From 28dcbfbc6e3a61d47c2a1218bce5d2693c77d04d Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Wed, 17 Oct 2012 06:14:57 +0900
Subject: moved srp registration to base

and some minor changes in wizard, like textentry for provider.
---
 src/leap/base/auth.py | 87 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 87 insertions(+)
 create mode 100644 src/leap/base/auth.py

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
new file mode 100644
index 00000000..c34ad39b
--- /dev/null
+++ b/src/leap/base/auth.py
@@ -0,0 +1,87 @@
+import binascii
+import logging
+
+import requests
+import srp
+
+from leap.base import constants as baseconstants
+
+logger = logging.getLogger(__name__)
+
+SIGNUP_TIMEOUT = getattr(baseconstants, 'SIGNUP_TIMEOUT', 5)
+
+
+class LeapSRPRegister(object):
+
+    def __init__(self,
+                 schema="https",
+                 provider=None,
+                 port=None,
+                 register_path="1/users.json",
+                 method="POST",
+                 fetcher=requests,
+                 srp=srp,
+                 hashfun=srp.SHA256,
+                 ng_constant=srp.NG_1024):
+
+        self.schema = schema
+        self.provider = provider
+        self.port = port
+        self.register_path = register_path
+        self.method = method
+        self.fetcher = fetcher
+        self.srp = srp
+        self.HASHFUN = hashfun
+        self.NG = ng_constant
+
+        self.init_session()
+
+    def init_session(self):
+        self.session = self.fetcher.session()
+
+    def get_registration_uri(self):
+        # XXX assert is https!
+        # use urlparse
+        if self.port:
+            uri = "%s://%s:%s/%s" % (
+                self.schema,
+                self.provider,
+                self.port,
+                self.register_path)
+        else:
+            uri = "%s://%s/%s" % (
+                self.schema,
+                self.provider,
+                self.register_path)
+
+        return uri
+
+    def register_user(self, username, password, keep=False):
+        """
+        @rtype: tuple
+        @rparam: (ok, request)
+        """
+        salt, vkey = self.srp.create_salted_verification_key(
+            username,
+            password,
+            self.HASHFUN,
+            self.NG)
+
+        user_data = {
+            'user[login]': username,
+            'user[password_verifier]': binascii.hexlify(vkey),
+            'user[password_salt]': binascii.hexlify(salt)}
+
+        uri = self.get_registration_uri()
+        logger.debug('post to uri: %s' % uri)
+
+        # XXX get self.method
+        req = self.session.post(
+            uri, data=user_data,
+            timeout=SIGNUP_TIMEOUT)
+        logger.debug(req)
+        logger.debug('user_data: %s', user_data)
+        #logger.debug('response: %s', req.text)
+        # we catch it in the form
+        #req.raise_for_status()
+        return (req.ok, req)
-- 
cgit v1.2.3


From c45e6d34b1beb44d4eb7cecd6426f6c762249484 Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Fri, 19 Oct 2012 11:01:27 +0900
Subject: srp authentication class + useful decorator

---
 src/leap/base/auth.py | 158 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 158 insertions(+)

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
index c34ad39b..1f93c9c3 100644
--- a/src/leap/base/auth.py
+++ b/src/leap/base/auth.py
@@ -1,15 +1,22 @@
 import binascii
+import json
 import logging
+import urlparse
 
 import requests
 import srp
 
+from PyQt4 import QtCore
+
 from leap.base import constants as baseconstants
 
 logger = logging.getLogger(__name__)
 
 SIGNUP_TIMEOUT = getattr(baseconstants, 'SIGNUP_TIMEOUT', 5)
 
+# XXX remove me!!
+SERVER = "http://springbok/1"
+
 
 class LeapSRPRegister(object):
 
