vpnmanager/manager/views.py

from django.shortcuts import render, get_object_or_404, redirect
from django.http import HttpResponse
from django.contrib.auth.forms import AuthenticationForm, PasswordChangeForm
from django.contrib.auth.forms import AdminPasswordChangeForm
from django.db.models import Q
from django.views.decorators.csrf import csrf_exempt
from django.utils import timezone
from django.core.files import File
from django.db.models.fields.files import FieldFile
from django.contrib.auth.models import User
from django.contrib.auth.decorators import login_required, user_passes_test
from django.db.models.signals import post_save
from django.dispatch import receiver
from django.conf import settings
from django.contrib.auth.forms import PasswordResetForm
from django.urls import reverse

from .models import Device, Organization, Network, Model, Wifi, UserStatus
from .signals import *
from .forms import *
from .device import makewificonfig, heartbeathandler
from .tasks import mkfirmware

from distutils.dir_util import copy_tree
from celery.exceptions import TimeoutError
from subprocess import call as execute

import glob
import sys
import subprocess
import os
import socket
import tempfile
import crypt
import tarfile
from datetime import datetime
import time
import uuid


def is_superuser(user):
    return user.is_superuser


def is_staff(user):
    return user.is_staff


@login_required
def index(request):
    return redirect(reverse("devices"))


@csrf_exempt
def heartbeat(request):
    device = get_object_or_404(Device, secret=request.POST.get("secret", ""))
    ip = request.POST.get("ip", "")

    return HttpResponse(heartbeathandler(device, ip))


@csrf_exempt
def wireless(request):
    device = get_object_or_404(Device, secret=request.POST.get("secret", ""))
    device.wireless = timezone.now()
    device.save()
    return HttpResponse(makewificonfig(device))


@csrf_exempt
def hosts(request):
    device = get_object_or_404(Device, secret=request.POST.get("secret", ""))
    sigRebootDevice(device.serial, None, False)
    device.reboot = False
    device.save()
    return render(request, "manager/hosts", {"device": device})


@csrf_exempt
def update(request):
    FWDIR = "/opt/vpnmanager/images/"

    device = get_object_or_404(Device, secret=request.POST.get("secret", ""))

    try:
        process = mkfirmware.apply_async((device, FWDIR), serializer='pickle')
        if not process.get(timeout=300):
            return HttpResponse(status=503)
    except TimeoutError:
        return HttpResponse(status=503)

    sigUpdateDevice(device.serial, None, False)
    device.update = False
    device.save()

    with open("%s/%s.bin" % (FWDIR, device.id), "rb") as download:
        response = HttpResponse(
                download.read(),
                content_type="application/octet-stream"
                )

        response['Content-Disposition'] = (
                'inline; '
                'filename=%s.bin' % device.serial
                )

        return response


def ping(request, device_id):
    if request.user.is_authenticated:
        try:
            device = Device.objects.get(
                    id=device_id,
                    organization__in=request.user.organization_set.all()
                    )

        except Exception:
            device = None

        ajax = '{\n "status": '

        if not device:
            status = "-1"

        else:
            tz = timezone.get_current_timezone()
            if device.lasttime:
                naive = timezone.make_naive(device.lasttime, tz)
                tt = naive.timetuple()
                lasttime = str(int(time.mktime(tt)) * 1000)
            else:
                lasttime = None

            if device.lastbeat:
                naive = timezone.make_naive(device.lastbeat, tz)
                tt = naive.timetuple()
                lastbeat = str(int(time.mktime(tt)) * 1000)
            else:
                lastbeat = None

            status = None

            try:
                if device.curip:
                    try:
                        socket.inet_aton(device.curip)
                    except Exception:
                        status = -3
                    else:
                        if device.lasttime:
                            diff = timezone.now() - device.lasttime
                            secs = diff.total_seconds()
                            if secs < 300:
                                cmd = "ping -c1 -w1 %s >/dev/null 2>&1"
                                status = os.system(cmd % device.curip)
                                if not os.WEXITSTATUS(status):
                                    status = 1

                        if not status:
                            if (not device.lasttime) or secs > 120:
                                diff = timezone.now() - device.lastbeat
                                secs = diff.total_seconds()
                                if secs < 60:
                                    status = 2

