Segeln · OstseeGEO-SAILING
Dein treuer Begleiter für den nächsten Ostseeurlaub
- Logbuch
- Törn-Briefing
- Funk-Skript
- Crew-Einweisung
- Manöver
Segeln · OstseeKeys erzeugen, sperren, zurücksetzen und das Zugriffsprotokoll ansehen.
Segeln · OstseeDein treuer Begleiter für den nächsten Ostseeurlaub
Lade …
''' # ---------------------------------------------------------------- Hilfsfunktionen def now(): return datetime.now().strftime('%Y-%m-%d %H:%M:%S') def sha(s): return hashlib.sha256(s.encode('utf-8')).hexdigest() def norm_key(k): return re.sub(r'[^A-Z0-9]', '', (k or '').upper()) _MIGRIERT = False IP_TABLE = '''CREATE TABLE IF NOT EXISTS ip_log(license_id INTEGER NOT NULL REFERENCES licenses(id) ON DELETE CASCADE, ip TEXT NOT NULL, first_seen TEXT NOT NULL, last_seen TEXT NOT NULL, hits INTEGER NOT NULL DEFAULT 1, PRIMARY KEY(license_id, ip))''' LOG_RE = re.compile(r'^(\d{4}-\d\d-\d\d \d\d:\d\d:\d\d) \| (\S+)\s*\| (?:AKTIVIERT|LOGIN|PRUEFUNG|SEITE \S+)\s*\| .*\(#(\d+)\)\s*$') def backfill_ips(c): """Beim ersten Anlegen der IP-Tabelle: bisherige erfolgreiche Zugriffe aus zugriffe.log uebernehmen.""" try: ids = set(r[0] for r in c.execute('SELECT id FROM licenses')) acc = {} with open(LOG, encoding='utf-8', errors='replace') as f: for line in f: m = LOG_RE.match(line.rstrip('\n')) if not m or int(m.group(3)) not in ids: continue k = (int(m.group(3)), m.group(2)); a = acc.get(k) if a: a[1] = m.group(1); a[2] += 1 else: acc[k] = [m.group(1), m.group(1), 1] for (lid, ip), (fs, ls, n) in acc.items(): c.execute('INSERT OR IGNORE INTO ip_log(license_id,ip,first_seen,last_seen,hits) VALUES(?,?,?,?,?)', (lid, ip, fs, ls, n)) except OSError: pass def ensure_schema(c): """Aeltere Datenbank ergaenzen: Ablaufdatum, Demo-Spalten, IP-Verlauf je Key.""" cols = [r[1] for r in c.execute('PRAGMA table_info(licenses)')] if not cols: return for name, typ in (('expires', 'TEXT'), ('demo_min', 'INTEGER'), ('demo_until', 'TEXT')): if name not in cols: c.execute('ALTER TABLE licenses ADD COLUMN %s %s' % (name, typ)) if 'muster' not in cols: # Haken "Muster-Toerns anlegen" je Lizenz; fuer 3 und 21 vorbelegt c.execute('ALTER TABLE licenses ADD COLUMN muster INTEGER NOT NULL DEFAULT 0') c.execute('UPDATE licenses SET muster=1 WHERE id IN (%s)' % ','.join(str(int(i)) for i in MUSTER_LICENSES)) if not c.execute("SELECT 1 FROM sqlite_master WHERE type='table' AND name='ip_log'").fetchone(): c.execute(IP_TABLE); backfill_ips(c) c.execute('CREATE TABLE IF NOT EXISTS logbuch(license_id INTEGER NOT NULL REFERENCES licenses(id) ON DELETE CASCADE, eid TEXT NOT NULL, data TEXT NOT NULL, PRIMARY KEY(license_id, eid))') # Zusaetzliche Admins: Lizenzen mit Zugriff auf die Admin-Seite (der Haupt-Admin steht weiter in config.json "admin_license") c.execute('CREATE TABLE IF NOT EXISTS admins(license_id INTEGER PRIMARY KEY REFERENCES licenses(id) ON DELETE CASCADE)') # Geteilte Toerns: lb_share = Freigabe-Code eines Toerns (gehoert dem Besitzer), lb_member = Lizenzen, die beigetreten sind c.execute('CREATE TABLE IF NOT EXISTS lb_share(code TEXT PRIMARY KEY, owner INTEGER NOT NULL REFERENCES licenses(id) ON DELETE CASCADE, tid TEXT NOT NULL, UNIQUE(owner, tid))') c.execute('CREATE TABLE IF NOT EXISTS lb_member(code TEXT NOT NULL REFERENCES lb_share(code) ON DELETE CASCADE, lid INTEGER NOT NULL REFERENCES licenses(id) ON DELETE CASCADE, joined TEXT, PRIMARY