Refactoring

master-3.5
parent 3c99855268
commit c193eee22b

@ -14,13 +14,18 @@
# See the License for the specific language governing permissions and
# limitations under the License.
import os, pwd
import sys, subprocess
import socket, time
import os
import pwd
import sys
import subprocess
import socket
import time
import urllib2
from calculate.console.application.function import _print
from function import get_ip_mac_type
from calculate.console.application.sid_func import get_sid
import OpenSSL, hashlib
import OpenSSL
import hashlib
from client_class import HTTPSClientCertTransport
from cert_verify import VerifyError
from calculate.core.datavars import DataVarsCore
@ -28,9 +33,12 @@ from calculate.core.server.methods_func import get_password
from calculate.lib.cl_lang import setLocalTranslate
from calculate.lib.utils.common import getpass
from calculate.lib.utils.files import listDirectory
_ = lambda x: x
setLocalTranslate('cl_console3', sys.modules[__name__])
VERSION = 0.11
def client_post_cert(client, clVars, show_info=False):
""" send a certificate server for check """
sid = get_sid(client.SID_FILE)
@ -41,11 +49,13 @@ def client_post_cert (client, clVars, show_info = False):
result_sid = _result_sid[1].integer
if os.environ.get("DEBUG"):
print _("The client uses certificate %s (server ID %s)") %(client.CERT_FILE, result_post_cert[0])
print _("The client uses certificate %s (server ID %s)") % (
client.CERT_FILE, result_post_cert[0])
if result_post_cert[0] == -4:
print _("Certificate not found on the server")
print _("the client uses certificate %s") % client.CERT_FILE
print _('You can generate a new certificate using options --gen-cert-by and '\
print _('You can generate a new certificate '
'using options --gen-cert-by and '
'--get-cert-from')
raise Exception(3)
@ -75,14 +85,17 @@ def client_post_cert (client, clVars, show_info = False):
if show_info:
if result_sid[1] == 1:
print _(" New Session")
else: print _(" Old Session")
else:
print _(" Old Session")
print _(" Your session ID = %s") % sid
# Creation of secret key of the client
def new_key_req(key, cert_path, server_host_name, private_key_passwd = None, \
def new_key_req(key, cert_path, server_host_name, private_key_passwd=None,
auto=False):
from create_cert import generateRSAKey, makePKey, makeRequest, \
passphrase_callback
rsa = generateRSAKey()
rsa.save_key(key + '_pub', cipher=None, callback=lambda *unused: None)
@ -111,6 +124,7 @@ def new_key_req(key, cert_path, server_host_name, private_key_passwd = None, \
return req_file
def delete_old_cert(client):
try:
os.unlink(client.CERT_FILE)
@ -120,6 +134,7 @@ def delete_old_cert(client):
except OSError, e:
_print(e.message)
def client_post_request(cert_path, args):
if os.path.exists(cert_path + 'req_id'):
print \
@ -137,6 +152,7 @@ def client_post_request (cert_path, args):
url = "https://%s:%s/?wsdl" % (args.by_host, port)
print '%s\n' % url, _("connecting...")
from client_class import Client_suds
try:
client = Client_suds(url, transport=HTTPSClientCertTransport \
(None, None, cert_path))
@ -164,7 +180,7 @@ def client_post_request (cert_path, args):
ip, mac, client_type = get_ip_mac_type()
data = open(csr_file).read()
res = client.service.post_client_request(request = data, ip = ip,\
res = client.service.post_client_request(request=data, ip=ip,
mac=mac, client_type=client_type)
if int(res) < 0:
print _("The server has not signed the certificate!")
@ -177,6 +193,7 @@ def client_post_request (cert_path, args):
'\n' + 'cl-core --sign-client ID_CLIENT_REQUEST')
return 0
def client_get_cert(cert_path, args):
clVars = DataVarsCore()
clVars.importCore()
@ -195,11 +212,14 @@ def client_get_cert(cert_path, args):
print '%s\n' % url, _("connecting...")
from client_class import Client_suds
try:
client = Client_suds(url, \
transport = HTTPSClientCertTransport(None, None, cert_path))
client = Client_suds(url,
transport=HTTPSClientCertTransport(None, None,
cert_path))
except KeyboardInterrupt:
print _("Closing. Connection error.")
return 1
client.wsdl.services[0].setlocation(url)
server_host_name = client.service.get_server_host_name()
@ -303,7 +323,6 @@ def client_get_cert(cert_path, args):
fd.write(ca_root)
fd.close()
user_root_cert = clVars.Get('core.cl_user_root_cert')
user_root_cert = user_root_cert.replace("~", homePath)
fa = open(user_root_cert, 'a')
@ -315,6 +334,7 @@ def client_get_cert(cert_path, args):
print _("The file containing the CA certificate now exists")
return 0
def client_post_auth(client):
""" authorization client or post request """
sid = get_sid(client.SID_FILE)
@ -324,16 +344,19 @@ def client_post_auth(client):
pass # client_post_cert(client)
else:
# client_post_request(client)
print _("You do not have a certificate. Use option --gen-cert-by HOST to generate a new request or --get-cert-from HOST to get a new certificate from the server.")
print _(
"You do not have a certificate. Use option --gen-cert-by HOST to generate a new request or --get-cert-from HOST to get a new certificate from the server.")
