This change adds decryption functionality to the cryptographic
engine used by the server. It supports a variety of symmetric
decryption algorithms and block cipher modes. Asymmetric
decryption support will be added in a future patch.
Unit tests and minor updates to surrounding code are included.
This change adds Encrypt operation support to the KMIPProxy and
ProxyKmipClient clients, including unit tests to cover the new
functionality.
Extensive documentation has been added to the header comments for
the new client methods detailing the expected input parameters and
return values. This approach should be followed for all new client
additions going forward.
This change adds the Encrypt operation to the server. Support is
currently limited to symmetric encryption only. The encryption key
used with the operation must be in the Active state and it must
have the Encrypt bit set in its cryptographic usage mask.
This change adds encryption functionality to the cryptographic
engine used by the server. It supports a variety of symmetric
encryption algorithms and block cipher modes. Asymmetric encryption
support will be added in a future patch.
Unit tests and minor updates to surrounding core code are included.
This change updates the CryptographicParameters struct, removing the
primitive class wrappers that it used to use for attribute values
and replacing them with struct properties that internally manage the
primitive objects directly. This gutting and regutting necessitates
cascading changes to every part of the library that used these
internal primitive class wrappers, including unit tests, client and
client tests, and attribute factory handlers. All of these have been
updated to reflect the correct usage of the CryptographicParameters
struct.
This change also adds in additional attribute members for the
CryptographicParameters struct to bring it up to spec with KMIP 1.2.
This change loosens the input requirements for ProxyKmipClient
operations that accept a secret UID. Operations like Get and
Destroy used to require a string value but are allowed in the
KMIP specification to take no value at all. This change updates
the ProxyKmipClient to properly reflect the specification. The
underlying KMIPProxy client is mostly unchanged.
Closes#261
This change updates the server results returned by the Query
operation to match the current set of supported features. The tests
for Query have been updated to better reflect testing across KMIP
versions.
This change removes the original KMIPServer implementation, along
with all supporting classes. The KmipServer implementation is the
only supported server implementation going forward.
This change restructures how access controls are enforced for
different server operations, pulling common code into a shared
method for reuse. The server unit tests have been updated to
reflect this change.
This change updates the server and managed object set to support
the InitialDate attribute. The InitialDate is set when the Create,
CreateKeyPair, and Register operations are invoked and can be
listed and retrieved with the GetAttributeList and GetAttributes
operations respectively. The server unit tests have been updated
to reflect these changes.
This change adds support for the GetAttributeList operation. The
user can specify the ID of a managed object and get back a list
containing the names of all attributes currently set on the object.
The user can also omit the ID and the server will default to using
the ID placeholder for the object ID. New server tests have been
added to cover this feature. The GetAttributeList payloads have
also been updated for consistency with other payloads, requiring
minor updates in other clients and unit tests.
This change fixes a bug introduced with the addition of Python3.5
support. In Python3.5, SIGINT is silently ignored for system calls
(e.g., socket.accept) if the SIGINT signal handler does not raise
an exception. This causes the server to delay shutdown when
receiving SIGINT until after a new connection has been made. This
change updates the server's SIGINT signal handler to raise the
correct exception and updates the error handling code while serving
connections to account for this change in SIGINT processing. This
allows the server to shutdown immediately upon receiving SIGINT.
The server unit tests are updated to account for this change.
This change fixes a bug that could occur when accessing the server
with multiple threads or processes. The SQLite backend by default
does not support multithreading. This change updates how the
SQLite backend is instantiated, preventing error generation when
using multiple clients simultaenously. The server unit test suite
has been updated to cover the change.
This change updates the server to better handle exceptions thrown
while looking up the value of different attributes on managed
objects. Some managed objects in PyKMIP don't currently support
attributes they are supposed to. This can cause lookup errors
when using GetAttributes. This change suppresses any exceptions
and simply returns None for the missing attribute value. The
server unit tests have been updated to account for this change.
This change adds support for the GetAttributes operation to the
PyKMIP clients. Demo scripts showing how to use the new operation
will be included in a future update. Client test cases have been
added and updated to reflect the new operation.
This change adds server support for the GetAttributes operation.
The user can specify an object ID and an attribute list to get
the values of the attributes listed from the specified object.
The user can also omit either argument; the server will default
to using the ID placeholder and all viable attributes respectively.
Only a subset of the standard attributes are supported right now.
New tests have been added to cover the new feature.
Closes#185Closes#211Closes#218
This change fixes a bug with the server where the server would
prematurely shutdown upon receiving a client connection using an
invalid certificate. The server will now withstand bad client
connections. The impacted server unit tests have been updated to
reflect the bug fix.
This change fixes a bug with parameter handling when invoking
the server's main routine. The default values provided for the
parameters would override any configuration file settings if
the main routine was used to run the server. To fix this, the
default values were removed, requiring the user to explicitly
specify parameter values if they want them to override the
configuration settings. The parameter doc strings have been
updated to match these changes.
Fixes#217
This change updates the server, updating how it processes config
values and allowing it to handle optional or ommitted policy_path
values. This fixes a bug where users could not leave the
policy_path config file unset, in addition to a bug that forced
users to use '/etc/pykmip/policies' as their policy directory.
Fixes#210
This change adds support for the Activate operation to the server,
including additional server unit tests, a new IllegalOperation
exception, and updated state attribute support in Pie objects.
Fixes#186
This change reorganizes some of the error handling code in the
client open routine, preventing the generation of an undefined
variable error. The net effect of the client open routine is
unchanged.
Fixes#199
This change fixes a minor bug with the client shutdown routine,
where an error would get thrown when attempting to call shutdown
on an unconnected socket. This error is now caught and suppressed,
since the client is already shutting down. A new client unit test
is included to cover this change.
This change adds support for dynamic operation policy loading.
The server config file now supports a 'policy_path' option that
points to a filesystem directory. Each file in the directory
should contain a JSON policy object. The KMIP server will scan
this directory and attempt to load all valid policies it finds.
The results of this process will be logged.
This change adds enforcement of KMIP operation policies to the
server engine, specifically to the Get and Destroy operations.
Explicit object ownership is enforced as a result, with ownership
now a tracked internal server property of managed objects. Tests
for this new functionality are included.
This change updates the KMIP engine to process and persist the
value of the operation policy name attribute when creating or
registering new managed objects. Tests are included for these
changes.
This change fixes a bug in the KMIP server engine where a missing
request credential would cause the session to prematurely
terminate. Credential handling may require session termination
for missing credentials, but that decision should be made by
credential processing not request processing.
Fixes#193
This change updates the KmipSession, allowing it to extract client
identity from the client certificate of a TLS connection. The
certificate subject common name is used as the client identity if
the certificate has client authentication set in the extended key
usage extension.
This change breaks backwards compatibility. If a client certificate
does not define a client identity, the session will reject it and
shutdown the connection. Any client certificates used to connect
with the software server in the past will need to be replaced with
certificates that define a suitable client identity.
Added console_scripts to setup.py, and added an entry for
pykmip-server. The pykmip-server application will run the PyKMIP
server. The two command line options below will run the server.
python -m kmip.services.server.server
pykmip-server
This change adds some additional logging statements when processing
individual KMIP operations, providing additional information on
operation input and output. The associated tests have been updated
accordingly.
This change swaps out the in-memory SQLite database for file-based data
storage. SQLAlchemy support for in-memory SQLite storage does not work
across threads. The new storage scheme stores all PyKMIP server data in
/tmp.
This change fixes a bug with the KmipSession connection handling logic
that would terminate the connection before actually receiving a
termination from the client. The corresponding unit tests have been
updated to reflect this fix.
This change adds KmipEngine support to the KmipSession. The session will
now pass on received requests for processing by the engine, handling any
results or errors that occur. The KmipSession test suite has been
updated to reflect this change.
This change adds a simple warning that is triggered whenever the
KMIPServer class is instantiated. It advises the user to use the newer
KmipServer class. The KMIPServer will be removed in a future version of
PyKMIP.
This change adds the KmipServer, the front-end of the KMIP software
server. The KmipServer is in charge of loading configuration settings,
creating all major server components, and serving and managing client
connections. A KmipServerConfig tool is included to handle configuration
settings. Test cases for all new code are included.
When KmipSession instantiated without session name there is error:
File ".../PyKMIP/kmip/services/server/session.py", line 57, in __init__
self._logger = logging.getLogger('.'.join((__name__, name)))
TypeError: sequence item 1: expected str instance, NoneType found
This change adds a policy system that will be used by the KmipEngine to
track and organize rules for individual KMIP attributes. Comparison
operators for the Integer primitive and ProtocolVersion struct are added
to support the AttributePolicy. Tests for all new changes are included.
This change adds a policy system that will be used by the KmipEngine to
track and organize rules for individual KMIP attributes. Comparison
operators for the Integer primitive and ProtocolVersion struct are added
to support the AttributePolicy. Tests for all new changes are included.
This change adds the KmipEngine, the core processing component of the
KmipServer. The KmipEngine contains the KMIP application logic and
handles process request messages by batch. The engine handles logging
and error handling throughout the processing stack.
New server exceptions are added to handle new error cases. A test suite
is included.
... to gently indicate the end of request processing
Introduce 'RequestLengthMismatch' exception dedicated for the
unexpected result of 'read' request operation
Unit tests for kmip-protocol
This change adds a KmipSession class that manages individual
client/server connections in a thread of execution separate from the
main thread. A test suite is included.
This pull request adds some unit tests for the server failover code that was recently merged.
Signed-off-by: Hadi Esiely <hadi.esiely-barrera@jhuapl.edu>
This change adds KMIP authentication suites, which define the TLS
protocols and cipher suites to use for establishing secure network
connections compliant with the KMIP specification. Test suites are
included.
This feature enables the PyKMIP library to switch between KMIP service provider
hosts in the event one of them is unavailable. To list more than than one host,
include all necessary host IP addresses separated by commas in the "host" field
in the pykmip.conf file.
Signed-off-by: Hadi Esiely <hadi.esiely-barrera@jhuapl.edu>
This change creates a new subpackage under services, server, which now
holds all of the software server related code. References to different
pieces of the server code base are updated accordingly.
This change updates the Enumeration primitive, adding a fresh
implementation and documentation. An updated unit test suite for the
primitive is included. Numerous changes to Enumeration usage across the
library are also included to comply with the updated implementation.
This change adds support for the GetAttributeList operation to the
KMIPProxy client. It adds a new result object for the operation along
with an integration test demonstrating how the operation can be used.
Client unit test cases are also included.
This change adds support for a customizable timeout option for the KMIP
client. The client will stop attempting connections or operations once
the timeout is exceeded instead of waiting for the default system
timeout. The default timeouts is 30 seconds.
This change removes all references to self.__class__. In object
hierarchies with multiple levels of inheritance, using self.__class__
can cause an infinite loop when resolving references to parent classes.
This change updates the client with the KMIP profile information of the
conformance clauses and authentication suites that the client supports.
Several new methods are added to the client, allowing for the retrieval
and basic predicate querying of the profile data. A new test suite has
also been added to test this new capability.
This change updates the Get unit demo, adding support for:
* the additional display of key-related objects
* the passing of more arguments to the client (e.g., KeyFormatType)
* the retrieval of Public/PrivateKeys
This change updates the KMIP client to support the custom selection of
client configuration options. This makes it easy to dynamically create
clients that connect to different backends. All unit demos have been
updated to support this feature.
This change adds support for the Query operation, including updates to
the KMIP client and core object libraries, the KMIP client and core unit
test suites, and a Query unit demo.
Peter Hamilton
Peter Hamilton
Hao Shen
Peter Hamilton
Nathan Reller
Peter
Viktor Tarasov
Hadi Esiely
Felix Engelmann
sedukull
Tim Kelsey