This change adds enforcement of KMIP operation policies to the
server engine, specifically to the Get and Destroy operations.
Explicit object ownership is enforced as a result, with ownership
now a tracked internal server property of managed objects. Tests
for this new functionality are included.
This change updates the KMIP engine to process and persist the
value of the operation policy name attribute when creating or
registering new managed objects. Tests are included for these
changes.
This change adds operation policy name support to the pie client,
allowing you to optionally specify the policy name when creating
new symmetric keys and asymmetric key pairs. The operation policy
name can also be set on any pie object and will be sent with the
corresponding register request for new objects. Tests for these
additions are included.
This change fixes a bug in the KMIP server engine where a missing
request credential would cause the session to prematurely
terminate. Credential handling may require session termination
for missing credentials, but that decision should be made by
credential processing not request processing.
Fixes#193
This change updates the KmipSession, allowing it to extract client
identity from the client certificate of a TLS connection. The
certificate subject common name is used as the client identity if
the certificate has client authentication set in the extended key
usage extension.
This change breaks backwards compatibility. If a client certificate
does not define a client identity, the session will reject it and
shutdown the connection. Any client certificates used to connect
with the software server in the past will need to be replaced with
certificates that define a suitable client identity.
This change adds enumerations and policy objects to support the
specification and enforcement of KMIP operation policies. A new
module, kmip.core.policy, is added to define the default policy
objects required by the KMIP specification.
This change updates the set of supported enumerations to include
all enumerations included in KMIP 1.2. Existing enumerations are
updated where required.
This update includes a new implementation of the PyKMIP software server,
in addition to other minor features and bug fixes:
* Add KmipServer server implementation
* Add KmipSession to manage threaded client/server connections
* Add KmipEngine for processing core server application logic
* Add KmipEngine support for CRUD operations for managed objects
* Add SQLAlchemy/SQLite support for KmipEngine data storage
* Add CryptographyEngine component for all cryptographic operations
* Add pending deprecation warning for Python 2.6 support
* Add pending deprecation warning for the KMIPServer implementation
* Add support for building Sphinx documentation
* Add support for SQLAlchemy tables to all Pie objects
* Add Python magic methods to Attribute and Name objects
* Add Attribute class unit tests
* Add bin script to run the KmipServer
* Add setup entry points to run the KmipServer
* Update DiscoverVersions demo with optional versions argument
* Update all demo scripts to setup their own logging infrastructure
* Update README with information on the KmipServer implementation
* Remove expired certificate files from the integration test suite
* Remove default package log configuration and configuration file
* Fix bug with Locate payload parsing optional values
* Fix bug with DateTime string tests and move to UTC representation
Added console_scripts to setup.py, and added an entry for
pykmip-server. The pykmip-server application will run the PyKMIP
server. The two command line options below will run the server.
python -m kmip.services.server.server
pykmip-server
This change adds some additional logging statements when processing
individual KMIP operations, providing additional information on
operation input and output. The associated tests have been updated
accordingly.
This change fixes a bug with the Pie object table definitions used by
SQLAlchemy to store managed objects and attributes for the PyKMIP
software server. While primary keys are specified for all tables, they
do not by default auto-increment with SQLAlchemy/SQLite, causing
collisions and uniqueness constraint violations when bulk testing with
the server. Add an explicit SQLite auto-increment tag to each table
prevents this from happening.
An issue with local daylight savings time causes a comparison error in
some locales when checking against a hard-coded expected time string.
The DateTime primitive string representation has been updated to output
only UTC time strings.
Fixes#124
This change removes the use of default logging settings in
kmip.__init__.py as well as the bundled logconfig.ini file. Logging
settings should be set by applications, not by underlying software
libraries. All demos have been updated to set their own logging
settings and to log at appropriate levels.
This change swaps out the in-memory SQLite database for file-based data
storage. SQLAlchemy support for in-memory SQLite storage does not work
across threads. The new storage scheme stores all PyKMIP server data in
/tmp.
This change fixes a bug with the KmipSession connection handling logic
that would terminate the connection before actually receiving a
termination from the client. The corresponding unit tests have been
updated to reflect this fix.
This change adds KmipEngine support to the KmipSession. The session will
now pass on received requests for processing by the engine, handling any
results or errors that occur. The KmipSession test suite has been
updated to reflect this change.
This change adds a simple warning that is triggered whenever the
KMIPServer class is instantiated. It advises the user to use the newer
KmipServer class. The KMIPServer will be removed in a future version of
PyKMIP.
This change adds the KmipServer, the front-end of the KMIP software
server. The KmipServer is in charge of loading configuration settings,
creating all major server components, and serving and managing client
connections. A KmipServerConfig tool is included to handle configuration
settings. Test cases for all new code are included.
