2014-05-08 10:06:16 -05:00
|
|
|
# Authors: Nathaniel McCallum <npmccallum@redhat.com>
|
|
|
|
#
|
|
|
|
# Copyright (C) 2014 Red Hat
|
|
|
|
# see file 'COPYING' for use and warranty information
|
|
|
|
#
|
|
|
|
# This program is free software; you can redistribute it and/or modify
|
|
|
|
# it under the terms of the GNU General Public License as published by
|
|
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
|
|
# (at your option) any later version.
|
|
|
|
#
|
|
|
|
# This program is distributed in the hope that it will be useful,
|
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
#
|
|
|
|
# You should have received a copy of the GNU General Public License
|
|
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
#
|
|
|
|
|
2018-04-05 02:21:16 -05:00
|
|
|
from __future__ import absolute_import
|
|
|
|
|
2014-05-08 10:06:16 -05:00
|
|
|
import abc
|
|
|
|
import base64
|
|
|
|
import datetime
|
2017-05-23 11:35:57 -05:00
|
|
|
import logging
|
2014-05-08 10:06:16 -05:00
|
|
|
import os
|
|
|
|
import uuid
|
|
|
|
|
|
|
|
from lxml import etree
|
|
|
|
import dateutil.parser
|
|
|
|
import dateutil.tz
|
2015-07-20 09:04:07 -05:00
|
|
|
import gssapi
|
2015-08-26 06:29:18 -05:00
|
|
|
import six
|
2014-05-08 10:06:16 -05:00
|
|
|
|
2017-02-25 04:06:04 -06:00
|
|
|
from cryptography.exceptions import InvalidSignature
|
|
|
|
from cryptography.hazmat.primitives import hashes, hmac
|
|
|
|
from cryptography.hazmat.primitives.padding import PKCS7
|
2015-08-31 09:46:19 -05:00
|
|
|
from cryptography.hazmat.primitives.kdf import pbkdf2
|
|
|
|
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
|
|
|
|
from cryptography.hazmat.backends import default_backend
|
|
|
|
|
2016-12-02 02:10:41 -06:00
|
|
|
from ipaplatform.paths import paths
|
2014-05-08 10:06:16 -05:00
|
|
|
from ipapython import admintool
|
|
|
|
from ipalib import api, errors
|
2015-12-16 09:06:03 -06:00
|
|
|
from ipaserver.plugins.ldap2 import AUTOBIND_DISABLED
|
2014-05-08 10:06:16 -05:00
|
|
|
|
2015-09-11 06:43:28 -05:00
|
|
|
if six.PY3:
|
|
|
|
unicode = str
|
2015-10-08 08:39:14 -05:00
|
|
|
long = int
|
2015-09-11 06:43:28 -05:00
|
|
|
|
2017-05-23 11:35:57 -05:00
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
2014-05-08 10:06:16 -05:00
|
|
|
|
|
|
|
class ValidationError(Exception):
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
|
|
def fetchAll(element, xpath, conv=lambda x: x):
|
2015-08-12 05:25:30 -05:00
|
|
|
return [conv(e) for e in element.xpath(xpath, namespaces={
|
2017-06-20 09:31:15 -05:00
|
|
|
"pkcs5": "http://www.rsasecurity.com/rsalabs/pkcs/schemas/pkcs-5v2-0#",
|
2014-05-08 10:06:16 -05:00
|
|
|
"pskc": "urn:ietf:params:xml:ns:keyprov:pskc",
|
|
|
|
"xenc11": "http://www.w3.org/2009/xmlenc11#",
|
|
|
|
"xenc": "http://www.w3.org/2001/04/xmlenc#",
|
|
|
|
"ds": "http://www.w3.org/2000/09/xmldsig#",
|
2015-08-12 05:25:30 -05:00
|
|
|
})]
|
2014-05-08 10:06:16 -05:00
|
|
|
|
|
|
|
|
|
|
|
def fetch(element, xpath, conv=lambda x: x, default=None):
|
|
|
|
result = fetchAll(element, xpath, conv)
|
|
|
|
return result[0] if result else default
|
|
|
|
|
|
|
|
|
|
|
|
def convertDate(value):
|
|
|
|
"Converts an ISO 8601 string into a UTC datetime object."
