ó Xé?_c@sûdZdZdZddlZddlmZddlmZmZddl Z ddlm Z d„Z d Z d Z e e fZdZd „Zd„Zd„Zd„Zdd„Zd„Zdefd„ƒYZd de ed„Zed„ZdS(szAn implementation of the server-side of HTTP Digest Access Authentication, which is described in :rfc:`2617`. Example usage, using the built-in get_ha1_dict_plain function which uses a dict of plaintext passwords as the credentials store:: userpassdict = {'alice' : '4x5istwelve'} get_ha1 = cherrypy.lib.auth_digest.get_ha1_dict_plain(userpassdict) digest_auth = {'tools.auth_digest.on': True, 'tools.auth_digest.realm': 'wonderland', 'tools.auth_digest.get_ha1': get_ha1, 'tools.auth_digest.key': 'a565c27146791cfb', } app_config = { '/' : digest_auth } tvisteyas April 2009iÿÿÿÿN(tmd5(tparse_http_listtparse_keqv_list(tntobcCstt|ƒƒjƒS(N(RRt hexdigest(ts((s/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pytstauthsauth-inttMD5sMD5-sesscCstj|ddƒdS(NtcontextsTOOLS.AUTH_DIGEST(tcherrypytlog(tmsg((s/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pytTRACE(scs‡fd†}|S(sAReturns a get_ha1 function which obtains a plaintext password from a dictionary of the form: {username : password}. If you want a simple dictionary-based authentication scheme, with plaintext passwords, use get_ha1_dict_plain(my_userpass_dict) as the value for the get_ha1 argument to digest_auth(). cs0ˆj|ƒ}|r,td|||fƒSdS(Ns%s:%s:%s(tgettmd5_hextNone(trealmtusernametpassword(tuser_password_dict(s/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pytget_ha17s((RR((Rs/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pytget_ha1_dict_plain/scs‡fd†}|S(sYReturns a get_ha1 function which obtains a HA1 password hash from a dictionary of the form: {username : HA1}. If you want a dictionary-based authentication scheme, but with pre-computed HA1 hashes instead of plain-text passwords, use get_ha1_dict(my_userha1_dict) as the value for the get_ha1 argument to digest_auth(). cs ˆj|ƒS(N(R(RR(t user_ha1_dict(s/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pyRIs((RR((Rs/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pyt get_ha1_dict@s cs‡fd†}|S(smReturns a get_ha1 function which obtains a HA1 password hash from a flat file with lines of the same format as that produced by the Apache htdigest utility. For example, for realm 'wonderland', username 'alice', and password '4x5istwelve', the htdigest line would be:: alice:wonderland:3238cdfe91a8b2ed8e39646921a02d4c If you want to use an Apache htdigest file as the credentials store, then use get_ha1_file_htdigest(my_htdigest_file) as the value for the get_ha1 argument to digest_auth(). It is recommended that the filename argument be an absolute path, to avoid problems. cstd}tˆdƒ}xN|D]F}|jƒjdƒ\}}}||kr||kr|}PqqW|jƒ|S(Ntrt:(Rtopentrstriptsplittclose(RRtresulttftlinetuRtha1(tfilename(s/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pyR\s  ((R%R((R%s/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pytget_ha1_file_htdigestOs  cCsN|dkr!ttjƒƒ}ntd|||fƒ}d||f}|S(s†Synthesize a nonce value which resists spoofing and can be checked for staleness. Returns a string suitable as the value for 'nonce' in the www-authenticate header. s A string related to the resource, such as the hostname of the server. key A secret string known only to the server. timestamp An integer seconds-since-the-epoch timestamp s%s:%s:%ss%s:%sN(RtintttimeR(Rtkeyt timestampthtnonce((s/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pytsynthesize_noncejs  cCs t|ƒS(sThe hash function H(R(R((s/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pytH€stHttpDigestAuthorizationcBsYeZdZd„Zed„Zd„Zd„Zdd„Zdd„Z dd „Z RS( s_Class to parse a Digest Authorization header and perform re-calculation of the digest. cCsd|S(NsDigest Authorization