def register(self):
"""Register a device with the central server. Happens outside of a session."""
own_device = Device.get_own_device()
# Since we can't know the version of the remote device (yet),
# we give it everything we possibly can (don't specify a dest_version)
#
# Note that (currently) this should never fail--the central server (which we're sending
# these objects to) should always have a higher version.
r = self.post("register", {
"client_device": serializers.serialize("versioned-json", [own_device], ensure_ascii=False)
})
# If they don't understand, our assumption is broken.
if r.status_code == 500:
if "Device has no field named 'version'" in r.content:
raise Exception("Central server is of an older version than us?")
elif r.headers.get("content-type", "") == "text/html":
raise Exception("Unhandled server-side exception: %s" % r.content)
elif r.status_code == 200:
# Save to our local store. By NOT passing a src_version,
# we're saying it's OK to just store what we can.
models = serializers.deserialize("versioned-json", r.content, src_version=None, dest_version=own_device.get_version())
for model in models:
if not model.object.verify():
continue
# save the imported model, and mark the returned Device as trusted
if isinstance(model.object, Device):
model.object.save(is_trusted=True, imported=True)
else:
model.object.save(imported=True)
return {"code": "registered"}
return json.loads(r.content)
def start_session(self):
"""A 'session' to exchange data"""
if self.session:
self.close_session()
self.session = SyncSession()
self.session.client_nonce = uuid.uuid4().hex
self.session.client_device = Device.get_own_device()
r = self.post("session/create", {
"client_nonce": self.session.client_nonce,
"client_device": self.session.client_device.pk,
"client_version": kalite.VERSION,
"client_os": kalite.OS,
})
# Happens if the server has an error
raw_data = r.content
try:
data = json.loads(raw_data)
except ValueError as e:
z = re.search(r'exception_value">([^<]+)<', str(raw_data), re.MULTILINE)
if z:
raise Exception("Could not load JSON\n; server error=%s" % z.group(1))
else:
raise Exception("Could not load JSON\n; raw content=%s" % raw_data)
if data.get("error", ""):
raise Exception(data.get("error", ""))
signature = data.get("signature", "")
# Once again, we assume that (currently) the central server's version is >= ours,
# We just store what we can.
own_device = self.session.client_device
session = serializers.deserialize("versioned-json", data["session"], src_version=None, dest_version=own_device.version).next().object
if not session.verify_server_signature(signature):
raise Exception("Signature did not match.")
if session.client_nonce != self.session.client_nonce:
raise Exception("Client nonce did not match.")
if session.client_device != self.session.client_device:
raise Exception("Client device did not match.")
if self.require_trusted and not session.server_device.get_metadata().is_trusted:
raise Exception("The server is not trusted.")
self.session.server_nonce = session.server_nonce
self.session.server_device = session.server_device
self.session.verified = True
self.session.timestamp = session.timestamp
self.session.save()
r = self.post("session/create", {
"client_nonce": self.session.client_nonce,
"client_device": self.session.client_device.pk,
"server_nonce": self.session.server_nonce,
"server_device": self.session.server_device.pk,
"signature": self.session.sign(),
})
if r.status_code == 200:
return "success"
else:
return r
def register(self):
"""Register a device with the central server. Happens outside of a session."""
own_device = Device.get_own_device()
# Todo: registration process should always use one of these--and it needs to use
# Device.public_key. So, should migrate over the rest of the registration code
# to do the same.
assert own_device.public_key == own_device.get_key(
).get_public_key_string(
), "Make sure these somehow didn't get out of sync (can happen when people muck around with the data manually."
