summaryrefslogtreecommitdiffstats
path: root/third_party/python/mohawk
diff options
context:
space:
mode:
Diffstat (limited to 'third_party/python/mohawk')
-rw-r--r--third_party/python/mohawk/PKG-INFO19
-rw-r--r--third_party/python/mohawk/README.rst25
-rw-r--r--third_party/python/mohawk/mohawk.egg-info/PKG-INFO19
-rw-r--r--third_party/python/mohawk/mohawk.egg-info/SOURCES.txt15
-rw-r--r--third_party/python/mohawk/mohawk.egg-info/dependency_links.txt1
-rw-r--r--third_party/python/mohawk/mohawk.egg-info/requires.txt1
-rw-r--r--third_party/python/mohawk/mohawk.egg-info/top_level.txt1
-rw-r--r--third_party/python/mohawk/mohawk/__init__.py2
-rw-r--r--third_party/python/mohawk/mohawk/base.py230
-rw-r--r--third_party/python/mohawk/mohawk/bewit.py167
-rw-r--r--third_party/python/mohawk/mohawk/exc.py98
-rw-r--r--third_party/python/mohawk/mohawk/receiver.py170
-rw-r--r--third_party/python/mohawk/mohawk/sender.py178
-rw-r--r--third_party/python/mohawk/mohawk/tests.py823
-rw-r--r--third_party/python/mohawk/mohawk/util.py267
-rw-r--r--third_party/python/mohawk/setup.cfg5
-rw-r--r--third_party/python/mohawk/setup.py25
17 files changed, 2046 insertions, 0 deletions
diff --git a/third_party/python/mohawk/PKG-INFO b/third_party/python/mohawk/PKG-INFO
new file mode 100644
index 0000000000..131f03cfc5
--- /dev/null
+++ b/third_party/python/mohawk/PKG-INFO
@@ -0,0 +1,19 @@
+Metadata-Version: 1.1
+Name: mohawk
+Version: 0.3.4
+Summary: Library for Hawk HTTP authorization
+Home-page: https://github.com/kumar303/mohawk
+Author: Kumar McMillan, Austin King
+Author-email: kumar.mcmillan@gmail.com
+License: MPL 2.0 (Mozilla Public License)
+Description: UNKNOWN
+Platform: UNKNOWN
+Classifier: Intended Audience :: Developers
+Classifier: Natural Language :: English
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 2
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 2.6
+Classifier: Programming Language :: Python :: 2.7
+Classifier: Programming Language :: Python :: 3.3
+Classifier: Topic :: Internet :: WWW/HTTP
diff --git a/third_party/python/mohawk/README.rst b/third_party/python/mohawk/README.rst
new file mode 100644
index 0000000000..e53a8f7e3e
--- /dev/null
+++ b/third_party/python/mohawk/README.rst
@@ -0,0 +1,25 @@
+======
+Mohawk
+======
+.. image:: https://img.shields.io/pypi/v/mohawk.svg
+ :target: https://pypi.python.org/pypi/mohawk
+ :alt: Latest PyPI release
+
+.. image:: https://img.shields.io/pypi/dm/mohawk.svg
+ :target: https://pypi.python.org/pypi/mohawk
+ :alt: PyPI monthly download stats
+
+.. image:: https://travis-ci.org/kumar303/mohawk.svg?branch=master
+ :target: https://travis-ci.org/kumar303/mohawk
+ :alt: Travis master branch status
+
+.. image:: https://readthedocs.org/projects/mohawk/badge/?version=latest
+ :target: https://mohawk.readthedocs.io/en/latest/?badge=latest
+ :alt: Documentation status
+
+Mohawk is an alternate Python implementation of the
+`Hawk HTTP authorization scheme`_.
+
+Full documentation: https://mohawk.readthedocs.io/
+
+.. _`Hawk HTTP authorization scheme`: https://github.com/hueniverse/hawk
diff --git a/third_party/python/mohawk/mohawk.egg-info/PKG-INFO b/third_party/python/mohawk/mohawk.egg-info/PKG-INFO
new file mode 100644
index 0000000000..131f03cfc5
--- /dev/null
+++ b/third_party/python/mohawk/mohawk.egg-info/PKG-INFO
@@ -0,0 +1,19 @@
+Metadata-Version: 1.1
+Name: mohawk
+Version: 0.3.4
+Summary: Library for Hawk HTTP authorization
+Home-page: https://github.com/kumar303/mohawk
+Author: Kumar McMillan, Austin King
+Author-email: kumar.mcmillan@gmail.com
+License: MPL 2.0 (Mozilla Public License)
+Description: UNKNOWN
+Platform: UNKNOWN
+Classifier: Intended Audience :: Developers
+Classifier: Natural Language :: English
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 2
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 2.6
+Classifier: Programming Language :: Python :: 2.7
+Classifier: Programming Language :: Python :: 3.3
+Classifier: Topic :: Internet :: WWW/HTTP
diff --git a/third_party/python/mohawk/mohawk.egg-info/SOURCES.txt b/third_party/python/mohawk/mohawk.egg-info/SOURCES.txt
new file mode 100644
index 0000000000..880beddbc4
--- /dev/null
+++ b/third_party/python/mohawk/mohawk.egg-info/SOURCES.txt
@@ -0,0 +1,15 @@
+README.rst
+setup.py
+mohawk/__init__.py
+mohawk/base.py
+mohawk/bewit.py
+mohawk/exc.py
+mohawk/receiver.py
+mohawk/sender.py
+mohawk/tests.py
+mohawk/util.py
+mohawk.egg-info/PKG-INFO
+mohawk.egg-info/SOURCES.txt
+mohawk.egg-info/dependency_links.txt
+mohawk.egg-info/requires.txt
+mohawk.egg-info/top_level.txt \ No newline at end of file
diff --git a/third_party/python/mohawk/mohawk.egg-info/dependency_links.txt b/third_party/python/mohawk/mohawk.egg-info/dependency_links.txt
new file mode 100644
index 0000000000..8b13789179
--- /dev/null
+++ b/third_party/python/mohawk/mohawk.egg-info/dependency_links.txt
@@ -0,0 +1 @@
+
diff --git a/third_party/python/mohawk/mohawk.egg-info/requires.txt b/third_party/python/mohawk/mohawk.egg-info/requires.txt
new file mode 100644
index 0000000000..ffe2fce498
--- /dev/null
+++ b/third_party/python/mohawk/mohawk.egg-info/requires.txt
@@ -0,0 +1 @@
+six
diff --git a/third_party/python/mohawk/mohawk.egg-info/top_level.txt b/third_party/python/mohawk/mohawk.egg-info/top_level.txt
new file mode 100644
index 0000000000..2b859fd06c
--- /dev/null
+++ b/third_party/python/mohawk/mohawk.egg-info/top_level.txt
@@ -0,0 +1 @@
+mohawk
diff --git a/third_party/python/mohawk/mohawk/__init__.py b/third_party/python/mohawk/mohawk/__init__.py
new file mode 100644
index 0000000000..a79e7b7164
--- /dev/null
+++ b/third_party/python/mohawk/mohawk/__init__.py
@@ -0,0 +1,2 @@
+from .sender import *
+from .receiver import *
diff --git a/third_party/python/mohawk/mohawk/base.py b/third_party/python/mohawk/mohawk/base.py
new file mode 100644
index 0000000000..4935110568
--- /dev/null
+++ b/third_party/python/mohawk/mohawk/base.py
@@ -0,0 +1,230 @@
+import logging
+import math
+import pprint
+
+import six
+from six.moves.urllib.parse import urlparse
+
+from .exc import (AlreadyProcessed,
+ MacMismatch,
+ MisComputedContentHash,
+ TokenExpired)
+from .util import (calculate_mac,
+ calculate_payload_hash,
+ calculate_ts_mac,
+ prepare_header_val,
+ random_string,
+ strings_match,
+ utc_now)
+
+default_ts_skew_in_seconds = 60
+log = logging.getLogger(__name__)
+
+
+class HawkAuthority:
+
+ def _authorize(self, mac_type, parsed_header, resource,
+ their_timestamp=None,
+ timestamp_skew_in_seconds=default_ts_skew_in_seconds,
+ localtime_offset_in_seconds=0,
+ accept_untrusted_content=False):
+
+ now = utc_now(offset_in_seconds=localtime_offset_in_seconds)
+
+ their_hash = parsed_header.get('hash', '')
+ their_mac = parsed_header.get('mac', '')
+ mac = calculate_mac(mac_type, resource, their_hash)
+ if not strings_match(mac, their_mac):
+ raise MacMismatch('MACs do not match; ours: {ours}; '
+ 'theirs: {theirs}'
+ .format(ours=mac, theirs=their_mac))
+
+ if 'hash' not in parsed_header and accept_untrusted_content:
+ # The request did not hash its content.
+ log.debug('NOT calculating/verifiying payload hash '
+ '(no hash in header)')
+ check_hash = False
+ content_hash = None
+ else:
+ check_hash = True
+ content_hash = resource.gen_content_hash()
+
+ if check_hash and not their_hash:
+ log.info('request unexpectedly did not hash its content')
+
+ if check_hash:
+ if not strings_match(content_hash, their_hash):
+ # The hash declared in the header is incorrect.
+ # Content could have been tampered with.
