#!/bin/env python

 # -*- coding: utf-8 -*-

 # ------------------------------------------------------------

 # opensecurity_client_restful_server

 # 

 # the OpenSecurity client RESTful server

 #

 # Autor: Oliver Maurhart, <oliver.maurhart@ait.ac.at>

 #

 # Copyright (C) 2013 AIT Austrian Institute of Technology

 # AIT Austrian Institute of Technology GmbH

 # Donau-City-Strasse 1 | 1220 Vienna | Austria

 # http://www.ait.ac.at

 #

 # This program is free software; you can redistribute it and/or

 # modify it under the terms of the GNU General Public License

 # as published by the Free Software Foundation version 2.

 # 

 # This program is distributed in the hope that it will be useful,

 # but WITHOUT ANY WARRANTY; without even the implied warranty of

 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 # GNU General Public License for more details.

 # 

 # You should have received a copy of the GNU General Public License

 # along with this program; if not, write to the Free Software

 # Foundation, Inc., 51 Franklin Street, Fifth Floor, 

 # Boston, MA  02110-1301, USA.

 # ------------------------------------------------------------

 # ------------------------------------------------------------

 # imports

 import os

 import os.path

 import subprocess

 import sys

 import urllib

 import urllib2

 import web

 # local

 from environment import Environment

 from notification import Notification

 import opensecurity_server

 # ------------------------------------------------------------

 # const

 __version__ = "0.2"

 """All the URLs we know mapping to class handler"""

 opensecurity_urls = (

     #'/application',             'os_application',

     '/credentials',             'os_credentials',

     '/notification',            'os_notification',

     '/password',                'os_password',

     '/',                        'os_root'

 )

 # ------------------------------------------------------------

 # code

 # class os_application:

 #

 # PRESUMLY DEAD CODE

 #

     # """OpenSecurity '/application' handler.

     # This is called on GET /application?vm=VM-ID&app=APP-ID

     # This tries to access the vm identified with the label VM-ID

     # and launched the application identified APP-ID

     # """

     # def GET(self):

         # # pick the arguments

         # args = web.input()

         # # we _need_ a vm

         # if not "vm" in args:

             # raise web.badrequest('no vm given')

         # # we _need_ a app

         # if not "command" in args:

             # raise web.badrequest('no app given')

         # # check if we do have valid vm

         # v = [v for v in vms if v['name'] == args.vm]

         # if len(v) == 0:

             # raise web.notfound('vm not found')

         # v = v[0]

         # # check if we do have a valid app

         # a = [a for a in apps if a['name'] == args.app]

         # if len(a) == 0:

             # raise web.notfound('app not found')

         # a = a[0]

         # # invoke launch with 

         # res = "starting: launch " + v['user'] + " " + v['ip'] + " " + a['command']

         # launch_image = os.path.join(sys.path[0], 'launch.py')

         # process_command = [sys.executable, launch_image, v['user'], v['ip'], a['command']]

         # process = subprocess.Popen(process_command, shell = False, stdout = subprocess.PIPE)

         # result = process.communicate()[0]

         # if process.returncode != 0:

             # return 'Launch of application aborted.'

         # return result

 class os_credentials:

     """OpenSecurity '/credentials' handler.

     This is called on GET /credentials?text=TEXT.

     Ideally this should pop up a user dialog to insert his

     credentials based the given TEXT.

     """

     def GET(self):

         # pick the arguments

         args = web.input()

         # we _need_ a text

         if not "text" in args:

             raise web.badrequest('no text given')

         # invoke the user dialog as a subprocess

         dlg_image = os.path.join(sys.path[0], 'opensecurity_dialog.py')

         process_command = [sys.executable, dlg_image, 'credentials', args.text]

         process = subprocess.Popen(process_command, shell = False, stdout = subprocess.PIPE)

         result = process.communicate()[0]

         if process.returncode != 0:

             return 'Credentials request has been aborted.'

         return result

 class os_notification:

     """OpenSecurity '/notification' handler.

