diff --git a/confluent/auth.py b/confluent/auth.py
index 09641b1a..f60a2fc6 100644
--- a/confluent/auth.py
+++ b/confluent/auth.py
@@ -21,9 +21,9 @@
import confluent.config.configmanager as configmanager
import eventlet
-import Crypto.Protocol.KDF as kdf
-import Crypto.Hash as hash
-import os
+import Crypto.Protocol.KDF as KDF
+import hashlib
+import hmac
import time
_passcache = {}
@@ -33,7 +33,7 @@ _passchecking = {}
def _prune_passcache():
# This function makes sure we don't remember a passphrase in memory more
# than 10 seconds
- while (1):
+ while True:
curtime = time.time()
for passent in _passcache.iterkeys():
if passent[2] < curtime - 10:
@@ -88,7 +88,7 @@ def authorize(name, element, tenant=False, operation='create'):
manager = configmanager.ConfigManager(tenant)
userobj = manager.get_user(user)
if userobj: # returning
- return (userobj, manager, user, tenant)
+ return userobj, manager, user, tenant
return None
@@ -110,7 +110,7 @@ def check_user_passphrase(name, passphrase, element=None, tenant=False):
embedded in name)
"""
# The reason why tenant is 'False' instead of 'None':
- # None means explictly not a tenant. False means check
+ # None means explicitly not a tenant. False means check
# the username for signs of being a tenant
# If there is any sign of guessing on a user, all valid and
# invalid attempts are equally slowed to no more than 20 per second
@@ -135,7 +135,7 @@ def check_user_passphrase(name, passphrase, element=None, tenant=False):
cfm = configmanager.ConfigManager(tenant)
ucfg = cfm.get_user(user)
if ucfg is None or 'cryptpass' not in ucfg:
- eventlet.sleep(0.05) # stall even on test for existance of a username
+ eventlet.sleep(0.05) # stall even on test for existence of a username
return None
_passchecking[(user, tenant)] = True
# TODO(jbjohnso): WORKERPOOL
@@ -143,8 +143,8 @@ def check_user_passphrase(name, passphrase, element=None, tenant=False):
# throw it at the worker pool when implemented
# maybe a distinct worker pool, wondering about starving out non-auth stuff
salt, crypt = ucfg['cryptpass']
- crypted = kdf.PBKDF2(passphrase, salt, 32, 10000,
- lambda p, s: hash.HMAC.new(p, s, hash.SHA256).digest()
+ crypted = KDF.PBKDF2(passphrase, salt, 32, 10000,
+ lambda p, s: hmac.new(p, s, hashlib.sha256).digest()
)
del _passchecking[(user, tenant)]
eventlet.sleep(0.05) # either way, we want to stall so that client can't
diff --git a/confluent/exceptions.py b/confluent/exceptions.py
index f18c9fcc..e8a8108d 100644
--- a/confluent/exceptions.py
+++ b/confluent/exceptions.py
@@ -13,24 +13,30 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
+
+
class ConfluentException(Exception):
pass
+
class NotFoundException(ConfluentException):
# Something that could be construed as a name was not found
# basically, picture an http error code 404
pass
+
class InvalidArgumentException(ConfluentException):
# Something from the remote client wasn't correct
# like http code 400
pass
+
class TargetEndpointUnreachable(ConfluentException):
# A target system was unavailable. For example, a BMC
# was unreachable. http code 504
pass
+
class ForbiddenRequest(ConfluentException):
# The client request is not allowed by authorization engine
pass
diff --git a/confluent/httpapi.py b/confluent/httpapi.py
index 4201b239..c0936122 100644
--- a/confluent/httpapi.py
+++ b/confluent/httpapi.py
@@ -52,7 +52,7 @@ def group_creation_resources():
yield confluent.messages.Attributes(
kv={'name': None}, desc="Name of the group").html() + '
'
yield confluent.messages.ListAttributes(kv={'nodes': []},
- desc='Nodes to add to the group').html() + '
\n'
+ desc='Nodes to add to the group').html() + '
\n'
for attr in sorted(attribs.node.iterkeys()):
if attr == 'groups':