+ log.debug('mismatched content: {content}'
+ .format(content=repr(resource.content)))
+ log.debug('mismatched content-type: {typ}'
+ .format(typ=repr(resource.content_type)))
+ raise MisComputedContentHash(
+ 'Our hash {ours} ({algo}) did not '
+ 'match theirs {theirs}'
+ .format(ours=content_hash,
+ theirs=their_hash,
+ algo=resource.credentials['algorithm']))
+
+ if resource.seen_nonce:
+ if resource.seen_nonce(resource.credentials['id'],
+ parsed_header['nonce'],
+ parsed_header['ts']):
+ raise AlreadyProcessed('Nonce {nonce} with timestamp {ts} '
+ 'has already been processed for {id}'
+ .format(nonce=parsed_header['nonce'],
+ ts=parsed_header['ts'],
+ id=resource.credentials['id']))
+ else:
+ log.warn('seen_nonce was None; not checking nonce. '
+ 'You may be vulnerable to replay attacks')
+
+ their_ts = int(their_timestamp or parsed_header['ts'])
+
+ if math.fabs(their_ts - now) > timestamp_skew_in_seconds:
+ message = ('token with UTC timestamp {ts} has expired; '
+ 'it was compared to {now}'
+ .format(ts=their_ts, now=now))
+ tsm = calculate_ts_mac(now, resource.credentials)
+ if isinstance(tsm, six.binary_type):
+ tsm = tsm.decode('ascii')
+ www_authenticate = ('Hawk ts="{ts}", tsm="{tsm}", error="{error}"'
+ .format(ts=now, tsm=tsm, error=message))
+ raise TokenExpired(message,
+ localtime_in_seconds=now,
+ www_authenticate=www_authenticate)
+
+ log.debug('authorized OK')
+
+ def _make_header(self, resource, mac, additional_keys=None):
+ keys = additional_keys
+ if not keys:
+ # These are the default header keys that you'd send with a
+ # request header. Response headers are odd because they
+ # exclude a bunch of keys.
+ keys = ('id', 'ts', 'nonce', 'ext', 'app', 'dlg')
+
+ header = u'Hawk mac="{mac}"'.format(mac=prepare_header_val(mac))
+
+ if resource.content_hash:
+ header = u'{header}, hash="{hash}"'.format(
+ header=header,
+ hash=prepare_header_val(resource.content_hash))
+
+ if 'id' in keys:
+ header = u'{header}, id="{id}"'.format(
+ header=header,
+ id=prepare_header_val(resource.credentials['id']))
+
+ if 'ts' in keys:
+ header = u'{header}, ts="{ts}"'.format(
+ header=header, ts=prepare_header_val(resource.timestamp))
+
+ if 'nonce' in keys:
+ header = u'{header}, nonce="{nonce}"'.format(
+ header=header, nonce=prepare_header_val(resource.nonce))
+
+ # These are optional so we need to check if they have values first.
+
+ if 'ext' in keys and resource.ext:
+ header = u'{header}, ext="{ext}"'.format(
+ header=header, ext=prepare_header_val(resource.ext))
+
+ if 'app' in keys and resource.app:
+ header = u'{header}, app="{app}"'.format(
+ header=header, app=prepare_header_val(resource.app))
+
+ if 'dlg' in keys and resource.dlg:
+ header = u'{header}, dlg="{dlg}"'.format(
+ header=header, dlg=prepare_header_val(resource.dlg))
+
+ log.debug('Hawk header for URL={url} method={method}: {header}'
+ .format(url=resource.url, method=resource.method,
+ header=header))
+ return header
+
+
+class Resource:
+ """
+ Normalized request/response resource.
+ """
+
+ def __init__(self, **kw):
+ self.credentials = kw.pop('credentials')
+ self.method = kw.pop('method').upper()
+ self.content = kw.pop('content', None)
+ self.content_type = kw.pop('content_type', None)
+ self.always_hash_content = kw.pop('always_hash_content', True)
+ self.ext = kw.pop('ext', None)
+ self.app = kw.pop('app', None)
+ self.dlg = kw.pop('dlg', None)
+
+ self.timestamp = str(kw.pop('timestamp', None) or utc_now())
+
+ self.nonce = kw.pop('nonce', None)
+ if self.nonce is None:
+ self.nonce = random_string(6)
+
+ # This is a lookup function for checking nonces.
+ self.seen_nonce = kw.pop('seen_nonce', None)
+
+ self.url = kw.pop('url')
+ if not self.url:
+ raise ValueError('url was empty')
+ url_parts = self.parse_url(self.url)
+ log.debug('parsed URL parts: \n{parts}'
+ .format(parts=pprint.pformat(url_parts)))
+
+ self.name = url_parts['resource'] or ''
+ self.host = url_parts['hostname'] or ''
+ self.port = str(url_parts['port'])
+
+ if kw.keys():
+ raise TypeError('Unknown keyword argument(s): {0}'
+ .format(kw.keys()))
+
+ @property
+ def content_hash(self):
+ if not hasattr(self, '_content_hash'):
+ raise AttributeError(
+ 'Cannot access content_hash because it has not been generated')
+ return self._content_hash
+
+ def gen_content_hash(self):
+ if self.content is None or self.content_type is None:
+ if self.always_hash_content:
+ # Be really strict about allowing developers to skip content
+ # hashing. If they get this far they may be unintentiionally
+ # skipping it.
+ raise ValueError(
+ 'payload content and/or content_type cannot be '
+ 'empty without an explicit allowance')
+ log.debug('NOT hashing content')
+ self._content_hash = None
+ else:
+ self._content_hash = calculate_payload_hash(
+ self.content, self.credentials['algorithm'],
+ self.content_type)
+ return self.content_hash
+
+ def parse_url(self, url):
+ url_parts = urlparse(url)
+ url_dict = {
+ 'scheme': url_parts.scheme,
+ 'hostname': url_parts.hostname,
+ 'port': url_parts.port,
+ 'path': url_parts.path,
+ 'resource': url_parts.path,
+ 'query': url_parts.query,
+ }
+ if len(url_dict['query']) > 0:
+ url_dict['resource'] = '%s?%s' % (url_dict['resource'],
+ url_dict['query'])
+
+ if url_parts.port is None:
+ if url_parts.scheme == 'http':
+ url_dict['port'] = 80
+ elif url_parts.scheme == 'https':
+ url_dict['port'] = 443
+ return url_dict
diff --git a/third_party/python/mohawk/mohawk/bewit.py b/third_party/python/mohawk/mohawk/bewit.py
new file mode 100644
index 0000000000..ec83923655
--- /dev/null
+++ b/third_party/python/mohawk/mohawk/bewit.py
@@ -0,0 +1,167 @@
+from base64 import urlsafe_b64encode, b64decode
+from collections import namedtuple
+import logging
+import re
+
+import six
+
+from .base import Resource
+from .util import (calculate_mac,
+ utc_now)
+from .exc import (CredentialsLookupError,
+ InvalidBewit,
+ MacMismatch,
+ TokenExpired)
+
+log = logging.getLogger(__name__)
+
+
+def get_bewit(resource):
+ """
+ Returns a bewit identifier for the resource as a string.
+
+ :param resource:
+ Resource to generate a bewit for
+ :type resource: `mohawk.base.Resource`
+ """
+ if resource.method != 'GET':
+ raise ValueError('bewits can only be generated for GET requests')
+ if resource.nonce != '':
+ raise ValueError('bewits must use an empty nonce')
+ mac = calculate_mac(
+ 'bewit',
+ resource,
+ None,
+ )
+
+ if isinstance(mac, six.binary_type):
+ mac = mac.decode('ascii')
+
+ if resource.ext is None:
+ ext = ''
+ else:
+ ext = resource.ext
+
+ # Strip out \ from the client id
+ # since that can break parsing the response
+ # NB that the canonical implementation does not do this as of
+ # Oct 28, 2015, so this could break compat.
+ # We can leave \ in ext since validators can limit how many \ they split
+ # on (although again, the canonical implementation does not do this)
+ client_id = six.text_type(resource.credentials['id'])
+ if "\\" in client_id:
+ log.warn("Stripping backslash character(s) '\\' from client_id")
+ client_id = client_id.replace("\\", "")
+
+ # b64encode works only with bytes in python3, but all of our parameters are
+ # in unicode, so we need to encode them. The cleanest way to do this that
+ # works in both python 2 and 3 is to use string formatting to get a
+ # unicode string, and then explicitly encode it to bytes.
+ inner_bewit = u"{id}\\{exp}\\{mac}\\{ext}".format(
+ id=client_id,
+ exp=resource.timestamp,
+ mac=mac,
+ ext=ext,
+ )
+ inner_bewit_bytes = inner_bewit.encode('ascii')
+ bewit_bytes = urlsafe_b64encode(inner_bewit_bytes)
+ # Now decode the resulting bytes back to a unicode string
+ return bewit_bytes.decode('ascii')
+
+
+bewittuple = namedtuple('bewittuple', 'id expiration mac ext')
+
+
+def parse_bewit(bewit):
+ """
+ Returns a `bewittuple` representing the parts of an encoded bewit string.
+ This has the following named attributes:
+ (id, expiration, mac, ext)
+
+ :param bewit:
+ A base64 encoded bewit string
+ :type bewit: str
+ """
+ decoded_bewit = b64decode(bewit).decode('ascii')
+ bewit_parts = decoded_bewit.split("\\", 3)
+ if len(bewit_parts) != 4:
+ raise InvalidBewit('Expected 4 parts to bewit: %s' % decoded_bewit)
+ return bewittuple(*decoded_bewit.split("\\", 3))
+
+
+def strip_bewit(url):
+ """
+ Strips the bewit parameter out of a url.
+
+ Returns (encoded_bewit, stripped_url)
+
+ Raises InvalidBewit if no bewit found.
+
+ :param url:
+ The url containing a bewit parameter
+ :type url: str
+ """
+ m = re.search('[?&]bewit=([^&]+)', url)
+ if not m:
+ raise InvalidBewit('no bewit data found')
+ bewit = m.group(1)
+ stripped_url = url[:m.start()] + url[m.end():]
+ return bewit, stripped_url
+
+
+def check_bewit(url, credential_lookup, now=None):
+ """
+ Validates the given bewit.
+
+ Returns True if the resource has a valid bewit parameter attached,
+ or raises a subclass of HawkFail otherwise.
