May 2014 - tor-commits - lists.torproject.org

[bridgedb/master] Tweak docstrings for two ReCaptchaProtectedResource methods.
by isis＠torproject.org 16 May '14

16 May '14

commit 91ec2eb2cc79f2f932fa2557bb0fe455bf9af24c Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed May 14 20:10:36 2014 +0000 Tweak docstrings for two ReCaptchaProtectedResource methods. * CHANGE getRemoteIP() and checkSolution() docstring to make the Sphinx output be formatted more nicely. --- lib/bridgedb/HTTPServer.py | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/lib/bridgedb/HTTPServer.py b/lib/bridgedb/HTTPServer.py index 491e527..3b77c39 100644 --- a/lib/bridgedb/HTTPServer.py +++ b/lib/bridgedb/HTTPServer.py @@ -458,8 +458,8 @@ class ReCaptchaProtectedResource(CaptchaProtectedResource): """Mask the client's real IP address with a faked one. The fake client IP address is sent to the reCaptcha server, and it is - either the public IP address of bridges.torproject.org (if - ``RECAPTCHA_REMOTE_IP`` is configured), or a random IP. + either the public IP address of bridges.torproject.org (if the config + option ``RECAPTCHA_REMOTE_IP`` is configured), or a random IP. :rtype: str :returns: A fake IP address to report to the reCaptcha API server. @@ -485,10 +485,13 @@ class ReCaptchaProtectedResource(CaptchaProtectedResource): ``'captcha_response_field'``. These POST arguments should be obtained from :meth:`render_GET`. :rtupe: :api:`twisted.internet.defer.Deferred` - :returns: the returned deferred will callback with a tuple of - (``bool``, :api:`twisted.web.server.Request`). If the CAPTCHA - solution was valid, a tuple will contain ``(True, request)``; - otherwise, it will contain ``(False, request)``. + :returns: A deferred wich will callback with a tuple in the following + form: + (:type:`bool`, :api:`twisted.web.server.Request`) + If the CAPTCHA solution was valid, a tuple will contain:: + (True, Request) + Otherwise, it will contain:: + (False, Request) """ challenge, response = self.extractClientSolution(request) clientIP = self.getClientIP(request)

1 0

[bridgedb/master] Rename config var RECAPTCHA_PRIV_KEY → RECAPTCHA_SEC_KEY.
by isis＠torproject.org 16 May '14

16 May '14

commit aa9671e42690671b1d7b1d19372d833c8d81c1be Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed May 14 20:01:25 2014 +0000 Rename config var RECAPTCHA_PRIV_KEY → RECAPTCHA_SEC_KEY. --- README | 2 +- bridgedb.conf | 7 +++++-- lib/bridgedb/HTTPServer.py | 4 ++-- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/README b/README index c5adf54..e41fb4b 100644 --- a/README +++ b/README @@ -166,7 +166,7 @@ bridgedb.conf: RECAPTCHA_ENABLED RECAPTCHA_PUB_KEY - RECAPTCHA_PRIV_KEY + RECAPTCHA_SEC_KEY A [recaptcha.net](https://www.google.com/recaptcha) account is required. diff --git a/bridgedb.conf b/bridgedb.conf index 0b27adc..eaf82ed 100644 --- a/bridgedb.conf +++ b/bridgedb.conf @@ -15,11 +15,14 @@ # for details. # :copyright: (c) 2007-2013 The Tor Project, Inc. # (c) 2007-2013, all sentient entities within the AUTHORS file -# :version: 0.0.7 +# :version: 0.0.8 #=============================================================================== # # CHANGELOG: # ~~~~~~~~~~ +# Changes in version 0.0.8 - 2014-05-14 +# * CHANGE RECAPTCHA_PRIV_KEY to RECAPTCHA_SEC_KEY. +# # Changes in version 0.0.7 - 2014-03-31 # * ADD new settings for tracing function calls and thread info within logged # messages: LOG_THREADS, LOG_TRACE, and LOG_TIME_FORMAT. @@ -242,7 +245,7 @@ RECAPTCHA_ENABLED = False # Recaptcha API keys RECAPTCHA_PUB_KEY = '' -RECAPTCHA_PRIV_KEY = '' +RECAPTCHA_SEC_KEY = '' # The remoteip we send to reCAPTCHA during verification RECAPTCHA_REMOTEIP = '' diff --git a/lib/bridgedb/HTTPServer.py b/lib/bridgedb/HTTPServer.py index 7c4689a..328d7a3 100644 --- a/lib/bridgedb/HTTPServer.py +++ b/lib/bridgedb/HTTPServer.py @@ -837,7 +837,7 @@ def addWebServer(cfg, dist, sched): HTTPS_USE_IP_FROM_FORWARDED_HEADER RECAPTCHA_ENABLED RECAPTCHA_PUB_KEY - RECAPTCHA_PRIV_KEY + RECAPTCHA_SEC_KEY RECAPTCHA_REMOTEIP GIMP_CAPTCHA_ENABLED GIMP_CAPTCHA_DIR @@ -864,7 +864,7 @@ def addWebServer(cfg, dist, sched): if cfg.RECAPTCHA_ENABLED: protected = ReCaptchaProtectedResource( - recaptchaPrivKey=cfg.RECAPTCHA_PRIV_KEY, + recaptchaPrivKey=cfg.RECAPTCHA_SEC_KEY, recaptchaPubKey=cfg.RECAPTCHA_PUB_KEY, remoteip=cfg.RECAPTCHA_REMOTEIP, useForwardedHeader=cfg.HTTP_USE_IP_FROM_FORWARDED_HEADER,

1 0

[bridgedb/master] Add docstring to HTTPServer.CaptchaProtectedResource.getClientIP().
by isis＠torproject.org 16 May '14

