Merge remote-tracking branch 'kali/feature/refactor_imap_fetch' into develop

5 files changed, 100 insertions, 61 deletions

diff --git a/changes/feature_cert_auth b/changes/feature_cert_auth
new file mode 100644
index 0000000..23cdf90
--- /dev/null
+++ b/changes/feature_cert_auth
@@ -0,0 +1 @@
+  o Add client certificate authentication. Closes #3376.
\ No newline at end of file
diff --git a/src/leap/mail/imap/fetch.py b/src/leap/mail/imap/fetch.py
index 48a45e6..1c41813 100644
--- a/src/leap/mail/imap/fetch.py
+++ b/src/leap/mail/imap/fetch.py
@@ -1,15 +1,16 @@
 import logging
 import json
+import ssl
 
 from twisted.python import log
 from twisted.internet import defer
+from twisted.internet.task import LoopingCall
 from twisted.internet.threads import deferToThread
 
 from leap.common.check import leap_assert, leap_assert_type
+from leap.keymanager import openpgp
 from leap.soledad import Soledad
 
-from leap.common.keymanager import openpgp
-
 logger = logging.getLogger(__name__)
 
 
@@ -26,7 +27,8 @@ class LeapIncomingMail(object):
     INCOMING_KEY = "incoming"
     CONTENT_KEY = "content"
 
-    def __init__(self, keymanager, soledad, imap_account):
+    def __init__(self, keymanager, soledad, imap_account,
+                 check_period):
 
         """
         Initialize LeapIMAP.
@@ -39,10 +41,15 @@ class LeapIncomingMail(object):
 
         :param imap_account: the account to fetch periodically
         :type imap_account: SoledadBackedAccount
+
+        :param check_period: the period to fetch new mail, in seconds.
+        :type check_period: int
         """
 
         leap_assert(keymanager, "need a keymanager to initialize")
         leap_assert_type(soledad, Soledad)
+        leap_assert(check_period, "need a period to check incoming mail")
+        leap_assert_type(check_period, int)
 
         self._keymanager = keymanager
         self._soledad = soledad
@@ -51,6 +58,16 @@ class LeapIncomingMail(object):
 
         self._pkey = self._keymanager.get_all_keys_in_local_db(
             private=True).pop()
+        self._loop = None
+        self._check_period = check_period
+
+        self._create_soledad_indexes()
+
+    def _create_soledad_indexes(self):
+        """
+        Create needed indexes on soledad.
+        """
+        self._soledad.create_index("just-mail", "incoming")
 
     def fetch(self):
         """
@@ -64,16 +81,33 @@ class LeapIncomingMail(object):
         d.addCallbacks(self._process_doclist, self._sync_soledad_err)
         return d
 
+    def start_loop(self):
+        """
+        Starts a loop to fetch mail.
+        """
+        self._loop = LoopingCall(self.fetch)
+        self._loop.start(self._check_period)
+
+    def stop(self):
+        """
+        Stops the loop that fetches mail.
+        """
+        if self._loop:
+            self._loop.stop()
+
     def _sync_soledad(self):
         log.msg('syncing soledad...')
         logger.debug('in soledad sync')
-        #import ipdb; ipdb.set_trace()
 
-        self._soledad.sync()
-        gen, doclist = self._soledad.get_all_docs()
-        #logger.debug("there are %s docs" % (len(doclist),))
-        log.msg("there are %s docs" % (len(doclist),))
-        return doclist
+        try:
+            self._soledad.sync()
+            doclist = self._soledad.get_from_index("just-mail", "*")
+            #log.msg("there are %s mails" % (len(doclist),))
+            return doclist
+        except ssl.SSLError as exc:
+            logger.warning('SSL Error while syncing soledad: %r' % (exc,))
+        except Exception as exc:
+            logger.warning('Error while syncing soledad: %r' % (exc,))
 
     def _sync_soledad_err(self, f):
         log.err("error syncing soledad: %s" % (f.value,))
@@ -81,6 +115,8 @@ class LeapIncomingMail(object):
 
     def _process_doclist(self, doclist):
         log.msg('processing doclist')
+        if not doclist:
+            return
         for doc in doclist:
             keys = doc.content.keys()
             if self.ENC_SCHEME_KEY in keys and self.ENC_JSON_KEY in keys:
diff --git a/src/leap/mail/imap/service/imap.py b/src/leap/mail/imap/service/imap.py
index 49d54e3..9e331b6 100644
--- a/src/leap/mail/imap/service/imap.py
+++ b/src/leap/mail/imap/service/imap.py
@@ -20,15 +20,13 @@ Imap service initialization
 import logging
 logger = logging.getLogger(__name__)
 
