backend/netconf.py

# coding=utf-8
"""
Netconf session operations
File: netconf.py
Author: Jakub Man <xmanja00@stud.fit.vutbr.cz>


Parts of this file was taken from the Netopeer2GUI project by Radek Krejčí
Available here: https://github.com/CESNET/Netopeer2GUI

  Copyright 2017 Radek Krejčí

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
"""

from liberouterapi import db, auth, config, socketio
from liberouterapi.dbConnector import dbConnector
import netconf2 as nc
import json
from eventlet.timeout import Timeout
from flask import request
import logging
from .sockets import *
import os
import yang
from .schemas import get_schema
from .devices import *
from .data import *
import pprint

sessions = {}
log = logging.getLogger(__name__)
netconf_db = dbConnector('netconf', provider='mongodb', config={'database': config['netconf']['database']})
netconf_coll = netconf_db.db[config['netconf']['collection']]

"""
netconf session (ncs)
static PyGetSetDef ncSessionGetSetters[] = {
    {"id", (getter)ncSessionGetId, NULL, "NETCONF Session id.", NULL},
    {"host", (getter)ncSessionGetHost, NULL, "Host where the NETCONF Session is connected.", NULL},
    {"port", (getter)ncSessionGetPort, NULL, "Port number where the NETCONF Session is connected.", NULL},
    {"user", (getter)ncSessionGetUser, NULL, "Username of the user connected with the NETCONF Session.", NULL},
    {"transport", (getter)ncSessionGetTransport, NULL, "Transport protocol used for the NETCONF Session.", NULL},
    {"version", (getter)ncSessionGetVersion, NULL, "NETCONF Protocol version used for the NETCONF Session.", NULL},
    {"capabilities", (getter)ncSessionGetCapabilities, NULL, "Capabilities of the NETCONF Session.", NULL},
    {"context", (getter)ncSessionGetContext, NULL, "libyang context of the NETCONF Session.", NULL},
    {NULL} /* Sentinel */
};
"""


def auth_common(session_id):
    global log
    result = None
    timeout = Timeout(60)
    try:
        # wait for response from the frontend
        data = sio_wait(session_id)
        result = data['password']
    except Timeout:
        # no response received within the timeout
        log.info("socketio: auth request timeout.")
    except KeyError:
        # no password
        log.info("socketio: invalid credential data received.")
    finally:
        # we have the response
        sio_clean(session_id)
        timeout.cancel()

    return result


def auth_interactive(name, instruction, prompt, priv):
    try:
        pp = pprint.PrettyPrinter(indent=4)
        pp.pprint(priv)
        params = {'id': priv['id'], 'type': name, 'msg': instruction, 'prompt': prompt, 'device': priv['device']}
        sio_emit('device_auth', params)
        return auth_common(priv)
    except Exception as e:
        print(e)


def auth_password(username, hostname, priv):
    sio_emit('device_auth', {'id': priv, 'type': 'Password Authentication', 'msg': username + '@' + hostname})
    return auth_common(priv)


@auth.required()
def connect_device():
    global sessions
    session = auth.lookup(request.headers.get('lgui-Authorization', None))
    username = str(session['user'].username)
    data = request.get_json()

    nc.setSchemaCallback(get_schema, session)
    site_root = os.path.realpath(os.path.dirname(__file__))
    path = os.path.join(site_root, 'userfiles', username)
    if not os.path.exists(path):
        os.makedirs(path)
    nc.setSearchpath(path)
    if 'password' in data and data['password'] != '' and data['password'] is not None:
        ssh = nc.SSH(data['username'], password=data['password'])
    else:
        ssh = nc.SSH(data['username'])
        ssh.setAuthPasswordClb(auth_password, session['session_id'])
        ssh.setAuthInteractiveClb(func=auth_interactive, priv={'id': session['session_id'], 'device': data})

    ssh.setAuthHostkeyCheckClb(hostkey_check, {'session': session, 'device': data})

    try:
        ncs = nc.Session(data['hostname'], int(data['port']), ssh)
    except Exception as e:
        nc.setSchemaCallback(None)
        return json.dumps({'success': False, 'code': 500, 'message': str(e)})
    nc.setSchemaCallback(None)

    if username not in sessions:
        sessions[username] = {}

    # use key (as hostname:port:session-id) to store the created NETCONF session
    key = ncs.host + ":" + str(ncs.port) + ":" + ncs.id
    sessions[username][key] = {}
    sessions[username][key]['session'] = ncs

