# Mark Huang <mlhuang@cs.princeton.edu>
# Copyright (C) 2006 The Trustees of Princeton University
#
-# $Id: Auth.py,v 1.10 2007/01/04 16:01:28 mlhuang Exp $
-#
import crypt
-import sha
+from hashlib import sha1 as sha
import hmac
import time
+import os
from PLC.Faults import *
from PLC.Parameter import Parameter, Mixed
from PLC.Persons import Persons
from PLC.Nodes import Node, Nodes
+from PLC.Interfaces import Interface, Interfaces
from PLC.Sessions import Session, Sessions
from PLC.Peers import Peer, Peers
+from PLC.Keys import Keys
+from PLC.Boot import notify_owners
+from PLC.Logger import logger
class Auth(Parameter):
"""
Base class for all API authentication methods, as well as a class
- that can be used to represent Mixed(SessionAuth(), PasswordAuth(),
- GPGAuth()), i.e. the three principal API authentication methods.
+ that can be used to represent all supported API authentication
+ methods.
"""
- def __init__(self, auth = {}):
+ def __init__(self, auth=None):
+ if auth is None:
+ auth = {'AuthMethod': Parameter(str, "Authentication method to use",
+ optional=False)}
Parameter.__init__(self, auth, "API authentication structure")
def check(self, method, auth, *args):
- method.type_check("auth", auth,
- Mixed(SessionAuth(), PasswordAuth(), GPGAuth()),
- (auth,) + args)
+ global auth_methods
+
+ # Method.type_check() should have checked that all of the
+ # mandatory fields were present.
+ assert 'AuthMethod' in auth
+
+ if auth['AuthMethod'] in auth_methods:
+ expected = auth_methods[auth['AuthMethod']]()
+ else:
+ sm = "'" + "', '".join(list(auth_methods.keys())) + "'"
+ raise PLCInvalidArgument("must be " + sm, "AuthMethod")
+
+ # Re-check using the specified authentication method
+ method.type_check("auth", auth, expected, (auth,) + args)
+
class GPGAuth(Auth):
"""
def __init__(self):
Auth.__init__(self, {
- 'AuthMethod': Parameter(str, "Authentication method to use, always 'gpg'", optional = False),
- 'name': Parameter(str, "Peer or user name", optional = False),
- 'signature': Parameter(str, "Message signature", optional = False)
- })
+ 'AuthMethod': Parameter(str, "Authentication method to use, always 'gpg'", optional=False),
+ 'name': Parameter(str, "Peer or user name", optional=False),
+ 'signature': Parameter(str, "Message signature", optional=False)
+ })
def check(self, method, auth, *args):
try:
peers = Peers(method.api, [auth['name']])
if peers:
if 'peer' not in method.roles:
- raise PLCAuthenticationFailure, "Not allowed to call method"
+ raise PLCAuthenticationFailure(
+ "GPGAuth: Not allowed to call method, missing 'peer' role")
method.caller = peer = peers[0]
- keys = [peer['key']]
+ gpg_keys = [peer['key']]
else:
- persons = Persons(method.api, {'email': auth['name'], 'enabled': True, 'peer_id': None})
+ persons = Persons(
+ method.api, {'email': auth['name'], 'enabled': True, 'peer_id': None})
if not persons:
- raise PLCAuthenticationFailure, "No such user '%s'" % auth['name']
+ raise PLCAuthenticationFailure(
+ "GPGAuth: No such user '%s'" % auth['name'])
+ method.caller = person = persons[0]
if not set(person['roles']).intersection(method.roles):
- raise PLCAuthenticationFailure, "Not allowed to call method"
+ raise PLCAuthenticationFailure(
+ "GPGAuth: Not allowed to call method, missing role")
- method.caller = person = persons[0]
- keys = Keys(method.api, {'key_id': person['key_ids'], 'key_type': "gpg", 'peer_id': None})
+ keys = Keys(
+ method.api, {'key_id': person['key_ids'], 'key_type': "gpg", 'peer_id': None})
+ gpg_keys = [key['key'] for key in keys]
- if not keys:
- raise PLCAuthenticationFailure, "No GPG key on record for peer or user '%s'"
+ if not gpg_keys:
+ raise PLCAuthenticationFailure(
+ "GPGAuth: No GPG key on record for peer or user '%s'" % auth['name'])
