)]}'
{"barbican/plugin/crypto/p11_crypto.py":[{"author":{"_account_id":14926,"name":"Jeff Feng","email":"jianhua@us.ibm.com","username":"jhfeng"},"change_message_id":"ed26ce18fcecf89caf7356ec92994020107ae116","unresolved":false,"context_lines":[{"line_number":47,"context_line":"               default\u003d1),"},{"line_number":48,"context_line":"    cfg.BoolOpt(\u0027rw_session\u0027,"},{"line_number":49,"context_line":"                help\u003du._(\u0027Flag for Read/Write Sessions\u0027),"},{"line_number":50,"context_line":"                default\u003dTrue),"},{"line_number":51,"context_line":"    cfg.IntOpt(\u0027kek_length\u0027,"},{"line_number":52,"context_line":"               help\u003du._(\u0027KEK length in bytes.\u0027),"},{"line_number":53,"context_line":"               default\u003d32),"}],"source_content_type":"text/x-python","patch_set":2,"id":"da85f559_903eb28a","line":50,"updated":"2015-11-10 23:14:55.000000000","message":"any reason why we need this option?  any usecase for read_only session ?","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"c8e41801c20f74711fdfaf486a699589edb5b0a7","unresolved":false,"context_lines":[{"line_number":47,"context_line":"               default\u003d1),"},{"line_number":48,"context_line":"    cfg.BoolOpt(\u0027rw_session\u0027,"},{"line_number":49,"context_line":"                help\u003du._(\u0027Flag for Read/Write Sessions\u0027),"},{"line_number":50,"context_line":"                default\u003dTrue),"},{"line_number":51,"context_line":"    cfg.IntOpt(\u0027kek_length\u0027,"},{"line_number":52,"context_line":"               help\u003du._(\u0027KEK length in bytes.\u0027),"},{"line_number":53,"context_line":"               default\u003d32),"}],"source_content_type":"text/x-python","patch_set":2,"id":"da85f559_79a2124d","line":50,"in_reply_to":"da85f559_903eb28a","updated":"2015-11-10 23:43:52.000000000","message":"Yeah, I plan on running my instances in RO mode, so the tokens can\u0027t be accidentally changed. But I didn\u0027t want to change the default behaviour, which is RW sessions.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":86,"context_line":"        self.algorithm \u003d plugin_conf.algorithm"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"        # Master Key cache"},{"line_number":89,"context_line":"        self.mk_cache \u003d {}"},{"line_number":90,"context_line":"        # Project KEK cache"},{"line_number":91,"context_line":"        self.kek_cache \u003d {}"},{"line_number":92,"context_line":"        # Session for object caching"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_78203cf8","line":89,"updated":"2015-11-16 20:31:37.000000000","message":"If you changed the name to \"mkek_cache\" you should be able to remove the comment.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"c4890a844efa382c32ea560ae345dc724555d351","unresolved":false,"context_lines":[{"line_number":86,"context_line":"        self.algorithm \u003d plugin_conf.algorithm"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"        # Master Key cache"},{"line_number":89,"context_line":"        self.mk_cache \u003d {}"},{"line_number":90,"context_line":"        # Project KEK cache"},{"line_number":91,"context_line":"        self.kek_cache \u003d {}"},{"line_number":92,"context_line":"        # Session for object caching"}],"source_content_type":"text/x-python","patch_set":2,"id":"7a740942_1cb56ccc","line":89,"in_reply_to":"ba8a016a_63c48f90","updated":"2015-12-03 23:59:41.000000000","message":"I misunderstood what the dict contained when I wrote that. No, we shouldn\u0027t. I don\u0027t like the name mk_cache because it looks like \"Make Cache\", but I can\u0027t think of something better right now, so just ignore my comment. :)","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":86,"context_line":"        self.algorithm \u003d plugin_conf.algorithm"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"        # Master Key cache"},{"line_number":89,"context_line":"        self.mk_cache \u003d {}"},{"line_number":90,"context_line":"        # Project KEK cache"},{"line_number":91,"context_line":"        self.kek_cache \u003d {}"},{"line_number":92,"context_line":"        # Session for object caching"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_63c48f90","line":89,"in_reply_to":"ba8a016a_78203cf8","updated":"2015-11-18 22:26:55.000000000","message":"Does the Barbican community consider mkek to be a generic term for both the mkek and hmac keys in the HSM? I went with just master key so that its more generic to encompass both key types.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":88,"context_line":"        # Master Key cache"},{"line_number":89,"context_line":"        self.mk_cache \u003d {}"},{"line_number":90,"context_line":"        # Project KEK cache"},{"line_number":91,"context_line":"        self.kek_cache \u003d {}"},{"line_number":92,"context_line":"        # Session for object caching"},{"line_number":93,"context_line":"        self.caching_session \u003d self.pkcs11.get_session()"},{"line_number":94,"context_line":"        # Cache master keys"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_7877dc02","line":91,"updated":"2015-11-16 20:31:37.000000000","message":"If you changed the name to \"pkek_cache\" you should be able to remove the comment as well.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":88,"context_line":"        # Master Key cache"},{"line_number":89,"context_line":"        self.mk_cache \u003d {}"},{"line_number":90,"context_line":"        # Project KEK cache"},{"line_number":91,"context_line":"        self.kek_cache \u003d {}"},{"line_number":92,"context_line":"        # Session for object caching"},{"line_number":93,"context_line":"        self.caching_session \u003d self.pkcs11.get_session()"},{"line_number":94,"context_line":"        # Cache master keys"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_c360dba7","line":91,"in_reply_to":"ba8a016a_7877dc02","updated":"2015-11-18 22:26:55.000000000","message":"For more than just removing the comment, I think pkek works better there, so I\u0027ll update that.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":100,"context_line":"        try:"},{"line_number":101,"context_line":"            session \u003d None"},{"line_number":102,"context_line":"            session \u003d self.pkcs11.get_session()"},{"line_number":103,"context_line":"            ct_data \u003d self.pkcs11.encrypt("},{"line_number":104,"context_line":"                kek, encrypt_dto.unencrypted, session"},{"line_number":105,"context_line":"            )"},{"line_number":106,"context_line":"        finally:"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_d8ada832","line":103,"updated":"2015-11-16 20:31:37.000000000","message":"Do you mind being more explicit with this and renaming this to ciphertext or something? We shorted the names in the old code to ct and pt for ciphertext and plaintext, but it always caused readability problems for people reviewing the code.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"c4890a844efa382c32ea560ae345dc724555d351","unresolved":false,"context_lines":[{"line_number":100,"context_line":"        try:"},{"line_number":101,"context_line":"            session \u003d None"},{"line_number":102,"context_line":"            session \u003d self.pkcs11.get_session()"},{"line_number":103,"context_line":"            ct_data \u003d self.pkcs11.encrypt("},{"line_number":104,"context_line":"                kek, encrypt_dto.unencrypted, session"},{"line_number":105,"context_line":"            )"},{"line_number":106,"context_line":"        finally:"}],"source_content_type":"text/x-python","patch_set":2,"id":"7a740942_5cf3f473","line":103,"in_reply_to":"ba8a016a_be2dacff","updated":"2015-12-03 23:59:41.000000000","message":"I get where you\u0027re coming from. However, since we\u0027re writing Python, PEP 20 likes to shout at me when reading through Barbican code lol. I guess it\u0027s my way of trying to slowly move the code base a little.