tools/origin_trials/generate_token.py - chromium/src - Git at Google

 #!/usr/bin/env python
 # Copyright (c) 2016 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.

 """Utility for generating experimental API tokens

 usage: generate_token.py [-h] [--key-file KEY_FILE]
                          [--expire-days EXPIRE_DAYS |
                           --expire-timestamp EXPIRE_TIMESTAMP]
                          [--is_subdomain | --no-subdomain]
                          origin trial_name

 Run "generate_token.py -h" for more help on usage.
 """
 import argparse
 import base64
 from datetime import datetime
 import json
 import re
 import os
 import struct
 import sys
 import time
 import urlparse

 script_dir = os.path.dirname(os.path.realpath(__file__))
 sys.path.insert(0, os.path.join(script_dir, 'third_party', 'ed25519'))
 import ed25519


 # Matches a valid DNS name label (alphanumeric plus hyphens, except at the ends,
 # no longer than 63 ASCII characters)
 DNS_LABEL_REGEX = re.compile(r"^(?!-)[a-z\d-]{1,63}(?<!-)$", re.IGNORECASE)

 # This script generates Version 2 tokens.
 VERSION = "\x02"

 # Default key file, relative to script_dir.
 DEFAULT_KEY_FILE = 'eftest.key'

 def HostnameFromArg(arg):
   """Determines whether a string represents a valid hostname.

   Returns the canonical hostname if its argument is valid, or None otherwise.
   """
   if not arg or len(arg) > 255:
     return None
   if arg[-1] == ".":
     arg = arg[:-1]
   if "." not in arg and arg != "localhost":
     return None
   if all(DNS_LABEL_REGEX.match(label) for label in arg.split(".")):
     return arg.lower()

 def OriginFromArg(arg):
   """Constructs the origin for the token from a command line argument.

   Returns None if this is not possible (neither a valid hostname nor a
   valid origin URL was provided.)
   """
   # Does it look like a hostname?
   hostname = HostnameFromArg(arg)
   if hostname:
     return "https://" + hostname + ":443"
   # If not, try to construct an origin URL from the argument
   origin = urlparse.urlparse(arg)
   if not origin or not origin.scheme or not origin.netloc:
     raise argparse.ArgumentTypeError("%s is not a hostname or a URL" % arg)
   # HTTPS or HTTP only
   if origin.scheme not in ('https','http'):
     raise argparse.ArgumentTypeError("%s does not use a recognized URL scheme" %
                                      arg)
   # Add default port if it is not specified
   try:
     port = origin.port
   except ValueError:
     raise argparse.ArgumentTypeError("%s is not a hostname or a URL" % arg)
   if not port:
     port = {"https": 443, "http": 80}[origin.scheme]
   # Strip any extra components and return the origin URL:
   return "{0}://{1}:{2}".format(origin.scheme, origin.hostname, port)

 def ExpiryFromArgs(args):
   if args.expire_timestamp:
     return int(args.expire_timestamp)
   return (int(time.time()) + (int(args.expire_days) * 86400))

 def GenerateTokenData(origin, is_subdomain, feature_name, expiry):
   data = {"origin": origin,
           "feature": feature_name,
           "expiry": expiry}
   if is_subdomain is not None:
     data["isSubdomain"] = is_subdomain
   return json.dumps(data).encode('utf-8')

 def GenerateDataToSign(version, data):
   return version + struct.pack(">I",len(data)) + data

 def Sign(private_key, data):
   return ed25519.signature(data, private_key[:32], private_key[32:])

 def FormatToken(version, signature, data):
   return base64.b64encode(version + signature +
                           struct.pack(">I",len(data)) + data)

 def main():
   default_key_file_absolute = os.path.join(script_dir, DEFAULT_KEY_FILE)

   parser = argparse.ArgumentParser(
       description="Generate tokens for enabling experimental features")
   parser.add_argument("origin",
                       help="Origin for which to enable the feature. This can "
                            "be either a hostname (default scheme HTTPS, "
                            "default port 443) or a URL.",
                       type=OriginFromArg)
   parser.add_argument("trial_name",
                       help="Feature to enable. The current list of "
                            "experimental feature trials can be found in "
                            "RuntimeFeatures.in")
   parser.add_argument("--key-file",
                       help="Ed25519 private key file to sign the token with",
                       default=default_key_file_absolute)

