1

import base64

     2

import calendar

     3

import datetime

     4

import ipaddr

     5

import hashlib

     6

import M2Crypto

     7

     8

import logging; log = logging.getLogger('pvl.login.pubtkt')

     9

    10

def datetime2unix (dt) :

    11

    """

    12

        datetime.datetime -> float

    13

    """

    14

    15

    return calendar.timegm(dt.utctimetuple())

    16

    17

def unix2datetime (unix) :

    18

    return datetime.datetime.utcfromtimestamp(unix)

    19

    20

class Error (Exception) :

    21

    """

    22

        Error

    23

    """

    24

    25

    def __init__ (self, error) :

    26

        self.error = error

    27

    28

    def __unicode__ (self) :

    29

        return u"{doc}: {self.error}".format(self=self, doc=self.__doc__.strip())

    30

    31

class ParseError (Error) :

    32

    """

    33

        Unable to parse PubTkt from cookie

    34

    """

    35

    36

class VerifyError (Error) :

    37

    """

    38

        Invalid login token sigunature

    39

    """

    40

    41

    def __init__ (self, pubtkt, error) :

    42

        self.pubtkt = pubtkt

    43

        self.error = error

    44

    45

class ExpiredError (Error) :

    46

    """

    47

        Login token has expired

    48

    """

    49

    50

    def __init__ (self, pubtkt, expire) :

    51

        self.pubtkt = pubtkt

    52

        self.error = expire

    53

    54

class RenewError (Error) :

    55

    """

    56

        Unable to renew login token

    57

    """

    58

    59

class ServerError (Error) :

    60

    """

    61

        Login request from invalid server

    62

    """

    63

    64

class ServerKeys (object) :

    65

    @classmethod

    66

    def config (cls, public_key, private_key) :

    67

        return cls(

    68

                public  = M2Crypto.RSA.load_pub_key(public_key),

    69

                private = M2Crypto.RSA.load_key(private_key),

    70

        )

    71

    72

    def __init__ (self, public, private) :

    73

        self.public = public

    74

        self.private = private

    75

    76

class PubTkt (object) :

    77

    @staticmethod

    78

    def now () :

    79

        return datetime.datetime.utcnow()

    80

    81

    @classmethod

    82

    def load (cls, cookie, public_key) :

    83

        """

    84

            Load and verify a pubtkt from a cookie.

    85

    86

            Raise ParseError, VerifyError.

    87

        """

    88

    89

        pubtkt, hash, sig = cls.parse(cookie)

    90

    91

        log.debug("parsed %s hash=%s sig=%s", pubtkt, hash.encode('hex'), sig.encode('hex'))

    92

    93

        try :

    94

            if not public_key.verify(hash, sig, 'sha1') :

    95

                raise VerifyError(pubtkt, "Unable to verify signature")

    96

        except M2Crypto.RSA.RSAError as ex :

    97

            raise VerifyError(pubtkt, str(ex))

    98

    99

   100

        log.debug("checking expiry %s", pubtkt.validuntil)

   101

   102

        if not pubtkt.valid() :

   103

            raise ExpiredError(pubtkt, pubtkt.validuntil)

   104

   105

        return pubtkt

   106

   107

    @classmethod

   108

    def parse (cls, cookie) :

   109

        """

   110

            Load a pubtkt from a cookie

   111

   112

            Raises ParseError.

   113

        """

   114

   115

        if ';sig=' in cookie :

   116

            data, sig = cookie.rsplit(';sig=', 1)

   117

        else :

   118

            raise ParseError("Missing signature")

   119

   120

        try :

   121

            sig = base64.b64decode(sig)

   122

        except (ValueError, TypeError) as ex :

   123

            raise ParseError("Invalid signature")

   124

   125

        hash = hashlib.sha1(data).digest()

   126

   127

        try :

   128

            attrs = dict(field.split('=', 1) for field in data.split(';'))

   129

        except ValueError as ex :

   130

            raise ParseError(str(ex))

   131

   132

        if 'uid' not in attrs or 'validuntil' not in attrs :

   133

            raise ParseError("Missing parameters in cookie (uid, validuntil)")

   134

   135

        try :

   136

            return cls.build(**attrs), hash, sig

   137

        except TypeError as ex :

   138

            raise ParseError("Invalid or missing parameters in cookie")

   139

        except ValueError as ex :

   140

            raise ParseError(str(ex))

   141

   142

    @classmethod

   143

    def build (cls, uid, validuntil, cip=None, tokens=None, udata=None, graceperiod=None, bauth=None) :

   144

        """

   145

            Build a pubtkt from items.