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":100,"context_line":"        try:"},{"line_number":101,"context_line":"            session \u003d None"},{"line_number":102,"context_line":"            session \u003d self.pkcs11.get_session()"},{"line_number":103,"context_line":"            ct_data \u003d self.pkcs11.encrypt("},{"line_number":104,"context_line":"                kek, encrypt_dto.unencrypted, session"},{"line_number":105,"context_line":"            )"},{"line_number":106,"context_line":"        finally:"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_be2dacff","line":103,"in_reply_to":"ba8a016a_d8ada832","updated":"2015-11-18 22:26:55.000000000","message":"I\u0027m on the fence here. I totally want to make it easier to read and review, but coming from the Java world, I really have an issue with overly verbose variable names. I also feel that any one who is qualified to review this code should know what pt and ct mean. Let me think about this a bit.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":104,"context_line":"                kek, encrypt_dto.unencrypted, session"},{"line_number":105,"context_line":"            )"},{"line_number":106,"context_line":"        finally:"},{"line_number":107,"context_line":"            if session:     # pragma: no branch"},{"line_number":108,"context_line":"                self.pkcs11.return_session(session)"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"        kek_meta_extended \u003d json.dumps("}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_189ed056","line":107,"updated":"2015-11-16 20:31:37.000000000","message":"Why disable branch coverage here. This seems like a branch that should potentially be covered.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":104,"context_line":"                kek, encrypt_dto.unencrypted, session"},{"line_number":105,"context_line":"            )"},{"line_number":106,"context_line":"        finally:"},{"line_number":107,"context_line":"            if session:     # pragma: no branch"},{"line_number":108,"context_line":"                self.pkcs11.return_session(session)"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"        kek_meta_extended \u003d json.dumps("}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_c3b8dbca","line":107,"in_reply_to":"ba8a016a_189ed056","updated":"2015-11-18 22:26:55.000000000","message":"The no branch was to cover the else side of the if, as when I started writing tests, it seemed like a pain to find a way to make the get_session above to throw an exception, but after writing more tests, I think I know how to do it, so I\u0027ll look at removing that.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"c4890a844efa382c32ea560ae345dc724555d351","unresolved":false,"context_lines":[{"line_number":104,"context_line":"                kek, encrypt_dto.unencrypted, session"},{"line_number":105,"context_line":"            )"},{"line_number":106,"context_line":"        finally:"},{"line_number":107,"context_line":"            if session:     # pragma: no branch"},{"line_number":108,"context_line":"                self.pkcs11.return_session(session)"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"        kek_meta_extended \u003d json.dumps("}],"source_content_type":"text/x-python","patch_set":2,"id":"7a740942_fc43c06a","line":107,"in_reply_to":"ba8a016a_c3b8dbca","updated":"2015-12-03 23:59:41.000000000","message":"Yeah, it would be preferred for us to figure it out at some point. I guess unless we guarantee that session is defined. If it was, I suppose we wouldn\u0027t need the \"if\" ;).","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":121,"context_line":"        try:"},{"line_number":122,"context_line":"            session \u003d None"},{"line_number":123,"context_line":"            session \u003d self.pkcs11.get_session()"},{"line_number":124,"context_line":"            pt_data \u003d self.pkcs11.decrypt("},{"line_number":125,"context_line":"                kek, iv, decrypt_dto.encrypted, session"},{"line_number":126,"context_line":"            )"},{"line_number":127,"context_line":"        finally:"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_1849f08b","line":124,"updated":"2015-11-16 20:31:37.000000000","message":"Like what I mentioned above, could you change this to plaintext or something?","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":137,"context_line":"            wkek \u003d self._generate_wrapped_kek("},{"line_number":138,"context_line":"                self.kek_length, kek_meta_dto.kek_label, session"},{"line_number":139,"context_line":"            )"},{"line_number":140,"context_line":"            wkek_json \u003d json.dumps(wkek, separators\u003d(\u0027,\u0027, \u0027:\u0027))"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"            # Persisted by Barbican"},{"line_number":143,"context_line":"            kek_meta_dto.plugin_meta \u003d wkek_json"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_931aa16d","line":140,"updated":"2015-11-16 20:31:37.000000000","message":"I\u0027ve seen this compact json dumps a couple times now. Perhaps this should be put into a utility method so we\u0027re not duplicating the separators statement all over the place.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":137,"context_line":"            wkek \u003d self._generate_wrapped_kek("},{"line_number":138,"context_line":"                self.kek_length, kek_meta_dto.kek_label, session"},{"line_number":139,"context_line":"            )"},{"line_number":140,"context_line":"            wkek_json \u003d json.dumps(wkek, separators\u003d(\u0027,\u0027, \u0027:\u0027))"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"            # Persisted by Barbican"},{"line_number":143,"context_line":"            kek_meta_dto.plugin_meta \u003d wkek_json"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_a3ea77aa","line":140,"in_reply_to":"ba8a016a_931aa16d","updated":"2015-11-18 22:26:55.000000000","message":"Sure, I can do that.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":151,"context_line":"        byte_length \u003d int(generate_dto.bit_length) / 8"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"        try:"},{"line_number":154,"context_line":"            session \u003d None"},{"line_number":155,"context_line":"            session \u003d self.pkcs11.get_session()"},{"line_number":156,"context_line":"            buf \u003d self.pkcs11.generate_random(byte_length, session)"},{"line_number":157,"context_line":"            ct_data \u003d self.pkcs11.encrypt(kek, buf, session)"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_53a0b9f4","line":154,"updated":"2015-11-16 20:31:37.000000000","message":"Why assign session to None when we\u0027re going to just reassign it on the next line?","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":151,"context_line":"        byte_length \u003d int(generate_dto.bit_length) / 8"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"        try:"},{"line_number":154,"context_line":"            session \u003d None"},{"line_number":155,"context_line":"            session \u003d self.pkcs11.get_session()"},{"line_number":156,"context_line":"            buf \u003d self.pkcs11.generate_random(byte_length, session)"},{"line_number":157,"context_line":"            ct_data \u003d self.pkcs11.encrypt(kek, buf, session)"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_c3621b3e","line":154,"in_reply_to":"ba8a016a_53a0b9f4","updated":"2015-11-18 22:26:55.000000000","message":"This is to cover the case where get_session throws an exception. Without the initial assignment, session never gets created and in the finally block, a NameError is thrown because a variable with that name can\u0027t be found. This seemed the simplest way to ensure sessions always get cleaned up.