|
|
|
|
|
|
|
|
dt = dateutil.parser.parse(value)
|
|
|
|
|
2015-03-27 06:14:27 -05:00
|
|
|
# pylint: disable=E1101
|
2014-05-08 10:06:16 -05:00
|
|
|
if dt.tzinfo is None:
|
|
|
|
dt = datetime.datetime(*dt.timetuple()[0:6],
|
|
|
|
tzinfo=dateutil.tz.tzlocal())
|
|
|
|
|
|
|
|
return dt.astimezone(dateutil.tz.tzutc())
|
|
|
|
|
|
|
|
|
|
|
|
def convertTokenType(value):
|
|
|
|
"Converts token algorithm URI to token type string."
|
|
|
|
|
|
|
|
return {
|
|
|
|
"urn:ietf:params:xml:ns:keyprov:pskc:hotp": u"hotp",
|
|
|
|
"urn:ietf:params:xml:ns:keyprov:pskc#hotp": u"hotp",
|
|
|
|
"urn:ietf:params:xml:ns:keyprov:pskc:totp": u"totp",
|
|
|
|
"urn:ietf:params:xml:ns:keyprov:pskc#totp": u"totp",
|
|
|
|
}.get(value.lower(), None)
|
|
|
|
|
|
|
|
|
|
|
|
def convertHashName(value):
|
|
|
|
"Converts hash names to their canonical names."
|
|
|
|
|
2017-09-14 09:31:57 -05:00
|
|
|
default_hash = u"sha1"
|
|
|
|
known_prefixes = ("", "hmac-",)
|
|
|
|
known_hashes = {
|
2014-05-08 10:06:16 -05:00
|
|
|
"sha1": u"sha1",
|
|
|
|
"sha224": u"sha224",
|
|
|
|
"sha256": u"sha256",
|
|
|
|
"sha384": u"sha384",
|
|
|
|
"sha512": u"sha512",
|
|
|
|
"sha-1": u"sha1",
|
|
|
|
"sha-224": u"sha224",
|
|
|
|
"sha-256": u"sha256",
|
|
|
|
"sha-384": u"sha384",
|
|
|
|
"sha-512": u"sha512",
|
2017-09-14 09:31:57 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
if value is None:
|
|
|
|
return default_hash
|
|
|
|
|
|
|
|
v = value.lower()
|
|
|
|
for prefix in known_prefixes:
|
|
|
|
if prefix:
|
|
|
|
w = v[len(prefix):]
|
|
|
|
else:
|
|
|
|
w = v
|
|
|
|
result = known_hashes.get(w)
|
|
|
|
if result is not None:
|
|
|
|
break
|
|
|
|
else:
|
|
|
|
result = default_hash
|
|
|
|
|
|
|
|
return result
|
2014-05-08 10:06:16 -05:00
|
|
|
|
|
|
|
|
|
|
|
def convertHMACType(value):
|
|
|
|
"Converts HMAC URI to hashlib object."
|
|
|
|
|
|
|
|
return {
|
2017-02-25 04:06:04 -06:00
|
|
|
"http://www.w3.org/2000/09/xmldsig#hmac-sha1": hashes.SHA1,
|
|
|
|
"http://www.w3.org/2001/04/xmldsig-more#hmac-sha224": hashes.SHA224,
|
|
|
|
"http://www.w3.org/2001/04/xmldsig-more#hmac-sha256": hashes.SHA256,
|
|
|
|
"http://www.w3.org/2001/04/xmldsig-more#hmac-sha384": hashes.SHA384,
|
|
|
|
"http://www.w3.org/2001/04/xmldsig-more#hmac-sha512": hashes.SHA512,
|
|
|
|
}.get(value.lower(), hashes.SHA1)
|
2014-05-08 10:06:16 -05:00
|
|
|
|
|
|
|
|
|
|
|
def convertAlgorithm(value):
|
|
|
|
"Converts encryption URI to (mech, ivlen)."