@@ -85,3 +92,154 @@ class LeapSRPRegister(object):
         # we catch it in the form
         #req.raise_for_status()
         return (req.ok, req)
+
+
+class SRPAuthenticationError(Exception):
+    """
+    exception raised
+    for authentication errors
+    """
+    pass
+
+safe_unhexlify = lambda x: binascii.unhexlify(x) \
+    if (len(x) % 2 == 0) else binascii.unhexlify('0' + x)
+
+
+class SRPAuth(requests.auth.AuthBase):
+
+    def __init__(self, username, password):
+        self.username = username
+        self.password = password
+
+        # XXX init something similar to
+        # SERVER...
+
+        self.init_data = None
+        self.session = requests.session()
+
+        self.init_srp()
+
+    def get_data(self, response):
+        return json.loads(response.content)
+
+    def init_srp(self):
+        usr = srp.User(
+            self.username,
+            self.password,
+            srp.SHA256,
+            srp.NG_1024)
+        uname, A = usr.start_authentication()
+
+        self.srp_usr = usr
+        self.A = A
+
+    def get_auth_data(self):
+        return {
+            'login': self.username,
+            'A': binascii.hexlify(self.A)
+        }
+
+    def get_init_data(self):
+        init_session = self.session.post(
+            SERVER + '/sessions',
+            data=self.get_auth_data())
+        self.init_data = self.get_data(init_session)
+        return self.init_data
+
+    def authenticate(self):
+        print 'start authentication...'
+
+        init_data = self.get_init_data()
+        salt = init_data.get('salt', None)
+        B = init_data.get('B', None)
+
+        if not salt or not B:
+            raise SRPAuthenticationError
+
+        self.M = self.srp_usr.process_challenge(
+            safe_unhexlify(salt),
+            safe_unhexlify(B)
+        )
+
+        auth_result = self.session.put(
+            SERVER + '/sessions/' + self.username,
+            data={'client_auth': binascii.hexlify(self.M)})
+
+        # XXX check for errors
+        auth_data = self.get_data(auth_result)
+        self.srp_usr.verify_session(
+            safe_unhexlify(auth_data["M2"]))
+
+        try:
+            assert self.srp_usr.authenticated()
+            print 'user is authenticated!'
+        except (AssertionError):
+            raise SRPAuthenticationError
+
+    def __call__(self, req):
+        self.authenticate()
+        req.session = self.session
+        return req
+
+
+def srpauth_protected(user=None, passwd=None):
+    """
+    decorator factory that accepts
+    user and password keyword arguments
+    and add those to the decorated request
+    """
+    def srpauth(fn, user=user, passwd=passwd):
+        def wrapper(*args, **kwargs):
+            print 'uri is ', args[0]
+            if user and passwd:
+                auth = SRPAuth(user, passwd)
+                kwargs['auth'] = auth
+            return fn(*args, **kwargs)
+        return wrapper
+    return srpauth
+
+
+def magic_srpauth(fn):
+    """
+    decorator that gets user and password
+    from the config file and adds those to
+    the decorated request
+    """
+    # TODO --- finish this...
+    def wrapper(*args, **kwargs):
+        uri = args[0]
+        # XXX Ugh!
+        # Problem with this approach.
+        # This won't work when we're using
+        # api.foo.bar
+        # Unless we keep a table with the
+        # equivalencies...
+
+        domain = urlparse.urlparse(uri).netloc
+
+        # XXX check this settings init...
+        settings = QtCore.QSettings()
+        user = settings.get('%s_username' % domain, None)
+
+        # uh... I forgot.
+        # get secret?
+        # leapkeyring.get_password(foo?)
+        passwd = settings.get('%s_password' % domain, None)
+
+        auth = SRPAuth(user, passwd)
+        kwargs['auth'] = auth
+        return fn(*args, **kwargs)
+    return wrapper
+
+
+if __name__ == "__main__":
+
+    TEST_USER = "test1"
+    TEST_PASS = "1234"
+
+    @srpauth_protected(user=TEST_USER, passwd=TEST_PASS)
+    def test_srp_protected_get(*args, **kwargs):
+        req = requests.get(*args, **kwargs)
+        print req.content
+
+    test_srp_protected_get('http://springbok/1/cert')
-- 
cgit v1.2.3


From a1acfd6417beeae312f056f76ac009b80c38654d Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Fri, 19 Oct 2012 23:20:35 +0900
Subject: added docs

---
 src/leap/base/auth.py | 13 +++++++++++++
 1 file changed, 13 insertions(+)

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
index 1f93c9c3..7d99a7fe 100644
--- a/src/leap/base/auth.py
+++ b/src/leap/base/auth.py
@@ -18,6 +18,18 @@ SIGNUP_TIMEOUT = getattr(baseconstants, 'SIGNUP_TIMEOUT', 5)
 SERVER = "http://springbok/1"
 
 
+"""
+Registration and authentication classes for the
+SRP auth mechanism used in the leap platform.
+
+We're currently using the (pure python?) srp library since
+it seemed the fastest way of getting something working.
+
+In the future we can switch to use python-gnutls, since
+libgnutls implements srp protocol.
+"""
+
+
 class LeapSRPRegister(object):
 
     def __init__(self,
@@ -206,6 +218,7 @@ def magic_srpauth(fn):
     the decorated request
     """
     # TODO --- finish this...
+    # currently broken.
     def wrapper(*args, **kwargs):
         uri = args[0]
         # XXX Ugh!
-- 
cgit v1.2.3


From 47a9a04145e30476c162a1d76d4d8b4b360de0bd Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Tue, 23 Oct 2012 00:34:39 +0900
Subject: allow to test auth from cli

---
 src/leap/base/auth.py | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
index 7d99a7fe..5a9ebe1d 100644
--- a/src/leap/base/auth.py
+++ b/src/leap/base/auth.py
@@ -246,13 +246,14 @@ def magic_srpauth(fn):
 
 
 if __name__ == "__main__":
+    import sys
+    user = sys.argv[1]
+    passwd = sys.argv[2]
 
-    TEST_USER = "test1"
-    TEST_PASS = "1234"
-
-    @srpauth_protected(user=TEST_USER, passwd=TEST_PASS)
+    @srpauth_protected(user=user, passwd=passwd)
     def test_srp_protected_get(*args, **kwargs):
         req = requests.get(*args, **kwargs)
-        print req.content
+        req.raise_for_status
+        #print req.content
 
     test_srp_protected_get('http://springbok/1/cert')
-- 
cgit v1.2.3


From a0fc20884a02ccffe1f9a83440b5e2212853289a Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Thu, 25 Oct 2012 07:12:34 +0900
Subject: login branch in wizard