16 May '14

commit 48d1281e5c641641c099ac5bcd47a60f4527fc9b Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed May 14 20:05:02 2014 +0000 Add docstring to HTTPServer.CaptchaProtectedResource.getClientIP(). --- lib/bridgedb/HTTPServer.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/lib/bridgedb/HTTPServer.py b/lib/bridgedb/HTTPServer.py index 328d7a3..779e270 100644 --- a/lib/bridgedb/HTTPServer.py +++ b/lib/bridgedb/HTTPServer.py @@ -144,6 +144,12 @@ class CaptchaProtectedResource(resource.Resource): self.resource = protectedResource def getClientIP(self, request): + """Get the client's IP address from the :header:`X-Forwarded-For` + header, or from the :api:`request <twisted.web.server.Request>`. + + :rtype: None or str + :returns: The client's IP address, if it was obtainable. + """ ip = None if self.useForwardedHeader: h = request.getHeader("X-Forwarded-For")

1 0

[bridgedb/master] Add class inheritance overview to bridgedb.captcha module docstring.
by isis＠torproject.org 16 May '14

16 May '14

commit 65be217961a833951497931dc0b77074da38fc13 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed May 14 20:33:10 2014 +0000 Add class inheritance overview to bridgedb.captcha module docstring. --- lib/bridgedb/captcha.py | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/lib/bridgedb/captcha.py b/lib/bridgedb/captcha.py index 8f56552..0018988 100644 --- a/lib/bridgedb/captcha.py +++ b/lib/bridgedb/captcha.py @@ -17,10 +17,30 @@ **Module Overview:** -.. +:: + captcha - |_ReCaptchaKeyError - \_ReCaptcha - Class for obtaining reCaptcha images and challenge strings + |- CaptchaExpired - Raised if a solution is given for a stale CAPTCHA. + |- CaptchaKeyError - Raised if a CAPTCHA system's keys are invalid/missing. + |- GimpCaptchaError - Raised when a Gimp CAPTCHA can't be retrieved. + | + \_ ICaptcha - Zope Interface specification for a generic CAPTCHA. + | + Captcha - Generic base class implementation for obtaining a CAPTCHA. + | |- image - The CAPTCHA image. + | |- challenge - A unique string associated with this CAPTCHA image. + | |- publicKey - The public key for this CAPTCHA system. + | |- secretKey - The secret key for this CAPTCHA system. + | \_ get() - Get a new pair of CAPTCHA image and challenge strings. + | + |- ReCaptcha - Obtain reCaptcha images and challenge strings. + | \_ get() - Request an image and challenge from a reCaptcha API server. + | + \_ GimpCaptcha - Class for obtaining a CAPTCHA from a local cache. + |- hmacKey - A client-specific key for HMAC generation. + |- cacheDir - The path to the local CAPTCHA cache directory. + \_ get() - Get a CAPTCHA image from the cache and create a challenge. + .. There are two types of CAPTCHAs which BridgeDB knows how to serve: those

1 0

[bridgedb/master] Clean up HTTPServer.addWebServer() docstring.
by isis＠torproject.org 16 May '14

16 May '14

commit 5a5e2f4feaedda3b4be1275f663e95eceda054c1 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed May 14 20:17:31 2014 +0000 Clean up HTTPServer.addWebServer() docstring. --- lib/bridgedb/HTTPServer.py | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/lib/bridgedb/HTTPServer.py b/lib/bridgedb/HTTPServer.py index 3b77c39..7598755 100644 --- a/lib/bridgedb/HTTPServer.py +++ b/lib/bridgedb/HTTPServer.py @@ -829,14 +829,18 @@ class WebRoot(resource.Resource): def addWebServer(cfg, dist, sched): - """Set up a web server. + """Set up a web server for HTTP(S)-based bridge distribution. - :param cfg: A configuration object from :mod:`bridgedb.Main`. Currently, - we use these options:: - HTTPS_N_BRIDGES_PER_ANSWER + :type cfg: :class:`bridgedb.persistent.Conf` + :param cfg: A configuration object from + :mod:`bridgedb.Main`. Currently, we use these options:: HTTP_UNENCRYPTED_PORT HTTP_UNENCRYPTED_BIND_IP HTTP_USE_IP_FROM_FORWARDED_HEADER + HTTPS_N_BRIDGES_PER_ANSWER + HTTPS_INCLUDE_FINGERPRINTS + HTTPS_KEY_FILE + HTTPS_CERT_FILE HTTPS_PORT HTTPS_BIND_IP HTTPS_USE_IP_FROM_FORWARDED_HEADER @@ -846,10 +850,17 @@ def addWebServer(cfg, dist, sched): RECAPTCHA_REMOTEIP GIMP_CAPTCHA_ENABLED GIMP_CAPTCHA_DIR + GIMP_CAPTCHA_HMAC_KEYFILE + GIMP_CAPTCHA_RSA_KEYFILE :type dist: :class:`bridgedb.Dist.IPBasedDistributor` :param dist: A bridge distributor. - :type sched: :class:`bridgedb.Time.IntervalSchedule` - :param sched: DOCDOC + :type sched: :class:`bridgedb.schedule.ScheduledInterval` + :param sched: The scheduled interval at which bridge selection, which + are ultimately displayed on the :class:`WebResourceBridges` page, will + be shifted. + :raises SystemExit: if the servers cannot be started. + :rtype: :api:`twisted.web.server.Site` + :returns: A webserver. """ httpdist = resource.Resource() httpdist.putChild('', WebRoot())

1 0

[bridgedb/master] Add a docstring to captcha.Captcha.__init__().
by isis＠torproject.org 16 May '14

16 May '14

commit c6830ecb6ef81d019afd52f0304bcb8f4e344184 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed May 14 20:44:08 2014 +0000 Add a docstring to captcha.Captcha.__init__(). --- lib/bridgedb/captcha.py | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/bridgedb/captcha.py b/lib/bridgedb/captcha.py index 15f1083..8a76198 100644 --- a/lib/bridgedb/captcha.py +++ b/lib/bridgedb/captcha.py @@ -98,6 +98,7 @@ class Captcha(object): implements(ICaptcha) def __init__(self): + """Obtain a new CAPTCHA for a client.""" self.image = None self.challenge = None

1 0

[bridgedb/master] Simplify GimpCaptchaKeyError and ReCaptchaKeyError into CaptchaKeyError.
by isis＠torproject.org 16 May '14

