/usr/lib/python2.6/site-packages/keystoneclient/common
Edit: /usr/lib/python2.6/site-packages/keystoneclient/common/cms.pyc (14078B)
Ñò
d d k l } | i o d d k l a n
d d k a Wqk t j
o d d k a qk Xn d S( Niÿÿÿÿ( t patcher( t
subprocess( R t eventletR t already_patchedt eventlet.greent ImportError( R ( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt _ensure_subprocess5 s
c C s
| a d S( s‘ Set subprocess module to use.
The subprocess could be eventlet.green.subprocess if using eventlet,
or Python's subprocess otherwise.
N( R ( t _subprocess( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt set_subprocessE s c C sŽ d } d } y6 x/ | D]' } t | d ƒ i i ƒ z Wd QXq WWn? t j
o3 } t d ƒ h | d 6| i d 6} t i } n X| | f S( Niÿÿÿÿt rsV Hit OSError in _process_communicate_handle_oserror()
Likely due to %(file)s: %(error)st filet error( t Nonet opent __exit__t __enter__t IOErrorR t strerrorR R
( t filest errt retcodet try_filet e( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt _check_files_accessibleN s
c C sÌ y | i | ƒ \ } } Wnw t j
ok } | i t i j o ‚ n t | ƒ \ } } | i o& | i i ƒ } | | i d ƒ } n d } n. X| i ƒ } | d j o | i d ƒ } n | | | f S( s; Wrapper around process.communicate that checks for OSError.s utf-8t N(
t communicatet OSErrort errnot EPIPER& t stderrt readt decodet pollR ( t processt dataR! t outputR" R% R# t msg( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt# _process_communicate_handle_oserrorb s
c C sW | t j o
d } n= | t j o
d } n& t t d ƒ d i t t f ƒ ƒ ‚ | S( Ns UTF-8t hexs "inform" must be one of: %st ,( t
PKI_ASN1_FORMt
PKIZ_CMS_FORMt
ValueErrorR t join( t informt encoding( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt _encoding_for_form| s
c
C s0 t ƒ t | t i ƒ o t | t | ƒ ƒ } n | } t i d d d d | d | d d d d d
d g
d t i d
t i d t i d t ƒ} t
| | | | f ƒ \ } } } | t i j o6 | i
d ƒ o t i | ƒ ‚ q,t i | ƒ ‚ n6 | t i j o% t i | d ƒ } | | _ | ‚ n | S( sL Verifies the signature of the contents IAW CMS syntax.
:raises subprocess.CalledProcessError:
:raises keystoneclient.exceptions.CertificateConfigError: if certificate
is not configured
properly.
t opensslt cmss -verifys -certfiles -CAfiles -informR s -nosmimecaps -nodetachs -nocertss -noattrt stdint stdoutR, t close_fdss Error reading S/MIME message( R t
isinstancet sixt string_typest bytearrayR= R t Popent PIPEt TrueR4 R R
t
startswithR t CMSErrort CertificateConfigErrorR t CalledProcessErrorR2 (
t formattedt signing_cert_file_namet ca_file_nameR; R1 R0 R2 R" R# R% ( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt
cms_verify‰ s2
c C s
| i t ƒ S( s• Determine if a token a cmsz token
Checks if the string has the prefix that indicates it is a
Crypto Message Syntax, Z compressed token.
( RJ t PKIZ_PREFIX( t
token_text( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt is_pkiz¿ s i c C sM t | | | t d | ƒ} t i | | ƒ } t t i | ƒ i d ƒ } | S( Nt message_digests utf-8( t
cms_sign_dataR8 t zlibt compressRR t base64t urlsafe_b64encodeR. ( t textRO t signing_key_file_namet compression_levelRU t signedt
compressedt encoded( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt pkiz_signÈ s c C s; | t t ƒ i d ƒ } t i | ƒ } t i | ƒ } | S( Ns utf-8( t lenRR t encodeRY t urlsafe_b64decodeRW t
decompress( t signed_textR[ t unencodedt uncompressed( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt pkiz_uncompressÙ s c C s" t | ƒ } t | | | d t ƒS( NR; ( Ri RQ R8 ( Rf RO RP Rh ( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt pkiz_verifyà s c C sK | i d d ƒ } d g } | t i | d ƒ 7} | i d ƒ d i | ƒ S( s Converts a custom formatted token to a PEM-formatted token.
See documentation for cms_to_token() for details on the custom formatting.
t -t /s -----BEGIN CMS-----i@ s -----END CMS-----
s
( t replacet textwrapt wrapt appendR: ( Rf t copy_of_textt lines( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt token_to_cmsæ s
c C s t t | ƒ | | ƒ S( N( RQ Rs ( t tokenRO RP ( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt verify_tokenó s c C s | d t j S( s§ Determine if a token appears to be PKI-based.
thx to ayoung for sorting this out.
base64 decoded hex representation of MII is 3082::
In [3]: binascii.hexlify(base64.b64decode('MII='))
Out[3]: '3082'
re: http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
::
pg4: For tags from 0 to 30 the first octet is the identfier
pg10: Hex 30 means sequence, followed by the length of that sequence.
pg5: Second octet is the length octet
first bit indicates short or long form, next 7 bits encode the
number of subsequent octets that make up the content length octets
as an unsigned binary int
82 = 10000010 (first bit indicates long form)
0000010 = 2 octets of content length
so read the next 2 octets to get the length of the content.