|
|
|
|
|
|
|
|
return {
|
2017-02-25 04:06:04 -06:00
|
|
|
"http://www.w3.org/2001/04/xmlenc#aes128-cbc": (
|
|
|
|
algorithms.AES, modes.CBC, 128),
|
|
|
|
"http://www.w3.org/2001/04/xmlenc#aes192-cbc": (
|
|
|
|
algorithms.AES, modes.CBC, 192),
|
|
|
|
"http://www.w3.org/2001/04/xmlenc#aes256-cbc": (
|
|
|
|
algorithms.AES, modes.CBC, 256),
|
|
|
|
"http://www.w3.org/2001/04/xmlenc#tripledes-cbc": (
|
|
|
|
algorithms.TripleDES, modes.CBC, 64),
|
|
|
|
"http://www.w3.org/2001/04/xmldsig-more#camellia128": (
|
|
|
|
algorithms.Camellia, modes.CBC, 128),
|
|
|
|
"http://www.w3.org/2001/04/xmldsig-more#camellia192": (
|
|
|
|
algorithms.Camellia, modes.CBC, 192),
|
|
|
|
"http://www.w3.org/2001/04/xmldsig-more#camellia256": (
|
|
|
|
algorithms.Camellia, modes.CBC, 256),
|
2014-05-08 10:06:16 -05:00
|
|
|
|
|
|
|
# TODO: add support for these formats.
|
|
|
|
# "http://www.w3.org/2001/04/xmlenc#kw-aes128": "kw-aes128",
|
|
|
|
# "http://www.w3.org/2001/04/xmlenc#kw-aes192": "kw-aes192",
|
|
|
|
# "http://www.w3.org/2001/04/xmlenc#kw-aes256": "kw-aes256",
|
|
|
|
# "http://www.w3.org/2001/04/xmlenc#kw-tripledes": "kw-tripledes",
|
|
|
|
# "http://www.w3.org/2001/04/xmldsig-more#kw-camellia128": "kw-camellia128",
|
|
|
|
# "http://www.w3.org/2001/04/xmldsig-more#kw-camellia192": "kw-camellia192",
|
|
|
|
# "http://www.w3.org/2001/04/xmldsig-more#kw-camellia256": "kw-camellia256",
|
2015-08-31 09:46:19 -05:00
|
|
|
}.get(value.lower(), (None, None, None))
|
2014-05-08 10:06:16 -05:00
|
|
|
|
|
|
|
|
|
|
|
def convertEncrypted(value, decryptor=None, pconv=base64.b64decode, econv=lambda x: x):
|
|
|
|
"Converts a value element, decrypting if necessary. See RFC 6030."
|
|
|
|
|
|
|
|
v = fetch(value, "./pskc:PlainValue/text()", pconv)
|
|
|
|
if v is not None:
|
|
|
|
return v
|
|
|
|
|
|
|
|
mac = fetch(value, "./pskc:ValueMAC/text()", base64.b64decode)
|
|
|
|
ev = fetch(value, "./pskc:EncryptedValue")
|
|
|
|
if ev is not None and decryptor is not None:
|
|
|
|
return econv(decryptor(ev, mac))
|
|
|
|
|
|
|
|
return None
|
|
|
|
|
|
|
|
|
2015-08-26 06:29:18 -05:00
|
|
|
class XMLKeyDerivation(six.with_metaclass(abc.ABCMeta, object)):
|
2014-05-08 10:06:16 -05:00
|
|
|
"Interface for XML Encryption 1.1 key derivation."
|
|
|
|
@abc.abstractmethod
|
|
|
|
def __init__(self, enckey):
|
|
|
|
"Sets up key derivation parameters from the parent XML entity."
|
|
|
|
|
|
|
|
@abc.abstractmethod
|
|
|
|
def derive(self, masterkey):
|
|
|
|
"Derives a key from the master key."
|
|
|
|
|
|
|
|
|
|
|
|
class PBKDF2KeyDerivation(XMLKeyDerivation):
|
|
|
|
def __init__(self, enckey):
|
2017-06-20 09:31:15 -05:00
|
|
|
params = fetch(enckey, "./xenc11:DerivedKey/xenc11:KeyDerivationMethod/pkcs5:PBKDF2-params")
|
2014-05-08 10:06:16 -05:00
|
|
|
if params is None:
|
|
|
|
raise ValueError("XML file is missing PBKDF2 parameters!")
|
|
|
|
|
2017-06-20 09:31:15 -05:00
|
|
|
salt = fetch(params, "./Salt/Specified/text()", base64.b64decode)
|
|
|
|
itrs = fetch(params, "./IterationCount/text()", int)
|
|
|
|
klen = fetch(params, "./KeyLength/text()", int)
|
|
|
|
hmod = fetch(params, "./PRF/@Algorithm", convertHMACType, hashes.SHA1)
|
2014-05-08 10:06:16 -05:00
|
|
|
|
2015-08-31 09:46:19 -05:00
|
|
|
if salt is None:
|
2014-05-08 10:06:16 -05:00
|
|
|
raise ValueError("XML file is missing PBKDF2 salt!")