+
+ :param credential_lookup:
+ Callable to look up the credentials dict by sender ID.
+ The credentials dict must have the keys:
+ ``id``, ``key``, and ``algorithm``.
+ See :ref:`receiving-request` for an example.
+ :type credential_lookup: callable
+
+ :param now=None:
+ Unix epoch time for the current time to determine if bewit has expired.
+ If None, then the current time as given by utc_now() is used.
+ :type now=None: integer
+ """
+ raw_bewit, stripped_url = strip_bewit(url)
+ bewit = parse_bewit(raw_bewit)
+ try:
+ credentials = credential_lookup(bewit.id)
+ except LookupError:
+ raise CredentialsLookupError('Could not find credentials for ID {0}'
+ .format(bewit.id))
+
+ res = Resource(url=stripped_url,
+ method='GET',
+ credentials=credentials,
+ timestamp=bewit.expiration,
+ nonce='',
+ ext=bewit.ext,
+ )
+ mac = calculate_mac('bewit', res, None)
+ mac = mac.decode('ascii')
+
+ if mac != bewit.mac:
+ raise MacMismatch('bewit with mac {bewit_mac} did not match expected mac {expected_mac}'
+ .format(bewit_mac=bewit.mac,
+ expected_mac=mac))
+
+ # Check that the timestamp isn't expired
+ if now is None:
+ # TODO: Add offset/skew
+ now = utc_now()
+ if int(bewit.expiration) < now:
+ # TODO: Refactor TokenExpired to handle this better
+ raise TokenExpired('bewit with UTC timestamp {ts} has expired; '
+ 'it was compared to {now}'
+ .format(ts=bewit.expiration, now=now),
+ localtime_in_seconds=now,
+ www_authenticate=''
+ )
+
+ return True
diff --git a/third_party/python/mohawk/mohawk/exc.py b/third_party/python/mohawk/mohawk/exc.py
new file mode 100644
index 0000000000..9376995f2c
--- /dev/null
+++ b/third_party/python/mohawk/mohawk/exc.py
@@ -0,0 +1,98 @@
+"""
+If you want to catch any exception that might be raised,
+catch :class:`mohawk.exc.HawkFail`.
+"""
+
+
+class HawkFail(Exception):
+ """
+ All Mohawk exceptions derive from this base.
+ """
+
+
+class MissingAuthorization(HawkFail):
+ """
+ No authorization header was sent by the client.
+ """
+
+
+class InvalidCredentials(HawkFail):
+ """
+ The specified Hawk credentials are invalid.
+
+ For example, the dict could be formatted incorrectly.
+ """
+
+
+class CredentialsLookupError(HawkFail):
+ """
+ A :class:`mohawk.Receiver` could not look up the
+ credentials for an incoming request.
+ """
+
+
+class BadHeaderValue(HawkFail):
+ """
+ There was an error with an attribute or value when parsing
+ or creating a Hawk header.
+ """
+
+
+class MacMismatch(HawkFail):
+ """
+ The locally calculated MAC did not match the MAC that was sent.
+ """
+
+
+class MisComputedContentHash(HawkFail):
+ """
+ The signature of the content did not match the actual content.
+ """
+
+
+class TokenExpired(HawkFail):
+ """
+ The timestamp on a message received has expired.
+
+ You may also receive this message if your server clock is out of sync.
+ Consider synchronizing it with something like `TLSdate`_.
+
+ If you are unable to synchronize your clock universally,
+ The `Hawk`_ spec mentions how you can `adjust`_
+ your sender's time to match that of the receiver in the case
+ of unexpected expiration.
+
+ The ``www_authenticate`` attribute of this exception is a header
+ that can be returned to the client. If the value is not None, it
+ will include a timestamp HMAC'd with the sender's credentials.
+ This will allow the client
+ to verify the value and safely apply an offset.
+
+ .. _`Hawk`: https://github.com/hueniverse/hawk
+ .. _`adjust`: https://github.com/hueniverse/hawk#future-time-manipulation
+ .. _`TLSdate`: http://linux-audit.com/tlsdate-the-secure-alternative-for-ntpd-ntpdate-and-rdate/
+ """
+ #: Current local time in seconds that was used to compare timestamps.
+ localtime_in_seconds = None
+ # A header containing an HMAC'd server timestamp that the sender can verify.
+ www_authenticate = None
+
+ def __init__(self, *args, **kw):
+ self.localtime_in_seconds = kw.pop('localtime_in_seconds')
+ self.www_authenticate = kw.pop('www_authenticate')
+ super(HawkFail, self).__init__(*args, **kw)
+
+
+class AlreadyProcessed(HawkFail):
+ """
+ The message has already been processed and cannot be re-processed.
+
+ See :ref:`nonce` for details.
+ """
+
+
+class InvalidBewit(HawkFail):
+ """
+ The bewit is invalid; e.g. it doesn't contain the right number of
+ parameters.
+ """
diff --git a/third_party/python/mohawk/mohawk/receiver.py b/third_party/python/mohawk/mohawk/receiver.py
new file mode 100644
index 0000000000..509729ea8d
--- /dev/null
+++ b/third_party/python/mohawk/mohawk/receiver.py
@@ -0,0 +1,170 @@
+import logging
+import sys
+
+from .base import default_ts_skew_in_seconds, HawkAuthority, Resource
+from .exc import CredentialsLookupError, MissingAuthorization
+from .util import (calculate_mac,
+ parse_authorization_header,
+ validate_credentials)
+
+__all__ = ['Receiver']
+log = logging.getLogger(__name__)
+
+
+class Receiver(HawkAuthority):
+ """
+ A Hawk authority that will receive and respond to requests.
+
+ :param credentials_map:
+ Callable to look up the credentials dict by sender ID.
+ The credentials dict must have the keys:
+ ``id``, ``key``, and ``algorithm``.
+ See :ref:`receiving-request` for an example.
+ :type credentials_map: callable
+
+ :param request_header:
+ A `Hawk`_ ``Authorization`` header
+ such as one created by :class:`mohawk.Sender`.
+ :type request_header: str
+
+ :param url: Absolute URL of the request.
+ :type url: str
+
+ :param method: Method of the request. E.G. POST, GET
+ :type method: str
+
+ :param content=None: Byte string of request body.
+ :type content=None: str
+
+ :param content_type=None: content-type header value for request.
+ :type content_type=None: str
+
+ :param accept_untrusted_content=False:
+ When True, allow requests that do not hash their content or
+ allow None type ``content`` and ``content_type``
+ arguments. Read :ref:`skipping-content-checks`
+ to learn more.
+ :type accept_untrusted_content=False: bool
+
+ :param localtime_offset_in_seconds=0:
+ Seconds to add to local time in case it's out of sync.
+ :type localtime_offset_in_seconds=0: float
+
+ :param timestamp_skew_in_seconds=60:
+ Max seconds until a message expires. Upon expiry,
+ :class:`mohawk.exc.TokenExpired` is raised.
+ :type timestamp_skew_in_seconds=60: float
+
+ .. _`Hawk`: https://github.com/hueniverse/hawk
+ """
+ #: Value suitable for a ``Server-Authorization`` header.
+ response_header = None
+
+ def __init__(self,
+ credentials_map,
+ request_header,
+ url,
+ method,
+ content=None,
+ content_type=None,
+ seen_nonce=None,
+ localtime_offset_in_seconds=0,
+ accept_untrusted_content=False,
+ timestamp_skew_in_seconds=default_ts_skew_in_seconds,
+ **auth_kw):
+
+ self.response_header = None # make into property that can raise exc?
+ self.credentials_map = credentials_map
+ self.seen_nonce = seen_nonce
+
+ log.debug('accepting request {header}'.format(header=request_header))
+
+ if not request_header:
+ raise MissingAuthorization()
+
+ parsed_header = parse_authorization_header(request_header)
+
+ try:
+ credentials = self.credentials_map(parsed_header['id'])
+ except LookupError:
+ etype, val, tb = sys.exc_info()
+ log.debug('Catching {etype}: {val}'.format(etype=etype, val=val))
+ raise CredentialsLookupError(
+ 'Could not find credentials for ID {0}'
+ .format(parsed_header['id']))
+ validate_credentials(credentials)
+
+ resource = Resource(url=url,
+ method=method,
+ ext=parsed_header.get('ext', None),
+ app=parsed_header.get('app', None),
+ dlg=parsed_header.get('dlg', None),
+ credentials=credentials,
+ nonce=parsed_header['nonce'],
+ seen_nonce=self.seen_nonce,
+ content=content,
+ timestamp=parsed_header['ts'],
+ content_type=content_type)
+
+ self._authorize(
+ 'header', parsed_header, resource,
+ timestamp_skew_in_seconds=timestamp_skew_in_seconds,
+ localtime_offset_in_seconds=localtime_offset_in_seconds,
+ accept_untrusted_content=accept_untrusted_content,
+ **auth_kw)
+
+ # Now that we verified an incoming request, we can re-use some of its
+ # properties to build our response header.
+
+ self.parsed_header = parsed_header
+ self.resource = resource
+
+ def respond(self,
+ content=None,
+ content_type=None,
+ always_hash_content=True,
+ ext=None):
+ """
+ Respond to the request.
+
+ This generates the :attr:`mohawk.Receiver.response_header`
+ attribute.
+
+ :param content=None: Byte string of response body that will be sent.
+ :type content=None: str
+
+ :param content_type=None: content-type header value for response.
+ :type content_type=None: str
+
+ :param always_hash_content=True:
+ When True, ``content`` and ``content_type`` cannot be None.
+ Read :ref:`skipping-content-checks` to learn more.
+ :type always_hash_content=True: bool
+
+ :param ext=None:
+ An external `Hawk`_ string. If not None, this value will be
+ signed so that the sender can trust it.