   subdomain_group = parser.add_mutually_exclusive_group()
   subdomain_group.add_argument("--is-subdomain",
                                help="Token will enable the feature for all "
                                     "subdomains that match the origin",
                                dest="is_subdomain",
                                action="store_true")
   subdomain_group.add_argument("--no-subdomain",
                                help="Token will only match the specified "
                                     "origin (default behavior)",
                                dest="is_subdomain",
                                action="store_false")
   parser.set_defaults(is_subdomain=None)

   expiry_group = parser.add_mutually_exclusive_group()
   expiry_group.add_argument("--expire-days",
                             help="Days from now when the token should expire",
                             type=int,
                             default=42)
   expiry_group.add_argument("--expire-timestamp",
                             help="Exact time (seconds since 1970-01-01 "
                                  "00:00:00 UTC) when the token should expire",
                             type=int)

   args = parser.parse_args()
   expiry = ExpiryFromArgs(args)

   key_file = open(os.path.expanduser(args.key_file), mode="rb")
   private_key = key_file.read(64)

   # Validate that the key file read was a proper Ed25519 key -- running the
   # publickey method on the first half of the key should return the second
   # half.
   if (len(private_key) < 64 or
     ed25519.publickey(private_key[:32]) != private_key[32:]):
     print("Unable to use the specified private key file.")
     sys.exit(1)

   token_data = GenerateTokenData(args.origin, args.is_subdomain,
                                  args.trial_name, expiry)
   data_to_sign = GenerateDataToSign(VERSION, token_data)
   signature = Sign(private_key, data_to_sign)

   # Verify that that the signature is correct before printing it.
   try:
     ed25519.checkvalid(signature, data_to_sign, private_key[32:])
   except Exception, exc:
     print "There was an error generating the signature."
     print "(The original error was: %s)" % exc
     sys.exit(1)


   # Output the token details
   print "Token details:"
   print " Origin: %s" % args.origin
   print " Is Subdomain: %s" % args.is_subdomain
   print " Feature: %s" % args.trial_name
   print " Expiry: %d (%s UTC)" % (expiry, datetime.utcfromtimestamp(expiry))
   print " Signature: %s" % ", ".join('0x%02x' % ord(x) for x in signature)
   print " Signature (Base64): %s" % base64.b64encode(signature)
   print

   # Output the properly-formatted token.
   print FormatToken(VERSION, signature, token_data)

 if __name__ == "__main__":
   main()
	#!/usr/bin/env python
	# Copyright (c) 2016 The Chromium Authors. All rights reserved.
	# Use of this source code is governed by a BSD-style license that can be
	# found in the LICENSE file.

	"""Utility for generating experimental API tokens

	usage: generate_token.py [-h] [--key-file KEY_FILE]
	[--expire-days EXPIRE_DAYS \|
	--expire-timestamp EXPIRE_TIMESTAMP]
	[--is_subdomain \| --no-subdomain]
	origin trial_name

	Run "generate_token.py -h" for more help on usage.
	"""
	import argparse
	import base64
	from datetime import datetime
	import json
	import re
	import os
	import struct
	import sys
	import time
	import urlparse

	script_dir = os.path.dirname(os.path.realpath(__file__))
	sys.path.insert(0, os.path.join(script_dir, 'third_party', 'ed25519'))
	import ed25519


	# Matches a valid DNS name label (alphanumeric plus hyphens, except at the ends,
	# no longer than 63 ASCII characters)
	DNS_LABEL_REGEX = re.compile(r"^(?!-)[a-z\d-]{1,63}(?<!-)$", re.IGNORECASE)

	# This script generates Version 2 tokens.
	VERSION = "\x02"

	# Default key file, relative to script_dir.
	DEFAULT_KEY_FILE = 'eftest.key'

	def HostnameFromArg(arg):
	"""Determines whether a string represents a valid hostname.

	Returns the canonical hostname if its argument is valid, or None otherwise.
	"""
	if not arg or len(arg) > 255:
	return None
	if arg[-1] == ".":
	arg = arg[:-1]
	if "." not in arg and arg != "localhost":
	return None
	if all(DNS_LABEL_REGEX.match(label) for label in arg.split(".")):
	return arg.lower()

	def OriginFromArg(arg):
	"""Constructs the origin for the token from a command line argument.

