def _setup_(self): if self.ocra is not None and self.bkey is not None: return key_len = 20 if self.ocrasuite.find('-SHA256'): key_len = 32 elif self.ocrasuite.find('-SHA512'): key_len = 64 self.bkey = kdf2(self.sharedsecret, self.nonce, self.activationkey, len=key_len) self.ocra = OcraSuite(self.ocrasuite) self.counter = 0 return
def _getChallenge(self, ocrasuite, bkey, serial, ocrapin='', data=None, count=0, ttime=None): otp1 = None p = { "serial": serial, "data": "0105037311 Konto 50150850 BLZ 1752,03 Eur" } if data is not None: p[data] = data response = self.app.get(genUrl(controller='ocra', action='request'), params=p) log.info("response %s\n", response) assert '"value": true' in response ''' -2b- from the response get the challenge ''' jresp = json.loads(response.body) challenge1 = str(jresp.get('detail').get('challenge')) transid1 = str(jresp.get('detail').get('transactionid')) now = datetime.now() if ttime is not None: now = ttime stime = now.strftime("%s") itime = int(stime) param = {} param['C'] = count param['Q'] = challenge1 param['P'] = ocrapin param['S'] = '' param['T'] = itime ocra = OcraSuite(ocrasuite) data = ocra.combineData(**param) otp1 = ocra.compute(data, bkey) return (otp1, transid1)
def _getChallenge(self, ocrasuite, bkey, serial, ocrapin='', data=None, count=0, ttime=None): otp1 = None p = {"serial" : serial, "data" : "0105037311 Konto 50150850 BLZ 1752,03 Eur" } if data is not None: p[data] = data response = self.app.get(genUrl(controller='ocra', action='request'), params=p) log.info("response %s\n", response) assert '"value": true' in response ''' -2b- from the response get the challenge ''' jresp = json.loads(response.body) challenge1 = str(jresp.get('detail').get('challenge')) transid1 = str(jresp.get('detail').get('transactionid')) now = datetime.now() if ttime is not None: now = ttime stime = now.strftime("%s") itime = int(stime) param = {} param['C'] = count param['Q'] = challenge1 param['P'] = ocrapin param['S'] = '' param['T'] = itime ocra = OcraSuite(ocrasuite) data = ocra.combineData(**param) otp1 = ocra.compute(data, bkey) return (otp1, transid1)
def _setup_(self): if self.ocra is not None and self.bkey is not None: return key_len = 20 if self.ocrasuite.find('-SHA256'): key_len = 32 elif self.ocrasuite.find('-SHA512'): key_len = 64 self.bkey = kdf2(self.sharedsecret, self.nonce, self.activationkey, len=key_len) self.ocra = OcraSuite(self.ocrasuite) self.counter = 0 return
def ptest_OCRA_token_failcounterInc(self, tid=1): ''' test_OCRA_token_failcounterInc: failcounter increment description: for all ocrasuites: create and enroll token verify the first otp get some challenges 4 times: verify a wrong otp verify a wrong transaction check status and if fail counter has incremented ''' tcount = 0 for test in self.tests: ocrasuite = test['ocrasuite'] key = test['keyh'] bkey = test['key'] ocrapin = 'myocrapin' tid = tid serial = "QR_One_%r_%r_%r_%r" % (tid, tcount, int(time.time()), random.randint(0, 100)) log.info("## serial: %s" % serial) count = 0 tcount = tcount + 1 ocra = OcraSuite(ocrasuite) pinlen = ocra.truncation ''' -1- create an ocra token ''' parameters = { "serial" : serial, "user" : "root", "pin" : "pin", "description" : "first QRToken", 'type' : 'ocra', 'ocrapin' : ocrapin, 'otpkey' : key, 'ocrasuite' : ocrasuite } response = self.app.get(genUrl(controller='admin', action='init'), params=parameters) assert '"value": true' in response ## verify that the token is usable ''' -2- fetch the challenge ''' p = {"serial" : serial, "data" : "0105037311 Konto 50150850 BLZ 1752,03 Eur" } response = self.app.get(genUrl(controller='ocra', action='request'), params=p) log.info("response %s\n", response) if '"value": true' not in response: assert '"value": true' in response ''' -3.a- from the response get the challenge ''' jresp = json.loads(response.body) challenge = str(jresp.get('detail').get('challenge')) transid = str(jresp.get('detail').get('transactionid')) param = {} param['C'] = count param['Q'] = challenge param['P'] = ocrapin param['S'] = '' if ocra.T is not None: ''' Default value for G is 1M, i.e., time-step size is one minute and the T represents the number of minutes since epoch time [UT]. ''' now = datetime.now() stime = now.strftime("%s") itime = int(stime) param['T'] = itime ocra = OcraSuite(ocrasuite) data = ocra.combineData(**param) otp = ocra.compute(data, bkey) ppin = 'pin' + otp ''' -3.b- verify the correct otp value ''' parameters = {"transactionid" : transid, "pass" : ppin, } response = self.app.get(genUrl(controller='ocra', action='check_t'), params=parameters) log.info("response %s\n", response) if '"result": true' not in response: assert '"result": true' in response # verify that the failcounter increments (max is 10) fcount = 0 for count in range(1, 3): ## create more than one challenge chals = random.randint(2, 5) for cc in range(1, chals): ''' -2- fetch the challenge ''' p = {"serial" : serial, "data" : "0105037311 Konto 50150850 BLZ 1752,03 Eur" } response = self.app.get(genUrl(controller='ocra', action='request'), params=p) log.info("response %s\n", response) if '"value": true' not in response: assert '"value": true' in response ''' -3.a- from the response get the challenge ''' jresp = json.loads(response.body) challenge = str(jresp.get('detail').get('challenge')) transid = str(jresp.get('detail').get('transactionid')) ppin = 'pin' + 'a' * pinlen ''' -4- verify the wrong otp value ''' parameters = {"transactionid" : transid, "pass" : ppin, } response = self.app.get(genUrl(controller='ocra', action='check_t'), params=parameters) log.info("response %s\n", response) if '"result": false' not in response: assert '"result": false' in response fcount += 1 ppin = 'pin' + '4' * pinlen ''' -5- verify the wrong otp value ''' parameters = {"transactionid" : transid, "pass" : ppin, } response = self.app.get(genUrl(controller='ocra', action='check_t'), params=parameters) log.info("response %s\n", response) if not '"result": false' in response: assert '"result": false' in response fcount += 1 ''' -6- check if the failcounter has incremented ''' parameters = {"transactionid" : transid, } response = self.app.get(genUrl(controller='ocra', action='checkstatus'), params=parameters) log.info("response %s\n", response) assert '"status": true' in response assstring = '"failcount": %d,' % (fcount) log.info("assert %s\n", assstring) if assstring not in response: log.error(response) assert assstring in response sleep = random.uniform(0.0, 0.3) time.sleep(sleep) ''' -remove the ocra token ''' parameters = {"serial" : serial, } response = self.app.get(genUrl(controller='admin', action='remove'), params=parameters) log.info("response %s\n", response) assert '"value": 1' in response for _iii in range(0, 3): parameters = {"serial" : serial, } response = self.app.get(genUrl(controller='admin', action='remove'), params=parameters) return response
class OcraOtp(object): def __init__(self, ocrapin=None): self.ocra = None self.bkey = None self.ocrapin = ocrapin self.activationkey = None self.sharedsecret = None self.ocrasuite = None self.serial = None self.counter = 0 def init_1(self, response): ''' take the response of the first init to setup the OcraOtp''' jresp = json.loads(response.body) app_import = str(jresp.get('detail').get('app_import')) self.sharedsecret = str(jresp.get('detail').get('sharedsecret')) self.serial = str(jresp.get('detail').get('serial')) ''' now parse the appurl for the ocrasuite ''' uri = urlparse(app_import.replace('lseqr://', 'http://')) qs = uri.query qdict = parse_qs(qs) ocrasuite = qdict.get('os', None) if ocrasuite is not None and len(ocrasuite) > 0: ocrasuite = ocrasuite[0] self.ocrasuite = ocrasuite return (self.ocrasuite, self.sharedsecret, self.serial) def init_2(self, response, activationKey): self.activationkey = activationKey jresp = json.loads(response.body) self.nonce = str(jresp.get('detail').get('nonce')) self.transid = str(jresp.get('detail').get('transactionid')) app_import = str(jresp.get('detail').get('app_import')) ''' now parse the appurl for the ocrasuite ''' uri = urlparse(app_import.replace('lseqr://', 'http://')) qs = uri.query qdict = parse_qs(qs) nonce = qdict.get('no', None) if nonce is not None and len(nonce) > 0: nonce = nonce[0] challenge = qdict.get('ch', None) if challenge is not None and len(challenge) > 0: challenge = challenge[0] self.challenge = challenge self.ocra = None self.bkey = None return (self.challenge, self.transid) def _setup_(self): if self.ocra is not None and self.bkey is not None: return key_len = 20 if self.ocrasuite.find('-SHA256'): key_len = 32 elif self.ocrasuite.find('-SHA512'): key_len = 64 self.bkey = kdf2(self.sharedsecret, self.nonce, self.activationkey, len=key_len) self.ocra = OcraSuite(self.ocrasuite) self.counter = 0 return def callcOtp(self, challenge=None, ocrapin=None, counter= -1): if self.ocra is None: self._setup_() if ocrapin is None: ocrapin = self.ocrapin if challenge is None: challenge = self.challenge if counter == -1: counter = self.counter param = {} param['C'] = counter param['Q'] = challenge param['P'] = ocrapin param['S'] = '' if self.ocra.T is not None: ''' Default value for G is 1M, i.e., time-step size is one minute and the T represents the number of minutes since epoch time [UT]. ''' now = datetime.now() stime = now.strftime("%s") itime = int(stime) param['T'] = itime data = self.ocra.combineData(**param) otp = self.ocra.compute(data, self.bkey) if counter == -1: self.counter += 1 return otp
class OcraOtp(object): def __init__(self, ocrapin=None): self.ocra = None self.bkey = None self.ocrapin = ocrapin self.activationkey = None self.sharedsecret = None self.ocrasuite = None self.serial = None self.counter = 0 def init_1(self, response): ''' take the response of the first init to setup the OcraOtp''' jresp = json.loads(response.body) app_import = str(jresp.get('detail').get('app_import')) self.sharedsecret = str(jresp.get('detail').get('sharedsecret')) self.serial = str(jresp.get('detail').get('serial')) ''' now parse the appurl for the ocrasuite ''' uri = urlparse(app_import.replace('lseqr://', 'http://')) qs = uri.query qdict = parse_qs(qs) ocrasuite = qdict.get('os', None) if ocrasuite is not None and len(ocrasuite) > 0: ocrasuite = ocrasuite[0] self.ocrasuite = ocrasuite return (self.ocrasuite, self.sharedsecret, self.serial) def init_2(self, response, activationKey): self.activationkey = activationKey jresp = json.loads(response.body) self.nonce = str(jresp.get('detail').get('nonce')) self.transid = str(jresp.get('detail').get('transactionid')) app_import = str(jresp.get('detail').get('app_import')) ''' now parse the appurl for the ocrasuite ''' uri = urlparse(app_import.replace('lseqr://', 'http://')) qs = uri.query qdict = parse_qs(qs) nonce = qdict.get('no', None) if nonce is not None and len(nonce) > 0: nonce = nonce[0] challenge = qdict.get('ch', None) if challenge is not None and len(challenge) > 0: challenge = challenge[0] self.challenge = challenge self.ocra = None self.bkey = None return (self.challenge, self.transid) def _setup_(self): if self.ocra is not None and self.bkey is not None: return key_len = 20 if self.ocrasuite.find('-SHA256'): key_len = 32 elif self.ocrasuite.find('-SHA512'): key_len = 64 self.bkey = kdf2(self.sharedsecret, self.nonce, self.activationkey, len=key_len) self.ocra = OcraSuite(self.ocrasuite) self.counter = 0 return def callcOtp(self, challenge=None, ocrapin=None, counter=-1): if self.ocra is None: self._setup_() if ocrapin is None: ocrapin = self.ocrapin if challenge is None: challenge = self.challenge if counter == -1: counter = self.counter param = {} param['C'] = counter param['Q'] = challenge param['P'] = ocrapin param['S'] = '' if self.ocra.T is not None: ''' Default value for G is 1M, i.e., time-step size is one minute and the T represents the number of minutes since epoch time [UT]. ''' now = datetime.now() stime = now.strftime("%s") itime = int(stime) param['T'] = itime data = self.ocra.combineData(**param) otp = self.ocra.compute(data, self.bkey) if counter == -1: self.counter += 1 return otp