In the case of a very large content length there could be a requirement to
have more than 2 octets to designate the content length, therefore
requiring us to check for MIM, MIQ, etc.
::
In [4]: base64.b64encode(binascii.a2b_hex('3083'))
Out[4]: 'MIM='
In [5]: base64.b64encode(binascii.a2b_hex('3084'))
Out[5]: 'MIQ='
Checking for MI would become invalid at 16 octets of content length
10010000 = 90
In [6]: base64.b64encode(binascii.a2b_hex('3090'))
Out[6]: 'MJA='
Checking for just M is insufficient
But we will only check for MII:
Max length of the content using 2 octets is 3FFF or 16383.
It's not practical to support a token of this length or greater in http
therefore, we will check for MII only and ignore the case of larger tokens
i ( t PKI_ASN1_PREFIX( Rt ( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt
is_asn1_tokenù s /t messages Use is_asn1_token() instead.t versions 1.7.0t removal_versions 2.0.0c C s
t | ƒ S( s˜ Deprecated.
This function is deprecated as of the 1.7.0 release in favor of
:func:`is_asn1_token` and may be removed in the 2.0.0 release.
( Rw ( Rt ( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt
is_ans1_token+ s c C s t | | | d | ƒS( NRU ( RV ( t data_to_signRO R\ RU ( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt
cms_sign_text6 s c
C sG t ƒ t | t i ƒ o t | d d ƒ} n | } t i d d d d | d | d d d
d d d
d | g d t i d t i d t i d t ƒ} t | | | | f ƒ \ } } } | t
i j p
d | j oS | t
i j o t
i t d ƒ ƒ n t
i t d ƒ | ƒ t i | d ƒ ‚ n | t j o | i d ƒ S| Sd S( sc Uses OpenSSL to sign a document.
Produces a Base64 encoding of a DER formatted CMS Document
http://en.wikipedia.org/wiki/Cryptographic_Message_Syntax
:param data_to_sign: data to sign
:param signing_cert_file_name: path to the X509 certificate containing
the public key associated with the private key used to sign the data
:param signing_key_file_name: path to the private key used to sign
the data
:param outform: Format for the signed document PKIZ_CMS_FORM or
PKI_ASN1_FORM
:param message_digest: Digest algorithm to use when signing or resigning
R< s utf-8R> R? s -signs -signers -inkeys -outformR s -nosmimecaps -nodetachs -nocertss -noattrs -mdR@ RA R, RB t Errorsk Signing error: Unable to load certificate - ensure you have configured PKI with "keystone-manage pki_setup"s Signing error: %sN( R RC RD RE RF R RG RH RI R4 R R R t LOGR R RM R7 R. (
R| RO R\ t outformRU R1 R0 R2 R" R# ( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyRV < s2
c C s" t | | | d | ƒ} t | ƒ S( NRU ( RV t cms_to_token( R[ RO R\ RU R2 ( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt cms_sign_tokenp s c C s^ d } d } | } | i d d ƒ } | i | d ƒ } | i | d ƒ } | i d d ƒ } | S( sL Converts a CMS-signed token in PEM format to a custom URL-safe format.
The conversion consists of replacing '/' char in the PEM-formatted token
with the '-' char and doing other such textual replacements to make the
result marshallable via HTTP. The return value can thus be used as the
value of a HTTP header such as "X-Auth-Token".
This ad-hoc conversion is an unfortunate oversight since the returned
value now does not conform to any of the standard variants of base64
encoding. It would have been better to use base64url encoding (either on
the PEM formatted text or, perhaps even better, on the inner CMS-signed
binary value without any PEM formatting). In any case, the same conversion
is done in reverse in the other direction (for token verification), so
there are no correctness issues here. Note that the non-standard encoding
of the token will be preserved so as to not break backward compatibility.
The conversion issue is detailed by the code author in a blog post at
http://adam.younglogic.com/2014/02/compressed-tokens/.
s -----BEGIN CMS-----s -----END CMS-----Rl Rk R' s
( Rm ( t cms_textt start_delimt end_delimRf ( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyR w s t md5c C s | d j o d St | ƒ p
t | ƒ oM t i | ƒ } t | t i ƒ o | i d ƒ } n | i | ƒ | i
ƒ S| Sd S( s™ Hash PKI tokens.
return: for asn1 or pkiz tokens, returns the hash of the passed in token
otherwise, returns what it was passed in.
s utf-8N( R Rw RT t hashlibt newRC RD t text_typeRc t updatet hexdigest( t token_idt modet hasher( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt cms_hash_token– s
(/ t __doc__RY R* R‡ t loggingRn RW t
debtcollectorR RD t keystoneclientR t keystoneclient.i18nR R R R t getLoggerR
R Rv RR R8 R7 t DEFAULT_TOKEN_DIGEST_ALGORITHMt objectR R R R& R4 R= RQ RT Ra Ri Rj Rs Ru Rw t removeR{ R} RV R‚ R R ( ( ( sH /tmp/pip-build-cD3xZi/python-keystoneclient/keystoneclient/common/cms.pyt sP 5
2 3