opentakserver 1.0.0__py3-none-any.whl

opentakserver/EmailValidator.py

@@ -0,0 +1,39 @@
+import tldextract
+from flask_security import MailUtil
+from extensions import logger
+
+
+class EmailValidator(MailUtil):
+
+    def __init__(self, app):
+        super().__init__(app)
+        self.app = app
+
+    def validate(self, email: str) -> str:
+        domain_whitelist = self.app.config.get("OTS_EMAIL_DOMAIN_WHITELIST")
+        domain_blacklist = self.app.config.get("OTS_EMAIL_DOMAIN_BLACKLIST")
+        tld_whitelist = self.app.config.get("OTS_EMAIL_TLD_WHITELIST")
+        tld_blacklist = self.app.config.get("OTS_EMAIL_TLD_BLACKLIST")
+
+        domain = email.split("@")[-1]
+        parsed_domain = tldextract.extract(domain)
+        logger.debug("Got domain: {}".format(domain))
+
+        if domain_whitelist and domain not in domain_whitelist:
+            logger.error("Domain {} is not whitelisted".format(domain))
+            raise ValueError("Domain {} is not whitelisted".format(domain))
+
+        if domain_blacklist and domain in domain_blacklist:
+            logger.error("Domain {} is blacklisted".format(domain))
+            raise ValueError("Domain {} is blacklisted".format(domain))
+
+        if tld_whitelist and parsed_domain.suffix not in tld_whitelist:
+            logger.error("TLD {} not whitelisted".format(parsed_domain.suffix))
+            raise ValueError("TLD {} not whitelisted".format(parsed_domain.suffix))
+
+        if tld_blacklist and parsed_domain.suffix in tld_blacklist:
+            logger.error("TLD {} is blacklisted".format(parsed_domain.suffix))
+            raise ValueError("TLD {} is blacklisted".format(parsed_domain.suffix))
+
+        logger.info("Looks like {} is good".format(email))
+        return super().validate(email)

opentakserver/SocketServer.py

@@ -0,0 +1,99 @@
+import os
+import socket
+import ssl
+from threading import Thread
+
+from opentakserver.controllers.client_controller import ClientController
+
+
+class SocketServer(Thread):
+    def __init__(self, logger, app_context=None, port=8088, ssl_server=False):
+        super().__init__()
+
+        self.logger = logger
+        self.port = port
+        self.ssl = ssl_server
+        self.shutdown = False
+        self.daemon = True
+        self.socket = None
+        self.clients = []
+        self.app_context = app_context
+
+    def run(self):
+        if self.ssl:
+            self.socket = self.launch_ssl_server()
+        elif self.app_context.app.config.get("OTS_ENABLE_TCP_STREAMING_PORT"):
+            self.socket = self.launch_tcp_server()
+        else:
+            self.logger.info("TCP connections are disabled")
+            return
+
+        self.socket.settimeout(1.0)
+
+        while not self.shutdown:
+            try:
+                sock, addr = self.socket.accept()
+                if self.ssl:
+                    self.logger.info("New SSL connection from {}".format(addr[0]))
+                else:
+                    self.logger.info("New TCP connection from {}".format(addr[0]))
+
+                new_thread = ClientController(addr[0], addr[1], sock, self.logger, self.app_context.app, self.ssl)
+                new_thread.daemon = True
+                new_thread.start()
+                self.clients.append(new_thread)
+            except KeyboardInterrupt:
+                break
+            except TimeoutError:
+                if self.shutdown:
+                    self.socket.shutdown(socket.SHUT_RDWR)
+                    self.socket.close()
+
+        if self.ssl:
+            self.logger.info("SSL server has shut down")
+        else:
+            self.logger.info("TCP server has shut down")
+
+    def launch_tcp_server(self):
+        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        s.bind(('0.0.0.0', self.port))
+        s.listen(1)
+
+        return s
+
+    def launch_ssl_server(self):
+        with socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0) as sock:
+            sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+
+            context = self.get_ssl_context()
+
+            sconn = context.wrap_socket(sock, server_side=True)
+            sconn.bind(('0.0.0.0', self.port))
+            sconn.listen(0)
+
+            return sconn
+
+    def stop(self):
+        if self.ssl:
+            self.logger.warning("Shutting down SSL server")
+        else:
+            self.logger.warning("Shutting down TCP server")
+
+        self.shutdown = True
+        for client in self.clients:
+            self.logger.debug('Attempting to stop client {}'.format(client.address))
+            client.stop()
+
+    def get_ssl_context(self):
+        context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+
+        with self.app_context:
+            context.load_cert_chain(
+                os.path.join(self.app_context.app.config.get("OTS_CA_FOLDER"), "certs", "opentakserver", "opentakserver.pem"),
+                os.path.join(self.app_context.app.config.get("OTS_CA_FOLDER"), "certs", "opentakserver", "opentakserver.nopass.key"))
+
+            context.verify_mode = self.app_context.app.config.get("OTS_SSL_VERIFICATION_MODE")
+            context.load_verify_locations(cafile=os.path.join(self.app_context.app.config.get("OTS_CA_FOLDER"), 'ca.pem'))
+
+            return context

