channel_input_smtp.py

import re

from zope.interface import implements, implementer

from twisted.internet import defer
from twisted.mail import smtp
from twisted.cred.portal import IRealm
from twisted.cred.portal import Portal
from twisted.logger import Logger

log = Logger()
from twisted.application import internet
from twisted.application import service

from constants import INPUT_CHANNEL_SMTP
from tokens import Canarytoken
from canarydrop import Canarydrop
from exception import NoCanarytokenPresent, NoCanarytokenFound
from channel import InputChannel
from queries import get_canarydrop


@implementer(smtp.IMessageDelivery)
class CanaryMessageDelivery:
    # implements(smtp.IMessageDelivery)

    def __init__(self):
        print('Created CanaryMessageDelivery()')

    def receivedHeader(self, helo, origin, recipients):
        return "Received: CanaryMessageDelivery"

    def validateFrom(self, helo, origin):
        return origin

    def validateTo(self, user):
        # Only messages directed to the "console" user are accepted.
        if user.dest.local == "console":
            return lambda: CanaryMessage()
        raise smtp.SMTPBadRcpt(user)


@implementer(smtp.IMessage)
class CanaryMessage:

    def __init__(self, esmtp=None):
        self.esmtp = esmtp
        self.headers = []
        self.headers_finished = False
        self.attachments = []
        self.links = []
        self.links_re = re.compile('(http[s]?://[^\s\'"]+)', re.I)
        self.mime_boundary = None
        self.mime_boundary_re = re.compile('.*boundary[ ]*=[" ]?([^" ]+)')
        self.in_mime_header = True
        self.lines = []
        self.stored_byte_count = 0

    def lineReceived(self, line):
        if line == '' and not self.headers_finished:
            self.headers_finished = True

        if not self.headers_finished:
            self.headers.append(line)
            m = self.mime_boundary_re.match(line)
            if m:
                self.mime_boundary = m.group(1)
        else:
            if self.mime_boundary:
                if self.in_mime_header:
                    if line == '':
                        self.in_mime_header = False
                    else:
                        self.attachments[-1].append(line)

                if self.mime_boundary in line:
                    self.in_mime_header = True
                    self.attachments.append([])

            if self.stored_byte_count < 5 * 2 ** 20:  # 5MB limit
                self.lines.append(line)
                self.stored_byte_count + + len(line)

    def eomReceived(self):
        print("New message received:")
        self.esmtp.mail['headers'] = self.headers
        print("\n".join(self.headers))
        self.esmtp.mail['links'] = self.links_re.findall(
            '\r\n'.join(self.lines))
        print("\n".join(self.links))
        self.esmtp.mail['attachments'] = ['\n'.join(x) for x in self.attachments]
        print('\n\n'.join(['\n'.join(x) for x in self.attachments]))
        self.lines = None
        self.esmtp.dispatch()
        # return defer.succeed(None)
        d = defer.Deferred()
        d.callback("Success")
        return d

    def connectionLost(self):
        # There was an error, throw away the stored lines
        self.lines = None


class CanaryESMTP(smtp.ESMTP):
    def __init__(self, **kwargs):
        smtp.ESMTP.__init__(self, **kwargs)
        self.mail = {'recipients': [],
                     'sender': '',
                     'helo': {},
                     'headers': [],
                     'links': [],
                     'attachments': []}

    def greeting(self, ):
        self.src_ip = self.transport.getPeer().host
        try:
            return self.factory.responses['greeting']
        except KeyError:
            return smtp.ESMTP.greeting(self)

    def receivedHeader(self, helo, origin, recipients):
        self.mail['helo']['client_name'] = helo[0]
        self.mail['helo']['client_ip'] = helo[1]
        self.mail['sender'] = str(origin)
        for r in recipients:
            address = r.dest.addrstr
            self.mail['recipients'].append(address)

    def validateFrom(self, helo, origin):
        return origin

    def validateTo(self, user):
        # Only messages directed to the "console" user are accepted.
        try:
            token = Canarytoken(value=user.dest.local)
            self.canarydrop = Canarydrop(**get_canarydrop(canarytoken=token.value()))
            return lambda: CanaryMessage(esmtp=self)
        except (NoCanarytokenPresent, NoCanarytokenFound):
            log.warn('No token in recipient address: {address}' \
                     .format(address=user.dest.local))
        except Exception as e:
            log.error(e)

        raise smtp.SMTPBadRcpt(user)

    def dispatch(self, ):
        self.factory.dispatch(canarydrop=self.canarydrop, src_ip=self.src_ip,
                              mail=self.mail)


class CanarySMTPFactory(smtp.SMTPFactory, InputChannel):
    protocol = CanaryESMTP
    CHANNEL = INPUT_CHANNEL_SMTP

    def __init__(self, *a, **kw):
        self.responses = {'data_success': 'Finished', 'greeting': 'Hello there'}
        self.switchboard = kw.pop('switchboard')
        smtp.SMTPFactory.__init__(self, *a, **kw)
        InputChannel.__init__(self, switchboard=self.switchboard,
                              name=self.CHANNEL,
                              unique_channel=False)

    def buildProtocol(self, addr):
        p = smtp.SMTPFactory.buildProtocol(self, addr)
        #        p.delivery = self.delivery
        #        p.challengers = {"LOGIN": LOGINCredentials, "PLAIN": PLAINCredentials}
        return p

    def format_additional_data(self, **kwargs):
        log.info(kwargs)
        if 'src_ip' in kwargs and kwargs['src_ip']:
            additional_report = 'Source IP : {ip}'.format(ip=kwargs['src_ip'])
        if 'mail' in kwargs and kwargs['mail']:
            mail = kwargs['mail']
            additional_report += """
Client Name : {client_name}
Client IP   : {client_ip}
Sender      : {sender}
Recipients  : {recipients}
Links       : {links}
Attachments :
{attachments}


Headers     :
{headers}""".format(
                recipients=', '.join(mail['recipients']),
                sender=mail['sender'],
                client_ip=mail['helo']['client_ip'],
                client_name=mail['helo']['client_name'],
                links=', '.join(mail['links']),
                attachments='\n\n'.join(mail['attachments']),
                headers='\n'.join(mail['headers']))

        return additional_report


class ChannelSMTP():
    def __init__(self, port=25, switchboard=None):
        self.service = internet.TCPServer(port, CanarySMTPFactory(None, switchboard=switchboard))