# Since we can't know the version of the remote device (yet),
# we give it everything we possibly can (don't specify a dest_version)
#
# Note that (currently) this should never fail--the central server (which we're sending
# these objects to) should always have a higher version.
r = self.post(
"register", {
"client_device":
serializers.serialize("versioned-json", [own_device],
ensure_ascii=False)
})
# If they don't understand, our assumption is broken.
if r.status_code == 500:
if "Device has no field named 'version'" in r.content:
raise Exception(
"Central server is of an older version than us?")
elif r.headers.get("content-type", "") == "text/html":
raise Exception("Unhandled server-side exception: %s" %
r.content)
elif r.status_code == 200:
# Save to our local store. By NOT passing a src_version,
# we're saying it's OK to just store what we can.
models = serializers.deserialize("versioned-json",
r.content,
src_version=None,
dest_version=own_device.version)
for model in models:
if not model.object.verify():
continue
# save the imported model, and mark the returned Device as trusted
if isinstance(model.object, Device):
model.object.save(is_trusted=True, imported=True)
else:
model.object.save(imported=True)
return {"code": "registered"}
return json.loads(r.content)
def register_device(request):
data = simplejson.loads(request.raw_post_data or "{}")
# attempt to load the client device data from the request data
if "client_device" not in data:
return JsonResponse({"error": "Serialized client device must be provided."}, status=500)
try:
# When hand-shaking on the device models, since we don't yet know the version,
# we have to just TRY with our own version.
#
# This is currently "central server" code, so
# this will only fail (currently) if the central server version
# is less than the version of a client--something that should never happen
try:
models = serializers.deserialize("versioned-json", data["client_device"], src_version=version.VERSION, dest_version=version.VERSION)
except db_models.FieldDoesNotExist as fdne:
raise Exception("Central server version is lower than client version. This is ... impossible!")
client_device = models.next().object
except Exception as e:
return JsonResponse({
"error": "Could not decode the client device model: %r" % e,
"code": "client_device_corrupted",
}, status=500)
if not isinstance(client_device, Device):
return JsonResponse({
"error": "Client device must be an instance of the 'Device' model.",
"code": "client_device_not_device",
}, status=500)
if not client_device.verify():
return JsonResponse({
"error": "Client device must be self-signed with a signature matching its own public key.",
"code": "client_device_invalid_signature",
}, status=500)
# we have a valid self-signed Device, so now check if its public key has been registered
try:
registration = RegisteredDevicePublicKey.objects.get(public_key=client_device.public_key)
except RegisteredDevicePublicKey.DoesNotExist:
try:
device = Device.objects.get(public_key=client_device.public_key)
return JsonResponse({
"error": "This device has already been registered",
"code": "device_already_registered",
}, status=500)
except Device.DoesNotExist:
return JsonResponse({
"error": "Device registration with public key not found; login and register first?",
"code": "public_key_unregistered",
}, status=500)
client_device.signed_by = client_device
# the device checks out; let's save it!
client_device.save(imported=True)
# create the DeviceZone for the new device
device_zone = DeviceZone(device=client_device, zone=registration.zone)
device_zone.save()
# delete the RegisteredDevicePublicKey, now that we've initialized the device and put it in its zone
registration.delete()
# return our local (server) Device, its Zone, and the newly created DeviceZone, to the client
return JsonResponse(
serializers.serialize("versioned-json", [Device.get_own_device(), registration.zone, device_zone], dest_version=client_device.version, ensure_ascii=False)
)
def deserialize(data, *args, **kwargs):
"""
Similar to serialize, except for deserialization.
"""
return serializers.deserialize("versioned-json", data, *args, **kwargs)
def save_serialized_models(data, increment_counters=True, src_version=None):
"""Unserializes models (from a device of version=src_version) in data and saves them to the django database.
If src_version is None, all unrecognized fields are (silently) stripped off.
If it is set to some value, then only fields of versions higher than ours are stripped off.
