Projet

Général

Profil

0003-passerelle-use-shared_secret-for-ApiUser.key-fixes-8.patch

Benjamin Dauvergne, 12 novembre 2015 13:12

Télécharger (8,32 ko)

Voir les différences:

Subject: [PATCH 3/3] passerelle: use shared_secret for ApiUser.key (fixes
 #8580)

 .../passerelle/management/commands/hobo_deploy.py  | 14 +++++-
 jenkins.sh                                         | 20 ++++++--
 tests_passerelle/conftest.py                       | 15 ++++++
 tests_passerelle/settings.py                       | 25 ++++++++++
 tests_passerelle/test_deploy.py                    | 57 ++++++++++++++++++++++
 5 files changed, 125 insertions(+), 6 deletions(-)
 create mode 100644 tests_passerelle/conftest.py
 create mode 100644 tests_passerelle/settings.py
 create mode 100644 tests_passerelle/test_deploy.py
hobo/agent/passerelle/management/commands/hobo_deploy.py
2 2

  
3 3
from tenant_schemas.utils import tenant_context
4 4
from hobo.agent.common.management.commands import hobo_deploy
5
from hobo.multitenant.settings_loaders import KnownServices
5 6

  
6 7
from passerelle.base.models import ApiUser
7 8

  
......
12 13
    def deploy_specifics(self, hobo_environment, tenant):
13 14
        super(Command, self).deploy_specifics(hobo_environment, tenant)
14 15
        with tenant_context(tenant):
15
            for service in hobo_environment.get('services'):
16
            services = hobo_environment.get('services')
17
            for service in services:
18
                if service.get('this'):
19
                    this = service
20
                    break
21
            else:
22
                raise RuntimeError('unable to find this service')
23
            our_key = this['secret_key']
24
            for service in services:
16 25
                if service.get('this') or not service.get('secret_key'):
17 26
                    continue
18 27
                domain = urlparse.urlparse(service.get('base_url')).netloc.split(':')[0]
19 28
                obj, created = ApiUser.objects.get_or_create(username=domain,
20 29
                                                             keytype='SIGN')
21 30
                obj.fullname = service.get('title')
22
                obj.key = service.get('secret_key')
31
                their_key = service.get('secret_key')
32
                obj.key = KnownServices.shared_secret(our_key, their_key)
23 33
                obj.save()
jenkins.sh
1 1
#!/bin/sh
2 2

  
3
set -e # prevent hiding of errors
4

  
3 5
rm -f *coverage.xml
4 6
rm -f *test_results.xml
5 7

  
......
13 15
pip install --upgrade mock
14 16
pip install --upgrade raven
15 17
pip install http://git.entrouvert.org/authentic.git/snapshot/authentic-master.tar.gz
18
pip install http://git.entrouvert.org/passerelle.git/snapshot/passerelle-master.tar.gz
19

  
16 20

  
17
DJANGO_SETTINGS_MODULE=hobo.settings \
18
HOBO_SETTINGS_FILE=tests/settings.py \
19
py.test --junitxml=hobo_server_test_results.xml --cov-report xml --cov=hobo/ --cov-config .coveragerc tests/
21
# Base tests
22
DJANGO_SETTINGS_MODULE=hobo.settings HOBO_SETTINGS_FILE=tests/settings.py py.test --junitxml=hobo_server_test_results.xml --cov-report xml --cov=hobo/ --cov-config .coveragerc tests/
20 23
mv coverage.xml hobo_server_coverage.xml
21 24

  
25
# Multitenant
22 26
PYTHONPATH=tests_multitenant DJANGO_SETTINGS_MODULE=settings py.test --junitxml=multitenant_test_results.xml --cov-report xml --cov=../hobo/ --cov-config .coveragerc tests_multitenant/
23 27
mv coverage.xml multitenant_coverage.xml
28

  
29
# Authentic agent
24 30
DEBIAN_CONFIG_COMMON=debian/debian_config_common.py DJANGO_SETTINGS_MODULE=authentic2.settings AUTHENTIC2_SETTINGS_FILE=tests_authentic/settings.py py.test --junitxml=authentic2_agent_test_results.xml --cov-report xml --cov=hobo/ --cov-config .coveragerc --nomigration tests_authentic/
25 31
mv coverage.xml authentic2_agent_coverage.xml
26 32