raise Exception(1)
# print client.service.versions(sid, VERSION)
except VerifyError, e:
print e.value
raise Exception(1)
########## Get password
def getRunProc():
"""List run program"""
def getCmd(procNum):
cmdLineFile = '/proc/%s/cmdline' % procNum
try:
@ -342,12 +365,14 @@ def getRunProc():
except:
pass
return ["", procNum]
if not os.access('/proc', os.R_OK):
return []
return map(getCmd,
filter(lambda x: x.isdigit(),
listDirectory('/proc')))
def owner(pid):
UID = 1
for ln in open('/proc/%s/status' % pid):
@ -355,6 +380,7 @@ def owner(pid):
uid = int(ln.split()[UID])
return pwd.getpwuid(uid).pw_name
def create_socket(file_path, username):
host = '' # ip
port = 5501 # порт
@ -393,6 +419,7 @@ def create_socket(file_path, username):
port += 1
return s
def set_password(s, req, size):
password = getpass.getpass(_('Password: '))
msg = '%s,%s' % (req, password)
@ -402,6 +429,7 @@ def set_password(s, req, size):
_print(resp)
return password
def clear_password(server_host, server_port):
size = 1024 # размер данных
username = pwd.getpwuid(os.getuid()).pw_name
@ -417,18 +445,19 @@ def clear_password(server_host, server_port):
while connect_error < 10:
if os.path.isfile(file_path):
serv_port, hash_val = open(file_path, 'r').read().split()
break
s.connect(('localhost', int(serv_port)))
req = 'delete,%s,%s,%s,%s' % (server_host, str(server_port),
username, hash_val)
s.send(req)
s.recv(size)
return
else:
connect_error += 1
time.sleep(0.3)
s.connect(('localhost', int(serv_port)))
break
except socket.error:
time.sleep(0.3)
req = 'delete,%s,%s,%s,%s' %(server_host, str(server_port), username,
hash_val)
s.send(req)
resp = s.recv(size)
def socket_connect(s, file_path):
connect_error = 0
@ -437,15 +466,15 @@ def socket_connect(s, file_path):
while connect_error < 10:
if os.path.isfile(file_path):
serv_port, hash_val = open(file_path, 'r').read().split()
break
s.connect(('localhost', int(serv_port)))
return s, hash_val
else:
connect_error += 1
time.sleep(0.3)
s.connect(('localhost', int(serv_port)))
break
except socket.error:
time.sleep(0.3)
return s, hash_val
def get_password_from_daemon(server_host, server_port, wait_thread):
size = 1024 # размер данных
@ -458,7 +487,8 @@ def get_password_from_daemon(server_host, server_port, wait_thread):
s = create_socket(file_path, username)
s, hash_val = socket_connect(s, file_path)
req = '%s,%s,%s,%s' %(server_host,str(server_port),username,hash_val)
req = '%s,%s,%s,%s' % (
server_host, str(server_port), username, hash_val)
s.send(req)
resp = s.recv(size)
if resp.startswith('Error'):

@ -14,25 +14,31 @@
# See the License for the specific language governing permissions and
# limitations under the License.
import os, re, glob, sys
import os
import re
import sys
import OpenSSL
from calculate.console.application.function import _print
from calculate.core.datavars import DataVarsCore
from calculate.lib.cl_lang import setLocalTranslate
_ = lambda x: x
setLocalTranslate('cl_console3', sys.modules[__name__])
class VerifyError(Exception):
def __init__(self, value):
self.value = value
def __str__(self):
return repr(self.value)
# check recall of server certificate
def verify(server_cert, crl_path, flag):
certobj = OpenSSL.crypto.load_certificate \
(OpenSSL.SSL.FILETYPE_PEM, server_cert)
certobj = OpenSSL.crypto.load_certificate(
OpenSSL.SSL.FILETYPE_PEM, server_cert)
serverSerial = certobj.get_serial_number()
Issuer = certobj.get_issuer().get_components()
@ -71,14 +77,13 @@ def verify(server_cert, crl_path, flag):
return 0
crl_object = OpenSSL.crypto.load_crl(OpenSSL.crypto.FILETYPE_PEM, crl)
revoked_objects = crl_object.get_revoked()
for rvk in revoked_objects:
if serverSerial == int(rvk.get_serial(), 16):
print _("This certificate has been revoked!")
print _("Serial")+ _(': %s\n') %rvk.get_serial() + _("Revoke date") + \
_(': %s') %rvk.get_rev_date()
print _("Serial") + _(': %s\n') % rvk.get_serial() + _(
"Revoke date") + _(': %s') % rvk.get_rev_date()
raise VerifyError('CRL Exception')
return 0
@ -100,8 +105,8 @@ def get_CRL(path_to_cert):
try:
os.makedirs(os.path.join(path_to_cert, 'ca'))
except OSError:
print _("Failed to create directory %s") \
%(os.path.join(path_to_cert, 'ca'))
print _("Failed to create directory %s") % (
os.path.join(path_to_cert, 'ca'))
raise Exception(1)
os.makedirs(CRL_path)
@ -117,10 +122,12 @@ def get_CRL(path_to_cert):
if os.path.exists(user_root_cert):
user_ca_certs = open(user_root_cert, 'r').read()
else: user_ca_certs = ''
else:
user_ca_certs = ''
if os.path.exists(glob_root_cert):
glob_ca_certs = open(glob_root_cert, 'r').read()
else: glob_ca_certs = ''
else:
glob_ca_certs = ''
# get certificates list fron text
p = re.compile('[-]+[\w ]+[-]+\n+[\w\n\+\\=/]+[-]+[\w ]+[-]+\n?')