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":157,"context_line":"            ct_data \u003d self.pkcs11.encrypt(kek, buf, session)"},{"line_number":158,"context_line":"        finally:"},{"line_number":159,"context_line":"            if session:     # pragma: no branch"},{"line_number":160,"context_line":"                self.pkcs11.return_session(session)"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"        kek_meta_extended \u003d json.dumps("},{"line_number":163,"context_line":"            {\u0027iv\u0027: base64.b64encode(ct_data[\u0027iv\u0027])}, separators\u003d(\u0027,\u0027, \u0027:\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_b36805bc","line":160,"updated":"2015-11-16 20:31:37.000000000","message":"I\u0027ve seen this try-finally statement a few times now. Perhaps this should become a wrapping function of some sort.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":157,"context_line":"            ct_data \u003d self.pkcs11.encrypt(kek, buf, session)"},{"line_number":158,"context_line":"        finally:"},{"line_number":159,"context_line":"            if session:     # pragma: no branch"},{"line_number":160,"context_line":"                self.pkcs11.return_session(session)"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"        kek_meta_extended \u003d json.dumps("},{"line_number":163,"context_line":"            {\u0027iv\u0027: base64.b64encode(ct_data[\u0027iv\u0027])}, separators\u003d(\u0027,\u0027, \u0027:\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_c3f0db69","line":160,"in_reply_to":"ba8a016a_b36805bc","updated":"2015-11-18 22:26:55.000000000","message":"I\u0027ll have to think about that. Any place we use a transactional session should use this pattern so that the session is guaranteed to be cleaned up.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":209,"context_line":""},{"line_number":210,"context_line":"    def _load_kek(self, key_label, iv, wrapped_key, hmac,"},{"line_number":211,"context_line":"                  mkek_label, hmac_label, session):"},{"line_number":212,"context_line":"        ckek \u003d self.kek_cache.get(key_label, None)"},{"line_number":213,"context_line":"        if ckek is None:"},{"line_number":214,"context_line":"            # Get master keys"},{"line_number":215,"context_line":"            mkek \u003d self._get_master_key(mkek_label, session)"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_739ffd5f","line":212,"updated":"2015-11-16 20:31:37.000000000","message":"ckek? Do you mean pkek since it doesn\u0027t matter if it\u0027s cached or not?","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":209,"context_line":""},{"line_number":210,"context_line":"    def _load_kek(self, key_label, iv, wrapped_key, hmac,"},{"line_number":211,"context_line":"                  mkek_label, hmac_label, session):"},{"line_number":212,"context_line":"        ckek \u003d self.kek_cache.get(key_label, None)"},{"line_number":213,"context_line":"        if ckek is None:"},{"line_number":214,"context_line":"            # Get master keys"},{"line_number":215,"context_line":"            mkek \u003d self._get_master_key(mkek_label, session)"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_6377afd3","line":212,"in_reply_to":"ba8a016a_739ffd5f","updated":"2015-11-18 22:26:55.000000000","message":"ckek is an instance of the CachedKEK named tuple, and contains both the kek we want, plus an expiration time.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":213,"context_line":"        if ckek is None:"},{"line_number":214,"context_line":"            # Get master keys"},{"line_number":215,"context_line":"            mkek \u003d self._get_master_key(mkek_label, session)"},{"line_number":216,"context_line":"            mkhk \u003d self._get_master_key(hmac_label, session)"},{"line_number":217,"context_line":"            # Decode data"},{"line_number":218,"context_line":"            iv \u003d base64.b64decode(iv)"},{"line_number":219,"context_line":"            wrapped_key \u003d base64.b64decode(wrapped_key)"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_b3e7a511","line":216,"updated":"2015-11-16 20:31:37.000000000","message":"mkhk? Master Key HMAC Key? Perhaps we should rename these to master_kek and master_hmac? I don\u0027t know...","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":213,"context_line":"        if ckek is None:"},{"line_number":214,"context_line":"            # Get master keys"},{"line_number":215,"context_line":"            mkek \u003d self._get_master_key(mkek_label, session)"},{"line_number":216,"context_line":"            mkhk \u003d self._get_master_key(hmac_label, session)"},{"line_number":217,"context_line":"            # Decode data"},{"line_number":218,"context_line":"            iv \u003d base64.b64decode(iv)"},{"line_number":219,"context_line":"            wrapped_key \u003d base64.b64decode(wrapped_key)"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_7c742d67","line":216,"in_reply_to":"ba8a016a_b3e7a511","updated":"2015-11-18 22:26:55.000000000","message":"Heh, naming is a pain. I wasn\u0027t happy with just hmac and how it was used in the old module, so I tried a different name, and anyone who knows whats what should get it, but I can definitely see others having issues. I\u0027ll look at revamping that.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":224,"context_line":"            # Unwrap KEK"},{"line_number":225,"context_line":"            kek \u003d self.pkcs11.unwrap_key(mkek, iv, wrapped_key, session)"},{"line_number":226,"context_line":"            # Cache KEK"},{"line_number":227,"context_line":"            self._cache_kek(kek, key_label)"},{"line_number":228,"context_line":"        else:"},{"line_number":229,"context_line":"            kek \u003d ckek.kek"},{"line_number":230,"context_line":"            now \u003d int(time.time())"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_73c85d75","line":227,"updated":"2015-11-16 20:31:37.000000000","message":"Do you mind adding some spacing above each comment to make this a little more readable?","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":224,"context_line":"            # Unwrap KEK"},{"line_number":225,"context_line":"            kek \u003d self.pkcs11.unwrap_key(mkek, iv, wrapped_key, session)"},{"line_number":226,"context_line":"            # Cache KEK"},{"line_number":227,"context_line":"            self._cache_kek(kek, key_label)"},{"line_number":228,"context_line":"        else:"},{"line_number":229,"context_line":"            kek \u003d ckek.kek"},{"line_number":230,"context_line":"            now \u003d int(time.time())"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_a347d775","line":227,"in_reply_to":"ba8a016a_73c85d75","updated":"2015-11-18 22:26:55.000000000","message":"Sure","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":14926,"name":"Jeff Feng","email":"jianhua@us.ibm.com","username":"jhfeng"},"change_message_id":"ed26ce18fcecf89caf7356ec92994020107ae116","unresolved":false,"context_lines":[{"line_number":233,"context_line":""},{"line_number":234,"context_line":"        return kek"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"    def _cache_kek(self, kek, label):"},{"line_number":237,"context_line":"        expires \u003d int(time.time()) + self.kek_cache_ttl"},{"line_number":238,"context_line":"        ckek \u003d CachedKEK(kek, expires)"},{"line_number":239,"context_line":"        old_ckek \u003d self.kek_cache.get(label, None)"}],"source_content_type":"text/x-python","patch_set":2,"id":"da85f559_fe1b48c8","line":236,"updated":"2015-11-10 23:14:55.000000000","message":"yep, like you said in IRC channel. we need serialize this cacheng operation","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"c8e41801c20f74711fdfaf486a699589edb5b0a7","unresolved":false,"context_lines":[{"line_number":233,"context_line":""},{"line_number":234,"context_line":"        return kek"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"    def _cache_kek(self, kek, label):"},{"line_number":237,"context_line":"        expires \u003d int(time.time()) + self.kek_cache_ttl"},{"line_number":238,"context_line":"        ckek \u003d CachedKEK(kek, expires)"},{"line_number":239,"context_line":"        old_ckek \u003d self.kek_cache.get(label, None)"}],"source_content_type":"text/x-python","patch_set":2,"id":"da85f559_99333614","line":236,"in_reply_to":"da85f559_fe1b48c8","updated":"2015-11-10 23:43:52.000000000","message":"I was thinking about the code above in _load_kek and _load_kek_from_meta_dto is what needs locking, as well as kek generation in bind_kek_metadata. Those three methods use the self.caching_session, which is persistent and needs to be serialized.