- for key in keys:
+ for gpg_key in gpg_keys:
try:
from PLC.GPG import gpg_verify
- gpg_verify(method.name, args, auth['signature'], key)
+ gpg_verify(args, gpg_key, auth['signature'], method.name)
return
- except PLCAuthenticationFailure, fault:
+ except PLCAuthenticationFailure as fault:
pass
raise fault
- except PLCAuthenticationFailure, fault:
+ except PLCAuthenticationFailure as fault:
# XXX Send e-mail
raise fault
+
class SessionAuth(Auth):
"""
Secondary authentication method. After authenticating with a
def __init__(self):
Auth.__init__(self, {
- 'AuthMethod': Parameter(str, "Authentication method to use, always 'session'", optional = False),
- 'session': Parameter(str, "Session key", optional = False)
- })
+ 'AuthMethod': Parameter(str, "Authentication method to use, always 'session'", optional=False),
+ 'session': Parameter(str, "Session key", optional=False)
+ })
def check(self, method, auth, *args):
# Method.type_check() should have checked that all of the
# mandatory fields were present.
- assert auth.has_key('session')
+ assert 'session' in auth
# Get session record
- sessions = Sessions(method.api, [auth['session']], expires = None)
+ sessions = Sessions(method.api, [auth['session']], expires=None)
if not sessions:
- raise PLCAuthenticationFailure, "No such session"
+ raise PLCAuthenticationFailure("SessionAuth: No such session")
session = sessions[0]
try:
if session['node_id'] is not None:
- nodes = Nodes(method.api, {'node_id': session['node_id'], 'peer_id': None})
+ nodes = Nodes(
+ method.api, {'node_id': session['node_id'], 'peer_id': None})
if not nodes:
- raise PLCAuthenticationFailure, "No such node"
+ raise PLCAuthenticationFailure("SessionAuth: No such node")
node = nodes[0]
if 'node' not in method.roles:
- raise PLCAuthenticationFailure, "Not allowed to call method"
+ # using PermissionDenied rather than AuthenticationFailure here because
+ # if that fails we don't want to delete the session..
+ raise PLCPermissionDenied(
+ "SessionAuth: Not allowed to call method %s, missing 'node' role" % method.name)
method.caller = node
elif session['person_id'] is not None and session['expires'] > time.time():
- persons = Persons(method.api, {'person_id': session['person_id'], 'enabled': True, 'peer_id': None})
+ persons = Persons(method.api, {
+ 'person_id': session['person_id'], 'enabled': True, 'peer_id': None})
if not persons:
- raise PLCAuthenticationFailure, "No such account"
+ raise PLCAuthenticationFailure(
+ "SessionAuth: No such enabled account")
person = persons[0]
if not set(person['roles']).intersection(method.roles):
- raise PLCAuthenticationFailure, "Not allowed to call method"
+ method_message = "method %s has roles [%s]" % (
+ method.name, ','.join(method.roles))
+ person_message = "caller %s has roles [%s]" % (
+ person['email'], ','.join(person['roles']))
+ # not PLCAuthenticationFailure b/c that would end the session..
+ raise PLCPermissionDenied(
+ "SessionAuth: missing role, %s -- %s" % (method_message, person_message))
- method.caller = persons[0]
+ method.caller = person
else:
- raise PLCAuthenticationFailure, "Invalid session"
+ raise PLCAuthenticationFailure("SessionAuth: Invalid session")
- except PLCAuthenticationFailure, fault:
+ except PLCAuthenticationFailure as fault:
session.delete()
raise fault
+
class BootAuth(Auth):
"""
PlanetLab version 3.x node authentication structure. Used by the
Boot Manager to make authenticated calls to the API based on a
unique node key or boot nonce value.
-
- The original parameter serialization code did not define the byte
- encoding of strings, or the string encoding of all other types. We
- define the byte encoding to be UTF-8, and the string encoding of
- all other types to be however Python version 2.3 unicode() encodes
- them.