KEY(code, lid))') # Wachfuehrer eines geteilten Toerns (Lizenz, die gerade die Wache hat) c.execute('CREATE TABLE IF NOT EXISTS lb_wache(code TEXT PRIMARY KEY REFERENCES lb_share(code) ON DELETE CASCADE, lid INTEGER NOT NULL, t REAL)') # Von Hand hinzugefuegte Wachfuehrer (Personen ohne eigene Lizenz bzw. ohne Freigabe); gid wird vom Geraet vergeben, in der Crew steht die Person als -gid c.execute('CREATE TABLE IF NOT EXISTS lb_gast(code TEXT NOT NULL REFERENCES lb_share(code) ON DELETE CASCADE, gid INTEGER NOT NULL, name TEXT NOT NULL, PRIMARY KEY(code, gid))') c.execute('CREATE TABLE IF NOT EXISTS qr_tokens(token_hash TEXT PRIMARY KEY, license_id INTEGER NOT NULL REFERENCES licenses(id) ON DELETE CASCADE, created REAL NOT NULL)') c.execute('''CREATE TABLE IF NOT EXISTS ip_geo(ip TEXT PRIMARY KEY, ok INTEGER NOT NULL, lat REAL, lon REAL, city TEXT, country TEXT, org TEXT, ts REAL NOT NULL)''') # Ein Geraet darf mit mehreren Keys angemeldet sein: alte Tabelle hatte dev_hash allein als UNIQUE, jetzt gilt UNIQUE(license_id, dev_hash). old = any(len(c.execute('PRAGMA index_info(%s)' % r[1]).fetchall()) == 1 and c.execute('PRAGMA index_info(%s)' % r[1]).fetchone()[2] == 'dev_hash' for r in c.execute('PRAGMA index_list(devices)') if r[2]) if old: c.executescript(''' CREATE TABLE devices_neu(id INTEGER PRIMARY KEY AUTOINCREMENT, license_id INTEGER NOT NULL REFERENCES licenses(id) ON DELETE CASCADE, dev_hash TEXT NOT NULL, first_seen TEXT NOT NULL, last_seen TEXT NOT NULL, ip TEXT, UNIQUE(license_id, dev_hash)); INSERT INTO devices_neu(id,license_id,dev_hash,first_seen,last_seen,ip) SELECT id,license_id,dev_hash,first_seen,last_seen,ip FROM devices; DROP TABLE devices; ALTER TABLE devices_neu RENAME TO devices;''') c.commit() def db(): global _MIGRIERT c = sqlite3.connect(DB, timeout=15); c.row_factory = sqlite3.Row c.execute('PRAGMA foreign_keys=ON') if not _MIGRIERT: ensure_schema(c); _MIGRIERT = True return c def touch_ip(c, lid, ip): """Merkt sich, von welcher IP-Adresse aus ein Key benutzt wurde (erstmals, zuletzt, Anzahl).""" t = now() if c.execute('UPDATE ip_log SET last_seen=?, hits=hits+1 WHERE license_id=? AND ip=?', (t, lid, ip)).rowcount == 0: c.execute('INSERT INTO ip_log(license_id,ip,first_seen,last_seen,hits) VALUES(?,?,?,?,1)', (lid, ip, t, t)) # ---------------------------------------------------------------- IP-Standorte (nur fuer die Admin-Karte) GEO_URL_DEFAULT = 'https://ipwho.is/{ip}' # in config.json aenderbar: "geo_url" (mit {ip}), "geo": false schaltet die Abfrage ab GEO_OK_TTL = 30 * 86400 # gefundene Standorte 30 Tage merken GEO_FAIL_TTL = 3600 # Fehlschlaege nach 1 Stunde erneut versuchen GEO_PER_CALL = 12 # so viele neue Abfragen pro Aufruf, der Rest folgt im naechsten def ip_valid(ip): try: ipaddress.ip_address(ip); return True except Exception: return False def ip_private(ip): try: a = ipaddress.ip_address(ip) return a.is_private or a.is_loopback or a.is_link_local or a.is_reserved or a.is_multicast except Exception: return True def geo_fetch(ip): """Fragt einen Standort-Dienst ab (Standard ipwho.is, HTTPS). Gibt dict(lat,lon,city,country,org) oder None zurueck.""" url = str(cfg().get('geo_url') or GEO_URL_DEFAULT).replace('{ip}', ip) try: rq = urllib.request.Request(url, headers={'User-Agent': 'geo-gleinig-admin/1.0', 'Accept': 'application/json'}) with urllib.request.urlopen(rq, timeout=4) as r: d = json.loads(r.read(200000).decode('utf-8', 'replace')) if d.get('success') is False or d.get('status') not in (None, 'success'): return None lat = d.get('latitude', d.get('lat')); lon = d.get('longitude', d.get('lon', d.get('lng'))) lat = float(lat); lon = float(lon) if not (-90 <= lat <= 90 and -180 <= lon <= 180): return None conn = d.get('connection') if isinstance(d.get('connection'), dict) else {} return {'lat': lat, 'lon': lon, 'city': str(d.get('city') or '')[:60], 'country': str(d.get('country') or d.get('country_name') or '')[:60], 'org': str(conn.get('isp') or conn.get('org') or d.get('isp') or d.get('org') or '')[:80]} except Exception: return None def geo_lookup(c, ips): """Standorte fuer IPs aus dem Zwischenspeicher, fehlende werden (begrenzt) nachgeladen. Rueckgabe: ({ip: info}, noch_offen).""" out, todo, t = {}, [], time.time() for ip in ips: if not ip_valid(ip): out[ip] = {'ok': False, 'why': 'ungueltig'}; continue if ip_private(ip): out[ip] = {'ok': False, 'why': 'privat'}; continue r = c.execute('SELECT * FROM ip_geo WHERE ip=?', (ip,)).fetchone() if r and t - r['ts'] < (GEO_OK_TTL if r['ok'] else GEO_FAIL_TTL): out[ip] = {'ok': True, 'lat': r['lat'], 'lon': r['lon'], 'city': r['city'], 'country': r['country'], 'org': r['org']} if r['ok'] else {'ok': False, 'why': 'unbekannt'} else: todo.append(ip) pending = 0 if cfg().get('geo', True) is False: for ip in todo: out[ip] = {'ok': False, 'why': 'aus'} return out, 0 for ip in todo[:GEO_PER_CALL]: g = geo_fetch(ip) if g: c.execute('INSERT OR REPLACE INTO ip_geo(ip,ok,lat,lon,city,country,org,ts) VALUES(?,1,?,?,?,?,?,?)', (ip, g['lat'], g['lon'], g['city'], g['country'], g['org'], t)) g['ok'] = True; out[ip] = g else: c.execute('INSERT OR REPLACE INTO ip_geo(ip,ok,lat,lon,city,country,org,ts) VALUES(?,0,NULL,NULL,NULL,NULL,NULL,?)', (ip, t)) out[ip] = {'ok': False, 'why': 'unbekannt'} c.commit() pending = len(todo) - GEO_PER_CALL return out, max(0, pending) def unassigned_ips(limit_lines=200000): """IPs aus dem Zugriffsprotokoll, die zu keinem Key gehoeren: abgelehnte Keys, Aufrufe ohne Anmeldung, zu viele Fehlversuche.""" ev_ok = ('KEIN-ZUGRIFF', 'ABGELEHNT', 'GESPERRT-ZU-OFT') acc = {} try: with open(LOG, encoding='utf-8', errors='replace') as f: lines = deque((x.rstrip('\n') for x in f), maxlen=limit_lines) except OSError: return [] for line in lines: p = [x.strip() for x in line.split('|', 3)] if len(p) < 3: continue ts, ip, ev = p[0], p[1], p[2]; who = p[3] if len(p) > 3 else '' if ev not in ev_ok or re.search(r'\(#\d+\)', who) or not ip_valid(ip): continue a = acc.get(ip) if not a: a = acc[ip] = {'ip': ip, 'first_seen': ts, 'last_seen': ts, 'hits': 0, 'events': {}} a['last_seen'] = ts; a['hits'] += 1; a['events'][ev] = a['events'].get(ev, 0) + 1 return sorted(acc.values(), key=lambda x: x['last_seen'], reverse=True)[:300] def demo_minutes(): try: return max(1, min(1440, int(cfg().get('demo_minuten', DEMO_DEFAULT_MIN)))) except Exception: return DEMO_DEFAULT_MIN def demo_expired(lic): return bool(lic['demo_until']) and lic['demo_until'] < now() def demo_msg(): return 'Dieser Demo-Key ist abgelaufen. Bitte frage einen vollständigen Key an.' def start_demo(c, lic): """Demo-Key: Die Laufzeit beginnt mit der ersten erfolgreichen Nutzung.""" if lic['demo_min'] and not lic['demo_until']: c.execute('UPDATE licenses SET demo_until=? WHERE id=? AND demo_until IS