summaryrefslogtreecommitdiff
path: root/scripts/db_access/client_side_db.py
blob: 422afffab8e8fd4ba3745263c9da133ee58c6fa3 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
#!/usr/bin/python

import os
import argparse
import tempfile
import getpass
import requests
import srp._pysrp as srp
import binascii
import logging
import json
import time

from twisted.internet import reactor
from twisted.internet.defer import inlineCallbacks

from leap.soledad.client import Soledad
from leap.keymanager import KeyManager
from leap.keymanager.openpgp import OpenPGPKey

from util import ValidateUserHandle


"""
Script to give access to client-side Soledad database.

This is mainly used for tests, but can also be used to recover data from a
Soledad database (public/private keys, export documents, etc).

To speed up testing/debugging, this script can dump the auth data after
logging in. Use the --export-auth-data option to export auth data to a file.
The contents of the file is a json dictionary containing the uuid, server_url,
cert_file and token, which is enough info to instantiate a soledad client
without having to interact with the webapp again. Use the --use-auth-data
option to use the auth data stored in a file.

Use the --help option to see available options.
"""


# create a logger
logger = logging.getLogger(__name__)
LOG_FORMAT = '%(asctime)s %(message)s'
logging.basicConfig(format=LOG_FORMAT, level=logging.DEBUG)


safe_unhexlify = lambda x: binascii.unhexlify(x) if (
    len(x) % 2 == 0) else binascii.unhexlify('0' + x)


def _fail(reason):
    logger.error('Fail: ' + reason)
    exit(2)


def _get_api_info(provider):
    info = requests.get(
        'https://'+provider+'/provider.json', verify=False).json()
    return info['api_uri'], info['api_version']


def _login(username, passphrase, provider, api_uri, api_version):
    usr = srp.User(username, passphrase, srp.SHA256, srp.NG_1024)
    auth = None
    try:
        auth = _authenticate(api_uri, api_version, usr).json()
    except requests.exceptions.ConnectionError:
        _fail('Could not connect to server.')
    if 'errors' in auth:
        _fail(str(auth['errors']))
    return api_uri, api_version, auth


def _authenticate(api_uri, api_version, usr):
    api_url = "%s/%s" % (api_uri, api_version)
    session = requests.session()
    uname, A = usr.start_authentication()
    params = {'login': uname, 'A': binascii.hexlify(A)}
    init = session.post(
        api_url + '/sessions', data=params, verify=False).json()
    if 'errors' in init:
        _fail('test user not found')
    M = usr.process_challenge(
        safe_unhexlify(init['salt']), safe_unhexlify(init['B']))
    return session.put(api_url + '/sessions/' + uname, verify=False,
                       data={'client_auth': binascii.hexlify(M)})


def _get_soledad_info(username, provider, passphrase, basedir):
    api_uri, api_version = _get_api_info(provider)
    auth = _login(username, passphrase, provider, api_uri, api_version)
    # get soledad server url
    service_url = '%s/%s/config/soledad-service.json' % \
                  (api_uri, api_version)
    soledad_hosts = requests.get(service_url, verify=False).json()['hosts']
    hostnames = soledad_hosts.keys()
    # allow for choosing the host
    host = hostnames[0]
    if len(hostnames) > 1:
        i = 1
        print "There are many available hosts:"
        for h in hostnames:
            print "  (%d) %s.%s" % (i, h, provider)
            i += 1
        choice = raw_input("Choose a host to use (default: 1): ")
        if choice != '':
            host = hostnames[int(choice) - 1]
    server_url = 'https://%s:%d/user-%s' % \
              (soledad_hosts[host]['hostname'], soledad_hosts[host]['port'],
               auth[2]['id'])
    # get provider ca certificate
    ca_cert = requests.get('https://%s/ca.crt' % provider, verify=False).text
    cert_file = os.path.join(basedir, 'ca.crt')
    with open(cert_file, 'w') as f:
      f.write(ca_cert)
    return auth[2]['id'], server_url, cert_file, auth[2]['token']


def _get_soledad_instance(uuid, passphrase, basedir, server_url, cert_file,
        token):
    # setup soledad info
    logger.info('UUID is %s' % uuid)
    logger.info('Server URL is %s' % server_url)
    secrets_path = os.path.join(
        basedir, '%s.secret' % uuid)
    local_db_path = os.path.join(
        basedir, '%s.db' % uuid)
    # instantiate soledad
    return Soledad(
        uuid,
        unicode(passphrase),
        secrets_path=secrets_path,
        local_db_path=local_db_path,
        server_url=server_url,
        cert_file=cert_file,
        auth_token=token,
        defer_encryption=True)


def _get_keymanager_instance(username, provider, soledad, token,
        ca_cert_path=None, api_uri=None, api_version=None, uid=None,
        gpgbinary=None):
    return KeyManager(
        "{username}@{provider}".format(username=username, provider=provider),
        "http://uri",
        soledad,
        token=token,
        ca_cert_path=ca_cert_path,
        api_uri=api_uri,
        api_version=api_version,
        uid=uid,
        gpgbinary=gpgbinary)