---
 src/leap/base/auth.py | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
index 5a9ebe1d..cc9562d8 100644
--- a/src/leap/base/auth.py
+++ b/src/leap/base/auth.py
@@ -177,10 +177,16 @@ class SRPAuth(requests.auth.AuthBase):
             SERVER + '/sessions/' + self.username,
             data={'client_auth': binascii.hexlify(self.M)})
 
-        # XXX check for errors
         auth_data = self.get_data(auth_result)
+        M2 = auth_data.get("M2", None)
+        if not M2:
+            errors = auth_data.get('errors', None)
+            if errors:
+                logger.error(errors)
+            raise SRPAuthenticationError('Authentication Error')
+
         self.srp_usr.verify_session(
-            safe_unhexlify(auth_data["M2"]))
+            safe_unhexlify(M2))
 
         try:
             assert self.srp_usr.authenticated()
-- 
cgit v1.2.3


From 0590991d7777de473a7df21ed32e1fa7caa9cf4b Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Fri, 26 Oct 2012 00:12:08 +0900
Subject: user credentials saved on login/signup branches.

cert request is using magick decorator that retrieves the certificates
using srp.
---
 src/leap/base/auth.py | 37 ++++++++++++++++++-------------------
 1 file changed, 18 insertions(+), 19 deletions(-)

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
index cc9562d8..1665f48e 100644
--- a/src/leap/base/auth.py
+++ b/src/leap/base/auth.py
@@ -1,7 +1,7 @@
 import binascii
 import json
 import logging
-import urlparse
+#import urlparse
 
 import requests
 import srp
@@ -9,6 +9,7 @@ import srp
 from PyQt4 import QtCore
 
 from leap.base import constants as baseconstants
+from leap.crypto import leapkeyring
 
 logger = logging.getLogger(__name__)
 
@@ -159,7 +160,7 @@ class SRPAuth(requests.auth.AuthBase):
         return self.init_data
 
     def authenticate(self):
-        print 'start authentication...'
+        logger.debug('start authentication...')
 
         init_data = self.get_init_data()
         salt = init_data.get('salt', None)
@@ -190,7 +191,7 @@ class SRPAuth(requests.auth.AuthBase):
 
         try:
             assert self.srp_usr.authenticated()
-            print 'user is authenticated!'
+            logger.debug('user is authenticated!')
         except (AssertionError):
             raise SRPAuthenticationError
 
@@ -217,34 +218,32 @@ def srpauth_protected(user=None, passwd=None):
     return srpauth
 
 
-def magic_srpauth(fn):
+def get_leap_credentials():
+    settings = QtCore.QSettings()
+    full_username = settings.value('eip_username')
+    username, domain = full_username.split('@')
+    seed = settings.value('%s_seed' % domain, None)
+    password = leapkeyring.leap_get_password(full_username, seed=seed)
+    return (username, password)
+
+
+def magick_srpauth(fn):
     """
     decorator that gets user and password
     from the config file and adds those to
     the decorated request
     """
-    # TODO --- finish this...
-    # currently broken.
+    logger.debug('magick srp auth decorator called')
+
     def wrapper(*args, **kwargs):
-        uri = args[0]
+        #uri = args[0]
         # XXX Ugh!
         # Problem with this approach.
         # This won't work when we're using
         # api.foo.bar
         # Unless we keep a table with the
         # equivalencies...
-
-        domain = urlparse.urlparse(uri).netloc
-
-        # XXX check this settings init...
-        settings = QtCore.QSettings()
-        user = settings.get('%s_username' % domain, None)
-
-        # uh... I forgot.
-        # get secret?
-        # leapkeyring.get_password(foo?)
-        passwd = settings.get('%s_password' % domain, None)
-
+        user, passwd = get_leap_credentials()
         auth = SRPAuth(user, passwd)
         kwargs['auth'] = auth
         return fn(*args, **kwargs)
-- 
cgit v1.2.3


From 8a70d249df9782a370c00a37de9a7d3af568c0f5 Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Thu, 8 Nov 2012 08:32:57 +0900
Subject: more specific errors catched during srpauth

---
 src/leap/base/auth.py | 104 +++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 81 insertions(+), 23 deletions(-)

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
index 1665f48e..9ee159e7 100644
--- a/src/leap/base/auth.py
+++ b/src/leap/base/auth.py
@@ -16,7 +16,7 @@ logger = logging.getLogger(__name__)
 SIGNUP_TIMEOUT = getattr(baseconstants, 'SIGNUP_TIMEOUT', 5)
 
 # XXX remove me!!
-SERVER = "http://springbok/1"
+SERVER = "https://localhost:8443/1"
 
 
 """
@@ -120,9 +120,10 @@ safe_unhexlify = lambda x: binascii.unhexlify(x) \
 
 class SRPAuth(requests.auth.AuthBase):
 
-    def __init__(self, username, password):
+    def __init__(self, username, password, verify=None):
         self.username = username
         self.password = password
+        self.verify = verify
 
