openstack/barbican
Code Issues Proposed changes

Initial connect orders resource to certificate processing

Browse Source 
Connects the new orders type/meta API to the issue_certificate_request()
method of certificate worker tasking logic. The order plugin metadata is not
provided with this CR. Saving a certificate into a Container is also not
provided with this CR. This CR does address issues with the orders resource
processing.

Change-Id: Id5c6c06ecccd3d4d7eb27d974156dba06bd8fe6f
Implements: blueprint add-ssl-ca-support
This commit is contained in:
jfwood
2014-08-20 12:19:47 -05:00
parent 16e38cfad4
commit 1f22f9a77e
6 changed files with 71 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
barbican/api/controllers/orders.py
+13 -9
View File
@@ -151,15 +151,19 @@ class OrdersController(object):
if order_type:
body = api.load_body(pecan.request,
validator=self.type_order_validator)
LOG.debug('Start on_post...%s', body)
name = body.get('meta').get('name')
LOG.debug('Order to create is %s', name)
new_order = models.Order(body)
#TODO(atiwari): we need to make another round of model
# change to address. payload_content_type can not be None
# Setting up this value to satisfy this DB rule (bug1335171)
new_order.secret_payload_content_type = new_order.meta.get(
'payload_content_type')
LOG.debug('Processing order type %s', order_type)
new_order = models.Order()
new_order.meta = body.get('meta')
new_order.type = order_type
#TODO(john-wood-w) These are required attributes currently, but
# will eventually be removed once we drop the legacy orders
# request.
new_order.secret_name = 'N/A'
new_order.secret_algorithm = 'N/A'
new_order.secret_bit_length = 0
new_order.secret_mode = 'N/A'
new_order.secret_payload_content_type = 'N/A'
else:
body = api.load_body(pecan.request, validator=self.validator)
LOG.debug('Start on_post...%s', body)
barbican/common/validators.py
-1
View File
@@ -340,7 +340,6 @@ class TypeOrderValidator(ValidatorBase):
self._assert_validity(certificate_meta is not None,
schema_name,
u._("'meta' attributes is required"), "meta")
self._raise_feature_not_implemented('certificate', schema_name)
def _extract_expiration(self, json_data, schema_name):
"""Extracts and returns the expiration date from the JSON data."""
barbican/model/models.py
+21 -12
View File
@@ -469,18 +469,27 @@ class Order(BASE, ModelBase):
def _do_extra_dict_fields(self):
"""Sub-class hook method: return dict of fields."""
ret = {'secret': {'name': self.secret_name or self.secret_id,
'algorithm': self.secret_algorithm,
'bit_length': self.secret_bit_length,
'mode': self.secret_mode,
'expiration': self.secret_expiration.isoformat()
if self.secret_expiration
else self.secret_expiration,
'payload_content_type':
self.secret_payload_content_type},
'type': self.type,
'meta': self.meta,
'order_id': self.id}
if not self.meta:
expiration = (
self.secret_expiration.isoformat()
if self.secret_expiration else self.secret_expiration)
ret = {
'secret': {
'name': self.secret_name or self.secret_id,
'algorithm': self.secret_algorithm,
'bit_length': self.secret_bit_length,
'mode': self.secret_mode,
'expiration': expiration,
'payload_content_type': self.secret_payload_content_type
},
'order_id': self.id
}
else:
ret = {
'type': self.type,
'meta': self.meta,
'order_id': self.id
}
if self.secret_id:
ret['secret_id'] = self.secret_id
if self.container_id:
barbican/tasks/certificate_resources.py
+1 -2
View File
@@ -22,7 +22,7 @@ def issue_certificate_request(order_model, repos):
plugin_meta = _get_plugin_meta(order_model)
# Locate a suitable plugin to issue a certificate.
cert_plugin = cert.CertificatePluginManager().get_plugin()
cert_plugin = cert.CertificatePluginManager().get_plugin(order_model.meta)
result = cert_plugin.issue_certificate_request(order_model.id,
order_model.meta,
@@ -61,7 +61,6 @@ def _get_plugin_meta(order_model):
def _save_plugin_metadata(order_model, plugin_meta, repos):
"""Add plugin metadata to an order."""
if not isinstance(plugin_meta, dict):
plugin_meta = dict()
barbican/tasks/resources.py
+13 -8
View File
@@ -26,6 +26,7 @@ from barbican.model import models
from barbican.model import repositories as rep
from barbican.openstack.common import gettextutils as u
from barbican.plugin import resources as plugin
from barbican.tasks import certificate_resources as cert
LOG = utils.getLogger(__name__)
