Merge pull request #825 from docker/lsm5-master-m2crypto

Replace python-rsa with m2crypto

Author: dmp42

.travis.yml

@@ -7,7 +7,8 @@ python:
 before_install:
   - sudo apt-get update
   - sudo apt-get install redis-server
-  - sudo apt-get install libevent-dev liblzma-dev
+  - sudo apt-get install libevent-dev liblzma-dev libssl-dev
+  - sudo apt-get install swig
 
 install:
 ## This below should be separated when core lives elsewhere

docker_registry/lib/config.py

@@ -2,7 +2,8 @@
 
 import os
 
-import rsa
+from M2Crypto import BIO
+from M2Crypto import RSA
 import yaml
 
 from docker_registry.core import compat
@@ -109,10 +110,17 @@ def _init():
                 'Heads-up! File is missing: %s' % conf.privileged_key)
 
         try:
-            conf.privileged_key = rsa.PublicKey.load_pkcs1(f.read())
+            pk = f.read().split('\n')
+            pk = 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A' + ''.join(pk[1:-2])
+            pk = [pk[i: i + 64] for i in range(0, len(pk), 64)]
+            pk = ('-----BEGIN PUBLIC KEY-----\n' + '\n'.join(pk) +
+                  '\n-----END PUBLIC KEY-----')
+            bio = BIO.MemoryBuffer(pk)
+            conf.privileged_key = RSA.load_pub_key_bio(bio)
         except Exception:
             raise exceptions.ConfigError(
                 'Key at %s is not a valid RSA key' % conf.privileged_key)
+        f.close()
 
     if conf.index_endpoint:
         conf.index_endpoint = conf.index_endpoint.strip('/')

docker_registry/toolkit.py

@@ -2,6 +2,7 @@
 
 import base64
 import functools
+import hashlib
 import logging
 import os
 import random
@@ -10,8 +11,8 @@
 import urllib
 
 import flask
+from M2Crypto import RSA
 import requests
-import rsa
 
 from docker_registry.core import compat
 json = compat.json
@@ -20,6 +21,7 @@
 from .lib import config
 
 cfg = config.load()
+
 logger = logging.getLogger(__name__)
 _re_docker_version = re.compile('docker/([^\s]+)')
 _re_authorization = re.compile(r'(\w+)[:=][\s"]?([^",]+)"?')
@@ -221,7 +223,8 @@ def check_token(args):
 
 
 def check_signature():
-    if not cfg.privileged_key:
+    pkey = cfg.privileged_key
+    if not pkey:
         return False
     headers = flask.request.headers
     signature = headers.get('X-Signature')
@@ -238,8 +241,9 @@ def check_signature():
                        ['{}:{}'.format(k, headers[k]) for k in header_keys])
     logger.debug('Signed message: {}'.format(message))
     try:
-        return rsa.verify(message, sigdata, cfg.privileged_key)
-    except rsa.VerificationError:
+        return pkey.verify(message_digest(message), sigdata, 'sha1')
+    except RSA.RSAError as e:
+        logger.exception(e)
         return False
 
 
@@ -251,6 +255,12 @@ def parse_content_signature(s):
     return ret
 
 
+def message_digest(s):
+    m = hashlib.new('sha1')
+    m.update(s)
+    return m.digest()
+
+
 def requires_auth(f):
     @functools.wraps(f)
     def wrapper(*args, **kwargs):

requirements/main.txt

@@ -4,6 +4,6 @@ gevent==1.0.1
 gunicorn==19.1
 PyYAML==3.11
 requests==2.3.0
-rsa==3.1.4
+M2Crypto==0.22.3
 sqlalchemy==0.9.4
 setuptools==5.8