Changeset 150

Timestamp:

05/16/12 07:21:24 (13 years ago)

Author:

atzm

Message:

• add basic auth support to server

File:

• etherws/trunk/etherws.py (modified) (4 diffs)

etherws/trunk/etherws.py

@@ -45 +45 @@
 import sys
 import time
+import base64
+import hashlib
 import argparse
 import threading
@@ -138 +140 @@
 
 def server_main(args):
+    def may_auth_required(cls, users):
+        if not users:
+            return cls
+
+        orig_execute = cls._execute
+
+        def _execute(self, transforms, *args, **kwargs):
+            def auth_required():
+                self.stream.write(tornado.escape.utf8(
+                    'HTTP/1.1 401 Authorization Required\r\n'
+                    'WWW-Authenticate: Basic realm=etherws\r\n\r\n'
+                ))
+                self.stream.close()
+
+            try:
+                creds = self.request.headers.get('Authorization')
+
+                if not creds or not creds.startswith('Basic '):
+                    return auth_required()
+
+                creds = base64.b64decode(creds[6:])
+
+                if creds.find(':') < 0:
+                    return auth_required()
+
+                name, passwd = creds.split(':', 2)
+                passwd = base64.b64encode(hashlib.sha1(passwd).digest())
+
+                if name not in users or users[name] != passwd:
+                    return auth_required()
+
+                return orig_execute(self, transforms, *args, **kwargs)
+
+            except:
+                return auth_required()
+
+        cls._execute = _execute
+        return cls
+
+    def load_htpasswd(path):
+        users = {}
+        try:
+            with open(path) as fp:
+                for line in fp:
+                    line = line.strip()
+                    if 0 <= line.find(':'):
+                        name, passwd = line.split(':', 2)
+                        if passwd.startswith('{SHA}'):
+                            users[name] = passwd[5:]
+        except TypeError:
+            pass
+        return users
+
+    handler = may_auth_required(EtherWebSocket, load_htpasswd(args.htpasswd))
     ssl_options = {}
 
@@ -163 +219 @@
     tap = TapHandler(args.device, debug=args.debug)
     app = tornado.web.Application([
-        (args.path, EtherWebSocket, {'tap': tap, 'debug': args.debug}),
+        (args.path, handler, {'tap': tap, 'debug': args.debug}),
     ])
     server = tornado.httpserver.HTTPServer(app, ssl_options=ssl_options)
@@ -211 +267 @@
     parser_server.add_argument('--port', action='store', type=int)
     parser_server.add_argument('--path', action='store', default='/')
+    parser_server.add_argument('--htpasswd', action='store')
     parser_server.add_argument('--keyfile', action='store')
     parser_server.add_argument('--certfile', action='store')