1

import base64

     2

import calendar

     3

import datetime

     4

import ipaddr

     5

import hashlib

     6

import M2Crypto

     7

     8

import logging; log = logging.getLogger('pvl.login.pubtkt')

     9

    10

def datetime2unix (dt) :

    11

    """

    12

        datetime.datetime -> float

    13

    """

    14

    15

    return calendar.timegm(dt.utctimetuple())

    16

    17

def unix2datetime (unix) :

    18

    return datetime.datetime.utcfromtimestamp(unix)

    19

    20

class Error (Exception) :

    21

    def __init__ (self, error) :

    22

        self.error = error

    23

    24

class ParseError (Error) :

    25

    """

    26

        Unable to load PubTkt from cookie.

    27

    """

    28

    29

    def __unicode__ (self) :

    30

        return u"Invalid login token: {self.error}".format(self=self)

    31

    32

class VerifyError (Error) :

    33

    """

    34

        Unable to verify PubTkt.

    35

    """

    36

    37

    def __init__ (self, pubtkt, error) :

    38

        self.pubtkt = pubtkt

    39

        self.error = error

    40

    41

    def __unicode__ (self) :

    42

        return u"Invalid login token signature: {self.error}".format(self=self)

    43

    44

class ExpiredError (VerifyError) :

    45

    """

    46

        Verified PubTkt, but expired.

    47

    """

    48

    49

    def __init__ (self, pubtkt, now) :

    50

        self.pubtkt = pubtkt

    51

        self.now = now

    52

    53

    def __unicode__ (self) :

    54

        return u"Login token has expired"

    55

    56

class ServerError (Error) :

    57

    """

    58

        Invalid server request.

    59

    """

    60

    61

    def __unicode__ (self) :

    62

        return u"Login request is not valid: {self.error}".format(self=self)

    63

    64

class ServerKeys (object) :

    65

    @classmethod

    66

    def config (cls, public_key, private_key) :

    67

        return cls(

    68

                public  = M2Crypto.RSA.load_pub_key(public_key),

    69

                private = M2Crypto.RSA.load_key(private_key),

    70

        )

    71

    72

    def __init__ (self, public, private) :

    73

        self.public = public

    74

        self.private = private

    75

    76

class PubTkt (object) :

    77

    @staticmethod

    78

    def now () :

    79

        return datetime.datetime.utcnow()

    80

    81

    @classmethod

    82

    def load (cls, cookie, public_key) :

    83

        """

    84

            Load and verify a pubtkt from a cookie.

    85

    86

            Raise ParseError, VerifyError.

    87

        """

    88

    89

        pubtkt, hash, sig = cls.parse(cookie)

    90

    91

        log.debug("parsed %s hash=%s sig=%s", pubtkt, hash.encode('hex'), sig.encode('hex'))

    92

    93

        try :

    94

            if not public_key.verify(hash, sig, 'sha1') :

    95

                raise VerifyError(pubtkt, "Unable to verify signature")

    96

        except M2Crypto.RSA.RSAError as ex :

    97

            raise VerifyError(pubtkt, str(ex))

    98

    99

        now = cls.now()

   100

   101

        log.debug("validating %s < %s", pubtkt.validuntil, now)

   102

   103

        if pubtkt.validuntil < now :

   104

            raise ExpiredError(pubtkt, now)

   105

   106

        return pubtkt

   107

   108

    @classmethod

   109

    def parse (cls, cookie) :

   110

        """

   111

            Load a pubtkt from a cookie

   112

   113

            Raises ParseError.