         # XXX init something similar to
         # SERVER...
@@ -132,7 +133,7 @@ class SRPAuth(requests.auth.AuthBase):
 
         self.init_srp()
 
-    def get_data(self, response):
+    def get_json_data(self, response):
         return json.loads(response.content)
 
     def init_srp(self):
@@ -153,12 +154,45 @@ class SRPAuth(requests.auth.AuthBase):
         }
 
     def get_init_data(self):
-        init_session = self.session.post(
-            SERVER + '/sessions',
-            data=self.get_auth_data())
-        self.init_data = self.get_data(init_session)
+        try:
+            init_session = self.session.post(
+                SERVER + '/sessions.json/',
+                data=self.get_auth_data(),
+                verify=self.verify)
+        except requests.exceptions.ConnectionError:
+            raise SRPAuthenticationError(
+                "No connection made (salt).")
+        if init_session.status_code not in (200, ):
+            raise SRPAuthenticationError(
+                "No valid response (salt).")
+
+        # XXX should  get auth_result.json instead
+        self.init_data = self.get_json_data(init_session)
         return self.init_data
 
+    def get_server_proof_data(self):
+        try:
+            auth_result = self.session.put(
+                SERVER + '/sessions.json/' + self.username,
+                data={'client_auth': binascii.hexlify(self.M)},
+                verify=self.verify)
+        except requests.exceptions.ConnectionError:
+            raise SRPAuthenticationError(
+                "No connection made (HAMK).")
+
+        if auth_result.status_code not in (200, ):
+            raise SRPAuthenticationError(
+                "No valid response (HAMK).")
+
+        # XXX should  get auth_result.json instead
+        try:
+            self.auth_data = self.get_json_data(auth_result)
+        except ValueError:
+            raise SRPAuthenticationError(
+                "No valid data sent (HAMK)")
+
+        return self.auth_data
+
     def authenticate(self):
         logger.debug('start authentication...')
 
@@ -166,34 +200,54 @@ class SRPAuth(requests.auth.AuthBase):
         salt = init_data.get('salt', None)
         B = init_data.get('B', None)
 
+        # XXX refactor this function
+        # move checks and un-hex
+        # to routines
+
         if not salt or not B:
-            raise SRPAuthenticationError
+            raise SRPAuthenticationError(
+                "Server did not send initial data.")
+
+        try:
+            unhex_salt = safe_unhexlify(salt)
+        except TypeError:
+            raise SRPAuthenticationError(
+                "Bad data from server (salt)")
+        try:
+            unhex_B = safe_unhexlify(B)
+        except TypeError:
+            raise SRPAuthenticationError(
+                "Bad data from server (B)")
 
         self.M = self.srp_usr.process_challenge(
-            safe_unhexlify(salt),
-            safe_unhexlify(B)
+            unhex_salt,
+            unhex_B
         )
 
-        auth_result = self.session.put(
-            SERVER + '/sessions/' + self.username,
-            data={'client_auth': binascii.hexlify(self.M)})
+        proof_data = self.get_server_proof_data()
 
-        auth_data = self.get_data(auth_result)
-        M2 = auth_data.get("M2", None)
-        if not M2:
-            errors = auth_data.get('errors', None)
+        HAMK = proof_data.get("M2", None)
+        if not HAMK:
+            errors = proof_data.get('errors', None)
             if errors:
                 logger.error(errors)
-            raise SRPAuthenticationError('Authentication Error')
+            raise SRPAuthenticationError("Server did not send HAMK.")
+
+        try:
+            unhex_HAMK = safe_unhexlify(HAMK)
+        except TypeError:
+            raise SRPAuthenticationError(
+                "Bad data from server (HAMK)")
 
         self.srp_usr.verify_session(
-            safe_unhexlify(M2))
+            unhex_HAMK)
 
         try:
             assert self.srp_usr.authenticated()
             logger.debug('user is authenticated!')
         except (AssertionError):
-            raise SRPAuthenticationError
+            raise SRPAuthenticationError(
+                "Auth verification failed.")
 
     def __call__(self, req):
         self.authenticate()
@@ -201,7 +255,7 @@ class SRPAuth(requests.auth.AuthBase):
         return req
 
 
-def srpauth_protected(user=None, passwd=None):
+def srpauth_protected(user=None, passwd=None, verify=True):
     """
     decorator factory that accepts
     user and password keyword arguments
@@ -211,7 +265,7 @@ def srpauth_protected(user=None, passwd=None):
         def wrapper(*args, **kwargs):
             print 'uri is ', args[0]
             if user and passwd:
-                auth = SRPAuth(user, passwd)
+                auth = SRPAuth(user, passwd, verify)
                 kwargs['auth'] = auth
             return fn(*args, **kwargs)
         return wrapper
@@ -227,6 +281,10 @@ def get_leap_credentials():
     return (username, password)
 
 
+# XXX TODO
+# Pass verify as single argument,
+# in srpauth_protected style
+
 def magick_srpauth(fn):
     """
     decorator that gets user and password
@@ -261,4 +319,4 @@ if __name__ == "__main__":
         req.raise_for_status
         #print req.content
 
-    test_srp_protected_get('http://springbok/1/cert')
+    test_srp_protected_get('http://localhost:8443/1/cert')
-- 
cgit v1.2.3


From 8118056a244ca74d16380ad26a70e3da40e7e401 Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Fri, 9 Nov 2012 11:21:40 +0900
Subject: connect page merged into regvalidation.