@ -130,25 +137,28 @@ def get_CRL(path_to_cert):
# association in one list
all_ca_certs_list = user_ca_certs_list + glob_ca_certs_list
for ca in all_ca_certs_list:
certobj = OpenSSL.crypto.load_certificate \
(OpenSSL.SSL.FILETYPE_PEM, ca)
certobj = OpenSSL.crypto.load_certificate(OpenSSL.SSL.FILETYPE_PEM, ca)
# get url from certificates
url = None
CN = None
Subject = certobj.get_subject().get_components()
last_subj = ""
for subj in Subject:
if subj[0] == 'L':
url = "https://" + subj[1] + "/?wsdl"
if subj[0] == 'CN':
CN = subj[1]
last_subj = subj
if url:
new_crl = None
from client_class import Client_suds
from client_class import HTTPSClientCertTransport
# connect to ca server (url get from certificates)
client = None
try:
client = Client_suds(url,\
transport = HTTPSClientCertTransport(None, None, \
client = Client_suds(
url, transport=HTTPSClientCertTransport(None, None,
path_to_cert))
client.set_parameters(path_to_cert, None, None)
@ -160,12 +170,11 @@ def get_CRL(path_to_cert):
except:
pass
client.wsdl.services[0].setlocation(url)
if 'new_crl' in locals():
if new_crl:
if CN and len(CN) > 2:
CRL_file = CRL_path + CN
else:
host = subj[1].split(':')[0]
host = last_subj[1].split(':')[0]
CRL_file = CRL_path + host
if new_crl == ' ':
open(CRL_file, 'w')
@ -182,13 +191,14 @@ def get_CRL(path_to_cert):
print _("CRL added")
find_ca_in_crl(CRL_path, all_ca_certs_list)
def find_ca_in_crl(CRL_path, all_ca_certs_list):
CRL_name_list = glob.glob(CRL_path + '*')
for ca in all_ca_certs_list:
certobj = OpenSSL.crypto.load_certificate \
(OpenSSL.SSL.FILETYPE_PEM, ca)
certobj = OpenSSL.crypto.load_certificate(
OpenSSL.SSL.FILETYPE_PEM, ca)
Issuer = certobj.get_issuer().get_components()
CN = ""
for item in Issuer:
if item[0] == 'CN':
CN = item[1]
@ -201,8 +211,8 @@ def find_ca_in_crl (CRL_path, all_ca_certs_list):
crl = "".join(_crl_file.readlines())
try:
crl_object = OpenSSL.crypto.load_crl \
(OpenSSL.crypto.FILETYPE_PEM, crl)
crl_object = OpenSSL.crypto.load_crl(
OpenSSL.crypto.FILETYPE_PEM, crl)
except:
continue
revoked_objects = crl_object.get_revoked()
@ -211,6 +221,7 @@ def find_ca_in_crl (CRL_path, all_ca_certs_list):
if serverSerial == int(rvk.get_serial(), 16):
rm_ca_from_trusted(ca)
def rm_ca_from_trusted(ca_cert):
clVars = DataVarsCore()
clVars.importCore()
@ -230,11 +241,13 @@ def rm_ca_from_trusted(ca_cert):
system_ca_db = clVars.Get('core.cl_glob_root_cert')
import hashlib
md5 = hashlib.md5()
md5.update(ca_cert)
md5sum = md5.hexdigest()
# search ca certificate in user ca list
newfile = ''
with open(user_ca_list) as fd:
t = fd.read()
# See each line
@ -271,7 +284,7 @@ def rm_ca_from_trusted(ca_cert):
if ca_cert != cert:
new_user_ca_certs.append(cert)
else:
print _("CA certificate deleted from the list of user " \
print _("CA certificate deleted from the list of user "
"trusted certificates")
fd = open(user_ca_db, 'w')
@ -291,7 +304,7 @@ def rm_ca_from_trusted(ca_cert):
if ca_cert != cert:
new_system_ca_certs.append(cert)
else:
print _("CA certificate deleted from the list of system " \
print _("CA certificate deleted from the list of system "
"trusted certificates")
fd = open(system_ca_db, 'w')

@ -20,12 +20,16 @@ from sudsds.transport import TransportError
from client_class import Client_suds
import traceback as tb
import time, logging
import os, sys
import threading, urllib2
import time
import logging
import os
import sys
import threading
import urllib2
from pid_information import client_list_methods
from cert_func import client_post_auth, client_post_request, client_get_cert,\
client_post_cert, get_password_from_daemon, clear_password
from cert_func import (client_post_auth, client_post_request, client_get_cert,
client_post_cert, get_password_from_daemon,
clear_password)
from sid_func import session_clean, client_session_info, client_session_list
from cert_verify import get_CRL, VerifyError
@ -33,10 +37,12 @@ import M2Crypto, OpenSSL
from calculate.core.datavars import DataVarsCore
from client_class import HTTPSClientCertTransport
from methods_func import call_method, get_method_argparser, parse, get_view
from function import MessageReceiver, MessageDispatcher, clear, _print, \
get_view_params
from function import (MessageReceiver, MessageDispatcher, clear, _print,
get_view_params)
from calculate.lib.utils.files import makeDirectory, readLinesFile
from calculate.lib.cl_lang import setLocalTranslate
_ = lambda x: x
setLocalTranslate('cl_console3', sys.modules[__name__])
@ -48,6 +54,7 @@ def get_entire_message_receiver(client, pid):
return MessageReceiver.from_entire(client, pid,
MessageDispatcher(Methods()), Display())
def client_signal(client):
Vars = DataVarsCore()
Vars.importCore()
@ -71,6 +78,7 @@ def client_signal(client):
raise Exception(1)
time.sleep(float(client_active))
class StoppableThread(threading.Thread):
def __init__(self):
super(StoppableThread, self).__init__()
@ -80,7 +88,6 @@ class StoppableThread(threading.Thread):
def run(self):
l = ['|', '/', '-', '\\', '|', '/', '-', '\\']
i = 0
while True:
for i in l:
sys.stdout.write("\r\r" + i)
@ -93,7 +100,6 @@ class StoppableThread(threading.Thread):
sys.stdout.flush()
return 0
def pause(self):
self._pause.set()
while not self._paused.is_set():
@ -113,6 +119,7 @@ class StoppableThread(threading.Thread):
def paused(self):
return self._pause.isSet()
def connect_with_cert(cert, path_to_cert, url, args, wait_thread, clVarsCore,
crypto_Error, Connect_Error):
flag_thread_start = False
@ -121,23 +128,22 @@ def connect_with_cert(cert, path_to_cert, url, args, wait_thread, clVarsCore,
CERT_KEY = os.path.join(path_to_cert, cert_name + '.key')
if not os.path.isfile(CERT_FILE) or not os.path.isfile(CERT_KEY):
Connect_Error = 1
return (None, 1, crypto_Error, False, None)
return None, 1, crypto_Error, False, None
client = None
bio = M2Crypto.BIO.openfile(CERT_KEY)
rsa = M2Crypto.m2.rsa_read_key(bio._ptr(), lambda *unused: None)
store_passwd = None
if not rsa:
port = args.port or clVarsCore.Get('core.cl_core_port')
store_passwd = get_password_from_daemon(args.host, args.port,
wait_thread)
if 'store_passwd' in locals():
store_passwd = get_password_from_daemon(args.host, port, wait_thread)
key_passwd = store_passwd
else:
key_passwd = None
er = None
try:
ca_certs = os.path.join(path_to_cert, 'ca/ca_root.crt')
client = Client_suds(url, transport=HTTPSClientCertTransport \
(CERT_KEY, CERT_FILE, path_to_cert, password=key_passwd,
client = Client_suds(
url, transport=HTTPSClientCertTransport(
