From 6dc7473ab05d14d8c3e7a62a1d2b60600c7f7cc7 Mon Sep 17 00:00:00 2001
From: Valentin Samir <valentin.samir@crans.org>
Date: Sun, 8 May 2016 16:12:50 +0200
Subject: [PATCH] Use JSON Web Signature and Encryption (JWS & JWE) between
 webvirtcloud and gstfsd

---
 computes/forms.py                             | 11 ++++
 .../migrations/0002_compute_gstfsd_key.py     | 19 +++++++
 computes/models.py                            |  1 +
 computes/templates/computes.html              | 24 ++++++++
 computes/templates/create_comp_block.html     | 24 ++++++++
 computes/views.py                             | 16 ++++--
 conf/daemon/gstfsd                            | 45 ++++++++++++---
 conf/requirements.txt                         |  1 +
 instances/views.py                            | 55 +++++++++++++------
 9 files changed, 166 insertions(+), 30 deletions(-)
 create mode 100644 computes/migrations/0002_compute_gstfsd_key.py

diff --git a/computes/forms.py b/computes/forms.py
index a626106..e08210f 100644
--- a/computes/forms.py
+++ b/computes/forms.py
@@ -13,6 +13,8 @@ class ComputeAddTcpForm(forms.Form):
                             max_length=100)
     password = forms.CharField(error_messages={'required': _('No password has been entered')},
                                max_length=100)
+    gstfsd_key = forms.CharField(max_length=256, required=False)
+
 
     def clean_name(self):
         name = self.cleaned_data['name']
@@ -49,6 +51,8 @@ class ComputeAddSshForm(forms.Form):
                                max_length=100)
     login = forms.CharField(error_messages={'required': _('No login has been entered')},
                             max_length=20)
+    gstfsd_key = forms.CharField(max_length=256, required=False)
+
 
     def clean_name(self):
         name = self.cleaned_data['name']
@@ -87,6 +91,8 @@ class ComputeAddTlsForm(forms.Form):
                             max_length=100)
     password = forms.CharField(error_messages={'required': _('No password has been entered')},
                                max_length=100)
+    gstfsd_key = forms.CharField(max_length=256, required=False)
+
 
     def clean_name(self):
         name = self.cleaned_data['name']
@@ -126,6 +132,8 @@ class ComputeEditHostForm(forms.Form):
                             max_length=100)
     password = forms.CharField(max_length=100)
 
+    gstfsd_key = forms.CharField(max_length=256, required=False)
+
     def clean_name(self):
         name = self.cleaned_data['name']
         have_symbol = re.match('[^a-zA-Z0-9._-]+', name)
@@ -150,6 +158,9 @@ class ComputeAddSocketForm(forms.Form):
     name = forms.CharField(error_messages={'required': _('No hostname has been entered')},
                            max_length=20)
 
+    gstfsd_key = forms.CharField(max_length=256, required=False)
+
+
     def clean_name(self):
         name = self.cleaned_data['name']
         have_symbol = re.match('[^a-zA-Z0-9._-]+', name)
diff --git a/computes/migrations/0002_compute_gstfsd_key.py b/computes/migrations/0002_compute_gstfsd_key.py
new file mode 100644
index 0000000..f1c4deb
--- /dev/null
+++ b/computes/migrations/0002_compute_gstfsd_key.py
@@ -0,0 +1,19 @@
+# -*- coding: utf-8 -*-
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('computes', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='compute',
+            name='gstfsd_key',
+            field=models.CharField(max_length=256, null=True, blank=True),
+        ),
+    ]
diff --git a/computes/models.py b/computes/models.py
index 6ee7de8..553f037 100644
--- a/computes/models.py
+++ b/computes/models.py
@@ -7,6 +7,7 @@ class Compute(models.Model):
     login = models.CharField(max_length=20)
     password = models.CharField(max_length=14, blank=True, null=True)
     type = models.IntegerField()
+    gstfsd_key = models.CharField(max_length=256, blank=True, null=True)
 