NULL', ((datetime.now() + timedelta(minutes=lic['demo_min'])).strftime('%Y-%m-%d %H:%M:%S'), lic['id'])) def today(): return datetime.now().strftime('%Y-%m-%d') def parse_date(v): """'' / None -> None (unbegrenzt); 'YYYY-MM-DD' -> dasselbe; sonst ValueError. Der Key gilt bis einschliesslich dieses Tages.""" if v is None or str(v).strip() == '' or str(v).strip().lower() in ('aus', 'nie', 'unbegrenzt'): return None v = str(v).strip() d = datetime.strptime(v, '%Y-%m-%d') if d.year > 2100: raise ValueError('Jahr zu gross') return v def is_expired(exp): return bool(exp) and exp < today() def de_date(v): return '%s.%s.%s' % (v[8:10], v[5:7], v[:4]) def expired_msg(exp): return 'Dein Key ist am %s abgelaufen. Bitte frage einen neuen bzw. verlängerten Key an.' % de_date(exp) def cfg(): try: with open(CFG, encoding='utf-8') as f: return json.load(f) except Exception: return {'host': '127.0.0.1', 'port': 8000, 'proxy': False} def qr_minutes(): try: return max(1, min(60, int(cfg().get('qr_minuten', QR_MINUTES)))) except Exception: return QR_MINUTES def offline_days(): """Wie viele Tage die Seiten nach der letzten erfolgreichen Lizenzpruefung offline nutzbar sind (config.json \"offline_tage\", Standard 14, 0 = aus).""" try: return max(0, min(365, int(cfg().get('offline_tage', 14)))) except Exception: return 14 def is_admin(c, lid): """Haupt-Admin (config.json) oder Lizenz, der im Admin-Dialog Admin-Rechte gegeben wurden.""" if lid == admin_id(): return True try: return c.execute('SELECT 1 FROM admins WHERE license_id=?', (lid,)).fetchone() is not None except sqlite3.Error: return False def admin_id(): try: return int(cfg().get('admin_license', ADMIN_DEFAULT_ID)) except Exception: return ADMIN_DEFAULT_ID def log(ip, event, who=''): try: with open(LOG, 'a', encoding='utf-8') as f: f.write('%s | %-15s | %-18s | %s\n' % (now(), ip, event, who)) except Exception: pass def need_init(): if not os.path.exists(DB): print('Noch nicht eingerichtet. Bitte zuerst: python3 lizenzserver.py init'); sys.exit(1) # ---------------------------------------------------------------- Befehle def cmd_init(a): os.makedirs(DATA, exist_ok=True); os.makedirs(PAGES_DIR, exist_ok=True); os.makedirs(PUBLIC_DIR, exist_ok=True) c = sqlite3.connect(DB) c.executescript(''' CREATE TABLE IF NOT EXISTS licenses(id INTEGER PRIMARY KEY AUTOINCREMENT, label TEXT NOT NULL, key_hash TEXT UNIQUE NOT NULL, created TEXT NOT NULL, max_devices INTEGER NOT NULL DEFAULT 1, revoked INTEGER NOT NULL DEFAULT 0, expires TEXT, demo_min INTEGER, demo_until TEXT); CREATE TABLE IF NOT EXISTS devices(id INTEGER PRIMARY KEY AUTOINCREMENT, license_id INTEGER NOT NULL REFERENCES licenses(id) ON DELETE CASCADE, dev_hash TEXT NOT NULL, first_seen TEXT NOT NULL, last_seen TEXT NOT NULL, ip TEXT, UNIQUE(license_id, dev_hash)); CREATE TABLE IF NOT EXISTS fails(ip TEXT NOT NULL, ts REAL NOT NULL); ''') c.execute(IP_TABLE); c.commit(); c.close() if not os.path.exists(CFG): with open(CFG, 'w', encoding='utf-8') as f: json.dump({'host': '127.0.0.1', 'port': 8000, 'proxy': False}, f, indent=1) try: os.chmod(DATA, 0o700) except Exception: pass print('Datenbank angelegt: ' + DB) print('Naechste Schritte:\n python3 lizenzserver.py neu "Name" (Key erzeugen)\n python3 lizenzserver.py start (Server starten)') def cmd_neu(a): need_init(); c = db(); out = [] try: exp = parse_date(a.bis) if a.bis else (None if not a.tage