diff --git a/web/backend/config.sample.json b/web/backend/config.sample.json index cb7625b..be34908 100644 --- a/web/backend/config.sample.json +++ b/web/backend/config.sample.json @@ -1,13 +1,13 @@ { "nodes": { "": { - "pub-endpoint": "", //optional, recommended - "api-con": "http://:/", // required + "pub-endpoint": "", + "api-con": "http://:/", "comment": "/* from here: data to be displayed on the webinterface */", "country": "...", // Countrycode: 2 capital letters "city": "...", - "wg-key": "...=", // pubkey of node; required - "internal-v4": "172.2x.xxx.xxx", //at least one ipv{4,6} addr required + "wg-key": "...=", // pubkey of node + "internal-v4": "172.2x.xxx.xxx", "internal-v6": "fdxx:...", "internal-v4ll": "169.254.xxx.xxx", "internal-v6ll": "fe80::..." @@ -17,8 +17,7 @@ "listen": "0.0.0.0", "port": 8042, "domain": "example.org", // domain to use for kioubit verification service - "base-dir": "/", //optional:directury for which it is reachable (if behind some sort of reverse proxy) default "/" - "debug-mode": false, // optional; whethet to enable debugging; default false "flask-secret-key": "", // secret key for session cookies + "flask-debug": false, // optional; default false "flask-template-dir": "../frontend/" // optional; default "../frontend" } \ No newline at end of file diff --git a/web/backend/kioubit_verify.py b/web/backend/kioubit_verify.py index 1f9d3d2..24cb8ec 100644 --- a/web/backend/kioubit_verify.py +++ b/web/backend/kioubit_verify.py @@ -1,8 +1,8 @@ #! /usr/bin/env python3 -import base64, os, json, time -import OpenSSL +import base64, os from OpenSSL.crypto import load_publickey, FILETYPE_PEM, verify, X509 +import OpenSSL PUBKEY_FILE = os.path.dirname(__file__)+"/kioubit-auth-pubkey.pem" @@ -33,18 +33,12 @@ class AuthVerifyer (): verify(self.x509, sig, params, 'sha512') except OpenSSL.crypto.Error: return False, "Signature Failed" - - try: - user_data = json.loads(base64.b64decode(params)) - if (time.time() - user_data["time"] )> 60: - return False, "Signature to old" - except json.decoder.JSONDecodeError: - # we shouldn't get here unless kioubit's service is misbehaving - return False, "invalid JSON" - except KeyError: - return False, "value not found in JSON" - print(user_data) - return True, user_data + #h = SHA512.new() + #h.update(base64.b64decode(params)) + #print(h.hexdigest()) + #verifier = DSS.new(self.pubkey, 'deterministic-rfc6979') + #valid = verifier.verify(h, base64.b64decode(signature)) + return True, "" if __name__ == "__main__": example_com_verifier = AuthVerifyer("example.com") diff --git a/web/backend/main.py b/web/backend/main.py index 76c91ba..296d167 100644 --- a/web/backend/main.py +++ b/web/backend/main.py @@ -36,10 +36,9 @@ class Config (dict): if not "flask-template-dir" in self._config: self._config["flask-template-dir"] = "../frontend" - if not "debug-mode" in self._config: - self._config["debug-mode"] = False - if not "base-dir" in self._config: - self._config["base-dir"] = "/" + if not "flask-debug" in self._config: + self._config["flask-debug"] = False + print(self._config) config = Config() @@ -48,7 +47,7 @@ def auth_required(): def wrapper(f): @wraps(f) def decorated(*args, **kwargs): - if not "login" in session: + if not "logged_in" in session: return redirect(f"login?return={request.url}") else: return f(*args, **kwargs) @@ -59,71 +58,37 @@ def auth_required(): kverifyer = kioubit_verify.AuthVerifyer(config["domain"]) @app.route("/api/auth/kverify", methods=["GET", "POST"]) def kioubit_auth(): - try: - params = request.args["params"] - signature = request.args["signature"] - except KeyError: - return render_template("login.html", session=session,config=config,return_addr=session["return_url"], msg='"params" or "signature" missing') + params = request.args["params"] + signature = request.args["signature"] + print(base64.b64decode(params)) + return str(kverifyer.verify(params, signature)) - - success, msg = kverifyer.verify(params, signature) - try: print(base64.b64decode(params)) - except: print("invalid Base64 data provided") - - - if success: - session["user-data"] = msg - session["login"] = msg['mnt'] - return redirect(session["return_url"]) - else: - return render_template("login.html", session=session,config=config,return_addr=session["return_url"], msg=msg) - -@app.route("/logout") -def logout(): - session.clear() - return redirect("/") @app.route("/login",methods=["GET","POST"]) def login(): if request.method == "GET": - session["return_url"] = request.args["return"] if "return" in request.args else "" - - return render_template("login.html", session=session, config=config, return_addr=session["return_url"]) - elif request.method == "POST": - if config["domain"] == "svc.burble.dn42:8042" and request.form["logincode"] and request.form["logincode"] == "eyJhc24iOjQyNDI0MjMwMzUsImFsbG93ZWQ0IjoiMTcyLjIyLjEyNS4xMjhcLzI2LDE3Mi4yMC4wLjgxXC8zMiIsImFsbG93ZWQ2IjoiZmQ2Mzo1ZDQwOjQ3ZTU6OlwvNDgsZmQ0MjpkNDI6ZDQyOjgxOjpcLzY0IiwibW50IjoiTEFSRS1NTlQifQo=": - print("abc") - user_data = json.loads(base64.b64decode(request.form["logincode"])) - session["login"] = user_data['mnt'] - session["user-data"] = user_data - return redirect(request.args["return"]) + session["return_url"] = request.args["return"] + return render_template("login.html", config=config, return_addr=request.args["return"]) + #elif request.method == "POST": @app.route("/peer", methods=["GET","POST"]) @auth_required() def peer(): - if request.method == "GET": - if "node" in request.args and request.args["node"] in config["nodes"]: - return render_template("peer.html", config=config, selected_node=request.args["node"]) - return str(config["nodes"][request.args["node"]]) - else: return render_template("peer.html", session=session,config=config) - elif request.method == "POST": - return "POST /peer" - - else: - return 405 - + return request.args + @app.route("/") def index(): # print(config._config["nodes"]) # for node in config["nodes"].values(): # print (node) - return render_template("index.html", session=session, config=config._config) + return render_template("index.html", config=config._config) def main(): app.static_folder= config["flask-template-dir"]+"/static/" app.template_folder=config["flask-template-dir"] app.secret_key = config["flask-secret-key"] - app.run(host=config["listen"], port=config["port"], debug=config["debug-mode"], threaded=True) + app.run(host=config["listen"], port=config["port"], debug=config["flask-debug"], threaded=True) if __name__ == "__main__": diff --git a/web/frontend/base.html b/web/frontend/base.html index b1b1d8a..956236b 100644 --- a/web/frontend/base.html +++ b/web/frontend/base.html @@ -5,14 +5,11 @@ {{config["MNT"]}} Autopeering - + -
{{config["MNT"]}} Autopeering{% if "login" in session %}logout{% else %} login{%endif%}
-
- {% block content %} - {% endblock %} -
+
{{config["MNT"]}}
+
{% block content %}{% endblock %}