March 2014 - tor-commits - lists.torproject.org

[bridgedb/develop] Rewrite docstring for bridgedb.captcha.ReCaptcha.get().
by isis＠torproject.org 16 Mar '14

16 Mar '14

commit 88d09044dd718d0b9ac706a095f252e8e8f4b44a Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Mar 1 03:17:06 2014 +0000 Rewrite docstring for bridgedb.captcha.ReCaptcha.get(). --- lib/bridgedb/captcha.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/lib/bridgedb/captcha.py b/lib/bridgedb/captcha.py index cd53cd7..fea4b44 100644 --- a/lib/bridgedb/captcha.py +++ b/lib/bridgedb/captcha.py @@ -74,8 +74,14 @@ class ReCaptcha(Captcha): super(ReCaptcha, self).__init__() def get(self): - """ gets a fresh captcha """ - + """Retrieve a CAPTCHA from the reCaptcha API server. + + This simply requests a new CAPTCHA from + ``recaptcha.client.captcha.API_SSL_SERVER`` and parses the returned + HTML to extract the CAPTCHA image and challenge string. The image is + stored at ``ReCaptcha.image`` and the challenge string at + ``ReCaptcha.challenge``. + """ if (self.pubkey == '') or (self.privkey == ''): raise ReCaptchaKeyError urlbase = recaptcha.API_SERVER

1 0

[bridgedb/develop] Pep8; move ReCaptchaKeyError to the beginning of captcha.py.
by isis＠torproject.org 16 Mar '14

16 Mar '14

commit 624e60cda89faa6cd6e032feba59078478b50169 Author: Isis Lovecruft <isis(a)torproject.org> Date: Fri Feb 28 23:38:55 2014 +0000 Pep8; move ReCaptchaKeyError to the beginning of captcha.py. --- lib/bridgedb/captcha.py | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/lib/bridgedb/captcha.py b/lib/bridgedb/captcha.py index 430643c..67b23d3 100644 --- a/lib/bridgedb/captcha.py +++ b/lib/bridgedb/captcha.py @@ -38,6 +38,13 @@ from BeautifulSoup import BeautifulSoup from recaptcha.client import captcha as recaptcha +class ReCaptchaKeyError(Exception): + """Exception raised when recaptcha API keys are not supplied""" + + def __init__(self): + msg = 'You must supply recaptcha API keys' + Exception.__init__(self, msg) + class ReCaptcha(object): """ A recaptcha captcha and method to request them """ @@ -62,8 +69,3 @@ class ReCaptcha(object): self.challenge = str(soup.find('input', {'name' : 'recaptcha_challenge_field'})['value']) self.image = urllib2.urlopen(imgurl).read() -class ReCaptchaKeyError(Exception): - """ Exception raised when recaptcha API keys are not supplied""" - def __init__(self): - msg = 'You must supply recaptcha API keys' - Exception.__init__(self, msg)

1 0

[bridgedb/develop] Make a log message in CaptchaProtectedResource more general.
by isis＠torproject.org 16 Mar '14

16 Mar '14

commit a16b663ae13482ad144edf5f44ae8f84d62d2754 Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue Mar 4 08:27:32 2014 +0000 Make a log message in CaptchaProtectedResource more general. --- lib/bridgedb/HTTPServer.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/bridgedb/HTTPServer.py b/lib/bridgedb/HTTPServer.py index ae14f62..5a9d5a3 100644 --- a/lib/bridgedb/HTTPServer.py +++ b/lib/bridgedb/HTTPServer.py @@ -220,7 +220,7 @@ class CaptchaProtectedResource(twisted.web.resource.Resource): rendered = replaceErrorPage(err) return rendered - logging.debug("Client failed a recaptcha; returning redirect to %s" + logging.debug("Client failed a CAPTCHA; returning redirect to %s" % request.uri) return redirectTo(request.uri, request)

1 0

[bridgedb/develop] Add GIMP_CAPTCHA_ENABLED and GIMP_CAPTCHA_DIR options.
by isis＠torproject.org 16 Mar '14