def ptest_OCRA_token_failcounterInc(self, tid=1): ''' test_OCRA_token_failcounterInc: failcounter increment description: for all ocrasuites: create and enroll token verify the first otp get some challenges 4 times: verify a wrong otp verify a wrong transaction check status and if fail counter has incremented ''' tcount = 0 for test in self.tests: ocrasuite = test['ocrasuite'] key = test['keyh'] bkey = test['key'] ocrapin = 'myocrapin' tid = tid serial = "QR_One_%r_%r_%r_%r" % (tid, tcount, int( time.time()), random.randint(0, 100)) log.info("## serial: %s" % serial) count = 0 tcount = tcount + 1 ocra = OcraSuite(ocrasuite) pinlen = ocra.truncation ''' -1- create an ocra token ''' parameters = { "serial": serial, "user": "******", "pin": "pin", "description": "first QRToken", 'type': 'ocra', 'ocrapin': ocrapin, 'otpkey': key, 'ocrasuite': ocrasuite } response = self.app.get(genUrl(controller='admin', action='init'), params=parameters) assert '"value": true' in response ## verify that the token is usable ''' -2- fetch the challenge ''' p = { "serial": serial, "data": "0105037311 Konto 50150850 BLZ 1752,03 Eur" } response = self.app.get(genUrl(controller='ocra', action='request'), params=p) log.info("response %s\n", response) if '"value": true' not in response: assert '"value": true' in response ''' -3.a- from the response get the challenge ''' jresp = json.loads(response.body) challenge = str(jresp.get('detail').get('challenge')) transid = str(jresp.get('detail').get('transactionid')) param = {} param['C'] = count param['Q'] = challenge param['P'] = ocrapin param['S'] = '' if ocra.T is not None: ''' Default value for G is 1M, i.e., time-step size is one minute and the T represents the number of minutes since epoch time [UT]. ''' now = datetime.now() stime = now.strftime("%s") itime = int(stime) param['T'] = itime ocra = OcraSuite(ocrasuite) data = ocra.combineData(**param) otp = ocra.compute(data, bkey) ppin = 'pin' + otp ''' -3.b- verify the correct otp value ''' parameters = { "transactionid": transid, "pass": ppin, } response = self.app.get(genUrl(controller='ocra', action='check_t'), params=parameters) log.info("response %s\n", response) if '"result": true' not in response: assert '"result": true' in response # verify that the failcounter increments (max is 10) fcount = 0 for count in range(1, 3): ## create more than one challenge chals = random.randint(2, 5) for cc in range(1, chals): ''' -2- fetch the challenge ''' p = { "serial": serial, "data": "0105037311 Konto 50150850 BLZ 1752,03 Eur" } response = self.app.get(genUrl(controller='ocra', action='request'), params=p) log.info("response %s\n", response) if '"value": true' not in response: assert '"value": true' in response ''' -3.a- from the response get the challenge ''' jresp = json.loads(response.body) challenge = str(jresp.get('detail').get('challenge')) transid = str(jresp.get('detail').get('transactionid')) ppin = 'pin' + 'a' * pinlen ''' -4- verify the wrong otp value ''' parameters = { "transactionid": transid, "pass": ppin, } response = self.app.get(genUrl(controller='ocra', action='check_t'), params=parameters) log.info("response %s\n", response) if '"result": false' not in response: assert '"result": false' in response fcount += 1 ppin = 'pin' + '4' * pinlen ''' -5- verify the wrong