|
|
|
|
|
2015-08-31 09:46:19 -05:00
|
|
|
if itrs is None:
|
2014-05-08 10:06:16 -05:00
|
|
|
raise ValueError("XML file is missing PBKDF2 iteration count!")
|
|
|
|
|
2015-08-31 09:46:19 -05:00
|
|
|
if klen is None:
|
2014-05-08 10:06:16 -05:00
|
|
|
raise ValueError("XML file is missing PBKDF2 key length!")
|
|
|
|
|
2015-08-31 09:46:19 -05:00
|
|
|
self.kdf = pbkdf2.PBKDF2HMAC(
|
2017-02-25 04:06:04 -06:00
|
|
|
algorithm=hmod(),
|
2015-08-31 09:46:19 -05:00
|
|
|
length=klen,
|
|
|
|
salt=salt,
|
2017-02-25 04:06:04 -06:00
|
|
|
iterations=itrs,
|
|
|
|
backend=default_backend()
|
2015-08-31 09:46:19 -05:00
|
|
|
)
|
2014-05-08 10:06:16 -05:00
|
|
|
|
2015-08-31 09:46:19 -05:00
|
|
|
def derive(self, masterkey):
|
|
|
|
return self.kdf.derive(masterkey)
|
2014-05-08 10:06:16 -05:00
|
|
|
|
|
|
|
|
|
|
|
def convertKeyDerivation(value):
|
|
|
|
"Converts key derivation URI to a BaseKeyDerivation class."
|
|
|
|
|
|
|
|
return {
|
|
|
|
"http://www.rsasecurity.com/rsalabs/pkcs/schemas/pkcs-5v2-0#pbkdf2": PBKDF2KeyDerivation,
|
|
|
|
}.get(value.lower(), None)
|
|
|
|
|
|
|
|
|
2018-09-26 04:59:50 -05:00
|
|
|
class XMLDecryptor:
|
2014-05-08 10:06:16 -05:00
|
|
|
"""This decrypts values from XML as specified in:
|
|
|
|
* http://www.w3.org/TR/xmlenc-core/
|
|
|
|
* RFC 6931"""
|
|
|
|
|
|
|
|
def __init__(self, key, hmac=None):
|
2015-08-31 09:46:19 -05:00
|
|
|
self.__key = key
|
2014-05-08 10:06:16 -05:00
|
|
|
self.__hmac = hmac
|
|
|
|
|
|
|
|
def __call__(self, element, mac=None):
|
2017-02-25 04:06:04 -06:00
|
|
|
algo, mode, klen = fetch(
|
|
|
|
element, "./xenc:EncryptionMethod/@Algorithm", convertAlgorithm)
|
|
|
|
data = fetch(
|
|
|
|
element,
|
|
|
|
"./xenc:CipherData/xenc:CipherValue/text()",
|
|
|
|
base64.b64decode
|
|
|
|
)
|
2014-05-08 10:06:16 -05:00
|
|
|
|
2015-08-31 09:46:19 -05:00
|
|
|
# Make sure the key is the right length.
|
|
|
|
if len(self.__key) * 8 != klen:
|
|
|
|
raise ValidationError("Invalid key length!")