16 Mar '14

commit 08624169a25d601c336706e48db4405921011260 Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Mar 1 01:38:51 2014 +0000 Add GIMP_CAPTCHA_ENABLED and GIMP_CAPTCHA_DIR options. --- bridgedb.conf | 11 ++++++++++- lib/bridgedb/Main.py | 3 ++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/bridgedb.conf b/bridgedb.conf index d223875..f1bf16c 100644 --- a/bridgedb.conf +++ b/bridgedb.conf @@ -15,11 +15,14 @@ # for details. # :copyright: (c) 2007-2013 The Tor Project, Inc. # (c) 2007-2013, all sentient entities within the AUTHORS file -# :version: 0.0.3 +# :version: 0.0.5 #=============================================================================== # # CHANGELOG: # ~~~~~~~~~~ +# Changes in version 0.0.5 - 2014-02-27 +# * ADD GIMP_CAPTCHA_ENABLED and GIMP_CAPTCHA_DIR settings (see #10809). +# # Changes in version 0.0.4 - 2014-01-24 # * ADD COLLECT_TIMESTAMPS option (see #10724). Set it to False for the # staging instance (etc/test-bridgedb.conf), and True for the production @@ -226,6 +229,12 @@ RECAPTCHA_PRIV_KEY = '' # The remoteip we send to reCAPTCHA during verification RECAPTCHA_REMOTEIP = '' +# If true, use a local cache of generated CAPTCHAs: +GIMP_CAPTCHA_ENABLED = True + +# The directory for the local CAPTCHA cache: +GIMP_CAPTCHA_DIR = 'captchas' + #------------------------------- # Email Distribution Options \ #------------------------------------------------------------------------------ diff --git a/lib/bridgedb/Main.py b/lib/bridgedb/Main.py index 36e4e88..be8b1b0 100644 --- a/lib/bridgedb/Main.py +++ b/lib/bridgedb/Main.py @@ -282,7 +282,8 @@ def loadConfig(configFile=None, configCls=None): for attr in ["DB_FILE", "DB_LOG_FILE", "MASTER_KEY_FILE", "PIDFILE", "ASSIGNMENTS_FILE", "HTTPS_CERT_FILE", "HTTPS_KEY_FILE", - "LOG_FILE", "STATUS_FILE", "COUNTRY_BLOCK_FILE"]: + "LOG_FILE", "STATUS_FILE", "COUNTRY_BLOCK_FILE", + "GIMP_CAPTCHA_DIR"]: setting = getattr(config, attr, None) if setting is None: setattr(config, attr, setting)

1 0

[bridgedb/develop] Import entire bridgedb.captcha module in bridgedb.HTTPServer.
by isis＠torproject.org 16 Mar '14

16 Mar '14

commit 4f6e5dc3ee1208a30030e0c8d7fc9ad22d0db319 Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Mar 1 01:41:17 2014 +0000 Import entire bridgedb.captcha module in bridgedb.HTTPServer. --- lib/bridgedb/HTTPServer.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/bridgedb/HTTPServer.py b/lib/bridgedb/HTTPServer.py index 2d5fd72..63e48c9 100644 --- a/lib/bridgedb/HTTPServer.py +++ b/lib/bridgedb/HTTPServer.py @@ -27,7 +27,7 @@ import bridgedb.I18n as I18n import bridgedb.Util as Util from recaptcha.client import captcha as recaptcha -from bridgedb.captcha import ReCaptcha +from bridgedb import captcha from bridgedb.Filters import filterBridgesByIP6, filterBridgesByIP4 from bridgedb.Filters import filterBridgesByTransport from bridgedb.Filters import filterBridgesByNotBlockedIn @@ -144,7 +144,7 @@ class CaptchaProtectedResource(twisted.web.resource.Resource): :returns: A rendered HTML page containing a ReCaptcha challenge image for the client to solve. """ - c = ReCaptcha(self.recaptchaPubKey, self.recaptchaPrivKey) + c = captcha.ReCaptcha(self.recaptchaPubKey, self.recaptchaPrivKey) try: c.get()

1 0

[bridgedb/develop] Add bridgedb.captcha.GimpCaptcha implementation.
by isis＠torproject.org 16 Mar '14