                            if not status:
                                status = 0

            except Exception as e:
                status = str(e)
                status += "-4"
            finally:
                ajax += str(status)
                ajax += ',\n "serial": "%s"' % device.serial
                ajax += ',\n "name": "%s"' % (device.name or "")
                ajax += ',\n "ip": "%s"' % (device.curip or "")
                ajax += ',\n "time": "%s"' % lasttime
                ajax += ',\n "lastbeat": "%s"' % lastbeat
                ajax += ',\n "reboot": %i' % (1 if device.reboot else 0)
                ajax += ',\n "update": %i' % (1 if device.update else 0)

                ajax += ',\n "network": {'
                ajax += '\n  "intip": "%s"' % device.network.intip
                ajax += ',\n  "extip": "%s"' % device.network.extip
                ajax += ',\n  "name": "%s"' % (device.network.name or "")
                ajax += '\n }'

    else:
        ajax += "-2"

    ajax += "\n}"
    return HttpResponse(ajax, content_type="application/json")


@login_required
def devices(request, code=200, exception=None):
    return render(
            request,
            "manager/index.html",
            {
                "title": "Device Administration",
                "exception": exception
                },
            status=code
            )


@login_required
def editdevice(request, device_id):
    post = request.method == "POST"

    device = get_object_or_404(
            Device,
            id=device_id,
            organization__in=request.user.organization_set.all()
            )

    subnets = Network.objects.filter(
            organization=device.organization
            )

    wifis = Wifi.objects.filter(
            organization=device.organization
            )

    form = DeviceForm(
            request.POST if post else None,
            instance=device
            )

    form.fields["mac"].disabled = True
    form.fields["serial"].disabled = True
    form.fields["secret"].disabled = True
    form.fields["model"].disabled = True
    form.fields["password"].disabled = True

    if post and form.is_valid():
        form.save()
        return redirect(reverse("devices"))

    return render(
           request,
           "manager/form.html",
           {
               "title": "Edit Device",
               "form": form
               }
           )


@user_passes_test(is_superuser)
def makeuser(request):
    if request.POST.get("username", ""):
        user = User.objects.create_user(
               username=request.POST.get("username", ""),
               password=str(uuid.uuid4().hex),
               first_name=request.POST.get("firstname", ""),
               last_name=request.POST.get("lastname", ""),
               is_staff=request.POST.get("staff", "0") == "True",
               is_superuser=request.POST.get("superuser", "0") == "True",
               email=request.POST.get("email", "")
               )

        user.organization_set.set(set(request.POST.getlist("orga", [])))

        form = PasswordResetForm({"email": user.email})

        if form.is_valid():
            form.save(
                request=request,
                use_https=True,
                email_template_name='registration/add_user.html')

        return redirect(reverse("users"))

    else:
        return render(request, "manager/adduser.html", {"title": "Add User"})


@login_required
def edituser(request, user_id):
    if request.user.is_staff or request.user.id == user_id:
        orgas = request.user.organization_set.all()
        user = User.objects.distinct().get(id=user_id, organization__in=orgas)

        if not user:
            return redirect(reverse("users"))

        if request.POST.get("form", ""):
            newfirst = request.POST.get("firstname", "")
            newlast = request.POST.get("lastname", "")

            if newlast != user.last_name or newfirst != user.first_name:
                sigRenameUser(
                        user.username,
                        request.user.username,
                        "%s %s" % (user.first_name, user.last_name),
                        "%s %s" % (newfirst, newlast)
                        )
                user.first_name = request.POST.get("firstname", "")
                user.last_name = request.POST.get("lastname", "")

            if request.user.is_staff or request.user.is_superuser:
                newstaff = request.POST.get("staff", "0") == "True"
                if newstaff != user.is_staff:
                    sigStaffUser(
                            user.username,
                            request.user.username,
                            newstaff
                            )
                    user.is_staff = newstaff

            if request.user.is_superuser:
                newsuper = request.POST.get("superuser", "0") == "True"
                if newsuper != user.is_superuser:
                    sigSuperUser(
                       user.username,
                       request.user.username,
                       newsuper)
                    user.is_superuser = newsuper

                    neworgas = set(request.POST.getlist("orga", []))
                    oldorgas = set(user.organization_set.all())
                    if neworgas != oldorgas:
                        sigOrgaUser(
                            user.username,
                            request.user.username,
                            oldorgas,
                            neworgas
                            )
                        user.organization_set.set(neworgas)

            newmail = request.POST.get("email", "")
            if newmail != user.email:
                sigMailUser(
                        user.username,
                        request.user.username,
                        user.email,
                        newmail
                        )
                user.email = newmail

            user.save()

            return redirect(reverse("users"))

        return render(
               request,
               "manager/edituser.html",
               {
                   "title": "Edit User",
                   "auser": user
                   }
               )

    return redirect(
            reverse(
                "two_factor:login",
                kwargs={
                    'next': request.path
                    }
                )
            )


