Source code for keystone.receipt.receipt_formatters

# Copyright 2018 Catalyst Cloud Ltd
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.

import base64
import datetime
import struct
import uuid

from cryptography import fernet
import msgpack
from oslo_log import log
from oslo_utils import timeutils

from keystone.auth import plugins as auth_plugins
from keystone.common import fernet_utils as utils
from keystone.common import utils as ks_utils
import keystone.conf
from keystone import exception
from keystone.i18n import _


CONF = keystone.conf.CONF
LOG = log.getLogger(__name__)

# Fernet byte indexes as computed by pypi/keyless_fernet and defined in
# https://github.com/fernet/spec
TIMESTAMP_START = 1
TIMESTAMP_END = 9


[docs] class ReceiptFormatter(object): """Packs and unpacks payloads into receipts for transport.""" @property def crypto(self): """Return a cryptography instance. You can extend this class with a custom crypto @property to provide your own receipt encoding / decoding. For example, using a different cryptography library (e.g. ``python-keyczar``) or to meet arbitrary security requirements. This @property just needs to return an object that implements ``encrypt(plaintext)`` and ``decrypt(ciphertext)``. """ fernet_utils = utils.FernetUtils( CONF.fernet_receipts.key_repository, CONF.fernet_receipts.max_active_keys, 'fernet_receipts' ) keys = fernet_utils.load_keys() if not keys: raise exception.KeysNotFound() fernet_instances = [fernet.Fernet(key) for key in keys] return fernet.MultiFernet(fernet_instances)
[docs] def pack(self, payload): """Pack a payload for transport as a receipt. :type payload: bytes :rtype: str """ # base64 padding (if any) is not URL-safe return self.crypto.encrypt(payload).rstrip(b'=').decode('utf-8')
[docs] def unpack(self, receipt): """Unpack a receipt, and validate the payload. :type receipt: str :rtype: bytes """ receipt = ReceiptFormatter.restore_padding(receipt) try: return self.crypto.decrypt(receipt.encode('utf-8')) except fernet.InvalidToken: raise exception.ValidationError( _('This is not a recognized Fernet receipt %s') % receipt)
[docs] @classmethod def restore_padding(cls, receipt): """Restore padding based on receipt size. :param receipt: receipt to restore padding on :type receipt: str :returns: receipt with correct padding """ # Re-inflate the padding mod_returned = len(receipt) % 4 if mod_returned: missing_padding = 4 - mod_returned receipt += '=' * missing_padding return receipt
[docs] @classmethod def creation_time(cls, fernet_receipt): """Return the creation time of a valid Fernet receipt. :type fernet_receipt: str """ fernet_receipt = ReceiptFormatter.restore_padding(fernet_receipt) # fernet_receipt is str # Fernet receipts are base64 encoded, so we need to unpack them first # urlsafe_b64decode() requires bytes receipt_bytes = base64.urlsafe_b64decode( fernet_receipt.encode('utf-8')) # slice into the byte array to get just the timestamp timestamp_bytes = receipt_bytes[TIMESTAMP_START:TIMESTAMP_END] # convert those bytes to an integer # (it's a 64-bit "unsigned long long int" in C) timestamp_int = struct.unpack(">Q", timestamp_bytes)[0] # and with an integer, it's trivial to produce a datetime object issued_at = datetime.datetime.utcfromtimestamp(timestamp_int) return issued_at
[docs] def create_receipt(self, user_id, methods, expires_at): """Given a set of payload attributes, generate a Fernet receipt.""" payload = ReceiptPayload.assemble(user_id, methods, expires_at) serialized_payload = msgpack.packb(payload) receipt = self.pack(serialized_payload) # NOTE(lbragstad): We should warn against Fernet receipts that are over # 255 characters in length. This is mostly due to persisting the # receipts in a backend store of some kind that might have a limit of # 255 characters. Even though Keystone isn't storing a Fernet receipt # anywhere, we can't say it isn't being stored somewhere else with # those kind of backend constraints. if len(receipt) > 255: LOG.info('Fernet receipt created with length of %d ' 'characters, which exceeds 255 characters', len(receipt)) return receipt