16 Mar '14

commit f387a0a4d4bc5eeba6d0d8c965ebe35959ff5ce7 Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue Mar 4 08:28:51 2014 +0000 Add bridgedb.captcha.GimpCaptcha implementation. * ADD GimpCaptcha class, which handles retrieving cached CAPTCHAs from a local directory, creating challenge strings from the CAPTCHA answers, and later checking a client's proposed solution against the challenge. * FIXES #10809. --- lib/bridgedb/captcha.py | 74 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 74 insertions(+) diff --git a/lib/bridgedb/captcha.py b/lib/bridgedb/captcha.py index 07b06d4..a76303f 100644 --- a/lib/bridgedb/captcha.py +++ b/lib/bridgedb/captcha.py @@ -32,6 +32,10 @@ gimp-captcha_ and then cached locally. .. _gimp-captcha: https://github.com/isislovecruft/gimp-captcha """ +import hashlib +import logging +import random +import os import urllib2 from BeautifulSoup import BeautifulSoup @@ -46,6 +50,9 @@ class ReCaptchaKeyError(Exception): msg = 'You must supply recaptcha API keys' Exception.__init__(self, msg) +class GimpCaptchaError(Exception): + """General exception raised when a Gimp CAPTCHA cannot be retrieved.""" + class ICaptcha(Interface): """Interface specification for CAPTCHAs.""" image = Attribute("A CAPTCHA image.") @@ -64,6 +71,7 @@ class Captcha(object): def get(self): return self.image + class ReCaptcha(Captcha): """A reCaptcha CAPTCHA.""" @@ -94,3 +102,69 @@ class ReCaptcha(Captcha): self.challenge = str(soup.find('input', {'name' : 'recaptcha_challenge_field'})['value']) self.image = urllib2.urlopen(imgurl).read() + +class GimpCaptcha(Captcha): + """A cached CAPTCHA image which was created with Gimp.""" + + def __init__(self, cacheDir=None, clientIP=None): + """Create a ``GimpCaptcha`` which retrieves images from **cacheDir**. + + :raises GimpCaptchaError: if **cacheDir** is not a directory. + """ + if not os.path.isdir(cacheDir): + raise GimpCaptchaError("Gimp captcha cache isn't a directory: %r" + % cacheDir) + + self.image = None + self.challenge = None + self.cacheDir = cacheDir + self.clientIP = clientIP + super(GimpCaptcha, self).__init__() + + @classmethod + def check(cls, challenge, answer, clientIP=None): + """Check a client's CAPTCHA solution against the **challenge**. + + :rtype: bool + :returns: True if the CAPTCHA solution was correct. + """ + logging.debug("Checking CAPTCHA solution %r against challenge %r" + % (answer, challenge)) + solution = cls.createChallenge(answer, clientIP) + if (not challenge) or (challenge != solution): + return False + return True + + @classmethod + def createChallenge(cls, answer, clientIP=None): + """Hash a CAPTCHA answer together with a **clientIP**, if given. + + :param str answer: The answer (either actual, or a client's proposed + solution) to a CAPTCHA. + :param str clientIP: The client's IP address. + """ + challenge = '\n'.join([answer, str(clientIP)]) + return hashlib.sha256(challenge).hexdigest() + + def get(self): + """Get a random CAPTCHA from the cache directory. + + :raises GimpCaptchaError: if the chosen CAPTCHA image file could not + be read. + :returns: A 2-tuple of ``(captcha, None)``, where ``captcha`` is the + image file contents. + """ + imageFilename = random.choice(os.listdir(self.cacheDir)) + imagePath = os.path.join(self.cacheDir, imageFilename) + + try: + with open(imagePath) as imageFile: + self.image = imageFile.read() + except (OSError, IOError) as err: + raise GimpCaptchaError("Could not read Gimp captcha image file: %r" + % imageFilename) + + captchaAnswer = imageFilename.rsplit(os.path.extsep, 1)[0] + self.challenge = self.createChallenge(captchaAnswer, self.clientIP) + + return (self.image, self.challenge)

1 0

[bridgedb/develop] Use SSL when requesting CAPCHAs from reCaptcha.
by isis＠torproject.org 16 Mar '14