16 May '14

commit f5be372df769be8934ac6666e1433e3b92718eab Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed May 14 20:41:00 2014 +0000 Simplify GimpCaptchaKeyError and ReCaptchaKeyError into CaptchaKeyError. * REMOVE exception class captcha.GimpCaptchaKeyError. * REMOVE exception class captcha.ReCaptchaKeyError. * ADD exception class captcha.CaptchaKeyError. --- lib/bridgedb/captcha.py | 17 +++++++---------- lib/bridgedb/test/test_captcha.py | 16 ++++++++-------- 2 files changed, 15 insertions(+), 18 deletions(-) diff --git a/lib/bridgedb/captcha.py b/lib/bridgedb/captcha.py index 0018988..15f1083 100644 --- a/lib/bridgedb/captcha.py +++ b/lib/bridgedb/captcha.py @@ -68,15 +68,12 @@ from bridgedb import crypto from bridgedb.txrecaptcha import API_SSL_SERVER -class ReCaptchaKeyError(Exception): - """Exception raised when recaptcha API keys are not supplied.""" +class CaptchaKeyError(Exception): + """Raised if a CAPTCHA system's keys are invalid or missing.""" class GimpCaptchaError(Exception): """General exception raised when a Gimp CAPTCHA cannot be retrieved.""" -class GimpCaptchaKeyError(ValueError): - """Raised when there is a problem with one of the Gimp CAPTCHA keys.""" - class ICaptcha(Interface): """Interface specification for CAPTCHAs.""" @@ -135,12 +132,12 @@ class ReCaptcha(Captcha): stored at ``ReCaptcha.image`` and the challenge string at ``ReCaptcha.challenge``. - :raises ReCaptchaKeyError: If either the :ivar:`pubkey` or - :ivar:`privkey` are missing. + :raises CaptchaKeyError: If either the :ivar:`publicKey` or + :ivar:`secretKey` are missing. :raises HTTPError: If the server returned any HTTP error status code. """ if not self.pubkey or not self.privkey: - raise ReCaptchaKeyError('You must supply recaptcha API keys') + raise CaptchaKeyError('You must supply recaptcha API keys') urlbase = API_SSL_SERVER form = "/noscript?k=%s" % self.pubkey @@ -173,7 +170,7 @@ class GimpCaptcha(Captcha): images have been stored in. This can be set via the ``GIMP_CAPTCHA_DIR`` setting in the config file. :raises GimpCaptchaError: if **cacheDir** is not a directory. - :raises GimpCaptchaKeyError: if any of **secretKey**, **publicKey**, + :raises CaptchaKeyError: if any of **secretKey**, **publicKey**, or **hmacKey** is invalid, or missing. """ super(GimpCaptcha, self).__init__() @@ -182,7 +179,7 @@ class GimpCaptcha(Captcha): raise GimpCaptchaError("Gimp captcha cache isn't a directory: %r" % cacheDir) if not (publicKey and secretKey and hmacKey): - raise GimpCaptchaKeyError( + raise CaptchaKeyError( "Invalid key supplied to GimpCaptcha: SK=%r PK=%r HMAC=%r" % (secretKey, publicKey, hmacKey)) diff --git a/lib/bridgedb/test/test_captcha.py b/lib/bridgedb/test/test_captcha.py index 7a6f2c4..a383545 100644 --- a/lib/bridgedb/test/test_captcha.py +++ b/lib/bridgedb/test/test_captcha.py @@ -88,7 +88,7 @@ class ReCaptchaTests(unittest.TestCase): def test_get_noKeys(self): """ReCaptcha.get() without API keys should fail.""" c = captcha.ReCaptcha() - self.assertRaises(captcha.ReCaptchaKeyError, c.get) + self.assertRaises(captcha.CaptchaKeyError, c.get) class GimpCaptchaTests(unittest.TestCase): @@ -106,23 +106,23 @@ class GimpCaptchaTests(unittest.TestCase): def test_init_noSecretKey(self): """Calling GimpCaptcha.__init__() without a secret key parameter should raise - a GimpCaptchaKeyError. + a CaptchaKeyError. """ - self.assertRaises(captcha.GimpCaptchaKeyError, captcha.GimpCaptcha, + self.assertRaises(captcha.CaptchaKeyError, captcha.GimpCaptcha, None, self.publik, self.hmacKey, self.cacheDir) def test_init_noPublicKey(self): - """__init__() without publicKey should raise a GimpCaptchaKeyError.""" - self.assertRaises(captcha.GimpCaptchaKeyError, captcha.GimpCaptcha, + """__init__() without publicKey should raise a CaptchaKeyError.""" + self.assertRaises(captcha.CaptchaKeyError, captcha.GimpCaptcha, self.sekrit, None, self.hmacKey, self.cacheDir) def test_init_noHMACKey(self): - """__init__() without hmacKey should raise a GimpCaptchaKeyError.""" - self.assertRaises(captcha.GimpCaptchaKeyError, captcha.GimpCaptcha, + """__init__() without hmacKey should raise a CaptchaKeyError.""" + self.assertRaises(captcha.CaptchaKeyError, captcha.GimpCaptcha, self.sekrit, self.publik, None, self.cacheDir) def test_init_noCacheDir(self): - """__init__() without cacheDir should raise a GimpCaptchaKeyError.""" + """__init__() without cacheDir should raise a CaptchaKeyError.""" self.assertRaises(captcha.GimpCaptchaError, captcha.GimpCaptcha, self.sekrit, self.publik, self.hmacKey, None)

1 0

[bridgedb/master] Fix captcha.Captcha.get() implementation.
by isis＠torproject.org 16 May '14

16 May '14

commit b7b65a6afcb8e85271ed05350fdba5542ac9cf99 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed May 14 21:13:12 2014 +0000 Fix captcha.Captcha.get() implementation. It's not supposed to return anything. It's only supposed to set the Captcha.image and Captcha.challenge attributes. --- lib/bridgedb/captcha.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/lib/bridgedb/captcha.py b/lib/bridgedb/captcha.py index f5674c4..ca2575c 100644 --- a/lib/bridgedb/captcha.py +++ b/lib/bridgedb/captcha.py @@ -114,7 +114,13 @@ class Captcha(object): self.secretKey = secretKey def get(self): - return self.image + """Retrieve a new CAPTCHA image and its associated challenge string. + + The image and challenge will be stored as :ivar:`image` and + :ivar:`challenge, respectively. + """ + self.image = None + self.challenge = None class ReCaptcha(Captcha):