[docs] def validate_receipt(self, receipt): """Validate a Fernet receipt and returns the payload attributes. :type receipt: str """ serialized_payload = self.unpack(receipt) payload = msgpack.unpackb(serialized_payload) (user_id, methods, expires_at) = ReceiptPayload.disassemble(payload) # rather than appearing in the payload, the creation time is encoded # into the receipt format itself issued_at = ReceiptFormatter.creation_time(receipt) issued_at = ks_utils.isotime(at=issued_at, subsecond=True) expires_at = timeutils.parse_isotime(expires_at) expires_at = ks_utils.isotime(at=expires_at, subsecond=True) return (user_id, methods, issued_at, expires_at)
[docs] class ReceiptPayload(object):
[docs] @classmethod def assemble(cls, user_id, methods, expires_at): """Assemble the payload of a receipt. :param user_id: identifier of the user in the receipt request :param methods: list of authentication methods used :param expires_at: datetime of the receipt's expiration :returns: the payload of a receipt """ b_user_id = cls.attempt_convert_uuid_hex_to_bytes(user_id) methods = auth_plugins.convert_method_list_to_integer(methods) expires_at_int = cls._convert_time_string_to_float(expires_at) return (b_user_id, methods, expires_at_int)
[docs] @classmethod def disassemble(cls, payload): """Disassemble a payload into the component data. The tuple consists of:: (user_id, methods, expires_at_str) * ``methods`` are the auth methods. :param payload: this variant of payload :returns: a tuple of the payloads component data """ (is_stored_as_bytes, user_id) = payload[0] if is_stored_as_bytes: user_id = cls.convert_uuid_bytes_to_hex(user_id) methods = auth_plugins.convert_integer_to_method_list(payload[1]) expires_at_str = cls._convert_float_to_time_string(payload[2]) return (user_id, methods, expires_at_str)
[docs] @classmethod def convert_uuid_hex_to_bytes(cls, uuid_string): """Compress UUID formatted strings to bytes. :param uuid_string: uuid string to compress to bytes :returns: a byte representation of the uuid """ uuid_obj = uuid.UUID(uuid_string) return uuid_obj.bytes
[docs] @classmethod def convert_uuid_bytes_to_hex(cls, uuid_byte_string): """Generate uuid.hex format based on byte string. :param uuid_byte_string: uuid string to generate from :returns: uuid hex formatted string """ uuid_obj = uuid.UUID(bytes=uuid_byte_string) return uuid_obj.hex
@classmethod def _convert_time_string_to_float(cls, time_string): """Convert a time formatted string to a float. :param time_string: time formatted string :returns: a timestamp as a float """ time_object = timeutils.parse_isotime(time_string) return (timeutils.normalize_time(time_object) - datetime.datetime.utcfromtimestamp(0)).total_seconds() @classmethod def _convert_float_to_time_string(cls, time_float): """Convert a floating point timestamp to a string. :param time_float: integer representing timestamp :returns: a time formatted strings """ time_object = datetime.datetime.utcfromtimestamp(time_float) return ks_utils.isotime(time_object, subsecond=True)
[docs] @classmethod def attempt_convert_uuid_hex_to_bytes(cls, value): """Attempt to convert value to bytes or return value. :param value: value to attempt to convert to bytes :returns: tuple containing boolean indicating whether user_id was stored as bytes and uuid value as bytes or the original value """ try: return (True, cls.convert_uuid_hex_to_bytes(value)) except ValueError: # this might not be a UUID, depending on the situation (i.e. # federation) return (False, value)
[docs] @classmethod def base64_encode(cls, s): """Encode a URL-safe string. :type s: str :rtype: str """ # urlsafe_b64encode() returns bytes so need to convert to # str, might as well do it before stripping. return base64.urlsafe_b64encode(s).decode('utf-8').rstrip('=')
[docs] @classmethod def random_urlsafe_str_to_bytes(cls, s): """Convert string from :func:`random_urlsafe_str()` to bytes. :type s: str :rtype: bytes """ # urlsafe_b64decode() requires str, unicode isn't accepted. s = str(s) # restore the padding (==) at the end of the string return base64.urlsafe_b64decode(s + '==')