16 Mar '14

commit ffbc3bd846ab8e4bf3229b89096775d8b2db0f34 Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Mar 1 03:18:01 2014 +0000 Use SSL when requesting CAPCHAs from reCaptcha. This sounds bad. It is. What's worse: this only fixes half the problem. The recaptcha.client.captcha.submit() function in the reCaptcha API [0] is hardcoded to submit the server's (in this case, BridgeDB's) private API key, the client's IP address (BridgeDB sends a faked one), and the client's solution to the CAPTCHA, all over HTTP, in glorious plaintext. Hooray. [0]: https://recaptcha.googlecode.com/svn/trunk/recaptcha-plugins/python/recaptc… --- lib/bridgedb/captcha.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/bridgedb/captcha.py b/lib/bridgedb/captcha.py index fea4b44..07b06d4 100644 --- a/lib/bridgedb/captcha.py +++ b/lib/bridgedb/captcha.py @@ -84,7 +84,7 @@ class ReCaptcha(Captcha): """ if (self.pubkey == '') or (self.privkey == ''): raise ReCaptchaKeyError - urlbase = recaptcha.API_SERVER + urlbase = recaptcha.API_SSL_SERVER form = "/noscript?k=%s" % self.pubkey # extract and store image from captcha

1 0

[bridgedb/develop] Add HTTPServer.GimpCaptchaProtectedResource class.
by isis＠torproject.org 16 Mar '14

16 Mar '14

commit bcf10d76b62568f1b1162016a4e90a03fba5eba3 Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue Mar 4 08:32:37 2014 +0000 Add HTTPServer.GimpCaptchaProtectedResource class. --- lib/bridgedb/HTTPServer.py | 98 ++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 95 insertions(+), 3 deletions(-) diff --git a/lib/bridgedb/HTTPServer.py b/lib/bridgedb/HTTPServer.py index 5a9d5a3..f525964 100644 --- a/lib/bridgedb/HTTPServer.py +++ b/lib/bridgedb/HTTPServer.py @@ -133,7 +133,7 @@ class CaptchaProtectedResource(twisted.web.resource.Resource): ip = request.getClientIP() return ip - def getCaptchaImage(self): + def getCaptchaImage(self, request=None): """Get a CAPTCHA image. :returns: A 2-tuple of ``(image, challenge)``, where ``image`` is a @@ -183,7 +183,7 @@ class CaptchaProtectedResource(twisted.web.resource.Resource): :returns: A rendered HTML page containing a ReCaptcha challenge image for the client to solve. """ - image, challenge = self.getCaptchaImage() + image, challenge = self.getCaptchaImage(request) try: # TODO: this does not work for versions of IE < 8.0 @@ -225,6 +225,98 @@ class CaptchaProtectedResource(twisted.web.resource.Resource): return redirectTo(request.uri, request) +class GimpCaptchaProtectedResource(CaptchaProtectedResource): + """A web resource which uses a local cache of CAPTCHAs, generated with + gimp-captcha. + + .. _gimp-captcha: https://github.com/isislovecruft/gimp-captcha + """ + + def __init__(self, captchaDir='', + useForwardedHeader=False, resource=None): + CaptchaProtectedResource.__init__(self, useForwardedHeader, resource) + self.captchaDir = captchaDir + + def checkSolution(self, request): + """Process a solved CAPTCHA by sending rehashing the solution together with + the client's IP address, and checking that the result matches the challenge. + + The client's IP address is not sent to the ReCaptcha server; instead, + a completely random IP is generated and sent instead. + + :type request: :api:`twisted.web.http.Request` + + :param request: A ``Request`` object, including POST arguments which + should include two key/value pairs: one key being + ``'captcha_challenge_field'``, and the other, + ``'captcha_response_field'``. These POST arguments should be + obtained from :meth:`render_GET`. + :rtupe: bool + :returns: True, if the CAPTCHA solution was valid; False otherwise. + """ + challenge, response = self.extractClientSolution(request) + clientIP = self.getClientIP(request) + solution = captcha.GimpCaptcha.check(challenge, response, clientIP) + logging.debug("Captcha from %r. Parameters: %r" + % (Util.logSafely(clientIP), request.args)) + return solution + + def getCaptchaImage(self, request): + """Get a random CAPTCHA image from our **captchaDir**. + + Creates a :class:`~bridgedb.captcha.GimpCaptcha`, and calls its + :meth:`~bridgedb.captcha.GimpCaptcha.get` method to return a random + CAPTCHA and challenge string. + + :returns: A 2-tuple of ``(image, challenge)``, where:: + - ``image`` is a string holding a binary, JPEG-encoded image. + - ``challenge`` is a unique string associated with the request. + """ + clientIP = self.getClientIP(request) + c = captcha.GimpCaptcha(self.captchaDir, clientIP) + + try: + c.get() + except captcha.GimpCaptchaError as error: + logging.error(error) + except Exception as error: + logging.error("Unhandled error while retrieving Gimp captcha!") + logging.error(error) + + return (c.image, c.challenge) + + def render_GET(self, request): + """Retrieve a ReCaptcha from the API server and serve it to the client. + + :type request: :api:`twisted.web.http.Request` + :param request: A ``Request`` object for a page which should be + protected by a CAPTCHA. + :rtype: str + :returns: A rendered HTML page containing a ReCaptcha challenge image + for the client to solve. + """ + return CaptchaProtectedResource.render_GET(self, request) + + def render_POST(self, request): + """Process a client's CAPTCHA solution. + + If the client's CAPTCHA solution is valid (according to + :meth:`checkSolution`), process and serve their original + request. Otherwise, redirect them back to a new CAPTCHA page. + + :type request: :api:`twisted.web.http.Request` + :param request: A ``Request`` object, including POST arguments which + should include two key/value pairs: one key being + ``'captcha_challenge_field'``, and the other, + ``'captcha_response_field'``. These POST arguments + should be obtained from :meth:`render_GET`. + :rtype: str + :returns: A rendered HTML page containing a ReCaptcha challenge image + for the client to solve. + """ + return CaptchaProtectedResource.render_POST(self, request) + + class ReCaptchaProtectedResource(CaptchaProtectedResource): """A web resource which uses the reCaptcha_ service. @@ -238,7 +330,7 @@ class ReCaptchaProtectedResource(CaptchaProtectedResource): self.recaptchaPubKey = recaptchaPubKey self.recaptchaRemoteIP = remoteip - def getCaptchaImage(self): + def getCaptchaImage(self, request): """Get a CAPTCHA image from the remote reCaptcha server. :returns: A 2-tuple of ``(image, challenge)``, where::