CERT_KEY, CERT_FILE, path_to_cert, password=key_passwd,
ca_certs=ca_certs, wait_thread=wait_thread))
if not wait_thread.isAlive():
wait_thread = StoppableThread()
@ -150,12 +156,16 @@ def connect_with_cert(cert, path_to_cert, url, args, wait_thread, clVarsCore,
Connect_Error = 0
except VerifyError, e:
Connect_Error = 1
er = e
except OpenSSL.crypto.Error, e:
Connect_Error = 1
crypto_Error = 1
er = e
except urllib2.URLError, e:
Connect_Error = 1
except Exception, e:
er = e
except Exception as e:
er = e
if e.message == 3:
wait_thread.stop()
sys.exit(1)
@ -163,8 +173,8 @@ def connect_with_cert(cert, path_to_cert, url, args, wait_thread, clVarsCore,
if flag_thread_start:
wait_thread.stop()
return (client, Connect_Error, crypto_Error,
True if 'store_passwd' in locals() else False,
e if 'e' in locals() else None)
True if store_passwd is not None else False, er)
def get_server_hostname(host, path_to_cert):
compliance_file = os.path.join(path_to_cert, 'compliance_server_names')
@ -177,6 +187,7 @@ def get_server_hostname(host, path_to_cert):
return server_hostname
return None
def add_server_hostname(host, path_to_cert, server_hostname):
try:
compliance_file = os.path.join(path_to_cert, 'compliance_server_names')
@ -202,23 +213,10 @@ def add_server_hostname(host, path_to_cert, server_hostname):
print e
return False
def https_server(client, args, unknown_args, url, clVarsCore, wait_thread):
client_post_auth(client)
# sym_link = os.path.basename(sys.argv[0])
# if sym_link != 'cl-console':
# wait_thread.stop()
# results = client.service.get_methods(client.sid, 'console')
# find_flag = False
# if hasattr (results, 'stringArray'):
# for _array in results.stringArray:
# if _array.string[0] == sym_link:
# args.method = _array.string[1]
# find_flag = True
# break
# if not find_flag:
# _print (_('Method not found for %s') %sym_link)
if args.stop_consoled:
wait_thread.stop()
os.system('cl-consoled --stop')
@ -242,9 +240,11 @@ def https_server(client, args, unknown_args, url, clVarsCore, wait_thread):
wait_thread.stop()
if args.dump:
from pid_information import client_pid_info
client_pid_info(client)
else:
from pid_information import client_list_pid
client_list_pid(client)
return 0
@ -267,6 +267,7 @@ def https_server(client, args, unknown_args, url, clVarsCore, wait_thread):
if args.pid_kill:
wait_thread.stop()
from pid_information import client_pid_kill
return client_pid_kill(client, args.pid_kill)
retCode = 0
@ -289,7 +290,8 @@ def https_server(client, args, unknown_args, url, clVarsCore, wait_thread):
_unknown_args = method_parser.fixBoolVariables(unknown_args)
_args, _unknown_args = method_parser.parse_known_args(_unknown_args)
_args, _unknown_args = method_parser.parse_known_args(
_unknown_args)
if dispatch_usenew == _args.no_questions:
method_parser.print_help()
@ -334,14 +336,15 @@ def https_server(client, args, unknown_args, url, clVarsCore, wait_thread):
pid = int(mess.message)
except:
return 1
retCode = \
1 if int(client.service.pid_info(client.sid,pid)[0][1]) else 0
retCode = 1 if int(
client.service.pid_info(client.sid, pid)[0][1]) else 0
if not args.keep_result:
client.service.clear_pid_cache(client.sid, pid)
client.service.clear_method_cache(client.sid, args.method)
wait_thread.stop()
return retCode
def main(wait_thread):
parser = parse()
args, unknown_args = parser.parse_known_args()
@ -361,6 +364,7 @@ def main(wait_thread):
cl_wsdl = ob.Get('cl_wsdl_available')
# создать симлинки на команды
from calculate.core.server.func import initialization
initialization(cl_wsdl)
ob.close()
if sym_link in loaded_methods.LoadedMethods.conMethods.keys():
@ -432,12 +436,14 @@ def main(wait_thread):
clear()
serv_hostname = get_server_hostname(host, path_to_cert)
get_name_flag = False
client = None
if serv_hostname:
Connect_Error = 1
crypto_Error = 0
client, Connect_Error, crypto_Error, passwd_flag, e = \
connect_with_cert(serv_hostname, path_to_cert, url, args,
wait_thread, clVarsCore, crypto_Error, Connect_Error)
wait_thread, clVarsCore, crypto_Error,
Connect_Error)
if not wait_thread.isAlive():
wait_thread = StoppableThread()
wait_thread.start()
@ -457,11 +463,12 @@ def main(wait_thread):
get_name_flag = False
if get_name_flag:
if client:
try:
client.port = port
return_val = 1
try:
return_val = https_server(client, args, unknown_args, url, \
return_val = https_server(client, args, unknown_args, url,
clVarsCore, wait_thread)
except urllib2.URLError, e:
print _('Error: '), e
@ -476,7 +483,6 @@ def main(wait_thread):
print e.message
elif e.args:
print e
# tb.print_exc()
return 1
wait_thread.stop()
return return_val
@ -494,14 +500,15 @@ def main(wait_thread):
tb.print_exc()
wait_thread.stop()
server_host_name = ""
try:
client = Client_suds(url, \
transport = HTTPSClientCertTransport(None,None, path_to_cert))
client = Client_suds(
url, transport=HTTPSClientCertTransport(None, None, path_to_cert))
client.wsdl.services[0].setlocation(url)
server_host_name = client.service.get_server_host_name()
if not add_server_hostname(host, path_to_cert, server_host_name):
print 'compliance_file write error!'
del (client)
del client
except urllib2.URLError, e:
wait_thread.stop()
print '\b' + _('Failed to connect') + ':', e
@ -513,6 +520,7 @@ def main(wait_thread):
try:
import glob
all_cert_list = glob.glob(os.path.join(path_to_cert, '*.crt'))
fit_cert_list = []
for client_cert_path in all_cert_list:
@ -524,12 +532,14 @@ def main(wait_thread):
Connect_Error = 1
crypto_Error = 0
e = None
passwd_flag = False
for i in range(0, len(fit_cert_list)):
cert_name = fit_cert_list.pop()
client, Connect_Error, crypto_Error, passwd_flag, e = \
connect_with_cert(cert_name, path_to_cert, url, args,
wait_thread, clVarsCore, crypto_Error, Connect_Error)
wait_thread, clVarsCore, crypto_Error,
Connect_Error)
if not wait_thread.isAlive():
wait_thread = StoppableThread()
wait_thread.start()
@ -555,15 +565,16 @@ def main(wait_thread):
CERT_FILE = None
CERT_KEY = None
client = Client_suds(url, transport = HTTPSClientCertTransport \
(CERT_KEY, CERT_FILE, path_to_cert))
client = Client_suds(
url, transport=HTTPSClientCertTransport(CERT_KEY, CERT_FILE,
path_to_cert))
client.wsdl.services[0].setlocation(url)
client.set_parameters(path_to_cert, CERT_FILE, CERT_KEY)
client.port = port
return_val = 1
try:
return_val = https_server(client, args, unknown_args, url, \
return_val = https_server(client, args, unknown_args, url,
clVarsCore, wait_thread)
except urllib2.URLError, e:
print _('Error: '), e