1 0

[bridgedb/master] Simplify Captcha and CaptchaProtectedResource keypair attributes.
by isis＠torproject.org 16 May '14

16 May '14

commit f0b9885eabb832e6d0ba688c7723266e9f6b0117 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed May 14 21:24:21 2014 +0000 Simplify Captcha and CaptchaProtectedResource keypair attributes. All *Captcha and *CaptchaProtectedResource classes and subclasses (as well as their interface specifications) now have `publicKey` and `secretKey` attributes. For the GimpCaptcha class, this involved switching the ordering of the parameters for the initialisation method from: GimpCaptcha(secretKey, publicKey, ...) to: GimpCaptcha(publicKey, secretKey, ...) Make sure that the intialisations of all of these classes take the public key *first*. YOU HAVE BEEN WARNED. --- lib/bridgedb/HTTPServer.py | 103 ++++++++++++++-------------- lib/bridgedb/captcha.py | 125 ++++++++++++++++++++++++---------- lib/bridgedb/test/test_HTTPServer.py | 8 +-- lib/bridgedb/test/test_captcha.py | 54 +++++++-------- 4 files changed, 172 insertions(+), 118 deletions(-) diff --git a/lib/bridgedb/HTTPServer.py b/lib/bridgedb/HTTPServer.py index 7598755..ead6d60 100644 --- a/lib/bridgedb/HTTPServer.py +++ b/lib/bridgedb/HTTPServer.py @@ -20,6 +20,8 @@ import textwrap import time import os +from functools import partial + from ipaddr import IPv4Address from ipaddr import IPv6Address @@ -138,8 +140,11 @@ class CaptchaProtectedResource(resource.Resource): isLeaf = True - def __init__(self, useForwardedHeader=False, protectedResource=None): + def __init__(self, publicKey=None, secretKey=None, + useForwardedHeader=False, protectedResource=None): resource.Resource.__init__(self) + self.publicKey = publicKey + self.secretKey = secretKey self.useForwardedHeader = useForwardedHeader self.resource = protectedResource @@ -270,9 +275,7 @@ class GimpCaptchaProtectedResource(CaptchaProtectedResource): .. _gimp-captcha: https://github.com/isislovecruft/gimp-captcha """ - def __init__(self, secretKey=None, publicKey=None, hmacKey=None, - captchaDir='', useForwardedHeader=False, - protectedResource=None): + def __init__(self, hmacKey=None, captchaDir='', **kwargs): """Protect a resource via this one, using a local CAPTCHA cache. :param str secretkey: A PKCS#1 OAEP-padded, private RSA key, used for @@ -294,10 +297,7 @@ class GimpCaptchaProtectedResource(CaptchaProtectedResource): :param protectedResource: The resource to serve if the client successfully passes the CAPTCHA challenge. """ - CaptchaProtectedResource.__init__(self, useForwardedHeader, - protectedResource) - self.secretKey = secretKey - self.publicKey = publicKey + CaptchaProtectedResource.__init__(self, **kwargs) self.hmacKey = hmacKey self.captchaDir = captchaDir @@ -340,7 +340,7 @@ class GimpCaptchaProtectedResource(CaptchaProtectedResource): # Create a new HMAC key, specific to requests from this client: clientIP = self.getClientIP(request) clientHMACKey = crypto.getHMAC(self.hmacKey, clientIP) - capt = captcha.GimpCaptcha(self.secretKey, self.publicKey, + capt = captcha.GimpCaptcha(self.publicKey, self.secretKey, clientHMACKey, self.captchaDir) try: capt.get() @@ -391,13 +391,9 @@ class ReCaptchaProtectedResource(CaptchaProtectedResource): .. _reCaptcha: http://www.google.com/recaptcha """ - def __init__(self, recaptchaPrivKey='', recaptchaPubKey='', remoteip='', - useForwardedHeader=False, protectedResource=None): - CaptchaProtectedResource.__init__(self, useForwardedHeader, - protectedResource) - self.recaptchaPrivKey = recaptchaPrivKey - self.recaptchaPubKey = recaptchaPubKey - self.recaptchaRemoteIP = remoteip + def __init__(self, remoteIP=None, **kwargs): + CaptchaProtectedResource.__init__(self, **kwargs) + self.remoteIP = remoteIP def _renderDeferred(self, checkedRequest): """Render this resource asynchronously. @@ -442,7 +438,7 @@ class ReCaptchaProtectedResource(CaptchaProtectedResource): - ``image`` is a string holding a binary, JPEG-encoded image. - ``challenge`` is a unique string associated with the request. """ - capt = captcha.ReCaptcha(self.recaptchaPubKey, self.recaptchaPrivKey) + capt = captcha.ReCaptcha(self.publicKey, self.secretKey) try: capt.get() @@ -464,8 +460,8 @@ class ReCaptchaProtectedResource(CaptchaProtectedResource): :rtype: str :returns: A fake IP address to report to the reCaptcha API server. """ - if self.recaptchaRemoteIP: - remoteIP = self.recaptchaRemoteIP + if self.remoteIP: + remoteIP = self.remoteIP else: # generate a random IP for the captcha submission remoteIP = IPv4Address(random.randint(0, 2**32-1)).compressed @@ -520,7 +516,7 @@ class ReCaptchaProtectedResource(CaptchaProtectedResource): % (clientIP, solution.error_code)) return (False, request) - d = txrecaptcha.submit(challenge, response, self.recaptchaPrivKey, + d = txrecaptcha.submit(challenge, response, self.secretKey, remoteIP).addCallback(checkResponse, request) return d @@ -862,6 +858,13 @@ def addWebServer(cfg, dist, sched): :rtype: :api:`twisted.web.server.Site` :returns: A webserver. """ + captcha = None + fwdHeaders = cfg.HTTP_USE_IP_FROM_FORWARDED_HEADER + numBridges = cfg.HTTPS_N_BRIDGES_PER_ANSWER + fprInclude = cfg.HTTPS_INCLUDE_FINGERPRINTS + + logging.info("Starting web servers...") + httpdist = resource.Resource() httpdist.putChild('', WebRoot()) httpdist.putChild('robots.txt', @@ -873,58 +876,56 @@ def addWebServer(cfg, dist, sched): httpdist.putChild('options', WebResourceOptions()) httpdist.putChild('howto', WebResourceHowto()) - bridgesResource = WebResourceBridges( - dist, sched, cfg.HTTPS_N_BRIDGES_PER_ANSWER, - cfg.HTTP_USE_IP_FROM_FORWARDED_HEADER, - includeFingerprints=cfg.HTTPS_INCLUDE_FINGERPRINTS) - if cfg.RECAPTCHA_ENABLED: - protected = ReCaptchaProtectedResource( - recaptchaPrivKey=cfg.RECAPTCHA_SEC_KEY, - recaptchaPubKey=cfg.RECAPTCHA_PUB_KEY, - remoteip=cfg.RECAPTCHA_REMOTEIP, - useForwardedHeader=cfg.HTTP_USE_IP_FROM_FORWARDED_HEADER, - protectedResource=bridgesResource) - httpdist.putChild('bridges', protected) - + publicKey = cfg.RECAPTCHA_PUB_KEY + secretKey = cfg.RECAPTCHA_SEC_KEY + captcha = partial(ReCaptchaProtectedResource, + remoteIP=cfg.RECAPTCHA_REMOTEIP) elif cfg.GIMP_CAPTCHA_ENABLED: - # Get the HMAC secret key for CAPTCHA challenges and create a new key - # from it for use on the server: + # Get the master HMAC secret