root / flowspec / views.py @ 3d81901c
History | View | Annotate | Download (19.1 kB)
1 |
# Create your views here.
|
---|---|
2 |
import urllib2 |
3 |
import socket |
4 |
import json |
5 |
from django import forms |
6 |
from django.views.decorators.csrf import csrf_exempt |
7 |
from django.core import urlresolvers |
8 |
from django.core import serializers |
9 |
from django.contrib.auth.decorators import login_required |
10 |
from django.contrib.auth import logout |
11 |
from django.contrib.sites.models import Site |
12 |
from django.contrib.auth.models import User |
13 |
from django.http import HttpResponseRedirect, HttpResponseForbidden, HttpResponse |
14 |
from django.shortcuts import get_object_or_404, render_to_response |
15 |
from django.core.context_processors import request |
16 |
from django.template.context import RequestContext |
17 |
from django.template.loader import get_template, render_to_string |
18 |
from django.core.urlresolvers import reverse |
19 |
from django.contrib import messages |
20 |
from flowspy.accounts.models import * |
21 |
from ipaddr import * |
22 |
|
23 |
from django.contrib.auth import authenticate, login |
24 |
|
25 |
from django.forms.models import model_to_dict |
26 |
|
27 |
from flowspy.flowspec.forms import * |
28 |
from flowspy.flowspec.models import * |
29 |
from flowspy.peers.models import * |
30 |
|
31 |
from registration.models import RegistrationProfile |
32 |
|
33 |
from copy import deepcopy |
34 |
from flowspy.utils.decorators import shib_required |
35 |
|
36 |
from django.views.decorators.cache import never_cache |
37 |
from django.conf import settings |
38 |
from django.core.mail.message import EmailMessage |
39 |
import datetime |
40 |
import os |
41 |
|
42 |
LOG_FILENAME = os.path.join(settings.LOG_FILE_LOCATION, 'celery_jobs.log')
|
43 |
#FORMAT = '%(asctime)s %(levelname)s: %(message)s'
|
44 |
#logging.basicConfig(format=FORMAT)
|
45 |
formatter = logging.Formatter('%(asctime)s %(levelname)s %(clientip)s %(user)s: %(message)s')
|
46 |
|
47 |
logger = logging.getLogger(__name__) |
48 |
logger.setLevel(logging.DEBUG) |
49 |
handler = logging.FileHandler(LOG_FILENAME) |
50 |
handler.setFormatter(formatter) |
51 |
logger.addHandler(handler) |
52 |
|
53 |
@login_required
|
54 |
def user_routes(request): |
55 |
user_routes = Route.objects.filter(applier=request.user) |
56 |
return render_to_response('user_routes.html', {'routes': user_routes}, |
57 |
context_instance=RequestContext(request)) |
58 |
|
59 |
def welcome(request): |
60 |
return render_to_response('welcome.html', context_instance=RequestContext(request)) |
61 |
|
62 |
@login_required
|
63 |
@never_cache
|
64 |
def group_routes(request): |
65 |
group_routes = [] |
66 |
try:
|
67 |
peer = request.user.get_profile().peer |
68 |
except UserProfile.DoesNotExist:
|
69 |
error = "User <strong>%s</strong> does not belong to any peer or organization. It is not possible to create new firewall rules.<br>Please contact Helpdesk to resolve this issue" % request.user.username
|
70 |
return render_to_response('error.html', {'error': error}) |
71 |
if peer:
|
72 |
peer_members = UserProfile.objects.filter(peer=peer) |
73 |
users = [prof.user for prof in peer_members] |
74 |
group_routes = Route.objects.filter(applier__in=users) |
75 |
return render_to_response('user_routes.html', {'routes': group_routes}, |
76 |
context_instance=RequestContext(request)) |
77 |
|
78 |
|
79 |
@login_required
|
80 |
@never_cache
|
81 |
def add_route(request): |
82 |
applier = request.user.pk |
83 |
applier_peer_networks = request.user.get_profile().peer.networks.all() |
84 |
if not applier_peer_networks: |
85 |
messages.add_message(request, messages.WARNING, |
86 |
"Insufficient rights on administrative networks. Cannot add rule. Contact your administrator")
|
87 |
return HttpResponseRedirect(reverse("group-routes")) |
88 |
if request.method == "GET": |
89 |