By defaulting to src_version=None, we're expecting a perfect match when we come in
(i.e. that wherever we got this data from, they were smart enough to "dumb it down" for us,
or they were old enough to have nothing unexpecting)
So, care must be taken in calling this function
Returns a dictionary of the # of saved models, # unsaved, and any exceptions during saving"""
from .models import ImportPurgatory # cannot be top-level, otherwise inter-dependency of this and models fouls things up
from securesync.devices.models import Device
own_device = Device.get_own_device()
if not src_version: # default version: our own
src_version = own_device.get_version()
# if data is from a purgatory object, load it up
if isinstance(data, ImportPurgatory):
purgatory = data
data = purgatory.serialized_models
else:
purgatory = None
# deserialize the models, either from text or a list of dictionaries
if isinstance(data, str) or isinstance(data, unicode):
models = serializers.deserialize("versioned-json", data, src_version=src_version, dest_version=own_device.get_version())
else:
models = serializers.deserialize("versioned-python", data, src_version=src_version, dest_version=own_device.get_version())
# try importing each of the models in turn
unsaved_models = []
exceptions = ""
saved_model_count = 0
try:
for modelwrapper in models:
try:
# extract the model from the deserialization wrapper
model = modelwrapper.object
# only allow the importing of models that are subclasses of SyncedModel
if not hasattr(model, "verify"):
raise ValidationError("Cannot save model: %s does not have a verify method (not a subclass of SyncedModel?)" % model.__class__)
# TODO(jamalex): more robust way to do this? (otherwise, it might barf about the id already existing)
model._state.adding = False
# verify that all fields are valid, and that foreign keys can be resolved
model.full_clean()
# save the imported model (checking that the signature is valid in the process)
model.save(imported=True, increment_counters=increment_counters)
# keep track of how many models have been successfully saved
saved_model_count += 1
except ValidationError as e: # the model could not be saved
# keep a running list of models and exceptions, to be stored in purgatory
exceptions += "%s: %s\n" % (model.pk, e)
unsaved_models.append(model)
# if the model is at least properly signed, try incrementing the counter for the signing device
# (because otherwise we may never ask for additional models)
try:
if increment_counters and model.verify():
model.signed_by.set_counter_position(model.counter)
except:
pass
except Exception as e:
exceptions += str(e)
# deal with any models that didn't validate properly; throw them into purgatory so we can try again later
if unsaved_models:
if not purgatory:
purgatory = ImportPurgatory()
# These models were successfully unserialized, so re-save in our own version.
purgatory.serialized_models = serializers.serialize("versioned-json", unsaved_models, ensure_ascii=False, dest_version=own_device.get_version())
purgatory.exceptions = exceptions
purgatory.model_count = len(unsaved_models)
purgatory.retry_attempts += 1
purgatory.save()
elif purgatory: # everything saved properly this time, so we can eliminate the purgatory instance
purgatory.delete()
out_dict = {
"unsaved_model_count": len(unsaved_models),
"saved_model_count": saved_model_count,
}
if exceptions:
out_dict["exceptions"] = exceptions
return out_dict
def start_session(self):
"""A 'session' to exchange data"""
if self.session:
self.close_session()
self.session = SyncSession()
self.session.client_nonce = uuid.uuid4().hex
self.session.client_device = Device.get_own_device()
r = self.post(
"session/create", {
"client_nonce": self.session.client_nonce,
"client_device": self.session.client_device.pk,
"client_version": kalite.VERSION,
"client_os": kalite.OS,
})
# Happens if the server has an error
raw_data = r.content
try:
data = json.loads(raw_data)
except ValueError as e:
z = re.search(r'exception_value">([^<]+)<', str(raw_data),
re.MULTILINE)
if z:
raise Exception("Could not load JSON\n; server error=%s" %
z.group(1))
else:
raise Exception("Could not load JSON\n; raw content=%s" %
raw_data)
if data.get("error", ""):
raise Exception(data.get("error", ""))
signature = data.get("signature", "")
# Once again, we assume that (currently) the central server's version is >= ours,
# We just store what we can.
own_device = self.session.client_device
session = serializers.deserialize(
"versioned-json",
data["session"],
src_version=None,
dest_version=own_device.version).next().object
if not session.verify_server_signature(signature):
raise Exception("Signature did not match.")
if session.client_nonce != self.session.client_nonce:
raise Exception("Client nonce did not match.")
if session.client_device != self.session.client_device:
raise Exception("Client device did not match.")
