gosecure_app.py

#!/usr/bin/env python

from flask import Flask, render_template, request, Response, flash, redirect, url_for
from functools import wraps
import flask.ext.login as flask_login
import hashlib
import pickle
from forms import loginForm, initialSetupForm, userForm, wifiForm, vpnPskForm, resetToDefaultForm, statusForm
from scripts.rpi_network_conn import add_wifi, internet_status, reset_wifi
from scripts.vpn_server_conn import set_vpn_params, reset_vpn_params, start_vpn, stop_vpn, restart_vpn, vpn_status, vpn_configuration_status
from scripts.pi_mgmt import pi_reboot, pi_shutdown, start_ssh_service, update_client
import time
import os
import json

app = Flask(__name__)
login_manager = flask_login.LoginManager()
login_manager.init_app(app)


#Flask-Login functions (for regular Pages)

#users = {"admin":{"password":"2074ad04839ae517751e5948ae13f0e3c90d186c9c9bbd29c3c88b9c6000dba5", "salt":"uOMbInZTYYpiCGvEaH8Byw==\n"}}
#default username=admin password=gosecure, user is prompted to change if default is being used.
users = pickle.load(open("/home/pi/goSecure_Web_GUI/users_db.p","rb"))

class User(flask_login.UserMixin):
    pass


@login_manager.user_loader
def user_loader(username):
    if username not in users:
        return

    user = User()
    user.id = username
    return user

@login_manager.request_loader
def request_loader(request):
    username = request.form.get('username')
    if username not in users:
        return

    user = User()
    user.id = username

    # DO NOT ever store passwords in plaintext and always compare password
    # hashes using constant-time comparison!
    if(user_validate_credentials(request.form['username'],request.form['password'])):
        user.is_authenticated = True

    return user

@login_manager.unauthorized_handler
def unauthorized_handler():
    flash("Unauthorized, please log in.", "error")
    return redirect(url_for("login"))


#Flask HTTP Basic Auth (for API)

def authenticate():
    """Sends a 401 response that enables basic auth"""
    return Response(
    "Unauthorized", 401,
    {'WWW-Authenticate': 'Basic realm="Login Required"'})

def requires_basic_auth(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        auth = request.authorization
        if not auth or not user_validate_credentials(auth.username, auth.password):
            return authenticate()
        return f(*args, **kwargs)
    return decorated

def flash_form_errors(form):
    for field, errors in form.errors.items():
        for error in errors:
            flash(u"Error in the %s field - %s" % (
                getattr(form, field).label.text,
                error
            ), "error")


#Auth helper functions

#return True is username and password pair match what's in the database
#else return False
def user_validate_credentials(username, password):
    if username not in users:
        return False
    else:
        stored_password = users[username]['password']
        stored_salt = users[username]['salt']
        userPasswordHash = hashlib.sha256(str(stored_salt) + password).hexdigest()
        if(stored_password == userPasswordHash):
            return True
        else:
            return False

#return True is password is changed successfully
#else return False
def user_change_credentials(username, password, new_password):
    if username not in users:
        return False
    else:
        #verify current password
        if(user_validate_credentials(username, password)):
            #change password
            userPasswordHashSalt = os.urandom(16).encode("base64")
            userPasswordHash = hashlib.sha256(str(userPasswordHashSalt) + new_password).hexdigest()
            users[username]["salt"] = userPasswordHashSalt
            users[username]["password"] = userPasswordHash
            pickle.dump(users, open("/home/pi/goSecure_Web_GUI/users_db.p", "wb"))
            return True
        else:
            return False

#return True if credentials are reset
#else return False
def user_reset_credentials(username, password):
    if(user_change_credentials(username, password, "gosecure")):
        return True
    else:
        return False

    
#Routes for web pages

#404 page
@app.errorhandler(404)
def page_not_found(e):
    return render_template('404.html'), 404

#Login Page
@app.route("/", methods=["GET", "POST"])
def login():
    form = loginForm()

    if(request.method == "GET"):
        return render_template("login.html", form=form) 

    elif(request.method == "POST"):
        if(form.validate()):
            username = form.username.data
            password = form.password.data
            if(user_validate_credentials(username, password)):
                user = User()
                user.id = username
                flask_login.login_user(user)
                
                #check to see if default credentials are being used. If so, redirect to change password page.
                if(user_validate_credentials("admin","gosecure")):
                    flash("Please change the default password.", "notice")
                    return redirect(url_for("user"))
                else:
                    internet_status_bool = internet_status()
                    vpn_status_bool = vpn_status()
                    vpn_configuration_status_bool = vpn_configuration_status()