@ -15,28 +15,37 @@
# limitations under the License.
import urllib2 as u2
if hasattr(u2, "ssl"):
u2.ssl._create_default_https_context = u2.ssl._create_unverified_context
import os, sys
import socket, ssl
import OpenSSL, hashlib, M2Crypto
import os
import sys
import socket
import ssl
import OpenSSL
import hashlib
import M2Crypto
from calculate.core.datavars import DataVarsCore
from calculate.lib.datavars import DataVars
from sudsds.client import Client
from cert_verify import verify, get_CRL
from sudsds.transport.http import HttpTransport, SUDSHTTPRedirectHandler, \
CheckingHTTPSConnection, CheckingHTTPSHandler, \
PYOPENSSL_AVAILABLE, PyOpenSSLSocket
from sudsds.transport.http import (HttpTransport, SUDSHTTPRedirectHandler,
CheckingHTTPSConnection,
CheckingHTTPSHandler,
PYOPENSSL_AVAILABLE, PyOpenSSLSocket)
from sudsds.transport import Transport
from sudsds.properties import Unskin
from cookielib import CookieJar, DefaultCookiePolicy
from logging import getLogger
from calculate.console.datavars import DataVarsConsole
from calculate.lib.cl_lang import setLocalTranslate
_ = lambda x: x
setLocalTranslate('cl_console3', sys.modules[__name__])
log = getLogger(__name__)
flag = 0
class Client_suds(Client):
def set_parameters(self, path_to_cert, CERT_FILE, PKEY_FILE):
self.path_to_cert = path_to_cert
@ -50,6 +59,7 @@ class Client_suds(Client):
if not os.path.exists(self.CRL_PATH):
os.makedirs(self.CRL_PATH)
class CheckingClientHTTPSConnection(CheckingHTTPSConnection):
"""based on httplib.HTTPSConnection code - extended to support
server certificate verification and client certificate authorization"""
@ -156,8 +166,8 @@ class CheckingClientHTTPSConnection(CheckingHTTPSConnection):
if words[0] == md5sum:
filename = words[1]
if not filename:
certobj = OpenSSL.crypto.load_certificate \
(OpenSSL.SSL.FILETYPE_PEM, cert)
certobj = OpenSSL.crypto.load_certificate(
OpenSSL.SSL.FILETYPE_PEM, cert)
Issuer = certobj.get_issuer().get_components()
for item in Issuer:
if item[0] == 'CN':
@ -171,7 +181,8 @@ class CheckingClientHTTPSConnection(CheckingHTTPSConnection):
print _('Field "CN" not found in the certificate!')
return 1
fd = open(os.path.join(cl_client_cert_dir,'ca/',filename),'w')
fd = open(os.path.join(cl_client_cert_dir, 'ca/', filename),
'w')
fd.write(cert)
fd.close()
@ -186,8 +197,8 @@ class CheckingClientHTTPSConnection(CheckingHTTPSConnection):
def add_ca_cert(self, cert, list_ca_certs):
url = 'https://%s:%s/?wsdl' % (self.host, self.port)
client = Client_suds(url, transport = HTTPSClientCertTransport \
(None, None, self.cert_path))
client = Client_suds(
url, transport=HTTPSClientCertTransport(None, None, self.cert_path))
client.wsdl.services[0].setlocation(url)
cert = client.service.get_ca()
if cert == '1':
@ -199,8 +210,8 @@ class CheckingClientHTTPSConnection(CheckingHTTPSConnection):
raise Exception(1)
try:
certobj = OpenSSL.crypto.load_certificate \
(OpenSSL.SSL.FILETYPE_PEM, cert)
certobj = OpenSSL.crypto.load_certificate(
OpenSSL.SSL.FILETYPE_PEM, cert)
except:
print _("Error. Certificate not added to trusted")
raise Exception(1)
@ -225,8 +236,8 @@ class CheckingClientHTTPSConnection(CheckingHTTPSConnection):
def add_server_cert(self, cert):
self.wait_thread.stop()
print _("Untrusted server certificate!")