    # update inventory's list of schemas
    # schemas_update(session)

    return json.dumps({'success': True, 'session-key': key})


def hostkey_check(hostname, state, keytype, hexa, priv):
    if 'fingerprint' in priv['device']:
        # check according to the stored fingerprint from previous connection
        if hexa == priv['device']['fingerprint']:
            return True
        elif state != 2:
            log.error("Incorrect host key state")
            state = 2

        # ask frontend/user for hostkey check
    params = {'id': priv['session']['session_id'], 'hostname': hostname, 'state': state, 'keytype': keytype,
              'hexa': hexa, 'device': priv['device']}
    sio_emit('hostcheck', params)

    result = False
    timeout = Timeout(30)
    try:
        # wait for response from the frontend
        data = sio_wait(priv['session']['session_id'])
        result = data['result']
    except Timeout:
        # no response received within the timeout
        log.info("socketio: hostcheck timeout.")
    except KeyError:
        # invalid response
        log.error("socketio: invalid hostcheck_result received.")
    finally:
        # we have the response
        sio_clean(priv['session']['session_id'])
        timeout.cancel()

    if result:
        # store confirmed fingerprint for future connections
        priv['device']['fingerprint'] = hexa
        if 'id' in priv['device'].keys():
            update_hexa(priv['device']['id'], hexa, netconf_coll)
        else:
            update_hexa_by_device(priv['device'], hexa, netconf_coll)
    return result


""" SESSION HANDLING """


@auth.required()
def sessions_get_open():
    """
    Get all open sessions belonging to the user
    :return: Array of session keys and devices belonging to sessions. Device names will not be loaded.
    """
    global sessions
    session = auth.lookup(request.headers.get('lgui-Authorization', None))
    username = str(session['user'].username)

    if username in sessions:
        result = []
        for key in sessions[username].keys():
            ncs = sessions[username][key]['session']
            device = get_device_from_session_data(ncs.host, ncs.port, username, ncs.user, netconf_coll)
            if device is not None:
                result.append({'key': key, 'device': device})
        return json.dumps(result)
    else:
        return json.dumps([])


@auth.required()
def session_alive(key):
    global sessions
    session = auth.lookup(request.headers.get('lgui-Authorization', None))
    username = str(session['user'].username)

    if not username in sessions:
        sessions[username] = {}

    if key in sessions[username]:
        return json.dumps({'success': True, 'code': 200})
    else:
        return json.dumps({'success': False, 'code': 404, 'message': 'Session not found'})


@auth.required()
def session_destroy(key):
    global sessions
    session = auth.lookup(request.headers.get('lgui-Authorization', None))
    username = str(session['user'].username)
    if not username in sessions:
        sessions[username] = {}

    if key in sessions[username]:
        del sessions[username][key]
        return json.dumps({'success': True, 'code': 200})
    else:
        return json.dumps({'success': False, 'code': 404, 'message': 'Session not found'})


@auth.required()
def session_destroy_all():
    global sessions
    session = auth.lookup(request.headers.get('lgui-Authorization', None))
    username = str(session['user'].username)
    if username in sessions:
        del sessions[username]
    return json.dumps({'success': True, 'code': 200})


@auth.required()
def session_rpc_get():
    """
    code 500: wrong argument
    code 404: session invalid -> try reconnecting
    code 410: connection gone -> remove session, try reconnecting
    code 418: Error in processing netconf request (nothing to do with a teapot)
    """
    global sessions
    session = auth.lookup(request.headers.get('lgui-Authorization', None))
    username = str(session['user'].username)
    req = request.args.to_dict()
    if 'key' not in req:
        return json.dumps({'success': False, 'code': 500, 'message': 'Missing session key.'})
    if 'recursive' not in req:
        return json.dumps({'success': False, 'code': 500, 'message': 'Missing recursive flag.'})

    if username not in sessions:
        sessions[username] = {}

    key = req['key']
    if key not in sessions[username]:
        return json.dumps({'success': False, 'code': 404, 'message': 'Invalid session key.'})

    try:
        sessions[username][key]['data'] = sessions[username][key]['session'].rpcGet()
    except ConnectionError as e:
        del sessions[username][key]
        return json.dumps({'success': False, 'code': 410, 'message': str(e)})
    except nc.ReplyError as e:
        err_list = []
        for err in e.args[0]:
            err_list.append(str(err))
        return json.dumps({'success': False, 'code': 418, 'message': str(e)})

    if 'path' not in req:
        return data_info_roots(sessions[username][key]['data'], True if req['recursive'] == 'true' else False)
    else:
        return data_info_subtree(sessions[username][key]['data'], req['path'],
                                 True if req['recursive'] == 'true' else False)