otp value ''' parameters = { "transactionid": transid, "pass": ppin, } response = self.app.get(genUrl(controller='ocra', action='check_t'), params=parameters) log.info("response %s\n", response) if not '"result": false' in response: assert '"result": false' in response fcount += 1 ''' -6- check if the failcounter has incremented ''' parameters = { "transactionid": transid, } response = self.app.get(genUrl(controller='ocra', action='checkstatus'), params=parameters) log.info("response %s\n", response) assert '"status": true' in response assstring = '"failcount": %d,' % (fcount) log.info("assert %s\n", assstring) if assstring not in response: log.error(response) assert assstring in response sleep = random.uniform(0.0, 0.3) time.sleep(sleep) ''' -remove the ocra token ''' parameters = { "serial": serial, } response = self.app.get(genUrl(controller='admin', action='remove'), params=parameters) log.info("response %s\n", response) assert '"value": 1' in response for _iii in range(0, 3): parameters = { "serial": serial, } response = self.app.get(genUrl(controller='admin', action='remove'), params=parameters) return response
def calculateOtp(self): ''' ''' from linotp.lib.crypto import kdf2 from linotp.tokens.ocra import OcraSuite from datetime import datetime from urlparse import urlparse from urlparse import parse_qs res = {} # description = 'ocra/calculateOtp: calculate the first # otp from the given init2 response ' try: params = getLowerParams(request.params) log.debug("[calculateOtp]: %r" % params) checkPolicyPre('ocra', "calcOTP") sharedsecret = params.get('sharedsecret') activationcode = params.get('activationcode') nonce = params.get('nonce') ocrasuite = params.get('ocrasuite') challenge = params.get('challenge') counter = params.get('counter') ocrapin = params.get('ocrapin') nonce3 = params.get('no') ocrasuite3 = params.get('os') challenge = params.get('challenge') counter = params.get('counter') ocrapin = params.get('ocrapin') init1 = params.get('init1') init2 = params.get('init2') if init1 is not None: # now parse the appurl for the ocrasuite uri = urlparse(init1.replace('lseqr://', 'http://')) qs = uri.query qdict = parse_qs(qs) ocrasuite2 = qdict.get('os', None) if ocrasuite2 is not None and len(ocrasuite2) > 0: ocrasuite2 = ocrasuite2[0] if ocrasuite is None: ocrasuite = ocrasuite2 sharedsecret2 = qdict.get('sh', None) if sharedsecret2 is not None and len(sharedsecret2) > 0: sharedsecret2 = sharedsecret2[0] if sharedsecret is None: sharedsecret = sharedsecret2 # parse init1 if init2 is not None: # now parse the appurl for the ocrasuite uri = urlparse(init2.replace('lseqr://', 'http://')) qs = uri.query qdict = parse_qs(qs) challenge2 = qdict.get('ch', None) if challenge2 is not None and len(challenge2) > 0: challenge2 = challenge2[0] if challenge is None: challenge = challenge2 nonce2 = qdict.get('no', None) if nonce2 is not None and len(nonce2) > 0: nonce2 = nonce2[0] if nonce is None: nonce = nonce2 if ocrapin is None: ocrapin = '' if counter is None: counter = 0 if nonce3 is not None: nonce = unicode(nonce3) if ocrasuite3 is not None: ocrasuite = unicode(ocrasuite3) # now we have all in place for the key derivation to create # the new key sharedsecret, activationcode and nonce key_len = 20 if ocrasuite.find('-SHA256'): key_len = 32 elif ocrasuite.find('-SHA512'): key_len = 64 if sharedsecret is not None: sharedsecret = unicode(sharedsecret) if nonce is not None: nonce = unicode(nonce) if activationcode is not None: activationcode = unicode(activationcode) newkey = kdf2(sharedsecret, nonce, activationcode, len=key_len) ocra = OcraSuite(ocrasuite) param = {} param['C'] = int(counter) param['Q'] = unicode(challenge) param['P'] = unicode(ocrapin) param['S'] = '' if ocra.T is not None: # Default value for G is 1M, i.e., time-step size is # one minute and the T represents the number of minutes # since epoch time [UT]. now = datetime.now() stime = now.strftime("%s") itime = int(stime) param['T'] = itime data = ocra.combineData(**param) otp = ocra.compute(data, newkey) res = {'otp': otp} Session.commit() return sendResult(response, res, 1) except PolicyException as pe: log.exception("[ocra/calculateOtp] policy failed: %r" % pe) Session.rollback() return sendError(response, pe) except Exception as e: log.exception("[ocra/calculateOtp] failed: %r" % e) Session.rollback() return sendError(response, unicode(e), 0) finally: Session.close()