certobj = OpenSSL.crypto.load_certificate \
(OpenSSL.SSL.FILETYPE_PEM, cert)
certobj = OpenSSL.crypto.load_certificate(
OpenSSL.SSL.FILETYPE_PEM, cert)
print '\n' + _("Fingerprint = %s") % certobj.digest('SHA1')
print _("Serial Number = "), certobj.get_serial_number()
Issuer = certobj.get_issuer().get_components()
@ -251,7 +262,8 @@ class CheckingClientHTTPSConnection(CheckingHTTPSConnection):
if self.host == '127.0.0.1':
host = 'localhost'
else: host = self.host
else:
host = self.host
filename = host
fc = open(self.trusted_path + filename, "w")
fc.write(cert)
@ -308,6 +320,7 @@ class CheckingClientHTTPSConnection(CheckingHTTPSConnection):
raise Exception(1)
else:
import time
time.sleep(0.1)
try:
@ -343,8 +356,8 @@ class CheckingClientHTTPSConnection(CheckingHTTPSConnection):
raise Exception(1)
# if not hasattr(HTTPSClientCertTransport, 'filename') or \
# HTTPSClientCertTransport.filename == None:
HTTPSClientCertTransport.filename = self.cert_list \
(self.host, ca_cert_list, server_cert)
HTTPSClientCertTransport.filename = self.cert_list(
self.host, ca_cert_list, server_cert)
if HTTPSClientCertTransport.filename:
try:
if self.FORCE_SSL_VERSION:
@ -365,7 +378,6 @@ class CheckingClientHTTPSConnection(CheckingHTTPSConnection):
return 0
except Exception:
# print (e)
HTTPSClientCertTransport.filename = None
return 1
else:
@ -387,27 +399,31 @@ class CheckingClientHTTPSConnection(CheckingHTTPSConnection):
while True:
if os.path.exists(user_root_cert):
result_user_root = self.connect_trusted_root(sock, \
user_root_cert, self.CRL_PATH)
result_user_root = self.connect_trusted_root(sock,
user_root_cert,
self.CRL_PATH)
if result_user_root == 1:
glob_root_cert = self.Vars.Get('core.cl_glob_root_cert')
result_root_con = 1
if os.path.exists(glob_root_cert):
sock = socket.create_connection((self.host, self.port),
self.timeout, self.source_address)
self.timeout,
self.source_address)
if self._tunnel_host:
self.sock = sock
self._tunnel()
result_root_con = self.connect_trusted_root(sock, \
glob_root_cert, self.CRL_PATH)
result_root_con = self.connect_trusted_root(sock,
glob_root_cert,
self.CRL_PATH)
if result_root_con == 1:
sock = socket.create_connection((self.host, self.port),
self.timeout, self.source_address)
self.timeout,
self.source_address)
if self._tunnel_host:
self.sock = sock
self._tunnel()
result_server_con = self.connect_trusted_server \
(sock, self.CRL_PATH)
result_server_con = self.connect_trusted_server(
sock, self.CRL_PATH)
if result_server_con in [1, 2]:
raise Exception(1)
elif result_server_con == 3:
@ -416,13 +432,13 @@ class CheckingClientHTTPSConnection(CheckingHTTPSConnection):
print _('This server is not trusted')
self.wait_thread.stop()
sys.exit(1)
# raise Exception (_('This server is not trusted'))
elif result_root_con == 2:
raise Exception(1)
elif result_user_root == 2:
raise Exception(1)
break
class CheckingClientHTTPSHandler(CheckingHTTPSHandler):
def __init__(self, cert_path, ca_certs=None, cert_verifier=None,
client_certfile=None, client_keyfile=None,
@ -448,10 +464,12 @@ class CheckingClientHTTPSHandler(CheckingHTTPSHandler):
new_kw.update(kw)
return CheckingClientHTTPSConnection(self.cert_path,
*args, **new_kw)
return self.do_open(open, req)
https_request = u2.AbstractHTTPHandler.do_request_
class HTTPSClientCertTransport(HttpTransport):
def __init__(self, key, cert, path_to_cert, password=None,
ca_certs=None, cert_verifier=None,
@ -465,34 +483,37 @@ class HTTPSClientCertTransport(HttpTransport):
self.cert = cert
self.cert_path = path_to_cert
if key:
client_certobj = OpenSSL.crypto.load_certificate \
(OpenSSL.SSL.FILETYPE_PEM, file(cert).read())
client_certobj = OpenSSL.crypto.load_certificate(
OpenSSL.SSL.FILETYPE_PEM, file(cert).read())
if password:
client_keyobj = OpenSSL.crypto.load_privatekey \
(OpenSSL.SSL.FILETYPE_PEM, file(key).read(),
str(password))
client_keyobj = OpenSSL.crypto.load_privatekey(
OpenSSL.SSL.FILETYPE_PEM, file(key).read(), str(password))
else:
bio = M2Crypto.BIO.openfile(key)
rsa = M2Crypto.m2.rsa_read_key(bio._ptr(), lambda *unused: None)
if not rsa:
raise OpenSSL.crypto.Error
client_keyobj = OpenSSL.crypto.load_privatekey \
(OpenSSL.SSL.FILETYPE_PEM, file(key).read())
client_keyobj = OpenSSL.crypto.load_privatekey(
OpenSSL.SSL.FILETYPE_PEM, file(key).read())
Unskin(self.options).update(kwargs)
self.cookiejar = CookieJar(DefaultCookiePolicy())
self.cookie_callback = cookie_callback
self.user_agent_string = user_agent_string
log.debug("Proxy: %s", self.options.proxy)
from dslib.network import ProxyManager
proxy_handler = ProxyManager.HTTPS_PROXY.create_proxy_handler()
proxy_auth_handler = \
ProxyManager.HTTPS_PROXY.create_proxy_auth_handler()
if ca_certs or (client_keyfile and client_certfile) \
or (client_keyobj and client_certobj):
https_handler = CheckingClientHTTPSHandler(cert_path=path_to_cert,
ca_certs=ca_certs, cert_verifier=cert_verifier,
client_keyfile=client_keyfile, client_certfile = \
client_certfile, client_keyobj=client_keyobj,
if (ca_certs or (client_keyfile and client_certfile)
or (client_keyobj and client_certobj)):
https_handler = CheckingClientHTTPSHandler(
cert_path=path_to_cert,
ca_certs=ca_certs,
cert_verifier=cert_verifier,
client_keyfile=client_keyfile,
client_certfile=client_certfile,
client_keyobj=client_keyobj,
client_certobj=client_certobj,
wait_thread=wait_thread)
else:

@ -19,21 +19,27 @@ import socket
from M2Crypto import RSA, X509, EVP, m2
from calculate.lib.datavars import DataVars
from calculate.lib.cl_lang import setLocalTranslate
_ = lambda x: x
setLocalTranslate('cl_console3', sys.modules[__name__])
def passphrase_callback(v):
if type(v) == int or not v:
return None
return str(v)
def generateRSAKey():
return RSA.gen_key(2048, m2.RSA_F4)
def makePKey(key):
pkey = EVP.PKey()
pkey.assign_rsa(key)
return pkey
def makeRequest(pubkey, pkey, serv_host, auto=False):
""" create query to the signing on server """
req = X509.Request()
@ -71,7 +77,7 @@ def makeRequest(pubkey, pkey, serv_host, auto = False):
if name.OU in ['', None]:
name.OU = username
name.O = raw_input(_('Organization Name: '))
name.L = raw_input (_('Network address (hostname or IP) [%s]: ')\