@@ -255,8 +256,8 @@ class BeginTypeOrder(BaseTask):
:param order: Order to process.
"""
order_info = order.to_dict_fields()
order_type = order_info['type']
secret_info = order_info['meta']
order_type = order_info.get('type')
meta_info = order_info.get('meta')
# Retrieve the tenant.
tenant = self.repos.tenant_repo.get(order.tenant_id)
@@ -264,18 +265,22 @@ class BeginTypeOrder(BaseTask):
if order_type == models.OrderType.KEY:
# Create Secret
new_secret = plugin.\
generate_secret(secret_info,
secret_info.get('payload_content_type',
'application/octet-stream'),
generate_secret(meta_info,
meta_info.get('payload_content_type',
'application/octet-stream'),
tenant, self.repos)
order.secret_id = new_secret.id
LOG.debug("...done creating keys order's secret.")
elif order_type == models.OrderType.ASYMMETRIC:
# Create asymmetric Secret
new_container = plugin.generate_asymmetric_secret(
secret_info,
secret_info.get('payload_content_type',
'application/octet-stream'),
meta_info,
meta_info.get('payload_content_type',
'application/octet-stream'),
tenant, self.repos)
order.container_id = new_container.id
LOG.debug("...done creating asymmetric order's secret.")
elif order_type == models.OrderType.CERTIFICATE:
# Request a certificate
cert.issue_certificate_request(order, self.repos)
LOG.debug("...done requesting a certificate.")
barbican/tests/common/test_validators.py
+23 -26
View File
@@ -1023,6 +1023,29 @@ class WhenTestingTypeOrderValidator(testtools.TestCase):
self.validator = validators.TypeOrderValidator()
def test_should_pass_with_certificate_type_in_order_refs(self):
self.order_req['type'] = 'certificate'
result = self.validator.validate(self.order_req)
self.assertEqual('certificate', result['type'])
def test_should_pass_good_bit_meta_in_order_refs(self):
self.order_req['meta']['algorithm'] = 'AES'
self.order_req['meta']['bit_length'] = 256
result = self.validator.validate(self.order_req)
self.assertTrue(result['meta']['expiration'] is None)
def test_should_pass_good_exp_meta_in_order_refs(self):
self.order_req['meta']['algorithm'] = 'AES'
ony_year_factor = datetime.timedelta(days=1 * 365)
date_after_year = datetime.datetime.now() + ony_year_factor
date_after_year_str = date_after_year.strftime('%Y-%m-%d %H:%M:%S')
self.order_req['meta']['expiration'] = date_after_year_str
result = self.validator.validate(self.order_req)
self.assertTrue('expiration' in result['meta'])
self.assertTrue(isinstance(result['meta']['expiration'],
datetime.datetime))
def test_should_raise_with_no_type_in_order_refs(self):
del self.order_req['type']
@@ -1039,14 +1062,6 @@ class WhenTestingTypeOrderValidator(testtools.TestCase):
self.order_req)
self.assertEqual('type', exception.invalid_property)
def test_should_raise_with_certificate_type_in_order_refs(self):
self.order_req['type'] = 'certificate'
exception = self.assertRaises(excep.FeatureNotImplemented,
self.validator.validate,
self.order_req)
self.assertEqual('type', exception.invalid_field)
def test_should_raise_with_no_meta_in_order_refs(self):
del self.order_req['meta']
@@ -1055,12 +1070,6 @@ class WhenTestingTypeOrderValidator(testtools.TestCase):
self.order_req)
self.assertEqual('meta', exception.invalid_property)
def test_should_pass_good_bit_meta_in_order_refs(self):
self.order_req['meta']['algorithm'] = 'AES'
self.order_req['meta']['bit_length'] = 256
result = self.validator.validate(self.order_req)
self.assertTrue(result['meta']['expiration'] is None)
def test_should_raise_with_wrong_exp_meta_in_order_refs(self):
self.order_req['meta']['algorithm'] = 'AES'
self.order_req['meta']['expiration'] = '2014-02-28T19:14:44.180394'
@@ -1070,17 +1079,5 @@ class WhenTestingTypeOrderValidator(testtools.TestCase):
self.order_req)
self.assertEqual('expiration', exception.invalid_property)
def test_should_pass_good_exp_meta_in_order_refs(self):
self.order_req['meta']['algorithm'] = 'AES'
ony_year_factor = datetime.timedelta(days=1 * 365)
date_after_year = datetime.datetime.now() + ony_year_factor
date_after_year_str = date_after_year.strftime('%Y-%m-%d %H:%M:%S')
self.order_req['meta']['expiration'] = date_after_year_str
result = self.validator.validate(self.order_req)
self.assertTrue('expiration' in result['meta'])
self.assertTrue(isinstance(result['meta']['expiration'],
datetime.datetime))
if __name__ == '__main__':
unittest.main()