def calculateOtp(self): ''' ''' from linotp.lib.crypto import kdf2 from linotp.tokens.ocra import OcraSuite from datetime import datetime from urlparse import urlparse from urlparse import parse_qs res = {} # description = 'ocra/calculateOtp: calculate the first # otp from the given init2 response ' try: params = getLowerParams(self.request_params) log.debug("[calculateOtp]: %r" % params) checkPolicyPre('ocra', "calcOTP") sharedsecret = params.get('sharedsecret') activationcode = params.get('activationcode') nonce = params.get('nonce') ocrasuite = params.get('ocrasuite') challenge = params.get('challenge') counter = params.get('counter') ocrapin = params.get('ocrapin') nonce3 = params.get('no') ocrasuite3 = params.get('os') challenge = params.get('challenge') counter = params.get('counter') ocrapin = params.get('ocrapin') init1 = params.get('init1') init2 = params.get('init2') if init1 is not None: # now parse the appurl for the ocrasuite uri = urlparse(init1.replace('lseqr://', 'http://')) qs = uri.query qdict = parse_qs(qs) ocrasuite2 = qdict.get('os', None) if ocrasuite2 is not None and len(ocrasuite2) > 0: ocrasuite2 = ocrasuite2[0] if ocrasuite is None: ocrasuite = ocrasuite2 sharedsecret2 = qdict.get('sh', None) if sharedsecret2 is not None and len(sharedsecret2) > 0: sharedsecret2 = sharedsecret2[0] if sharedsecret is None: sharedsecret = sharedsecret2 # parse init1 if init2 is not None: # now parse the appurl for the ocrasuite uri = urlparse(init2.replace('lseqr://', 'http://')) qs = uri.query qdict = parse_qs(qs) challenge2 = qdict.get('ch', None) if challenge2 is not None and len(challenge2) > 0: challenge2 = challenge2[0] if challenge is None: challenge = challenge2 nonce2 = qdict.get('no', None) if nonce2 is not None and len(nonce2) > 0: nonce2 = nonce2[0] if nonce is None: nonce = nonce2 if ocrapin is None: ocrapin = '' if counter is None: counter = 0 if nonce3 is not None: nonce = unicode(nonce3) if ocrasuite3 is not None: ocrasuite = unicode(ocrasuite3) # now we have all in place for the key derivation to create # the new key sharedsecret, activationcode and nonce key_len = 20 if ocrasuite.find('-SHA256'): key_len = 32 elif ocrasuite.find('-SHA512'): key_len = 64 if sharedsecret is not None: sharedsecret = unicode(sharedsecret) if nonce is not None: nonce = unicode(nonce) if activationcode is not None: activationcode = unicode(activationcode) newkey = kdf2(sharedsecret, nonce, activationcode, len=key_len) ocra = OcraSuite(ocrasuite) param = {} param['C'] = int(counter) param['Q'] = unicode(challenge) param['P'] = unicode(ocrapin) param['S'] = '' if ocra.T is not None: # Default value for G is 1M, i.e., time-step size is # one minute and the T represents the number of minutes # since epoch time [UT]. now = datetime.now() stime = now.strftime("%s") itime = int(stime) param['T'] = itime data = ocra.combineData(**param) otp = ocra.compute(data, newkey) res = {'otp': otp} Session.commit() return sendResult(response, res, 1) except PolicyException as pe: log.exception("[ocra/calculateOtp] policy failed: %r" % pe) Session.rollback() return sendError(response, pe) except Exception as e: log.exception("[ocra/calculateOtp] failed: %r" % e) Session.rollback() return sendError(response, unicode(e), 0) finally: Session.close()