Mercurial > templog
annotate web/secure.py @ 238:509a1be16456
gevent doesn't work well with subprocess
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Sun, 10 May 2015 21:13:49 +0800 |
| parents | da769023bf08 |
| children | f7261dd970da |
| rev | line source |
|---|---|
|
211
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
1 import re |
| 185 | 2 import os |
| 3 import time | |
| 4 import fcntl | |
| 5 import hmac | |
| 6 import binascii | |
| 7 import sys | |
| 189 | 8 import hashlib |
| 9 | |
| 10 import bottle | |
| 185 | 11 |
| 12 import config | |
| 13 | |
|
211
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
14 __all__ = ["get_csrf_blob", "check_csrf_blob", "setup_csrf", "get_user_hash", |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
15 "check_user_hash"] |
| 189 | 16 |
| 17 HASH=hashlib.sha1 | |
| 185 | 18 |
|
211
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
19 CLEAN_RE = re.compile('[^a-z0-9A-Z]') |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
20 |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
21 def clean_hash(h): |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
22 return CLEAN_RE.sub('', h.lower()) |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
23 |
| 185 | 24 def get_user_hash(): |
|
211
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
25 """ |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
26 Uses the following apache config. |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
27 Needs a separate port or IP to no-certificate SSL, SNI isn't good enough. |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
28 |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
29 <location /~matt/templog/set> |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
30 Require all granted |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
31 SSLVerifyClient optional_no_ca |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
32 SSLVerifyDepth 1 |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
33 SSLOptions +StdEnvVars +ExportCertData +OptRenegotiate |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
34 </location> |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
35 """ |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
36 |
| 191 | 37 verify = bottle.request.environ.get('SSL_CLIENT_VERIFY', '') |
| 38 if not (verify == 'GENEROUS' or verify == 'SUCCESS'): | |
| 189 | 39 return 'FAILVERIFY' |
| 40 blob = bottle.request.environ.get('SSL_CLIENT_CERT') | |
| 41 if not blob: | |
| 42 return 'NOCERT' | |
| 43 | |
| 44 b64 = ''.join(l for l in blob.split('\n') | |
| 45 if not l.startswith('-')) | |
| 46 | |
| 47 return HASH(binascii.a2b_base64(b64)).hexdigest() | |
| 185 | 48 |
|
211
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
49 def check_user_hash(allowed_users): |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
50 current_hash = clean_hash(get_user_hash()) |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
51 for a in allowed_users: |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
52 if current_hash == clean_hash(a): |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
53 return True |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
54 return False |
|
59379b2bd056
key fingerprints are case- and whitespace-insensitive.
Matt Johnston <matt@ucc.asn.au>
parents:
194
diff
changeset
|
55 |
| 185 | 56 def setup_csrf(): |
| 57 NONCE_SIZE=16 | |
| 58 global _csrf_fd, _csrf_key | |
| 226 | 59 _csrf_fd = os.fdopen(os.open('%s/csrf.dat' % config.DATA_PATH, os.O_RDWR | os.O_CREAT, 0600), 'r+') |
| 185 | 60 |
| 61 try: | |
| 62 fcntl.lockf(_csrf_fd, fcntl.LOCK_EX | fcntl.LOCK_NB) | |
| 63 _csrf_fd.write("%d-%s" % (os.getpid(), binascii.hexlify(os.urandom(NONCE_SIZE)))) | |
| 64 _csrf_fd.flush() | |
| 65 _csrf_fd.seek(0) | |
| 66 except IOError: | |
| 67 pass | |
| 68 fcntl.lockf(_csrf_fd, fcntl.LOCK_SH) | |
| 69 _csrf_key = _csrf_fd.read() | |
| 70 # keep the lock open until we go away | |
| 71 | |
| 72 | |
| 73 def get_csrf_blob(): | |
| 74 expiry = int(config.CSRF_TIMEOUT + time.time()) | |
| 75 content = '%s-%s' % (get_user_hash(), expiry) | |
| 76 mac = hmac.new(_csrf_key, content).hexdigest() | |
| 77 return "%s-%s" % (content, mac) | |
| 78 | |
| 79 def check_csrf_blob(blob): | |
| 80 toks = blob.split('-') | |
| 81 if len(toks) != 3: | |
| 194 | 82 print>>sys.stderr, "wrong toks" |
| 185 | 83 return False |
| 84 | |
| 85 user, expiry, mac = toks | |
| 86 if user != get_user_hash(): | |
| 194 | 87 print>>sys.stderr, "wrong user" |
| 185 | 88 return False |
| 89 | |
| 90 try: | |
| 91 exp = int(expiry) | |
| 92 except ValueError: | |
| 194 | 93 print>>sys.stderr, "failed exp" |
| 185 | 94 return False |
| 95 | |
| 96 if exp < 1000000000: | |
| 97 return False | |
| 98 | |
| 194 | 99 if exp < time.time(): |
| 100 print>>sys.stderr, "expired %d %d" % (exp, time.time()) | |
| 185 | 101 return False |
| 102 | |
| 103 check_content = "%s-%s" % (user, expiry) | |
| 194 | 104 check_mac = hmac.new(_csrf_key, check_content).hexdigest() |
| 185 | 105 if mac == check_mac: |
| 194 | 106 print>>sys.stderr, "good hmac" |
| 185 | 107 return True |
| 108 | |
| 194 | 109 print>>sys.stderr, "fail" |
| 185 | 110 return False |
| 111 |