replace plaintext secret transmission with time-limited hmac-based bearer tokens

[hippotat.git] / hippotat

diff --git a/hippotat b/hippotat
index 2f88d5eeac3ba16d767fdcb9bb8797eef3e9fa43..a6ec7aec06405b8315d1120d50e70be83776eeb2 100755 (executable)
--- a/hippotat
+++ b/hippotat
@@ -1,5 +1,27 @@
 #!/usr/bin/python3
-
+#
+# Hippotat - Asinine IP Over HTTP program
+# ./hippotat - client main program
+#
+# Copyright 2017 Ian Jackson
+#
+# GPLv3+
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU General Public License as published by
+#    the Free Software Foundation, either version 3 of the License, or
+#    (at your option) any later version.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program, in the file GPLv3.  If not,
+#    see <http://www.gnu.org/licenses/>.
+
+#@ import sys; sys.path.append('@PYBUILD_INSTALL_DIR@')
 from hippotatlib import *
 
 import twisted.web
@@ -130,7 +152,8 @@ class Client():
       cl.log(DBG.HTTP_CTRL, 'req_err ' + str(err), idof=req)
       if isinstance(err, twisted.python.failure.Failure):
         err = err.getTraceback()
-      print('[%#x] %s' % (id(req), err), file=sys.stderr)
+      print('%s[%#x] %s' % (cl.desc, id(req), err.strip('\n').replace('\n',' / ')),
+            file=sys.stderr)
       if not isinstance(cl.outstanding[req], int):
         raise RuntimeError('[%#x] previously %s' %
                            (id(req), cl.outstanding[req]))
@@ -162,13 +185,15 @@ class Client():
 
       d = mime_translate(d)
 
+      token = authtoken_make(cl.c.secret)
+
       crlf = b'\r\n'
       lf   =   b'\n'
       mime = (b'--b'                                        + crlf +
               b'Content-Type: text/plain; charset="utf-8"'  + crlf +
               b'Content-Disposition: form-data; name="m"'   + crlf + crlf +
               str(cl.c.client)            .encode('ascii')  + crlf +
-              cl.c.password                                 + crlf +
+              token                                         + crlf +
               str(cl.c.target_requests_outstanding)
                                           .encode('ascii')  + crlf +
               str(cl.c.http_timeout)      .encode('ascii')  + crlf +
@@ -211,7 +236,7 @@ class Client():
 
 clients = [ ]
 
-def process_cfg(putative_servers, putative_clients):
+def process_cfg(_opts, putative_servers, putative_clients):
   global clients
 
   for ss in putative_servers.values():
@@ -221,6 +246,8 @@ def process_cfg(putative_servers, putative_clients):
       sections = cfg_process_client_common(c,ss,cs,ci)
       if not sections: continue
 
+      log_debug_config('processing client [%s %s]' % (ss, cs))
+
       def srch(getter,key): return cfg_search(getter,key,sections)
 
       c.http_timeout   += srch(cfg.getint, 'http_timeout_grace')
@@ -230,6 +257,9 @@ def process_cfg(putative_servers, putative_clients):
       c.max_queue_time  = srch(cfg.getint, 'max_queue_time')
       c.vroutes         = srch(cfg.get,    'vroutes')
 
+      try: c.ifname     = srch(cfg_get_raw, 'ifname_client')
+      except NoOptionError: pass
+
       try: c.url = srch(cfg.get,'url')
       except NoOptionError:
         cfg_process_saddrs(c, ss)