@login_required
def editwifi(request, wifi_id):
    userorgas = request.user.organization_set.all()

    wifi = get_object_or_404(
            Wifi,
            id=wifi_id,
            organization__in=userorgas
            )

    form = WifiForm(
            request.POST if request.method == "POST" else None,
            instance=wifi
            )

    form.fields["organization"].queryset = userorgas

    if request.method == "POST" and form.is_valid():
        form.save()
        return redirect(reverse("wifi"))

    return render(
            request,
            "manager/form.html",
            {
                "title": "Edit WiFi",
                "form": form
                }
            )


@user_passes_test(is_superuser)
def getconfig(request, device_id):
    FWDIR = "/opt/vpnmanager/images/"

    device = get_object_or_404(Device, id=device_id)
    files = glob.glob("%s/%s.bin" % (FWDIR, device_id))

    if not files:
        mtime = os.path.getmtime(files[0])
        tz = timezone.get_current_timezone()

        if not datetime.fromtimestamp(mtime, tz) > device.model.firmware:
            work = mkfirmware.apply_async((device, FWDIR), serializer='pickle')
            if not work.get(timeout=300):
                return HttpResponse(status=503)

    sigUpdateDevice(device.serial, None, False)
    device.update = False
    device.save()

    with open("%s/%s.bin" % (FWDIR, device.id), "rb") as download:
        response = HttpResponse(
                download.read(),
                content_type="application/octet-stream"
                )

        response['Content-Disposition'] = (
                'inline; '
                'filename=%s.bin' % device.serial
                )

        return response


@login_required
def rebootdevice(request, device_id):
    device = get_object_or_404(
            Device,
            id=device_id,
            organization__in=request.user.organization_set.all()
            )

    if not device.reboot:
        sigRebootDevice(device.serial, request.user.username, True)
        device.reboot = True
        device.save()

    return redirect(reverse("devices"))


@user_passes_test(is_staff)
def updatedevice(request, device_id):
    device = get_object_or_404(
            Device,
            id=device_id,
            organization__in=request.user.organization_set.all()
            )

    if not device.update:
        sigUpdateDevice(device.serial, request.user.username, True)
        device.update = True
        device.save()

    return redirect(reverse("devices"))


@user_passes_test(is_superuser)
def deletedevice(request, device_id):
    CADIR = "/etc/openvpn/ca/"
    BEFORE = os.getcwd()

    device = get_object_or_404(Device, id=device_id)

    os.chdir(CADIR)

    execute(CADIR + "/revoke " + device.serial, shell=True)
    os.system("rm " + CADIR + "/keys/" + device.serial + ".{crt,csr,key}")

    os.chdir(BEFORE)

    device.delete()

    return redirect(reverse("devices"))


@user_passes_test(is_staff)
def deletewifi(request, wifi_id):
    wifi = get_object_or_404(
            Wifi,
            id=wifi_id,
            organization__in=request.user.organization_set.all()
            )
    wifi.delete()
    return redirect(reverse("wifi"))


@user_passes_test(is_superuser)
def deleteuser(request, user_id):
    user = get_object_or_404(User, id=user_id)
    user.delete()
    return redirect(reverse("users"))


@user_passes_test(is_superuser)
def deletenetwork(request, network_id):
    network = get_object_or_404(Network, id=network_id)
    network.delete()
    return redirect(reverse("networks"))


@user_passes_test(is_superuser)
def deleteorga(request, orga_id):
    orga = get_object_or_404(Organization, id=orga_id)
    orga.delete()
    return redirect(reverse("organizations"))


@login_required
def makewifi(request):
    post = request.method == "POST"
    postdata = request.POST if post else None

    organization = request.user.userstatus.orga
    initial = {"organization": organization} if not post else None

    form = WifiForm(postdata, initial=initial)
    form.fields["organization"].queryset = request.user.organization_set.all()
    if request.method == "POST" and form.is_valid():
        form.save()
        return redirect(reverse("wifi"))

    return render(
            request,
            "manager/form.html",
            {
                "title": "Add WiFi",
                "form": form
                }
            )


@user_passes_test(is_superuser)
def makenetwork(request):
    if request.method == "POST":
        form = NetworkForm(request.POST)
        if form.is_valid():
            form.save()
            return redirect(reverse("networks"))

    else:
        form = NetworkForm()

    return render(
            request,
            "manager/form.html",
            {
                "title": "Add Network",
                "form": form
                }
            )


@user_passes_test(is_superuser)
def editnetwork(request, network_id):
    net = get_object_or_404(Network, id=network_id)
    postdata = request.POST if request.method == "POST" else None
    form = NetworkForm(postdata, instance=net)
    form.fields["intip"].disabled = True
    form.fields["extip"].disabled = True

    if request.method == "POST" and form.is_valid():
        form.save()
        return redirect(reverse("networks"))

    return render(
            request,
            "manager/form.html",
            {
                "title": "Edit Network",
                "form": form
                }
            )