When KmipSession instantiated without session name there is error:
File ".../PyKMIP/kmip/services/server/session.py", line 57, in __init__
self._logger = logging.getLogger('.'.join((__name__, name)))
TypeError: sequence item 1: expected str instance, NoneType found
This change adds a policy system that will be used by the KmipEngine to
track and organize rules for individual KMIP attributes. Comparison
operators for the Integer primitive and ProtocolVersion struct are added
to support the AttributePolicy. Tests for all new changes are included.
This change adds a policy system that will be used by the KmipEngine to
track and organize rules for individual KMIP attributes. Comparison
operators for the Integer primitive and ProtocolVersion struct are added
to support the AttributePolicy. Tests for all new changes are included.
This change adds the KmipEngine, the core processing component of the
KmipServer. The KmipEngine contains the KMIP application logic and
handles process request messages by batch. The engine handles logging
and error handling throughout the processing stack.
New server exceptions are added to handle new error cases. A test suite
is included.
This pull request:
- Adds the comparison operators to the following classes:
-- Attribute.AttributeName class
- Fixes bug in the "_create_cryptographic_parameters" function when "None" type parameters are used
- Adds read, write, and comparator unit tests for the Attribute class in the /kmip/core/objects.py file
Signed-off-by: Hadi Esiely <hadi.esiely-barrera@jhuapl.edu>
... to gently indicate the end of request processing
Introduce 'RequestLengthMismatch' exception dedicated for the
unexpected result of 'read' request operation
Unit tests for kmip-protocol
SQLAlchemy requires a unique identifier for classes when using the
join table inheritence strategy. Previous commits were reusing the
object_type attribute of ManagedObject, but this strategy does not
work for classes that are subclasses of an object. This will be the
case for the Certificate object type because one such subclass will be
X509Certificate.
The code for persisting symmetric keys in a database has been added
along with the corresponding unit tests.
The usage mask list for cryptographic objects is stored as an integer bitmask.
The conversion takes place with a new SQLAlchemy type.
Switched ManagedObject value type to VARBINARY. This prevents errors from
occuring when trying to convert to a string.
Added the ORM code to be able to persist OpaqueData in a database.
This added the code to the base class ManagedObject as well. Unit
tests are added to demonstrate the code is working correctly.
This change adds a KmipSession class that manages individual
client/server connections in a thread of execution separate from the
main thread. A test suite is included.
This pull request adds some unit tests for the server failover code that was recently merged.
Signed-off-by: Hadi Esiely <hadi.esiely-barrera@jhuapl.edu>
This change adds KMIP authentication suites, which define the TLS
protocols and cipher suites to use for establishing secure network
connections compliant with the KMIP specification. Test suites are
included.
This change add a simple warning that is triggered whenever Python
2.6 is used with PyKMIP. It simply advises the user to use a newer
version of Python. For now, Python 2.6 can still be used with
PyKMIP.
This update includes several new features:
* Add support for the GetAttributeList operation
* Add integration with Travis CI, Codecov/Coveralls, and Bandit
* Add client/server failover support using multiple IP addresses
* Add additional attribute unit tests
* Update implementations of KMIP primitives
* Reorganize server code to prepare for refactoring
* Remove use of exec when handling library version numbers
* Remove broken server script
This feature enables the PyKMIP library to switch between KMIP service provider
hosts in the event one of them is unavailable. To list more than than one host,
include all necessary host IP addresses separated by commas in the "host" field
in the pykmip.conf file.
Signed-off-by: Hadi Esiely <hadi.esiely-barrera@jhuapl.edu>
This change creates a new subpackage under services, server, which now
holds all of the software server related code. References to different
pieces of the server code base are updated accordingly.
This change updates the Enumeration primitive, adding a fresh
implementation and documentation. An updated unit test suite for the
primitive is included. Numerous changes to Enumeration usage across the
library are also included to comply with the updated implementation.
This change adds support for the GetAttributeList operation to the
ProxyKmipClient. It updates the Pie client API and provides a demo
showing how to use the operation. All relevant test suites are updated
accordingly.
This change updates the DateTime primitive, adding documentation and
Python string operator support. A new unit test suite for the primitive
is included.
This change adds support for the GetAttributeList operation to the
KMIPProxy client. It adds a new result object for the operation along
with an integration test demonstrating how the operation can be used.
Client unit test cases are also included.
This change adds support for multiple configuration file storage
locations, including the user's home directory and /etc. The preferred
configuration file name is now pykmip.conf. The original name,
kmipconfig.ini, will continue to be supported for legacy installations.
This change fixes various bugs with the original BigInteger
implementation, adding in a working version of the primitive. A full
unit test suite is included.
This change updates the LongInteger primitive, improving class
documentation, adding standard Python operators, cleaning up the
original implementation, and expanding the corresponding unit test suite
to address the modifications.
