1 # encoding: utf-8

     2 

     3 import base64

     4 import datetime

     5 import hashlib

     6 import os

     7 import os.path

     8 import string

     9 

    10 import pvl.invoke

    11 

    12 import logging; log = logging.getLogger('pvl.login.ssl')

    13 

    14 class Error (Exception) :

    15     pass

    16 

    17 class UsersCA (object) :

    18     OPENSSL = '/usr/bin/openssl'

    19 

    20     SIGN_DAYS = 1

    21 

    22     VALID_USER = set(string.letters + string.digits + '-.')

    23     

    24     O = u"Päivölän Kansanopisto"

    25     OU = u"People"

    26     DC = ('paivola', 'fi')

    27 

    28     def __init__ (self, ca, users) :

    29         self.ca = ca

    30         self.users = users

    31 

    32         self.ca_config = os.path.join(ca, 'openssl.cnf')

    33 

    34     def sign_spkac (self, out, spkac, days=SIGN_DAYS) :

    35         """

    36             Sign given request file (path).

    37 

    38             Creates the given output file (path). Empty file on errors..

    39         """

    40 

    41         pvl.invoke.invoke(self.OPENSSL, ('ca',

    42                 '-config', self.ca_config,

    43                 '-spkac', spkac,

    44                 '-out', out,

    45                 '-policy', 'policy_user',

    46                 '-days', str(days),

    47                 '-utf8',

    48             ),

    49             setenv={

    50                 'CA':   self.ca,

    51             },

    52         )

    53 

    54     def generate_dn (self, uid, cn=None) :

    55         """

    56             Generate OpenSSL (rdn, value) pairs for given user.

    57         """

    58 

    59         if self.O :

    60             yield 'O', self.O

    61 

    62         elif self.DC :

    63             for index, dc in enumerate(self.DC, 1) :

    64                 yield '{index}.DC'.format(index=index), dc

    65         

    66         yield 'OU', self.OU

    67          

    68         yield 'UID', uid 

    69         

    70         if cn :

    71             yield 'CN', cn

    72 

    73     def write_spkac (self, path, spkac, dn) :

    74         """

    75             Write out a spkac file to the given path, containing the given base64-encoded spkac and DN.

    76         """

    77 

    78         # roundtrip the spkac for consistent formatting

    79         spkac = base64.b64encode(base64.b64decode(spkac))

    80 

    81         file = open(path, 'w')

    82 

    83         file.write('SPKAC=')

    84         file.write(spkac)

    85         file.write('\n')

    86 

    87         for rdn, value in dn :

    88             file.write(u'{rdn}={value}\n'.format(rdn=rdn, value=value).encode('utf-8'))

    89         

    90         file.close()

    91 

    92     def sign_user (self, user, spkac, userinfo=None) :

    93         """

    94             Sign given spkac string (base64-encoded) for given user.

    95 

    96             Returns a name for the signed cert.

    97         """

    98 

    99         if not set(user).issubset(self.VALID_USER) :

   100             raise Error("Invalid username: {user}".format(user=user))

   101 

   102         dir = os.path.join(self.users, user)

   103 

   104         if not os.path.exists(dir) :

   105             os.mkdir(dir)

   106 

   107         name = hashlib.sha1(user + spkac).hexdigest()

   108         spkac_file = os.path.join(dir, name) + '.spkac'

   109         cert_file = os.path.join(dir, name)

   110         tmp_file = os.path.join(dir, name) + '.tmp'

   111         

   112         # the req to sign

   113         if os.path.exists(spkac_file) :

   114             log.warning("spkac already exists: %s", spkac_file)

   115         else :

   116             log.info("%s: write spkac: %s", user, spkac_file)

   117             self.write_spkac(os.path.join(dir, name) + '.spkac', spkac, self.generate_dn(user, userinfo))

   118         

   119         # sign it

   120         if os.path.exists(cert_file) :

   121             log.warning("cert already exists: %s", cert_file)

   122             return name

   123         

   124         if os.path.exists(tmp_file) :

   125             log.warning("cleaning out previous tmp file: %s", tmp_file)

   126             os.unlink(tmp_file)

   127 

   128         log.info("%s: sign cert: %s", user, cert_file)

   129         self.sign_spkac(tmp_file, spkac_file)

   130 

   131         log.debug("%s: rename %s -> %s", user, tmp_file, cert_file)

   132         os.rename(tmp_file, cert_file)

   133 

   134         return name

   135 

   136     def open_cert (self, user, name) :

   137         """

   138             Return an opened cert file by username / cert name.

   139         """

   140 

   141         if not set(user).issubset(self.VALID_USER) :

   142             raise Error("Invalid username: {user}".format(user=user))

   143 

   144         path = os.path.join(self.users, user, name)

   145 

   146         if not os.path.exists(path) :

   147             raise Error("No cert found on server")

   148 

   149         return open(path)