From 48c584194e4e5ec4b3561b2d6448ba4728ab0739 Mon Sep 17 00:00:00 2001
From: "Chris St. Pierre" <chris.a.st.pierre@gmail.com>
Date: Thu, 20 Sep 2012 16:23:25 -0400
Subject: Encryption: improved docs, made algorithm configurable

---
 src/lib/Bcfg2/Server/Plugins/Properties.py | 61 ++++++++++++++++++------------
 1 file changed, 36 insertions(+), 25 deletions(-)

(limited to 'src/lib/Bcfg2/Server/Plugins/Properties.py')

diff --git a/src/lib/Bcfg2/Server/Plugins/Properties.py b/src/lib/Bcfg2/Server/Plugins/Properties.py
index 1b925ce46..590d536a9 100644
--- a/src/lib/Bcfg2/Server/Plugins/Properties.py
+++ b/src/lib/Bcfg2/Server/Plugins/Properties.py
@@ -5,46 +5,50 @@ import copy
 import logging
 import lxml.etree
 import Bcfg2.Server.Plugin
+from Bcfg2.Server.Plugin import PluginExecutionError
 try:
     from Bcfg2.Encryption import ssl_decrypt, get_passphrases, \
-        bruteforce_decrypt, EVPError
-    have_crypto = True
+        get_algorithm, bruteforce_decrypt, EVPError
+    HAS_CRYPTO = True
 except ImportError:
-    have_crypto = False
+    HAS_CRYPTO = False
 
-logger = logging.getLogger(__name__)
+LOGGER = logging.getLogger(__name__)
 
 SETUP = None
 
 
 class PropertyFile(Bcfg2.Server.Plugin.StructFile):
-    """Class for properties files."""
+    """ Class for properties files. """
+
     def write(self):
         """ Write the data in this data structure back to the property
         file """
         if not SETUP.cfp.getboolean("properties", "writes_enabled",
                                     default=True):
-            msg = "Properties files write-back is disabled in the configuration"
-            logger.error(msg)
-            raise Bcfg2.Server.Plugin.PluginExecutionError(msg)
+            msg = "Properties files write-back is disabled in the " + \
+                "configuration"
+            LOGGER.error(msg)
+            raise PluginExecutionError(msg)
         try:
             self.validate_data()
-        except Bcfg2.Server.Plugin.PluginExecutionError:
+        except PluginExecutionError:
             msg = "Cannot write %s: %s" % (self.name, sys.exc_info()[1])
-            logger.error(msg)
-            raise Bcfg2.Server.Plugin.PluginExecutionError(msg)
+            LOGGER.error(msg)
+            raise PluginExecutionError(msg)
 
         try:
             open(self.name,
-                 "wb").write(lxml.etree.tostring(self.xdata,
-                                                 xml_declaration=False,
-                                                 pretty_print=True).decode('UTF-8'))
+                 "wb").write(
+                lxml.etree.tostring(self.xdata,
+                                    xml_declaration=False,
+                                    pretty_print=True).decode('UTF-8'))
             return True
         except IOError:
             err = sys.exc_info()[1]
             msg = "Failed to write %s: %s" % (self.name, err)
-            logger.error(msg)
-            raise Bcfg2.Server.Plugin.PluginExecutionError(msg)
+            LOGGER.error(msg)
+            raise PluginExecutionError(msg)
 
     def validate_data(self):
         """ ensure that the data in this object validates against the
@@ -55,31 +59,34 @@ class PropertyFile(Bcfg2.Server.Plugin.StructFile):
                 schema = lxml.etree.XMLSchema(file=schemafile)
             except:
                 err = sys.exc_info()[1]
-                raise Bcfg2.Server.Plugin.PluginExecutionError("Failed to process schema for %s: %s" % (self.name, err))
+                raise PluginExecutionError("Failed to process schema for %s: "
+                                           "%s" % (self.name, err))
         else:
             # no schema exists
             return True
 
         if not schema.validate(self.xdata):
-            raise Bcfg2.Server.Plugin.PluginExecutionError("Data for %s fails to validate; run bcfg2-lint for more details" % self.name)
+            raise PluginExecutionError("Data for %s fails to validate; run "
+                                       "bcfg2-lint for more details" %
+                                       self.name)
         else:
             return True
 
     def Index(self):
         Bcfg2.Server.Plugin.StructFile.Index(self)
         if self.xdata.get("encryption", "false").lower() != "false":
-            if not have_crypto:
+            if not HAS_CRYPTO:
                 msg = "Properties: M2Crypto is not available: %s" % self.name
-                logger.error(msg)
-                raise Bcfg2.Server.Plugin.PluginExecutionError(msg)
+                LOGGER.error(msg)
+                raise PluginExecutionError(msg)
             for el in self.xdata.xpath("//*[@encrypted]"):
                 try:
                     el.text = self._decrypt(el)
                 except EVPError:
                     msg = "Failed to decrypt %s element in %s" % (el.tag,
                                                                   self.name)
-                    logger.error(msg)
-                    raise Bcfg2.Server.PluginExecutionError(msg)
+                    LOGGER.error(msg)
+                    raise PluginExecutionError(msg)
 
     def _decrypt(self, element):
         if not element.text.strip():
@@ -88,14 +95,18 @@ class PropertyFile(Bcfg2.Server.Plugin.StructFile):
         try:
             passphrase = passes[element.get("encrypted")]
             try:
-                return ssl_decrypt(element.text, passphrase)
+                return ssl_decrypt(element.text, passphrase,
+                                   algorithm=get_algorithm(SETUP))
             except EVPError:
                 # error is raised below
                 pass
         except KeyError:
-            return bruteforce_decrypt(element.text, passphrases=passes.values())
+            return bruteforce_decrypt(element.text,
+                                      passphrases=passes.values(),
+                                      algorithm=get_algorithm(SETUP))
         raise EVPError("Failed to decrypt")
 
+
 class PropDirectoryBacked(Bcfg2.Server.Plugin.DirectoryBacked):
     __child__ = PropertyFile
     patterns = re.compile(r'.*\.xml$')
-- 
cgit v1.2.3-1-g7c22