#!/bin/env python

# -*- coding: utf-8 -*-

# ------------------------------------------------------------

# opensecurity_client_restful_server

# 

# the OpenSecurity client RESTful server

#

# Autor: Oliver Maurhart, <oliver.maurhart@ait.ac.at>

#

# Copyright (C) 2013 AIT Austrian Institute of Technology

# AIT Austrian Institute of Technology GmbH

# Donau-City-Strasse 1 | 1220 Vienna | Austria

# http://www.ait.ac.at

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation version 2.

# 

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

# 

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, 

# Boston, MA  02110-1301, USA.

# ------------------------------------------------------------

# ------------------------------------------------------------

# imports

import os

import os.path

import subprocess

import sys

import urllib

import urllib2

import web

# local

from environment import Environment

from notification import Notification

import opensecurity_server

# ------------------------------------------------------------

# const

__version__ = "0.1"

"""All the URLs we know mapping to class handler"""

opensecurity_urls = (

    '/application',             'os_application',

    '/credentials',             'os_credentials',

    '/notification',            'os_notification',

    '/password',                'os_password',

    '/',                        'os_root'

)

# ------------------------------------------------------------

# code

class os_application:

    """OpenSecurity '/application' handler.

    This is called on GET /application?vm=VM-ID&app=APP-ID

    This tries to access the vm identified with the label VM-ID

    and launched the application identified APP-ID

    """

    def GET(self):

        # pick the arguments

        args = web.input()

        # we _need_ a vm

        if not "vm" in args:

            raise web.badrequest('no vm given')

        # we _need_ a app

        if not "app" in args:

            raise web.badrequest('no app given')

        apps = opensecurity_server.query_apps()

        vms = opensecurity_server.query_vms()

        # check if we do have valid vm

        v = [v for v in vms if v['name'] == args.vm]

        if len(v) == 0:

            raise web.notfound('vm not found')

        v = v[0]

        # check if we do have a valid app

        a = [a for a in apps if a['name'] == args.app]

        if len(a) == 0:

            raise web.notfound('app not found')

        a = a[0]

        # invoke launch with 

        res = "starting: launch " + v['user'] + " " + v['ip'] + " " + a['command']

        launch_image = os.path.join(sys.path[0], 'launch.py')

        process_command = [sys.executable, launch_image, v['user'], v['ip'], a['command']]

        process = subprocess.Popen(process_command, shell = False, stdout = subprocess.PIPE)

        result = process.communicate()[0]

        if process.returncode != 0:

            return 'Launch of application aborted.'

        return result

class os_credentials:

    """OpenSecurity '/credentials' handler.

    This is called on GET /credentials?text=TEXT.

    Ideally this should pop up a user dialog to insert his

    credentials based the given TEXT.

    """

    def GET(self):

        # pick the arguments

        args = web.input()

        # we _need_ a text

        if not "text" in args:

            raise web.badrequest('no text given')

        # invoke the user dialog as a subprocess

        dlg_image = os.path.join(sys.path[0], 'opensecurity_dialog.py')

        process_command = [sys.executable, dlg_image, 'credentials', args.text]

        process = subprocess.Popen(process_command, shell = False, stdout = subprocess.PIPE)

        result = process.communicate()[0]

        if process.returncode != 0:

            return 'Credentials request has been aborted.'

        return result

class os_notification:

    """OpenSecurity '/notification' handler.

    This is called on GET /notification?msgtype=TYPE&text=TEXT.

    This will pop up an OpenSecurity notifcation window

    """

    def GET(self):

        # pick the arguments

        args = web.input()

        # we _need_ a type

        if not "msgtype" in args:

            raise web.badrequest('no msgtype given')

        if not args.msgtype in Notification.TYPES:

            raise web.badrequest('Unknown value for msgtype')

        # we _need_ a text

        if not "text" in args:

            raise web.badrequest('no text given')

        # invoke the user dialog as a subprocess

        dlg_image = os.path.join(sys.path[0], 'opensecurity_dialog.py')

        process_command = [sys.executable, dlg_image, 'notification-' + args.msgtype, args.text]

        process = subprocess.Popen(process_command, shell = False, stdout = subprocess.PIPE)

        return "Ok"

class os_password:

    """OpenSecurity '/password' handler.

    This is called on GET /password?text=TEXT.

    Ideally this should pop up a user dialog to insert his

    password based device name.

    """

    def GET(self):

        # pick the arguments

        args = web.input()

        # we _need_ a text

        if not "text" in args:

            raise web.badrequest('no text given')

        # remember remote ip

        remote_ip = web.ctx.environ['REMOTE_ADDR']

        # invoke the user dialog as a subprocess

        dlg_image = os.path.join(sys.path[0], 'opensecurity_dialog.py')

        process_command = [sys.executable, dlg_image, 'password', args.text]

        process = subprocess.Popen(process_command, shell = False, stdout = subprocess.PIPE)

        result = process.communicate()[0]

        if process.returncode != 0:

            return 'password request has been aborted.'

        # all ok, tell send request back appropriate destination

        # the returned value of the dialog is a jason object like

        # "{ 'password': 'THE_PASSWORD' }"

        # so we _could_ call eval(...) on this.

        #

        # However, anyone malicious enough _could_ encode a certain

        # "password" making some nasty things within that eval code. :(

        #

        # So this is plain old-school string hacking then ...

        try:

            password = result.split(':')[1].split("'")[1]

        except:

            raise web.internalerror('error in password parsing')

        url_addr = 'http://' + remote_ip + ':58080/password'

        url_data = urllib.urlencode({ 'password': password})

        req = urllib2.Request(url = url_addr + '?' + url_data)

        try:

            res = urllib2.urlopen(req)

        except:

            raise web.internalerror('failed to contact: ' + url_addr)

        return 'password told'

class os_root:

    """OpenSecurity '/' handler"""

    def GET(self):

        res = "OpenSecurity-Client RESTFul Server { \"version\": \"%s\" }" % __version__

        # add some sample links

        res = res + """

USAGE EXAMPLES:

Request a password: 

    (copy paste this into your browser's address field after the host:port)

    /password?text=Give+me+a+password+for+device+%22My+USB+Drive%22+(ID%3A+32090-AAA-X0)

    (eg.: http://127.0.0.1:8090/password?text=Give+me+a+password+for+device+%22My+USB+Drive%22+(ID%3A+32090-AAA-X0))

    NOTE: check yout taskbar, the dialog window may not pop up in front of your browser window.

Request a combination of user and password:

    (copy paste this into your browser's address field after the host:port)

    /credentials?text=Tell+the+NSA+which+credentials+to+use+in+order+to+avoid+hacking+noise+on+wire.

    (eg.: http://127.0.0.1:8090/credentials?text=Tell+the+NSA+which+credentials+to+use+in+order+to+avoid+hacking+noise+on+wire.)

    NOTE: check yout taskbar, the dialog window may not pop up in front of your browser window.

Start a Browser:

    (copy paste this into your browser's address field after the host:port)

    /application?vm=Debian+7&app=Browser

    (e.g. http://127.0.0.1:8090/application?vm=Debian+7&app=Browser)

        """

        return res

# start

if __name__ == "__main__":

    server = web.application(opensecurity_urls, globals())

    server.run()