key for CAPTCHA challenges, and then + # create a new HMAC key from it for use on the server. captchaKey = crypto.getKey(cfg.GIMP_CAPTCHA_HMAC_KEYFILE) hmacKey = crypto.getHMAC(captchaKey, "Captcha-Key") - # Load or create our encryption keys: secretKey, publicKey = crypto.getRSAKey(cfg.GIMP_CAPTCHA_RSA_KEYFILE) - - protected = GimpCaptchaProtectedResource( - secretKey=secretKey, - publicKey=publicKey, - hmacKey=hmacKey, - captchaDir=cfg.GIMP_CAPTCHA_DIR, - useForwardedHeader=cfg.HTTP_USE_IP_FROM_FORWARDED_HEADER, - protectedResource=bridgesResource) + captcha = partial(GimpCaptchaProtectedResource, + hmacKey=hmacKey, + captchaDir=cfg.GIMP_CAPTCHA_DIR) + + bridges = WebResourceBridges(dist, sched, numBridges, + fwdHeaders, includeFingerprints=fprInclude) + if captcha: + # Protect the 'bridges' page with a CAPTCHA, if configured to do so: + protected = captcha(publicKey=publicKey, + secretKey=secretKey, + useForwardedHeader=fwdHeaders, + protectedResource=bridges) httpdist.putChild('bridges', protected) + logging.info("Protecting resources with %s." % captcha.func.__name__) else: - httpdist.putChild('bridges', bridgesResource) + httpdist.putChild('bridges', bridges) site = server.Site(httpdist) if cfg.HTTP_UNENCRYPTED_PORT: ip = cfg.HTTP_UNENCRYPTED_BIND_IP or "" + port = cfg.HTTP_UNENCRYPTED_PORT or 80 try: - reactor.listenTCP(cfg.HTTP_UNENCRYPTED_PORT, site, interface=ip) + reactor.listenTCP(port, site, interface=ip) except CannotListenError as error: raise SystemExit(error) + logging.info("Started HTTP server on %s:%d" % (str(ip), int(port))) if cfg.HTTPS_PORT: - from twisted.internet.ssl import DefaultOpenSSLContextFactory - #from OpenSSL.SSL import SSLv3_METHOD ip = cfg.HTTPS_BIND_IP or "" - factory = DefaultOpenSSLContextFactory(cfg.HTTPS_KEY_FILE, - cfg.HTTPS_CERT_FILE) + port = cfg.HTTPS_PORT or 443 try: - reactor.listenSSL(cfg.HTTPS_PORT, site, factory, interface=ip) + from twisted.internet.ssl import DefaultOpenSSLContextFactory + factory = DefaultOpenSSLContextFactory(cfg.HTTPS_KEY_FILE, + cfg.HTTPS_CERT_FILE) + reactor.listenSSL(port, site, factory, interface=ip) except CannotListenError as error: raise SystemExit(error) + logging.info("Started HTTPS server on %s:%d" % (str(ip), int(port))) return site diff --git a/lib/bridgedb/captcha.py b/lib/bridgedb/captcha.py index ca2575c..e10bc81 100644 --- a/lib/bridgedb/captcha.py +++ b/lib/bridgedb/captcha.py @@ -124,22 +124,28 @@ class Captcha(object): class ReCaptcha(Captcha): - """A reCaptcha CAPTCHA. + """A CAPTCHA obtained from a remote reCaptcha_ API server. :ivar str image: The CAPTCHA image. :ivar str challenge: The ``'recaptcha_challenge_response'`` HTTP form - field to pass to the client along with the CAPTCHA image. + field to pass to the client, along with the CAPTCHA image. See + :doc:`BridgeDB's captcha.html <templates/captcha.html>` Mako_ template + for an example usage. + :ivar str publicKey: The public reCaptcha API key. + :ivar str secretKey: The private reCaptcha API key. + + .. _reCaptcha: https://code.google.com/p/recaptcha/ + .. _Mako: http://docs.makotemplates.org/en/latest/syntax.html#page """ - def __init__(self, pubkey=None, privkey=None): + def __init__(self, publicKey=None, secretKey=None): """Create a new ReCaptcha CAPTCHA. - :param str pubkey: The public reCaptcha API key. - :param str privkey: The private reCaptcha API key. + :param str publicKey: The public reCaptcha API key. + :param str secretKey: The private reCaptcha API key. """ - super(ReCaptcha, self).__init__() - self.pubkey = pubkey - self.privkey = privkey + super(ReCaptcha, self).__init__(publicKey=publicKey, + secretKey=secretKey) def get(self): """Retrieve a CAPTCHA from the reCaptcha API server. @@ -154,11 +160,11 @@ class ReCaptcha(Captcha): :ivar:`secretKey` are missing. :raises HTTPError: If the server returned any HTTP error status code. """ - if not self.pubkey or not self.privkey: + if not self.publicKey or not self.secretKey: raise CaptchaKeyError('You must supply recaptcha API keys') urlbase = API_SSL_SERVER - form = "/noscript?k=%s" % self.pubkey + form = "/noscript?k=%s" % self.publicKey # Extract and store image from recaptcha html = urllib2.urlopen(urlbase + form).read() @@ -172,27 +178,45 @@ class ReCaptcha(Captcha): class GimpCaptcha(Captcha): - """A cached CAPTCHA image which was created with Gimp.""" + """A locally cached CAPTCHA image which was created with gimp-captcha_. + + :ivar str secretKey: A PKCS#1 OAEP-padded, private RSA key, used for + verifying the client's solution to the CAPTCHA. + :ivar str publickey: A PKCS#1 OAEP-padded, public RSA key. This is used to + hide the correct CAPTCHA solution within the + ``captcha_challenge_field`` HTML form field. That form field is given + to the a client along with the :ivar:`image` during the initial + CAPTCHA request, and the client *should* give it back to us later + during the CAPTCHA solution verification step. + :ivar bytes hmacKey: A client-specific HMAC secret key. + :ivar str cacheDir: The local directory which pre-generated CAPTCHA images + have been stored in. This can be set via the ``GIMP_CAPTCHA_DIR`` + setting in the config file. + :type sched: :class:`bridgedb.schedule.ScheduledInterval` + :ivar sched: An time interval. After this much time has passed, the + CAPTCHA is considered stale, and all solutions are considered invalid + regardless of their correctness. + + .. _gimp-captcha: https://github.com/isislovecruft/gimp-captcha + """ - def __init__(self, secretKey=None, publicKey=None, hmacKey=None, + def __init__(self, publicKey=None, secretKey=None, hmacKey=None, cacheDir=None): """Create a ``GimpCaptcha`` which retrieves images from **cacheDir**. - :param str secretkey: A PKCS#1 OAEP-padded, private RSA key, used for - verifying the client's solution to the CAPTCHA. :param str publickey: A PKCS#1 OAEP-padded, public RSA key, used for creating the ``captcha_challenge_field`` string to give to a client. + :param str secretKey: A PKCS#1 OAEP-padded, private RSA key, used for + verifying the client's solution to the CAPTCHA. :param bytes hmacKey: A client-specific HMAC secret key. :param str cacheDir: The local directory which pre-generated CAPTCHA images have been stored in. This can be set via the ``GIMP_CAPTCHA_DIR`` setting in the config file. - :raises GimpCaptchaError: if **cacheDir** is not a directory. - :raises CaptchaKeyError: if any of **secretKey**, **publicKey**, - or **hmacKey** is invalid, or missing. + :raises GimpCaptchaError: if :ivar:`cacheDir` is not a directory. + :raises CaptchaKeyError: if any of :ivar:`secretKey`, + :ivar:`publicKey`, or :ivar:`hmacKey` are invalid or missing. """ - super(GimpCaptcha, self).