                    #check to see if network is up. If not, redirect to network page
                    if(internet_status_bool == False and vpn_configuration_status_bool == True):
                        flash("Internet is not reachable.", "notice")
                        return redirect(url_for("wifi"))
                    #check to see if network and vpn are up. If not, redirect to initial setup page
                    elif(internet_status_bool == False and vpn_status_bool == False):
                        return redirect(url_for("initial_setup"))
                    #check to see if vpn is up. If not, redirect to vpn page
                    elif(vpn_status_bool == False):
                        flash("VPN is not established.", "notice")
                        return redirect(url_for("vpn_psk"))
                    else:
                        return redirect(request.args.get("next") or url_for("status"))
            else:
                flash("Invalid username or password. Please try again.", "error")
                return render_template("login.html", form=form)
        else:
            flash_form_errors(form)
            return render_template("login.html", form=form)

@app.route('/logout')
def logout():
    flask_login.logout_user()
    return redirect(url_for("login"))

#User page
@app.route("/status", methods=["GET", "POST"])
@flask_login.login_required
def status():
    form = statusForm()
    
    if(request.method == "GET"):
        #check to see if network and vpn are active, red=not active, green=active
        internet_status_color = "red"
        if(internet_status()):
            internet_status_color = "green"
        vpn_status_color = "red"
        if(vpn_status()):
            vpn_status_color = "green"

        return render_template("status.html", form=form, internet_status_color=internet_status_color, vpn_status_color=vpn_status_color)

#User page
@app.route("/user", methods=["GET", "POST"])
@flask_login.login_required
def user():
    form = userForm()
    
    if(request.method == "GET"):
        form.username.data = flask_login.current_user.id
        return render_template("user.html", form=form)
    
    elif(request.method == "POST"):
        if(form.validate()):
            username = form.username.data
            password = form.password.data
            new_password = form.new_password.data
            if(user_change_credentials(username, password, new_password)):
                flash("Your user information has been successfully changed. Please login with the new credentials.", "success")
                return redirect(url_for("login"))
            else:
                flash("Invalid current username or password. Please try again.", "error")
                return render_template("user.html", form=form)

        else:
            flash_form_errors(form)
            return render_template("user.html", form=form)

#Initial setup page
@app.route("/initial_setup", methods=["GET", "POST"])
@flask_login.login_required
def initial_setup():
    form = initialSetupForm()

    if(request.method == "GET"):
        return render_template("initial_setup.html", form=form) 

    elif(request.method == "POST"):
        if(form.validate()):
            ssid = (form.ssid.data).rsplit("-", 1)[0]
            psk = form.psk.data
            add_wifi(ssid, psk)
            
            if(internet_status() == True):
                vpn_server = form.vpn_server.data
                user_id = form.user_id.data
                user_psk = form.user_psk.data
                set_vpn_params(vpn_server, user_id, user_psk)
                restart_vpn()
            
                flash("Wifi and VPN settings saved!", "success")
                return redirect(url_for("status"))
            else:
                flash("Error! Cannot reach the internet...", "error")
                return render_template("initial_setup.html", form=form)
            
        else:
            flash("Error! " + str(form.data), "error")
            return render_template("initial_setup.html", form=form)

#Wifi page
@app.route("/wifi", methods=["GET", "POST"])
@flask_login.login_required
def wifi():
    form = wifiForm()

    if(request.method == "GET"):
        return render_template("wifi.html", form=form)
    
    elif(request.method == "POST"):
        if(form.validate()):
            ssid = (form.ssid.data).rsplit("-", 1)[0]
            psk = form.psk.data
            add_wifi(ssid, psk)
            time.sleep(5)
            
            if(internet_status() == True):
                restart_vpn()
                time.sleep(5)
                flash("Wifi settings saved! VPN Restarted!", "success")
                return redirect(url_for("status"))
            else:
                flash("Error! Cannot reach the internet...", "error")
                return render_template("wifi.html", form=form)

        else:
            flash("Error! " + str(form.data), "error")
            return render_template("wifi.html", form=form)

#VPN psk page
@app.route("/vpn_psk", methods=["GET", "POST"])
@flask_login.login_required
def vpn_psk():
    form = vpnPskForm()

    if(request.method == "GET"):
        return render_template("vpn_psk.html", form=form)
    
    elif(request.method == "POST"):
        if(form.validate()):
            vpn_server = form.vpn_server.data
            user_id = form.user_id.data
            user_psk = form.user_psk.data
            set_vpn_params(vpn_server, user_id, user_psk)
            restart_vpn()

            if(vpn_status()):
                flash("VPN settings saved and VPN restarted!", "success")
                return redirect(url_for("status"))
            else:
                flash("VPN settings saved and VPN restarted! Unable to establish VPN connection.", "error")
                return render_template("vpn_psk.html", form=form)
        else:
            flash("Error! " + str(form.data), "error")
            return render_template("vpn_psk.html", form=form)
    