if self.require_trusted and not session.server_device.get_metadata(
).is_trusted:
raise Exception("The server is not trusted.")
self.session.server_nonce = session.server_nonce
self.session.server_device = session.server_device
self.session.verified = True
self.session.timestamp = session.timestamp
self.session.save()
r = self.post(
"session/create", {
"client_nonce": self.session.client_nonce,
"client_device": self.session.client_device.pk,
"server_nonce": self.session.server_nonce,
"server_device": self.session.server_device.pk,
"signature": self.session.sign(),
})
if r.status_code == 200:
return "success"
else:
return r
def register_device(request):
data = simplejson.loads(request.raw_post_data or "{}")
# attempt to load the client device data from the request data
if "client_device" not in data:
return JsonResponse({"error": "Serialized client device must be provided."}, status=500)
try:
# When hand-shaking on the device models, since we don't yet know the version,
# we have to just TRY with our own version.
#
# This is currently "central server" code, so
# this will only fail (currently) if the central server version
# is less than the version of a client--something that should never happen
try:
models = serializers.deserialize("versioned-json", data["client_device"], src_version=version.VERSION, dest_version=version.VERSION)
except db_models.FieldDoesNotExist as fdne:
raise Exception("Central server version is lower than client version. This is ... impossible!")
client_device = models.next().object
except Exception as e:
return JsonResponse({
"error": "Could not decode the client device model: %r" % e,
"code": "client_device_corrupted",
}, status=500)
if not isinstance(client_device, Device):
return JsonResponse({
"error": "Client device must be an instance of the 'Device' model.",
"code": "client_device_not_device",
}, status=500)
if not client_device.verify():
return JsonResponse({
"error": "Client device must be self-signed with a signature matching its own public key.",
"code": "client_device_invalid_signature",
}, status=500)
# we have a valid self-signed Device, so now check if its public key has been registered
try:
registration = RegisteredDevicePublicKey.objects.get(public_key=client_device.public_key)
except RegisteredDevicePublicKey.DoesNotExist:
try:
device = Device.objects.get(public_key=client_device.public_key)
return JsonResponse({
"error": "This device has already been registered",
"code": "device_already_registered",
}, status=500)
except Device.DoesNotExist:
return JsonResponse({
"error": "Device registration with public key not found; login and register first?",
"code": "public_key_unregistered",
}, status=500)
client_device.signed_by = client_device
# the device checks out; let's save it!
client_device.save(imported=True)
# create the DeviceZone for the new device
device_zone = DeviceZone(device=client_device, zone=registration.zone)
device_zone.save()
# delete the RegisteredDevicePublicKey, now that we've initialized the device and put it in its zone
registration.delete()
# return our local (server) Device, its Zone, and the newly created DeviceZone, to the client
return JsonResponse(
serializers.serialize("versioned-json", [Device.get_own_device(), registration.zone, device_zone], dest_version=client_device.version, ensure_ascii=False)
)
def deserialize(data, *args, **kwargs):
"""
Similar to serialize, except for deserialization.
"""
return serializers.deserialize("versioned-json", data, *args, **kwargs)
def save_serialized_models(data,
increment_counters=True,
src_version=version.VERSION):
"""Unserializes models (from a device of version=src_version) in data and saves them to the django database.
If src_version is None, all unrecognized fields are (silently) stripped off.
If it is set to some value, then only fields of versions higher than ours are stripped off.