__init__() - if not cacheDir or not os.path.isdir(cacheDir): raise GimpCaptchaError("Gimp captcha cache isn't a directory: %r" % cacheDir) @@ -201,10 +225,10 @@ class GimpCaptcha(Captcha): "Invalid key supplied to GimpCaptcha: SK=%r PK=%r HMAC=%r" % (secretKey, publicKey, hmacKey)) - self.secretKey = secretKey - self.publicKey = publicKey - self.cacheDir = cacheDir + super(GimpCaptcha, self).__init__(publicKey=publicKey, + secretKey=secretKey) self.hmacKey = hmacKey + self.cacheDir = cacheDir self.answer = None @classmethod @@ -215,7 +239,7 @@ class GimpCaptcha(Captcha): ``'captcha_challenge_field'`` HTTP form field. :param str solution: The client's proposed solution to the CAPTCHA that they were presented with. - :param str secretkey: A PKCS#1 OAEP-padded, private RSA key, used for + :param str secretKey: A PKCS#1 OAEP-padded, private RSA key, used for verifying the client's solution to the CAPTCHA. :param bytes hmacKey: A private key for generating HMACs. :rtype: bool @@ -248,22 +272,51 @@ class GimpCaptcha(Captcha): return False def createChallenge(self, answer): - """Encrypt the CAPTCHA **answer** and HMAC the encrypted data. - - Take a string containing the answer to a CAPTCHA and encrypts it to - :attr:`publicKey`. The resulting encrypted blob is then HMACed with a - client-specific :attr:`hmacKey`. These two strings are then joined - together in the form: - - HMAC ";" ENCRYPTED_ANSWER - - where the HMAC MUST be the first 20 bytes. Lastly base64-encoded (in a - URL safe manner). + """Encrypt-then-HMAC the CAPTCHA **answer**. + + A challenge string consists of a URL-safe, base64-encoded string which + contains an ``HMAC`` concatenated with an ``ENC_BLOB``, in the + following form:: + + CHALLENGE := B64( HMAC | ENC_BLOB ) + ENC_BLOB := RSA_ENC( ANSWER_BLOB ) + ANSWER_BLOB := ( TIMESTAMP | ANSWER ) + + where + * ``B64`` is a URL-safe base64-encode function, + * ``RSA_ENC`` is the PKCS#1 RSA-OAEP encryption function, + * and the remaining feilds are specified as follows: + + +-------------+--------------------------------------------+----------+ + | Field | Description | Length | + +=============+============================================+==========+ + | HMAC | An HMAC of the ``ENC_BLOB``, created with | 20 bytes | + | | the client-specific :ivar:`hmacKey`, by | | + | | applying :func:`~crypto.getHMAC` to the | | + | | ``ENC_BLOB``. | | + +-------------+--------------------------------------------+----------+ + | ENC_BLOB | An encrypted ``ANSWER``, created with | varies | + | | a PKCS#1 OAEP-padded RSA :ivar:`publicKey`.| | + +-------------+--------------------------------------------+----------+ + | ANSWER | A string containing answer to this | 8 bytes | + | | CAPTCHA :ivar:`image`. | | + +-------------+--------------------------------------------+----------+ + + The steps taken to produce a ``CHALLENGE`` are then: + + 1. Encrypt the ``ANSWER`` to :ivar:`publicKey` to create + the ``ENC_BLOB``. + + 2. Use the client-specific :ivar:`hmacKey` to apply the + :func:`~crypto.getHMAC` function to the ``ENC_BLOB``, obtaining + an ``HMAC``. + + 3. Create the final ``CHALLENGE`` string by concatenating the + ``HMAC`` and ``ENC_BLOB``, then base64-encoding the result. :param str answer: The answer to a CAPTCHA. :rtype: str - :returns: An HMAC of, as well as a string containing the URL-safe, - base64-encoded encrypted **answer**. + :returns: A challenge string. """ encrypted = self.publicKey.encrypt(answer) hmac = crypto.getHMAC(self.hmacKey, encrypted) diff --git a/lib/bridgedb/test/test_HTTPServer.py b/lib/bridgedb/test/test_HTTPServer.py index 570fe9c..8bc1da7 100644 --- a/lib/bridgedb/test/test_HTTPServer.py +++ b/lib/bridgedb/test/test_HTTPServer.py @@ -274,9 +274,9 @@ class ReCaptchaProtectedResourceTests(unittest.TestCase): # (None, None) is the (distributor, scheduleInterval): self.protectedResource = HTTPServer.WebResourceBridges(None, None) self.captchaResource = HTTPServer.ReCaptchaProtectedResource( - recaptchaPrivKey='42', - recaptchaPubKey='23', - remoteip='111.111.111.111', + publicKey='23', + secretKey='42', + remoteIP='111.111.111.111', useForwardedHeader=True, protectedResource=self.protectedResource) @@ -365,7 +365,7 @@ class ReCaptchaProtectedResourceTests(unittest.TestCase): def test_getRemoteIP_useRandomIP(self): """Check that removing our remoteip setting produces a random IP.""" - self.captchaResource.recaptchaRemoteIP = None + self.captchaResource.remoteIP = None ip = self.captchaResource.getRemoteIP() realishIP = ipaddr.IPv4Address(ip).compressed self.assertTrue(realishIP) diff --git a/lib/bridgedb/test/test_captcha.py b/lib/bridgedb/test/test_captcha.py index a383545..536f29e 100644 --- a/lib/bridgedb/test/test_captcha.py +++ b/lib/bridgedb/test/test_captcha.py @@ -50,8 +50,8 @@ class ReCaptchaTests(unittest.TestCase): def test_init(self): """Check the ReCaptcha class stored the private and public keys.""" - self.assertEquals(self.c.privkey, 'sekrit') - self.assertEquals(self.c.pubkey, 'publik') + self.assertEquals(self.c.secretKey, 'sekrit') + self.assertEquals(self.c.publicKey, 'publik') def test_get(self): """Test get() method.""" @@ -109,32 +109,32 @@ class GimpCaptchaTests(unittest.TestCase): a CaptchaKeyError. """ self.assertRaises(captcha.CaptchaKeyError, captcha.GimpCaptcha, - None, self.publik, self.hmacKey, self.cacheDir) + self.publik, None, self.hmacKey, self.cacheDir) def test_init_noPublicKey(self): """__init__() without publicKey should raise a CaptchaKeyError.""" self.assertRaises(captcha.CaptchaKeyError, captcha.GimpCaptcha, - self.sekrit, None, self.hmacKey, self.cacheDir) + None, self.sekrit, self.hmacKey, self.cacheDir) def test_init_noHMACKey(self): """__init__() without hmacKey should raise a CaptchaKeyError.""" self.assertRaises(captcha.CaptchaKeyError, captcha.GimpCaptcha, - self.sekrit, self.publik, None, self.cacheDir) + self.publik, self.sekrit, None, self.cacheDir) def test_init_noCacheDir(self): """__init__() without