annotate web/secure.py @ 191:8318d50d766d

gets current params
author Matt Johnston <matt@ucc.asn.au>
date Tue, 11 Feb 2014 22:10:32 +0800
parents 101c66da848d
children 4fa8cbf31065
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
185
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
1 import os
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
2 import time
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
3 import fcntl
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
4 import hmac
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
5 import binascii
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
6 import sys
189
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
7 import hashlib
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
8
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
9 import bottle
185
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
10
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
11 import config
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
12
189
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
13 __all__ = ["get_csrf_blob", "check_csrf_blob", "setup_csrf", "get_user_hash"]
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
14
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
15 HASH=hashlib.sha1
185
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
16
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
17 def get_user_hash():
191
8318d50d766d gets current params
Matt Johnston <matt@ucc.asn.au>
parents: 189
diff changeset
18 verify = bottle.request.environ.get('SSL_CLIENT_VERIFY', '')
8318d50d766d gets current params
Matt Johnston <matt@ucc.asn.au>
parents: 189
diff changeset
19 if not (verify == 'GENEROUS' or verify == 'SUCCESS'):
189
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
20 return 'FAILVERIFY'
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
21 blob = bottle.request.environ.get('SSL_CLIENT_CERT')
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
22 if not blob:
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
23 return 'NOCERT'
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
24
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
25 b64 = ''.join(l for l in blob.split('\n')
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
26 if not l.startswith('-'))
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
27
101c66da848d watcher script
Matt Johnston <matt@ucc.asn.au>
parents: 185
diff changeset
28 return HASH(binascii.a2b_base64(b64)).hexdigest()
185
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
29
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
30 def setup_csrf():
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
31 NONCE_SIZE=16
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
32 global _csrf_fd, _csrf_key
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
33 _csrf_fd = open('%s/csrf.dat' % config.DATA_PATH, 'r+')
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
34
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
35 try:
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
36 fcntl.lockf(_csrf_fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
37 os.fchmod(_csrf_fd.fileno(), 0600)
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
38 _csrf_fd.write("%d-%s" % (os.getpid(), binascii.hexlify(os.urandom(NONCE_SIZE))))
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
39 _csrf_fd.flush()
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
40 _csrf_fd.seek(0)
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
41 except IOError:
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
42 pass
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
43 fcntl.lockf(_csrf_fd, fcntl.LOCK_SH)
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
44 _csrf_key = _csrf_fd.read()
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
45 # keep the lock open until we go away
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
46
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
47
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
48 def get_csrf_blob():
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
49 expiry = int(config.CSRF_TIMEOUT + time.time())
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
50 content = '%s-%s' % (get_user_hash(), expiry)
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
51 mac = hmac.new(_csrf_key, content).hexdigest()
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
52 return "%s-%s" % (content, mac)
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
53
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
54 def check_csrf_blob(blob):
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
55 toks = blob.split('-')
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
56 if len(toks) != 3:
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
57 return False
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
58
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
59 user, expiry, mac = toks
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
60 if user != get_user_hash():
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
61 return False
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
62
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
63 try:
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
64 exp = int(expiry)
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
65 except ValueError:
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
66 return False
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
67
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
68 if exp < 1000000000:
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
69 return False
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
70
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
71 if exp > time.time():
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
72 return False
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
73
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
74 check_content = "%s-%s" % (user, expiry)
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
75 check_mac = hmac.new(_csrf_key, content).hexdigest()
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
76 if mac == check_mac:
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
77 return True
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
78
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
79 return False
adbf70d1449f working
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
80