@login_required
def setactiveorga(request, orga_id):
    request.user.userstatus.orga = get_object_or_404(
            Organization,
            id=orga_id,
            users=request.user
            )

    request.user.userstatus.save()
    return HttpResponse("")


@user_passes_test(is_superuser)
def makeorganization(request):
    if request.method == "POST":
        form = OrgaForm(request.POST)
        if form.is_valid():
            orga = form.save()
            request.user.organization_set.add(orga)
            Network.objects.get(intip="No VPN").organization.add(orga)
            return redirect(reverse("organizations"))

    else:
        form = OrgaForm()

    return render(
            request,
            "manager/form.html",
            {
                "title": "Add Organization",
                "form": form
                }
            )


@user_passes_test(is_superuser)
def editorganization(request, orga_id):
    orga = get_object_or_404(Organization, id=orga_id)
    if request.method == "POST":
        form = OrgaForm(request.POST, instance=orga)
        if form.is_valid():
            form.save()
            return redirect(reverse("organizations"))

    else:
        form = OrgaForm(instance=orga)

    return render(
            request,
            "manager/form.html",
            {
                "title": "Change Organization",
                "form": form
                }
            )


@user_passes_test(is_superuser)
def makedevice(request):
    CADIR = "/etc/openvpn/ca/"
    CONFIGDIR = "/etc/openvpn/client-configs/"
    BEFORE = os.getcwd()

    device_serial = request.POST.get("serial", "").replace(" ", "_")
    device_name = request.POST.get("name", "")
    device_organization = request.POST.get("organization", "")
    device_model = request.POST.get("model", "")
    device_ssid = request.POST.get("ssid", device_serial)
    device_key = request.POST.get("key", "")
    device_mac = request.POST.get("mac", "")

    if not device_serial:
        orga = Organization.objects.all()
        models = Model.objects.all()

        return render(request, "manager/add.html",
                      {
                        "title": "Add Device",
                        "organizations": orga,
                        "models": models
                      }
                      )

    if glob.glob(CADIR + "/keys/" + device_serial + "*"):
        return HttpResponse("Key already exists.")

    os.chdir(CADIR)

    if execute(CADIR + "/generate-key " + device_serial, shell=True):
        os.chdir(BEFORE)
        return HttpResponse("Error generating key.")

    if glob.glob(CONFIGDIR + "/files/" + device_serial + "*"):
        os.chdir(BEFORE)
        return HttpResponse("Configuration file already exists.")

    os.chdir(CONFIGDIR)

    if execute(CONFIGDIR + "/make_config " + device_serial, shell=True):
        os.chdir(BEFORE)
        return HttpResponse("Error generating config file.")

    os.chdir(BEFORE)

    with open(CONFIGDIR + "/files/" + device_serial + ".ovpn") as vpnfile:
        vpnconfig = vpnfile.read()

    organization = Organization.objects.get(id=device_organization)

    device = Device.objects.create(
           serial=device_serial,
           name=device_name,
           ssid=device_ssid,
           key=device_key,
           model=Model.objects.filter(id=device_model)[0],
           network=Network.objects.filter(intip="No VPN")[0],
           organization=organization,
           vpnconfig=vpnconfig,
           mac=device_mac or None,
           changed=timezone.now()
           )

    return redirect(reverse("devices"))


@receiver(post_save, sender=settings.AUTH_USER_MODEL)
def createUserStatus(sender, instance, created, **kwargs):
    if created:
        UserStatus.objects.create(user=instance)


@receiver(post_save, sender=settings.AUTH_USER_MODEL)
def saveUserStatus(sender, instance, **kwargs):
    try:
        instance.userstatus.save()
    except Exception:
        UserStatus.objects.create(user=instance)


def errorhandler(request, code, exception):
    if code == 403:
        exception.human = ("You have no permission "
                           "to access the requested page.")
    elif code == 400:
        exception.human = ("Something seems to be wrong with "
                           "the request you sent. Please try again.")

    elif code == 404:
        exception.human = ("Sorry, we were unable to find the page you "
                           "requested. Please check the address and try again."
                           )

    elif code == 500:
        exception.human = ("Sorry, something seems to be wrong on our end. "
                           "Please try again later or contact support if "
                           "the problem persists.")

    return devices(request, code=code, exception=exception)


def handler400(request, exception):
    return errorhandler(request, 400, exception)


def handler403(request, exception):
    return errorhandler(request, 403, exception)


def handler404(request, exception):
    return errorhandler(
            request,
            404,
            exception
            )


def handler500(request):
    return errorhandler(
            request,
            500,
            Exception("Please check server logs for additional information.")
            )