opentakserver/__init__.py

@@ -0,0 +1,3 @@
+# These version placeholders will be replaced later during substitution.
+__version__ = "1.0.0"
+__version_tuple__ = (1, 0, 0)

opentakserver/app.py

@@ -0,0 +1,281 @@
+import sys
+
+import eventlet
+try:
+    eventlet.monkey_patch()
+except BaseException as e:
+    print("Failed to monkey_patch(): {}".format(e))
+
+import platform
+import requests
+from sqlalchemy import insert
+import sqlite3
+from opentakserver.models.Icon import Icon
+
+import yaml
+from apscheduler.jobstores.sqlalchemy import SQLAlchemyJobStore
+
+from opentakserver.EmailValidator import EmailValidator
+
+import logging
+import os
+
+import colorlog
+from werkzeug.middleware.proxy_fix import ProxyFix
+from datetime import datetime
+import sqlalchemy
+
+import flask_wtf
+
+import pika
+from flask import Flask, jsonify
+from flask_cors import CORS
+
+from flask_security import Security, SQLAlchemyUserDatastore, hash_password, uia_username_mapper, uia_email_mapper
+from flask_security.models import fsqla_v3 as fsqla
+from flask_security.signals import user_registered
+
+from opentakserver.extensions import logger, db, socketio, mail, apscheduler
+from opentakserver.defaultconfig import DefaultConfig
+from opentakserver.models.WebAuthn import WebAuthn
+
+from opentakserver.controllers.cot_controller import CoTController
+from opentakserver.certificate_authority import CertificateAuthority
+from opentakserver.SocketServer import SocketServer
+try:
+    from opentakserver.mumble.mumble_ice_app import MumbleIceDaemon
+except ModuleNotFoundError:
+    print("Mumble auth not supported on this platform")
+
+
+def init_extensions(app):
+    db.init_app(app)
+
+    # Handle config options that can't be serialized to yaml
+    app.config.update({"SCHEDULER_JOBSTORES": {'default': SQLAlchemyJobStore(url=app.config.get("SQLALCHEMY_DATABASE_URI"))}})
+    identity_attributes = [{"username": {"mapper": uia_username_mapper, "case_insensitive": False}}]
+
+    # Don't allow registration unless email is enabled
+    if app.config.get("OTS_ENABLE_EMAIL"):
+        identity_attributes.append({"email": {"mapper": uia_email_mapper, "case_insensitive": True}})
+        app.config.update({
+            "SECURITY_REGISTERABLE": True,
+            "SECURITY_CONFIRMABLE": True,
+            "SECURITY_RECOVERABLE": True,
+            "SECURITY_TWO_FACTOR_ENABLED_METHODS": ["authenticator", "email"]
+        })
+    else:
+        app.config.update({
+            "SECURITY_REGISTERABLE": False,
+            "SECURITY_CONFIRMABLE": False,
+            "SECURITY_RECOVERABLE": False,
+            "SECURITY_TWO_FACTOR_ENABLED_METHODS": ["authenticator"]
+        })
+    app.config.update({"SECURITY_USER_IDENTITY_ATTRIBUTES": identity_attributes})
+
+    ca = CertificateAuthority(logger, app)
+    ca.create_ca()
+
+    cors = CORS(app, resources={r"/api/*": {"origins": "*"}, r"/Marti/*": {"origins": "*"}, r"/*": {"origins": "*"}},
+                supports_credentials=True)
+    flask_wtf.CSRFProtect(app)
+
+    socketio.init_app(app, logger=logger)
+
+    rabbit_connection = pika.BlockingConnection(pika.ConnectionParameters('localhost'))
+    channel = rabbit_connection.channel()
+    channel.exchange_declare('cot', durable=True, exchange_type='fanout')
+    channel.exchange_declare('dms', durable=True, exchange_type='direct')
+    channel.exchange_declare('chatrooms', durable=True, exchange_type='direct')