\n\nNow that you mention the cache, that\u0027ll need some controls as well.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":238,"context_line":"        ckek \u003d CachedKEK(kek, expires)"},{"line_number":239,"context_line":"        old_ckek \u003d self.kek_cache.get(label, None)"},{"line_number":240,"context_line":"        if old_ckek is not None:"},{"line_number":241,"context_line":"            if old_ckek.kek !\u003d kek:"},{"line_number":242,"context_line":"                msg \u003d u._(\"The KEK label {0} already exists in the cache!\")"},{"line_number":243,"context_line":"                raise ValueError(msg.format(label))"},{"line_number":244,"context_line":"        self.kek_cache[label] \u003d ckek"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_ae02de3c","line":241,"updated":"2015-11-16 20:31:37.000000000","message":"Why are we checking that they\u0027re equal? If we could retrieve it via the label then shouldn\u0027t that be enough?","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":238,"context_line":"        ckek \u003d CachedKEK(kek, expires)"},{"line_number":239,"context_line":"        old_ckek \u003d self.kek_cache.get(label, None)"},{"line_number":240,"context_line":"        if old_ckek is not None:"},{"line_number":241,"context_line":"            if old_ckek.kek !\u003d kek:"},{"line_number":242,"context_line":"                msg \u003d u._(\"The KEK label {0} already exists in the cache!\")"},{"line_number":243,"context_line":"                raise ValueError(msg.format(label))"},{"line_number":244,"context_line":"        self.kek_cache[label] \u003d ckek"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_9ea8e8dc","line":241,"in_reply_to":"ba8a016a_ae02de3c","updated":"2015-11-18 22:26:55.000000000","message":"I need to rewrite the cache implementation for project keks, as the current implementation has issues that I\u0027ve been having difficulty working around, including the fact that its rather ugly at the moment.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":14926,"name":"Jeff Feng","email":"jianhua@us.ibm.com","username":"jhfeng"},"change_message_id":"ed26ce18fcecf89caf7356ec92994020107ae116","unresolved":false,"context_lines":[{"line_number":264,"context_line":"            \u0027hmac_label\u0027: self.hmac_label"},{"line_number":265,"context_line":"        }"},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"    def _generate_mkek(self, key_length, key_label, session):"},{"line_number":268,"context_line":"        if key_label in self.mk_cache or \\"},{"line_number":269,"context_line":"           self.pkcs11.get_key_handle(key_label, session) is not None:"},{"line_number":270,"context_line":"            # TODO(jkf) Test if above key handle to token object causes a leak"}],"source_content_type":"text/x-python","patch_set":2,"id":"da85f559_b9063a1b","line":267,"updated":"2015-11-10 23:14:55.000000000","message":"nice feature, we should call it from __init__, so that the mkek and mkhk can be generated smartly.  and the utility tool \u0027pkcs11-key-generation\u0027 is not have to run.\n\nif call it from __init__, need serializing also","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":264,"context_line":"            \u0027hmac_label\u0027: self.hmac_label"},{"line_number":265,"context_line":"        }"},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"    def _generate_mkek(self, key_length, key_label, session):"},{"line_number":268,"context_line":"        if key_label in self.mk_cache or \\"},{"line_number":269,"context_line":"           self.pkcs11.get_key_handle(key_label, session) is not None:"},{"line_number":270,"context_line":"            # TODO(jkf) Test if above key handle to token object causes a leak"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_8c04c315","line":267,"in_reply_to":"da85f559_9965761f","updated":"2015-11-16 20:31:37.000000000","message":"The plugin use to generate master keys at runtime and it caused major problems as it induces race conditions when you have more than 1 Barbican node. Also, depending on your HSM HA configuration, the keys may not properly be distributed between your HSMs. We (Rackspace) determined that, considering a deployer should be backing up their keys to various other HSMs (not in the normal cluster) anyhow, it was better that a deployer create and manage the mkek\u0027s and hmac on the HSM through scripts.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"c8e41801c20f74711fdfaf486a699589edb5b0a7","unresolved":false,"context_lines":[{"line_number":264,"context_line":"            \u0027hmac_label\u0027: self.hmac_label"},{"line_number":265,"context_line":"        }"},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"    def _generate_mkek(self, key_length, key_label, session):"},{"line_number":268,"context_line":"        if key_label in self.mk_cache or \\"},{"line_number":269,"context_line":"           self.pkcs11.get_key_handle(key_label, session) is not None:"},{"line_number":270,"context_line":"            # TODO(jkf) Test if above key handle to token object causes a leak"}],"source_content_type":"text/x-python","patch_set":2,"id":"da85f559_9965761f","line":267,"in_reply_to":"da85f559_b9063a1b","updated":"2015-11-10 23:43:52.000000000","message":"I don\u0027t know if I\u0027m comfortable with Barbican generating its own master keys at run time. My feeling is I\u0027d rather have that happen via an external script, which is how the old module behaved. My goals for iteration 1 of the code was to duplicate the functionality of the old module, but with better session handling and key caching.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":266,"context_line":""},{"line_number":267,"context_line":"    def _generate_mkek(self, key_length, key_label, session):"},{"line_number":268,"context_line":"        if key_label in self.mk_cache or \\"},{"line_number":269,"context_line":"           self.pkcs11.get_key_handle(key_label, session) is not None:"},{"line_number":270,"context_line":"            # TODO(jkf) Test if above key handle to token object causes a leak"},{"line_number":271,"context_line":"            raise pkcs11.P11CryptoPluginKeyException("},{"line_number":272,"context_line":"                u._(\"A master key with that label already exists\")"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_6ce95f1a","line":269,"updated":"2015-11-16 20:31:37.000000000","message":"Shouldn\u0027t this just use self._get_master_key(...)?","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":266,"context_line":""},{"line_number":267,"context_line":"    def _generate_mkek(self, key_length, key_label, session):"},{"line_number":268,"context_line":"        if key_label in self.mk_cache or \\"},{"line_number":269,"context_line":"           self.pkcs11.get_key_handle(key_label, session) is not None:"},{"line_number":270,"context_line":"            # TODO(jkf) Test if above key handle to token object causes a leak"},{"line_number":271,"context_line":"            raise pkcs11.P11CryptoPluginKeyException("},{"line_number":272,"context_line":"                u._(\"A master key with that label already exists\")"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_dedaf04b","line":269,"in_reply_to":"ba8a016a_6ce95f1a","updated":"2015-11-18 22:26:55.000000000","message":"No, _get_master_key has cache interactions. But in the case where I know the key_label doesn\u0027t exist in the cache, I want to query the HSM directly to see if the label exists, without loading the key into the cache.