|
|
|
|
|
2014-05-08 10:06:16 -05:00
|
|
|
# If a MAC is present, perform validation.
|
|
|
|
if mac:
|
|
|
|
tmp = self.__hmac.copy()
|
|
|
|
tmp.update(data)
|
2017-02-25 04:06:04 -06:00
|
|
|
try:
|
|
|
|
tmp.verify(mac)
|
|
|
|
except InvalidSignature as e:
|
|
|
|
raise ValidationError("MAC validation failed!", e)
|
2014-05-08 10:06:16 -05:00
|
|
|
|
2017-02-25 04:06:04 -06:00
|
|
|
iv = data[:algo.block_size // 8]
|
2015-08-31 09:46:19 -05:00
|
|
|
data = data[len(iv):]
|
|
|
|
|
2017-02-25 04:06:04 -06:00
|
|
|
algorithm = algo(self.__key)
|
|
|
|
cipher = Cipher(algorithm, mode(iv), default_backend())
|
2015-08-31 09:46:19 -05:00
|
|
|
decryptor = cipher.decryptor()
|
2017-02-25 04:06:04 -06:00
|
|
|
padded = decryptor.update(data)
|
|
|
|
padded += decryptor.finalize()
|
|
|
|
|
|
|
|
unpadder = PKCS7(algorithm.block_size).unpadder()
|
|
|
|
out = unpadder.update(padded)
|
|
|
|
out += unpadder.finalize()
|
2015-08-31 09:46:19 -05:00
|
|
|
|
2014-05-08 10:06:16 -05:00
|
|
|
return out
|
|
|
|
|
|
|
|
|
2018-09-26 04:59:50 -05:00
|
|
|
class PSKCKeyPackage:
|
2014-05-08 10:06:16 -05:00
|
|
|
_XML = {
|
|
|
|
'pskc:DeviceInfo': {
|
|
|
|
'pskc:IssueNo/text()': ('issueno', unicode),
|
|
|
|
'pskc:ExpiryDate/text()': ('notafter.hw', convertDate),
|
|
|
|
'pskc:Manufacturer/text()': ('vendor', unicode),
|
|
|
|
'pskc:Model/text()': ('model', unicode),
|
|
|
|
'pskc:SerialNo/text()': ('serial', unicode),
|
|
|
|
'pskc:StartDate/text()': ('notbefore.hw', convertDate),
|
|
|
|
'pskc:UserId/text()': ('owner', unicode),
|
|
|
|
},
|
|
|
|
|
|
|
|
'pskc:Key': {
|
|
|
|
'@Algorithm': ('type', convertTokenType),
|
|
|
|
'@Id': ('id', unicode),
|
|
|
|
'pskc:FriendlyName/text()': ('description', unicode),
|
|
|
|
'pskc:Issuer/text()': ('issuer', unicode),
|
|
|
|
'pskc:KeyReference/text()': ('keyref', unicode),
|
|
|
|
|
|
|
|
'pskc:AlgorithmParameters': {
|
|
|
|
'pskc:Suite/text()': ('algorithm', convertHashName),
|
|
|
|
'pskc:ResponseFormat/@CheckDigit': ('checkdigit', unicode),
|
|
|
|
'pskc:ResponseFormat/@Encoding': ('encoding', unicode),
|
|
|
|
'pskc:ResponseFormat/@Length': ('digits', int),
|
|
|
|
},
|
|
|
|
|
|
|
|
'pskc:Data': {
|
|
|
|
'pskc:Counter': ('counter', lambda v, d: convertEncrypted(v, d, long, long)),
|
|
|
|
'pskc:Secret': ('key', convertEncrypted),
|
|
|
|
'pskc:Time': ('time', lambda v, d: convertEncrypted(v, d, int, int)),
|
|
|
|
'pskc:TimeDrift': ('offset', lambda v, d: convertEncrypted(v, d, int, int)),
|
|
|
|
'pskc:TimeInterval': ('interval', lambda v, d: convertEncrypted(v, d, int, int)),
|
|
|
|
},
|
|
|
|
|
|
|
|
'pskc:Policy': {
|
|
|
|
'pskc:ExpiryDate/text()': ('notafter.sw', convertDate),
|
|
|
|
'pskc:KeyUsage/text()': ('keyusage', unicode),
|
|
|
|
'pskc:NumberOfTransactions': ('maxtransact', lambda v: v),
|
|
|
|
'pskc:PINPolicy': ('pinpolicy', lambda v: v),
|
|
|
|
'pskc:StartDate/text()': ('notbefore.sw', convertDate),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
_MAP = (
|
|
|
|
('type', 'type', lambda v, o: v.strip()),
|
|
|
|
('description', 'description', lambda v, o: v.strip()),
|
|
|
|
('vendor', 'ipatokenvendor', lambda v, o: v.strip()),
|
|
|
|