-#from twisted.application import internet, service
 from twisted.internet.protocol import ServerFactory
-from twisted.internet.task import LoopingCall
 
 from twisted.mail import imap4
 from twisted.python import log
 
 from leap.common.check import leap_assert, leap_assert_type
-from leap.common.keymanager import KeyManager
+from leap.keymanager import KeyManager
 from leap.mail.imap.server import SoledadBackedAccount
 from leap.mail.imap.fetch import LeapIncomingMail
 from leap.soledad import Soledad
@@ -36,8 +34,8 @@ from leap.soledad import Soledad
 IMAP_PORT = 9930
 # The default port in which imap service will run
 
-#INCOMING_CHECK_PERIOD = 10
-INCOMING_CHECK_PERIOD = 5
+# INCOMING_CHECK_PERIOD = 5
+INCOMING_CHECK_PERIOD = 60
 # The period between succesive checks of the incoming mail
 # queue (in seconds)
 
@@ -127,6 +125,9 @@ class LeapIMAPFactory(ServerFactory):
 def run_service(*args, **kwargs):
     """
     Main entry point to run the service from the client.
+
+    :returns: the LoopingCall instance that will have to be stoppped
+              before shutting down the client.
     """
     leap_assert(len(args) == 2)
     soledad, keymanager = args
@@ -139,29 +140,16 @@ def run_service(*args, **kwargs):
     uuid = soledad._get_uuid()
     factory = LeapIMAPFactory(uuid, soledad)
 
-    # ---- for application framework
-    #application = service.Application("LEAP IMAP4 Local Service")
-    #imapService = internet.TCPServer(port, factory)
-    #imapService.setServiceParent(application)
-
     from twisted.internet import reactor
     reactor.listenTCP(port, factory)
 
     fetcher = LeapIncomingMail(
         keymanager,
         soledad,
-        factory.theAccount)
+        factory.theAccount,
+        check_period)
 
-    lc = LoopingCall(fetcher.fetch)
-    lc.start(check_period)
+    fetcher.start_loop()
 
-    # ---- for application framework
-    #internet.TimerService(
-        #check_period,
-        #fetcher.fetch).setServiceParent(application)
-
-    logger.debug('----------------------------------------')
     logger.debug("IMAP4 Server is RUNNING in port  %s" % (port,))
-
-    #log.msg("IMAP4 Server is RUNNING in port  %s" % (port,))
-    #return application
+    return fetcher
diff --git a/src/leap/mail/smtp/__init__.py b/src/leap/mail/smtp/__init__.py
index 78eb4f8..3b4d9d6 100644
--- a/src/leap/mail/smtp/__init__.py
+++ b/src/leap/mail/smtp/__init__.py
@@ -25,8 +25,8 @@ from twisted.internet import reactor
 from leap.mail.smtp.smtprelay import SMTPFactory
 
 
-def setup_smtp_relay(port, keymanager, smtp_host, smtp_port, smtp_username,
-                     smtp_password, encrypted_only):
+def setup_smtp_relay(port, keymanager, smtp_host, smtp_port,
+                     smtp_cert, smtp_key, encrypted_only):
     """
     Setup SMTP relay to run with Twisted.
 
@@ -42,10 +42,10 @@ def setup_smtp_relay(port, keymanager, smtp_host, smtp_port, smtp_username,
     @type smtp_host: str
     @param smtp_port:  The port of the remote SMTP server.
     @type smtp_port: int
-    @param smtp_username: The username used to connect to remote SMTP server.
-    @type smtp_username: str
-    @param smtp_password: The password used to connect to remote SMTP server.
-    @type smtp_password: str
+    @param smtp_cert: The client certificate for authentication.
+    @type smtp_cert: str
+    @param smtp_key: The client key for authentication.
+    @type smtp_key: str
     @param encrypted_only: Whether the SMTP relay should send unencrypted mail
         or not.
     @type encrypted_only: bool
@@ -56,15 +56,15 @@ def setup_smtp_relay(port, keymanager, smtp_host, smtp_port, smtp_username,
     # {
     #     'host': '<host>',
     #     'port': <int>,
-    #     'username': '<username>',
-    #     'password': '<password>',
+    #     'cert': '<cert path>',
+    #     'key': '<key path>',
     #     'encrypted_only': <True/False>
     # }
     config = {
         'host': smtp_host,
         'port': smtp_port,
-        'username': smtp_username,
-        'password': smtp_password,
+        'cert': smtp_cert,
+        'key': smtp_key,
         'encrypted_only': encrypted_only
     }
 
diff --git a/src/leap/mail/smtp/smtprelay.py b/src/leap/mail/smtp/smtprelay.py
index 1738840..e5a5614 100644
--- a/src/leap/mail/smtp/smtprelay.py
+++ b/src/leap/mail/smtp/smtprelay.py
@@ -19,16 +19,12 @@
 LEAP SMTP encrypted relay.
 """
 