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"c4890a844efa382c32ea560ae345dc724555d351","unresolved":false,"context_lines":[{"line_number":266,"context_line":""},{"line_number":267,"context_line":"    def _generate_mkek(self, key_length, key_label, session):"},{"line_number":268,"context_line":"        if key_label in self.mk_cache or \\"},{"line_number":269,"context_line":"           self.pkcs11.get_key_handle(key_label, session) is not None:"},{"line_number":270,"context_line":"            # TODO(jkf) Test if above key handle to token object causes a leak"},{"line_number":271,"context_line":"            raise pkcs11.P11CryptoPluginKeyException("},{"line_number":272,"context_line":"                u._(\"A master key with that label already exists\")"}],"source_content_type":"text/x-python","patch_set":2,"id":"7a740942_57318da1","line":269,"in_reply_to":"ba8a016a_dedaf04b","updated":"2015-12-03 23:59:41.000000000","message":"The reason I asked is because in this case, you\u0027re checking to see if the label is in the cache as a part of this conditional.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":14926,"name":"Jeff Feng","email":"jianhua@us.ibm.com","username":"jhfeng"},"change_message_id":"ed26ce18fcecf89caf7356ec92994020107ae116","unresolved":false,"context_lines":[{"line_number":269,"context_line":"           self.pkcs11.get_key_handle(key_label, session) is not None:"},{"line_number":270,"context_line":"            # TODO(jkf) Test if above key handle to token object causes a leak"},{"line_number":271,"context_line":"            raise pkcs11.P11CryptoPluginKeyException("},{"line_number":272,"context_line":"                u._(\"A master key with that label already exists\")"},{"line_number":273,"context_line":"            )"},{"line_number":274,"context_line":"        mk \u003d self.pkcs11.generate_key("},{"line_number":275,"context_line":"            key_length, session, key_label,"}],"source_content_type":"text/x-python","patch_set":2,"id":"da85f559_39c48a8f","line":272,"updated":"2015-11-10 23:14:55.000000000","message":"not sure on needing raise exception here. it could be because  \u0027pkcs11-key-generation\u0027 was run before.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"c8e41801c20f74711fdfaf486a699589edb5b0a7","unresolved":false,"context_lines":[{"line_number":269,"context_line":"           self.pkcs11.get_key_handle(key_label, session) is not None:"},{"line_number":270,"context_line":"            # TODO(jkf) Test if above key handle to token object causes a leak"},{"line_number":271,"context_line":"            raise pkcs11.P11CryptoPluginKeyException("},{"line_number":272,"context_line":"                u._(\"A master key with that label already exists\")"},{"line_number":273,"context_line":"            )"},{"line_number":274,"context_line":"        mk \u003d self.pkcs11.generate_key("},{"line_number":275,"context_line":"            key_length, session, key_label,"}],"source_content_type":"text/x-python","patch_set":2,"id":"da85f559_19618605","line":272,"in_reply_to":"da85f559_39c48a8f","updated":"2015-11-10 23:43:52.000000000","message":"The whole point of this code is to detect if the label we want to create exists or not, as we don\u0027t want to create multiple keys with the same label. If we did so, the get_key_handle code in pkcs11 would fail because it would get back more than a single result.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":280,"context_line":""},{"line_number":281,"context_line":"    def _generate_mkhk(self, key_length, key_label, session):"},{"line_number":282,"context_line":"        if key_label in self.mk_cache or \\"},{"line_number":283,"context_line":"           self.pkcs11.get_key_handle(key_label, session) is not None:"},{"line_number":284,"context_line":"            raise pkcs11.P11CryptoPluginKeyException("},{"line_number":285,"context_line":"                u._(\"A master key with that label already exists\")"},{"line_number":286,"context_line":"            )"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_ac90a796","line":283,"updated":"2015-11-16 20:31:37.000000000","message":"Same as above","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":280,"context_line":""},{"line_number":281,"context_line":"    def _generate_mkhk(self, key_length, key_label, session):"},{"line_number":282,"context_line":"        if key_label in self.mk_cache or \\"},{"line_number":283,"context_line":"           self.pkcs11.get_key_handle(key_label, session) is not None:"},{"line_number":284,"context_line":"            raise pkcs11.P11CryptoPluginKeyException("},{"line_number":285,"context_line":"                u._(\"A master key with that label already exists\")"},{"line_number":286,"context_line":"            )"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_7edbc44f","line":283,"in_reply_to":"ba8a016a_ac90a796","updated":"2015-11-18 22:26:55.000000000","message":"Heh, see above. :)","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":9234,"name":"Steve Heyman","email":"steve@heyman.com","username":"hockeynut"},"change_message_id":"3d64742cbb8e3703a8f3d285269d23ae69bfa17c","unresolved":false,"context_lines":[{"line_number":36,"context_line":"    cfg.StrOpt(\u0027library_path\u0027,"},{"line_number":37,"context_line":"               help\u003du._(\u0027Path to vendor PKCS11 library\u0027)),"},{"line_number":38,"context_line":"    cfg.StrOpt(\u0027login\u0027,"},{"line_number":39,"context_line":"               help\u003du._(\u0027Password to login to PKCS11 session\u0027)),"},{"line_number":40,"context_line":"    cfg.StrOpt(\u0027mkek_label\u0027,"},{"line_number":41,"context_line":"               help\u003du._(\u0027Master KEK label (used in the HSM)\u0027)),"},{"line_number":42,"context_line":"    cfg.IntOpt(\u0027mkek_length\u0027,"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa69d971_67379eff","line":39,"updated":"2016-01-11 15:56:47.000000000","message":"why isn\u0027t this secret\u003dTrue anymore?  I think that\u0027s needed to keep passwords out of the logs.","commit_id":"1f4f3597cce56b95f25af8ccd036433220dd16af"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"a77b577b9e79ec81e7cf492d011436b164274d69","unresolved":false,"context_lines":[{"line_number":36,"context_line":"    cfg.StrOpt(\u0027library_path\u0027,"},{"line_number":37,"context_line":"               help\u003du._(\u0027Path to vendor PKCS11 library\u0027)),"},{"line_number":38,"context_line":"    cfg.StrOpt(\u0027login\u0027,"},{"line_number":39,"context_line":"               help\u003du._(\u0027Password to login to PKCS11 session\u0027)),"},{"line_number":40,"context_line":"    cfg.StrOpt(\u0027mkek_label\u0027,"},{"line_number":41,"context_line":"               help\u003du._(\u0027Master KEK label (used in the HSM)\u0027)),"},{"line_number":42,"context_line":"    cfg.IntOpt(\u0027mkek_length\u0027,"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa69d971_6b69a48b","line":39,"in_reply_to":"fa69d971_67379eff","updated":"2016-01-11 17:20:42.000000000","message":"That shouldn\u0027t be there, thanks for pointing that out. Not sure how that changed creeped in. I\u0027ll reverse it in the next patch.","commit_id":"1f4f3597cce56b95f25af8ccd036433220dd16af"},{"author":{"_account_id":9234,"name":"Steve Heyman","email":"steve@heyman.com","username":"hockeynut"},"change_message_id":"3d64742cbb8e3703a8f3d285269d23ae69bfa17c","unresolved":false,"context_lines":[{"line_number":53,"context_line":"               help\u003du._(\u0027Project KEK length in bytes.\u0027),"},{"line_number":54,"context_line":"               default\u003d32),"},{"line_number":55,"context_line":"    cfg.IntOpt(\u0027pkek_cache_ttl\u0027,"},{"line_number":56,"context_line":"               help\u003du._(\u0027Project KEK Cache Time To Live\u0027),"},{"line_number":57,"context_line":"               default\u003d900),"},{"line_number":58,"context_line":"    cfg.IntOpt(\u0027pkek_cache_limit\u0027,"},{"line_number":59,"context_line":"               help\u003du._(\u0027Project KEK Cache Item Limit\u0027),"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa69d971_4a006101","line":56,"updated":"2016-01-11 15:56:47.000000000","message":"might want to add the time unit","commit_id":"1f4f3597cce56b95f25af8ccd036433220dd16af"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"a77b577b9e79ec81e7cf492d011436b164274d69","unresolved":false,"context_lines":[{"line_number":53,"context_line":"               help\u003du._(\u0027Project KEK length in bytes.