This change adds a new pytest marker, ignore. It is used to silently
skip the software server integration test suite, which is now broken
from a recent ssl update. A pytest ini configuration file is also added
to register the new marker.
This change updates the AttributeValue factory, removing and
streamlining code. Support for several basic primitive attributes are
added in addition to a redesigned test suite for the factory.
This change splits the original set of primitive object test suites into
separate modules. Minor refactoring to account for structure changes is
included.
This change adds request and response payloads for the GetAttributeList
operation. It updates the payload factories to support these new objects
and updates and adds all associated or required test suites. A new
exception is also included that is thrown by objects attempting to parse
invalid KMIP encodings.
This update includes several new features and bug fixes:
* Add the official Pie API for a simpler KMIP interface
* Add the ProxyKmipClient implementation of the Pie API
* Add key, secret, and opaque objects to the Pie object hierarchy
* Add unit demos for all ProxyKmipClient operations
* Add complete unit and integration test suites for the Pie package
* Add KMIPProxy client support for the Activate and Revoke operations
* Add KMIPProxy client connection timeout support
* Add KMIPProxy integration tests for asymm. key/secret/opaque objects
* Add improved request error logging for the KMIPServer
* Update README with more information about the clients and Pie API
* Remove AUTHORS in favor of Git commit history
* Fix bug with dangling file handle when setting __version__
* Fix bug with dangling socket connection upon client destruction
This change adds two examples showing how to use opaque objects with the
ProxyKmipClient. The first is a unit demo showing how to register an
opaque object using the register operation of the ProxyKmipClient. The
second is an integration test showing how to register, get, and destroy
an opaque object using the ProxyKmipClient.
This change adds two examples showing how to use secret data with the
ProxyKmipClient. The first is a unit demo showing how to register a
secret using the register operation of the ProxyKmipClient. The second
is an integration test showing how to register, get, and destroy a
secret using the ProxyKmipClient.
This change adds two examples showing how to use certificates with the
ProxyKmipClient. The first is a unit demo showing how to register a
certificate using the register operation of the ProxyKmipClient. The
second is an integration test showing how to register, get, and destroy
a certificate using the ProxyKmipClient.
This change adds an OpaqueObject class to the Pie object hierarchy. A
unit test suite covering the class is included, as are updates to the
Pie object factory and associated tests.
This change adds a SecretData class to the Pie object hierarchy. A unit
test suite covering the class is provided, as are updates to the Pie
object factory and associated tests.
This change adds certificate objects to the Pie object hierarchy,
specifically a generic Certificate class and an X509Certificate
subclass. Unit test suites covering both classes are included. The Pie
object factory is also updated to support Pie and core certificate
conversion.
This change adds a new suite of unit demos for the new Pie
ProxyKmipClient. The demos show how to create the ProxyKmipClient and
how to use all of its primary operations. Demo utilities are updated to
support the new suite.
This change adds an integration test suite for the new Pie
ProxyKmipClient, which tests basic CRUD operations for symmetric and
asymmetric keys. An additional pytest fixture is included for the new
client.
This change adds the Pie ProxyKmipClient, which provides a simplified
version of the original KMIP interface and which wraps the original
client. The ProxyKmipClient supports basic CRUD operations for
symmetric, public, and private keys. A unit test suite for the client is
included.
This change adds an abstract base class defining the client interface
for all future PyKMIP clients. Required arguments for different
operations are explicitly specified. A basic sanity unit test suite is
included.
This change adds an ObjectFactory for the Pie object hierarchy. It
provides easy translation to and from Pie objects to the original core
object hierarchy. The factory is only used by the new Pie client and
should never be used outside of this context. A unit test suite for the
factory is included.
This change makes some minor updates to the Pie key object hierarchy. It
fixes the key subclasses to inherit from Key directly. It adds in
support for the key format type attribute, which is required for
low-level key encoding. It also improves repr and str functionality by
using binascii.hexlify to represent the key values. The corresponding
test suites are updated accordingly to reflect these changes.
This change adds support for a customizable timeout option for the KMIP
client. The client will stop attempting connections or operations once
the timeout is exceeded instead of waiting for the default system
timeout. The default timeouts is 30 seconds.
This change adds SymmetricKey to the Pie object hierarchy along with a
test suite and updates to the other classes and test suites composing
the Pie interface.
This change adds a unit demo for the Revoke operation. The operation
accepts a UID of the KMIP managed object that needs to be revoked, in
addition to a revocation code and message explaining why revocation
needs to occur.
This change adds a unit demo for the Activate operation. The operation
accepts the UID of a KMIP managed object that needs to be activated for
future use.
Peter Hamilton
Peter Hamilton
Peter
Nathan Reller
Viktor Tarasov
Hadi Esiely
Nathan Reller
Spencer Jackson
Felix Engelmann
sedukull
Tim Kelsey