form = RouteForm() |
90 |
if not request.user.is_superuser: |
91 |
form.fields['then'] = forms.ModelMultipleChoiceField(queryset=ThenAction.objects.filter(action__in=settings.UI_USER_THEN_ACTIONS).order_by('action'), required=True) |
92 |
form.fields['protocol'] = forms.ModelMultipleChoiceField(queryset=MatchProtocol.objects.filter(protocol__in=settings.UI_USER_PROTOCOLS).order_by('protocol'), required=False) |
93 |
return render_to_response('apply.html', {'form': form, 'applier': applier}, |
94 |
context_instance=RequestContext(request)) |
95 |
|
96 |
else:
|
97 |
form = RouteForm(request.POST) |
98 |
if form.is_valid():
|
99 |
route=form.save(commit=False)
|
100 |
route.applier = request.user |
101 |
route.status = "PENDING"
|
102 |
route.source = IPNetwork("%s/%s" %(IPNetwork(route.source).network.compressed, IPNetwork(route.source).prefixlen)).compressed
|
103 |
route.destination = IPNetwork("%s/%s" %(IPNetwork(route.destination).network.compressed, IPNetwork(route.destination).prefixlen)).compressed
|
104 |
route.save() |
105 |
form.save_m2m() |
106 |
route.commit_add() |
107 |
requesters_address = request.META['HTTP_X_FORWARDED_FOR']
|
108 |
mail_body = render_to_string("rule_add_mail.txt",
|
109 |
{"route": route, "address": requesters_address}) |
110 |
user_mail = "%s" %route.applier.email
|
111 |
user_mail = user_mail.split(';')
|
112 |
send_new_mail(settings.EMAIL_SUBJECT_PREFIX + "Rule %s creation request submitted by %s" %(route.name, route.applier.username),
|
113 |
mail_body, settings.SERVER_EMAIL, user_mail, |
114 |
get_peer_techc_mails(route.applier)) |
115 |
d = { 'clientip' : "%s"%requesters_address, 'user' : route.applier.username } |
116 |
logger.info(mail_body, extra=d) |
117 |
return HttpResponseRedirect(reverse("group-routes")) |
118 |
else:
|
119 |
return render_to_response('apply.html', {'form': form, 'applier':applier}, |
120 |
context_instance=RequestContext(request)) |
121 |
|
122 |
@login_required
|
123 |
@never_cache
|
124 |
def edit_route(request, route_slug): |
125 |
applier = request.user.pk |
126 |
applier_peer = request.user.get_profile().peer |
127 |
route_edit = get_object_or_404(Route, name=route_slug) |
128 |
route_edit_applier_peer = route_edit.applier.get_profile().peer |
129 |
if applier_peer != route_edit_applier_peer:
|
130 |
messages.add_message(request, messages.WARNING, |
131 |
"Insufficient rights to edit rule %s" %(route_slug))
|
132 |
return HttpResponseRedirect(reverse("group-routes")) |
133 |
# if route_edit.status == "ADMININACTIVE" :
|
134 |
# messages.add_message(request, messages.WARNING,
|
135 |
# "Administrator has disabled editing of rule %s" %(route_slug))
|
136 |
# return HttpResponseRedirect(reverse("group-routes"))
|
137 |
# if route_edit.status == "EXPIRED" :
|
138 |
# messages.add_message(request, messages.WARNING,
|
139 |
# "Cannot edit the expired rule %s. Contact helpdesk to enable it" %(route_slug))
|
140 |
# return HttpResponseRedirect(reverse("group-routes"))
|
141 |
if route_edit.status == "PENDING" : |
142 |
messages.add_message(request, messages.WARNING, |
143 |
"Cannot edit a pending rule: %s." %(route_slug))
|
144 |
return HttpResponseRedirect(reverse("group-routes")) |
145 |
route_original = deepcopy(route_edit) |
146 |
if request.POST:
|
147 |
form = RouteForm(request.POST, instance = route_edit) |
148 |
critical_changed_values = ['source', 'destination', 'sourceport', 'destinationport', 'port', 'protocol', 'then'] |
149 |
if form.is_valid():
|
150 |
changed_data = form.changed_data |
151 |
route=form.save(commit=False)
|
152 |
route.name = route_original.name |
153 |
route.status = route_original.status |
154 |
route.response = route_original.response |
155 |
route.applier = request.user |
156 |
if bool(set(changed_data) & set(critical_changed_values)) or (not route_original.status == 'ACTIVE'): |
157 |
route.status = "PENDING"
|
158 |
route.response = "Committing..."