\u0027),"},{"line_number":54,"context_line":"               default\u003d32),"},{"line_number":55,"context_line":"    cfg.IntOpt(\u0027pkek_cache_ttl\u0027,"},{"line_number":56,"context_line":"               help\u003du._(\u0027Project KEK Cache Time To Live\u0027),"},{"line_number":57,"context_line":"               default\u003d900),"},{"line_number":58,"context_line":"    cfg.IntOpt(\u0027pkek_cache_limit\u0027,"},{"line_number":59,"context_line":"               help\u003du._(\u0027Project KEK Cache Item Limit\u0027),"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa69d971_cbcc508b","line":56,"in_reply_to":"fa69d971_4a006101","updated":"2016-01-11 17:20:42.000000000","message":"Done","commit_id":"1f4f3597cce56b95f25af8ccd036433220dd16af"},{"author":{"_account_id":9234,"name":"Steve Heyman","email":"steve@heyman.com","username":"hockeynut"},"change_message_id":"3d64742cbb8e3703a8f3d285269d23ae69bfa17c","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"    \"\"\""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    def __init__(self, conf\u003dCONF, ffi\u003dNone, pkcs11\u003dNone):"},{"line_number":80,"context_line":"        self.conf \u003d conf"},{"line_number":81,"context_line":"        plugin_conf \u003d conf.p11_crypto_plugin"},{"line_number":82,"context_line":"        if plugin_conf.library_path is None:"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa69d971_aa179d43","line":79,"updated":"2016-01-11 15:56:47.000000000","message":"general comment - I\u0027m normally not a fan of shortened variable names (how would someone know that iv\u003dinitialization vector?) but this is such a specialized area of code it almost requires that the reader be familiar with those concepts (and their associated acronyms).","commit_id":"1f4f3597cce56b95f25af8ccd036433220dd16af"},{"author":{"_account_id":9234,"name":"Steve Heyman","email":"steve@heyman.com","username":"hockeynut"},"change_message_id":"3d64742cbb8e3703a8f3d285269d23ae69bfa17c","unresolved":false,"context_lines":[{"line_number":209,"context_line":"            ckek \u003d self.pkek_cache.get(label)"},{"line_number":210,"context_line":"            if ckek is not None:"},{"line_number":211,"context_line":"                if int(time.time()) \u003c ckek.expires:"},{"line_number":212,"context_line":"                    kek \u003d ckek.kek"},{"line_number":213,"context_line":"                else:"},{"line_number":214,"context_line":"                    with self.caching_session_lock:"},{"line_number":215,"context_line":"                        self.pkcs11.destroy_object(ckek.kek,"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa69d971_2a596d35","line":212,"updated":"2016-01-11 15:56:47.000000000","message":"the kek itself is still ok even if the ttl expires, right?  The ttl is just for the cache and has nothing to do with the kek itself.  So if the ttl expires after we check (line 214) but before we set the returned kek (215) then that\u0027s not a problem...","commit_id":"1f4f3597cce56b95f25af8ccd036433220dd16af"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"a77b577b9e79ec81e7cf492d011436b164274d69","unresolved":false,"context_lines":[{"line_number":209,"context_line":"            ckek \u003d self.pkek_cache.get(label)"},{"line_number":210,"context_line":"            if ckek is not None:"},{"line_number":211,"context_line":"                if int(time.time()) \u003c ckek.expires:"},{"line_number":212,"context_line":"                    kek \u003d ckek.kek"},{"line_number":213,"context_line":"                else:"},{"line_number":214,"context_line":"                    with self.caching_session_lock:"},{"line_number":215,"context_line":"                        self.pkcs11.destroy_object(ckek.kek,"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa69d971_ab279c10","line":212,"in_reply_to":"fa69d971_2a596d35","updated":"2016-01-11 17:20:42.000000000","message":"That\u0027s correct, the TTL is purely for cache management purposes.","commit_id":"1f4f3597cce56b95f25af8ccd036433220dd16af"},{"author":{"_account_id":9234,"name":"Steve Heyman","email":"steve@heyman.com","username":"hockeynut"},"change_message_id":"3d64742cbb8e3703a8f3d285269d23ae69bfa17c","unresolved":false,"context_lines":[{"line_number":218,"context_line":"        return kek"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"    def _pkek_cache_expire(self, now, session):"},{"line_number":221,"context_line":"        # Look for expired items, starting from oldest"},{"line_number":222,"context_line":"        for (label, kek) in self.pkek_cache.items():"},{"line_number":223,"context_line":"            if now \u003e\u003d kek.expires:"},{"line_number":224,"context_line":"                self.pkcs11.destroy_object(kek.kek, session)"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa69d971_aa5c7d19","line":221,"updated":"2016-01-11 15:56:47.000000000","message":"why isn\u0027t this protected by the lock?  seems that this is a critical section that needs to be atomic","commit_id":"1f4f3597cce56b95f25af8ccd036433220dd16af"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"a77b577b9e79ec81e7cf492d011436b164274d69","unresolved":false,"context_lines":[{"line_number":218,"context_line":"        return kek"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"    def _pkek_cache_expire(self, now, session):"},{"line_number":221,"context_line":"        # Look for expired items, starting from oldest"},{"line_number":222,"context_line":"        for (label, kek) in self.pkek_cache.items():"},{"line_number":223,"context_line":"            if now \u003e\u003d kek.expires:"},{"line_number":224,"context_line":"                self.pkcs11.destroy_object(kek.kek, session)"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa69d971_6b2c44ac","line":221,"in_reply_to":"fa69d971_aa5c7d19","updated":"2016-01-11 17:20:42.000000000","message":"_pkek_cache_add takes the caching_session lock before passing the caching_session object into this function. I didn\u0027t want to do the locking at this level incase we needed to pass a non-caching session object.","commit_id":"1f4f3597cce56b95f25af8ccd036433220dd16af"},{"author":{"_account_id":9234,"name":"Steve Heyman","email":"steve@heyman.com","username":"hockeynut"},"change_message_id":"3d64742cbb8e3703a8f3d285269d23ae69bfa17c","unresolved":false,"context_lines":[{"line_number":275,"context_line":"                hmac \u003d base64.b64decode(hmac)"},{"line_number":276,"context_line":"                kek_data \u003d iv + wrapped_key"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"                with self.caching_session_lock:"},{"line_number":279,"context_line":"                    session \u003d self.caching_session"},{"line_number":280,"context_line":"                    # Get master keys"},{"line_number":281,"context_line":"                    mkek \u003d self._get_master_key(mkek_label)"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa69d971_2aa72d0c","line":278,"updated":"2016-01-11 15:56:47.000000000","message":"Whenever I see lock 2 obtained while we hold lock 1 I am reminded of those silly dining philosophers.  