else (datetime.now() + timedelta(days=a.tage)).strftime('%Y-%m-%d')) except ValueError: print('Datum bitte als JJJJ-MM-TT, z.B. 2027-06-30'); sys.exit(1) dm = demo_minutes() if a.demo else None if dm: exp = None for i in range(a.anzahl): key = '-'.join(''.join(secrets.choice(ALPHABET) for _ in range(4)) for _ in range(4)) lab = a.name if a.anzahl == 1 else '%s %d' % (a.name, i + 1) c.execute('INSERT INTO licenses(label,key_hash,created,max_devices,expires,demo_min) VALUES(?,?,?,?,?,?)', (lab, sha(norm_key(key)), now(), a.geraete, exp, dm)) out.append((c.execute('SELECT last_insert_rowid()').fetchone()[0], lab, key)) c.commit(); c.close() print('Der Key wird nur jetzt angezeigt (gespeichert ist nur ein Hash). Bitte direkt weitergeben:\n') for i, lab, key in out: print(' #%-3d %-20s %s (%d Geraet%s, %s)' % (i, lab, key, a.geraete, '' if a.geraete == 1 else 'e', ('Demo: %d Min. ab erster Nutzung' % dm) if dm else (('gueltig bis ' + exp) if exp else 'unbegrenzt'))) def cmd_liste(a): need_init(); c = db() rows = c.execute('''SELECT l.*, (SELECT COUNT(*) FROM devices d WHERE d.license_id=l.id) AS n, (SELECT MAX(last_seen) FROM devices d WHERE d.license_id=l.id) AS ls FROM licenses l ORDER BY l.id''').fetchall() if not rows: print('Noch keine Keys. Erzeugen mit: python3 lizenzserver.py neu "Name"'); return print('%-4s %-20s %-10s %-8s %-19s %-11s %s' % ('ID', 'Name', 'Status', 'Geraete', 'Zuletzt gesehen', 'Gueltig bis', 'Angelegt')) for r in rows: st = 'gesperrt' if r['revoked'] else ('abgelaufen' if (is_expired(r['expires']) or demo_expired(r)) else ('benutzt' if r['n'] else 'frei')) gb = ('Demo ' + (r['demo_until'][11:16] if r['demo_until'] else '%dmin' % r['demo_min'])) if r['demo_min'] else (r['expires'] or '-') print('%-4d %-20s %-10s %-8s %-19s %-11s %s' % (r['id'], r['label'][:20], st, '%d/%d' % (r['n'], r['max_devices']), r['ls'] or '-', gb, r['created'])) def _lic(c, id_): r = c.execute('SELECT * FROM licenses WHERE id=?', (id_,)).fetchone() if not r: print('Keine Lizenz mit ID %s.' % id_); sys.exit(1) return r def cmd_sperren(a): need_init(); c = db(); r = _lic(c, a.id); c.execute('UPDATE licenses SET revoked=1 WHERE id=?', (a.id,)); c.commit() print('Gesperrt: #%d %s (Geraete verlieren sofort den Zugang)' % (r['id'], r['label'])) def cmd_entsperren(a): need_init(); c = db(); r = _lic(c, a.id); c.execute('UPDATE licenses SET revoked=0 WHERE id=?', (a.id,)); c.commit() print('Entsperrt: #%d %s' % (r['id'], r['label'])) def cmd_reset(a): need_init(); c = db(); r = _lic(c, a.id); c.execute('DELETE FROM devices WHERE license_id=?', (a.id,)); c.commit() print('Geraetebindung geloescht: #%d %s. Der Key kann einmal neu aktiviert werden (z.B. fuer ein neues Handy).' % (r['id'], r['label'])) def cmd_ablauf(a): need_init(); c = db(); r = _lic(c, a.id) try: exp = parse_date(a.datum) except ValueError: print('Datum bitte als JJJJ-MM-TT (z.B. 2027-06-30) oder "aus" fuer unbegrenzt.'); sys.exit(1) c.execute('UPDATE licenses SET expires=? WHERE id=?', (exp, a.id)); c.commit() print('#%d %s: %s' % (r['id'], r['label'], ('gueltig bis einschliesslich ' + exp) if exp else 'unbegrenzt gueltig')) def cmd_geraete(a): need_init(); c = db(); r = _lic(c, a.id) if not 1 <= a.anzahl <= 100: print('Anzahl bitte 1 bis 100.'); sys.exit(1) c.execute('UPDATE licenses SET max_devices=? WHERE id=?', (a.anzahl, a.id)); c.commit() print('#%d %s: bis zu %d