Changeset fcdc60 in indico for indico/web/http_api/handlers.py

Timestamp:

08/23/11 15:38:51 (21 months ago)

Author:

Jose Benito <jose.benito.gonzalez@…>

Branches:

master, hello-world-walkthrough, ipv6, v0.98-series, v0.98.2, v0.98.3, v0.98b2, v0.99, 051b2622c51afb171a1dedb46a0df4fbb0cbd02e, 0da0c1403bae8e51d8229f460181c71b9e6dda72

Children:

92ad85

Parents:

315708

git-author:

Adrian Moennich <jerome.ernst.monnich@…> (05/12/11 14:59:04)

git-committer:

Jose Benito <jose.benito.gonzalez@…> (08/23/11 15:38:51)

Message:

[IMP] Make signature ttl configurable

File:

• indico/web/http_api/handlers.py (modified) (6 diffs)

indico/web/http_api/handlers.py

@@ -68 +68 @@
 
 
-def normalizeQuery(path, query, ts=None, remove=('timestamp', 'signature')):
+def normalizeQuery(path, query, remove=('signature',)):
     """Normalize request path and query so it can be used for caching and signing
 
@@ -78 +78 @@
         for key in remove:
             qdata.pop(key, None)
-    if ts is not None:
-        qdata['timestamp'] = ts
     sortedQuery = sorted(qdata.items(), key=lambda x: x[0].lower())
     if sortedQuery:
@@ -87 +85 @@
 
 
-def validateSignature(key, signature, path, query, timestamp=None):
-    if timestamp is None:
-        timestamp = int(time.time())
-    ts = timestamp / 300
-    candidates = []
-    for i in xrange(-1, 2):
-        h = hmac.new(key, normalizeQuery(path, query, ts + i), hashlib.sha1)
-        candidates.append(h.hexdigest())
-    if signature not in candidates:
-        raise HTTPAPIError('Signature invalid (check system clock)', apache.HTTP_FORBIDDEN)
-
-
-def getAK(apiKey, signature, path, query):
+def validateSignature(key, signature, timestamp, path, query):
+    ttl = HelperMaKaCInfo.getMaKaCInfoInstance().getAPISignatureTTL()
+    if not timestamp:
+        raise HTTPAPIError('Signature invalid (no timestamp)', apache.HTTP_FORBIDDEN)
+    elif abs(timestamp - int(time.time())) > ttl:
+        raise HTTPAPIError('Signature invalid (bad timestamp)', apache.HTTP_FORBIDDEN)
+    digest = hmac.new(key, normalizeQuery(path, query), hashlib.sha1).hexdigest()
+    if signature != digest:
+        raise HTTPAPIError('Signature invalid', apache.HTTP_FORBIDDEN)
+
+
+def checkAK(apiKey, signature, timestamp, path, query):
     minfo = HelperMaKaCInfo.getMaKaCInfoInstance()
     apiMode = minfo.getAPIMode()
@@ -115 +112 @@
     onlyPublic = False
     if signature:
-        validateSignature(ak.getSignKey(), signature, path, query)
+        validateSignature(ak.getSignKey(), signature, timestamp, path, query)
     elif apiMode in (API_MODE_SIGNED, API_MODE_ALL_SIGNED):
         raise HTTPAPIError('Signature missing', apache.HTTP_FORBIDDEN)
@@ -203 +200 @@
     apiKey = get_query_parameter(qdata, ['ak', 'apikey'], None)
     signature = get_query_parameter(qdata, ['signature'])
+    timestamp = get_query_parameter(qdata, ['timestamp'], 0, integer=True)
     no_cache = get_query_parameter(qdata, ['nc', 'nocache'], 'no') == 'yes'
     pretty = get_query_parameter(qdata, ['p', 'pretty'], 'no') == 'yes'
@@ -216 +214 @@
     try:
         # Validate the API key (and its signature)
-        ak, enforceOnlyPublic = getAK(apiKey, signature, path, query)
+        ak, enforceOnlyPublic = checkAK(apiKey, signature, timestamp, path, query)
         if enforceOnlyPublic:
             onlyPublic = True