|
159 |
route.source = IPNetwork("%s/%s" %(IPNetwork(route.source).network.compressed, IPNetwork(route.source).prefixlen)).compressed
|
160 |
route.destination = IPNetwork("%s/%s" %(IPNetwork(route.destination).network.compressed, IPNetwork(route.destination).prefixlen)).compressed
|
161 |
route.save() |
162 |
if bool(set(changed_data) & set(critical_changed_values)) or (not route_original.status == 'ACTIVE'): |
163 |
form.save_m2m() |
164 |
route.commit_edit() |
165 |
requesters_address = request.META['HTTP_X_FORWARDED_FOR']
|
166 |
mail_body = render_to_string("rule_edit_mail.txt",
|
167 |
{"route": route, "address": requesters_address}) |
168 |
user_mail = "%s" %route.applier.email
|
169 |
user_mail = user_mail.split(';')
|
170 |
send_new_mail(settings.EMAIL_SUBJECT_PREFIX + "Rule %s edit request submitted by %s" %(route.name, route.applier.username),
|
171 |
mail_body, settings.SERVER_EMAIL, user_mail, |
172 |
get_peer_techc_mails(route.applier)) |
173 |
d = { 'clientip' : requesters_address, 'user' : route.applier.username } |
174 |
logger.info(mail_body, extra=d) |
175 |
return HttpResponseRedirect(reverse("group-routes")) |
176 |
else:
|
177 |
return render_to_response('apply.html', {'form': form, 'edit':True, 'applier': applier}, |
178 |
context_instance=RequestContext(request)) |
179 |
else:
|
180 |
dictionary = model_to_dict(route_edit, fields=[], exclude=[]) |
181 |
#form = RouteForm(instance=route_edit)
|
182 |
form = RouteForm(dictionary) |
183 |
if not request.user.is_superuser: |
184 |
form.fields['then'] = forms.ModelMultipleChoiceField(queryset=ThenAction.objects.filter(action__in=settings.UI_USER_THEN_ACTIONS).order_by('action'), required=True) |
185 |
form.fields['protocol'] = forms.ModelMultipleChoiceField(queryset=MatchProtocol.objects.filter(protocol__in=settings.UI_USER_PROTOCOLS).order_by('protocol'), required=False) |
186 |
return render_to_response('apply.html', {'form': form, 'edit':True, 'applier': applier}, |
187 |
context_instance=RequestContext(request)) |
188 |
|
189 |
@login_required
|
190 |
@never_cache
|
191 |
def delete_route(request, route_slug): |
192 |
if request.is_ajax():
|
193 |
route = get_object_or_404(Route, name=route_slug) |
194 |
applier_peer = route.applier.get_profile().peer |
195 |
requester_peer = request.user.get_profile().peer |
196 |
if applier_peer == requester_peer:
|
197 |
route.status = "PENDING"
|
198 |
route.expires = datetime.date.today() |
199 |
route.applier = request.user |
200 |
route.response = "Suspending..."
|
201 |
route.save() |
202 |
route.commit_delete() |
203 |
requesters_address = request.META['HTTP_X_FORWARDED_FOR']
|
204 |
mail_body = render_to_string("rule_delete_mail.txt",
|
205 |
{"route": route, "address": requesters_address}) |
206 |
user_mail = "%s" %route.applier.email
|
207 |
user_mail = user_mail.split(';')
|
208 |
send_new_mail(settings.EMAIL_SUBJECT_PREFIX + "Rule %s removal request submitted by %s" %(route.name, route.applier.username),
|
209 |
mail_body, settings.SERVER_EMAIL, user_mail, |
210 |
get_peer_techc_mails(route.applier)) |
211 |
d = { 'clientip' : requesters_address, 'user' : route.applier.username } |
212 |
logger.info(mail_body, extra=d) |
213 |
html = "<html><body>Done</body></html>"
|
214 |
return HttpResponse(html)
|
215 |
else:
|
216 |
return HttpResponseRedirect(reverse("group-routes")) |
217 |
|
218 |
@login_required
|
219 |
@never_cache
|
220 |
def user_profile(request): |
221 |
user = request.user |
222 |
try:
|
223 |
peer = request.user.get_profile().peer |
224 |
peers = Peer.objects.filter(pk=peer.pk) |
225 |
if user.is_superuser:
|
226 |
peers = Peer.objects.all() |
227 |
except UserProfile.DoesNotExist:
|
228 |