Geraet%s erlaubt.' % (r['id'], r['label'], a.anzahl, '' if a.anzahl == 1 else 'e')) def cmd_ips(a): need_init(); c = db(); r = _lic(c, a.id) rows = c.execute('SELECT * FROM ip_log WHERE license_id=? ORDER BY last_seen DESC', (a.id,)).fetchall() print('IP-Adressen fuer #%d %s:' % (r['id'], r['label'])) if not rows: print(' noch keine.'); return print(' %-45s %-19s %-19s %s' % ('IP', 'Zuletzt', 'Erstmals', 'Aufrufe')) for x in rows: print(' %-45s %-19s %-19s %d' % (x['ip'], x['last_seen'], x['first_seen'], x['hits'])) def cmd_loeschen(a): need_init(); c = db(); r = _lic(c, a.id); c.execute('DELETE FROM licenses WHERE id=?', (a.id,)); c.commit() print('Geloescht: #%d %s' % (r['id'], r['label'])) def cmd_log(a): if not os.path.exists(LOG): print('Noch keine Eintraege.'); return with open(LOG, encoding='utf-8') as f: lines = f.readlines() sys.stdout.write(''.join(lines[-a.n:])) # ---------------------------------------------------------------- Webserver def seed_muster(c, lid, label): """Demo-Key: legt beim ersten Aufruf des Logbuchs die Muster-Toerns aus daten/muster-toerns.json an (Platzhalter {EIGNER} = Name der Lizenz). Die Marke '_muster' verhindert, dass geloeschte Muster wiederkommen.""" try: if c.execute("SELECT 1 FROM logbuch WHERE license_id=? AND eid='_muster'", (lid,)).fetchone(): return with open(os.path.join(DATA, 'muster-toerns.json'), encoding='utf-8') as f: txt = f.read() rows = json.loads(txt.replace('{EIGNER}', json.dumps(label or 'Demo', ensure_ascii=False)[1:-1])) for v in rows: if isinstance(v, dict) and isinstance(v.get('id'), str): c.execute('INSERT OR IGNORE INTO logbuch(license_id, eid, data) VALUES(?,?,?)', (lid, v['id'], json.dumps(v, ensure_ascii=False))) c.execute("INSERT OR IGNORE INTO logbuch(license_id, eid, data) VALUES(?,?,?)", (lid, '_muster', '{}')) c.commit() except (OSError, ValueError, sqlite3.Error): pass class H(BaseHTTPRequestHandler): server_version = 'GeoSailing' sys_version = '' def log_message(self, *a): pass def ip(self): if self.server.proxy: # Der Proxy (Apache/nginx) haengt die echte Client-IP hinten an. Ein vom Besucher # mitgeschickter Wert steht davor und wird bewusst ignoriert (kein Faelschen der IP). x = (self.headers.get('X-Forwarded-For') or '').split(',')[-1].strip() if x: return x[:45] return self.client_address[0] def send(self, code, body, ctype='text/html; charset=utf-8', extra=None): if isinstance(body, str): body = body.encode('utf-8') self.send_response(code) self.send_header('Content-Type', ctype); self.send_header('Content-Length', str(len(body))) self.send_header('Cache-Control', 'no-store'); self.send_header('X-Content-Type-Options', 'nosniff') self.send_header('Referrer-Policy', 'no-referrer') for k, v in (extra or {}).items(): self.send_header(k, v) self.end_headers() if self.command != 'HEAD': self.wfile.write(body) def cookie_dev(self): try: ck = SimpleCookie(self.headers.get('Cookie') or '') v = ck[COOKIE].value if COOKIE in ck else '' except Exception: return '' return v if DEV_RE.match(v or '') else '' def cookie_hdr(self, tok): sec = '; Secure' if (self.headers.get('X-Forwarded-Proto') or '').lower() == 'https' else '' return {'Set-Cookie': '%s=%s; Max-Age=%d; Path=/; HttpOnly; SameSite=Lax%s' % (COOKIE, tok, COOKIE_AGE, sec)} def jerr(self, code, msg): self.send(code, json.dumps({'error': msg}), 'application/json') def jden(self, msg, **extra): # 403 