Changeset 1856 for TI12-security

Timestamp:

13/12/06 08:56:39 (13 years ago)

Author:

pjkersha

Message:

Added changePassphrase method and removed debug print statements.

File:

• TI12-security/trunk/python/Tests/MyProxyClient/m2CryptoMyPxClnt.py (modified) (11 diffs)

TI12-security/trunk/python/Tests/MyProxyClient/m2CryptoMyPxClnt.py

@@ -35 +35 @@
 
 class MyProxyClient(object):
-    """MyProxy client interface
+    """MyProxy client interface 
+    
+    Based on protocol definitions in: 
+    
+    http://grid.ncsa.uiuc.edu/myproxy/protocol/
     
     @cvar __getCmd: get command string
@@ -48 +52 @@
 PASSPHRASE=%s
 LIFETIME=%d\0"""
-
+ 
     __infoCmd="""VERSION=MYPROXYv2
 COMMAND=2
@@ -60 +64 @@
 PASSPHRASE=PASSPHRASE
 LIFETIME=0"""
+
+    __changePassphraseCmd="""VERSION=MYPROXYv2
+ COMMAND=4
+ USERNAME=%s
+ PASSPHRASE=%s
+ NEW_PHRASE=%s
+ LIFETIME=0"""
    
     __storeCmd="""VERSION=MYPROXYv2
@@ -270 +281 @@
             "No client authentication cert. and private key file were given"
         
-        import pdb;pdb.set_trace()
+
         context = Context(protocol='sslv3')
         context.load_cert(ownerCertFile,
@@ -293 +304 @@
     
         # send info command
-        cmd = MyProxyClient.__infoCmd % (username)
+        cmd = MyProxyClient.__infoCmd % username
         conn.write(cmd)
     
@@ -306 +317 @@
 
         return not bool(respCode), errorTxt, field
+
+
+    #_________________________________________________________________________   
+    def changePassphrase(self,
+                         username, 
+                         passphrase,
+                         newPassphrase,
+                         ownerCertFile=None,
+                         ownerKeyFile=None,
+                         ownerPassphrase=None):
+        """change pass-phrase protecting the credentials for a given username
+        
+        Exceptions:  GetError, StoreCredError
+        
+        @param username: username of credential
+        @param passphrase: existing pass-phrase for credential
+        @param newPassphrase: new pass-phrase to replace the existing one.
+        @param ownerCertFile: certificate used for client authentication with
+        the MyProxy server SSL connection.  This ID will be set as the owner
+        of the stored credentials.  Only the owner can later remove 
+        credentials with myproxy-destroy or the destroy method.  If not set,
+        this argument defaults to $GLOBUS_LOCATION/etc/hostcert.pem 
+        @param ownerKeyFile: corresponding private key file.  See explanation
+        for ownerCertFile
+        @param ownerPassphrase: passphrase for ownerKeyFile.  Omit if the
+        private key is not password protected.  
+        @return none
+        """
+        globusLoc = os.environ.get('GLOBUS_LOCATION')
+        if not ownerCertFile or not ownerKeyFile:
+            if globusLoc:
+                ownerCertFile = os.path.join(globusLoc, 'etc', 'hostcert.pem')
+                ownerKeyFile = os.path.join(globusLoc, 'etc', 'hostkey.pem')
+            else:
+                raise MyProxyClientError, \
+            "No client authentication cert. and private key file were given"
+        
+        import pdb;pdb.set_trace()
+        context = Context(protocol='sslv3')
+        context.load_cert(ownerCertFile,
+                          keyfile=ownerKeyFile,
+                          callback=lambda *ar, **kw: ownerPassphrase)
+    
+        # Disable for compatibility with myproxy server (er, globus)
+        # globus doesn't handle this case, apparently, and instead
+        # chokes in proxy delegation code
+        context.set_options(m2.SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)
+        
+        # connect to myproxy server
+        conn = Connection(context, sock=socket.socket())
+        
+        # Fudge to avoid checking client cert - seems to pick globus 
+        # host/<hostname> one
+        conn.clientPostConnectionCheck = None
+        conn.connect((self.hostname, self.port))
+        
+        # send globus compatibility stuff
+        conn.write('0')
+    
+        # send command
+        cmd = MyProxyClient.__changePassphraseCmd % (username, 
+                                                     passphrase,
+                                                     newPassphrase)
+        conn.write(cmd)
+    
+        # process server response
+        dat = conn.recv(8192)
+            
+        respCode, errorTxt = self._deserializeResponse(dat)
+        if respCode:
+            raise GetError, errorTxt
 
 
@@ -339 +421 @@
             "No client authentication cert. and private key file were given"
         
-        import pdb;pdb.set_trace()
+
         context = Context(protocol='sslv3')
         context.load_cert(ownerCertFile,
@@ -361 +443 @@
         conn.write('0')
     
-        # send store command
-        cmd = MyProxyClient.__destroyCmd % (username)
+        # send destroy command
+        cmd = MyProxyClient.__destroyCmd % username
         conn.write(cmd)
     
@@ -412 +494 @@
                 ownerKeyFile = keyFile
         
-        import pdb;pdb.set_trace()
+
         context = Context(protocol='sslv3')
         context.load_cert(ownerCertFile,
@@ -562 +644 @@
                       action="store_true",
                       help="destroy credential")
+
+    parser.add_option("-C", 
+                      "--change-pass-phrase", 
+                      dest="changePassphrase", 
+                      default=False,
+                      action="store_true",
+                      help="change pass-phrase protecting credential")
 
     parser.add_option("-g", 
@@ -659 +748 @@
                 (username, outfile)
             
+        except Exception,e:
+            print "Error:", e
+            sys.exit(1)
+            
+    elif options.changePassphrase:
+                
+        # Get MyProxy password
+        passphrase = getpass.getpass(\
+                     prompt='Enter (current) MyProxy pass phrase: ')
+        
+        newPassphrase = getpass.getpass(\
+                                 prompt='Enter new MyProxy pass phrase: ')
+        
+        if newPassphrase != getpass.getpass(\
+                     prompt='Verifying - Enter new MyProxy pass phrase: '):
+            raise Exception, "Pass-phrases entered don't match"
+        
+        
+        # Retrieve proxy cert
+        try:
+            myProxy.changePassphrase(username,
+                             passphrase,
+                             newPassphrase, 
+                             options.certFile,
+                             options.keyFile,
+                             ownerPassphrase=open('../tmp2').read().strip())            
         except Exception,e:
             print "Error:", e