   114

        """

   115

   116

        if ';sig=' in cookie :

   117

            data, sig = cookie.rsplit(';sig=', 1)

   118

        else :

   119

            raise ParseError("Missing signature")

   120

   121

        try :

   122

            sig = base64.b64decode(sig)

   123

        except (ValueError, TypeError) as ex :

   124

            raise ParseError("Invalid signature")

   125

   126

        hash = hashlib.sha1(data).digest()

   127

   128

        try :

   129

            attrs = dict(field.split('=', 1) for field in data.split(';'))

   130

        except ValueError as ex :

   131

            raise ParseError(str(ex))

   132

   133

        if 'uid' not in attrs or 'validuntil' not in attrs :

   134

            raise ParseError("Missing parameters in cookie (uid, validuntil)")

   135

   136

        try :

   137

            return cls.build(**attrs), hash, sig

   138

        except TypeError as ex :

   139

            raise ParseError("Invalid or missing parameters in cookie")

   140

        except ValueError as ex :

   141

            raise ParseError(str(ex))

   142

   143

    @classmethod

   144

    def build (cls, uid, validuntil, cip=None, tokens=None, udata=None, graceperiod=None, bauth=None) :

   145

        """

   146

            Build a pubtkt from items.

   147

   148

            Raises TypeError or ValueError..

   149

        """

   150

   151

        return cls(uid,

   152

                validuntil  = unix2datetime(int(validuntil)),

   153

                cip         = ipaddr.IPAddress(cip) if cip else None,

   154

                tokens      = tokens.split(',') if tokens else (),

   155

                udata       = udata,

   156

                graceperiod = unix2datetime(int(graceperiod)) if graceperiod else None,

   157

                bauth       = bauth,

   158

        )

   159

   160

    @classmethod

   161

    def new (cls, uid, valid, grace=None, **opts) :

   162

        now = cls.now()

   163

   164

        return cls(uid, now + valid,

   165

            graceperiod = now + grace if grace else None,

   166

            **opts

   167

        )

   168

   169

    def __init__ (self, uid, validuntil, cip=None, tokens=(), udata=None, graceperiod=None, bauth=None) :

   170

        self.uid = uid

   171

        self.validuntil = validuntil

   172

        self.cip = cip

   173

        self.tokens = tokens

   174

        self.udata = udata

   175

        self.graceperiod = graceperiod

   176

        self.bauth = bauth

   177

   178

    def iteritems (self) :

   179

        yield 'uid', self.uid

   180

        yield 'validuntil', int(datetime2unix(self.validuntil))

   181

   182

        if self.cip :

   183

            yield 'cip', self.cip

   184

   185

        if self.tokens :

   186

            yield 'tokens', ','.join(self.tokens)

   187

   188

        if self.udata :

   189

            yield 'udata', self.udata

   190

   191

        if self.graceperiod :

   192

            yield 'graceperiod', int(datetime2unix(self.graceperiod))

   193

   194

        if self.bauth :

   195

            yield 'bauth', self.bauth

   196

   197

    def __str__ (self) :

   198

        """

   199

            The (unsigned) pubtkt

   200

        """

   201

   202

        return ';'.join('%s=%s' % (key, value) for key, value in self.iteritems())

   203

   204

    def sign (self, private_key) :

   205

        data = str(self)

   206

        hash = hashlib.sha1(data).digest()

   207

        sign = private_key.sign(hash, 'sha1')

   208

   209

        return '%s;sig=%s' % (self, base64.b64encode(sign))

   210

   211

    def valid (self) :

   212

        """

   213

            Return remaining ticket validity.

   214

        """

   215

   216

        now = self.now()

   217

   218

        if self.validuntil > now :

   219

            return self.validuntil - now

   220

        else :

   221

            return False

   222

   223

    def grace (self) :

   224

        """

   226

        """

   227

   228

        now = self.now()

   229

   230

        if not self.graceperiod :

   231

            return None

   232

   241

        else :

   243

            return False

   244

   245

    def renew (self, valid, grace=None) :

   246

        if not self.valid() :

   247

            raise ExpiredError(self, "Unable to renew expired pubtkt")

   248

   249

        now = self.now()

   250

   251

        self.validuntil = now + valid

   252

        self.graceperiod = now + grace if grace else None

   253

   254