   146

   147

            Raises TypeError or ValueError..

   148

        """

   149

   150

        return cls(uid,

   151

                validuntil  = unix2datetime(int(validuntil)),

   152

                cip         = ipaddr.IPAddress(cip) if cip else None,

   153

                tokens      = tokens.split(',') if tokens else (),

   154

                udata       = udata,

   155

                graceperiod = unix2datetime(int(graceperiod)) if graceperiod else None,

   156

                bauth       = bauth,

   157

        )

   158

   159

    @classmethod

   160

    def new (cls, uid, valid, grace=None, **opts) :

   161

        now = cls.now()

   162

   163

        return cls(uid, now + valid,

   164

            graceperiod = now + grace if grace else None,

   165

            **opts

   166

        )

   167

   168

    def update (self, valid, grace, cip=None, tokens=None, udata=None, bauth=None) :

   169

        now = self.now()

   170

   171

        return type(self)(self.uid, now + valid,

   172

            graceperiod = now + grace if grace else None,

   173

            cip         = self.cip if cip is None else cip,

   174

            tokens      = self.tokens if tokens is None else tokens,

   175

            udata       = self.udata if udata is None else udata,

   176

            bauth       = self.bauth if bauth is None else bauth,

   177

        )

   178

   179

    def __init__ (self, uid, validuntil, cip=None, tokens=(), udata=None, graceperiod=None, bauth=None) :

   180

        self.uid = uid

   181

        self.validuntil = validuntil

   182

        self.cip = cip

   183

        self.tokens = tokens

   184

        self.udata = udata

   185

        self.graceperiod = graceperiod

   186

        self.bauth = bauth

   187

   188

    def iteritems (self) :

   189

        yield 'uid', self.uid

   190

        yield 'validuntil', int(datetime2unix(self.validuntil))

   191

   192

        if self.cip :

   193

            yield 'cip', self.cip

   194

   195

        if self.tokens :

   196

            yield 'tokens', ','.join(str(token) for token in self.tokens)

   197

   198

        if self.udata :

   199

            yield 'udata', self.udata

   200

   201

        if self.graceperiod :

   202

            yield 'graceperiod', int(datetime2unix(self.graceperiod))

   203

   204

        if self.bauth :

   205

            yield 'bauth', self.bauth

   206

   207

    def __str__ (self) :

   208

        """

   209

            The (unsigned) pubtkt

   210

        """

   211

   212

        return ';'.join('%s=%s' % (key, value) for key, value in self.iteritems())

   213

   214

    def sign (self, private_key) :

   215

        data = str(self)

   216

        hash = hashlib.sha1(data).digest()

   217

        sign = private_key.sign(hash, 'sha1')

   218

   219

        return '%s;sig=%s' % (self, base64.b64encode(sign))

   220

   221

    def valid (self) :

   222

        """

   223

            Return remaining ticket validity.

   224

        """

   225

   226

        now = self.now()

   227

   228

        if self.validuntil > now :

   229

            return self.validuntil - now

   230

        else :

   231

            return False

   232

   233

    def grace (self) :

   234

        """

   235

            Return remaining grace period.

   236

        """

   237

   238

        now = self.now()

   239

   240

        if not self.graceperiod :

   241

            return None

   242

   243

        elif now < self.graceperiod :

   244

            # still valid

   245

            return None

   246

   247

        elif now < self.validuntil :

   248

            # positive

   249

            return self.validuntil - now

   250

   251

        else :

   252

            # expired

   253

            return False

   254

   255

    def remaining (self) :

   256

        """

   257

            Return remaining validity before grace.

   258

        """

   259

   260

        now = self.now()

   261

   262

        if not self.graceperiod :

   263

            return self.valid()

   264

   265

        elif now < self.graceperiod :

   266

            return self.graceperiod - now

   267

   268

        else :

   269

            # expired

   270

            return False

   271

   272

    def grace_period (self) :

   273

        """

   274

            Return the length of the grace period.

   275

        """

   276

   277

        if self.graceperiod :

   278

            return self.validuntil - self.graceperiod

   279

        else :

   280

            return None

   281

   282

    def renew (self, valid, grace=None) :

   283

        if not self.valid() :

   284

            raise ExpiredError(self, "Unable to renew expired pubtkt")

   285

   286

        now = self.now()

   287

   288

        self.validuntil = now + valid

   289

        self.graceperiod = now + grace if grace else None

   290

   291