X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~mdw/git/chopwood/blobdiff_plain/bb623e8fca6fd67635eac42e26c11abcc45e46a5..ea0eda5a7760ecd64663def89e55111e0d76ae3d:/httpauth.py?ds=sidebyside diff --git a/httpauth.py b/httpauth.py index e29686c..31e4ca1 100644 --- a/httpauth.py +++ b/httpauth.py @@ -28,6 +28,7 @@ from __future__ import with_statement import base64 as BN import hashlib as H import hmac as HM +import itertools as I import os as OS import cgi as CGI @@ -53,11 +54,11 @@ import util as U ### ### Once we've satisfied ourselves of the user's credentials, we issue a ### short-lived session token, stored in a cookie namde `chpwd-token'. This -### token has the form `DATE.NONCE.TAG.USER': here, DATE is the POSIX time of -### issue, as a decimal number; NONCE is a randomly chosen string, encoded in -### base64, USER is the user's login name, and TAG is a cryptographic MAC tag -### on the string `DATE.NONCE.USER'. (The USER name is on the end so that it -### can contain `.' characters without introducing parsing difficulties.) +### token has the form `DATE.TAG.USER': here, DATE is the POSIX time of +### issue, as a decimal number; USER is the user's login name; and TAG is a +### cryptographic MAC tag on the string `chpwd-token.DATE.USER'. (The USER +### name is on the end so that it can contain `.' characters without +### introducing parsing difficulties.) ### ### Secrets for these MAC tags are stored in the database: secrets expire ### after 30 minutes (invalidating all tokens issued with them); we only @@ -73,10 +74,13 @@ import util as U ### to forge, and the cookie will be supplied automatically by the user ### agent. Showing the user some information we were quite happy to release ### anyway isn't an interesting attack, but we must certainly require -### something stronger for state-change requests. Here, we also check that a -### special request parameter `%nonce' matches the token's NONCE field: forms -### setting up a `POST' action must include an appropriate hidden input -### element. +### something stronger for state-change requests. Here, we also check a +### special request parameter `%nonce': forms setting up a `POST' action must +### include an appropriate hidden input element. The `%nonce' parameter has +### the form `LEFT.RIGHT', where LEFT and RIGHT are two base-64 strings such +### that their XOR is the (deterministic) MAC tag on `chpwd-nonce.DATE.USER'. +### (The LEFT string is chosen at random, and the RIGHT string is set to the +### appropriate TAG XOR LEFT.) ### ### Messing about with cookies is a bit annoying, but it's hard to come up ### with alternatives. I'm trying to keep the URLs fairly pretty, and anyway @@ -100,7 +104,10 @@ CONF.DEFAULTS.update( SECRETLIFE = 30*60, ## Maximum age of an authentication key, in seconds. - SECRETFRESH = 5*60) + SECRETFRESH = 5*60, + + ## Hash function to use for crypto. + AUTHHASH = H.sha256) def cleansecrets(): """Remove dead secrets from the database.""" @@ -146,22 +153,39 @@ def freshsecret(): def hack_octets(s): """Return the octet string S, in a vaguely pretty form.""" - return BN.b64encode(s) \ - .rstrip('=') \ - .replace('/', '$') - -def auth_tag(sec, stamp, nonce, user): - """Compute a tag using secret SEC on `STAMP.NONCE.USER'.""" - hmac = HM.HMAC(sec, digestmod = H.sha256) - hmac.update('%d.%s.%s' % (stamp, nonce, user)) + return BN.b64encode(s, '+$').rstrip('=') + +def unhack_octets(s): + """Reverse the operation done by `hack_octets'.""" + pad = (len(s) + 3)&3 - len(s) + return BN.b64decode(s + '='*pad, '+$') + +def auth_tag(sec, stamp, user): + """Compute a tag using secret SEC on `STAMP.USER'.""" + hmac = HM.HMAC(sec, digestmod = CFG.AUTHHASH) + hmac.update('chpwd-token.%d.%s' % (stamp, user)) return hack_octets(hmac.digest()) +def csrf_tag(sec, stamp, user): + """Compute a tag using secret SEC on `STAMP.USER'.""" + hmac = HM.HMAC(sec, digestmod = CFG.AUTHHASH) + hmac.update('chpwd-nonce.%d.