mit denied-Merker: nur dann loescht das Geraet seine Offline-Kopien d = {'error': msg, 'denied': True}; d.update(extra); self.send(403, json.dumps(d), 'application/json') def do_HEAD(self): self.do_GET() def do_GET(self): try: self._get() except Exception as e: self.crash(e) def crash(self, e): import traceback; traceback.print_exc(file=sys.stderr); sys.stderr.flush() if isinstance(e, sqlite3.OperationalError): msg = 'Datenbank nicht beschreibbar (Dateirechte auf dem Server prüfen: lizenzserver.py pruefen).' else: msg = 'Serverfehler. Details im Server-Protokoll (journalctl -u geo-gleinig -n 30).' try: self.jerr(500, msg) except Exception: pass def _get(self): p = self.path.split('?', 1)[0].split('#', 1)[0] name = os.path.basename(p) or 'index.html' if p.endswith('/') or p == '': name = 'index.html' if name.endswith('.html') and name[:-5] in rechtliches.RENDER and rechtliches.active(DATA): # Rechtstexte: bewusst ohne Key abrufbar return self.send(200, rechtliches.render(name[:-5], DATA, cfg().get('geo', True) is not False)) if name.endswith('.html') and (name[:-5] in PAGES or name[:-5] == ADMIN_PAGE): sh = SHELL.replace('__NAME__', name[:-5]) if not rechtliches.active(DATA): sh = re.sub(r'.*?', '', sh, flags=re.S) # Rechtstexte abgeschaltet: auch die Links weg return self.send(200, sh) fp = os.path.join(PUBLIC_DIR, name) if name and re.match(r'^[A-Za-z0-9._-]+$', name) and os.path.isfile(fp): with open(fp, 'rb') as f: data = f.read() return self.send(200, data, MIME.get(os.path.splitext(name)[1].lower(), 'application/octet-stream')) self.send(404, 'Nicht gefunden', 'text/plain; charset=utf-8') def body(self, lim=4096): try: if 'chunked' in (self.headers.get('Transfer-Encoding') or '').lower(): raw = b'' while True: ln = int((self.rfile.readline(64).strip() or b'0').split(b';')[0], 16) if ln == 0: self.rfile.readline(); break raw += self.rfile.read(ln); self.rfile.readline() if len(raw) > lim: return None else: n = int(self.headers.get('Content-Length') or 0) if n <= 0 or n > lim: return None raw = self.rfile.read(n) return json.loads(raw.decode('utf-8')) except Exception: return None def do_POST(self): try: self._post() except Exception as e: self.crash(e) def _post(self): p = self.path.split('?', 1)[0] if p.endswith('/api/redeem'): return self.redeem() if p.endswith('/api/page'): return self.page() if p.endswith('/api/check'): return self.check() if p.endswith('/api/admin'): return self.admin() if p.endswith('/api/logbuch'): return self.logbuch() self.send(404, 'Nicht gefunden', 'text/plain; charset=utf-8') def limited(self, c, ip): c.execute('DELETE FROM fails WHERE ts= MAX_FAILS def redeem(self): ip = self.ip(); j = self.body(); c = db() try: if self.limited(c, ip): c.commit(); log(ip, 'GESPERRT-ZU-OFT'); return self.jerr(429, 'Zu viele Fehlversuche. Bitte in 10 Minuten erneut versuchen.') dev = (j or {}).get('dev', ''); key = norm_key((j or {}).get('key', '')) qr = (j or {}).get('qr') if qr is not None: return self.redeem_qr(c, ip, dev, qr) if not isinstance(dev, str) or not DEV_RE.match(dev) or len(key) != 16: c.execute('INSERT INTO fails VALUES(?,?)', (ip, time.time())); c.commit(); log(ip, 'ABGELEHNT', 'Format'); return self.jerr(403, 'Key ungültig.') lic = c.execute('SELECT * FROM licenses WHERE key_hash=?', (sha(key),)).fetchone() if not lic or lic['revoked']: c.execute('INSERT INTO fails