By defaulting to src_version=None, we're expecting a perfect match when we come in
(i.e. that wherever we got this data from, they were smart enough to "dumb it down" for us,
or they were old enough to have nothing unexpecting)
So, care must be taken in calling this function
Returns a dictionary of the # of saved models, # unsaved, and any exceptions during saving"""
from models import ImportPurgatory # cannot be top-level, otherwise inter-dependency of this and models fouls things up
# if data is from a purgatory object, load it up
if isinstance(data, ImportPurgatory):
purgatory = data
data = purgatory.serialized_models
else:
purgatory = None
# deserialize the models, either from text or a list of dictionaries
if isinstance(data, str) or isinstance(data, unicode):
models = serializers.deserialize("versioned-json",
data,
src_version=src_version,
dest_version=version.VERSION)
else:
models = serializers.deserialize("versioned-python",
data,
src_version=src_version,
dest_version=version.VERSION)
# try importing each of the models in turn
unsaved_models = []
exceptions = ""
saved_model_count = 0
try:
for modelwrapper in models:
try:
# extract the model from the deserialization wrapper
model = modelwrapper.object
# only allow the importing of models that are subclasses of SyncedModel
if not hasattr(model, "verify"):
raise ValidationError(
"Cannot save model: %s does not have a verify method (not a subclass of SyncedModel?)"
% model.__class__)
# TODO(jamalex): more robust way to do this? (otherwise, it might barf about the id already existing)
model._state.adding = False
# verify that all fields are valid, and that foreign keys can be resolved
model.full_clean()
# save the imported model (checking that the signature is valid in the process)
model.save(imported=True,
increment_counters=increment_counters)
# keep track of how many models have been successfully saved
saved_model_count += 1
except ValidationError as e: # the model could not be saved
# keep a running list of models and exceptions, to be stored in purgatory
exceptions += "%s: %s\n" % (model.pk, e)
unsaved_models.append(model)
# if the model is at least properly signed, try incrementing the counter for the signing device
# (because otherwise we may never ask for additional models)
try:
if increment_counters and model.verify():
model.signed_by.set_counter_position(model.counter)
except:
pass
except Exception as e:
exceptions += str(e)
# deal with any models that didn't validate properly; throw them into purgatory so we can try again later
if unsaved_models:
if not purgatory:
purgatory = ImportPurgatory()
# These models were successfully unserialized, so re-save in our own version.
purgatory.serialized_models = serializers.serialize(
"versioned-json",
unsaved_models,
ensure_ascii=False,
dest_version=version.VERSION)
purgatory.exceptions = exceptions
purgatory.model_count = len(unsaved_models)
purgatory.retry_attempts += 1
purgatory.save()
elif purgatory: # everything saved properly this time, so we can eliminate the purgatory instance
purgatory.delete()
out_dict = {
"unsaved_model_count": len(unsaved_models),
"saved_model_count": saved_model_count,
}
if exceptions:
out_dict["exceptions"] = exceptions
return out_dict
def register_device(request):
data = simplejson.loads(request.raw_post_data or "{}")
# attempt to load the client device data from the request data
if "client_device" not in data:
return JsonResponse({"error": "Serialized client device must be provided."}, status=500)
try:
# When hand-shaking on the device models, since we don't yet know the version,
# we have to just TRY with our own version.
#
# This is currently "central server" code, so
# this will only fail (currently) if the central server version
# is less than the version of a client--something that should never happen
try:
own_device = Device.get_own_device()
models = serializers.deserialize("versioned-json", data["client_device"], src_version=own_device.get_version(), dest_version=own_device.get_version())
except db_models.FieldDoesNotExist as fdne:
raise Exception("Central server version is lower than client version. This is ... impossible!")
client_device = models.next().object
except Exception as e:
return JsonResponse({
"error": "Could not decode the client device model: %r" % e,
"code": "client_device_corrupted",
}, status=500)
if not isinstance(client_device, Device):
return JsonResponse({
"error": "Client device must be an instance of the 'Device' model.",
"code": "client_device_not_device",
}, status=500)
if not client_device.verify():
return JsonResponse({
"error": "Client device must be self-signed with a signature matching its own public key.",
"code": "client_device_invalid_signature",
}, status=500)
# we have a valid self-signed Device, so now check if its public key has been registered
try:
registration = RegisteredDevicePublicKey.objects.get(public_key=client_device.public_key)
if registration.is_used():
if Device.objects.get(public_key=client_device.public_key):
return JsonResponse({
"error": "This device has already been registered",
"code": "device_already_registered",
}, status=500)
else:
# If not... we're in a very weird state--we have a record of their
# registration, but no device record.
# Let's just let the registration happens, so we can refresh things here.
# No harm, and some failsafe benefit.
# So, pass through... no code :)
pass
except RegisteredDevicePublicKey.DoesNotExist:
# This is the codepath for unregistered devices trying to start a session.
# This would only get hit, however, if they visit the registration page.
# But still, good to keep track of!
UnregisteredDevicePing.record_ping(id=client_device.id, ip=get_request_ip(request))
return JsonResponse({
"error": "Device registration with public key not found; login and register first?",
"code": "public_key_unregistered",
}, status=500)
client_device.signed_by = client_device
# the device checks out; let's save it!
client_device.save(imported=True)
# create the DeviceZone for the new device
device_zone = DeviceZone(device=client_device, zone=registration.zone)
device_zone.save()
# Use the RegisteredDevicePublicKey, now that we've initialized the device and put it in its zone
registration.use()
# return our local (server) Device, its Zone, and the newly created DeviceZone, to the client
return JsonResponse(
serializers.serialize("versioned-json", [Device.get_own_device(), registration.zone, device_zone], dest_version=client_device.version, ensure_ascii=False)
)
def register_device(request):
data = simplejson.loads(request.raw_post_data or "{}")
# attempt to load the client device data from the request data
if "client_device" not in data:
return JsonResponse(
{"error": "Serialized client device must be provided."},
status=500)
try:
# When hand-shaking on the device models, since we don't yet know the version,
# we have to just TRY with our own version.
#
# This is currently "central server" code, so
# this will only fail (currently) if the central server version
# is less than the version of a client--something that should never happen
try:
own_device = Device.get_own_device()
models = serializers.deserialize(
"versioned-json",
data["client_device"],
src_version=own_device.get_version(),
dest_version=own_device.get_version())
except db_models.FieldDoesNotExist as fdne:
raise Exception(
"Central server version is lower than client version. This is ... impossible!"
)
client_device = models.next().object
except Exception as e:
return JsonResponse(
{
"error": "Could not decode the client device model: %r" % e,
"code": "client_device_corrupted",
},
status=500)
if not isinstance(client_device, Device):
return JsonResponse(
{
"error":
"Client device must be an instance of the 'Device' model.",
"code": "client_device_not_device",
},
status=500)
if not client_device.verify():
return JsonResponse(
{
"error":
"Client device must be self-signed with a signature matching its own public key.",
"code": "client_device_invalid_signature",
},
status=500)
# we have a valid self-signed Device, so now check if its public key has been registered
try:
registration = RegisteredDevicePublicKey.objects.get(
public_key=client_device.public_key)
if registration.is_used():
if Device.objects.get(public_key=client_device.public_key):
return JsonResponse(
{
"error": "This device has already been registered",
"code": "device_already_registered",
},
status=500)
else:
# If not... we're in a very weird state--we have a record of their
# registration, but no device record.
# Let's just let the registration happens, so we can refresh things here.
# No harm, and some failsafe benefit.
# So, pass through... no code :)
pass
except RegisteredDevicePublicKey.DoesNotExist:
# This is the codepath for unregistered devices trying to start a session.
# This would only get hit, however, if they visit the registration page.
# But still, good to keep track of!
UnregisteredDevicePing.record_ping(id=client_device.id,
ip=get_request_ip(request))
return JsonResponse(
{
"error":
"Device registration with public key not found; login and register first?",
"code": "public_key_unregistered",
},
status=500)
client_device.signed_by = client_device
# the device checks out; let's save it!
client_device.save(imported=True)
# create the DeviceZone for the new device
device_zone = DeviceZone(device=client_device, zone=registration.zone)
device_zone.save()
# Use the RegisteredDevicePublicKey, now that we've initialized the device and put it in its zone
registration.use()
# return our local (server) Device, its Zone, and the newly created DeviceZone, to the client
return JsonResponse(
serializers.serialize(
"versioned-json",
[Device.get_own_device(), registration.zone, device_zone],
dest_version=client_device.version,
ensure_ascii=False))
