def _restore_master_secret(self, backup_file, encrypt_master_secret, passphrase, salt):
"""Restore secret from file.
Decode secret if encrypted.
"""
try:
with open(backup_file) as json_file:
backup = json.load(json_file)
except ValueError:
raise SecretsError('Master Secret backup file is corrupted.')
if encrypt_master_secret:
tag, plaintext = crypto.aes_gcm_decrypt(
aes_key=generate_aes_key(passphrase, salt),
iv=str(backup['IV'].decode('hex')),
header=str(backup['startTime']),
ciphertext=str(backup['ciphertext'].decode('hex')))
# Check authentication tag
if backup['tag'] != tag:
raise SecretsError('AES-GSM Decryption Failed. Authentication tag is not correct')
self.start_time = Time.ISOtoDateTime(str(backup['startTime']))
master_secret = plaintext.decode('hex')
else:
self.start_time = Time.ISOtoDateTime(backup['startTime'])
master_secret = backup['master_secret_hex'].decode('hex')
return master_secret, self.start_time
def generate_qr(self, wId):
webOTT = secrets.generate_ott(options.OTTLength,
self.application.server_secret.rng,
"hex")
nowTime = Time.syncedNow()
expirePinPadTime = nowTime + datetime.timedelta(
seconds=options.accessNumberExpireSeconds)
expireTime = expirePinPadTime + datetime.timedelta(
seconds=options.accessNumberExtendValiditySeconds)
self.storage.add(stage="auth",
expire_time=expireTime,
webOTT=webOTT,
wid=wId)
qrUrl = options.rpsBaseURL + "#" + wId
params = {
"ttlSeconds": options.accessNumberExpireSeconds,
"qrUrl": qrUrl,
"webOTT": webOTT,
"localTimeStart": Time.DateTimetoEpoch(nowTime),
"localTimeEnd": Time.DateTimetoEpoch(expirePinPadTime)
}
return params
def _verifySignature(self):
identity = self.get_argument("i", default="")
expires = self.get_argument("e", default="")
signature = self.get_argument("s", default="")
log.debug("/mpinActivate request for identity: {0}".format(identity))
try:
data = json.loads(identity.decode("hex"))
userid = data["userID"]
issued = data["issued"]
sIssued = Time.DateTimetoHuman(Time.ISOtoDateTime(issued))
mobile = int(data.get("mobile") or 0)
except Exception as E:
log.error("Error parsing the verification email: {0}".format(E))
userid, issued, sIssued = None, None, None
if userid:
if expires < datetime.datetime.utcnow().isoformat(b"T").split(
".")[0] + "Z":
isValid = False
info = "Link expired"
else:
isValid = True
info = ""
deviceName = mobile and "Mobile" or "PC"
else:
log.error("/mpinActivate: Invalid IDENTITY: {0}".format(identity))
isValid, info = False, "Invalid identity"
deviceName, issued = "", ""
params = {
"isValid": isValid,
"identity": identity,
"errorMessage": info,
"userid": userid,
"issued": issued,
"humanIssued": sIssued,
"activated": False,
"deviceName": deviceName,
"activateKey": signature
}
return params
def _schedule_expiration_check(self):
if self._timeout:
self.ioloop.remove_timeout(self._timeout)
self._timeout = None
while len(self._expires_list) > 0:
item_expiration, item_id = self._expires_list[0]
try:
item = self._items[item_id]
except KeyError:
del self._expires_list[0]
continue
now = Time.syncedNow()
if not item._active or item_expiration < now:
del self._expires_list[0]
del self._items[item_id]
self._delete_from_indexes(item)
continue
# No more expired items, schedule next check
self._timeout = self.ioloop.add_timeout(
item_expiration - now + datetime.timedelta(milliseconds=100),
self._schedule_expiration_check)
break
self._storage_change()
def _schedule_expiration_check(self):
if self._timeout:
self.ioloop.remove_timeout(self._timeout)
self._timeout = None
while len(self._expires_list) > 0:
item_expiration, item_id = self._expires_list[0]
try:
item = self._items[item_id]
except KeyError:
del self._expires_list[0]
continue
now = Time.syncedNow()
if not item._active or item_expiration < now:
del self._expires_list[0]
del self._items[item_id]
self._delete_from_indexes(item)
continue
# No more expired items, schedule next check
self._timeout = self.ioloop.add_timeout(
item_expiration - now + datetime.timedelta(milliseconds=100),
self._schedule_expiration_check
)
break
self._storage_change()
def get(self):
reason = "OK"
self.set_status(200, reason=reason)
start_time_str = Time.DateTimeToISO(
self.application.master_secret.start_time),
self.write({
'startTime': start_time_str,
'service_name': 'D-TA server',
'message': reason
})
return
def _get_server_secret(self):
expires = Time.syncedISO(seconds=SIGNATURE_EXPIRES_OFFSET_SECONDS)
certivox_server_secret = self._get_certivox_server_secret_share(expires)
customer_server_secret = self._get_customer_server_secret_share(expires)
try:
server_secret_hex = crypto.mpin_recombine_g2(certivox_server_secret, customer_server_secret)
except crypto.CryptoError as e:
log.error(e)
raise SecretsError('M-Pin Server Secret Generation Failed')
return server_secret_hex.decode("hex")
def validate_pass2_value(self, mpin_id, u, ut, y, v):
"""Validate pass2 value.
y - pass 1 values
v - pass 2 value in question
"""
date = crypto.today()
check_dates = [date]
if Time.syncedNow().hour < 1:
check_dates.append(date - 1)
for date in check_dates:
hid, htid = crypto.mpin_server_1(mpin_id, date)
success, _, _ = crypto.mpin_server_2(self.server_secret, v, date, hid, htid, y, u, ut)
if success != -19:
break
return success
def __init__(self, storage, expire_time, **kwargs):
'''expireTime should be in ISO format'''
self.__fields = ["_id", "_active", "_expires"]
self.__storage = storage
self._id = uuid.uuid1().hex
if isinstance(expire_time, datetime.datetime):
self._expires = expire_time.isoformat()
else:
self._expires = expire_time
self._update_item(**kwargs)
self._expiration_datetime = None
if self._expires:
self._expiration_datetime = Time.ISOtoDateTime(self._expires)
self.__storage.update_index(self)
def generate_qr(self, wId):
webOTT = secrets.generate_ott(options.OTTLength, self.application.server_secret.rng, "hex")
nowTime = Time.syncedNow()
expirePinPadTime = nowTime + datetime.timedelta(seconds=options.accessNumberExpireSeconds)
expireTime = expirePinPadTime + datetime.timedelta(seconds=options.accessNumberExtendValiditySeconds)
self.storage.add(stage="auth", expire_time=expireTime, webOTT=webOTT, wid=wId)
qrUrl = options.rpsBaseURL + "#" + wId
params = {
"ttlSeconds": options.accessNumberExpireSeconds,
"qrUrl": qrUrl,
"webOTT": webOTT,
"localTimeStart": Time.DateTimetoEpoch(nowTime),
"localTimeEnd": Time.DateTimetoEpoch(expirePinPadTime)
}
return params
def __init__(self):
handlers = [
(r"/clientSecret", ClientSecretHandler),
(r"/serverSecret", ServerSecretHandler),
(r"/timePermit", TimePermitHandler),
(r"/timePermits", TimePermitsHandler),
(r"/status", StatusHandler),
(r"/(.*)", DefaultHandler),
]
settings = dict(xsrf_cookies=False)
super(Application, self).__init__(handlers, **settings)
Seed.getSeed(options.EntropySources
) # Get seed value for random number generator
self.master_secret = secrets.MasterSecret(
passphrase=options.passphrase,
salt=options.salt,
seed=Seed.seedValue,
backup_file=options.backup_file,
encrypt_master_secret=options.encrypt_master_secret,
time=Time.syncedNow())
def add(self, key, expires, value):
if expires:
self._execute("setex", key, (expires - Time.syncedNow()), value)
else:
self._execute("set", key, value)
def today():
"""Return time in slots since epoch using synced time"""
utc_dt = datetime.datetime.utcfromtimestamp(0)
return int((Time.syncedNow() - utc_dt).total_seconds() / 86400)
def get(self):
# Remote request information
if 'User-Agent' in self.request.headers.keys():
UA = self.request.headers['User-Agent']
else:
UA = 'unknown'
request_info = '%s %s %s %s ' % (
self.request.method, self.request.path, self.request.remote_ip, UA)
# Get arguments
try:
app_id = str(self.get_argument('app_id'))
expires = self.get_argument('expires')
signature = self.get_argument('signature')
except tornado.web.MissingArgumentError as ex:
reason = ex.log_message
log.error("%s %s" % (request_info, reason))
self.set_status(403, reason=reason)
self.content_type = 'application/json'
self.write({'message': reason})
self.finish()
return
request_info = request_info + app_id
# Get path used for signature
path = self.request.path
path = path.replace("/", "")
# Check signature is valid and that timestamp has not expired
M = str("%s%s%s" % (path, Keys.app_id, expires))
valid, reason, code = verifySignature(M, signature, Keys.app_key,
expires)
if not valid:
return_data = {'code': code, 'message': reason}
log.error("%s %s" % (request_info, reason))
self.set_status(status_code=code, reason=reason)
self.content_type = 'application/json'
self.write(return_data)
self.finish()
return
try:
server_secret_hex = self.application.master_secret.get_server_secret(
)
except secrets.SecretsError as e:
log.error(
'M-Pin Server Secret Generation Failed: {0}. Request info: {1}'
.format(e, request_info))
return_data = {
'errorCode': e.message,
'reason': 'M-Pin Server Secret Generation Failed',
}
self.set_status(500, reason=reason)
self.content_type = 'application/json'
self.write(return_data)
self.finish()
return
# Hash server secret share
server_secret = server_secret_hex.decode("hex")
hash_server_secret_hex = hashlib.sha256(server_secret).hexdigest()
log.info("%s hash_server_secret_hex: %s" %
(request_info, hash_server_secret_hex))
# Returned data
reason = "OK"
self.set_status(200, reason=reason)
self.content_type = 'application/json'
return_data = {
'serverSecret':
server_secret_hex,
'startTime':
Time.DateTimeToISO(self.application.master_secret.start_time),
'message':
reason
}
self.write(return_data)
log.debug("%s %s" % (request_info, return_data))
self.finish()
return
def today():
"""Return time in slots since epoch using synced time"""
utc_dt = datetime.datetime.utcfromtimestamp(0)
return int((Time.syncedNow() - utc_dt).total_seconds() / 86400)
try:
credentialsFile = options.credentialsFile
Keys.loadFromFile(credentialsFile)
except Exception as E:
log.error(
"Error opening the credentials file: {0}".format(credentialsFile))
log.error(E)
sys.exit(1)
# TMP fix for 'ValueError: I/O operation on closed epoll fd'
# Fixed in Tornado 4.2
tornado.ioloop.IOLoop.instance()
# Sync time to CertiVox time server
if options.syncTime:
Time.getTime(wait=True)
if options.backup and options.encrypt_master_secret and not options.passphrase:
options.passphrase = getpass.getpass("Please enter passphrase:")
http_server = Application()
http_server.listen(options.port, options.address, xheaders=True)
io_loop = tornado.ioloop.IOLoop.instance()
if options.autoReload:
log.debug("Starting autoreloader")
tornado.autoreload.watch(CONFIG_FILE)
tornado.autoreload.start(io_loop)
if options.syncTime and (options.timePeriod > 0):
scheduler = tornado.ioloop.PeriodicCallback(Time.getTime,
def add(self, key, expires, value):
if expires:
self._execute("setex", key, (expires - Time.syncedNow()), value)
else:
self._execute("set", key, value)