def _parse_args():
    # parse command line
    parser = argparse.ArgumentParser()
    parser.add_argument(
        'user@provider', action=ValidateUserHandle, help='the user handle')
    parser.add_argument(
        '--basedir', '-b', default=None,
        help='soledad base directory')
    parser.add_argument(
        '--passphrase', '-p', default=None,
        help='the user passphrase')
    parser.add_argument(
        '--get-all-docs', '-a', action='store_true',
        help='get all documents from the local database')
    parser.add_argument(
        '--create-docs', '-c', default=0, type=int,
        help='create a number of documents')
    parser.add_argument(
        '--sync', '-s', action='store_true',
        help='synchronize with the server replica')
    parser.add_argument(
        '--repeat-sync', '-r', action='store_true',
        help='repeat synchronization until no new data is received')
    parser.add_argument(
        '--export-public-key', help="export the public key to a file")
    parser.add_argument(
        '--export-private-key', help="export the private key to a file")
    parser.add_argument(
        '--export-incoming-messages',
        help="export incoming messages to a directory")
    parser.add_argument(
        '--export-auth-data',
        help="export authentication data to a file")
    parser.add_argument(
        '--use-auth-data',
        help="use authentication data from a file")
    return parser.parse_args()


def _get_passphrase(args):
    passphrase = args.passphrase
    if passphrase is None:
        passphrase = getpass.getpass(
            'Password for %s@%s: ' % (args.username, args.provider))
    return passphrase


def _get_basedir(args):
    basedir = args.basedir
    if basedir is None:
        basedir = tempfile.mkdtemp()
    elif not os.path.isdir(basedir):
        os.mkdir(basedir)
    logger.info('Using %s as base directory.' % basedir)
    return basedir


@inlineCallbacks
def _export_key(args, km, fname, private=False):
    address = args.username + "@" + args.provider
    pkey = yield km.get_key(address, OpenPGPKey, private=private, fetch_remote=False)
    with open(args.export_private_key, "w") as f:
        f.write(pkey.key_data)


@inlineCallbacks
def _export_incoming_messages(soledad, directory):
    yield soledad.create_index("by-incoming", "bool(incoming)")
    docs = yield soledad.get_from_index("by-incoming", '1')
    i = 1
    for doc in docs:
        with open(os.path.join(directory, "message_%d.gpg" % i), "w") as f:
            f.write(doc.content["_enc_json"])
        i += 1


@inlineCallbacks
def _get_all_docs(soledad):
    _, docs = yield soledad.get_all_docs()
    for doc in docs:
        print json.dumps(doc.content, indent=4)


# main program

@inlineCallbacks
def _main(soledad, km, args):
    try:
        if args.create_docs:
            for i in xrange(args.create_docs):
                t = time.time()
                logger.debug("Creating doc %d/%d..." % (i + 1, args.create_docs))
                content = {
                    'datetime': time.strftime(
                        "%Y-%m-%d %H:%M:%S", time.gmtime(t)),
                    'timestamp': t,
                    'index': i,
                    'total': args.create_docs,
                }
                yield soledad.create_doc(content)
        if args.sync:
            yield soledad.sync()
        if args.repeat_sync:
            old_gen = 0
            new_gen = yield soledad.sync()
            while old_gen != new_gen:
                old_gen = new_gen
                new_gen = yield soledad.sync()
        if args.get_all_docs:
            yield _get_all_docs(soledad)
        if args.export_private_key:
            yield _export_key(args, km, args.export_private_key, private=True)
        if args.export_public_key:
            yield _export_key(args, km, args.expoert_public_key, private=False)
        if args.export_incoming_messages:
            yield _export_incoming_messages(soledad, args.export_incoming_messages)
    except Exception as e:
        logger.error(e)
    finally:
        soledad.close()
        reactor.callWhenRunning(reactor.stop)


if __name__ == '__main__':
    args = _parse_args()
    passphrase = _get_passphrase(args)
    basedir = _get_basedir(args)

    if not args.use_auth_data:
        # get auth data from server
        uuid, server_url, cert_file, token = \
            _get_soledad_info(args.username, args.provider, passphrase, basedir)
    else:
        # load auth data from file
        with open(args.use_auth_data) as f:
            auth_data = json.loads(f.read())
            uuid = auth_data['uuid']
            server_url = auth_data['server_url']
            cert_file = auth_data['cert_file']
            token = auth_data['token']

    # export auth data to a file
    if args.export_auth_data:
        with open(args.export_auth_data, "w") as f:
            f.write(json.dumps({
                'uuid': uuid,
                'server_url': server_url,
                'cert_file': cert_file,
                'token': token,
            }))

    soledad = _get_soledad_instance(
        uuid, passphrase, basedir, server_url, cert_file, token)
    km = _get_keymanager_instance(
        args.username,
        args.provider,
        soledad,
        token,
        uid=uuid)
    _main(soledad, km, args)
    reactor.run()