+ :type ext=None: str
+
+ .. _`Hawk`: https://github.com/hueniverse/hawk
+ """
+
+ log.debug('generating response header')
+
+ resource = Resource(url=self.resource.url,
+ credentials=self.resource.credentials,
+ ext=ext,
+ app=self.parsed_header.get('app', None),
+ dlg=self.parsed_header.get('dlg', None),
+ method=self.resource.method,
+ content=content,
+ content_type=content_type,
+ always_hash_content=always_hash_content,
+ nonce=self.parsed_header['nonce'],
+ timestamp=self.parsed_header['ts'])
+
+ mac = calculate_mac('response', resource, resource.gen_content_hash())
+
+ self.response_header = self._make_header(resource, mac,
+ additional_keys=['ext'])
+ return self.response_header
diff --git a/third_party/python/mohawk/mohawk/sender.py b/third_party/python/mohawk/mohawk/sender.py
new file mode 100644
index 0000000000..b6f3edc170
--- /dev/null
+++ b/third_party/python/mohawk/mohawk/sender.py
@@ -0,0 +1,178 @@
+import logging
+
+from .base import default_ts_skew_in_seconds, HawkAuthority, Resource
+from .util import (calculate_mac,
+ parse_authorization_header,
+ validate_credentials)
+
+__all__ = ['Sender']
+log = logging.getLogger(__name__)
+
+
+class Sender(HawkAuthority):
+ """
+ A Hawk authority that will emit requests and verify responses.
+
+ :param credentials: Dict of credentials with keys ``id``, ``key``,
+ and ``algorithm``. See :ref:`usage` for an example.
+ :type credentials: dict
+
+ :param url: Absolute URL of the request.
+ :type url: str
+
+ :param method: Method of the request. E.G. POST, GET
+ :type method: str
+
+ :param content=None: Byte string of request body.
+ :type content=None: str
+
+ :param content_type=None: content-type header value for request.
+ :type content_type=None: str
+
+ :param always_hash_content=True:
+ When True, ``content`` and ``content_type`` cannot be None.
+ Read :ref:`skipping-content-checks` to learn more.
+ :type always_hash_content=True: bool
+
+ :param nonce=None:
+ A string that when coupled with the timestamp will
+ uniquely identify this request to prevent replays.
+ If None, a nonce will be generated for you.
+ :type nonce=None: str
+
+ :param ext=None:
+ An external `Hawk`_ string. If not None, this value will be signed
+ so that the receiver can trust it.
+ :type ext=None: str
+
+ :param app=None:
+ A `Hawk`_ application string. If not None, this value will be signed
+ so that the receiver can trust it.
+ :type app=None: str
+
+ :param dlg=None:
+ A `Hawk`_ delegation string. If not None, this value will be signed
+ so that the receiver can trust it.
+ :type dlg=None: str
+
+ :param seen_nonce=None:
+ A callable that returns True if a nonce has been seen.
+ See :ref:`nonce` for details.
+ :type seen_nonce=None: callable
+
+ .. _`Hawk`: https://github.com/hueniverse/hawk
+ """
+ #: Value suitable for an ``Authorization`` header.
+ request_header = None
+
+ def __init__(self, credentials,
+ url,
+ method,
+ content=None,
+ content_type=None,
+ always_hash_content=True,
+ nonce=None,
+ ext=None,
+ app=None,
+ dlg=None,
+ seen_nonce=None,
+ # For easier testing:
+ _timestamp=None):
+
+ self.reconfigure(credentials)
+ self.request_header = None
+ self.seen_nonce = seen_nonce
+
+ log.debug('generating request header')
+ self.req_resource = Resource(url=url,
+ credentials=self.credentials,
+ ext=ext,
+ app=app,
+ dlg=dlg,
+ nonce=nonce,
+ method=method,
+ content=content,
+ always_hash_content=always_hash_content,
+ timestamp=_timestamp,
+ content_type=content_type)
+
+ mac = calculate_mac('header', self.req_resource,
+ self.req_resource.gen_content_hash())
+ self.request_header = self._make_header(self.req_resource, mac)
+
+ def accept_response(self,
+ response_header,
+ content=None,
+ content_type=None,
+ accept_untrusted_content=False,
+ localtime_offset_in_seconds=0,
+ timestamp_skew_in_seconds=default_ts_skew_in_seconds,
+ **auth_kw):
+ """
+ Accept a response to this request.
+
+ :param response_header:
+ A `Hawk`_ ``Server-Authorization`` header
+ such as one created by :class:`mohawk.Receiver`.
+ :type response_header: str
+
+ :param content=None: Byte string of the response body received.
+ :type content=None: str
+
+ :param content_type=None:
+ Content-Type header value of the response received.
+ :type content_type=None: str
+
+ :param accept_untrusted_content=False:
+ When True, allow responses that do not hash their content or
+ allow None type ``content`` and ``content_type``
+ arguments. Read :ref:`skipping-content-checks`
+ to learn more.
+ :type accept_untrusted_content=False: bool
+
+ :param localtime_offset_in_seconds=0:
+ Seconds to add to local time in case it's out of sync.
+ :type localtime_offset_in_seconds=0: float
+
+ :param timestamp_skew_in_seconds=60:
+ Max seconds until a message expires. Upon expiry,
+ :class:`mohawk.exc.TokenExpired` is raised.
+ :type timestamp_skew_in_seconds=60: float
+
+ .. _`Hawk`: https://github.com/hueniverse/hawk
+ """
+ log.debug('accepting response {header}'
+ .format(header=response_header))
+
+ parsed_header = parse_authorization_header(response_header)
+
+ resource = Resource(ext=parsed_header.get('ext', None),
+ content=content,
+ content_type=content_type,
+ # The following response attributes are
+ # in reference to the original request,
+ # not to the reponse header:
+ timestamp=self.req_resource.timestamp,
+ nonce=self.req_resource.nonce,
+ url=self.req_resource.url,
+ method=self.req_resource.method,
+ app=self.req_resource.app,
+ dlg=self.req_resource.dlg,
+ credentials=self.credentials,
+ seen_nonce=self.seen_nonce)
+
+ self._authorize(
+ 'response', parsed_header, resource,
+ # Per Node lib, a responder macs the *sender's* timestamp.
+ # It does not create its own timestamp.
+ # I suppose a slow response could time out here. Maybe only check
+ # mac failures, not timeouts?
+ their_timestamp=resource.timestamp,
+ timestamp_skew_in_seconds=timestamp_skew_in_seconds,
+ localtime_offset_in_seconds=localtime_offset_in_seconds,
+ accept_untrusted_content=accept_untrusted_content,
+ **auth_kw)
+
+ def reconfigure(self, credentials):
+ validate_credentials(credentials)
+ self.credentials = credentials
diff --git a/third_party/python/mohawk/mohawk/tests.py b/third_party/python/mohawk/mohawk/tests.py
new file mode 100644
index 0000000000..eeb71506d1
--- /dev/null
+++ b/third_party/python/mohawk/mohawk/tests.py
@@ -0,0 +1,823 @@
+import sys
+from unittest import TestCase
+from base64 import b64decode, urlsafe_b64encode
+
+import mock
+from nose.tools import eq_, raises
+import six
+
+from . import Receiver, Sender
+from .base import Resource
+from .exc import (AlreadyProcessed,
+ BadHeaderValue,
+ CredentialsLookupError,
+ InvalidCredentials,
+ MacMismatch,
+ MisComputedContentHash,
+ MissingAuthorization,
+ TokenExpired,
+ InvalidBewit)
+from .util import (parse_authorization_header,
+ utc_now,
+ calculate_ts_mac,
+ validate_credentials)
+from .bewit import (get_bewit,
+ check_bewit,
+ strip_bewit,
+ parse_bewit)
+
+
+class Base(TestCase):
+
+ def setUp(self):
+ self.credentials = {
+ 'id': 'my-hawk-id',
+ 'key': 'my hAwK sekret',
+ 'algorithm': 'sha256',
+ }
+
+ # This callable might be replaced by tests.
+ def seen_nonce(id, nonce, ts):
+ return False
+ self.seen_nonce = seen_nonce
+
+ def credentials_map(self, id):
+ # Pretend this is doing something more interesting like looking up
+ # a credentials by ID in a database.