cacheDir should raise a CaptchaKeyError.""" self.assertRaises(captcha.GimpCaptchaError, captcha.GimpCaptcha, - self.sekrit, self.publik, self.hmacKey, None) + self.publik, self.sekrit, self.hmacKey, None) def test_init_badCacheDir(self): """GimpCaptcha with bad cacheDir should raise GimpCaptchaError.""" self.assertRaises(captcha.GimpCaptchaError, captcha.GimpCaptcha, - self.sekrit, self.publik, self.hmacKey, + self.publik, self.sekrit, self.hmacKey, self.cacheDir.rstrip('chas')) def test_init(self): """Test that __init__ correctly initialised all the values.""" - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) self.assertIsNone(c.answer) self.assertIsNone(c.image) @@ -142,14 +142,14 @@ class GimpCaptchaTests(unittest.TestCase): def test_createChallenge(self): """createChallenge() should return the encrypted CAPTCHA answer.""" - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) challenge = c.createChallenge('w00t') self.assertIsInstance(challenge, basestring) def test_createChallenge_base64(self): """createChallenge() return value should be urlsafe base64-encoded.""" - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) challenge = c.createChallenge('w00t') decoded = urlsafe_b64decode(challenge) @@ -157,7 +157,7 @@ class GimpCaptchaTests(unittest.TestCase): def test_createChallenge_hmacValid(self): """The HMAC in createChallenge() return value should be valid.""" - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) challenge = c.createChallenge('ShouldHaveAValidHMAC') decoded = urlsafe_b64decode(challenge) @@ -168,7 +168,7 @@ class GimpCaptchaTests(unittest.TestCase): def test_createChallenge_decryptedAnswerMatches(self): """The HMAC in createChallenge() return value should be valid.""" - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) answer = 'ThisAnswerShouldDecryptToThis' challenge = c.createChallenge(answer) @@ -182,7 +182,7 @@ class GimpCaptchaTests(unittest.TestCase): def test_get(self): """GimpCaptcha.get() should return image and challenge strings.""" - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) image, challenge = c.get() self.assertIsInstance(image, basestring) @@ -191,7 +191,7 @@ class GimpCaptchaTests(unittest.TestCase): def test_get_emptyCacheDir(self): """An empty cacheDir should raise GimpCaptchaError.""" os.makedirs(self.badCacheDir) - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.badCacheDir) self.assertRaises(captcha.GimpCaptchaError, c.get) shutil.rmtree(self.badCacheDir) @@ -205,7 +205,7 @@ class GimpCaptchaTests(unittest.TestCase): fh.flush() os.chmod(badFile, 0266) - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.badCacheDir) # This should hit the second `except:` clause in get(): self.assertRaises(captcha.GimpCaptchaError, c.get) @@ -213,7 +213,7 @@ class GimpCaptchaTests(unittest.TestCase): def test_check(self): """A correct answer and valid challenge should return True.""" - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) image, challenge = c.get() self.assertEquals( @@ -222,7 +222,7 @@ class GimpCaptchaTests(unittest.TestCase): def test_check_blankAnswer(self): """A blank answer and valid challenge should return False.""" - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) image, challenge = c.get() self.assertEquals( @@ -231,7 +231,7 @@ class GimpCaptchaTests(unittest.TestCase): def test_check_nonBase64(self): """Valid answer and challenge with invalid base64 returns False.""" - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) image, challenge = c.get() challengeBadB64 = challenge.rstrip('==') + "\x42\x42\x42" @@ -244,7 +244,7 @@ class GimpCaptchaTests(unittest.TestCase): def test_check_caseInsensitive_lowercase(self): """A correct answer in lowercase characters should return True.""" - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) image, challenge = c.get() solution = c.answer.lower() @@ -254,7 +254,7 @@ class GimpCaptchaTests(unittest.TestCase): def test_check_caseInsensitive_uppercase(self): """A correct answer in uppercase characters should return True.""" - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) image, challenge = c.get() solution = c.answer.upper() @@ -264,7 +264,7 @@ class GimpCaptchaTests(unittest.TestCase): def test_check_encoding_utf8(self): """A correct answer in utf-8 lowercase should return True.""" - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) image, challenge = c.get() solution = c.answer.encode('utf8') @@ -274,7 +274,7 @@ class GimpCaptchaTests(unittest.TestCase): def test_check_encoding_ascii(self): """A correct answer in utf-8 lowercase should return True.""" - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) image, challenge = c.get() solution = c.answer.encode('ascii') @@ -284,7 +284,7 @@ class GimpCaptchaTests(unittest.TestCase): def test_check_encoding_unicode(self): """A correct answer in utf-8 lowercase should return True.""" - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) image, challenge = c.get() solution = unicode(c.answer) @@ -294,7 +294,7 @@ class GimpCaptchaTests(unittest.TestCase): def test_check_missingHMACbytes(self): """A challenge that is missing part of the HMAC should return False.""" - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) image, challenge = c.get() challengeBadHMAC = challenge[:10] + challenge[20:] @@ -304,7 +304,7 @@ class GimpCaptchaTests(unittest.TestCase): def test_check_missingAnswerbytes(self): """Partial encrypted answers in challenges should return False.""" - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) image, challenge = c.get() challengeBadOrig = challenge[:20] + challenge[30:] @@ -315,7 +315,7 @@ class GimpCaptchaTests(unittest.TestCase): def test_check_badHMACkey(self): """A challenge with a bad HMAC key should return False.""" hmacKeyBad = crypto.getKey('test_gimpCaptcha_badHMACkey') - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) image, challenge = c.get() self.assertEquals( @@ -325,7 +325,7 @@ class GimpCaptchaTests(unittest.TestCase): def test_check_badRSAkey(self): """A challenge with a bad RSA secret key should return False.""" secretKeyBad, publicKeyBad = crypto.getRSAKey('test_gimpCaptcha_badRSAkey') - c = captcha.GimpCaptcha(self.sekrit, self.publik, self.hmacKey, + c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) image, challenge = c.get() self.assertEquals(

