X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=PLC%2FAuth.py;h=3be444bb7a9c5b8298290437499981db0b57b06e;hb=refs%2Fheads%2Fremove-xmlrpc;hp=2b2ea02ab447831786550f3a172930e59dd1ba04;hpb=24d16d18acab3da7bccc3e09df4927e9cf2d3246;p=plcapi.git diff --git a/PLC/Auth.py b/PLC/Auth.py index 2b2ea02..3be444b 100644 --- a/PLC/Auth.py +++ b/PLC/Auth.py @@ -4,42 +4,241 @@ # Mark Huang # Copyright (C) 2006 The Trustees of Princeton University # -# $Id$ -# import crypt +try: + from hashlib import sha1 as sha +except ImportError: + import sha +import hmac +import time +import os from PLC.Faults import * from PLC.Parameter import Parameter, Mixed from PLC.Persons import Persons +from PLC.Nodes import Node, Nodes +from PLC.Interfaces import Interface, Interfaces +from PLC.Sessions import Session, Sessions +from PLC.Peers import Peer, Peers +from PLC.Keys import Keys +from PLC.Boot import notify_owners + +class Auth(Parameter): + """ + Base class for all API authentication methods, as well as a class + that can be used to represent all supported API authentication + methods. + """ + + def __init__(self, auth = None): + if auth is None: + auth = {'AuthMethod': Parameter(str, "Authentication method to use", optional = False)} + Parameter.__init__(self, auth, "API authentication structure") + + def check(self, method, auth, *args): + global auth_methods + + # Method.type_check() should have checked that all of the + # mandatory fields were present. + assert 'AuthMethod' in auth + + if auth['AuthMethod'] in auth_methods: + expected = auth_methods[auth['AuthMethod']]() + else: + sm = "'" + "', '".join(auth_methods.keys()) + "'" + raise PLCInvalidArgument("must be " + sm, "AuthMethod") -class Auth(Parameter, dict): + # Re-check using the specified authentication method + method.type_check("auth", auth, expected, (auth,) + args) + +class GPGAuth(Auth): """ - Base class for all API authentication methods. + Proposed PlanetLab federation authentication structure. """ - def __init__(self, auth): - Parameter.__init__(self, auth, "API authentication structure", False) - dict.__init__(auth) + def __init__(self): + Auth.__init__(self, { + 'AuthMethod': Parameter(str, "Authentication method to use, always 'gpg'", optional = False), + 'name': Parameter(str, "Peer or user name", optional = False), + 'signature': Parameter(str, "Message signature", optional = False) + }) + + def check(self, method, auth, *args): + try: + peers = Peers(method.api, [auth['name']]) + if peers: + if 'peer' not in method.roles: + raise PLCAuthenticationFailure, "GPGAuth: Not allowed to call method, missing 'peer' role" + + method.caller = peer = peers[0] + gpg_keys = [ peer['key'] ] + else: + persons = Persons(method.api, {'email': auth['name'], 'enabled': True, 'peer_id': None}) + if not persons: + raise PLCAuthenticationFailure, "GPGAuth: No such user '%s'" % auth['name'] + + method.caller = person = persons[0] + if not set(person['roles']).intersection(method.roles): + raise PLCAuthenticationFailure, "GPGAuth: Not allowed to call method, missing role" + + keys = Keys(method.api, {'key_id': person['key_ids'], 'key_type': "gpg", 'peer_id': None}) + gpg_keys = [ key['key'] for key in keys ] + + if not gpg_keys: + raise PLCAuthenticationFailure, "GPGAuth: No GPG key on record for peer or user '%s'"%auth['name'] + + for gpg_key in gpg_keys: + try: + from PLC.GPG import gpg_verify + gpg_verify(args, gpg_key, auth['signature'], method.name) + return + except PLCAuthenticationFailure, fault: + pass + + raise fault -class NodeAuth(Auth): + except PLCAuthenticationFailure, fault: + # XXX Send e-mail + raise fault + +class SessionAuth(Auth): + """ + Secondary authentication method. After authenticating with a + primary authentication method, call GetSession() to generate a + session key that may be used for subsequent calls. + """ + + def __init__(self): + Auth.