I don\u0027t see a path (yet) where we can get this deadlock, but good to be aware just in case we have a place where we could obtain lock 2 before attempting to get lock 1","commit_id":"1f4f3597cce56b95f25af8ccd036433220dd16af"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"a77b577b9e79ec81e7cf492d011436b164274d69","unresolved":false,"context_lines":[{"line_number":275,"context_line":"                hmac \u003d base64.b64decode(hmac)"},{"line_number":276,"context_line":"                kek_data \u003d iv + wrapped_key"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"                with self.caching_session_lock:"},{"line_number":279,"context_line":"                    session \u003d self.caching_session"},{"line_number":280,"context_line":"                    # Get master keys"},{"line_number":281,"context_line":"                    mkek \u003d self._get_master_key(mkek_label)"}],"source_content_type":"text/x-python","patch_set":5,"id":"fa69d971_0e2276a3","line":278,"in_reply_to":"fa69d971_2aa72d0c","updated":"2016-01-11 17:20:42.000000000","message":"I agree, and I\u0027ve spent a lot of time looking at the code to ensure there aren\u0027t any situations where we run into that.","commit_id":"1f4f3597cce56b95f25af8ccd036433220dd16af"}],"barbican/plugin/crypto/pkcs11.py":[{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":352,"context_line":"        self.gcmtagsize \u003d 16"},{"line_number":353,"context_line":""},{"line_number":354,"context_line":"        # Validate configuration and RNG"},{"line_number":355,"context_line":"        session \u003d self.get_session()"},{"line_number":356,"context_line":"        self._rng_self_test(session)"},{"line_number":357,"context_line":"        self.return_session(session)"},{"line_number":358,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_b2bebcfd","line":355,"updated":"2015-11-16 20:31:37.000000000","message":"Considering we do a get_session() followed by a return_session(), it would probably be cleaner to push this into a context manager.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":352,"context_line":"        self.gcmtagsize \u003d 16"},{"line_number":353,"context_line":""},{"line_number":354,"context_line":"        # Validate configuration and RNG"},{"line_number":355,"context_line":"        session \u003d self.get_session()"},{"line_number":356,"context_line":"        self._rng_self_test(session)"},{"line_number":357,"context_line":"        self.return_session(session)"},{"line_number":358,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_e2a15647","line":355,"in_reply_to":"ba8a016a_b2bebcfd","updated":"2015-11-18 22:26:55.000000000","message":"Do you mean turning the get/return_session calls into something we can use with the \u0027with\u0027 statement?","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"c4890a844efa382c32ea560ae345dc724555d351","unresolved":false,"context_lines":[{"line_number":352,"context_line":"        self.gcmtagsize \u003d 16"},{"line_number":353,"context_line":""},{"line_number":354,"context_line":"        # Validate configuration and RNG"},{"line_number":355,"context_line":"        session \u003d self.get_session()"},{"line_number":356,"context_line":"        self._rng_self_test(session)"},{"line_number":357,"context_line":"        self.return_session(session)"},{"line_number":358,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"7a740942_772fe9a1","line":355,"in_reply_to":"ba8a016a_e2a15647","updated":"2015-12-03 23:59:41.000000000","message":"Yeah. It\u0027s not really necessary. However, they are quite nice to use and can help prevent people from accidentally not cleaning up after themselves.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":353,"context_line":""},{"line_number":354,"context_line":"        # Validate configuration and RNG"},{"line_number":355,"context_line":"        session \u003d self.get_session()"},{"line_number":356,"context_line":"        self._rng_self_test(session)"},{"line_number":357,"context_line":"        self.return_session(session)"},{"line_number":358,"context_line":""},{"line_number":359,"context_line":"    def get_session(self):"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_82b2ca92","line":356,"updated":"2015-11-18 22:26:55.000000000","message":"What are your thoughts on this remaining in the code? Is it really necessary? I only brought it over because it was in the old code and I\u0027d really like to get rid of it if we could.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"c4890a844efa382c32ea560ae345dc724555d351","unresolved":false,"context_lines":[{"line_number":353,"context_line":""},{"line_number":354,"context_line":"        # Validate configuration and RNG"},{"line_number":355,"context_line":"        session \u003d self.get_session()"},{"line_number":356,"context_line":"        self._rng_self_test(session)"},{"line_number":357,"context_line":"        self.return_session(session)"},{"line_number":358,"context_line":""},{"line_number":359,"context_line":"    def get_session(self):"}],"source_content_type":"text/x-python","patch_set":2,"id":"7a740942_f2dc4748","line":356,"in_reply_to":"ba8a016a_82b2ca92","updated":"2015-12-03 23:59:41.000000000","message":"I think it was in here to verify that when we instantiated the pkcs11 plugin we guaranteed that we had the rights to do something on the HSM. We also made sure we could generate some data that looked random. Personally, I think we should have some sort of health test when start up Barbican. This may not be buying us that much, but I think the idea is good. \n\nI could be completely wrong about the reasons. Paul would have a much better idea on the rational than I would.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":369,"context_line":"    def return_session(self, session):"},{"line_number":370,"context_line":"        self._close_session(session)"},{"line_number":371,"context_line":""},{"line_number":372,"context_line":"    def generate_random(self, length, session):"},{"line_number":373,"context_line":"        buf \u003d self._generate_random(length, session)"},{"line_number":374,"context_line":"        return self.ffi.buffer(buf)[:]"},{"line_number":375,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_52b510cb","line":372,"updated":"2015-11-16 20:31:37.000000000","message":"Soo this is just the dereferenced version of _generate_random? Perhaps we should call this generate_random and the other generate_random_buffer? I don\u0027t know. It feels like this could result in someone making an easy mistake.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":369,"context_line":"    def return_session(self, session):"},{"line_number":370,"context_line":"        self._close_session(session)"},{"line_number":371,"context_line":""},{"line_number":372,"context_line":"    def generate_random(self, length, session):"},{"line_number":373,"context_line":"        buf \u003d self._generate_random(length, session)"},{"line_number":374,"context_line":"        return self.ffi.buffer(buf)[:]"},{"line_number":375,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_c238d2f0","line":372,"in_reply_to":"ba8a016a_52b510cb","updated":"2015-11-18 22:26:55.000000000","message":"This is the public interface to generate_random, I wanted all of the public interfaces to be native python types and contain all of the ffi types inside. _generate_random below was created because I need to get random numbers inside of the pkcs11 module and need the ffi buffer, so all the logic is in the internal version, with the public version calling the internal version and unwrapping the ffi buffer. I am going to move the internal method down with the rest of the internal methods to hopefully avoid confusion.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":14926,"name":"Jeff Feng","email":"jianhua@us.ibm.com","username":"jhfeng"},"change_message_id":"ed26ce18fcecf89caf7356ec92994020107ae116","unresolved":false,"context_lines":[{"line_number":373,"context_line":"        buf \u003d self._generate_random(length, session)"},{"line_number":374,"context_line":"        return self.ffi.buffer(buf)[:]"},{"line_number":375,"context_line":""},{"line_number":376,"context_line":"    def _generate_random(self, length, session):"},{"line_number":377,"context_line":"        buf \u003d self.ffi.new(\"CK_BYTE[{0}]\".format(length))"},{"line_number":378,"context_line":"        rv \u003d self.lib.C_GenerateRandom(session, buf, length)"},{"line_number":379,"context_line":"        self._check_error(rv)"}],"source_content_type":"text/x-python","patch_set":2,"id":"da85f559_b075f6fa","line":376,"updated":"2015-11-10 23:14:55.000000000","message":"suggest to move this _* routine to bottom","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"c8e41801c20f74711fdfaf486a699589edb5b0a7","unresolved":false,"context_lines":[{"line_number":373,"context_line":"        buf \u003d self._generate_random(length, session)"},{"line_number":374,"context_line":"        return self.ffi.buffer(buf)[:]"},{"line_number":375,"context_line":""},{"line_number":376,"context_line":"    def _generate_random(self, length, session):"},{"line_number":377,"context_line":"        buf \u003d self.ffi.new(\"CK_BYTE[{0}]\".format(length))"},{"line_number":378,"context_line":"        rv \u003d self.lib.C_GenerateRandom(session, buf, length)"},{"line_number":379,"context_line":"        self._check_error(rv)"}],"source_content_type":"text/x-python","patch_set":2,"id":"da85f559_d41bc571","line":376,"in_reply_to":"da85f559_b075f6fa","updated":"2015-11-10 23:43:52.000000000","message":"I was waffling on wether to move that or not. It\u0027ll be moved in the next patch set.