+ if self.credentials['id'] != id:
+ raise LookupError('No credentialsuration for Hawk ID {id}'
+ .format(id=id))
+ return self.credentials
+
+
+class TestConfig(Base):
+
+ @raises(InvalidCredentials)
+ def test_no_id(self):
+ c = self.credentials.copy()
+ del c['id']
+ validate_credentials(c)
+
+ @raises(InvalidCredentials)
+ def test_no_key(self):
+ c = self.credentials.copy()
+ del c['key']
+ validate_credentials(c)
+
+ @raises(InvalidCredentials)
+ def test_no_algo(self):
+ c = self.credentials.copy()
+ del c['algorithm']
+ validate_credentials(c)
+
+ @raises(InvalidCredentials)
+ def test_no_credentials(self):
+ validate_credentials(None)
+
+ def test_non_dict_credentials(self):
+ class WeirdThing(object):
+ def __getitem__(self, key):
+ return 'whatever'
+ validate_credentials(WeirdThing())
+
+
+class TestSender(Base):
+
+ def setUp(self):
+ super(TestSender, self).setUp()
+ self.url = 'http://site.com/foo?bar=1'
+
+ def Sender(self, method='GET', **kw):
+ credentials = kw.pop('credentials', self.credentials)
+ kw.setdefault('content', '')
+ kw.setdefault('content_type', '')
+ sender = Sender(credentials, self.url, method, **kw)
+ return sender
+
+ def receive(self, request_header, url=None, method='GET', **kw):
+ credentials_map = kw.pop('credentials_map', self.credentials_map)
+ kw.setdefault('content', '')
+ kw.setdefault('content_type', '')
+ kw.setdefault('seen_nonce', self.seen_nonce)
+ return Receiver(credentials_map, request_header,
+ url or self.url, method, **kw)
+
+ def test_get_ok(self):
+ method = 'GET'
+ sn = self.Sender(method=method)
+ self.receive(sn.request_header, method=method)
+
+ def test_post_ok(self):
+ method = 'POST'
+ sn = self.Sender(method=method)
+ self.receive(sn.request_header, method=method)
+
+ def test_post_content_ok(self):
+ method = 'POST'
+ content = 'foo=bar&baz=2'
+ sn = self.Sender(method=method, content=content)
+ self.receive(sn.request_header, method=method, content=content)
+
+ def test_post_content_type_ok(self):
+ method = 'POST'
+ content = '{"bar": "foobs"}'
+ content_type = 'application/json'
+ sn = self.Sender(method=method, content=content,
+ content_type=content_type)
+ self.receive(sn.request_header, method=method, content=content,
+ content_type=content_type)
+
+ def test_post_content_type_with_trailing_charset(self):
+ method = 'POST'
+ content = '{"bar": "foobs"}'
+ content_type = 'application/json; charset=utf8'
+ sn = self.Sender(method=method, content=content,
+ content_type=content_type)
+ self.receive(sn.request_header, method=method, content=content,
+ content_type='application/json; charset=other')
+
+ @raises(ValueError)
+ def test_missing_payload_details(self):
+ self.Sender(method='POST', content=None, content_type=None)
+
+ def test_skip_payload_hashing(self):
+ method = 'POST'
+ content = '{"bar": "foobs"}'
+ content_type = 'application/json'
+ sn = self.Sender(method=method, content=None, content_type=None,
+ always_hash_content=False)
+ self.receive(sn.request_header, method=method, content=content,
+ content_type=content_type,
+ accept_untrusted_content=True)
+
+ @raises(ValueError)
+ def test_cannot_skip_content_only(self):
+ self.Sender(method='POST', content=None,
+ content_type='application/json')
+
+ @raises(ValueError)
+ def test_cannot_skip_content_type_only(self):
+ self.Sender(method='POST', content='{"foo": "bar"}',
+ content_type=None)
+
+ @raises(MacMismatch)
+ def test_tamper_with_host(self):
+ sn = self.Sender()
+ self.receive(sn.request_header, url='http://TAMPERED-WITH.com')
+
+ @raises(MacMismatch)
+ def test_tamper_with_method(self):
+ sn = self.Sender(method='GET')
+ self.receive(sn.request_header, method='POST')
+
+ @raises(MacMismatch)
+ def test_tamper_with_path(self):
+ sn = self.Sender()
+ self.receive(sn.request_header,
+ url='http://site.com/TAMPERED?bar=1')
+
+ @raises(MacMismatch)
+ def test_tamper_with_query(self):
+ sn = self.Sender()
+ self.receive(sn.request_header,
+ url='http://site.com/foo?bar=TAMPERED')
+
+ @raises(MacMismatch)
+ def test_tamper_with_scheme(self):
+ sn = self.Sender()
+ self.receive(sn.request_header, url='https://site.com/foo?bar=1')
+
+ @raises(MacMismatch)
+ def test_tamper_with_port(self):
+ sn = self.Sender()
+ self.receive(sn.request_header,
+ url='http://site.com:8000/foo?bar=1')
+
+ @raises(MisComputedContentHash)
+ def test_tamper_with_content(self):
+ sn = self.Sender()
+ self.receive(sn.request_header, content='stuff=nope')
+
+ def test_non_ascii_content(self):
+ content = u'Ivan Kristi\u0107'
+ sn = self.Sender(content=content)
+ self.receive(sn.request_header, content=content)
+
+ @raises(MacMismatch)
+ def test_tamper_with_content_type(self):
+ sn = self.Sender(method='POST')
+ self.receive(sn.request_header, content_type='application/json')
+
+ @raises(AlreadyProcessed)
+ def test_nonce_fail(self):
+
+ def seen_nonce(id, nonce, ts):
+ return True
+
+ sn = self.Sender()
+
+ self.receive(sn.request_header, seen_nonce=seen_nonce)
+
+ def test_nonce_ok(self):
+
+ def seen_nonce(id, nonce, ts):
+ return False
+
+ sn = self.Sender(seen_nonce=seen_nonce)
+ self.receive(sn.request_header)
+
+ @raises(TokenExpired)
+ def test_expired_ts(self):
+ now = utc_now() - 120
+ sn = self.Sender(_timestamp=now)
+ self.receive(sn.request_header)
+
+ def test_expired_exception_reports_localtime(self):
+ now = utc_now()
+ ts = now - 120
+ sn = self.Sender(_timestamp=ts) # force expiry
+
+ exc = None
+ with mock.patch('mohawk.base.utc_now') as fake_now:
+ fake_now.return_value = now
+ try:
+ self.receive(sn.request_header)
+ except:
+ etype, exc, tb = sys.exc_info()
+
+ eq_(type(exc), TokenExpired)
+ eq_(exc.localtime_in_seconds, now)
+
+ def test_localtime_offset(self):
+ now = utc_now() - 120
+ sn = self.Sender(_timestamp=now)
+ # Without an offset this will raise an expired exception.
+ self.receive(sn.request_header, localtime_offset_in_seconds=-120)
+
+ def test_localtime_skew(self):
+ now = utc_now() - 120
+ sn = self.Sender(_timestamp=now)
+ # Without an offset this will raise an expired exception.
+ self.receive(sn.request_header, timestamp_skew_in_seconds=120)
+
+ @raises(MacMismatch)
+ def test_hash_tampering(self):
+ sn = self.Sender()
+ header = sn.request_header.replace('hash="', 'hash="nope')
+ self.receive(header)
+
+ @raises(MacMismatch)
+ def test_bad_secret(self):
+ cfg = {
+ 'id': 'my-hawk-id',
+ 'key': 'INCORRECT; YOU FAIL',
+ 'algorithm': 'sha256',
+ }
+ sn = self.Sender(credentials=cfg)
+ self.receive(sn.request_header)
+
+ @raises(MacMismatch)
+ def test_unexpected_algorithm(self):
+ cr = self.credentials.copy()
+ cr['algorithm'] = 'sha512'
+ sn = self.Sender(credentials=cr)
+
+ # Validate with mismatched credentials (sha256).
+ self.receive(sn.request_header)
+
+ @raises(InvalidCredentials)
+ def test_invalid_credentials(self):
+ cfg = self.credentials.copy()
+ # Create an invalid credentials.
+ del cfg['algorithm']
+
+ self.Sender(credentials=cfg)
+
+ @raises(CredentialsLookupError)
+ def test_unknown_id(self):
+ cr = self.credentials.copy()
+ cr['id'] = 'someone-else'
+ sn = self.Sender(credentials=cr)
+
+ self.receive(sn.request_header)
+
+ @raises(MacMismatch)
+ def test_bad_ext(self):
+ sn = self.Sender(ext='my external data')
+
+ header = sn.request_header.replace('my external data', 'TAMPERED')
+ self.receive(header)
+
+ def test_ext_with_quotes(self):
+ sn = self.Sender(ext='quotes=""')
+ self.receive(sn.request_header)
+ parsed = parse_authorization_header(sn.request_header)
+ eq_(parsed['ext'], 'quotes=""')
+
+ def test_ext_with_new_line(self):
+ sn = self.Sender(ext="new line \n in the middle")
+ self.receive(sn.request_header)
+ parsed = parse_authorization_header(sn.request_header)
+ eq_(parsed['ext'], "new line \n in the middle")
+
+ def test_ext_with_equality_sign(self):
+ sn = self.Sender(ext="foo=bar&foo2=bar2;foo3=bar3")
+ self.receive(sn.request_header)
+ parsed = parse_authorization_header(sn.request_header)
+ eq_(parsed['ext'], "foo=bar&foo2=bar2;foo3=bar3")
+
+ @raises(BadHeaderValue)
+ def test_ext_with_illegal_chars(self):
+ self.Sender(ext="something like \t is illegal")
+
+ @raises(BadHeaderValue)
+ def test_ext_with_illegal_unicode(self):
+ self.Sender(ext=u'Ivan Kristi\u0107')
+
+ @raises(BadHeaderValue)
+ def test_ext_with_illegal_utf8(self):
+ # This isn't allowed because the escaped byte chars are out of
+ # range. It's a little odd but this is what the Node lib does
+ # implicitly with its regex.