error = "User <strong>%s</strong> does not belong to any peer or organization. It is not possible to create new firewall rules.<br>Please contact Helpdesk to resolve this issue" % user.username
|
229 |
return render_to_response('error.html', {'error': error}) |
230 |
return render_to_response('profile.html', {'user': user, 'peers':peers}, |
231 |
context_instance=RequestContext(request)) |
232 |
|
233 |
@never_cache
|
234 |
def user_login(request): |
235 |
try:
|
236 |
error_username = False
|
237 |
error_orgname = False
|
238 |
error_entitlement = False
|
239 |
error_mail = False
|
240 |
has_entitlement = False
|
241 |
error = ''
|
242 |
username = request.META['HTTP_EPPN']
|
243 |
if not username: |
244 |
error_username = True
|
245 |
firstname = request.META['HTTP_SHIB_INETORGPERSON_GIVENNAME']
|
246 |
lastname = request.META['HTTP_SHIB_PERSON_SURNAME']
|
247 |
mail = request.META['HTTP_SHIB_INETORGPERSON_MAIL']
|
248 |
organization = request.META['HTTP_SHIB_HOMEORGANIZATION']
|
249 |
entitlement = request.META['HTTP_SHIB_EP_ENTITLEMENT']
|
250 |
if settings.SHIB_AUTH_ENTITLEMENT in entitlement.split(";"): |
251 |
has_entitlement = True
|
252 |
if not has_entitlement: |
253 |
error_entitlement = True
|
254 |
if not organization: |
255 |
error_orgname = True
|
256 |
if not mail: |
257 |
error_mail = True
|
258 |
if error_username:
|
259 |
error = "Your idP should release the HTTP_EPPN attribute towards this service<br>"
|
260 |
if error_orgname:
|
261 |
error = error + "Your idP should release the HTTP_SHIB_HOMEORGANIZATION attribute towards this service<br>"
|
262 |
if error_entitlement:
|
263 |
error = error + "Your idP should release an appropriate HTTP_SHIB_EP_ENTITLEMENT attribute towards this service<br>"
|
264 |
if error_mail:
|
265 |
error = error + "Your idP should release the HTTP_SHIB_INETORGPERSON_MAIL attribute towards this service"
|
266 |
if error_username or error_orgname or error_entitlement or error_mail: |
267 |
return render_to_response('error.html', {'error': error, "missing_attributes": True}, |
268 |
context_instance=RequestContext(request)) |
269 |
try:
|
270 |
user = User.objects.get(username__exact=username) |
271 |
user.email = mail |
272 |
user.first_name = firstname |
273 |
user.last_name = lastname |
274 |
user.save() |
275 |
user_exists = True
|
276 |
except:
|
277 |
user_exists = False
|
278 |
user = authenticate(username=username, firstname=firstname, lastname=lastname, mail=mail, authsource='shibboleth')
|
279 |
if user is not None: |
280 |
try:
|
281 |
peer = Peer.objects.get(domain_name=organization) |
282 |
up = UserProfile.objects.get_or_create(user=user,peer=peer) |
283 |
except:
|
284 |
error = "Your organization's domain name does not match our peers' domain names<br>Please contact Helpdesk to resolve this issue"
|
285 |
return render_to_response('error.html', {'error': error}) |
286 |
if not user_exists: |
287 |
user_activation_notify(user) |
288 |
if user.is_active:
|
289 |
login(request, user) |
290 |
return HttpResponseRedirect(reverse("group-routes")) |
291 |
else:
|
292 |
error = "User account <strong>%s</strong> is pending activation. Administrators have been notified and will activate this account within the next days. <br>If this account has remained inactive for a long time contact your technical coordinator or GRNET Helpdesk" %user.username
|
293 |
return render_to_response('error.html', {'error': error, 'inactive': True}, |
294 |
context_instance=RequestContext(request)) |
295 |
else:
|
296 |
error = "Something went wrong during user authentication. Contact your administrator"
|
297 |
return render_to_response('error.html', {'error': error,}, |
298 |
context_instance=RequestContext(request)) |
299 |
except Exception: |
300 |
error = "Invalid login procedure"