__init__(self, { + 'AuthMethod': Parameter(str, "Authentication method to use, always 'session'", optional = False), + 'session': Parameter(str, "Session key", optional = False) + }) + + def check(self, method, auth, *args): + # Method.type_check() should have checked that all of the + # mandatory fields were present. + assert auth.has_key('session') + + # Get session record + sessions = Sessions(method.api, [auth['session']], expires = None) + if not sessions: + raise PLCAuthenticationFailure, "SessionAuth: No such session" + session = sessions[0] + + try: + if session['node_id'] is not None: + nodes = Nodes(method.api, {'node_id': session['node_id'], 'peer_id': None}) + if not nodes: + raise PLCAuthenticationFailure, "SessionAuth: No such node" + node = nodes[0] + + if 'node' not in method.roles: + # using PermissionDenied rather than AuthenticationFailure here because + # if that fails we don't want to delete the session.. + raise PLCPermissionDenied, "SessionAuth: Not allowed to call method %s, missing 'node' role"%method.name + + method.caller = node + + elif session['person_id'] is not None and session['expires'] > time.time(): + persons = Persons(method.api, {'person_id': session['person_id'], 'enabled': True, 'peer_id': None}) + if not persons: + raise PLCAuthenticationFailure, "SessionAuth: No such enabled account" + person = persons[0] + + if not set(person['roles']).intersection(method.roles): + method_message="method %s has roles [%s]"%(method.name,','.join(method.roles)) + person_message="caller %s has roles [%s]"%(person['email'],','.join(person['roles'])) + # not PLCAuthenticationFailure b/c that would end the session.. + raise PLCPermissionDenied, "SessionAuth: missing role, %s -- %s"%(method_message,person_message) + + method.caller = person + + else: + raise PLCAuthenticationFailure, "SessionAuth: Invalid session" + + except PLCAuthenticationFailure, fault: + session.delete() + raise fault + +class BootAuth(Auth): """ PlanetLab version 3.x node authentication structure. Used by the Boot Manager to make authenticated calls to the API based on a unique node key or boot nonce value. + + The original parameter serialization code did not define the byte + encoding of strings, or the string encoding of all other types. We + define the byte encoding to be UTF-8, and the string encoding of + all other types to be however Python version 2.3 unicode() encodes + them. """ def __init__(self): Auth.__init__(self, { - 'AuthMethod': Parameter(str, "Authentication method to use, always 'hmac'", False), - 'node_id': Parameter(str, "Node identifier", False), - 'node_ip': Parameter(str, "Node primary IP address", False), - 'value': Parameter(str, "HMAC of node key and method call", False) + 'AuthMethod': Parameter(str, "Authentication method to use, always 'hmac'", optional = False), + 'node_id': Parameter(int, "Node identifier", optional = False), + 'value': Parameter(str, "HMAC of node key and method call", optional = False) }) + def canonicalize(self, args): + values = [] + + for arg in args: + if isinstance(arg, list) or isinstance(arg, tuple): + # The old implementation did not recursively handle + # lists of lists. But neither did the old API itself. + values += self.canonicalize(arg) + elif isinstance(arg, dict): + # Yes, the comments in the old implementation are + # misleading. Keys of dicts are not included in the + # hash. + values += self.canonicalize(arg.values()) + else: + # We use unicode() instead of str(). + values.append(unicode(arg)) + + return values + def check(self, method, auth, *args): - # XXX Do HMAC checking - return True + # Method.type_check() should have checked that all of the + # mandatory fields were present. + assert auth.has_key('node_id') + + if 'node' not in method.roles: + raise PLCAuthenticationFailure, "BootAuth: Not allowed to call method, missing 'node' role" + + try: + nodes = Nodes(method.api, {'node_id': auth['node_id'], 'peer_id': None}) + if not nodes: + raise PLCAuthenticationFailure, "BootAuth: No such node" + node = nodes[0] + + # Jan 2011 : removing support for old boot CDs + if node['key']: + key = node['key'] + else: + raise PLCAuthenticationFailure, "BootAuth: No node key" + + # Yes, this is the "canonicalization" method used. + args = self.canonicalize(args) + args.sort() + msg = "[" + "".join(args) + "]" + + # We encode in UTF-8 before calculating the HMAC, which is + # an 8-bit algorithm. + # python 2.6 insists on receiving a 'str' as opposed to a 'unicode' + digest = hmac.new(str(key), msg.encode('utf-8'), sha).hexdigest() + + if digest != auth['value']: + raise PLCAuthenticationFailure, "BootAuth: Call could not be authenticated" + + method.caller = node + + except PLCAuthenticationFailure, fault: + if nodes: + notify_owners(method, node, 'authfail', include_pis = True, include_techs = True, fault = fault) + raise fault class AnonymousAuth(Auth): """ @@ -52,8 +251,10 @@ class AnonymousAuth(Auth): }) def check(self, method, auth, *args): - # Sure, dude, whatever - return True + if 'anonymous' not in method.roles: + raise PLCAuthenticationFailure, "AnonymousAuth: method cannot be called anonymously" + + method.caller = None class PasswordAuth(Auth): """ @@ -62,10 +263,9 @@ class PasswordAuth(Auth): def __init__(self): Auth.