Flow nearly working with fake provider, except for authentication.
---
 src/leap/base/auth.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
index 9ee159e7..f1b618ba 100644
--- a/src/leap/base/auth.py
+++ b/src/leap/base/auth.py
@@ -37,6 +37,7 @@ class LeapSRPRegister(object):
                  schema="https",
                  provider=None,
                  port=None,
+                 verify=True,
                  register_path="1/users.json",
                  method="POST",
                  fetcher=requests,
@@ -47,6 +48,7 @@ class LeapSRPRegister(object):
         self.schema = schema
         self.provider = provider
         self.port = port
+        self.verify = verify
         self.register_path = register_path
         self.method = method
         self.fetcher = fetcher
@@ -98,7 +100,8 @@ class LeapSRPRegister(object):
         # XXX get self.method
         req = self.session.post(
             uri, data=user_data,
-            timeout=SIGNUP_TIMEOUT)
+            timeout=SIGNUP_TIMEOUT,
+            verify=self.verify)
         logger.debug(req)
         logger.debug('user_data: %s', user_data)
         #logger.debug('response: %s', req.text)
-- 
cgit v1.2.3


From 8fd77ba036cb78c81939bbfce312b12cdc90d881 Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Fri, 9 Nov 2012 18:13:32 +0900
Subject: working version of the fake provider.

wizard can now be completely tested against this.
---
 src/leap/base/auth.py | 126 +++++++++++++++++++++++++++++++++++---------------
 1 file changed, 88 insertions(+), 38 deletions(-)

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
index f1b618ba..58ae9d69 100644
--- a/src/leap/base/auth.py
+++ b/src/leap/base/auth.py
@@ -10,27 +10,46 @@ from PyQt4 import QtCore
 
 from leap.base import constants as baseconstants
 from leap.crypto import leapkeyring
+from leap.util.web import get_https_domain_and_port
 
 logger = logging.getLogger(__name__)
 
 SIGNUP_TIMEOUT = getattr(baseconstants, 'SIGNUP_TIMEOUT', 5)
 
-# XXX remove me!!
-SERVER = "https://localhost:8443/1"
-
-
 """
 Registration and authentication classes for the
 SRP auth mechanism used in the leap platform.
 
-We're currently using the (pure python?) srp library since
-it seemed the fastest way of getting something working.
-
-In the future we can switch to use python-gnutls, since
-libgnutls implements srp protocol.
+We're using the srp library which uses a c-based implementation
+of the protocol if the c extension is available, and a python-based
+one if not.
 """
 
 
+class ImproperlyConfigured(Exception):
+    """
+    """
+
+
+class SRPAuthenticationError(Exception):
+    """
+    exception raised
+    for authentication errors
+    """
+
+
+def null_check(value, value_name):
+    try:
+        assert value is not None
+    except AssertionError:
+        raise ImproperlyConfigured(
+            "%s parameter cannot be None" % value_name)
+
+
+safe_unhexlify = lambda x: binascii.unhexlify(x) \
+    if (len(x) % 2 == 0) else binascii.unhexlify('0' + x)
+
+
 class LeapSRPRegister(object):
 
     def __init__(self,
@@ -45,9 +64,19 @@ class LeapSRPRegister(object):
                  hashfun=srp.SHA256,
                  ng_constant=srp.NG_1024):
 
+        null_check(provider, provider)
+
         self.schema = schema
+
+        # XXX FIXME
         self.provider = provider
         self.port = port
+        # XXX splitting server,port
+        # deprecate port call.
+        domain, port = get_https_domain_and_port(provider)
+        self.provider = domain
+        self.port = port
+
         self.verify = verify
         self.register_path = register_path
         self.method = method
@@ -110,27 +139,16 @@ class LeapSRPRegister(object):
         return (req.ok, req)
 
 
-class SRPAuthenticationError(Exception):
-    """
-    exception raised
-    for authentication errors
-    """
-    pass
-
-safe_unhexlify = lambda x: binascii.unhexlify(x) \
-    if (len(x) % 2 == 0) else binascii.unhexlify('0' + x)
-
-
 class SRPAuth(requests.auth.AuthBase):
 
-    def __init__(self, username, password, verify=None):
+    def __init__(self, username, password, server=None, verify=None):
+        # sanity check
+        null_check(server, 'server')
         self.username = username
         self.password = password
+        self.server = server
         self.verify = verify
 
-        # XXX init something similar to
-        # SERVER...
-
         self.init_data = None
         self.session = requests.session()
 