VALUES(?,?)', (ip, time.time())); c.commit(); log(ip, 'ABGELEHNT', 'unbekannt/gesperrt'); return self.jerr(403, 'Key ungültig oder gesperrt.') if is_expired(lic['expires']): log(ip, 'ABGELEHNT', '%s (#%d): abgelaufen' % (lic['label'], lic['id'])); return self.jerr(403, expired_msg(lic['expires'])) if demo_expired(lic): log(ip, 'ABGELEHNT', '%s (#%d): Demo abgelaufen' % (lic['label'], lic['id'])); return self.jerr(403, demo_msg()) ck = self.cookie_dev() if ck: same = c.execute('SELECT * FROM devices WHERE dev_hash=? AND license_id=?', (sha(ck), lic['id'])).fetchone() if same: # Dieses Geraet ist schon mit genau diesem Key aktiviert (Browser hat sich das gemerkt) c.execute('UPDATE devices SET last_seen=?, ip=? WHERE id=?', (now(), ip, same['id'])); touch_ip(c, lic['id'], ip); start_demo(c, lic); c.commit() log(ip, 'LOGIN', '%s (#%d)' % (lic['label'], lic['id'])) return self.send(200, json.dumps({'ok': True, 'dev': ck}), 'application/json', self.cookie_hdr(ck)) dh = sha(dev); d = c.execute('SELECT * FROM devices WHERE dev_hash=? AND license_id=?', (dh, lic['id'])).fetchone() # ein Geraet darf mehrere Keys haben if not d: n = c.execute('SELECT COUNT(*) FROM devices WHERE license_id=?', (lic['id'],)).fetchone()[0] if n >= lic['max_devices']: c.execute('INSERT INTO fails VALUES(?,?)', (ip, time.time())); c.commit() log(ip, 'ABGELEHNT', '%s (#%d): schon benutzt' % (lic['label'], lic['id'])); return self.jerr(403, 'Dieser Key ist schon auf einem anderen Gerät aktiviert.') c.execute('INSERT INTO devices(license_id,dev_hash,first_seen,last_seen,ip) VALUES(?,?,?,?,?)', (lic['id'], dh, now(), now(), ip)) log(ip, 'AKTIVIERT', '%s (#%d)' % (lic['label'], lic['id'])) else: c.execute('UPDATE devices SET last_seen=?, ip=? WHERE id=?', (now(), ip, d['id'])); log(ip, 'LOGIN', '%s (#%d)' % (lic['label'], lic['id'])) touch_ip(c, lic['id'], ip); start_demo(c, lic) c.commit(); self.send(200, json.dumps({'ok': True, 'dev': dev}), 'application/json', self.cookie_hdr(dev)) finally: c.close() def redeem_qr(self, c, ip, dev, qr): """Einmal-QR-Code aus dem Admin-Panel: bindet dieses Geraet an die Lizenz QR_LICENSE, auch wenn deren Geraete-Limit erreicht ist. Der Token gilt nur kurz, nur einmal und nur fuer diese eine Lizenz.""" def bad(why): c.execute('INSERT INTO fails VALUES(?,?)', (ip, time.time())); c.commit(); log(ip, 'ABGELEHNT', 'QR: ' + why) return self.jerr(403, 'Dieser QR-Code ist ungültig oder abgelaufen. Bitte einen neuen erzeugen lassen.') if not isinstance(dev, str) or not DEV_RE.match(dev) or not isinstance(qr, str) or not re.match(r'^[A-Za-z0-9_-]{20,64}$', qr): return bad('Format') c.execute('DELETE FROM qr_tokens WHERE created=?) AND (l.demo_until IS NULL OR l.demo_until>=?) ORDER BY d.last_seen DESC, d.id DESC''', (sha(cand), today(), now())).fetchone() # mehrere Keys: der zuletzt eingegebene bzw. benutzte gilt if r: return r, cand return None, None def expired_for(self, c, dev): """Hinweistext, falls das Geraet zu einem (nicht gesperrten) abgelaufenen Key oder abgelaufenen Demo-Key gehoert, sonst None.""" cands = [x for x in (dev, self.cookie_dev()) if isinstance(x, str) and DEV_RE.match(x)] for cand in cands: r = c.execute('''SELECT l.expires, l.demo_until FROM devices d JOIN licenses l ON l.id=d.license_id WHERE d.dev_hash=? AND l.revoked=0 AND ((l.expires IS NOT NULL AND l.expireswindow.GG_LIC=' + json.dumps(info) + ';').encode('utf-8')) i = data.rfind(b'