) : <EOL> raise CredentialNotVerifiable ( "<STR_LIT>" % ( self . get_summary_tostring ( ) , parent_cred . get_summary_tostring ( ) ) ) <EOL> if parent_cred . parent : <EOL> parent_cred . verify_parent ( parent_cred . parent ) <EOL> def delegate ( self , delegee_gidfile , caller_keyfile , caller_gidfile ) : <EOL> """<STR_LIT>""" <EOL> object_gid = self . get_gid_object ( ) <EOL> object_hrn = object_gid . get_hrn ( ) <EOL> delegee_gid = GID ( filename = delegee_gidfile ) <EOL> delegee_hrn = delegee_gid . get_hrn ( ) <EOL> subject_string = "<STR_LIT>" % ( object_hrn , delegee_hrn ) <EOL> dcred = Credential ( subject = subject_string ) <EOL> dcred . set_gid_caller ( delegee_gid ) <EOL> dcred . set_gid_object ( object_gid ) <EOL> dcred . set_parent ( self ) <EOL> dcred . set_expiration ( self . get_expiration ( ) ) <EOL> dcred . set_privileges ( self . get_privileges ( ) ) <EOL> dcred . get_privileges ( ) . delegate_all_privileges ( True ) <EOL> dcred . set_issuer_keys ( caller_keyfile , caller_gidfile ) <EOL> dcred . encode ( ) <EOL> dcred . sign ( ) <EOL> return dcred <EOL> def get_filename ( self ) : <EOL> return getattr ( self , '<STR_LIT:filename>' , None ) <EOL> def dump ( self , * args , ** kwargs ) : <EOL> print self . dump_string ( * args , ** kwargs ) <EOL> def dump_string ( self , dump_parents = False , show_xml = False ) : <EOL> result = "<STR_LIT>" <EOL> result += "<STR_LIT>" % self . get_subject ( ) <EOL> filename = self . get_filename ( ) <EOL> if filename : result += "<STR_LIT>" % filename <EOL> result += "<STR_LIT>" % self . get_privileges ( ) . save_to_string ( ) <EOL> gidCaller = self . get_gid_caller ( ) <EOL> if gidCaller : <EOL> result += "<STR_LIT>" <EOL> result += gidCaller . dump_string ( <NUM_LIT:8> , dump_parents ) <EOL> if self . get_signature ( ) : <EOL> print "<STR_LIT>" <EOL> self . get_signature ( ) . get_issuer_gid ( ) . dump ( <NUM_LIT:8> , dump_parents ) <EOL> if self . expiration : <EOL> print "<STR_LIT>" , self . expiration . isoformat ( ) <EOL> gidObject = self . get_gid_object ( ) <EOL> if gidObject : <EOL> result += "<STR_LIT>" <EOL> result += gidObject . dump_string ( <NUM_LIT:8> , dump_parents ) <EOL> if self . parent and dump_parents : <EOL> result += "<STR_LIT>" <EOL> result += self . parent . dump_string ( True ) <EOL> if show_xml : <EOL> try : <EOL> tree = etree . parse ( StringIO ( self . xml ) ) <EOL> aside = etree . tostring ( tree , pretty_print = True ) <EOL> result += "<STR_LIT>" <EOL> result += aside <EOL> result += "<STR_LIT>" <EOL> except : <EOL> import traceback <EOL> print "<STR_LIT>" <EOL> traceback . print_exc ( ) <EOL> return result </s>