@@ -159,7 +177,7 @@ class SRPAuth(requests.auth.AuthBase):
     def get_init_data(self):
         try:
             init_session = self.session.post(
-                SERVER + '/sessions.json/',
+                self.server + '/1/sessions.json/',
                 data=self.get_auth_data(),
                 verify=self.verify)
         except requests.exceptions.ConnectionError:
@@ -176,7 +194,7 @@ class SRPAuth(requests.auth.AuthBase):
     def get_server_proof_data(self):
         try:
             auth_result = self.session.put(
-                SERVER + '/sessions.json/' + self.username,
+                self.server + '/1/sessions.json/' + self.username,
                 data={'client_auth': binascii.hexlify(self.M)},
                 verify=self.verify)
         except requests.exceptions.ConnectionError:
@@ -258,18 +276,18 @@ class SRPAuth(requests.auth.AuthBase):
         return req
 
 
-def srpauth_protected(user=None, passwd=None, verify=True):
+def srpauth_protected(user=None, passwd=None, server=None, verify=True):
     """
     decorator factory that accepts
     user and password keyword arguments
     and add those to the decorated request
     """
-    def srpauth(fn, user=user, passwd=passwd):
+    def srpauth(fn):
         def wrapper(*args, **kwargs):
-            print 'uri is ', args[0]
             if user and passwd:
-                auth = SRPAuth(user, passwd, verify)
+                auth = SRPAuth(user, passwd, server, verify)
                 kwargs['auth'] = auth
+                kwargs['verify'] = verify
             return fn(*args, **kwargs)
         return wrapper
     return srpauth
@@ -305,6 +323,9 @@ def magick_srpauth(fn):
         # Unless we keep a table with the
         # equivalencies...
         user, passwd = get_leap_credentials()
+
+        # XXX pass verify and server too
+        # (pop)
         auth = SRPAuth(user, passwd)
         kwargs['auth'] = auth
         return fn(*args, **kwargs)
@@ -312,14 +333,43 @@ def magick_srpauth(fn):
 
 
 if __name__ == "__main__":
+    """
+    To test against test_provider (twisted version)
+    Register an user: (will be valid during the session)
+    >>> python auth.py add test password
+
+    Test login with that user:
+    >>> python auth.py login test password
+    """
+
     import sys
-    user = sys.argv[1]
-    passwd = sys.argv[2]
 
-    @srpauth_protected(user=user, passwd=passwd)
-    def test_srp_protected_get(*args, **kwargs):
-        req = requests.get(*args, **kwargs)
-        req.raise_for_status
-        #print req.content
+    if len(sys.argv) not in (4, 5):
+        print 'Usage: auth <add|login> <user> <pass> [server]'
+        sys.exit(0)
+
+    action = sys.argv[1]
+    user = sys.argv[2]
+    passwd = sys.argv[3]
+
+    if len(sys.argv) == 5:
+        SERVER = sys.argv[4]
+    else:
+        SERVER = "https://localhost:8443"
+
+    if action == "login":
+
+        @srpauth_protected(
+            user=user, passwd=passwd, server=SERVER, verify=False)
+        def test_srp_protected_get(*args, **kwargs):
+            req = requests.get(*args, **kwargs)
+            req.raise_for_status
+            return req
+
+        req = test_srp_protected_get('https://localhost:8443/1/cert')
+        print 'cert :', req.content[:200] + "..."
+        sys.exit(0)
 
-    test_srp_protected_get('http://localhost:8443/1/cert')
+    if action == "add":
+        auth = LeapSRPRegister(provider=SERVER, verify=False)
+        auth.register_user(user, passwd)
-- 
cgit v1.2.3


From 13c4bd9087e4caaf9e440efa210d5762b8aca875 Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Mon, 12 Nov 2012 11:49:11 +0900
Subject: fix uri for sessions PUT

---
 src/leap/base/auth.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
index 58ae9d69..50533278 100644
--- a/src/leap/base/auth.py
+++ b/src/leap/base/auth.py
@@ -194,7 +194,8 @@ class SRPAuth(requests.auth.AuthBase):
     def get_server_proof_data(self):
         try:
             auth_result = self.session.put(
-                self.server + '/1/sessions.json/' + self.username,
+                #self.server + '/1/sessions.json/' + self.username,
+                self.server + '/1/sessions/' + self.username,
                 data={'client_auth': binascii.hexlify(self.M)},
                 verify=self.verify)
         except requests.exceptions.ConnectionError:
-- 
cgit v1.2.3


From 53fa2c134ab2c96376276aa1c0ed74db0aaba218 Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Mon, 10 Dec 2012 23:20:09 +0900
Subject: get cipher config from eip-service

---
 src/leap/base/auth.py | 16 ++--------------
 1 file changed, 2 insertions(+), 14 deletions(-)

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
index 50533278..73856bb0 100644
--- a/src/leap/base/auth.py
+++ b/src/leap/base/auth.py
@@ -10,6 +10,7 @@ from PyQt4 import QtCore
 
 from leap.base import constants as baseconstants
 from leap.crypto import leapkeyring
+from leap.util.misc import null_check
 from leap.util.web import get_https_domain_and_port
 
 logger = logging.getLogger(__name__)
@@ -26,11 +27,6 @@ one if not.
 """
 
 
-class ImproperlyConfigured(Exception):
-    """
-    """
-
-
 class SRPAuthenticationError(Exception):
     """
     exception raised
@@ -38,14 +34,6 @@ class SRPAuthenticationError(Exception):
     """
 
