diff options
Diffstat (limited to 'src/leap/base/auth.py')
| -rw-r--r-- | src/leap/base/auth.py | 151 |
1 files changed, 108 insertions, 43 deletions
diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py index d91e138b..f1b618ba 100644 --- a/src/leap/base/auth.py +++ b/src/leap/base/auth.py @@ -1,7 +1,7 @@ import binascii import json import logging -import urlparse +#import urlparse import requests import srp @@ -9,13 +9,14 @@ import srp from PyQt4 import QtCore from leap.base import constants as baseconstants +from leap.crypto import leapkeyring logger = logging.getLogger(__name__) SIGNUP_TIMEOUT = getattr(baseconstants, 'SIGNUP_TIMEOUT', 5) # XXX remove me!! -SERVER = "http://springbok/1" +SERVER = "https://localhost:8443/1" """ @@ -36,6 +37,7 @@ class LeapSRPRegister(object): schema="https", provider=None, port=None, + verify=True, register_path="1/users.json", method="POST", fetcher=requests, @@ -46,6 +48,7 @@ class LeapSRPRegister(object): self.schema = schema self.provider = provider self.port = port + self.verify = verify self.register_path = register_path self.method = method self.fetcher = fetcher @@ -97,7 +100,8 @@ class LeapSRPRegister(object): # XXX get self.method req = self.session.post( uri, data=user_data, - timeout=SIGNUP_TIMEOUT) + timeout=SIGNUP_TIMEOUT, + verify=self.verify) logger.debug(req) logger.debug('user_data: %s', user_data) #logger.debug('response: %s', req.text) @@ -119,18 +123,20 @@ safe_unhexlify = lambda x: binascii.unhexlify(x) \ class SRPAuth(requests.auth.AuthBase): - def __init__(self, username, password, server=SERVER, verify=True): + def __init__(self, username, password, verify=None): self.username = username self.password = password - self.server = server self.verify = verify + # XXX init something similar to + # SERVER... + self.init_data = None self.session = requests.session() self.init_srp() - def get_data(self, response): + def get_json_data(self, response): return json.loads(response.content) def init_srp(self): @@ -151,43 +157,100 @@ class SRPAuth(requests.auth.AuthBase): } def get_init_data(self): - init_session = self.session.post( - self.server + '/sessions', - data=self.get_auth_data(), - verify=self.verify) - self.init_data = self.get_data(init_session) + try: + init_session = self.session.post( + SERVER + '/sessions.json/', + data=self.get_auth_data(), + verify=self.verify) + except requests.exceptions.ConnectionError: + raise SRPAuthenticationError( + "No connection made (salt).") + if init_session.status_code not in (200, ): + raise SRPAuthenticationError( + "No valid response (salt).") + + # XXX should get auth_result.json instead + self.init_data = self.get_json_data(init_session) return self.init_data + def get_server_proof_data(self): + try: + auth_result = self.session.put( + SERVER + '/sessions.json/' + self.username, + data={'client_auth': binascii.hexlify(self.M)}, + verify=self.verify) + except requests.exceptions.ConnectionError: + raise SRPAuthenticationError( + "No connection made (HAMK).") + + if auth_result.status_code not in (200, ): + raise SRPAuthenticationError( + "No valid response (HAMK).") + + # XXX should get auth_result.json instead + try: + self.auth_data = self.get_json_data(auth_result) + except ValueError: + raise SRPAuthenticationError( + "No valid data sent (HAMK)") + + return self.auth_data + def authenticate(self): - print 'start authentication...' + logger.debug('start authentication...') init_data = self.get_init_data() salt = init_data.get('salt', None) B = init_data.get('B', None) + # XXX refactor this function + # move checks and un-hex + # to routines + if not salt or not B: - raise SRPAuthenticationError + raise SRPAuthenticationError( + "Server did not send initial data.") + + try: + unhex_salt = safe_unhexlify(salt) + except TypeError: + raise SRPAuthenticationError( + "Bad data from server (salt)") + try: + unhex_B = safe_unhexlify(B) + except TypeError: + raise SRPAuthenticationError( + "Bad data from server (B)") self.M = self.srp_usr.process_challenge( - safe_unhexlify(salt), - safe_unhexlify(B) + unhex_salt, + unhex_B ) - auth_result = self.session.put( - self.server + '/sessions/' + self.username, - data={'client_auth': binascii.hexlify(self.M)}, - verify=self.verify) + proof_data = self.get_server_proof_data() + + HAMK = proof_data.get("M2", None) + if not HAMK: + errors = proof_data.get('errors', None) + if errors: + logger.error(errors) + raise SRPAuthenticationError("Server did not send HAMK.") + + try: + unhex_HAMK = safe_unhexlify(HAMK) + except TypeError: + raise SRPAuthenticationError( + "Bad data from server (HAMK)") - # XXX check for errors - auth_data = self.get_data(auth_result) self.srp_usr.verify_session( - safe_unhexlify(auth_data["M2"])) + unhex_HAMK) try: assert self.srp_usr.authenticated() - print 'user is authenticated!' + logger.debug('user is authenticated!') except (AssertionError): - raise SRPAuthenticationError + raise SRPAuthenticationError( + "Auth verification failed.") def __call__(self, req): self.authenticate() @@ -195,7 +258,7 @@ class SRPAuth(requests.auth.AuthBase): return req -def srpauth_protected(user=None, passwd=None): +def srpauth_protected(user=None, passwd=None, verify=True): """ decorator factory that accepts user and password keyword arguments @@ -205,41 +268,43 @@ def srpauth_protected(user=None, passwd=None): def wrapper(*args, **kwargs): print 'uri is ', args[0] if user and passwd: - auth = SRPAuth(user, passwd) + auth = SRPAuth(user, passwd, verify) kwargs['auth'] = auth return fn(*args, **kwargs) return wrapper return srpauth -def magic_srpauth(fn): +def get_leap_credentials(): + settings = QtCore.QSettings() + full_username = settings.value('eip_username') + username, domain = full_username.split('@') + seed = settings.value('%s_seed' % domain, None) + password = leapkeyring.leap_get_password(full_username, seed=seed) + return (username, password) + + +# XXX TODO +# Pass verify as single argument, +# in srpauth_protected style + +def magick_srpauth(fn): """ decorator that gets user and password from the config file and adds those to the decorated request """ - # TODO --- finish this... - # currently broken. + logger.debug('magick srp auth decorator called') + def wrapper(*args, **kwargs): - uri = args[0] + #uri = args[0] # XXX Ugh! # Problem with this approach. # This won't work when we're using # api.foo.bar # Unless we keep a table with the # equivalencies... - - domain = urlparse.urlparse(uri).netloc - - # XXX check this settings init... - settings = QtCore.QSettings() - user = settings.get('%s_username' % domain, None) - - # uh... I forgot. - # get secret? - # leapkeyring.get_password(foo?) - passwd = settings.get('%s_password' % domain, None) - + user, passwd = get_leap_credentials() auth = SRPAuth(user, passwd) kwargs['auth'] = auth return fn(*args, **kwargs) @@ -257,4 +322,4 @@ if __name__ == "__main__": req.raise_for_status #print req.content - test_srp_protected_get('http://springbok/1/cert') + test_srp_protected_get('http://localhost:8443/1/cert') |