@auth.required()
def session_commit():
    session = auth.lookup(request.headers.get('lgui-Authorization', None))
    user = session['user']

    req = request.get_json(keep_order=True)
    if 'key' not in req:
        return json.dumps({'success': False, 'code': 500, 'message': 'Missing session key.'})
    if 'modifications' not in req:
        return json.dumps({'success': False, 'code': 500, 'message': 'Missing modifications.'})

    mods = req['modifications']
    ctx = sessions[user.username][req['key']]['session'].context
    root = None
    reorders = []
    for key in mods:
        recursion = False
        # get correct path and value if needed
        path = mods[key]['data']['path']
        value = None
        if mods[key]['type'] == 'change':
            value = mods[key]['value']
        elif mods[key]['type'] == 'create' or mods[key]['type'] == 'replace':
            if mods[key]['data']['info']['type'] == 1:
                # creating/replacing container
                recursion = True
            elif mods[key]['data']['info']['type'] == 4:
                # creating/replacing leaf
                value = mods[key]['data']['value']
            elif mods[key]['data']['info']['type'] == 8:
                # creating/replacing leaf-list
                value = mods[key]['data']['value'][0]
                path = mods[key]['data']['path']
            elif mods[key]['data']['info']['type'] == 16:
                recursion = True
                path = mods[key]['data']['path']
        elif mods[key]['type'] == 'reorder':
            # postpone reorders
            reorders.extend(mods[key]['transactions'])
            continue

        # create node
        # print("creating " + path)
        # print("value " + str(value))
        if root:
            root.new_path(ctx, path, value, 0, 0)
        else:
            try:
                root = yang.Data_Node(ctx, path, value, 0, 0)
            except Exception as e:
                print(e)
                return json.dumps({'success': False, 'code': 404, 'message': str(e)})
        node = root.find_path(path).data()[0]

        # set operation attribute and add additional data if any
        if mods[key]['type'] == 'change':
            node.insert_attr(None, 'ietf-netconf:operation', 'merge')
        elif mods[key]['type'] == 'delete':
            node.insert_attr(None, 'ietf-netconf:operation', 'delete')
        elif mods[key]['type'] == 'create':
            node.insert_attr(None, 'ietf-netconf:operation', 'create')
        elif mods[key]['type'] == 'replace':
            node.insert_attr(None, 'ietf-netconf:operation', 'replace')
        else:
            return json.dumps({'success': False, 'error-msg': 'Invalid modification ' + key})

        if recursion and 'children' in mods[key]['data']:
            for child in mods[key]['data']['children']:
                if 'key' in child['info'] and child['info']['key']:
                    continue
                _create_child(ctx, node, child)

    # finally process reorders which must be last since they may refer newly created nodes
    # and they do not reflect removed nodes
    for move in reorders:
        try:
            node = root.find_path(move['node']).data()[0];
            parent = node.parent()
            node.unlink()
            if parent:
                parent.insert(node)
            else:
                root.insert_sibling(node)
        except Exception as e:
            if root:
                root.new_path(ctx, move['node'], None, 0, 0)
            else:
                root = yang.Data_Node(ctx, move['node'], None, 0, 0)
            node = root.find_path(move['node']).data()[0];
        node.insert_attr(None, 'yang:insert', move['insert'])
        if move['insert'] == 'after' or move['insert'] == 'before':
            if 'key' in move:
                node.insert_attr(None, 'yang:key', move['key'])
            elif 'value' in move:
                node.insert_attr(None, 'yang:value', move['value'])

    # print(root.print_mem(yang.LYD_XML, yang.LYP_FORMAT))
    try:
        sessions[user.username][req['key']]['session'].rpcEditConfig(nc.DATASTORE_RUNNING, root)
    except nc.ReplyError as e:
        reply = {'success': False, 'code': 500, 'message': '[]'}
        for err in e.args[0]:
            reply['message'] += str(err) + '; '
        return json.dumps(reply)

    return json.dumps({'success': True})


def _create_child(ctx, parent, child_def):
    at = child_def['info']['module'].find('@')
    if at == -1:
        module = ctx.get_module(child_def['info']['module'])
    else:
        module = ctx.get_module(child_def['info']['module'][:at], child_def['info']['module'][at + 1:])
    if child_def['info']['type'] == 4:
        yang.Data_Node(parent, module, child_def['info']['name'], child_def['value'])
    elif child_def['info']['type'] == 8:
        yang.Data_Node(parent, module, child_def['info']['name'], child_def['value'][0])
    else:
        child = yang.Data_Node(parent, module, child_def['info']['name'])
        if 'children' in child_def:
            for grandchild in child_def['children']:
                _create_child(ctx, child, grandchild)