 
-def null_check(value, value_name):
-    try:
-        assert value is not None
-    except AssertionError:
-        raise ImproperlyConfigured(
-            "%s parameter cannot be None" % value_name)
-
-
 safe_unhexlify = lambda x: binascii.unhexlify(x) \
     if (len(x) % 2 == 0) else binascii.unhexlify('0' + x)
 
@@ -64,7 +52,7 @@ class LeapSRPRegister(object):
                  hashfun=srp.SHA256,
                  ng_constant=srp.NG_1024):
 
-        null_check(provider, provider)
+        null_check(provider, "provider")
 
         self.schema = schema
 
-- 
cgit v1.2.3


From 4984f2c966d11f529a2a8b722814b748b6a524d2 Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Wed, 12 Dec 2012 09:16:53 +0900
Subject: changed some values in new style eipconfig

---
 src/leap/base/auth.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
index 73856bb0..56b7cf96 100644
--- a/src/leap/base/auth.py
+++ b/src/leap/base/auth.py
@@ -43,7 +43,7 @@ class LeapSRPRegister(object):
     def __init__(self,
                  schema="https",
                  provider=None,
-                 port=None,
+                 #port=None,
                  verify=True,
                  register_path="1/users.json",
                  method="POST",
@@ -57,8 +57,8 @@ class LeapSRPRegister(object):
         self.schema = schema
 
         # XXX FIXME
-        self.provider = provider
-        self.port = port
+        #self.provider = provider
+        #self.port = port
         # XXX splitting server,port
         # deprecate port call.
         domain, port = get_https_domain_and_port(provider)
-- 
cgit v1.2.3


From 914a07aaf8ef52b2eaf88f1bf01fb6f72adcac5a Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Sat, 15 Dec 2012 02:25:12 +0900
Subject: use gnutls to parse pemfiles

---
 src/leap/base/auth.py | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
index 56b7cf96..c6bd3518 100644
--- a/src/leap/base/auth.py
+++ b/src/leap/base/auth.py
@@ -255,6 +255,7 @@ class SRPAuth(requests.auth.AuthBase):
         try:
             assert self.srp_usr.authenticated()
             logger.debug('user is authenticated!')
+            print 'user is authenticated!'
         except (AssertionError):
             raise SRPAuthenticationError(
                 "Auth verification failed.")
@@ -355,8 +356,11 @@ if __name__ == "__main__":
             req.raise_for_status
             return req
 
-        req = test_srp_protected_get('https://localhost:8443/1/cert')
-        print 'cert :', req.content[:200] + "..."
+        #req = test_srp_protected_get('https://localhost:8443/1/cert')
+        req = test_srp_protected_get('%s/1/cert' % SERVER)
+        import ipdb;ipdb.set_trace()
+        #print 'cert :', req.content[:200] + "..."
+        print 'cert :', req.content
         sys.exit(0)
 
     if action == "add":
-- 
cgit v1.2.3


From 0c2275222cf77bf5975a25a75ab0e50ac752bc9e Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Mon, 17 Dec 2012 04:35:16 +0900
Subject: fix srp authentication cookies

---
 src/leap/base/auth.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
index c6bd3518..ec854cf0 100644
--- a/src/leap/base/auth.py
+++ b/src/leap/base/auth.py
@@ -262,7 +262,7 @@ class SRPAuth(requests.auth.AuthBase):
 
     def __call__(self, req):
         self.authenticate()
-        req.session = self.session
+        req.cookies = self.session.cookies
         return req
 
 
@@ -358,9 +358,8 @@ if __name__ == "__main__":
 
         #req = test_srp_protected_get('https://localhost:8443/1/cert')
         req = test_srp_protected_get('%s/1/cert' % SERVER)
-        import ipdb;ipdb.set_trace()
         #print 'cert :', req.content[:200] + "..."
-        print 'cert :', req.content
+        print req.content
         sys.exit(0)
 
     if action == "add":
-- 
cgit v1.2.3


From 34cdc516cbdef476d0329fff5d09d6eb0e85431f Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Tue, 18 Dec 2012 07:17:56 +0900
Subject: freeze requests requirement lower than 1.0

srp auth breaking with 1.0 api
---
 src/leap/base/auth.py | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
index ec854cf0..ecc24179 100644
--- a/src/leap/base/auth.py
+++ b/src/leap/base/auth.py
@@ -142,9 +142,6 @@ class SRPAuth(requests.auth.AuthBase):
 
         self.init_srp()
 
-    def get_json_data(self, response):
-        return json.loads(response.content)
-
     def init_srp(self):
         usr = srp.User(
             self.username,
@@ -175,8 +172,7 @@ class SRPAuth(requests.auth.AuthBase):
             raise SRPAuthenticationError(
                 "No valid response (salt).")
 
-        # XXX should  get auth_result.json instead
-        self.init_data = self.get_json_data(init_session)
+        self.init_data = init_session.json
         return self.init_data
 
     def get_server_proof_data(self):
@@ -194,13 +190,7 @@ class SRPAuth(requests.auth.AuthBase):
             raise SRPAuthenticationError(
                 "No valid response (HAMK).")
 
