builders: Fix API authentication

[pbs.git] / src / web / base.py

#!/usr/bin/python

import asyncio
import base64
import functools
import http.client
import json
import kerberos
import logging
import os
import socket
import time
import tornado.locale
import tornado.web
import tornado.websocket
import traceback

from .. import __version__
from .. import builders
from .. import misc
from .. import users
from ..decorators import *

# Setup logging
log = logging.getLogger("pbs.web.base")

class KerberosAuthMixin(object):
	"""
		A mixin that handles Kerberos authentication
	"""
	@property
	def kerberos_realm(self):
		return "IPFIRE.ORG"

	@property
	def kerberos_service(self):
		return self.settings.get("krb5-service", "HTTP")

	@property
	def kerberos_principal(self):
		return self.settings.get("krb5-principal", "pakfire/%s" % socket.getfqdn())

	def authenticate_redirect(self):
		"""
			Called when the application needs the user to authenticate.

			We will send a response with status code 401 and set the
			WWW-Authenticate header to ask the client to either initiate
			some Kerberos authentication, or to perform HTTP Basic authentication.
		"""
		# Ask the client to authenticate using Kerberos
		self.add_header("WWW-Authenticate", "Negotiate")

		# Ask the client to authenticate using HTTP Basic Auth
		self.add_header("WWW-Authenticate", "Basic realm=\"%s\"" % self.kerberos_realm)

		# Set status to 401
		self.set_status(401)

	@functools.cache
	def get_authenticated_user(self):
		auth_header = self.request.headers.get("Authorization", None)

		# No authentication header
		if not auth_header:
			return

		# Perform GSS API Negotiation
		if auth_header.startswith("Negotiate "):
			return self._auth_negotiate(auth_header)

		# Perform Basic Authentication
		elif auth_header.startswith("Basic "):
			return self._auth_basic(auth_header)

		# Fail on anything else
		else:
			raise tornado.web.HTTPError(400, "Unexpected Authentication attempt: %s" % auth_header)

	def _auth_negotiate(self, auth_header):
		auth_value = auth_header.removeprefix("Negotiate ")

		# Set keytab to use
		os.environ["KRB5_KTNAME"] = self.backend.settings.get("krb5-keytab")

		try:
			# Initialise the server session
			result, context = kerberos.authGSSServerInit(self.kerberos_service)

			if not result == kerberos.AUTH_GSS_COMPLETE:
				raise tornado.web.HTTPError(500, "Kerberos Initialization failed: %s" % result)

			# Check the received authentication header
			result = kerberos.authGSSServerStep(context, auth_value)

			# If this was not successful, we will fall back to Basic authentication
			if not result == kerberos.AUTH_GSS_COMPLETE:
				return self._auth_basic(auth_header)

			if not isinstance(self, tornado.websocket.WebSocketHandler):
				# Fetch the server response
				response = kerberos.authGSSServerResponse(context)

				# Send the server response
				self.set_header("WWW-Authenticate", "Negotiate %s" % response)

			# Return the user who just authenticated
			user = kerberos.authGSSServerUserName(context)

		except kerberos.GSSError as e:
			log.error("Kerberos Authentication Error: %s" % e)

			raise tornado.web.HTTPError(500, "Could not initialize the Kerberos context")

		finally:
			# Cleanup
			kerberos.authGSSServerClean(context)

		log.debug("Successfully authenticated %s" % user)

		return user

	def _auth_basic(self, auth_header):
		# Remove "Basic "
		auth_header = auth_header.removeprefix("Basic ")

		try:
			# Decode base64
			auth_header = base64.b64decode(auth_header).decode()

			username, password = auth_header.split(":", 1)
		except:
			raise tornado.web.HTTPError(400, "Authorization data was malformed")

		# Authenticate against Kerberos
		return self._auth_with_credentials(username, password)

	def _auth_with_credentials(self, username, password):

		# Set keytab to use
		os.environ["KRB5_KTNAME"] = self.backend.settings.get("krb5-keytab")

		# Check the credentials against the Kerberos database
		try:
			kerberos.checkPassword(username, password,
				self.kerberos_principal, self.kerberos_realm)

