Source Code for Module backend.server.rhnSession

  1  # 
  2  # Copyright (c) 2008--2016 Red Hat, Inc. 
  3  # 
  4  # This software is licensed to you under the GNU General Public License, 
  5  # version 2 (GPLv2). There is NO WARRANTY for this software, express or 
  6  # implied, including the implied warranties of MERCHANTABILITY or FITNESS 
  7  # FOR A PARTICULAR PURPOSE. You should have received a copy of GPLv2 
  8  # along with this software; if not, see 
  9  # http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt. 
 10  # 
 11  # Red Hat trademarks are not licensed under GPLv2. No permission is 
 12  # granted to use or replicate Red Hat trademarks that are incorporated 
 13  # in this software or its documentation. 
 14  # 
 15  # 
 16  # Session management 
 17  # 
 18   
 19   
 20  import hashlib 
 21  import time 
 22  import string 
 23  import sys 
 24   
 25  from spacewalk.common.rhnConfig import CFG 
 26  from spacewalk.common.usix import raise_with_tb 
 27   
 28  import rhnSQL 
 29   
 30   
 31 -class InvalidSessionError(Exception): 
 32      pass 
 33   
 34   
 35 -class ExpiredSessionError(Exception): 
 36      pass 
 37   
 38   
 39 -class Session: 
 40   
 41 -    def __init__(self, session_id=None): 
 42          self.session_id = session_id 
 43          self.expires = None 
 44          self.uid = None 
 45          self.duration = None 
 46   
 47 -    def generate(self, duration=None, web_user_id=None): 
 48          # Grabs a session ID 
 49          self.session_id = rhnSQL.Sequence('pxt_id_seq').next() 
 50          self.duration = int(duration or CFG.SESSION_LIFETIME) 
 51          self.web_user_id(web_user_id) 
 52          return self 
 53   
 54 -    def _get_secrets(self): 
 55          # Reads the four secrets from the config file 
 56          return list(map(lambda x, cfg=CFG: getattr(cfg, 'session_secret_%s' % x), 
 57                      range(1, 5))) 
 58   
 59 -    def get_secrets(self): 
 60          # Validates the secrets from the config file 
 61          secrets = self._get_secrets() 
 62          if len(secrets) != len([_f for _f in secrets if _f]): 
 63              # the list of secrets has unset items 
 64              raise Exception("Secrets not set in the config file") 
 65          return secrets 
 66   
 67 -    def digest(self): 
 68          if self.session_id is None: 
 69              raise ValueError("session id not supplied") 
 70   
 71          secrets = self.get_secrets() 
 72   
 73          ctx = hashlib.new('sha256') 
 74          ctx.update(string.join(secrets[:2] + [str(self.session_id)] + 
 75                                 secrets[2:], ':')) 
 76   
 77          return string.join(["%02x" % ord(a) for a in ctx.digest()], '') 
 78   
 79 -    def get_session(self): 
 80          return "%sx%s" % (self.session_id, self.digest()) 
 81   
 82 -    def web_user_id(self, uid=None): 
 83          if uid: 
 84              self.uid = uid 
 85          return self.uid 
 86   
 87 -    def load(self, session): 
 88          arr = string.split(session, 'x', 1) 
 89          if len(arr) != 2: 
 90              raise InvalidSessionError("Invalid session string") 
 91   
 92          digest = arr[1] 
 93          if len(digest) != 64: 
 94              raise InvalidSessionError("Invalid session string (wrong length)") 
 95   
 96          try: 
 97              self.session_id = int(arr[0]) 
 98          except ValueError: 
 99              raise_with_tb(InvalidSessionError("Invalid session identifier"), sys.exc_info()[2]) 
100   
101          if digest != self.digest(): 
102              raise InvalidSessionError("Bad session checksum") 
103   
104          h = rhnSQL.prepare(""" 
105              select web_user_id, expires, value 
106                from pxtSessions 
107               where id = :session_id 
108          """) 
109          h.execute(session_id=self.session_id) 
110   
111          row = h.fetchone_dict() 
112          if row: 
113              # Session is stored in the DB 
114              if time.time() < row['expires']: 
115                  # And it's not expired yet - good to go 
116                  self.expires = row['expires'] 
117                  self.uid = row['web_user_id'] 
118                  return self 
119   
120              # Old session - clean it up 
121              h = rhnSQL.prepare(""" 
122                      delete from pxtSessions where id = :session_id 
123              """) 
124              h.execute(session_id=self.session_id) 
125              rhnSQL.commit() 
126   
127          raise ExpiredSessionError("Session not found") 
128   
129 -    def save(self): 
130          expires = int(time.time()) + self.duration 
131   
132          h = rhnSQL.prepare(""" 
133                  insert into PXTSessions (id, web_user_id, expires, value) 
134                  values (:id, :web_user_id, :expires, :value) 
135          """) 
136          h.execute(id=self.session_id, web_user_id=self.uid, 
137                    expires=expires, value='RHNAPP') 
138          rhnSQL.commit() 
139          return self 
140   
141   
142 -def load(session_string): 
143      return Session().load(session_string) 
144   
145   
146 -def generate(web_user_id=None, duration=None): 
147      return Session().generate(web_user_id=web_user_id, duration=duration).save() 
148