     This is called on GET /notification?msgtype=TYPE&text=TEXT.

     This will pop up an OpenSecurity notifcation window

     """

     def GET(self):

         # pick the arguments

         args = web.input()

         # we _need_ a type

         if not "msgtype" in args:

             raise web.badrequest('no msgtype given')

         if not args.msgtype in Notification.TYPES:

             raise web.badrequest('Unknown value for msgtype')

         # we _need_ a text

         if not "text" in args:

             raise web.badrequest('no text given')

         # invoke the user dialog as a subprocess

         dlg_image = os.path.join(sys.path[0], 'opensecurity_dialog.py')

         process_command = [sys.executable, dlg_image, 'notification-' + args.msgtype, args.text]

         process = subprocess.Popen(process_command, shell = False, stdout = subprocess.PIPE)

         return "Ok"

 class os_password:

     """OpenSecurity '/password' handler.

     This is called on GET /password?text=TEXT.

     Ideally this should pop up a user dialog to insert his

     password based device name.

     """

     def GET(self):

         # pick the arguments

         args = web.input()

         # we _need_ a text

         if not "text" in args:

             raise web.badrequest('no text given')

         # remember remote ip

         remote_ip = web.ctx.environ['REMOTE_ADDR']

         # invoke the user dialog as a subprocess

         dlg_image = os.path.join(sys.path[0], 'opensecurity_dialog.py')

         process_command = [sys.executable, dlg_image, 'password', args.text]

         process = subprocess.Popen(process_command, shell = False, stdout = subprocess.PIPE)

         result = process.communicate()[0]

         if process.returncode != 0:

             return 'password request has been aborted.'

         # all ok, tell send request back appropriate destination

         # the returned value of the dialog is a jason object like

         # "{ 'password': 'THE_PASSWORD' }"

         # so we _could_ call eval(...) on this.

         #

         # However, anyone malicious enough _could_ encode a certain

         # "password" making some nasty things within that eval code. :(

         #

         # So this is plain old-school string hacking then ...

         try:

             password = result.split(':')[1].split("'")[1]

         except:

             raise web.internalerror('error in password parsing')

         url_addr = 'http://' + remote_ip + ':58080/password'

         url_data = urllib.urlencode({ 'password': password})

         req = urllib2.Request(url = url_addr + '?' + url_data)

         try:

             res = urllib2.urlopen(req)

         except:

             raise web.internalerror('failed to contact: ' + url_addr)

         return 'password told'

 class os_root:

     """OpenSecurity '/' handler"""

     def GET(self):

         res = "OpenSecurity-Client RESTFul Server { \"version\": \"%s\" }" % __version__

         # add some sample links

         res = res + """

 USAGE EXAMPLES:

 Request a password: 

     (copy paste this into your browser's address field after the host:port)

     /password?text=Give+me+a+password+for+device+%22My+USB+Drive%22+(ID%3A+32090-AAA-X0)

     (eg.: http://127.0.0.1:8090/password?text=Give+me+a+password+for+device+%22My+USB+Drive%22+(ID%3A+32090-AAA-X0))

     NOTE: check yout taskbar, the dialog window may not pop up in front of your browser window.

 Request a combination of user and password:

     (copy paste this into your browser's address field after the host:port)

     /credentials?text=Tell+the+NSA+which+credentials+to+use+in+order+to+avoid+hacking+noise+on+wire.

     (eg.: http://127.0.0.1:8090/credentials?text=Tell+the+NSA+which+credentials+to+use+in+order+to+avoid+hacking+noise+on+wire.)

     NOTE: check yout taskbar, the dialog window may not pop up in front of your browser window.

 Start a Browser:

     (copy paste this into your browser's address field after the host:port)

     /application?vm=Debian+7&app=Browser

     (e.g. http://127.0.0.1:8090/application?vm=Debian+7&app=Browser)

         """

         return res

 # start

 if __name__ == "__main__":

     server = web.application(opensecurity_urls, globals())

     server.run()