[Pki-devel] [PATCH] 198-203 patches to address multiple issues in KeyResource server and client code.

[Endi Sukma Dewata]

On 2/21/2014 11:52 PM, Ade Lee wrote:
> Endi, Jack and I met to discuss various improvements to the
> Key/KeyResource client/server parts.  Some of these are addressed in the
> attached patches.  Some will be handled in separate tickets.
>
> Separate Tickets to be filed:
> 1. Add nonce mechanism for approvals.
> 2. Add openssl subclass for CryptoUtil
> 3. Extend generate_session_key() to return key in same call
> 4. Allow CLI to call python? (to be filed as separate ticket)
>
> Done in attached patches:
> 5. Change kraclient.generate_sym_key -> kraclient.generate_symmetric_key
>     and extend to allow addition of trans_wrapped_session_key.
> 6. Add getActiveKey() to python client.
> 7. client_id -> client_key_id
> 8. constants in python API for key status
> 9.  Add sanity checks to python client code
> 10. Move functions out of KRAClient.py and into key.py
> 11. from_dict() -> from)json()
> 12. Add methods to create nss certdb and import transport cert
> 13. All inputs/outputs from CryptoUtil are unencoded.
> 14. Fix usages in main function of SymKeyGenerationRequest
> 15. Fix bugs when retrieving invalid keyId.
> 16.  Fix bugs when generating key with only clientID provided.
>
> To be done in next patch:
> 17. Rewrite cryptoutil.generate_symmetric_key() to be more generic and
> provide a more restricted convenience function generate_session_key()
>
> To be considered further:
> 1. rename session_key -> encryption_key/ wrapping_key?
> 2. revamp archival to not require client to generate PkiArchiveOptions
> object.
> 3. should retrieve functions return unwrapped key?
>
> Please review attached patches.
>
> Ade

Some comments for #203:

1. It looks like TypeError is more common to indicate missing argument 
rather than ValueError:

http://stackoverflow.com/questions/8297526/proper-exception-to-raise-if-none-encountered-as-argument

2. It might be better for end users to see a descriptive error message 
rather than variable name, for example:

   raise ValueError("Request ID must be specified")

3. I don't think we should mask invalid data. If there's an error the 
exception will provide information to troubleshoot the problem.

     public Integer getKeySize() {
         try {
             return new Integer(attributes.get(KEY_SIZE));
         } catch (NumberFormatException e) {
             return null;
         }
     }

-- 
Endi S. Dewata