-import re
-import os
-import tempfile
-
-
 from zope.interface import implements
 from StringIO import StringIO
+from OpenSSL import SSL
 from twisted.mail import smtp
 from twisted.internet.protocol import ServerFactory
-from twisted.internet import reactor
+from twisted.internet import reactor, ssl
 from twisted.internet import defer
 from twisted.python import log
 from email.Header import Header
@@ -63,8 +59,8 @@ class MalformedConfig(Exception):
 
 HOST_KEY = 'host'
 PORT_KEY = 'port'
-USERNAME_KEY = 'username'
-PASSWORD_KEY = 'password'
+CERT_KEY = 'cert'
+KEY_KEY = 'key'
 ENCRYPTED_ONLY_KEY = 'encrypted_only'
 
 
@@ -89,17 +85,17 @@ def assert_config_structure(config):
     leap_assert_type(config[HOST_KEY], str)
     leap_assert(PORT_KEY in config)
     leap_assert_type(config[PORT_KEY], int)
-    leap_assert(USERNAME_KEY in config)
-    leap_assert_type(config[USERNAME_KEY], str)
-    leap_assert(PASSWORD_KEY in config)
-    leap_assert_type(config[PASSWORD_KEY], str)
+    leap_assert(CERT_KEY in config)
+    leap_assert_type(config[CERT_KEY], str)
+    leap_assert(KEY_KEY in config)
+    leap_assert_type(config[KEY_KEY], str)
     leap_assert(ENCRYPTED_ONLY_KEY in config)
     leap_assert_type(config[ENCRYPTED_ONLY_KEY], bool)
     # assert received params are not empty
     leap_assert(config[HOST_KEY] != '')
     leap_assert(config[PORT_KEY] is not 0)
-    leap_assert(config[USERNAME_KEY] != '')
-    leap_assert(config[PASSWORD_KEY] != '')
+    leap_assert(config[CERT_KEY] != '')
+    leap_assert(config[KEY_KEY] != '')
 
 
 def validate_address(address):
@@ -143,8 +139,8 @@ class SMTPFactory(ServerFactory):
                 {
                     HOST_KEY: '<str>',
                     PORT_KEY: <int>,
-                    USERNAME_KEY: '<str>',
-                    PASSWORD_KEY: '<str>',
+                    CERT_KEY: '<str>',
+                    KEY_KEY: '<str>',
                     ENCRYPTED_ONLY_KEY: <bool>,
                 }
         @type config: dict
@@ -294,6 +290,18 @@ class SMTPDelivery(object):
 # EncryptedMessage
 #
 
+class CtxFactory(ssl.ClientContextFactory):
+    def __init__(self, cert, key):
+        self.cert = cert
+        self.key = key
+
+    def getContext(self):
+        self.method = SSL.TLSv1_METHOD  #SSLv23_METHOD
+        ctx = ssl.ClientContextFactory.getContext(self)
+        ctx.use_certificate_file(self.cert)
+        ctx.use_privatekey_file(self.key)
+        return ctx
+
 class EncryptedMessage(object):
     """
     Receive plaintext from client, encrypt it and send message to a
@@ -405,17 +413,23 @@ class EncryptedMessage(object):
         @rtype: twisted.internet.defer.Deferred
         """
         msg = self._message.as_string(False)
+
+        log.msg("Connecting to SMTP server %s:%s" % (self._config[HOST_KEY],
+                                                     self._config[PORT_KEY]))
+
         d = defer.Deferred()
         factory = smtp.ESMTPSenderFactory(
-            self._config[USERNAME_KEY],
-            self._config[PASSWORD_KEY],
+            "",
+            "",
             self._fromAddress.addrstr,
             self._user.dest.addrstr,
             StringIO(msg),
             d,
-            requireAuthentication=False,  # for now do unauth, see issue #2474
+            contextFactory=CtxFactory(self._config[CERT_KEY],
+                                      self._config[KEY_KEY]),
+            requireAuthentication=False,
         )
-        # TODO: Change this to connectSSL when cert auth is in place in the platform
+
         reactor.connectTCP(
             self._config[HOST_KEY],
             self._config[PORT_KEY],