header: %s((tselfR((s/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pyterrmsg‹sc CsR||_||_|jddƒ\}}|jƒ|_|jdkrWtdƒ‚n||_t|ƒ}t|ƒ}|j dƒ|_ |j dƒ|_ |j dƒ|_ |j dƒ|_ |j d ƒ|_|j d ƒ|_|j d d ƒjƒ|_|j d ƒ|_|j dƒ|_|j dƒ|_|j dƒ|_|jtkrut|jd|jƒƒ‚n|j oŸ|j oŸ|j oŸ|j oŸ|j}|sÀt|jdƒƒ‚n|jr$|jtkr÷t|jd|jƒƒ‚n|jo|jsNt|jdƒƒ‚qNn*|js6|jrNt|jdƒƒ‚ndS(Nt itdigests$Authorization scheme is not "Digest"RRR,turitmethodtresponset algorithmR tcnoncetopaquetqoptncs%Unsupported value for algorithm: '%s's(Not all required parameters are present.sUnsupported value for qop: '%s's1If qop is sent then cnonce and nc MUST be presents8If qop is not sent, neither cnonce nor nc can be present(t http_methodtdebugRtlowertschemet ValueErrort auth_headerRRRRRR,R4R5R6tupperR7R8R9R:R;tvalid_algorithmsR1t valid_qops( R0RAR<R=R?tparamstitemstparamsdthas_reqd((s/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pyt__init__ŽsT            cCs d|jS(Nsauthorization : %s(RA(R0((s/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pyt__str__ÇscCs…ym|jjddƒ\}}t|||ƒjddƒ\}}||k}|jrhtd|ƒn|SWntk r€nXtS(sÃValidate the nonce. Returns True if nonce was generated by synthesize_nonce() and the timestamp is not spoofed, else returns False. s A string related to the resource, such as the hostname of the server. key A secret string known only to the server. Both s and key must be the same values which were used to synthesize the nonce we are trying to validate. Risvalidate_nonce: %s(R,RR-R=RR@tFalse(R0RR)R*thashpartt s_timestampt s_hashparttis_valid((s/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pytvalidate_nonceÊs!   iXcCssyE|jjddƒ\}}t|ƒ|ttjƒƒkrDtSWntk rXnX|jrotdƒntS(s÷Returns True if a validated nonce is stale. The nonce contains a timestamp in plaintext and also a secure hash of the timestamp. You should first validate the nonce to ensure the plaintext timestamp is not spoofed. Risnonce is stale( R,RR'R(RKR@R=RtTrue(R0tmax_age_secondsR*RL((s/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pytis_nonce_staleås"   tcCs‡|jdks|jdkr7d|j|jf}nF|jdkrhd|j|jt|ƒf}nt|jdƒƒ‚t|ƒS(s:Returns the H(A2) string. See :rfc:`2617` section 3.2.2.3.Rs%s:%ssauth-ints%s:%s:%ssUnrecognized value for qop!N(R:RR<R4R.R@R1(R0t entity_bodyta2((s/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pytHA2õs "cCsž|j|ƒ}|jr@d|j|j|j|j|f}nd|j|f}|jdkr„td||j|jfƒ}ntd||fƒ}|S(sNCalculates the Request-Digest. See :rfc:`2617` section 3.2.2.1. ha1 The HA1 string obtained from the credentials store. entity_body If 'qop' is set to 'auth-int', then A2 includes a hash of the "entity body". The entity body is the part of the message which follows the HTTP headers. See :rfc:`2617` section 4.3. This refers to the entity the user agent sent in the request which has the Authorization header. Typically GET requests don't have an entity, and POST requests do. s%s:%s:%s:%s:%ss%s:%ssMD5-sesss%s:%s:%s(RWR:R,R;R8R7R.(R0R$RUtha2treqR3((s/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pytrequest_digests % "( t__name__t __module__t__doc__R1RKRIRJRPRSRWRZ(((s/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pyR/…s  9    cCs‰|tkrtd|ƒ‚n|tkr>td|ƒ‚n|dkr\t||ƒ}nd||||f}|r…|d7}n|S(s?Constructs a WWW-Authenticate header for Digest authentication.sUnsupported value for qop: '%s's%Unsupported value for algorithm: '%s's7Digest realm="%s", nonce="%s", algorithm="%s", qop="%s"s, stale="true"N(RDR@RCRR-(RR)R7R,R:tstaleR((s/local/mnt/workspace/CRMBuilds/Saipan.LA.2.0-00145-STD.PROD-1_20200821_083004/b/common/sectools/ext/cherrypy/lib/auth_digest.pytwww_authenticate1s    c Cs”tjj}|jjdƒ}t}|d k rCyt||jd|ƒ}Wn#t k rqtj ddƒ‚nX|r‹t t |ƒƒn|j ||ƒrC|||jƒ}|d k r@|j|d|jƒ} | |jkr=|rõt dƒn|jddƒ}|s:|j|_|r3t d |jƒnd Sq=q@qCnt||d |ƒ} |rkt | ƒn| tjjjd s,          ¬