		# Catch any authentication errors
		except kerberos.BasicAuthError as e:
			log.error("Could not authenticate %s: %s" % (username, e))
			return

		# Create user principal name
		user = "%s@%s" % (username, self.kerberos_realm)

		log.debug("Successfully authenticated %s" % user)

		return user


class BaseHandler(tornado.web.RequestHandler):
	@property
	def backend(self):
		return self.application.backend

	@property
	def db(self):
		return self.backend.db

	@lazy_property
	def session(self):
		# Get the session from the cookie
		session_id = self.get_cookie("session_id", None)

		# Search for a valid database session
		if session_id:
			return self.backend.sessions.get(session_id)

	def get_current_user(self):
		if self.session:
			return self.session.user

	def get_user_locale(self):
		# Get the locale from the user settings
		if self.current_user:
			return self.current_user.locale

		# If no locale was provided, we take what ever the browser requested
		return self.get_browser_locale()

	@property
	def current_address(self):
		"""
			Returns the IP address the request came from.
		"""
		return self.request.headers.get("X-Real-IP") or self.request.remote_ip

	@property
	def user_agent(self):
		"""
			Returns the HTTP user agent
		"""
		return self.request.headers.get("User-Agent", None)

	def format_date(self, date, relative=True, shorter=False, full_format=False):
		return self.locale.format_date(date, relative=relative,
			shorter=shorter, full_format=full_format)

	def get_template_namespace(self):
		ns = tornado.web.RequestHandler.get_template_namespace(self)

		ns.update({
			"backend"         : self.backend,
			"hostname"        : self.request.host,
			"format_date"     : self.format_date,
			"format_size"     : misc.format_size,
			"version"         : __version__,
			"xsrf_token"      : self.xsrf_token,
			"year"            : time.strftime("%Y"),
		})

		return ns

	def write_error(self, code, exc_info=None, **kwargs):
		try:
			message = http.client.responses[code]
		except KeyError:
			message = None

		_traceback = []

		# Collect more information about the exception if possible.
		if exc_info:
			if self.current_user and isinstance(self.current_user, users.User):
				if self.current_user.is_admin():
					_traceback += traceback.format_exception(*exc_info)

		self.render("errors/error.html",
			code=code, message=message, traceback="".join(_traceback), **kwargs)

	# Typed Arguments

	def get_argument_bool(self, name):
		arg = self.get_argument(name, default=None)

		if arg:
			return arg.lower() in ("on", "true", "yes", "1")

		return False

	def get_argument_int(self, *args, **kwargs):
		arg = self.get_argument(*args, **kwargs)

		# Return nothing
		if not arg:
			return None

		try:
			return int(arg)
		except (TypeError, ValueError):
			raise tornado.web.HTTPError(400, "%s is not an integer" % arg)

	def get_argument_float(self, *args, **kwargs):
		arg = self.get_argument(*args, **kwargs)

		# Return nothing
		if not arg:
			return None

		try:
			return float(arg)
		except (TypeError, ValueError):
			raise tornado.web.HTTPError(400, "%s is not an float" % arg)

	def get_argument_builder(self, *args, **kwargs):
		name = self.get_argument(*args, **kwargs)

		if name:
			return self.backend.builders.get_by_name(name)

	def get_argument_distro(self, *args, **kwargs):
		slug = self.get_argument(*args, **kwargs)

		if slug:
			return self.backend.distros.get_by_slug(slug)

	# Uploads

	def _get_upload(self, uuid):
		upload = self.backend.uploads.get_by_uuid(uuid)

		# Check permissions
		if upload and not upload.has_perm(self.current_user):
			raise tornado.web.HTTPError(403, "%s has no permissions for upload %s" % (self.current_user, upload))

		return upload

	def get_argument_upload(self, *args, **kwargs):
		"""
			Returns an upload
		"""
		uuid = self.get_argument(*args, **kwargs)

		if uuid:
			return self._get_upload(uuid)

	def get_argument_uploads(self, *args, **kwargs):
		"""
			Returns a list of uploads
		"""
		uuids = self.get_arguments(*args, **kwargs)

