← Back to branch summary

~ubuntu-branches/debian/sid/keystone/sid

« back to all changes in this revision

Viewing changes to keystone/trust/backends/kvs.py

  • Committer: Package Import Robot
  • Author(s): Thomas Goirand
  • Date: 2013-05-10 10:22:18 UTC
  • mfrom: (1.2.1) (26.1.4 experimental)
  • Revision ID: package-import@ubuntu.com-20130510102218-7hph1420gz5jsyr7
Tags: 2013.1.1-2
http://bugs.debian.org/707598
* Uploading to unstable.
* New upstream release:
  - Fixes CVE-2013-2059: Keystone tokens not immediately invalidated when
  user is deleted [OSSA 2013-011] (Closes: #707598).
* Also installs httpd/keystone.py.

Show diffs side-by-side

added added

removed removed

Lines of Context:
keystone/trust/backends/kvs.py
 
1
# vim: tabstop=4 shiftwidth=4 softtabstop=4
 
2
 
 
3
# Copyright 2012 OpenStack LLC
 
4
#
 
5
# Licensed under the Apache License, Version 2.0 (the "License"); you may
 
6
# not use this file except in compliance with the License. You may obtain
 
7
# a copy of the License at
 
8
#
 
9
#      http://www.apache.org/licenses/LICENSE-2.0
 
10
#
 
11
# Unless required by applicable law or agreed to in writing, software
 
12
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 
13
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 
14
# License for the specific language governing permissions and limitations
 
15
# under the License.
 
16
"""
 
17
An in memory implementation of the trusts API.
 
18
only to be used for testing purposes
 
19
"""
 
20
import copy
 
21
import datetime
 
22
 
 
23
 
 
24
from keystone.common import kvs
 
25
from keystone.openstack.common import timeutils
 
26
from keystone import exception
 
27
from keystone import trust
 
28
 
 
29
 
 
30
def _filter_trust(ref):
 
31
    if ref['deleted']:
 
32
        return None
 
33
    if ref.get('expires_at') and timeutils.utcnow() > ref['expires_at']:
 
34
        return None
 
35
    ref = copy.deepcopy(ref)
 
36
    return ref
 
37
 
 
38
 
 
39
class Trust(kvs.Base, trust.Driver):
 
40
    def create_trust(self, trust_id, trust, roles):
 
41
        trust_ref = trust
 
42
        trust_ref['id'] = trust_id
 
43
        trust_ref['deleted'] = False
 
44
        trust_ref['roles'] = roles
 
45
        if (trust_ref.get('expires_at') and
 
46
                trust_ref['expires_at'].tzinfo is not None):
 
47
                    trust_ref['expires_at'] = (timeutils.normalize_time
 
48
                                               (trust_ref['expires_at']))
 
49
 
 
50
        self.db.set('trust-%s' % trust_id, trust_ref)
 
51
        trustee_user_id = trust_ref['trustee_user_id']
 
52
        trustee_list = self.db.get('trustee-%s' % trustee_user_id, [])
 
53
        trustee_list.append(trust_id)
 
54
        self.db.set('trustee-%s' % trustee_user_id, trustee_list)
 
55
        trustor_user_id = trust_ref['trustor_user_id']
 
56
        trustor_list = self.db.get('trustor-%s' % trustor_user_id, [])
 
57
        trustor_list.append(trust_id)
 
58
        self.db.set('trustor-%s' % trustor_user_id, trustor_list)
 
59
        return copy.deepcopy(trust_ref)
 
60
 
 
61
    def get_trust(self, trust_id):
 
62
        try:
 
63
            ref = self.db.get('trust-%s' % trust_id)
 
64
            return _filter_trust(ref)
 
65
        except exception.NotFound:
 
66
            return None
 
67
 
 
68
    def delete_trust(self, trust_id):
 
69
        try:
 
70
            ref = self.db.get('trust-%s' % trust_id)
 
71
        except exception.NotFound:
 
72
            raise exception.TrustNotFound(token_id=token_id)
 
73
        ref['deleted'] = True
 
74
        self.db.set('trust-%s' % trust_id, ref)
 
75
 
 
76
    def list_trusts(self):
 
77
        trusts = []
 
78
        for key, value in self.db.items():
 
79
            if key.startswith("trust-") and not value['deleted']:
 
80
                trusts.append(value)
 
81
        return trusts
 
82
 
 
83
    def list_trusts_for_trustee(self, trustee_user_id):
 
84
        trusts = []
 
85
        for trust in self.db.get('trustee-%s' % trustee_user_id, []):
 
86
            trusts.append(self.get_trust(trust))
 
87
        return trusts
 
88
 
 
89
    def list_trusts_for_trustor(self, trustor_user_id):
 
90
        trusts = []
 
91
        for trust in self.db.get('trustor-%s' % trustor_user_id, []):
 
92
            trusts.append(self.get_trust(trust))
 
93
        return trusts