__init__(self, { - 'AuthMethod': Parameter(str, "Authentication method to use, typically 'password'", False), - 'Username': Parameter(str, "PlanetLab username, typically an e-mail address", False), - 'AuthString': Parameter(str, "Authentication string, typically a password", False), - 'Role': Parameter(str, "Role to use for this call", False) + 'AuthMethod': Parameter(str, "Authentication method to use, always 'password' or 'capability'", optional = False), + 'Username': Parameter(str, "PlanetLab username, typically an e-mail address", optional = False), + 'AuthString': Parameter(str, "Authentication string, typically a password", optional = False), }) def check(self, method, auth, *args): @@ -74,11 +274,11 @@ class PasswordAuth(Auth): assert auth.has_key('Username') # Get record (must be enabled) - persons = Persons(method.api, [auth['Username']], enabled = True) + persons = Persons(method.api, {'email': auth['Username'].lower(), 'enabled': True, 'peer_id': None}) if len(persons) != 1: - raise PLCAuthenticationFailure, "No such account" + raise PLCAuthenticationFailure, "PasswordAuth: No such account" - person = persons.values()[0] + person = persons[0] if auth['Username'] == method.api.config.PLC_API_MAINTENANCE_USER: # "Capability" authentication, whatever the hell that was @@ -87,26 +287,47 @@ class PasswordAuth(Auth): # only be used on particular machines (those in a list). sources = method.api.config.PLC_API_MAINTENANCE_SOURCES.split() if method.source is not None and method.source[0] not in sources: - raise PLCAuthenticationFailure, "Not allowed to login to maintenance account" + raise PLCAuthenticationFailure, "PasswordAuth: Not allowed to login to maintenance account" # Not sure why this is not stored in the DB password = method.api.config.PLC_API_MAINTENANCE_PASSWORD if auth['AuthString'] != password: - raise PLCAuthenticationFailure, "Maintenance account password verification failed" + raise PLCAuthenticationFailure, "PasswordAuth: Maintenance account password verification failed" else: - # Get encrypted password stored in the DB + # Compare encrypted plaintext against encrypted password stored in the DB + plaintext = auth['AuthString'].encode(method.api.encoding) password = person['password'] # Protect against blank passwords in the DB if password is None or password[:12] == "" or \ - crypt.crypt(auth['AuthString'], password[:12]) != password: - raise PLCAuthenticationFailure, "Password verification failed" + crypt.crypt(plaintext, password[:12]) != password: + raise PLCAuthenticationFailure, "PasswordAuth: Password verification failed" - if auth['Role'] not in person['roles']: - raise PLCAuthenticationFailure, "Account does not have " + auth['Role'] + " role" - - if method.roles and auth['Role'] not in method.roles: - raise PLCAuthenticationFailure, "Cannot call with " + auth['Role'] + "role" + if not set(person['roles']).intersection(method.roles): + method_message="method %s has roles [%s]"%(method.name,','.join(method.roles)) + person_message="caller %s has roles [%s]"%(person['email'],','.join(person['roles'])) + raise PLCAuthenticationFailure, "PasswordAuth: missing role, %s -- %s"%(method_message,person_message) method.caller = person + +auth_methods = {'session': SessionAuth, + 'password': PasswordAuth, + 'capability': PasswordAuth, + 'gpg': GPGAuth, + 'hmac': BootAuth, + 'hmac_dummybox': BootAuth, + 'anonymous': AnonymousAuth} + +path = os.path.dirname(__file__) + "/Auth.d" +try: + extensions = os.listdir(path) +except OSError, e: + extensions = [] +for extension in extensions: + if extension.startswith("."): + continue + if not extension.endswith(".py"): + continue + execfile("%s/%s" % (path, extension)) +del extensions