|
301 |
return render_to_response('error.html', {'error': error,}, |
302 |
context_instance=RequestContext(request)) |
303 |
# Return an 'invalid login' error message.
|
304 |
# return HttpResponseRedirect(reverse("user-routes"))
|
305 |
|
306 |
def user_activation_notify(user): |
307 |
current_site = Site.objects.get_current() |
308 |
subject = render_to_string('registration/activation_email_subject.txt',
|
309 |
{ 'site': current_site })
|
310 |
# Email subject *must not* contain newlines
|
311 |
subject = ''.join(subject.splitlines())
|
312 |
registration_profile = RegistrationProfile.objects.create_profile(user) |
313 |
message = render_to_string('registration/activation_email.txt',
|
314 |
{ 'activation_key': registration_profile.activation_key,
|
315 |
'expiration_days': settings.ACCOUNT_ACTIVATION_DAYS,
|
316 |
'site': current_site,
|
317 |
'user': user })
|
318 |
send_new_mail(settings.EMAIL_SUBJECT_PREFIX + subject, |
319 |
message, settings.SERVER_EMAIL, |
320 |
get_peer_techc_mails(user), []) |
321 |
|
322 |
@login_required
|
323 |
@never_cache
|
324 |
def add_rate_limit(request): |
325 |
if request.method == "GET": |
326 |
form = ThenPlainForm() |
327 |
return render_to_response('add_rate_limit.html', {'form': form,}, |
328 |
context_instance=RequestContext(request)) |
329 |
|
330 |
else:
|
331 |
form = ThenPlainForm(request.POST) |
332 |
if form.is_valid():
|
333 |
then=form.save(commit=False)
|
334 |
then.action_value = "%sk"%then.action_value
|
335 |
then.save() |
336 |
response_data = {} |
337 |
response_data['pk'] = "%s" %then.pk |
338 |
response_data['value'] = "%s:%s" %(then.action, then.action_value) |
339 |
return HttpResponse(json.dumps(response_data), mimetype='application/json') |
340 |
else:
|
341 |
return render_to_response('add_rate_limit.html', {'form': form,}, |
342 |
context_instance=RequestContext(request)) |
343 |
|
344 |
@login_required
|
345 |
@never_cache
|
346 |
def add_port(request): |
347 |
if request.method == "GET": |
348 |
form = PortPlainForm() |
349 |
return render_to_response('add_port.html', {'form': form,}, |
350 |
context_instance=RequestContext(request)) |
351 |
|
352 |
else:
|
353 |
form = PortPlainForm(request.POST) |
354 |
if form.is_valid():
|
355 |
port=form.save() |
356 |
response_data = {} |
357 |
response_data['value'] = "%s" %port.pk |
358 |
response_data['text'] = "%s" %port.port |
359 |
return HttpResponse(json.dumps(response_data), mimetype='application/json') |
360 |
else:
|
361 |
return render_to_response('add_port.html', {'form': form,}, |
362 |
context_instance=RequestContext(request)) |
363 |
|
364 |
@login_required
|
365 |
@never_cache
|
366 |
def user_logout(request): |
367 |
logout(request) |
368 |
return HttpResponseRedirect(reverse('group-routes')) |
369 |
|
370 |
@never_cache
|
371 |
def load_jscript(request, file): |
372 |
long_polling_timeout = int(settings.POLL_SESSION_UPDATE)*1000 + 10000 |
373 |
return render_to_response('%s.js' % file, {'timeout': long_polling_timeout}, context_instance=RequestContext(request), mimetype="text/javascript") |
374 |
|
375 |
|
376 |
def get_peer_techc_mails(user): |
377 |
mail = [] |
378 |
additional_mail = [] |
379 |
techmails_list = [] |
380 |
user_mail = "%s" %user.email
|
381 |
user_mail = user_mail.split(';')
|
382 |
techmails = user.get_profile().peer.techc_emails.all() |
383 |
if techmails:
|
384 |
for techmail in techmails: |
385 |
techmails_list.append(techmail.email) |
386 |
if settings.NOTIFY_ADMIN_MAILS:
|
387 |
additional_mail = settings.NOTIFY_ADMIN_MAILS |
388 |
# mail.extend(user_mail)
|
389 |
mail.extend(additional_mail) |
390 |
mail.extend(techmails_list) |
391 |
return mail
|
392 |
|
393 |
|
394 |
def send_new_mail(subject, message, from_email, recipient_list, bcc_list): |
395 |
return EmailMessage(subject, message, from_email, recipient_list, bcc_list).send()
|
396 |
|