"""
def __init__(self):
Auth.__init__(self, {
- 'AuthMethod': Parameter(str, "Authentication method to use, always 'hmac'", optional = False),
- 'node_id': Parameter(int, "Node identifier", optional = False),
- 'value': Parameter(str, "HMAC of node key and method call", optional = False)
- })
+ 'AuthMethod': Parameter(str, "Authentication method to use, always 'hmac'", optional=False),
+ 'node_id': Parameter(int, "Node identifier", optional=False),
+ 'value': Parameter(str, "HMAC of node key and method call", optional=False)
+ })
def canonicalize(self, args):
values = []
# Yes, the comments in the old implementation are
# misleading. Keys of dicts are not included in the
# hash.
- values += self.canonicalize(arg.values())
+ values += self.canonicalize(list(arg.values()))
else:
# We use unicode() instead of str().
- values.append(unicode(arg))
+ values.append(str(arg))
return values
def check(self, method, auth, *args):
# Method.type_check() should have checked that all of the
# mandatory fields were present.
- assert auth.has_key('node_id')
+ assert 'node_id' in auth
+
+ if 'node' not in method.roles:
+ raise PLCAuthenticationFailure(
+ "BootAuth: Not allowed to call method, missing 'node' role")
try:
- nodes = Nodes(method.api, {'node_id': auth['node_id'], 'peer_id': None})
+ nodes = Nodes(
+ method.api, {'node_id': auth['node_id'], 'peer_id': None})
if not nodes:
- raise PLCAuthenticationFailure, "No such node"
+ raise PLCAuthenticationFailure("BootAuth: No such node")
node = nodes[0]
+ # Jan 2011 : removing support for old boot CDs
if node['key']:
key = node['key']
- elif node['boot_nonce']:
- # Allow very old nodes that do not have a node key in
- # their configuration files to use their "boot nonce"
- # instead. The boot nonce is a random value generated
- # by the node itself and POSTed by the Boot CD when it
- # requests the Boot Manager. This is obviously not
- # very secure, so we only allow it to be used if the
- # requestor IP is the same as the IP address we have
- # on record for the node.
- key = node['boot_nonce']
-
- nodenetwork = None
- if node['nodenetwork_ids']:
- nodenetworks = NodeNetworks(method.api, node['nodenetwork_ids'])
- for nodenetwork in nodenetworks:
- if nodenetwork['is_primary']:
- break
-
- if not nodenetwork or not nodenetwork['is_primary']:
- raise PLCAuthenticationFailure, "No primary network interface on record"
-
- if method.source is None:
- raise PLCAuthenticationFailure, "Cannot determine IP address of requestor"
-
- if nodenetwork['ip'] != method.source[0]:
- raise PLCAuthenticationFailure, "Requestor IP %s does not mach node IP %s" % \
- (method.source[0], nodenetwork['ip'])
else:
- raise PLCAuthenticationFailure, "No node key or boot nonce"
+ raise PLCAuthenticationFailure("BootAuth: No node key")
# Yes, this is the "canonicalization" method used.
args = self.canonicalize(args)
args.sort()
msg = "[" + "".join(args) + "]"
- # We encode in UTF-8 before calculating the HMAC, which is
- # an 8-bit algorithm.
- digest = hmac.new(key, msg.encode('utf-8'), sha).hexdigest()
+ digest = hmac.new(key.encode('utf-8'), msg.encode('utf-8'), sha).hexdigest()
if digest != auth['value']:
- raise PLCAuthenticationFailure, "Call could not be authenticated"
+ raise PLCAuthenticationFailure(
+ "BootAuth: Call could not be authenticated")
method.caller = node
- except PLCAuthenticationFailure, fault:
- # XXX Send e-mail
+ except PLCAuthenticationFailure as fault:
+ if nodes:
+ notify_owners(method, node, 'authfail',
+ include_pis=True, include_techs=True, fault=fault)
raise fault
+
class AnonymousAuth(Auth):
"""
PlanetLab version 3.x anonymous authentication structure.