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":393,"context_line":"        count \u003d self.ffi.new(\"CK_ULONG *\")"},{"line_number":394,"context_line":"        obj_handle_ptr \u003d self.ffi.new(\"CK_OBJECT_HANDLE[2]\")"},{"line_number":395,"context_line":"        rv \u003d self.lib.C_FindObjects(session, obj_handle_ptr, 2, count)"},{"line_number":396,"context_line":"        self._check_error(rv)"},{"line_number":397,"context_line":"        key \u003d None"},{"line_number":398,"context_line":"        if count[0] \u003d\u003d 1:"},{"line_number":399,"context_line":"            key \u003d obj_handle_ptr[0]"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_7295b4e2","line":396,"updated":"2015-11-16 20:31:37.000000000","message":"Can we add a blank line below this. I\u0027m going cross-eyed with all of these lines right together.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":399,"context_line":"            key \u003d obj_handle_ptr[0]"},{"line_number":400,"context_line":"        rv \u003d self.lib.C_FindObjectsFinal(session)"},{"line_number":401,"context_line":"        self._check_error(rv)"},{"line_number":402,"context_line":"        if count[0] \u003e 1:"},{"line_number":403,"context_line":"            raise P11CryptoPluginKeyException()"},{"line_number":404,"context_line":"        return key"},{"line_number":405,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_924ff891","line":402,"updated":"2015-11-16 20:31:37.000000000","message":"shouldn\u0027t this be up with the other count[0] conditional?","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":399,"context_line":"            key \u003d obj_handle_ptr[0]"},{"line_number":400,"context_line":"        rv \u003d self.lib.C_FindObjectsFinal(session)"},{"line_number":401,"context_line":"        self._check_error(rv)"},{"line_number":402,"context_line":"        if count[0] \u003e 1:"},{"line_number":403,"context_line":"            raise P11CryptoPluginKeyException()"},{"line_number":404,"context_line":"        return key"},{"line_number":405,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_4532acf3","line":402,"in_reply_to":"ba8a016a_924ff891","updated":"2015-11-18 22:26:55.000000000","message":"No, we need to make sure C_FindObjectsFinal is called before we throw an exception for the error. The count[0] \u003d\u003d 1 conditional handles the nominal case where only one object is returned.  If count[0] !\u003d 1, then it is either 0, which key \u003d None handles, or count[0] is greater than 1, which is an error, so we raise after finalizing the find operation.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":409,"context_line":"        rv \u003d self.lib.C_EncryptInit(session, ck_mechanism.mech, key)"},{"line_number":410,"context_line":"        self._check_error(rv)"},{"line_number":411,"context_line":""},{"line_number":412,"context_line":"        pt_len \u003d len(pt_data)"},{"line_number":413,"context_line":"        ct_len \u003d self.ffi.new(\"CK_ULONG *\", pt_len + self.gcmtagsize)"},{"line_number":414,"context_line":"        ct \u003d self.ffi.new(\"CK_BYTE[{0}]\".format(ct_len[0]))"},{"line_number":415,"context_line":"        rv \u003d self.lib.C_Encrypt(session, pt_data, pt_len, ct, ct_len)"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_f5af4ee1","line":412,"updated":"2015-11-16 20:31:37.000000000","message":"I mentioned this in the other file, but could we stop using the pt and ct names in variable and expand them to plaintext and ciphertext? It should make this a bit easier to read for newer people to this module.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":437,"context_line":"    def generate_key(self, key_length, session, key_label\u003dNone,"},{"line_number":438,"context_line":"                     encrypt\u003dFalse, sign\u003dFalse, wrap\u003dFalse, master_key\u003dFalse):"},{"line_number":439,"context_line":"        if not encrypt and not sign and not wrap:"},{"line_number":440,"context_line":"            raise P11CryptoPluginException()"},{"line_number":441,"context_line":"        if master_key and not key_label:"},{"line_number":442,"context_line":"            raise ValueError(u._(\"key_label must be set for master_keys\"))"},{"line_number":443,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_75e91e1a","line":440,"updated":"2015-11-16 20:31:37.000000000","message":"We should probably include an error message here.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"},{"author":{"_account_id":12920,"name":"Jason Fritcher","email":"jason_fritcher@symantec.com","username":"jfritcher"},"change_message_id":"1974a4c5ded1e811a404850e9793b780a4ca0154","unresolved":false,"context_lines":[{"line_number":437,"context_line":"    def generate_key(self, key_length, session, key_label\u003dNone,"},{"line_number":438,"context_line":"                     encrypt\u003dFalse, sign\u003dFalse, wrap\u003dFalse, master_key\u003dFalse):"},{"line_number":439,"context_line":"        if not encrypt and not sign and not wrap:"},{"line_number":440,"context_line":"            raise P11CryptoPluginException()"},{"line_number":441,"context_line":"        if master_key and not key_label:"},{"line_number":442,"context_line":"            raise ValueError(u._(\"key_label must be set for master_keys\"))"},{"line_number":443,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_c56bfcb7","line":440,"in_reply_to":"ba8a016a_75e91e1a","updated":"2015-11-18 22:26:55.000000000","message":"Good catch, thanks.","commit_id":"ea1fcd6a7a6000bb14aa3c0628e63943dcbf1267"}],"barbican/tests/plugin/crypto/test_p11_crypto.py":[{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":293,"context_line":"            self.plugin.supports(\"SOMETHING_RANDOM\")"},{"line_number":294,"context_line":"        )"},{"line_number":295,"context_line":""},{"line_number":296,"context_line":"    def test_default_slot_id(self):"},{"line_number":297,"context_line":"        with mock.patch.object(self.plugin.pkcs11, \u0027open_session\u0027) as mocked:"},{"line_number":298,"context_line":"            def mocked_open_session(slot):"},{"line_number":299,"context_line":"                self.assertEqual(1, slot)"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_35b6368b","side":"PARENT","line":296,"updated":"2015-11-16 20:31:37.000000000","message":"This should still be tested somewhere","commit_id":"86ca7f6d1a2b729ea39eb5670d80ab3ecd3d8ffe"},{"author":{"_account_id":7262,"name":"John Vrbanac","email":"john.vrbanac@linux.com","username":"john.vrbanac"},"change_message_id":"ce592b94b8e55667350e0c905308aac73b13a5ad","unresolved":false,"context_lines":[{"line_number":301,"context_line":"            mocked.side_effect \u003d mocked_open_session"},{"line_number":302,"context_line":"            self.plugin.pkcs11.create_working_session()"},{"line_number":303,"context_line":""},{"line_number":304,"context_line":"    def test_configurable_slot_id(self):"},{"line_number":305,"context_line":"        self.cfg_mock.p11_crypto_plugin.slot_id \u003d 99"},{"line_number":306,"context_line":"        with mock.patch.object(pkcs11.PKCS11, \u0027get_key_handle\u0027) as mocked:"},{"line_number":307,"context_line":"            mocked.return_value \u003d long(1)"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba8a016a_f5b0ae8d","side":"PARENT","line":304,"updated":"2015-11-16 20:31:37.000000000","message":"This should still be tested somewhere","commit_id":"86ca7f6d1a2b729ea39eb5670d80ab3ecd3d8ffe"}]}