  
27
./merge-junit-results.py hobo_server_test_results.xml multitenant_test_results.xml authentic2_agent_test_results.xml >test_results.xml
33
# Passerelle agent
34
DEBIAN_CONFIG_COMMON=debian/debian_config_common.py DJANGO_SETTINGS_MODULE=passerelle.settings PASSERELLE_SETTINGS_FILE=tests_passerelle/settings.py py.test --junitxml=passerelle_agent_test_results.xml --cov-report xml --cov=hobo/ --cov-config .coveragerc --nomigration tests_passerelle/
35
mv coverage.xml passerelle_agent_coverage.xml
36

  
37
./merge-junit-results.py hobo_server_test_results.xml multitenant_test_results.xml authentic2_agent_test_results.xml passerelle_agent_test_results.xml >test_results.xml
28 38
./merge-coverage.py -o coverage.xml *_coverage.xml
29 39

  
30 40

  
31 41
test -f pylint.out && cp pylint.out pylint.out.prev
32 42
(pylint -f parseable --rcfile /var/lib/jenkins/pylint.django.rc hobo | tee pylint.out) || /bin/true
33 43
test -f pylint.out.prev && (diff pylint.out.prev pylint.out | grep '^[><]' | grep .py) || /bin/true
44

  
45
echo OK
tests_passerelle/conftest.py
1
import os
2
import tempfile
3
import shutil
4
import json
5

  
6
import pytest
7

  
8
@pytest.fixture
9
def tenant_base(request, settings):
10
    base = tempfile.mkdtemp('passerelle-tenant-base')
11
    settings.TENANT_BASE = base
12
    def fin():
13
        shutil.rmtree(base)
14
    request.addfinalizer(fin)
15
    return tenant_base
tests_passerelle/settings.py
1
import os.path
2
import __builtin__ as builtin
3
from mock import mock_open, patch
4
import os
5

  
6
# Debian defaults
7
DEBUG = False
8

  
9
PROJECT_NAME = 'passerelle'
10

  
11
#
12
# hobotization (multitenant)
13
#
14
with patch.object(builtin, 'file', mock_open(read_data='xxx')):
15
    execfile(os.environ['DEBIAN_CONFIG_COMMON'])
16

  
17
# suds logs are buggy
18
LOGGING['loggers']['suds'] = {
19
        'level': 'ERROR',
20
        'handlers': ['mail_admins', 'sentry'],
21
        'propagate': True,
22
}
23

  
24
# Add passerelle hobo agent
25
INSTALLED_APPS = ('hobo.agent.passerelle',) + INSTALLED_APPS
tests_passerelle/test_deploy.py
1
import json
2
import sys
3
import time
4

  
5
from tenant_schemas.utils import tenant_context
6
from hobo.multitenant.middleware import TenantMiddleware
7
from django.core.management import call_command
8
import StringIO
9

  
10

  
11
def test_deploy_specifics(db, tenant_base):
12
    from django.conf import settings
13
    from passerelle.base.models import ApiUser
14

  
15
    hobo_json = {
16
        'variables': {
17
            'hobo_test_variable': True,
18
            'other_variable': 'foo',
19
        },
20
        'services': [
21
            {
22
                'slug': 'test',
23
                'title': 'Test',
24
                'service-id': 'welco',
25
                'this': True,
26
                'secret_key': '12345',
27
                'base_url': 'http://passerelle.example.net',
28
                'saml-sp-metadata-url': 'http://passerelle.example.net/saml/metadata',
29
                'variables': {
30
                    'other_variable': 'bar',
31
                }
32
            },
33
            {
34
                'slug': 'other',
35
                'title': 'Other',
36
                'secret_key': 'abcde',
37
                'service-id': 'wcs',
38
                'base_url': 'http://wcs.example.net'
39
            },
40
        ]
41
    }
42
    old_stdin = sys.stdin
43
    sys.stdin = StringIO.StringIO(json.dumps(hobo_json))
44
    try:
45
        call_command('hobo_deploy', 'http://passerelle.example.net', '-')
46
    finally:
47
        sys.stdin = old_stdin
48

  
49
    assert len(list(TenantMiddleware.get_tenants())) == 1
50
    tenant = next(TenantMiddleware.get_tenants())
51
    with tenant_context(tenant):
52
        # There is a 3 seconds cache now, hobo.json could be outdated
53
        settings.clear_tenants_settings()
54
        other = settings.KNOWN_SERVICES['wcs']['other']
55
        secret = other['secret']
56
        assert ApiUser.objects.filter(username=other['verif_orig'], keytype='SIGN',
57
                                      key=secret).count() == 1
0
-