def __init__(self):
Auth.__init__(self, {
'AuthMethod': Parameter(str, "Authentication method to use, always 'anonymous'", False),
- })
+ })
def check(self, method, auth, *args):
- # Sure, dude, whatever
- return True
+ if 'anonymous' not in method.roles:
+ raise PLCAuthenticationFailure(
+ "AnonymousAuth: method cannot be called anonymously")
+
+ method.caller = None
+
class PasswordAuth(Auth):
"""
def __init__(self):
Auth.__init__(self, {
- 'AuthMethod': Parameter(str, "Authentication method to use, typically 'password'", optional = False),
- 'Username': Parameter(str, "PlanetLab username, typically an e-mail address", optional = False),
- 'AuthString': Parameter(str, "Authentication string, typically a password", optional = False),
- })
+ 'AuthMethod': Parameter(str, "Authentication method to use, always 'password' or 'capability'", optional=False),
+ 'Username': Parameter(str, "PlanetLab username, typically an e-mail address", optional=False),
+ 'AuthString': Parameter(str, "Authentication string, typically a password", optional=False),
+ })
def check(self, method, auth, *args):
# Method.type_check() should have checked that all of the
# mandatory fields were present.
- assert auth.has_key('Username')
+ assert 'Username' in auth
# Get record (must be enabled)
- persons = Persons(method.api, {'email': auth['Username'], 'enabled': True, 'peer_id': None})
+ normalized = auth['Username'].lower()
+ persons = Persons(method.api, {
+ 'email': normalized, 'enabled': True, 'peer_id': None})
if len(persons) != 1:
- raise PLCAuthenticationFailure, "No such account"
+ logger.info(f"PasswordAuth failed with {normalized}, got {len(persons)} matches")
+ raise PLCAuthenticationFailure("PasswordAuth: No such account")
person = persons[0]
# only be used on particular machines (those in a list).
sources = method.api.config.PLC_API_MAINTENANCE_SOURCES.split()
if method.source is not None and method.source[0] not in sources:
- raise PLCAuthenticationFailure, "Not allowed to login to maintenance account"
+ raise PLCAuthenticationFailure(
+ "PasswordAuth: Not allowed to login to maintenance account")
# Not sure why this is not stored in the DB
password = method.api.config.PLC_API_MAINTENANCE_PASSWORD
if auth['AuthString'] != password:
- raise PLCAuthenticationFailure, "Maintenance account password verification failed"
+ raise PLCAuthenticationFailure(
+ "PasswordAuth: Maintenance account password verification failed")
else:
# Compare encrypted plaintext against encrypted password stored in the DB
- plaintext = auth['AuthString'].encode(method.api.encoding)
+ plaintext = auth['AuthString']
password = person['password']
# Protect against blank passwords in the DB
if password is None or password[:12] == "" or \
crypt.crypt(plaintext, password[:12]) != password:
- raise PLCAuthenticationFailure, "Password verification failed"
+ raise PLCAuthenticationFailure(
+ "PasswordAuth: Password verification failed")
if not set(person['roles']).intersection(method.roles):
- raise PLCAuthenticationFailure, "Not allowed to call method"
+ method_message = "method %s has roles [%s]" % (
+ method.name, ','.join(method.roles))
+ person_message = "caller %s has roles [%s]" % (
+ person['email'], ','.join(person['roles']))
+ raise PLCAuthenticationFailure(
+ "PasswordAuth: missing role, %s -- %s" % (method_message, person_message))
method.caller = person
+
+
+auth_methods = {'session': SessionAuth,
+ 'password': PasswordAuth,
+ 'capability': PasswordAuth,
+ 'gpg': GPGAuth,
+ 'hmac': BootAuth,
+ 'hmac_dummybox': BootAuth,
+ 'anonymous': AnonymousAuth}
+
+path = os.path.dirname(__file__) + "/Auth.d"
+try:
+ extensions = os.listdir(path)
+except OSError as e:
+ extensions = []
+for extension in extensions:
+ if extension.startswith("."):
+ continue
+ if not extension.endswith(".py"):
+ continue
+ exec(compile(open("%s/%s" % (path, extension)).read(),
+ "%s/%s" % (path, extension), 'exec'))
+del extensions
git://git.onelab.eu / plcapi.git / blobdiff