('model', 'ipatokenmodel', lambda v, o: v.strip()),
|
|
|
|
('serial', 'ipatokenserial', lambda v, o: v.strip()),
|
|
|
|
('issueno', 'ipatokenserial', lambda v, o: o.get('ipatokenserial', '') + '-' + v.strip()),
|
2017-06-20 03:16:10 -05:00
|
|
|
(
|
|
|
|
'key',
|
|
|
|
'ipatokenotpkey',
|
|
|
|
lambda v, o: base64.b32encode(v).decode('ascii')
|
|
|
|
),
|
2014-05-08 10:06:16 -05:00
|
|
|
('digits', 'ipatokenotpdigits', lambda v, o: v),
|
|
|
|
('algorithm', 'ipatokenotpalgorithm', lambda v, o: v),
|
|
|
|
('counter', 'ipatokenhotpcounter', lambda v, o: v),
|
|
|
|
('interval', 'ipatokentotptimestep', lambda v, o: v),
|
|
|
|
('offset', 'ipatokentotpclockoffset', lambda v, o: o.get('ipatokentotptimestep', 30) * v),
|
|
|
|
)
|
|
|
|
|
|
|
|
def __init__(self, element, decryptor):
|
|
|
|
self.__element = element
|
|
|
|
self.__decryptor = decryptor
|
|
|
|
self.__id = None
|
|
|
|
self.__options = None
|
|
|
|
|
|
|
|
@property
|
|
|
|
def id(self):
|
|
|
|
if self.__id is None:
|
|
|
|
self.__process()
|
|
|
|
|
|
|
|
return self.__id
|
|
|
|
|
|
|
|
@property
|
|
|
|
def options(self):
|
|
|
|
if self.__options is None:
|
|
|
|
self.__process()
|
|
|
|
|
|
|
|
return self.__options
|
|
|
|
|
|
|
|
def remove(self):
|
|
|
|
self.__element.getparent().remove(self.__element)
|
|
|
|
|
|
|
|
def __process(self):
|
|
|
|
# Parse and validate.
|
|
|
|
data = self.__parse(self.__decryptor, self.__element, ".", self._XML)
|
|
|
|
self.__validate(data)
|
|
|
|
|
|
|
|
# Copy values into output.
|
|
|
|
options = {}
|
|
|
|
for (dk, ok, f) in self._MAP:
|
|
|
|
if dk in data:
|
|
|
|
options[ok] = f(data[dk], options)
|
|
|
|
|
|
|
|
# Copy validity dates.
|
|
|
|
self.__dates(options, data, 'notbefore', max)
|
|
|
|
self.__dates(options, data, 'notafter', min)
|
|
|
|
|
|
|
|
# Save attributes.
|
|
|
|
self.__options = options
|
|
|
|
self.__id = data.get('id', uuid.uuid4())
|
|
|
|
|
|
|
|
def __parse(self, decryptor, element, prefix, table):
|
|
|
|
"Recursively parses the xml from a table."
|
|
|
|
|
|
|
|
data = {}
|
|
|
|
for k, v in table.items():
|
|
|
|
path = prefix + "/" + k
|
|
|
|
|
|
|
|
if isinstance(v, dict):
|
|
|
|
data.update(self.__parse(decryptor, element, path, v))
|
|
|
|
continue
|
|
|
|
|
|
|
|
result = fetch(element, path)
|
|
|
|
if result is not None:
|
2017-06-20 03:00:59 -05:00
|
|
|
lambda_code_attr = "__code__" if six.PY3 else "func_code"
|
|
|
|
if getattr(
|
|
|
|
getattr(v[1], lambda_code_attr, None),
|
|
|
|
"co_argcount", 0) > 1:
|
2014-05-08 10:06:16 -05:00
|
|
|
data[v[0]] = v[1](result, decryptor)
|
|
|
|
else:
|
|
|
|
data[v[0]] = v[1](result)
|
|
|
|
|
|
|
|
return data
|
|
|
|
|
|
|
|
def __validate(self, data):
|
|
|
|
"Validates the parsed data."
|
|
|
|
|
|
|
|
if 'type' not in data or data['type'] not in ('totp', 'hotp'):
|
|
|
|
raise ValidationError("Unsupported token type!")
|
|
|
|
|
|
|
|
if 'key' not in data:
|
|
|
|
if 'keyref' in data:
|
|
|
|
raise ValidationError("Referenced keys are not supported!")
|
|
|
|
raise ValidationError("Key not found in token!")
|
|
|
|
|
|
|
|
if data.get('checkdigit', 'FALSE').upper() != 'FALSE':
|
|
|
|
raise ValidationError("CheckDigit not supported!")