name.L = raw_input(_('Network address (hostname or IP) [%s]: ')
% host_name)
name.ST = raw_input(_('City: '))
name.C = raw_input(_('Country (2 characters): [%s]') % lang)

@ -30,28 +30,32 @@ from sudsds import MethodNotFound
from calculate.console.application.sid_func import get_sid
_ = lambda x: x
setLocalTranslate('cl_console3', sys.modules[__name__])
def _print(*args):
print " ".join(map(lambda x: unicode(x).encode('utf-8'), args))
# get list of certificate and session id
def clear():
""" delete caching suds file """
try:
import glob
for filename in glob.glob("/tmp/suds/suds-*"):
# print "delete", filename
try:
os.unlink(filename)
except OSError as e:
_print(e.message)
except:
except Exception:
print _("Failed to clear the cache! ")
return 1
def get_ip_global():
import urllib2
@ -62,22 +66,16 @@ def get_ip_global():
f.close()
return outerIP
def get_ip_mac_type(client_type=None):
results = []
#try:
results.append ( getIpLocal() )
#except:
#results.append ('no_ip')
#try:
results.append ( getHwAddr())
#except:
#results.append ('no_mac')
results = [getIpLocal(), getHwAddr()]
if client_type:
results.append(client_type)
else:
results.append('console')
return results
def print_brief(view, brief_label):
for Group in view.groups.GroupField:
if Group.name:
@ -86,7 +84,7 @@ def print_brief(view, brief_label):
print_brief_group(Group.fields.Field, Group.name)
def _return_revoked_serials(self, crlfile):
def _return_revoked_serials(crlfile):
try:
serials = []
crltext = open(crlfile, 'r').read()
@ -99,7 +97,8 @@ def _return_revoked_serials(self, crlfile):
call = '/usr/bin/openssl crl -text -noout -in %s' % crlfile
call = shlex.split(call)
serials = []
(res,err)=subprocess.Popen(call, stdout=subprocess.PIPE).communicate()
(res, err) = subprocess.Popen(call,
stdout=subprocess.PIPE).communicate()
for line in res.split('\n'):
if line.find('Serial Number:') == -1:
continue
@ -109,6 +108,7 @@ def _return_revoked_serials(self, crlfile):
serials.append(serial)
return serials
def _create_obj(client, method):
try:
view_params = create_obj(client, method)
@ -119,6 +119,7 @@ def _create_obj(client, method):
raise Exception(1)
return view_params
def get_view_params(client, method, step=None, expert=None, brief=None,
onlyhelp=False, dispatch_usenew=False):
view_params = _create_obj(client, method)
@ -135,7 +136,8 @@ class MessageReceiver(object):
Объект организует цикл получения сообщений от WsdlServer и передает их на
обработку MessageDispatcher
"""
class States:
class States(object):
Messages = 0
Progress = 1
Finish = 2
@ -159,7 +161,7 @@ class MessageReceiver(object):
sid = get_sid(client.SID_FILE)
list_pid = client.service.list_pid(sid=sid)
if hasattr(list_pid, 'integer'):
if not pid in list_pid.integer:
if pid not in list_pid.integer:
display.print_error(
_("The process does not exist or does not belong to "
"your session"))
@ -185,6 +187,7 @@ class MessageReceiver(object):
self.get_messages()
except Exception as e:
import traceback
traceback.print_exc()
elif message.type == 'error':
self.display.print_error(message.message)
@ -244,6 +247,7 @@ class MessageDispatcher(object):
В дальнейшем взаимодействует с parent через методы get_progress, get_table,
send_message, поле State
"""
def __init__(self, methods=None):
"""
@param methods: Common
@ -333,4 +337,3 @@ class MessageDispatcher(object):
def ask_password(self, message):
answer = self.methods.askPassword(message.message, message.id == 2)
self.parent.send_message(answer)

@ -14,12 +14,14 @@
# See the License for the specific language governing permissions and
# limitations under the License.
import argparse, sys
import argparse
import sys
from calculate.core.server.api_types import ViewInfoAdapter
from calculate.core.server.local_call import Methods, has_force_arg
from function import _create_obj, get_view_params, print_brief, _print
from calculate.lib.cl_lang import setLocalTranslate
_ = lambda x: x
setLocalTranslate('cl_console3', sys.modules[__name__])
import urllib2
@ -29,8 +31,8 @@ from calculate.core.server.methods_func import get_method_argparser, \
def parse():
parser = argparse.ArgumentParser(add_help=False,
formatter_class=RawAndDefaultsHelpFormatter)
parser = argparse.ArgumentParser(
add_help=False, formatter_class=RawAndDefaultsHelpFormatter)
# parser = argparse.ArgumentParser(add_help=False)
parser.add_argument(
'-h', '--help', action='store_true', default=False,
@ -48,8 +50,7 @@ def parse():
help=_('destination host'))
parser.add_argument(
'--gen-cert-by', type=str, dest='by_host', metavar='HOST',
help = \
_('send a certificate signature request to the server'))
help=_('send a certificate signature request to the server'))
parser.add_argument(
'--get-cert-from', type=str, dest='from_host', metavar='HOST',
help=_('get the signed certificate from the server'))
@ -101,6 +102,7 @@ def parse():
help=_("use passwords from standard input for users accounts"))
return parser
def get_view(client, method, sid, view_params):
try:
view = client.service[0][method + '_view'](client.sid, view_params)
@ -109,6 +111,7 @@ def get_view(client, method, sid, view_params):
raise Exception(1)
return view
def call_method(client, args, unknown_args, wait_thread):
method = args.method
stdin_passwd = args.stdin_passwd
@ -161,17 +164,19 @@ def call_method(client, args, unknown_args, wait_thread):
raise Exception(1)
if view.groups is not None:
param_object, steps = collect_object(client, param_object, view, args,
wait_thread,stdin_passwd=stdin_passwd)
wait_thread,
stdin_passwd=stdin_passwd)
if steps.label and hasattr(param_object, 'CheckOnly'):
param_object['CheckOnly'] = True
check_res = {}
while True:
method_result = client.service[0][method](client.sid,param_object)
method_result = client.service[0][method](client.sid,
param_object)
if not method_result:
print _('Method not available')
return None
if method_result.ReturnedMessage[0].type and \
method_result.ReturnedMessage[0].type != "pid":
if (method_result.ReturnedMessage[0].type and
method_result.ReturnedMessage[0].type != "pid"):
wait_thread.stop()
check_res = check_result_msg(method_result, view,