1 0

[bridgedb/master] Make publicKey and secretKey attributes of the ICaptcha interface.
by isis＠torproject.org 16 May '14

16 May '14

commit a8f35253e47bc47f0f3ca763f29a51224da47d55 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed May 14 20:45:09 2014 +0000 Make publicKey and secretKey attributes of the ICaptcha interface. Both the reCaptcha and GimpCaptcha subclasses of the generic base implementation, bridgedb.captcha.Captcha, of the ICaptcha interface have publicKey and secretKey attributes. In fact, it would be hard to generate a secret CAPTCHA challenge_string which was retrievable later if there weren't any keypairs involved. Ergo, the keypair should be part of the interface specification. --- lib/bridgedb/captcha.py | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/lib/bridgedb/captcha.py b/lib/bridgedb/captcha.py index 8a76198..f5674c4 100644 --- a/lib/bridgedb/captcha.py +++ b/lib/bridgedb/captcha.py @@ -82,6 +82,11 @@ class ICaptcha(Interface): "A string containing the contents of a CAPTCHA image file.") challenge = Attribute( "A unique string associated with the dispursal of this CAPTCHA.") + publicKey = Attribute( + "A public key used for encrypting CAPTCHA challenge strings.") + secretKey = Attribute( + "A private key used for decrypting challenge strings during CAPTCHA" + "solution verification.") def get(): """Retrieve a new CAPTCHA image.""" @@ -92,15 +97,21 @@ class Captcha(object): :ivar str image: The CAPTCHA image. :ivar str challenge: A challenge string which should permit checking of - the client's CAPTCHA solution in some manner. This should be passed - along to the client with the CAPTCHA image. + the client's CAPTCHA solution in some manner. In stateless protocols + such as HTTP, this should be passed along to the client with the + CAPTCHA image. + :ivar publicKey: A public key used for encrypting CAPTCHA challenge strings. + :ivar secretKey: A private key used for decrypting challenge strings during + CAPTCHA solution verification. """ implements(ICaptcha) - def __init__(self): + def __init__(self, publicKey=None, secretKey=None): """Obtain a new CAPTCHA for a client.""" self.image = None self.challenge = None + self.publicKey = publicKey + self.secretKey = secretKey def get(self): return self.image

1 0