|
|
|
|
|
|
|
|
if data.get('maxtransact', None) is not None:
|
|
|
|
raise ValidationError('NumberOfTransactions policy not supported!')
|
|
|
|
|
|
|
|
if data.get('pinpolicy', None) is not None:
|
|
|
|
raise ValidationError('PINPolicy policy not supported!')
|
|
|
|
|
|
|
|
if data.get('time', 0) != 0:
|
|
|
|
raise ValidationError('Specified time is not supported!')
|
|
|
|
|
|
|
|
encoding = data.get('encoding', 'DECIMAL').upper()
|
|
|
|
if encoding != 'DECIMAL':
|
|
|
|
raise ValidationError('Unsupported encoding: %s!' % encoding)
|
|
|
|
|
|
|
|
usage = data.get('keyusage', 'OTP')
|
|
|
|
if usage != 'OTP':
|
|
|
|
raise ValidationError('Unsupported key usage: %s' % usage)
|
|
|
|
|
|
|
|
def __dates(self, out, data, key, reducer):
|
|
|
|
dates = (data.get(key + '.sw', None), data.get(key + '.hw', None))
|
2015-08-11 09:42:28 -05:00
|
|
|
dates = [x for x in dates if x is not None]
|
2014-05-08 10:06:16 -05:00
|
|
|
if dates:
|
|
|
|
out['ipatoken' + key] = unicode(reducer(dates).strftime("%Y%m%d%H%M%SZ"))
|
|
|
|
|
|
|
|
|
2018-09-26 04:59:50 -05:00
|
|
|
class PSKCDocument:
|
2014-05-08 10:06:16 -05:00
|
|
|
@property
|
|
|
|
def keyname(self):
|
|
|
|
return self.__keyname
|
|
|
|
|
|
|
|
def __init__(self, filename):
|
|
|
|
self.__keyname = None
|
|
|
|
self.__decryptor = None
|
|
|
|
self.__doc = etree.parse(filename)
|
|
|
|
self.__mkey = fetch(self.__doc, "./pskc:MACMethod/pskc:MACKey")
|
|
|
|
self.__algo = fetch(self.__doc, "./pskc:MACMethod/@Algorithm", convertHMACType)
|
|
|
|
|
|
|
|
self.__keypackages = fetchAll(self.__doc, "./pskc:KeyPackage")
|
|
|
|
if not self.__keypackages:
|
|
|
|
raise ValueError("PSKC file is invalid!")
|
|
|
|
|
|
|
|
self.__enckey = fetch(self.__doc, "./pskc:EncryptionKey")
|
|
|
|
if self.__enckey is not None:
|
|
|
|
# Check for x509 key.
|
|
|
|
x509key = fetch(self.__enckey, "./ds:X509Data")
|
|
|
|
if x509key is not None:
|
|
|
|
raise NotImplementedError("X.509 keys are not currently supported!")
|
|
|
|
|
|
|
|
# Get the keyname.
|
|
|
|
self.__keyname = fetch(self.__enckey, "./ds:KeyName/text()")
|
|
|
|
if self.__keyname is None:
|
|
|
|
self.__keyname = fetch(self.__enckey,
|
|
|
|
"./xenc11:DerivedKey/xenc11:MasterKeyName/text()")
|
|
|
|
|
|
|
|
def setKey(self, key):
|
|
|
|
# Derive the enckey if required.
|
|
|
|
kd = fetch(self.__enckey,
|
|
|
|
"./xenc11:DerivedKey/xenc11:KeyDerivationMethod/@Algorithm",
|
|
|
|
convertKeyDerivation)
|
|
|
|
if kd is not None:
|
|
|
|
key = kd(self.__enckey).derive(key)
|
|
|
|
|
|
|
|
# Load the decryptor.
|
|
|
|
self.__decryptor = XMLDecryptor(key)
|
|
|
|
if self.__mkey is not None and self.__algo is not None:
|
2017-02-25 04:06:04 -06:00
|
|
|
tmp = hmac.HMAC(
|
|
|
|
self.__decryptor(self.__mkey),
|
|
|
|
self.__algo(),
|
|
|
|
backend=default_backend()
|
|
|
|
)
|
2014-05-08 10:06:16 -05:00
|
|
|
self.__decryptor = XMLDecryptor(key, tmp)
|
|
|
|
|
|
|
|
def getKeyPackages(self):
|
|
|
|
for kp in self.__keypackages:
|
|
|
|
yield PSKCKeyPackage(kp, self.__decryptor)
|
|
|
|
|
|
|
|
def save(self, dest):
|
|
|
|
self.__doc.write(dest)
|
|
|
|
|
|
|
|
|
|
|
|
class OTPTokenImport(admintool.AdminTool):
|
|
|
|
command_name = 'ipa-otptoken-import'
|
|
|
|
description = "Import OTP tokens."