     def __unicode__(self):
         return self.hostname
diff --git a/computes/templates/computes.html b/computes/templates/computes.html
index 7c1c28f..70fec70 100644
--- a/computes/templates/computes.html
+++ b/computes/templates/computes.html
@@ -84,6 +84,12 @@
                                                                     <input type="password" name="password" class="form-control" value="{{ compute.password }}">
                                                                 </div>
                                                             </div>
+                                                            <div class="form-group">
+                                                                <label class="col-sm-4 control-label">{% trans "Gstfsd key" %}</label>
+                                                                <div class="col-sm-6">
+                                                                    <input type="text" name="gstfsd_key" class="form-control" value="{{ compute.gstfsd_key }}" maxlength="256">
+                                                                </div>
+                                                            </div>
                                                     </div>
                                                     <div class="modal-footer">
                                                         <button type="submit" class="pull-left btn btn-danger" name="host_del">
@@ -121,6 +127,12 @@
                                                                     <input type="text" name="login" class="form-control" value="{{ compute.login }}">
                                                                 </div>
                                                             </div>
+                                                            <div class="form-group">
+                                                                <label class="col-sm-4 control-label">{% trans "Gstfsd key" %}</label>
+                                                                <div class="col-sm-6">
+                                                                    <input type="text" name="gstfsd_key" class="form-control" value="{{ compute.gstfsd_key }}" maxlength="256">
+                                                                </div>
+                                                            </div>
                                                     </div>
                                                     <div class="modal-footer">
                                                         <button type="submit" class="pull-left btn btn-danger" name="host_del">
@@ -163,6 +175,12 @@
                                                                     <input type="password" name="password" class="form-control" value="{{ compute.password }}">
                                                                 </div>
                                                             </div>
+                                                            <div class="form-group">
+                                                                <label class="col-sm-4 control-label">{% trans "Gstfsd key" %}</label>
+                                                                <div class="col-sm-6">
+                                                                    <input type="text" name="gstfsd_key" class="form-control" value="{{ compute.gstfsd_key }}" maxlength="256">
+                                                                </div>
+                                                            </div>
                                                     </div>
                                                     <div class="modal-footer">
                                                         <button type="submit" class="pull-left btn btn-danger" name="host_del">
@@ -187,6 +205,12 @@
                                                                     <input type="text" name="name" class="form-control" value="{{ compute.name }}" maxlength="20" required pattern="[a-z0-9\.\-_]+">
                                                                 </div>
                                                             </div>
+                                                            <div class="form-group">
+                                                                <label class="col-sm-4 control-label">{% trans "Gstfsd key" %}</label>
+                                                                <div class="col-sm-6">
+                                                                    <input type="text" name="gstfsd_key" class="form-control" value="{{ compute.gstfsd_key }}" maxlength="256">
+                                                                </div>
+                                                            </div>
                                                     </div>
                                                     <div class="modal-footer">
                                                         <button type="submit" class="pull-left btn btn-danger" name="host_del">
diff --git a/computes/templates/create_comp_block.html b/computes/templates/create_comp_block.html
index 57e327a..d6d5c75 100644
--- a/computes/templates/create_comp_block.html
+++ b/computes/templates/create_comp_block.html
@@ -50,6 +50,12 @@
                                         <input type="password" name="password" class="form-control" placeholder="{% trans "Password" %}">
                                     </div>
                                 </div>
+                                <div class="form-group">
+                                    <label class="col-sm-4 control-label">{% trans "Gstfsd key" %}</label>
+                                    <div class="col-sm-6">
+                                        <input type="text" name="gstfsd_key" placeholder="Gstfsd JSON Web Key" class="form-control" value="{{ compute.gstfsd_key }}" maxlength="256">
+                                    </div>
+                                </div>
                         </div>
                         <div class="modal-footer">
                             <button type="button" class="btn btn-default" data-dismiss="modal">
@@ -83,6 +89,12 @@
                                         <input type="text" name="login" class="form-control" placeholder="{% trans "Username" %}">
                                     </div>
                                 </div>
+                                <div class="form-group">
+                                    <label class="col-sm-4 control-label">{% trans "Gstfsd key" %}</label>
+                                    <div class="col-sm-6">
+                                        <input type="text" name="gstfsd_key" placeholder="Gstfsd JSON Web Key" class="form-control" value="{{ compute.gstfsd_key }}" maxlength="256">
+                                    </div>
+                                </div>
                         </div>
                         <div class="modal-footer">
                             <button type="button" class="btn btn-default" data-dismiss="modal">
@@ -121,6 +133,12 @@
                                         <input type="password" name="password" class="form-control" placeholder="{% trans "Password" %}">
                                     </div>
                                 </div>
+                                <div class="form-group">
+                                    <label class="col-sm-4 control-label">{% trans "Gstfsd key" %}</label>
+                                    <div class="col-sm-6">
+                                        <input type="text" name="gstfsd_key" placeholder="Gstfsd JSON Web Key" class="form-control" value="{{ compute.gstfsd_key }}" maxlength="256">
+                                    </div>
+                                </div>
                         </div>
                         <div class="modal-footer">
                             <button type="button" class="btn btn-default" data-dismiss="modal">
@@ -141,6 +159,12 @@
                                         <input type="text" name="name" class="form-control" placeholder="Label Name" maxlength="20" required pattern="[a-z0-9\.\-_]+">
                                     </div>
                                 </div>
+                                <div class="form-group">
+                                    <label class="col-sm-4 control-label">{% trans "Gstfsd key" %}</label>
+                                    <div class="col-sm-6">
+                                        <input type="text" name="gstfsd_key" placeholder="Gstfsd JSON Web Key" class="form-control" value="{{ compute.gstfsd_key }}" maxlength="256">
+                                    </div>
+                                </div>
                         </div>
                         <div class="modal-footer">
                             <button type="button" class="btn btn-default" data-dismiss="modal">
diff --git a/computes/views.py b/computes/views.py
index 39af4d0..544282a 100644
--- a/computes/views.py
+++ b/computes/views.py
@@ -36,7 +36,8 @@ def computes(request):
                                  'status': connection_manager.host_is_up(compute.type, compute.hostname),
                                  'type': compute.type,
                                  'login': compute.login,
-                                 'password': compute.password
+                                 'password': compute.password,
+                                 'gstfsd_key': compute.gstfsd_key
                                  })
         return compute_data
 
