|
485
|
1 import os |
|
|
2 import time |
|
|
3 import fcntl |
|
|
4 import hmac |
|
|
5 import binascii |
|
|
6 import sys |
|
488
|
7 import hashlib |
|
|
8 |
|
|
9 import bottle |
|
485
|
10 |
|
|
11 import config |
|
|
12 |
|
488
|
13 __all__ = ["get_csrf_blob", "check_csrf_blob", "setup_csrf", "get_user_hash"] |
|
|
14 |
|
|
15 HASH=hashlib.sha1 |
|
485
|
16 |
|
|
17 def get_user_hash(): |
|
489
|
18 verify = bottle.request.environ.get('SSL_CLIENT_VERIFY', '') |
|
|
19 if not (verify == 'GENEROUS' or verify == 'SUCCESS'): |
|
488
|
20 return 'FAILVERIFY' |
|
|
21 blob = bottle.request.environ.get('SSL_CLIENT_CERT') |
|
|
22 if not blob: |
|
|
23 return 'NOCERT' |
|
|
24 |
|
|
25 b64 = ''.join(l for l in blob.split('\n') |
|
|
26 if not l.startswith('-')) |
|
|
27 |
|
|
28 return HASH(binascii.a2b_base64(b64)).hexdigest() |
|
485
|
29 |
|
|
30 def setup_csrf(): |
|
|
31 NONCE_SIZE=16 |
|
|
32 global _csrf_fd, _csrf_key |
|
|
33 _csrf_fd = open('%s/csrf.dat' % config.DATA_PATH, 'r+') |
|
|
34 |
|
|
35 try: |
|
|
36 fcntl.lockf(_csrf_fd, fcntl.LOCK_EX | fcntl.LOCK_NB) |
|
|
37 os.fchmod(_csrf_fd.fileno(), 0600) |
|
|
38 _csrf_fd.write("%d-%s" % (os.getpid(), binascii.hexlify(os.urandom(NONCE_SIZE)))) |
|
|
39 _csrf_fd.flush() |
|
|
40 _csrf_fd.seek(0) |
|
|
41 except IOError: |
|
|
42 pass |
|
|
43 fcntl.lockf(_csrf_fd, fcntl.LOCK_SH) |
|
|
44 _csrf_key = _csrf_fd.read() |
|
|
45 # keep the lock open until we go away |
|
|
46 |
|
|
47 |
|
|
48 def get_csrf_blob(): |
|
|
49 expiry = int(config.CSRF_TIMEOUT + time.time()) |
|
|
50 content = '%s-%s' % (get_user_hash(), expiry) |
|
|
51 mac = hmac.new(_csrf_key, content).hexdigest() |
|
|
52 return "%s-%s" % (content, mac) |
|
|
53 |
|
|
54 def check_csrf_blob(blob): |
|
|
55 toks = blob.split('-') |
|
|
56 if len(toks) != 3: |
|
|
57 return False |
|
|
58 |
|
|
59 user, expiry, mac = toks |
|
|
60 if user != get_user_hash(): |
|
|
61 return False |
|
|
62 |
|
|
63 try: |
|
|
64 exp = int(expiry) |
|
|
65 except ValueError: |
|
|
66 return False |
|
|
67 |
|
|
68 if exp < 1000000000: |
|
|
69 return False |
|
|
70 |
|
|
71 if exp > time.time(): |
|
|
72 return False |
|
|
73 |
|
|
74 check_content = "%s-%s" % (user, expiry) |
|
|
75 check_mac = hmac.new(_csrf_key, content).hexdigest() |
|
|
76 if mac == check_mac: |
|
|
77 return True |
|
|
78 |
|
|
79 return False |
|
|
80 |