|
|
|
|
usage = "%prog [options] <PSKC file> <output file>"
|
|
|
|
|
|
|
|
@classmethod
|
|
|
|
def add_options(cls, parser):
|
|
|
|
super(OTPTokenImport, cls).add_options(parser)
|
|
|
|
|
|
|
|
parser.add_option("-k", "--keyfile", dest="keyfile",
|
|
|
|
help="File containing the key used to decrypt token secrets")
|
|
|
|
|
|
|
|
def validate_options(self):
|
|
|
|
super(OTPTokenImport, self).validate_options()
|
|
|
|
|
|
|
|
# Parse the file.
|
|
|
|
if len(self.args) < 1:
|
|
|
|
raise admintool.ScriptError("Import file required!")
|
|
|
|
self.doc = PSKCDocument(self.args[0])
|
|
|
|
|
|
|
|
# Get the output file.
|
|
|
|
if len(self.args) < 2:
|
|
|
|
raise admintool.ScriptError("Output file required!")
|
|
|
|
self.output = self.args[1]
|
|
|
|
if os.path.exists(self.output):
|
|
|
|
raise admintool.ScriptError("Output file already exists!")
|
|
|
|
|
|
|
|
# Verify a key is provided if one is needed.
|
|
|
|
if self.doc.keyname is not None:
|
2016-02-25 06:46:33 -06:00
|
|
|
if self.safe_options.keyfile is None: # pylint: disable=no-member
|
2014-05-08 10:06:16 -05:00
|
|
|
raise admintool.ScriptError("Encryption key required: %s!" % self.doc.keyname)
|
|
|
|
|
|
|
|
# Load the keyfile.
|
2016-02-25 06:46:33 -06:00
|
|
|
keyfile = self.safe_options.keyfile # pylint: disable=no-member
|
|
|
|
with open(keyfile) as f:
|
2014-05-08 10:06:16 -05:00
|
|
|
self.doc.setKey(f.read())
|
|
|
|
|
|
|
|
def run(self):
|
2016-12-02 02:10:41 -06:00
|
|
|
api.bootstrap(in_server=True, confdir=paths.ETC_IPA)
|
2014-05-08 10:06:16 -05:00
|
|
|
api.finalize()
|
|
|
|
|
|
|
|
try:
|
2015-11-23 01:48:40 -06:00
|
|
|
api.Backend.ldap2.connect(ccache=os.environ.get('KRB5CCNAME'),
|
|
|
|
autobind=AUTOBIND_DISABLED)
|
2015-07-20 09:04:07 -05:00
|
|
|
except (gssapi.exceptions.GSSError, errors.ACIError):
|
2014-05-08 10:06:16 -05:00
|
|
|
raise admintool.ScriptError("Unable to connect to LDAP! Did you kinit?")
|
|
|
|
|
|
|
|
try:
|
|
|
|
# Parse tokens
|
|
|
|
for keypkg in self.doc.getKeyPackages():
|
|
|
|
try:
|
2014-11-06 14:30:13 -06:00
|
|
|
api.Command.otptoken_add(keypkg.id, no_qrcode=True, **keypkg.options)
|
2014-05-08 10:06:16 -05:00
|
|
|
except Exception as e:
|
2017-05-23 11:35:57 -05:00
|
|
|
logger.warning("Error adding token: %s", e)
|
2014-05-08 10:06:16 -05:00
|
|
|
else:
|
2017-05-23 11:35:57 -05:00
|
|
|
logger.info("Added token: %s", keypkg.id)
|
2014-05-08 10:06:16 -05:00
|
|
|
keypkg.remove()
|
|
|
|
finally:
|
2015-11-23 01:48:40 -06:00
|
|
|
api.Backend.ldap2.disconnect()
|
2014-05-08 10:06:16 -05:00
|
|
|
|
|
|
|
# Write out the XML file without the tokens that succeeded.
|
|
|
|
self.doc.save(self.output)
|