1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
|
# -*- coding: utf-8 -*-
# _web.py
# Copyright (C) 2016 LEAP Encryption Access Project
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
"""
HTTP REST Dispatcher Service.
"""
import json
import os
import pkg_resources
from twisted.application import service
from twisted.internet import endpoints
from twisted.cred import portal, checkers, credentials, error as credError
from twisted.internet import reactor, defer
from twisted.logger import Logger
from twisted.web.guard import HTTPAuthSessionWrapper, BasicCredentialFactory
from twisted.web.resource import IResource, Resource
from twisted.web.server import Site, NOT_DONE_YET
from twisted.web.static import File
from zope.interface import implementer
from leap.bitmask.util import here
from leap.bitmask.core.dispatcher import CommandDispatcher
try:
import leap.bitmask_js
HAS_WEB_UI = True
except ImportError:
HAS_WEB_UI = False
try:
import txtorcon
except Exception:
pass
log = Logger()
class TokenCredentialFactory(BasicCredentialFactory):
scheme = 'token'
@implementer(checkers.ICredentialsChecker)
class TokenDictChecker:
credentialInterfaces = (credentials.IUsernamePassword,
credentials.IUsernameHashedPassword)
def __init__(self, tokens):
self.tokens = tokens
def requestAvatarId(self, credentials):
username = credentials.username
if username in self.tokens:
if credentials.checkPassword(self.tokens[username]):
return defer.succeed(username)
else:
return defer.fail(
credError.UnauthorizedLogin("Bad session token"))
else:
return defer.fail(
credError.UnauthorizedLogin("No such user"))
@implementer(portal.IRealm)
class HttpPasswordRealm(object):
def __init__(self, resource):
self.resource = resource
def requestAvatar(self, user, mind, *interfaces):
# the resource is passed on regardless of user
if IResource in interfaces:
return (IResource, self.resource, lambda: None)
raise NotImplementedError()
@implementer(IResource)
class WhitelistHTTPAuthSessionWrapper(HTTPAuthSessionWrapper):
"""
Wrap a portal, enforcing supported header-based authentication schemes.
It doesn't apply the enforcement to routes included in a whitelist.
"""
# TODO extend this to inspect the data -- so that we pass a tuple
# with the action
whitelist = (None,)
def __init__(self, *args, **kw):
self.whitelist = kw.pop('whitelist', tuple())
super(WhitelistHTTPAuthSessionWrapper, self).__init__(
*args, **kw)
def getChildWithDefault(self, path, request):
if request.path in self.whitelist:
return self
return HTTPAuthSessionWrapper.getChildWithDefault(self, path, request)
def render(self, request):
if request.path in self.whitelist:
_res = self._portal.realm.resource
return _res.render(request)
return HTTPAuthSessionWrapper.render(self, request)
def protectedResourceFactory(resource, session_tokens, whitelist):
realm = HttpPasswordRealm(resource)
checker = TokenDictChecker(session_tokens)
resource_portal = portal.Portal(realm, [checker])
credentialFactory = TokenCredentialFactory('localhost')
protected_resource = WhitelistHTTPAuthSessionWrapper(
resource_portal, [credentialFactory],
whitelist=whitelist)
return protected_resource
class HTTPDispatcherService(service.Service):
"""
A Dispatcher for BitmaskCore exposing a REST API.
The API itself is served under the API/ route.
If the package ``leap.bitmask_js`` is found in the import path, we'll serve
the whole JS UI in the root resource too (under the ``public`` path).
If that package cannot be found, we'll serve just the javascript wrapper
around the REST API.
"""
API_WHITELIST = (
'/API/bonafide/user',
)
def __init__(self, core, port=7070, debug=False, onion=False):
self._core = core
self.port = port
self.debug = debug
self.onion = onion
self.uri = ''
def startService(self):
# TODO refactor this, too long----------------------------------------
if HAS_WEB_UI:
webdir = os.path.abspath(
pkg_resources.resource_filename('leap.bitmask_js', 'public'))
log.debug('webdir: %s' % webdir)
else:
log.warn('bitmask_js not found, serving bitmask.core ui')
webdir = os.path.abspath(
pkg_resources.resource_filename('leap.bitmask.core', 'web'))
jspath = os.path.join(
here(), '..', '..', '..',
'ui', 'app', 'lib', 'bitmask.js')
jsapi = File(os.path.abspath(jspath))
api = Api(CommandDispatcher(self._core))
protected_api = protectedResourceFactory(
api, self._core.tokens, self.API_WHITELIST)
root = File(webdir)
root.putChild(u'API', protected_api)
if not HAS_WEB_UI:
root.putChild('bitmask.js', jsapi)
factory = Site(root)
self.site = factory
if self.onion and _has_txtorcon():
self._start_onion_service(factory)
else:
interface = '127.0.0.1'
endpoint = endpoints.TCP4ServerEndpoint(
reactor, self.port, interface=interface)
self.uri = 'https://%s:%s' % (interface, self.port)
endpoint.listen(factory)
# TODO this should be set in a callback to the listen call
self.running = True
def _start_onion_service(self, factory):
def progress(percent, tag, message):
bar = int(percent / 10)
log.debug('[%s%s] %s' % ('#' * bar, '.' * (10 - bar), message))
def setup_complete(port):
port = txtorcon.IHiddenService(port)
self.uri = "http://%s" % (port.getHost().onion_uri)
log.info('I have set up a hidden service, advertised at: %s'
% self.uri)
log.info('locally listening on %s' % port.local_address.getHost())
def setup_failed(args):
log.error('onion service setup FAILED: %r' % args)
endpoint = endpoints.serverFromString(reactor, 'onion:80')
txtorcon.IProgressProvider(endpoint).add_progress_listener(progress)
d = endpoint.listen(factory)
d.addCallback(setup_complete)
d.addErrback(setup_failed)
return d
def stopService(self):
self.site.stopFactory()
self.listener.stopListening()
self.running = False
def do_status(self):
status = 'running' if self.running else 'disabled'
return {'web': status, 'uri': self.uri}
class Api(Resource):
isLeaf = True
def __init__(self, dispatcher):
Resource.__init__(self)
self.dispatcher = dispatcher
def render_POST(self, request):
command = request.uri.split('/')[2:]
params = request.content.getvalue()
if params:
# json.loads returns unicode strings and the rest of the code
# expects strings. This 'str(param)' conversion can be removed
# if we move to python3
for param in json.loads(params):
command.append(str(param))
d = self.dispatcher.dispatch(command)
d.addCallback(self._write_response, request)
return NOT_DONE_YET
def _write_response(self, response, request):
request.setHeader('Content-Type', 'application/json')
request.write(response)
request.finish()
def _has_txtorcon():
try:
import txtorcon
txtorcon
except ImportError:
log.error('onion is enabled, but could not find txtorcon')
return False
return True
|