+ self.Sender(ext=u'Ivan Kristi\u0107'.encode('utf8'))
+
+ def test_app_ok(self):
+ app = 'custom-app'
+ sn = self.Sender(app=app)
+ self.receive(sn.request_header)
+ parsed = parse_authorization_header(sn.request_header)
+ eq_(parsed['app'], app)
+
+ @raises(MacMismatch)
+ def test_tampered_app(self):
+ app = 'custom-app'
+ sn = self.Sender(app=app)
+ header = sn.request_header.replace(app, 'TAMPERED-WITH')
+ self.receive(header)
+
+ def test_dlg_ok(self):
+ dlg = 'custom-dlg'
+ sn = self.Sender(dlg=dlg)
+ self.receive(sn.request_header)
+ parsed = parse_authorization_header(sn.request_header)
+ eq_(parsed['dlg'], dlg)
+
+ @raises(MacMismatch)
+ def test_tampered_dlg(self):
+ dlg = 'custom-dlg'
+ sn = self.Sender(dlg=dlg, app='some-app')
+ header = sn.request_header.replace(dlg, 'TAMPERED-WITH')
+ self.receive(header)
+
+
+class TestReceiver(Base):
+
+ def setUp(self):
+ super(TestReceiver, self).setUp()
+ self.url = 'http://site.com/'
+ self.sender = None
+ self.receiver = None
+
+ def receive(self, method='GET', **kw):
+ url = kw.pop('url', self.url)
+ sender = kw.pop('sender', None)
+ sender_kw = kw.pop('sender_kw', {})
+ sender_kw.setdefault('content', '')
+ sender_kw.setdefault('content_type', '')
+ sender_url = kw.pop('sender_url', url)
+
+ credentials_map = kw.pop('credentials_map',
+ lambda id: self.credentials)
+
+ if sender:
+ self.sender = sender
+ else:
+ self.sender = Sender(self.credentials, sender_url, method,
+ **sender_kw)
+
+ kw.setdefault('content', '')
+ kw.setdefault('content_type', '')
+ self.receiver = Receiver(credentials_map,
+ self.sender.request_header, url, method,
+ **kw)
+
+ def respond(self, **kw):
+ accept_kw = kw.pop('accept_kw', {})
+ accept_kw.setdefault('content', '')
+ accept_kw.setdefault('content_type', '')
+ receiver = kw.pop('receiver', self.receiver)
+
+ kw.setdefault('content', '')
+ kw.setdefault('content_type', '')
+ receiver.respond(**kw)
+ self.sender.accept_response(receiver.response_header, **accept_kw)
+
+ return receiver.response_header
+
+ @raises(InvalidCredentials)
+ def test_invalid_credentials_lookup(self):
+ # Return invalid credentials.
+ self.receive(credentials_map=lambda *a: {})
+
+ def test_get_ok(self):
+ method = 'GET'
+ self.receive(method=method)
+ self.respond()
+
+ def test_post_ok(self):
+ method = 'POST'
+ self.receive(method=method)
+ self.respond()
+
+ @raises(MisComputedContentHash)
+ def test_respond_with_wrong_content(self):
+ self.receive()
+ self.respond(content='real content',
+ accept_kw=dict(content='TAMPERED WITH'))
+
+ @raises(MisComputedContentHash)
+ def test_respond_with_wrong_content_type(self):
+ self.receive()
+ self.respond(content_type='text/html',
+ accept_kw=dict(content_type='application/json'))
+
+ @raises(MissingAuthorization)
+ def test_missing_authorization(self):
+ Receiver(lambda id: self.credentials, None, '/', 'GET')
+
+ @raises(MacMismatch)
+ def test_respond_with_wrong_url(self):
+ self.receive(url='http://fakesite.com')
+ wrong_receiver = self.receiver
+
+ self.receive(url='http://realsite.com')
+
+ self.respond(receiver=wrong_receiver)
+
+ @raises(MacMismatch)
+ def test_respond_with_wrong_method(self):
+ self.receive(method='GET')
+ wrong_receiver = self.receiver
+
+ self.receive(method='POST')
+
+ self.respond(receiver=wrong_receiver)
+
+ @raises(MacMismatch)
+ def test_respond_with_wrong_nonce(self):
+ self.receive(sender_kw=dict(nonce='another-nonce'))
+ wrong_receiver = self.receiver
+
+ self.receive()
+
+ # The nonce must match the one sent in the original request.
+ self.respond(receiver=wrong_receiver)
+
+ def test_respond_with_unhashed_content(self):
+ self.receive()
+
+ self.respond(always_hash_content=False, content=None,
+ content_type=None,
+ accept_kw=dict(accept_untrusted_content=True))
+
+ @raises(TokenExpired)
+ def test_respond_with_expired_ts(self):
+ self.receive()
+ hdr = self.receiver.respond(content='', content_type='')
+
+ with mock.patch('mohawk.base.utc_now') as fn:
+ fn.return_value = 0 # force an expiry
+ try:
+ self.sender.accept_response(hdr, content='', content_type='')
+ except TokenExpired:
+ etype, exc, tb = sys.exc_info()
+ hdr = parse_authorization_header(exc.www_authenticate)
+ calculated = calculate_ts_mac(fn(), self.credentials)
+ if isinstance(calculated, six.binary_type):
+ calculated = calculated.decode('ascii')
+ eq_(hdr['tsm'], calculated)
+ raise
+
+ def test_respond_with_bad_ts_skew_ok(self):
+ now = utc_now() - 120
+
+ self.receive()
+ hdr = self.receiver.respond(content='', content_type='')
+
+ with mock.patch('mohawk.base.utc_now') as fn:
+ fn.return_value = now
+
+ # Without an offset this will raise an expired exception.
+ self.sender.accept_response(hdr, content='', content_type='',
+ timestamp_skew_in_seconds=120)
+
+ def test_respond_with_ext(self):
+ self.receive()
+
+ ext = 'custom-ext'
+ self.respond(ext=ext)
+ header = parse_authorization_header(self.receiver.response_header)
+ eq_(header['ext'], ext)
+
+ @raises(MacMismatch)
+ def test_respond_with_wrong_app(self):
+ self.receive(sender_kw=dict(app='TAMPERED-WITH', dlg='delegation'))
+ self.receiver.respond(content='', content_type='')
+ wrong_receiver = self.receiver
+
+ self.receive(sender_kw=dict(app='real-app', dlg='delegation'))
+
+ self.sender.accept_response(wrong_receiver.response_header,
+ content='', content_type='')
+
+ @raises(MacMismatch)
+ def test_respond_with_wrong_dlg(self):
+ self.receive(sender_kw=dict(app='app', dlg='TAMPERED-WITH'))
+ self.receiver.respond(content='', content_type='')
+ wrong_receiver = self.receiver
+
+ self.receive(sender_kw=dict(app='app', dlg='real-dlg'))
+
+ self.sender.accept_response(wrong_receiver.response_header,
+ content='', content_type='')
+
+ @raises(MacMismatch)
+ def test_receive_wrong_method(self):
+ self.receive(method='GET')
+ wrong_sender = self.sender
+ self.receive(method='POST', sender=wrong_sender)
+
+ @raises(MacMismatch)
+ def test_receive_wrong_url(self):
+ self.receive(url='http://fakesite.com/')
+ wrong_sender = self.sender
+ self.receive(url='http://realsite.com/', sender=wrong_sender)
+
+ @raises(MisComputedContentHash)
+ def test_receive_wrong_content(self):
+ self.receive(sender_kw=dict(content='real request'),
+ content='real request')
+ wrong_sender = self.sender
+ self.receive(content='TAMPERED WITH', sender=wrong_sender)
+
+ @raises(MisComputedContentHash)
+ def test_unexpected_unhashed_content(self):
+ self.receive(sender_kw=dict(content=None, content_type=None,
+ always_hash_content=False))
+
+ @raises(ValueError)
+ def test_cannot_receive_empty_content_only(self):
+ content_type = 'text/plain'
+ self.receive(sender_kw=dict(content='<content>',
+ content_type=content_type),
+ content=None, content_type=content_type)
+
+ @raises(ValueError)
+ def test_cannot_receive_empty_content_type_only(self):
+ content = '<content>'
+ self.receive(sender_kw=dict(content=content,
+ content_type='text/plain'),
+ content=content, content_type=None)
+
+ @raises(MisComputedContentHash)
+ def test_receive_wrong_content_type(self):
+ self.receive(sender_kw=dict(content_type='text/html'),
+ content_type='text/html')
+ wrong_sender = self.sender
+
+ self.receive(content_type='application/json',
+ sender=wrong_sender)
+
+
+class TestSendAndReceive(Base):
+
+ def test(self):
+ credentials = {
+ 'id': 'some-id',
+ 'key': 'some secret',
+ 'algorithm': 'sha256'
+ }
+
+ url = 'https://my-site.com/'
+ method = 'POST'
+
+ # The client sends a request with a Hawk header.
+ content = 'foo=bar&baz=nooz'
+ content_type = 'application/x-www-form-urlencoded'
+
+ sender = Sender(credentials,
+ url, method,
+ content=content,
+ content_type=content_type)
+
+ # The server receives a request and authorizes access.
+ receiver = Receiver(lambda id: credentials,
+ sender.request_header,
+ url, method,
+ content=content,
+ content_type=content_type)
+
+ # The server responds with a similar Hawk header.
+ content = 'we are friends'
+ content_type = 'text/plain'
+ receiver.respond(content=content,
+ content_type=content_type)
+
+ # The client receives a response and authorizes access.