-        # XXX should  get auth_result.json instead
-        try:
-            self.auth_data = self.get_json_data(auth_result)
-        except ValueError:
-            raise SRPAuthenticationError(
-                "No valid data sent (HAMK)")
-
+        self.auth_data = auth_result.json
         return self.auth_data
 
     def authenticate(self):
-- 
cgit v1.2.3


From f82f81b6766905269d51e08632b42ed2e92c249b Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Wed, 9 Jan 2013 00:00:42 +0900
Subject: rename username var

---
 src/leap/base/auth.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
index ecc24179..563a0b2a 100644
--- a/src/leap/base/auth.py
+++ b/src/leap/base/auth.py
@@ -275,7 +275,7 @@ def srpauth_protected(user=None, passwd=None, server=None, verify=True):
 
 def get_leap_credentials():
     settings = QtCore.QSettings()
-    full_username = settings.value('eip_username')
+    full_username = settings.value('username')
     username, domain = full_username.split('@')
     seed = settings.value('%s_seed' % domain, None)
     password = leapkeyring.leap_get_password(full_username, seed=seed)
-- 
cgit v1.2.3


From 6d85c97ddcc8a151b157919e9a7322fba151a551 Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Fri, 11 Jan 2013 03:00:41 +0900
Subject: all calls except the first one are made to api uri

we also parse the port number
---
 src/leap/base/auth.py | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
index 563a0b2a..f629972f 100644
--- a/src/leap/base/auth.py
+++ b/src/leap/base/auth.py
@@ -43,7 +43,6 @@ class LeapSRPRegister(object):
     def __init__(self,
                  schema="https",
                  provider=None,
-                 #port=None,
                  verify=True,
                  register_path="1/users.json",
                  method="POST",
@@ -56,11 +55,6 @@ class LeapSRPRegister(object):
 
         self.schema = schema
 
-        # XXX FIXME
-        #self.provider = provider
-        #self.port = port
-        # XXX splitting server,port
-        # deprecate port call.
         domain, port = get_https_domain_and_port(provider)
         self.provider = domain
         self.port = port
@@ -137,6 +131,9 @@ class SRPAuth(requests.auth.AuthBase):
         self.server = server
         self.verify = verify
 
+        logger.debug('SRPAuth. verify=%s' % verify)
+        logger.debug('server: %s. username=%s' % (server, username))
+
         self.init_data = None
         self.session = requests.session()
 
@@ -168,6 +165,9 @@ class SRPAuth(requests.auth.AuthBase):
         except requests.exceptions.ConnectionError:
             raise SRPAuthenticationError(
                 "No connection made (salt).")
+        except:
+            raise SRPAuthenticationError(
+                "Unknown error (salt).")
         if init_session.status_code not in (200, ):
             raise SRPAuthenticationError(
                 "No valid response (salt).")
@@ -245,7 +245,6 @@ class SRPAuth(requests.auth.AuthBase):
         try:
             assert self.srp_usr.authenticated()
             logger.debug('user is authenticated!')
-            print 'user is authenticated!'
         except (AssertionError):
             raise SRPAuthenticationError(
                 "Auth verification failed.")
@@ -268,6 +267,8 @@ def srpauth_protected(user=None, passwd=None, server=None, verify=True):
                 auth = SRPAuth(user, passwd, server, verify)
                 kwargs['auth'] = auth
                 kwargs['verify'] = verify
+            if not args:
+                logger.warning('attempting to get from empty uri!')
             return fn(*args, **kwargs)
         return wrapper
     return srpauth
-- 
cgit v1.2.3


From 407b030bb7d27b797fb27254710a358c9c69f8be Mon Sep 17 00:00:00 2001
From: kali <kali@leap.se>
Date: Thu, 24 Jan 2013 01:57:28 +0900
Subject: catch missing messages on last page of wizard

---
 src/leap/base/auth.py | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

(limited to 'src/leap/base/auth.py')

diff --git a/src/leap/base/auth.py b/src/leap/base/auth.py
index f629972f..c2d3f424 100644
--- a/src/leap/base/auth.py
+++ b/src/leap/base/auth.py
@@ -44,7 +44,7 @@ class LeapSRPRegister(object):
                  schema="https",
                  provider=None,
                  verify=True,
-                 register_path="1/users.json",
+                 register_path="1/users",
                  method="POST",
                  fetcher=requests,
                  srp=srp,
@@ -113,9 +113,6 @@ class LeapSRPRegister(object):
             uri, data=user_data,
             timeout=SIGNUP_TIMEOUT,
             verify=self.verify)
-        logger.debug(req)
-        logger.debug('user_data: %s', user_data)
-        #logger.debug('response: %s', req.text)
         # we catch it in the form
         #req.raise_for_status()
         return (req.ok, req)
@@ -159,7 +156,7 @@ class SRPAuth(requests.auth.AuthBase):
     def get_init_data(self):
         try:
             init_session = self.session.post(
-                self.server + '/1/sessions.json/',
+                self.server + '/1/sessions/',
                 data=self.get_auth_data(),
                 verify=self.verify)
         except requests.exceptions.ConnectionError:
-- 
cgit v1.2.3