+    channel.queue_declare(queue='cot_controller')
+    channel.exchange_declare(exchange='cot_controller', exchange_type='fanout')
+
+    cot_thread = CoTController(app.app_context(), logger, db, socketio)
+    app.cot_thread = cot_thread
+
+    if not apscheduler.running:
+        apscheduler.init_app(app)
+        apscheduler.start(paused=True)
+
+    try:
+        fsqla.FsModels.set_db_info(db)
+    except sqlalchemy.exc.InvalidRequestError:
+        pass
+
+    from opentakserver.models.user import User
+    from opentakserver.models.role import Role
+
+    user_datastore = SQLAlchemyUserDatastore(db, User, Role, WebAuthn)
+    app.security = Security(app, user_datastore, mail_util_cls=EmailValidator)
+
+    mail.init_app(app)
+    with app.app_context():
+        db.create_all()
+
+
+def setup_logging(app):
+    level = logging.INFO
+    if app.config.get("DEBUG"):
+        level = logging.DEBUG
+
+    if sys.stdout.isatty():
+        color_log_handler = colorlog.StreamHandler()
+        color_log_formatter = colorlog.ColoredFormatter(
+            '%(log_color)s[%(asctime)s] - OpenTAKServer[%(process)d] - %(module)s - %(levelname)s - %(message)s', datefmt="%Y-%m-%d %H:%M:%S")
+        color_log_handler.setFormatter(color_log_formatter)
+        logger.setLevel(level)
+        logger.addHandler(color_log_handler)
+        logger.info("Added color logger")
+
+    fh = logging.FileHandler(os.path.join(app.config.get("OTS_DATA_FOLDER"), 'opentakserver.log'))
+    fh.setLevel(level)
+    fh.setFormatter(logging.Formatter("[%(asctime)s] - OpenTAKServer[%(process)d] - %(module)s - %(levelname)s - %(message)s"))
+    logger.addHandler(fh)
+
+
+def create_app():
+    app = Flask(__name__)
+    app.config.from_object(DefaultConfig)
+    setup_logging(app)
+
+    # Load config.yml if it exists
+    if os.path.exists(os.path.join(app.config.get("OTS_DATA_FOLDER"), "config.yml")):
+        app.config.from_file(os.path.join(app.config.get("OTS_DATA_FOLDER"), "config.yml"), load=yaml.safe_load)
+    else:
+        # First run, created config.yml based on default settings
+        logger.info("Creating config.yml")
+        with open(os.path.join(app.config.get("OTS_DATA_FOLDER"), "config.yml"), "w") as config:
+            conf = {}
+            for option in DefaultConfig.__dict__:
+                # Fix the sqlite DB path on Windows
+                if option == "SQLALCHEMY_DATABASE_URI" and platform.system() == "Windows" and DefaultConfig.__dict__[option].startswith("sqlite"):
+                    conf[option] = DefaultConfig.__dict__[option].replace("////", "///").replace("\\", "/")
+                elif option.isupper():
+                    conf[option] = DefaultConfig.__dict__[option]
+            config.write(yaml.safe_dump(conf))
+
+        # Try to set the MediaMTX token
+        try:
+            with open(os.path.join(app.config.get("OTS_DATA_FOLDER"), "mediamtx", "mediamtx.yml"), "r") as mediamtx_config:
+                conf = mediamtx_config.read()
+                conf = conf.replace("MTX_TOKEN", app.config.get("OTS_MEDIAMTX_TOKEN"))
+            with open(os.path.join(app.config.get("OTS_DATA_FOLDER"), "mediamtx", "mediamtx.yml"), "w") as mediamtx_config:
+                mediamtx_config.write(conf)
+        except BaseException as e:
+            logger.error("Failed to set MediaMTX token: {}".format(e))
+
+    init_extensions(app)
+