@@ -66,7 +67,8 @@ def computes(request):
                                        hostname=data['hostname'],
                                        type=CONN_TCP,
                                        login=data['login'],
-                                       password=data['password'])
+                                       password=data['password'],
+                                       gstfsd_key=data['gstfsd_key'])
                 new_tcp_host.save()
                 return HttpResponseRedirect(request.get_full_path())
             else:
@@ -79,7 +81,8 @@ def computes(request):
                 new_ssh_host = Compute(name=data['name'],
                                        hostname=data['hostname'],
                                        type=CONN_SSH,
-                                       login=data['login'])
+                                       login=data['login'],
+                                       gstfsd_key=data['gstfsd_key'])
                 new_ssh_host.save()
                 return HttpResponseRedirect(request.get_full_path())
             else:
@@ -93,7 +96,8 @@ def computes(request):
                                        hostname=data['hostname'],
                                        type=CONN_TLS,
                                        login=data['login'],
-                                       password=data['password'])
+                                       password=data['password'],
+                                       gstfsd_key=data['gstfsd_key'])
                 new_tls_host.save()
                 return HttpResponseRedirect(request.get_full_path())
             else:
@@ -107,7 +111,8 @@ def computes(request):
                                           hostname='localhost',
                                           type=CONN_SOCKET,
                                           login='',
-                                          password='')
+                                          password='',
+                                          gstfsd_key=data['gstfsd_key'])
                 new_socket_host.save()
                 return HttpResponseRedirect(request.get_full_path())
             else:
@@ -122,6 +127,7 @@ def computes(request):
                 compute_edit.hostname = data['hostname']
                 compute_edit.login = data['login']
                 compute_edit.password = data['password']
+                compute_edit.gstfsd_key = data['gstfsd_key']
                 compute_edit.save()
                 return HttpResponseRedirect(request.get_full_path())
             else:
diff --git a/conf/daemon/gstfsd b/conf/daemon/gstfsd
index 2e68312..d757328 100644
--- a/conf/daemon/gstfsd
+++ b/conf/daemon/gstfsd
@@ -7,10 +7,12 @@ import SocketServer
 import json
 import guestfs
 import re
-
+import os
+from jwcrypto import jws, jwk, jwe
 