+ sender.accept_response(receiver.response_header,
+ content=content,
+ content_type=content_type)
+
+
+class TestBewit(Base):
+
+ # Test cases copied from
+ # https://github.com/hueniverse/hawk/blob/492632da51ecedd5f59ce96f081860ad24ce6532/test/uri.js
+
+ def setUp(self):
+ self.credentials = {
+ 'id': '123456',
+ 'key': '2983d45yun89q',
+ 'algorithm': 'sha256',
+ }
+
+ def make_credential_lookup(self, credentials_map):
+ # Helper function to make a lookup function given a dictionary of
+ # credentials
+ def lookup(client_id):
+ # Will raise a KeyError if missing; which is a subclass of
+ # LookupError
+ return credentials_map[client_id]
+ return lookup
+
+ def test_bewit(self):
+ res = Resource(url='https://example.com/somewhere/over/the/rainbow',
+ method='GET', credentials=self.credentials,
+ timestamp=1356420407 + 300,
+ nonce='',
+ )
+ bewit = get_bewit(res)
+
+ expected = '123456\\1356420707\\IGYmLgIqLrCe8CxvKPs4JlWIA+UjWJJouwgARiVhCAg=\\'
+ eq_(b64decode(bewit).decode('ascii'), expected)
+
+ def test_bewit_with_binary_id(self):
+ # Check for exceptions in get_bewit call with binary id
+ binary_credentials = self.credentials.copy()
+ binary_credentials['id'] = binary_credentials['id'].encode('ascii')
+ res = Resource(url='https://example.com/somewhere/over/the/rainbow',
+ method='GET', credentials=binary_credentials,
+ timestamp=1356420407 + 300,
+ nonce='',
+ )
+ get_bewit(res)
+
+ def test_bewit_with_ext(self):
+ res = Resource(url='https://example.com/somewhere/over/the/rainbow',
+ method='GET', credentials=self.credentials,
+ timestamp=1356420407 + 300,
+ nonce='',
+ ext='xandyandz'
+ )
+ bewit = get_bewit(res)
+
+ expected = '123456\\1356420707\\kscxwNR2tJpP1T1zDLNPbB5UiKIU9tOSJXTUdG7X9h8=\\xandyandz'
+ eq_(b64decode(bewit).decode('ascii'), expected)
+
+ def test_bewit_with_ext_and_backslashes(self):
+ credentials = self.credentials
+ credentials['id'] = '123\\456'
+ res = Resource(url='https://example.com/somewhere/over/the/rainbow',
+ method='GET', credentials=self.credentials,
+ timestamp=1356420407 + 300,
+ nonce='',
+ ext='xand\\yandz'
+ )
+ bewit = get_bewit(res)
+
+ expected = '123456\\1356420707\\b82LLIxG5UDkaChLU953mC+SMrbniV1sb8KiZi9cSsc=\\xand\\yandz'
+ eq_(b64decode(bewit).decode('ascii'), expected)
+
+ def test_bewit_with_port(self):
+ res = Resource(url='https://example.com:8080/somewhere/over/the/rainbow',
+ method='GET', credentials=self.credentials,
+ timestamp=1356420407 + 300, nonce='', ext='xandyandz')
+ bewit = get_bewit(res)
+
+ expected = '123456\\1356420707\\hZbJ3P2cKEo4ky0C8jkZAkRyCZueg4WSNbxV7vq3xHU=\\xandyandz'
+ eq_(b64decode(bewit).decode('ascii'), expected)
+
+ @raises(ValueError)
+ def test_bewit_with_nonce(self):
+ res = Resource(url='https://example.com/somewhere/over/the/rainbow',
+ method='GET', credentials=self.credentials,
+ timestamp=1356420407 + 300,
+ nonce='n1')
+ get_bewit(res)
+
+ @raises(ValueError)
+ def test_bewit_invalid_method(self):
+ res = Resource(url='https://example.com:8080/somewhere/over/the/rainbow',
+ method='POST', credentials=self.credentials,
+ timestamp=1356420407 + 300, nonce='')
+ get_bewit(res)
+
+ def test_strip_bewit(self):
+ bewit = b'123456\\1356420707\\IGYmLgIqLrCe8CxvKPs4JlWIA+UjWJJouwgARiVhCAg=\\'
+ bewit = urlsafe_b64encode(bewit).decode('ascii')
+ url = "https://example.com/somewhere/over/the/rainbow?bewit={bewit}".format(bewit=bewit)
+
+ raw_bewit, stripped_url = strip_bewit(url)
+ self.assertEquals(raw_bewit, bewit)
+ self.assertEquals(stripped_url, "https://example.com/somewhere/over/the/rainbow")
+
+ @raises(InvalidBewit)
+ def test_strip_url_without_bewit(self):
+ url = "https://example.com/somewhere/over/the/rainbow"
+ strip_bewit(url)
+
+ def test_parse_bewit(self):
+ bewit = b'123456\\1356420707\\IGYmLgIqLrCe8CxvKPs4JlWIA+UjWJJouwgARiVhCAg=\\'
+ bewit = urlsafe_b64encode(bewit).decode('ascii')
+ bewit = parse_bewit(bewit)
+ self.assertEquals(bewit.id, '123456')
+ self.assertEquals(bewit.expiration, '1356420707')
+ self.assertEquals(bewit.mac, 'IGYmLgIqLrCe8CxvKPs4JlWIA+UjWJJouwgARiVhCAg=')
+ self.assertEquals(bewit.ext, '')
+
+ def test_parse_bewit_with_ext(self):
+ bewit = b'123456\\1356420707\\IGYmLgIqLrCe8CxvKPs4JlWIA+UjWJJouwgARiVhCAg=\\xandyandz'
+ bewit = urlsafe_b64encode(bewit).decode('ascii')
+ bewit = parse_bewit(bewit)
+ self.assertEquals(bewit.id, '123456')
+ self.assertEquals(bewit.expiration, '1356420707')
+ self.assertEquals(bewit.mac, 'IGYmLgIqLrCe8CxvKPs4JlWIA+UjWJJouwgARiVhCAg=')
+ self.assertEquals(bewit.ext, 'xandyandz')
+
+ def test_parse_bewit_with_ext_and_backslashes(self):
+ bewit = b'123456\\1356420707\\IGYmLgIqLrCe8CxvKPs4JlWIA+UjWJJouwgARiVhCAg=\\xand\\yandz'
+ bewit = urlsafe_b64encode(bewit).decode('ascii')
+ bewit = parse_bewit(bewit)
+ self.assertEquals(bewit.id, '123456')
+ self.assertEquals(bewit.expiration, '1356420707')
+ self.assertEquals(bewit.mac, 'IGYmLgIqLrCe8CxvKPs4JlWIA+UjWJJouwgARiVhCAg=')
+ self.assertEquals(bewit.ext, 'xand\\yandz')
+
+ @raises(InvalidBewit)
+ def test_parse_invalid_bewit_with_only_one_part(self):
+ bewit = b'12345'
+ bewit = urlsafe_b64encode(bewit).decode('ascii')
+ bewit = parse_bewit(bewit)
+
+ @raises(InvalidBewit)
+ def test_parse_invalid_bewit_with_only_two_parts(self):
+ bewit = b'1\\2'
+ bewit = urlsafe_b64encode(bewit).decode('ascii')
+ bewit = parse_bewit(bewit)
+
+ def test_validate_bewit(self):
+ bewit = b'123456\\1356420707\\IGYmLgIqLrCe8CxvKPs4JlWIA+UjWJJouwgARiVhCAg=\\'
+ bewit = urlsafe_b64encode(bewit).decode('ascii')
+ url = "https://example.com/somewhere/over/the/rainbow?bewit={bewit}".format(bewit=bewit)
+ credential_lookup = self.make_credential_lookup({
+ self.credentials['id']: self.credentials,
+ })
+ self.assertTrue(check_bewit(url, credential_lookup=credential_lookup, now=1356420407 + 10))
+
+ def test_validate_bewit_with_ext(self):
+ bewit = b'123456\\1356420707\\kscxwNR2tJpP1T1zDLNPbB5UiKIU9tOSJXTUdG7X9h8=\\xandyandz'
+ bewit = urlsafe_b64encode(bewit).decode('ascii')
+ url = "https://example.com/somewhere/over/the/rainbow?bewit={bewit}".format(bewit=bewit)
+ credential_lookup = self.make_credential_lookup({
+ self.credentials['id']: self.credentials,
+ })
+ self.assertTrue(check_bewit(url, credential_lookup=credential_lookup, now=1356420407 + 10))
+
+ def test_validate_bewit_with_ext_and_backslashes(self):
+ bewit = b'123456\\1356420707\\b82LLIxG5UDkaChLU953mC+SMrbniV1sb8KiZi9cSsc=\\xand\\yandz'
+ bewit = urlsafe_b64encode(bewit).decode('ascii')
+ url = "https://example.com/somewhere/over/the/rainbow?bewit={bewit}".format(bewit=bewit)
+ credential_lookup = self.make_credential_lookup({
+ self.credentials['id']: self.credentials,
+ })
+ self.assertTrue(check_bewit(url, credential_lookup=credential_lookup, now=1356420407 + 10))
+
+ @raises(TokenExpired)
+ def test_validate_expired_bewit(self):
+ bewit = b'123456\\1356420707\\IGYmLgIqLrCe8CxvKPs4JlWIA+UjWJJouwgARiVhCAg=\\'
+ bewit = urlsafe_b64encode(bewit).decode('ascii')
+ url = "https://example.com/somewhere/over/the/rainbow?bewit={bewit}".format(bewit=bewit)
+ credential_lookup = self.make_credential_lookup({
+ self.credentials['id']: self.credentials,
+ })
+ check_bewit(url, credential_lookup=credential_lookup, now=1356420407 + 1000)
+
+ @raises(CredentialsLookupError)
+ def test_validate_bewit_with_unknown_credentials(self):
+ bewit = b'123456\\1356420707\\IGYmLgIqLrCe8CxvKPs4JlWIA+UjWJJouwgARiVhCAg=\\'
+ bewit = urlsafe_b64encode(bewit).decode('ascii')
+ url = "https://example.com/somewhere/over/the/rainbow?bewit={bewit}".format(bewit=bewit)
+ credential_lookup = self.make_credential_lookup({
+ 'other_id': self.credentials,
+ })
+ check_bewit(url, credential_lookup=credential_lookup, now=1356420407 + 10)
diff --git a/third_party/python/mohawk/mohawk/util.py b/third_party/python/mohawk/mohawk/util.py
new file mode 100644
index 0000000000..46a28e94ce
--- /dev/null
+++ b/third_party/python/mohawk/mohawk/util.py
@@ -0,0 +1,267 @@
+from base64 import b64encode, urlsafe_b64encode
+import calendar
+import hashlib
+import hmac
+import logging
+import math
+import os
+import pprint
+import re
+import sys
+import time
+
+import six
+
+from .exc import (
+ BadHeaderValue,
+ HawkFail,
+ InvalidCredentials)
+
+
+HAWK_VER = 1
+log = logging.getLogger(__name__)
+allowable_header_keys = set(['id', 'ts', 'tsm', 'nonce', 'hash',
+ 'error', 'ext', 'mac', 'app', 'dlg'])
+
+
+def validate_credentials(creds):
+ if not hasattr(creds, '__getitem__'):
+ raise InvalidCredentials('credentials must be a dict-like object')
+ try:
+ creds['id']
+ creds['key']
+ creds['algorithm']
+ except KeyError:
+ etype, val, tb = sys.exc_info()
+ raise InvalidCredentials('{etype}: {val}'
+ .format(etype=etype, val=val))
+
+
+def random_string(length):
+ """Generates a random string for a given length."""
