1

import base64

     2

import calendar

     3

import datetime

     4

import ipaddr

     5

import hashlib

     6

import M2Crypto

     7

     8

import logging; log = logging.getLogger('pvl.login.pubtkt')

     9

    10

def datetime2unix (dt) :

    11

    """

    12

        datetime.datetime -> float

    13

    """

    14

    15

    return calendar.timegm(dt.utctimetuple())

    16

    17

class Error (Exception) :

    18

    pass

    19

    20

class ParseError (Error) :

    21

    pass

    22

    23

class VerifyError (Error) :

    24

    def __init__ (self, pubtkt, error) :

    25

        self.pubtkt = pubtkt

    26

        self.error = error

    27

    28

class ExpiredError (VerifyError) :

    29

    def __init__ (self, pubtkt, now) :

    30

        self.pubtkt = pubtkt

    31

        self.now = now

    32

    33

class ServerKeys (object) :

    34

    @classmethod

    35

    def config (cls, public_key, private_key) :

    36

        return cls(

    37

                public  = M2Crypto.RSA.load_pub_key(public_key),

    38

                private = M2Crypto.RSA.load_key(private_key),

    39

        )

    40

    41

    def __init__ (self, public, private) :

    42

        self.public = public

    43

        self.private = private

    44

    45

class PubTkt (object) :

    46

    @classmethod

    47

    def load (cls, cookie, public_key) :

    48

        """

    49

            Load and verify a pubtkt from a cookie.

    50

    51

            Raise ParseError, VerifyError.

    52

        """

    53

    54

        pubtkt, hash, sig = cls.parse(cookie)

    55

    56

        log.debug("parsed %s hash=%s sig=%s", pubtkt, hash.encode('hex'), sig.encode('hex'))

    57

    58

        try :

    59

            if not public_key.verify(hash, sig, 'sha1') :

    60

                raise VerifyError(pubtkt, "Unable to verify signature")

    61

        except M2Crypto.RSA.RSAError as ex :

    62

            raise VerifyError(pubtkt, str(ex))

    63

    64

        now = datetime.datetime.now()

    65

    66

        log.debug("validating %s < %s", pubtkt.validuntil, now)

    67

    68

        if pubtkt.validuntil < now :

    69

            raise ExpiredError(pubtkt, now)

    70

    71

        return pubtkt

    72

    73

    @classmethod

    74

    def parse (cls, cookie) :

    75

        """

    76

            Load a pubtkt from a cookie

    77

    78

            Raises ParseError.

    79

        """

    80

    81

        if ';sig=' in cookie :

    82

            data, sig = cookie.rsplit(';sig=', 1)

    83

        else :

    84

            raise ParseError("Missing signature")

    85

    86

        sig = base64.b64decode(sig)

    87

        hash = hashlib.sha1(data).digest()

    88

    89

        try :

    90

            attrs = dict(field.split('=', 1) for field in data.split(';'))

    91

        except ValueError as ex :

    92

            raise ParseError(str(ex))

    93

    94

        try :

    95

            return cls.build(**attrs), hash, sig

    96

        except (TypeError, ValueError) as ex :

    97

            raise ParseError(str(ex))

    98

    99

    @classmethod

   100

    def build (cls, uid, validuntil, cip=None, tokens=None, udata=None, graceperiod=None, bauth=None) :

   101

        """

   102

            Build a pubtkt from items.

   103

   104

            Raises TypeError or ValueError..

   105

        """

   106

   107

        return cls(uid,

   108

                validuntil  = datetime.datetime.fromtimestamp(int(validuntil)),

   109

                cip         = ipaddr.IPAddress(cip) if cip else None,

   110

                tokens      = tokens.split(',') if tokens else (),

   111

                udata       = udata,

   112

                graceperiod = datetime.datetime.fromtimestamp(int(graceperiod)) if graceperiod else None,

   113

                bauth       = bauth,

   114

        )

   115

   116

    @classmethod

   117

    def new (cls, uid, expiry, **opts) :

   118

        now = datetime.datetime.now()

   119

   120

        return cls(uid, now + expiry, **opts)

   121

   122

    def __init__ (self, uid, validuntil, cip=None, tokens=(), udata=None, graceperiod=None, bauth=None) :

   123

        self.uid = uid

   124

        self.validuntil = validuntil

   125

        self.cip = cip

   126

        self.tokens = tokens

   127

        self.udata = udata

   128

        self.graceperiod = graceperiod

   129

        self.bauth = bauth

   130

   131

    def iteritems (self) :

   132

        yield 'uid', self.uid

   133

        yield 'validuntil', int(datetime2unix(self.validuntil))

   134

   135

        if self.cip :

   136

            yield 'cip', self.cip

   137

   138

        if self.tokens :

   139

            yield 'tokens', ','.join(self.tokens)

   140

   141

        if self.udata :

   142

            yield 'udata', self.udata

   143

   144

        if self.graceperiod :

   145

            yield 'graceperiod', int(datetime2unix(self.graceperiod))

   146

   147

        if self.bauth :

   148

            yield 'bauth', self.bauth

   149

   150

    def __str__ (self) :

   151

        """

   152

            The (unsigned) pubtkt

   153

        """

   154

   155

        return ';'.join('%s=%s' % (key, value) for key, value in self.iteritems())

   156

   157

    def sign (self, private_key) :

   158

        data = str(self)

   159

        hash = hashlib.sha1(data).digest()

   160

        sign = private_key.sign(hash, 'sha1')

   161

   162

        return '%s;sig=%s' % (self, base64.b64encode(sign))

   163