channel_input_smtp.py

import re

from zope.interface import implements

from twisted.internet import defer
from twisted.mail import smtp
from twisted.cred.portal import IRealm
from twisted.cred.portal import Portal
from twisted.python import log
from twisted.application import internet
from twisted.application import service    

from constants import INPUT_CHANNEL_SMTP
from tokens import Canarytoken
from canarydrop import Canarydrop
from exception import NoCanarytokenPresent, NoCanarytokenFound
from channel import InputChannel
from queries import get_canarydrop



class CanaryMessageDelivery:
    implements(smtp.IMessageDelivery)

    def __init__(self):
        print 'Created CanaryMessageDelivery()'

    def receivedHeader(self, helo, origin, recipients):
        return "Received: CanaryMessageDelivery"

    def validateFrom(self, helo, origin):
        return origin

    def validateTo(self, user):
        # Only messages directed to the "console" user are accepted.
        if user.dest.local == "console":
            return lambda: CanaryMessage()
        raise smtp.SMTPBadRcpt(user)



class CanaryMessage:
    implements(smtp.IMessage)

    def __init__(self, esmtp=None):
        self.esmtp = esmtp
        self.headers = []
        self.headers_finished = False
        self.attachments = []
        self.links = []
        self.links_re = re.compile('(http[s]?://[^\s\'"]+)', re.I)
        self.mime_boundary = None
        self.mime_boundary_re = re.compile('.*boundary[ ]*=[" ]?([^" ]+)')
        self.in_mime_header = True
        self.lines = []
        self.stored_byte_count = 0

    def lineReceived(self, line):
        if line == '' and not self.headers_finished:
            self.headers_finished = True

        if not self.headers_finished:
            self.headers.append(line)
            m = self.mime_boundary_re.match(line)
            if m:
                self.mime_boundary = m.group(1)
        else:
            if self.mime_boundary:
                if self.in_mime_header:
                    if line == '':
                        self.in_mime_header = False
                    else:
                        self.attachments[-1].append(line)

                if self.mime_boundary in line:
                    self.in_mime_header = True
                    self.attachments.append([])

            if self.stored_byte_count < 5*2**20: #5MB limit
                self.lines.append(line)
                self.stored_byte_count ++ len(line)

    def eomReceived(self):
        print "New message received:"
        self.esmtp.mail['headers'] = self.headers
        print "\n".join(self.headers)
        self.esmtp.mail['links'] = self.links_re.findall(
                                   '\r\n'.join(self.lines))
        print "\n".join(self.links)
        self.esmtp.mail['attachments'] = [ '\n'.join(x) for x in self.attachments]
        print '\n\n'.join([ '\n'.join(x) for x in self.attachments])
        self.lines = None
        self.esmtp.dispatch()
        #return defer.succeed(None)
        d = defer.Deferred()
        d.callback("Success")
        return d

    def connectionLost(self):
        # There was an error, throw away the stored lines
        self.lines = None


class CanaryESMTP(smtp.ESMTP):
    def __init__(self, **kwargs):
        smtp.ESMTP.__init__(self, **kwargs)
        self.mail = {'recipients': [],
                     'sender': '', 
                     'helo': {}, 
                     'headers': [], 
                     'links': [], 
                     'attachments': []}

    def greeting(self,):
        self.src_ip = self.transport.getPeer().host
        try:
            return self.factory.responses['greeting']
        except KeyError:
            return smtp.ESMTP.greeting(self)

    def receivedHeader(self, helo, origin, recipients):
        self.mail['helo']['client_name'] = helo[0]
        self.mail['helo']['client_ip'] = helo[1]
        self.mail['sender'] = str(origin)
        for r in recipients:
            address = r.dest.addrstr
            self.mail['recipients'].append(address)

    def validateFrom(self, helo, origin):
        return origin

    def validateTo(self, user):
        # Only messages directed to the "console" user are accepted.
        try:
            token = Canarytoken(value=user.dest.local)
            self.canarydrop = Canarydrop(**get_canarydrop(canarytoken=token.value()))
            return lambda: CanaryMessage(esmtp=self)
        except (NoCanarytokenPresent, NoCanarytokenFound):
            log.err('No token in recipient address: {address}'\
                     .format(address=user.dest.local))
        except Exception as e:
            log.err(e)

        raise smtp.SMTPBadRcpt(user)

    def dispatch(self,):
        self.factory.dispatch(canarydrop=self.canarydrop, src_ip=self.src_ip, 
                      mail=self.mail)

class CanarySMTPFactory(smtp.SMTPFactory, InputChannel):
    protocol = CanaryESMTP
    CHANNEL = INPUT_CHANNEL_SMTP

    def __init__(self, *a, **kw):
        self.responses = {'data_success': 'Finished', 'greeting': 'Hello there'}
        self.switchboard = kw.pop('switchboard')
        smtp.SMTPFactory.__init__(self, *a, **kw)
        InputChannel.__init__(self, switchboard=self.switchboard,
                              name=self.CHANNEL,
                              unique_channel=False)

    def buildProtocol(self, addr):
        p = smtp.SMTPFactory.buildProtocol(self, addr)
#        p.delivery = self.delivery
#        p.challengers = {"LOGIN": LOGINCredentials, "PLAIN": PLAINCredentials}
        return p

    def format_additional_data(self, **kwargs):
        log.msg('%r' % kwargs)
        if kwargs.has_key('src_ip') and kwargs['src_ip']:
            additional_report = 'Source IP : {ip}'.format(ip=kwargs['src_ip'])
        if kwargs.has_key('mail') and kwargs['mail']:
            mail = kwargs['mail']
            additional_report += """
Client Name : {client_name}
Client IP   : {client_ip}
Sender      : {sender}
Recipients  : {recipients}
Links       : {links}
Attachments : 
{attachments}


Headers     : 
{headers}""".format(
                recipients = ', '.join(mail['recipients']),
                sender = mail['sender'],
                client_ip= mail['helo']['client_ip'],
                client_name = mail['helo']['client_name'],
                links = ', '.join(mail['links']),
                attachments = '\n\n'.join(mail['attachments']),
                headers = '\n'.join(mail['headers']))

        return additional_report


class ChannelSMTP():
    def __init__(self, port=25, switchboard=None):
        self.service = internet.TCPServer(port, CanarySMTPFactory(None, switchboard=switchboard))