 PORT = 16510
 ADDRESS = "0.0.0.0"
+SECRET = None
 
 
 class MyTCPServer(SocketServer.ThreadingTCPServer):
@@ -19,12 +21,20 @@ class MyTCPServer(SocketServer.ThreadingTCPServer):
 
 class MyTCPServerHandler(SocketServer.BaseRequestHandler):
     def handle(self):
-        # recive data
-        data = json.loads(self.request.recv(1024).strip())
-
-        # GuestFS
-        gfs = guestfs.GuestFS(python_return_dict=True)
+        # recive data and check authentcation
         try:
+            signed_data = jws.JWS()
+            signed_data.deserialize(self.request.recv(4096).strip())
+            signed_data.verify(SECRET, "HS512")
+
+            encrypted_data = jwe.JWE(algs=["A256KW", "A256CBC-HS512"])
+            encrypted_data.deserialize(signed_data.payload)
+            encrypted_data.decrypt(SECRET)
+
+            data = json.loads(encrypted_data.plaintext)
+
+            # GuestFS
+            gfs = guestfs.GuestFS(python_return_dict=True)
             gfs.add_domain(data['vname'])
             gfs.launch()
             parts = gfs.list_partitions()
@@ -51,8 +61,29 @@ class MyTCPServerHandler(SocketServer.BaseRequestHandler):
                     pass
             gfs.shutdown()
             gfs.close()
-        except RuntimeError, err:
+        # we check signature before trying to decrypt so jwe.InvalidJWEData should not be raised ever
+        except (jws.InvalidJWSObject, jwe.InvalidJWEData, RuntimeError, ValueError) as err:
             self.request.sendall(json.dumps({'return': 'error', 'message': err.message}))
 
+        except jws.InvalidJWSSignature as err:
+            self.request.sendall(json.dumps({'return': 'error', 'message': (
+                "Fail to verify request signature. Check if you have imported "
+                "the key (/var/lib/gstfsd/SECRET) in WebVirtCloud"
+            )}))
+
+if not os.path.isfile("/var/lib/gstfsd/SECRET"):
+    try:
+        os.mkdir("/var/lib/gstfsd")
+    except OSError as error:
+        if error.errno != 17: # File exists
+            raise
+    os.chmod("/var/lib/gstfsd", 0700)
+    with open("/var/lib/gstfsd/SECRET", 'w') as f:
+        f.write(jwk.JWK(generate='oct', size=256).export())
+    os.chmod("/var/lib/gstfsd/SECRET", 0600)
+
+with open("/var/lib/gstfsd/SECRET") as f:
+    SECRET = jwk.JWK(**json.load(f))
+
 server = MyTCPServer((ADDRESS, PORT), MyTCPServerHandler)
 server.serve_forever()
diff --git a/conf/requirements.txt b/conf/requirements.txt
index e01113b..03bbf3b 100644
--- a/conf/requirements.txt
+++ b/conf/requirements.txt
@@ -2,5 +2,6 @@ Django==1.8.11
 websockify==0.8.0
 gunicorn==19.3.0
 libvirt-python==1.3.2
+jwcrypto>=0.2.1
 #http://github.com/retspen/retspen.github.io/raw/master/libxml2-python-2.9.1.tar.gz
 http://git.gnome.org/browse/libxml2/snapshot/libxml2-2.9.1.tar.gz#egg=libxml2-python&subdirectory=python
diff --git a/instances/views.py b/instances/views.py
index 8d9afd9..d0b4773 100644
--- a/instances/views.py
+++ b/instances/views.py
@@ -5,6 +5,7 @@ import crypt
 from string import letters, digits
 from random import choice
 from bisect import insort
+from jwcrypto import jws, jwk, jwe
 from django.http import HttpResponse, HttpResponseRedirect
 from django.core.urlresolvers import reverse
 from django.shortcuts import render, get_object_or_404
@@ -291,17 +292,26 @@ def instance(request, compute_id, vname):
                 data = {'action': 'password', 'passwd': passwd_hash, 'vname': vname}
 