		# Return all uploads
		return [self._get_upload(uuid) for uuid in uuids]

	def get_argument_user(self, *args, **kwargs):
		name = self.get_argument(*args, **kwargs)

		if name:
			return self.backend.users.get_by_name(name)

# XXX TODO
BackendMixin = BaseHandler

class APIError(tornado.web.HTTPError):
	"""
		Raised if there has been an error in the API
	"""
	def __init__(self, code, message):
		super().__init__(400, message)

		self.code = code
		self.message = message

	def __str__(self):
		return self.message


class APIMixin(KerberosAuthMixin):
	# Generally do not permit users to authenticate against the API
	allow_users = False

	# Allow builders to authenticate?
	allow_builders = True

	# Do not perform any XSRF cookie validation on API calls
	def check_xsrf_cookie(self):
		pass

	def get_current_user(self):
		"""
			Authenticates a user or builder
		"""
		# Fetch the Kerberos ticket
		principal = self.get_authenticated_user()

		# Return nothing if we did not receive any credentials
		if not principal:
			return

		logging.debug("Searching for principal %s..." % principal)

		# Strip the realm
		principal, delimiter, realm = principal.partition("@")

		# Return any builders
		if self.allow_builders and principal.startswith("host/"):
			hostname = principal.removeprefix("host/")

			return self.backend.builders.get_by_name(hostname)

		# Return any users
		if self.allow_users:
			return self.backend.users.get_by_name(principal)

	def get_user_locale(self):
		return self.get_browser_locale()

	@property
	def builder(self):
		"""
			This is a convenience handler to access a builder by a better name
		"""
		if isinstance(self.current_user, builders.Builder):
			return self.current_user

		raise AttributeError

	def get_compression_options(self):
		# Enable maximum compression
		return {
			"compression_level" : 9,
			"mem_level" : 9,
		}

	def write_error(self, code, exc_info):
		"""
			Sends a JSON-encoded error message
		"""
		type, error, traceback = exc_info

		# We only handle API errors here
		if not isinstance(error, APIError):
			return super().write_error(code, exc_info)

		# We send errors as 200
		self.set_status(200)

		self.finish({
			"error" : {
				"code"    : error.code,
				"message" : error.message,
			},
		})

	def _decode_json_message(self, message):
		# Decode JSON message
		try:
			message = json.loads(message)

		except json.DecodeError as e:
			log.error("Could not decode JSON message", exc_info=True)
			raise e

		# Log message
		log.debug("Received message:")
		log.debug("%s" % json.dumps(message, indent=4))

		return message


def negotiate(method):
	"""
		Requires clients to use SPNEGO
	"""
	@functools.wraps(method)
	def wrapper(self, *args, **kwargs):
		if not self.current_user:
			# Send the Negotiate header
			self.add_header("WWW-Authenticate", "Negotiate")

			# Respond with 401
			self.set_status(401)
			self.finish()

			return None

		return method(self, *args, **kwargs)

	return wrapper

class ratelimit(object):
	"""
		A decorator class which limits how often a function can be called
	"""
	def __init__(self, *, minutes, requests):
		self.minutes  = minutes
		self.requests = requests

	def __call__(self, method):
		@functools.wraps(method)
		async def wrapper(handler, *args, **kwargs):
			# Pass the request to the rate limiter and get a request object
			req = handler.backend.ratelimiter.handle_request(handler.request,
				handler, minutes=self.minutes, limit=self.requests)

			# If the rate limit has been reached, we won't allow
			# processing the request and therefore send HTTP error code 429.
			if await req.is_ratelimited():
				raise tornado.web.HTTPError(429, "Rate limit exceeded")

			# Call the wrapped method
			result = method(handler, *args, **kwargs)

			# Await it if it is a coroutine
			if asyncio.iscoroutine(result):
				return await result

			# Return the result
			return result

		return wrapper