Polish KarlDNS production UI and docs

router_dyndns/ddns_security.py

@@ -53,17 +53,31 @@ def sign_dashboard_unlock_cookie(
     hostname: str,
     management_slug: str,
     password_hash: str,
+    signing_secret: str,
     max_age_seconds: int,
     now: int | None = None,
 ) -> str:
     timestamp = int(time.time() if now is None else now)
     bounded_max_age = _bounded_dashboard_unlock_seconds(max_age_seconds)
-    signature = _dashboard_unlock_signature(hostname, management_slug, password_hash, timestamp, bounded_max_age)
-    return f"v2:{timestamp}:{bounded_max_age}:{signature}"
+    signature = _dashboard_unlock_signature(
+        hostname,
+        management_slug,
+        password_hash,
+        signing_secret,
+        timestamp,
+        bounded_max_age,
+    )
+    return f"v3:{timestamp}:{bounded_max_age}:{signature}"
 
 
-def verify_dashboard_unlock_cookie(hostname: str, management_slug: str, password_hash: str | None, cookie_value: str | None) -> bool:
-    if not password_hash or not cookie_value:
+def verify_dashboard_unlock_cookie(
+    hostname: str,
+    management_slug: str,
+    password_hash: str | None,
+    signing_secret: str,
+    cookie_value: str | None,
+) -> bool:
+    if not password_hash or not signing_secret or not cookie_value:
         return False
     try:
         version, raw_timestamp, raw_max_age, supplied = cookie_value.split(":", 3)
@@ -71,12 +85,19 @@ def verify_dashboard_unlock_cookie(hostname: str, management_slug: str, password
         max_age_seconds = _bounded_dashboard_unlock_seconds(int(raw_max_age))
     except ValueError:
         return False
-    if version != "v2":
+    if version != "v3":
         return False
     now = int(time.time())
     if timestamp > now + 60 or now - timestamp > max_age_seconds:
         return False
-    expected = _dashboard_unlock_signature(hostname, management_slug, password_hash, timestamp, max_age_seconds)
+    expected = _dashboard_unlock_signature(
+        hostname,
+        management_slug,
+        password_hash,
+        signing_secret,
+        timestamp,
+        max_age_seconds,
+    )
     return hmac.compare_digest(supplied, expected)
 
 
@@ -84,11 +105,16 @@ def _dashboard_unlock_signature(
     hostname: str,
     management_slug: str,
     password_hash: str,
+    signing_secret: str,
     timestamp: int,
     max_age_seconds: int,
 ) -> str:
-    payload = f"{hostname}\0{management_slug}\0{timestamp}\0{max_age_seconds}".encode()
-    return hmac.new(password_hash.encode(), payload, hashlib.sha256).hexdigest()
+    payload = f"{hostname}\0{management_slug}\0{password_hash}\0{timestamp}\0{max_age_seconds}".encode()
+    return hmac.new(signing_secret.encode(), payload, hashlib.sha256).hexdigest()
+
+
+def dashboard_cookie_signing_secret(settings: DdnsSettings) -> str:
+    return settings.dashboard_cookie_secret or settings.admin_password
 
 
 def dashboard_csrf_token(management_slug: str, account: dict[str, str | int | None]) -> str: