annotate web/secure.py @ 219:16a83e2c97a0

sleep on a semaphore so it can start/stop immediately when there's a SIGHUP from the web UI. makes it seem more magical.
author Matt Johnston <matt@ucc.asn.au>
date Fri, 19 Dec 2014 21:52:50 +0800
parents 59379b2bd056
children da769023bf08
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
211
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
1 import re
185
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
2 import os
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
3 import time
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
4 import fcntl
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
5 import hmac
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
6 import binascii
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
7 import sys
189
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
8 import hashlib
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
9
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
10 import bottle
185
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
11
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
12 import config
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
13
211
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
14 __all__ = ["get_csrf_blob", "check_csrf_blob", "setup_csrf", "get_user_hash",
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
15 "check_user_hash"]
189
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
16
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
17 HASH=hashlib.sha1
185
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
18
211
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
19 CLEAN_RE = re.compile('[^a-z0-9A-Z]')
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
20
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
21 def clean_hash(h):
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
22 return CLEAN_RE.sub('', h.lower())
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
23
185
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
24 def get_user_hash():
211
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
25 """
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
26 Uses the following apache config.
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
27 Needs a separate port or IP to no-certificate SSL, SNI isn't good enough.
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
28
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
29 <location /~matt/templog/set>
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
30 Require all granted
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
31 SSLVerifyClient optional_no_ca
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
32 SSLVerifyDepth 1
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
33 SSLOptions +StdEnvVars +ExportCertData +OptRenegotiate
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
34 </location>
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
35 """
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
36
191
8318d50d766d gets current params
Matt Johnston <matt@ucc.asn.au>
parents: 189
diff changeset
37 verify = bottle.request.environ.get('SSL_CLIENT_VERIFY', '')
8318d50d766d gets current params
Matt Johnston <matt@ucc.asn.au>
parents: 189
diff changeset
38 if not (verify == 'GENEROUS' or verify == 'SUCCESS'):
189
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
39 return 'FAILVERIFY'
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
40 blob = bottle.request.environ.get('SSL_CLIENT_CERT')
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
41 if not blob:
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
42 return 'NOCERT'
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
43
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
44 b64 = ''.join(l for l in blob.split('\n')
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
45 if not l.startswith('-'))
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
46
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
47 return HASH(binascii.a2b_base64(b64)).hexdigest()
185
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
48
211
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
49 def check_user_hash(allowed_users):
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
50 current_hash = clean_hash(get_user_hash())
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
51 for a in allowed_users:
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
52 if current_hash == clean_hash(a):
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
53 return True
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
54 return False
59379b2bd056 key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents: 194
diff changeset
55
185
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
56 def setup_csrf():
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
57 NONCE_SIZE=16
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
58 global _csrf_fd, _csrf_key
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
59 _csrf_fd = open('%s/csrf.dat' % config.DATA_PATH, 'r+')
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
60
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
61 try:
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
62 fcntl.lockf(_csrf_fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
63 os.fchmod(_csrf_fd.fileno(), 0600)
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
64 _csrf_fd.write("%d-%s" % (os.getpid(), binascii.hexlify(os.urandom(NONCE_SIZE))))
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
65 _csrf_fd.flush()
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
66 _csrf_fd.seek(0)
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
67 except IOError:
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
68 pass
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
69 fcntl.lockf(_csrf_fd, fcntl.LOCK_SH)
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
70 _csrf_key = _csrf_fd.read()
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
71 # keep the lock open until we go away
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
72
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
73
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
74 def get_csrf_blob():
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
75 expiry = int(config.CSRF_TIMEOUT + time.time())
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
76 content = '%s-%s' % (get_user_hash(), expiry)
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
77 mac = hmac.new(_csrf_key, content).hexdigest()
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
78 return "%s-%s" % (content, mac)
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
79
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
80 def check_csrf_blob(blob):
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
81 toks = blob.split('-')
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
82 if len(toks) != 3:
194
4fa8cbf31065 working kinda
Matt Johnston <matt@ucc.asn.au>
parents: 191
diff changeset
83 print>>sys.stderr, "wrong toks"
185
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
84 return False
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
85
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
86 user, expiry, mac = toks
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
87 if user != get_user_hash():
194
4fa8cbf31065 working kinda
Matt Johnston <matt@ucc.asn.au>
parents: 191
diff changeset
88 print>>sys.stderr, "wrong user"
185
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
89 return False
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
90
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
91 try:
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
92 exp = int(expiry)
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
93 except ValueError:
194
4fa8cbf31065 working kinda
Matt Johnston <matt@ucc.asn.au>
parents: 191
diff changeset
94 print>>sys.stderr, "failed exp"
185
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
95 return False
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
96
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
97 if exp < 1000000000:
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
98 return False
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
99
194
4fa8cbf31065 working kinda
Matt Johnston <matt@ucc.asn.au>
parents: 191
diff changeset
100 if exp < time.time():
4fa8cbf31065 working kinda
Matt Johnston <matt@ucc.asn.au>
parents: 191
diff changeset
101 print>>sys.stderr, "expired %d %d" % (exp, time.time())
185
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
102 return False
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
103
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
104 check_content = "%s-%s" % (user, expiry)
194
4fa8cbf31065 working kinda
Matt Johnston <matt@ucc.asn.au>
parents: 191
diff changeset
105 check_mac = hmac.new(_csrf_key, check_content).hexdigest()
185
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
106 if mac == check_mac:
194
4fa8cbf31065 working kinda
Matt Johnston <matt@ucc.asn.au>
parents: 191
diff changeset
107 print>>sys.stderr, "good hmac"
185
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
108 return True
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
109
194
4fa8cbf31065 working kinda
Matt Johnston <matt@ucc.asn.au>
parents: 191
diff changeset
110 print>>sys.stderr, "fail"
185
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
111 return False
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
112