continue
@@ -60,7 +60,8 @@ def group_creation_resources():
yield confluent.messages.CryptedAttributes(
kv={attr: None},
desc=attribs.node[attr]['description']).html() + '
\n'
- elif 'type' in attribs.node[attr] and list == attribs.node[attr]['type']:
+ elif 'type' in attribs.node[attr] and list == attribs.node[attr][
+ 'type']:
yield confluent.messages.ListAttributes(
kv={attr: []},
desc=attribs.node[attr]['description']).html() + '
\n'
@@ -78,7 +79,8 @@ def node_creation_resources():
yield confluent.messages.CryptedAttributes(
kv={attr: None},
desc=attribs.node[attr]['description']).html() + '
\n'
- elif 'type' in attribs.node[attr] and list == attribs.node[attr]['type']:
+ elif 'type' in attribs.node[attr] and list == attribs.node[attr][
+ 'type']:
yield confluent.messages.ListAttributes(
kv={attr: []},
desc=attribs.node[attr]['description']).html() + '
\n'
@@ -87,6 +89,7 @@ def node_creation_resources():
kv={attr: None},
desc=attribs.node[attr]['description']).html() + '
\n'
+
create_resource_functions = {
'/nodes/': node_creation_resources,
'/groups/': group_creation_resources,
@@ -127,7 +130,7 @@ def _get_query_dict(env, reqbody, reqtype):
elif 'application/json' == reqtype:
pbody = json.loads(reqbody)
for key in pbody.iterkeys():
- qdict[key] = pbody[ky]
+ qdict[key] = pbody[key]
if 'restexplorerhonorkey' in qdict:
nqdict = {}
for key in qdict:
@@ -145,6 +148,7 @@ def _authorize_request(env, operation):
"""
authdata = False
+ name = ''
cookie = Cookie.SimpleCookie()
if 'HTTP_COOKIE' in env:
#attempt to use the cookie. If it matches
@@ -178,10 +182,10 @@ def _authorize_request(env, operation):
'target': env['PATH_INFO'],
}
authinfo = {'code': 200,
- 'cookie': cookie,
- 'cfgmgr': authdata[1],
- 'username': authdata[2],
- 'userdata': authdata[0]}
+ 'cookie': cookie,
+ 'cfgmgr': authdata[1],
+ 'username': authdata[2],
+ 'userdata': authdata[0]}
if authdata[3] is not None:
auditmsg['tenant'] = authdata[3]
authinfo['tenant'] = authdata[3]
@@ -191,13 +195,13 @@ def _authorize_request(env, operation):
return authinfo
else:
return {'code': 401}
- # TODO(jbjohnso): actually evaluate the request for authorization
- # In theory, the x509 or http auth stuff will get translated and then
- # passed on to the core authorization function in an appropriate form
- # expresses return in the form of http code
- # 401 if there is no known identity
- # 403 if valid identity, but no access
- # going to run 200 just to get going for now
+ # TODO(jbjohnso): actually evaluate the request for authorization
+ # In theory, the x509 or http auth stuff will get translated and then
+ # passed on to the core authorization function in an appropriate form
+ # expresses return in the form of http code
+ # 401 if there is no known identity
+ # 403 if valid identity, but no access
+ # going to run 200 just to get going for now
def _pick_mimetype(env):
@@ -239,6 +243,7 @@ def resourcehandler(env, start_response):
yield '500 - Internal Server Error'
return
+
def resourcehandler_backend(env, start_response):
"""Function to handle new wsgi requests
"""
@@ -327,10 +332,11 @@ def resourcehandler_backend(env, start_response):
try:
rsp = json.dumps(rspdata)
except UnicodeDecodeError:
- rsp = json.dumps(rspdata, encoding='cp437')
- except UnicodeDecodeError:
- rsp = json.dumps({'session': querydict['session'],
- 'data': 'DECODEERROR'})
+ try:
+ rsp = json.dumps(rspdata, encoding='cp437')
+ except UnicodeDecodeError:
+ rsp = json.dumps({'session': querydict['session'],
+ 'data': 'DECODEERROR'})
start_response('200 OK', headers)
yield rsp
return
@@ -367,7 +373,7 @@ def resourcehandler_backend(env, start_response):
def _assemble_html(responses, resource, querydict, url):
yield '