#Reset to default page
@app.route("/reset_to_default", methods=["GET", "POST"])
@flask_login.login_required
def reset_to_default():
    form = resetToDefaultForm()

    if(request.method == "GET"):
        form.username.data = flask_login.current_user.id
        return render_template("reset_to_default.html", form=form)

    elif(request.method == "POST"):
        if(form.validate()):
            username = form.username.data
            password = form.password.data
            
            reset_vpn_params()
            reset_wifi()
            
            if(user_reset_credentials(username, password)):
                flash("Your client has been successfully reset to default settings.", "success")
                return redirect(url_for("logout"))
            else:
                flash("Error resetting client.", "error")
                return render_template("reset_to_default.html", form=form)

        else:
            flash_form_errors(form)
            return render_template("reset_to_default.html", form=form)


@app.route("/action", methods=["POST"])
@flask_login.login_required
def execute_action():
    action = request.form["action"]
    if(action == "reboot"):
        pi_reboot()
    elif(action == "shutdown"):
        pi_shutdown()
    elif(action == "start_vpn"):
        start_vpn()
        flash("VPN Started!", "notice")
    elif(action == "stop_vpn"):
        stop_vpn()
        flash("VPN Stopped!", "notice")
    elif(action == "restart_vpn"):
        restart_vpn()
        flash("VPN Restarted!", "notice")
    elif(action == "ssh_service"):
        start_ssh_service()
        flash("SSH Service Started! It will be turned off on reboot.")
    elif(action == "update_client"):
        update_client()
        flash("Client will reboot... please reload this page in 1 minute.")
    else:
        form = initialSetupForm()
        flash("Error! Invalid Action!", "error")
        
    return redirect(url_for("status"))


#REST API
        
@app.route("/v1.0/vpn/credentials", methods=["POST", "DELETE"])
@requires_basic_auth
def api_vpn_credentials():
    if(request.method == "POST"):
        form = initialSetupForm()
        form.vpn_server.data = request.json["vpn_server"]
        form.user_id.data = request.json["user_id"]
        form.user_psk.data = request.json["user_psk"]

        if(request.headers['Content-Type'] == 'application/json'):
            if(form.vpn_server.validate(form) and form.user_id.validate(form) and form.user_psk.validate(form)):
                set_vpn_params(form.vpn_server.data, form.user_id.data, form.user_psk.data)
                return "Successfully set vpn_server, user_id, and psk for VPN"
            else:
                return "Invalid user_id or psk format"

        else:
            return "415 Unsupported Media Type - Use application/json"

    elif(request.method == "DELETE"):
        reset_vpn_params()
        return "Successfully reset vpn_server, user_id, and psk for VPN"
    else:
        return "Only POST and DELETE methods are supported. Refer to the API Documentation"

@app.route("/v1.0/vpn/actions", methods=["POST"])
@requires_basic_auth
def api_vpn_actions():
    if(request.method == "POST"):
        if(request.headers['Content-Type'] == 'application/json'):
            action = request.json["action"]
            if(action == "start_vpn"):
                if(start_vpn()):
                    return "VPN service started, VPN is ESTABLISHED"
                else:
                    return "VPN service started, VPN is NOT ESTABLISHED"
                
            elif(action == "stop_vpn"):
                stop_vpn()
                return "VPN service stopped, VPN is NOT ESTABLISHED"
            
            elif(action == "restart_vpn"):
                if(restart_vpn()):
                    return "VPN service restarted, VPN is ESTABLISHED"
                else:
                    return "VPN service restarted, VPN is NOT ESTABLISHED"
            else:
                return "Error! Invalid Action!"

        else:
            return "415 Unsupported Media Type - Use application/json"
    else:
        return "Only POST method is supported. Refer to the API Documentation"

    
if __name__ == "__main__":
    app.secret_key=os.urandom(24)
    
    #if SSL key and certificate pair do not exist, create them.
    if ((os.path.exists("ssl.key") and os.path.exists("ssl.crt")) != True):
        os.system('openssl genrsa 2048 > ssl.key')
        os.system('openssl req -new -x509 -nodes -sha256 -days 1095 -subj "/C=US/O=goSecure/CN=goSecureClient" -key ssl.key > ssl.crt')
        os.system('sudo chown pi:pi ssl.crt ssl.key')
        os.system('sudo chmod 440 ssl.crt ssl.key')
    
    app.run(host="192.168.50.1", port=443, ssl_context=("ssl.crt", "ssl.key"))