%s' % (stamp, user)) + return hmac.digest() + +def xor_strings(x, y): + """Return the bitwise XOR of two octet strings.""" + return ''.join(chr(ord(xc) ^ ord(yc)) for xc, yc in I.izip(x, y)) + +def mint_csrf_nonce(sec, ntag): + left = OS.urandom(len(ntag)) + right = xor_strings(left, ntag) + return '%s.%s' % (hack_octets(left), hack_octets(right)) + def mint_token(user): """Make and return a fresh token for USER.""" sec = freshsecret() - nonce = hack_octets(OS.urandom(16)) - tag = auth_tag(sec, U.NOW, nonce, user) - return '%d.%s.%s.%s' % (U.NOW, nonce, tag, user) + tag = auth_tag(sec, U.NOW, user) + return '%d.%s.%s' % (U.NOW, tag, user) ## Long messages for reasons why one might have been redirected back to the ## login page. @@ -175,6 +199,7 @@ LOGIN_REASONS = { 'EXPIRED': 'session timed out', 'BADTAG': 'incorrect tag', 'NOUSER': 'unknown user name', + 'LOGOUT': 'explicitly logged out', None: None } @@ -194,21 +219,20 @@ def check_auth(token, nonce = None): Check that the TOKEN is valid, comparing it against the NONCE if this is not `None'. - If the token is OK, then return the correct user name, and set `NONCE' set - to the appropriate portion of the token. Otherwise raise an - `AuthenticationFailed' exception with an appropriate `why'. + If the token is OK, then return the correct user name, and set `NONCE' to a + new nonce for the next request. Otherwise raise an `AuthenticationFailed' + exception with an appropriate `why'. """ global NONCE + ## If the token has been explicitly clobbered, then we're logged out. + if token == 'logged-out': raise AuthenticationFailed, 'LOGOUT' + ## Parse the token. bits = token.split('.', 3) - if len(bits) != 4: raise AuthenticationFailed, 'BADTOKEN' - stamp, NONCE, tag, user = bits - - ## Check that the nonce matches, if one was supplied. - if nonce is not None and nonce != NONCE: - raise AuthenticationFailed, 'BADNONCE' + if len(bits) != 3: raise AuthenticationFailed, 'BADTOKEN' + stamp, tag, user = bits ## Check the stamp, and find the right secret. if not stamp.isdigit(): raise AuthenticationFailed, 'BADTIME' @@ -217,9 +241,26 @@ def check_auth(token, nonce = None): if sec is None: raise AuthenticationFailed, 'EXPIRED' ## Check the tag. - t = auth_tag(sec, when, NONCE, user) + t = auth_tag(sec, when, user) if t != tag: raise AuthenticationFailed, 'BADTAG' + ## Determine the correct CSRF tag. + ntag = csrf_tag(sec, when, user) + + ## Check that the nonce matches, if one was supplied. + if nonce is not None: + bits = nonce.split('.', 2) + if len(bits) != 2: raise AuthenticationFailed, 'BADNONCE' + try: left, right = map(unhack_octets, bits) + except TypeError: raise AuthenticationFailed, 'BADNONCE' + if len(left) != len(right) or len(left) != len(ntag): + raise AuthenticationFailed, 'BADNONCE' + gtag = xor_strings(left, right) + if gtag != ntag: raise AuthenticationFailed, 'BADNONCE' + + ## Make a new nonce string for use in forms. + NONCE = mint_csrf_nonce(sec, ntag) + ## Make sure the user still exists. try: acct = S.SERVICES['master'].find(user) except S.UnknownUser: raise AuthenticationFailed, 'NOUSER' @@ -227,6 +268,16 @@ def check_auth(token, nonce = None): ## Done. return user +def bake_cookie(value): + """ + Return a properly baked authentication-token cookie with the given VALUE. + """ + return CGI.cookie('chpwd-token', value, + httponly = True, + secure = CGI.SSLP, + path = CFG.SCRIPT_NAME, + max_age = (CFG.SECRETLIFE - CFG.SECRETFRESH)) + ###-------------------------------------------------------------------------- ### Authentication commands. @@ -242,7 +293,7 @@ NONCE = '@DUMMY-NONCE' def cmd_login(why = None): CGI.page('login.fhtml', title = 'Chopwood: login', - why =LOGIN_REASONS.get(why, '' % why)) + why = LOGIN_REASONS.get(why, '' % why)) @CGI.subcommand( 'auth', ['cgi-noauth'], @@ -258,11 +309,6 @@ def cmd_auth(u, pw): else: t = mint_token(u) CGI.redirect(CGI.action('list', u), - set_cookie = CGI.cookie('chpwd-token', t, - httponly = True, - secure = CGI.SSLP, - path = CFG.SCRIPT_NAME, - max_age = (CFG.SECRETLIFE - - CFG.SECRETFRESH))) + set_cookie = bake_cookie(t)) ###----- That's all, folks --------------------------------------------------