	Returns None if this is not possible (neither a valid hostname nor a
	valid origin URL was provided.)
	"""
	# Does it look like a hostname?
	hostname = HostnameFromArg(arg)
	if hostname:
	return "https://" + hostname + ":443"
	# If not, try to construct an origin URL from the argument
	origin = urlparse.urlparse(arg)
	if not origin or not origin.scheme or not origin.netloc:
	raise argparse.ArgumentTypeError("%s is not a hostname or a URL" % arg)
	# HTTPS or HTTP only
	if origin.scheme not in ('https','http'):
	raise argparse.ArgumentTypeError("%s does not use a recognized URL scheme" %
	arg)
	# Add default port if it is not specified
	try:
	port = origin.port
	except ValueError:
	raise argparse.ArgumentTypeError("%s is not a hostname or a URL" % arg)
	if not port:
	port = {"https": 443, "http": 80}[origin.scheme]
	# Strip any extra components and return the origin URL:
	return "{0}://{1}:{2}".format(origin.scheme, origin.hostname, port)

	def ExpiryFromArgs(args):
	if args.expire_timestamp:
	return int(args.expire_timestamp)
	return (int(time.time()) + (int(args.expire_days) * 86400))

	def GenerateTokenData(origin, is_subdomain, feature_name, expiry):
	data = {"origin": origin,
	"feature": feature_name,
	"expiry": expiry}
	if is_subdomain is not None:
	data["isSubdomain"] = is_subdomain
	return json.dumps(data).encode('utf-8')

	def GenerateDataToSign(version, data):
	return version + struct.pack(">I",len(data)) + data

	def Sign(private_key, data):
	return ed25519.signature(data, private_key[:32], private_key[32:])

	def FormatToken(version, signature, data):
	return base64.b64encode(version + signature +
	struct.pack(">I",len(data)) + data)

	def main():
	default_key_file_absolute = os.path.join(script_dir, DEFAULT_KEY_FILE)

	parser = argparse.ArgumentParser(
	description="Generate tokens for enabling experimental features")
	parser.add_argument("origin",
	help="Origin for which to enable the feature. This can "
	"be either a hostname (default scheme HTTPS, "
	"default port 443) or a URL.",
	type=OriginFromArg)
	parser.add_argument("trial_name",
	help="Feature to enable. The current list of "
	"experimental feature trials can be found in "
	"RuntimeFeatures.in")
	parser.add_argument("--key-file",
	help="Ed25519 private key file to sign the token with",
	default=default_key_file_absolute)

	subdomain_group = parser.add_mutually_exclusive_group()
	subdomain_group.add_argument("--is-subdomain",
	help="Token will enable the feature for all "
	"subdomains that match the origin",
	dest="is_subdomain",
	action="store_true")
	subdomain_group.add_argument("--no-subdomain",
	help="Token will only match the specified "
	"origin (default behavior)",
	dest="is_subdomain",
	action="store_false")
	parser.set_defaults(is_subdomain=None)

	expiry_group = parser.add_mutually_exclusive_group()
	expiry_group.add_argument("--expire-days",
	help="Days from now when the token should expire",
	type=int,
	default=42)
	expiry_group.add_argument("--expire-timestamp",
	help="Exact time (seconds since 1970-01-01 "
	"00:00:00 UTC) when the token should expire",
	type=int)

	args = parser.parse_args()
	expiry = ExpiryFromArgs(args)

	key_file = open(os.path.expanduser(args.key_file), mode="rb")
	private_key = key_file.read(64)

	# Validate that the key file read was a proper Ed25519 key -- running the
	# publickey method on the first half of the key should return the second
	# half.
	if (len(private_key) < 64 or
	ed25519.publickey(private_key[:32]) != private_key[32:]):
	print("Unable to use the specified private key file.")
	sys.exit(1)

	token_data = GenerateTokenData(args.origin, args.is_subdomain,
	args.trial_name, expiry)
	data_to_sign = GenerateDataToSign(VERSION, token_data)
	signature = Sign(private_key, data_to_sign)

	# Verify that that the signature is correct before printing it.
	try:
	ed25519.checkvalid(signature, data_to_sign, private_key[32:])
	except Exception, exc:
	print "There was an error generating the signature."
	print "(The original error was: %s)" % exc
	sys.exit(1)


	# Output the token details
	print "Token details:"
	print " Origin: %s" % args.origin
	print " Is Subdomain: %s" % args.is_subdomain
	print " Feature: %s" % args.trial_name
	print " Expiry: %d (%s UTC)" % (expiry, datetime.utcfromtimestamp(expiry))
	print " Signature: %s" % ", ".join('0x%02x' % ord(x) for x in signature)
	print " Signature (Base64): %s" % base64.b64encode(signature)
	print

	# Output the properly-formatted token.
	print FormatToken(VERSION, signature, token_data)

	if __name__ == "__main__":
	main()