+ # this conservatively gets 8*length bits and then returns 6*length of
+ # them. Grabbing (6/8)*length bits could lose some entropy off the ends.
+ return urlsafe_b64encode(os.urandom(length))[:length]
+
+
+def calculate_payload_hash(payload, algorithm, content_type):
+ """Calculates a hash for a given payload."""
+ p_hash = hashlib.new(algorithm)
+
+ parts = []
+ parts.append('hawk.' + str(HAWK_VER) + '.payload\n')
+ parts.append(parse_content_type(content_type) + '\n')
+ parts.append(payload or '')
+ parts.append('\n')
+
+ for i, p in enumerate(parts):
+ # Make sure we are about to hash binary strings.
+ if not isinstance(p, six.binary_type):
+ p = p.encode('utf8')
+ p_hash.update(p)
+ parts[i] = p
+
+ log.debug('calculating payload hash from:\n{parts}'
+ .format(parts=pprint.pformat(parts)))
+
+ return b64encode(p_hash.digest())
+
+
+def calculate_mac(mac_type, resource, content_hash):
+ """Calculates a message authorization code (MAC)."""
+ normalized = normalize_string(mac_type, resource, content_hash)
+ log.debug(u'normalized resource for mac calc: {norm}'
+ .format(norm=normalized))
+ digestmod = getattr(hashlib, resource.credentials['algorithm'])
+
+ # Make sure we are about to hash binary strings.
+
+ if not isinstance(normalized, six.binary_type):
+ normalized = normalized.encode('utf8')
+ key = resource.credentials['key']
+ if not isinstance(key, six.binary_type):
+ key = key.encode('ascii')
+
+ result = hmac.new(key, normalized, digestmod)
+ return b64encode(result.digest())
+
+
+def calculate_ts_mac(ts, credentials):
+ """Calculates a message authorization code (MAC) for a timestamp."""
+ normalized = ('hawk.{hawk_ver}.ts\n{ts}\n'
+ .format(hawk_ver=HAWK_VER, ts=ts))
+ log.debug(u'normalized resource for ts mac calc: {norm}'
+ .format(norm=normalized))
+ digestmod = getattr(hashlib, credentials['algorithm'])
+
+ if not isinstance(normalized, six.binary_type):
+ normalized = normalized.encode('utf8')
+ key = credentials['key']
+ if not isinstance(key, six.binary_type):
+ key = key.encode('ascii')
+
+ result = hmac.new(key, normalized, digestmod)
+ return b64encode(result.digest())
+
+
+def normalize_string(mac_type, resource, content_hash):
+ """Serializes mac_type and resource into a HAWK string."""
+
+ normalized = [
+ 'hawk.' + str(HAWK_VER) + '.' + mac_type,
+ normalize_header_attr(resource.timestamp),
+ normalize_header_attr(resource.nonce),
+ normalize_header_attr(resource.method or ''),
+ normalize_header_attr(resource.name or ''),
+ normalize_header_attr(resource.host),
+ normalize_header_attr(resource.port),
+ normalize_header_attr(content_hash or '')
+ ]
+
+ # The blank lines are important. They follow what the Node Hawk lib does.
+
+ normalized.append(normalize_header_attr(resource.ext or ''))
+
+ if resource.app:
+ normalized.append(normalize_header_attr(resource.app))
+ normalized.append(normalize_header_attr(resource.dlg or ''))
+
+ # Add trailing new line.
+ normalized.append('')
+
+ normalized = '\n'.join(normalized)
+
+ return normalized
+
+
+def parse_content_type(content_type):
+ """Cleans up content_type."""
+ if content_type:
+ return content_type.split(';')[0].strip().lower()
+ else:
+ return ''
+
+
+def parse_authorization_header(auth_header):
+ """
+ Example Authorization header:
+
+ 'Hawk id="dh37fgj492je", ts="1367076201", nonce="NPHgnG", ext="and
+ welcome!", mac="CeWHy4d9kbLGhDlkyw2Nh3PJ7SDOdZDa267KH4ZaNMY="'
+ """
+ attributes = {}
+
+ # Make sure we have a unicode object for consistency.
+ if isinstance(auth_header, six.binary_type):
+ auth_header = auth_header.decode('utf8')
+
+ parts = auth_header.split(',')
+ auth_scheme_parts = parts[0].split(' ')
+ if 'hawk' != auth_scheme_parts[0].lower():
+ raise HawkFail("Unknown scheme '{scheme}' when parsing header"
+ .format(scheme=auth_scheme_parts[0].lower()))
+
+ # Replace 'Hawk key: value' with 'key: value'
+ # which matches the rest of parts
+ parts[0] = auth_scheme_parts[1]
+
+ for part in parts:
+ attr_parts = part.split('=')
+ key = attr_parts[0].strip()
+ if key not in allowable_header_keys:
+ raise HawkFail("Unknown Hawk key '{key}' when parsing header"
+ .format(key=key))
+
+ if len(attr_parts) > 2:
+ attr_parts[1] = '='.join(attr_parts[1:])
+
+ # Chop of quotation marks
+ value = attr_parts[1]
+
+ if attr_parts[1].find('"') == 0:
+ value = attr_parts[1][1:]
+
+ if value.find('"') > -1:
+ value = value[0:-1]
+
+ validate_header_attr(value, name=key)
+ value = unescape_header_attr(value)
+ attributes[key] = value
+
+ log.debug('parsed Hawk header: {header} into: \n{parsed}'
+ .format(header=auth_header, parsed=pprint.pformat(attributes)))
+ return attributes
+
+
+def strings_match(a, b):
+ # Constant time string comparision, mitigates side channel attacks.
+ if len(a) != len(b):
+ return False
+ result = 0
+
+ def byte_ints(buf):
+ for ch in buf:
+ # In Python 3, if we have a bytes object, iterating it will
+ # already get the integer value. In older pythons, we need
+ # to use ord().
+ if not isinstance(ch, int):
+ ch = ord(ch)
+ yield ch
+
+ for x, y in zip(byte_ints(a), byte_ints(b)):
+ result |= x ^ y
+ return result == 0
+
+
+def utc_now(offset_in_seconds=0.0):
+ # TODO: add support for SNTP server? See ntplib module.
+ return int(math.floor(calendar.timegm(time.gmtime()) +
+ float(offset_in_seconds)))
+
+
+# Allowed value characters:
+# !#$%&'()*+,-./:;<=>?@[]^_`{|}~ and space, a-z, A-Z, 0-9, \, "
+_header_attribute_chars = re.compile(
+ r"^[ a-zA-Z0-9_\!#\$%&'\(\)\*\+,\-\./\:;<\=>\?@\[\]\^`\{\|\}~\"\\]*$")
+
+
+def validate_header_attr(val, name=None):
+ if not _header_attribute_chars.match(val):
+ raise BadHeaderValue('header value name={name} value={val} '
+ 'contained an illegal character'
+ .format(name=name or '?', val=repr(val)))
+
+
+def escape_header_attr(val):
+
+ # Ensure we are working with Unicode for consistency.
+ if isinstance(val, six.binary_type):
+ val = val.decode('utf8')
+
+ # Escape quotes and slash like the hawk reference code.
+ val = val.replace('\\', '\\\\')
+ val = val.replace('"', '\\"')
+ val = val.replace('\n', '\\n')
+ return val
+
+
+def unescape_header_attr(val):
+ # Un-do the hawk escaping.
+ val = val.replace('\\n', '\n')
+ val = val.replace('\\\\', '\\').replace('\\"', '"')
+ return val
+
+
+def prepare_header_val(val):
+ val = escape_header_attr(val)
+ validate_header_attr(val)
+ return val
+
+
+def normalize_header_attr(val):
+ if not val:
+ val = ''
+
+ # Normalize like the hawk reference code.
+ val = escape_header_attr(val)
+ return val
diff --git a/third_party/python/mohawk/setup.cfg b/third_party/python/mohawk/setup.cfg
new file mode 100644
index 0000000000..861a9f5542
--- /dev/null
+++ b/third_party/python/mohawk/setup.cfg
@@ -0,0 +1,5 @@
+[egg_info]
+tag_build =
+tag_date = 0
+tag_svn_revision = 0
+
diff --git a/third_party/python/mohawk/setup.py b/third_party/python/mohawk/setup.py
new file mode 100644
index 0000000000..ddaf9026c2
--- /dev/null
+++ b/third_party/python/mohawk/setup.py
@@ -0,0 +1,25 @@
+from setuptools import setup, find_packages
+
+
+setup(name='mohawk',
+ version='0.3.4',
+ description="Library for Hawk HTTP authorization",
+ long_description='',
+ author='Kumar McMillan, Austin King',
+ author_email='kumar.mcmillan@gmail.com',
+ license='MPL 2.0 (Mozilla Public License)',
+ url='https://github.com/kumar303/mohawk',
+ include_package_data=True,
+ classifiers=[
+ 'Intended Audience :: Developers',
+ 'Natural Language :: English',
+ 'Operating System :: OS Independent',
+ 'Programming Language :: Python :: 2',
+ 'Programming Language :: Python :: 3',
+ 'Programming Language :: Python :: 2.6',
+ 'Programming Language :: Python :: 2.7',
+ 'Programming Language :: Python :: 3.3',
+ 'Topic :: Internet :: WWW/HTTP',
+ ],
+ packages=find_packages(exclude=['tests']),
+ install_requires=['six'])