@ -184,7 +189,7 @@ def call_method(client, args, unknown_args, wait_thread):
else:
break
view_params = get_view_params(client, method + '_view', step = None, \
view_params = get_view_params(client, method + '_view', step=None,
expert=True, brief=True)
view = get_view(client, method, client.sid, view_params)
wait_thread.stop()
@ -207,8 +212,8 @@ def call_method(client, args, unknown_args, wait_thread):
if not method_result:
print _('Method not available')
return None
if method_result.ReturnedMessage[0].type and \
method_result.ReturnedMessage[0].type != "pid":
if (method_result.ReturnedMessage[0].type and
method_result.ReturnedMessage[0].type != "pid"):
view = ViewInfoAdapter(view)
for error in method_result.ReturnedMessage:
display_error(error, args, view.groups)

@ -13,13 +13,17 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
from calculate.console.application.function import _print
from calculate.console.application.sid_func import get_sid
import sys
_ = lambda x: x
from calculate.lib.cl_lang import setLocalTranslate
setLocalTranslate('cl_console3', sys.modules[__name__])
client_types = "console"
#client_types = "gui"
def pid_inf(client, sid, pids):
""" get and show information about process """
@ -43,6 +47,7 @@ def pid_inf(client, sid, pids):
print _(u"Process killed")
return 0
def client_list_pid(client):
""" get all process id for this session """
sid = get_sid(client.SID_FILE)
@ -57,11 +62,12 @@ def client_list_pid(client):
else:
for i in list_pid[0]:
print green + "pid - %d" % i
except:
except Exception:
print red + _("Error fetching the PID list from the server")
return 1
return len(list_pid[0])
def gen_pid_ls(client):
""" generation list with pid for this session """
sid = get_sid(client.SID_FILE)
@ -74,11 +80,12 @@ def gen_pid_ls(client):
else:
for i in list_pid[0]:
pid_ls.append(i)
except:
except Exception:
print _("Error fetching the PID list from the server")
return 0
return pid_ls
def client_pid_info(client):
""" get information about selected process (or about all) """
# try:
@ -86,6 +93,8 @@ def client_pid_info(client):
pid_ls = gen_pid_ls(client)
if pid_ls:
pid_inf(client, sid, pid_ls)
# except:
# print _("Error get data")
# return 1
@ -120,6 +129,7 @@ def client_list_methods(client):
for key in sort_keys:
print " %s - %s" % (key, group_dict[key])
def client_pid_kill(client, pid):
sid = get_sid(client.SID_FILE)

@ -16,9 +16,13 @@
import os
import sys
_ = lambda x: x
from calculate.lib.cl_lang import setLocalTranslate
setLocalTranslate('cl_console3', sys.modules[__name__])
def client_del_sid(client):
""" delete this session """
sid = get_sid(client.SID_FILE)
@ -32,7 +36,7 @@ def client_del_sid(client):
print _("Failed to obtain certificate data!")
return -2
if s[0][0] == "Permission denied":
_print (_("%s: permission denied") % s[1][1])
print _("%s: permission denied") % s[1][1]
return -3
if s[0][0] == '0':
@ -40,11 +44,12 @@ def client_del_sid(client):
fi.write('0')
fi.close()
print _("SID deleted!")
except:
except Exception:
print _("SID deletion error on the server")
return 1
return 0
def sid_inf(client, sid):
red = '\033[31m * \033[0m'
green = '\033[32m * \033[0m'
@ -63,11 +68,12 @@ def sid_inf(client, sid):
print _('Session information: ')
print green + _(u"Session number: %s") % sid
print green + _(u"Certificate number: %s") % s[0][0]
_print (green + _(u"Certificate issued on %s") %s[0][1])
print green + _(u"Certificate issued on %s") % s[0][1]
print green + "ip - %s" % s[0][2]
print green + "MAC - %s\n" % s[0][3]
return 0
def client_session_info(client, sid=None):
""" select session for get information """
try:
@ -81,6 +87,7 @@ def client_session_info(client, sid = None):
print e
return 1
def client_session_list(client):
red = '\033[31m * \033[0m'
green = '\033[32m * \033[0m'
@ -102,29 +109,30 @@ def client_session_list(client):
return 0
print red + _('No active sessions on the server')
def session_clean(client):
try:
res = client.service.clear_session_cache(client.sid)
except Exception, e:
if res:
print _('Error clearing the session cache')
else:
print _('Session cache cleared')
except Exception as e:
if type(e.message) == tuple and len(e.message) == 2 \
and e.message[1] == 'Forbidden':
print _("Access forbidden!")
else:
print e
if res:
print _('Error clearing the session cache')
else:
print _('Session cache cleared')
def get_sid (SID_FILE):
if not os.path.exists(SID_FILE):
fi = open(SID_FILE, 'w')
def get_sid(sid_file):
if not os.path.exists(sid_file):
fi = open(sid_file, 'w')
fi.write('0')
fi.close()
sid = 0
else:
fi = open(SID_FILE, 'r')
fi = open(sid_file, 'r')
sid = fi.read()
fi.close()
return sid

@ -19,16 +19,19 @@ def console_main():
import sys
from calculate.console.application.cl_client import main, StoppableThread
from calculate.console.application.function import _print
reload(sys)
sys.setdefaultencoding("utf-8")
import __builtin__
from calculate.lib.cl_lang import setLocalTranslate
_ = lambda x: x
setLocalTranslate('calculate_console', sys.modules[__name__])
__builtin__.__dict__['_print'] = _print
try:
wait_thread = StoppableThread()
try:
sys.exit(main(wait_thread))
except KeyboardInterrupt:
wait_thread.stop()

@ -19,11 +19,14 @@ __app__ = "Calculate Console"
from calculate.lib.datavars import DataVars
class DataVarsConsole(DataVars):
"""Variable class for installation"""
def importConsole(self, **args):
'''Заполнить конфигурацию переменных, для десктопа'''
"""
Заполнить конфигурацию переменных, для десктопа
"""
self.importVariables()
self.importVariables('calculate.core.variables')
self.importVariables('calculate.console.variables')

@ -18,6 +18,7 @@ import sys
from os import path
from calculate.lib.cl_lang import setLocalTranslate
setLocalTranslate('cl_console3', sys.modules[__name__])
@ -27,13 +28,16 @@ class VariableClGuiData(Variable):
"""
value = '/var/calculate/server'
class VariableClGuiDatabase(Variable):
"""
Variable store name files containing clients certificates
"""
def get(self):
return path.join(self.Get('cl_gui_data'), "client_certs/Database")
class VariableClGuiImagePath(Variable):
"""
Variable store path to images

Loading…
Cancel
Save