                 if conn.get_status() == 5:
-                    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-                    s.connect((compute.hostname, 16510))
-                    s.send(json.dumps(data))
-                    result = json.loads(s.recv(1024))
-                    s.close()
-                    msg = _("Reset root password")
-                    addlogmsg(request.user.username, instance.name, msg)
+                    if compute.gstfsd_key:
+                        key = jwk.JWK(**json.loads(compute.gstfsd_key.strip()))
+                        data = jwe.JWE(json.dumps(data), algs=["A256KW", "A256CBC-HS512"])
+                        data.add_recipient(key, header='{"alg":"A256KW","enc":"A256CBC-HS512"}')
+                        data = jws.JWS(data.serialize())
+                        data.add_signature(key, alg="HS512")
+                        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+                        s.connect((compute.hostname, 16510))
+                        s.send(data.serialize())
+                        result = json.loads(s.recv(4096))
+                        s.close()
+                        msg = _("Reset root password")
+                        addlogmsg(request.user.username, instance.name, msg)
 
-                    if result['return'] == 'success':
-                        messages.append(msg)
+                        if result['return'] == 'success':
+                            messages.append(msg)
+                        else:
+                            error_messages.append(result.get('message', msg))
                     else:
+                        msg = _("Please import the gstfsd key into this compute. It is in /var/lib/gstfsd/SECRET on %s") % compute.name
                         error_messages.append(msg)
                 else:
                     msg = _("Please shutdow down your instance and then try again")
@@ -313,17 +323,26 @@ def instance(request, compute_id, vname):
                 data = {'action': 'publickey', 'key': publickey.keypublic, 'vname': vname}
 
                 if conn.get_status() == 5:
-                    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-                    s.connect((compute.hostname, 16510))
-                    s.send(json.dumps(data))
-                    result = json.loads(s.recv(1024))
-                    s.close()
-                    msg = _("Installed new ssh public key %s" % publickey.keyname)
-                    addlogmsg(request.user.username, instance.name, msg)
+                    if compute.gstfsd_key:
+                        key = jwk.JWK(**json.loads(compute.gstfsd_key.strip()))
+                        data = jwe.JWE(json.dumps(data), algs=["A256KW", "A256CBC-HS512"])
+                        data.add_recipient(key, header='{"alg":"A256KW","enc":"A256CBC-HS512"}')
+                        data = jws.JWS(data.serialize())
+                        data.add_signature(key, alg="HS512")
+                        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+                        s.connect((compute.hostname, 16510))
+                        s.send(data.serialize())
+                        result = json.loads(s.recv(4096))
+                        s.close()
+                        msg = _("Installed new ssh public key %s" % publickey.keyname)
+                        addlogmsg(request.user.username, instance.name, msg)
 
-                    if result['return'] == 'success':
-                        messages.append(msg)
+                        if result['return'] == 'success':
+                            messages.append(msg)
+                        else:
+                            error_messages.append(result.get('message', msg))
                     else:
+                        msg = _("Please import the gstfsd key into this compute. It is in /var/lib/gstfsd/SECRET on %s") % compute.name
                         error_messages.append(msg)
                 else:
                     msg = _("Please shutdow down your instance and then try again")