1 0

[bridgedb/develop] Update ReCaptchaProtectedResouce docstring.
by isis＠torproject.org 16 Mar '14

16 Mar '14

commit e16c237f9645ae55ce1c800dfe9bff088bcf7ac0 Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue Mar 4 08:34:08 2014 +0000 Update ReCaptchaProtectedResouce docstring. --- lib/bridgedb/HTTPServer.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/bridgedb/HTTPServer.py b/lib/bridgedb/HTTPServer.py index f525964..f0ca414 100644 --- a/lib/bridgedb/HTTPServer.py +++ b/lib/bridgedb/HTTPServer.py @@ -380,7 +380,7 @@ class ReCaptchaProtectedResource(CaptchaProtectedResource): ``'captcha_response_field'``. These POST arguments should be obtained from :meth:`render_GET`. :rtupe: bool - :returns: XXX + :returns: True, if the CAPTCHA solution was valid; False otherwise. """ challenge, response = self.extractClientSolution(request) clientIP = self.getClientIP(request)

1 0

[bridgedb/develop] Remove unused ``site=None`` in bridgedb.HTTPServer.addWebServer().
by isis＠torproject.org 16 Mar '14

16 Mar '14

commit 61e3c8d8ac3449451dc44f8e3bdcd1f89cd9792b Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue Mar 4 08:35:09 2014 +0000 Remove unused ``site=None`` in bridgedb.HTTPServer.addWebServer(). --- lib/bridgedb/HTTPServer.py | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/bridgedb/HTTPServer.py b/lib/bridgedb/HTTPServer.py index f0ca414..1e4bfac 100644 --- a/lib/bridgedb/HTTPServer.py +++ b/lib/bridgedb/HTTPServer.py @@ -685,7 +685,6 @@ def addWebServer(cfg, dist, sched): dist -- an IPBasedDistributor object. sched -- an IntervalSchedule object. """ - site = None httpdist = twisted.web.resource.Resource() httpdist.putChild('', WebRoot()) httpdist.putChild('robots.txt',

1 0