+    from opentakserver.blueprints.marti import marti_blueprint
+    app.register_blueprint(marti_blueprint)
+
+    from opentakserver.blueprints.api import api_blueprint
+    app.register_blueprint(api_blueprint)
+
+    from opentakserver.blueprints.ots_socketio import ots_socketio_blueprint
+    app.register_blueprint(ots_socketio_blueprint)
+
+    from opentakserver.blueprints.scheduled_jobs import scheduler_blueprint
+    app.register_blueprint(scheduler_blueprint)
+
+    from opentakserver.blueprints.scheduler_api import scheduler_api_blueprint
+    app.register_blueprint(scheduler_api_blueprint)
+
+    from opentakserver.blueprints.config import config_blueprint
+    app.register_blueprint(config_blueprint)
+
+    app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_host=1)
+
+    return app
+
+
+app = create_app()
+
+
+@app.route("/")
+def home():
+    return jsonify([])
+
+
+@app.after_request
+def after_request_func(response):
+    response.direct_passthrough = False
+    return response
+
+
+@user_registered.connect_via(app)
+def user_registered_sighandler(app, user, confirmation_token, **kwargs):
+    default_role = app.security.datastore.find_or_create_role(
+        name="user", permissions={"user-read", "user-write"}
+    )
+    app.security.datastore.add_role_to_user(user, default_role)
+
+
+if __name__ == '__main__':
+    with app.app_context():
+        logger.debug("Loading DB..")
+        db.create_all()
+
+        # Download the icon sets if they aren't already in the DB
+        icons = db.session.query(Icon).count()
+        if icons == 0:
+            logger.info("Downloading icons...")
+            try:
+                r = requests.get("https://github.com/brian7704/OpenTAKServer-Installer/raw/master/iconsets.sqlite", stream=True)
+                with open(os.path.join(app.config.get("OTS_DATA_FOLDER"), "icons.sqlite"), "wb") as f:
+                    f.write(r.content)
+
+                def dict_factory(cursor, row):
+                    d = {}
+                    for idx, col in enumerate(cursor.description):
+                        d[col[0]] = row[idx]
+                    return d
+
+                con = sqlite3.connect(os.path.join(app.config.get("OTS_DATA_FOLDER"), "icons.sqlite"))
+                con.row_factory = dict_factory
+                cur = con.cursor()
+                rows = cur.execute("SELECT * FROM icons")
+                for row in rows:
+                    db.session.execute(insert(Icon).values(**row))
+                db.session.commit()
+            except BaseException as e:
+                logger.error("Failed to download icons: {}".format(e))
+
+        if app.config.get("DEBUG"):
+            logger.debug("Starting in debug mode")
+        else:
+            logger.info("Starting in production mode")
+
+        app.security.datastore.find_or_create_role(
+            name="user", permissions={"user-read", "user-write"}
+        )
+
+        app.security.datastore.find_or_create_role(
+            name="administrator", permissions={"administrator"}
+        )
+
+        if not app.security.datastore.find_user(username="administrator"):
+            logger.info("Creating administrator account. The password is 'password'")
+            app.security.datastore.create_user(username="administrator",
+                                               password=hash_password("password"), roles=["administrator"])
+        db.session.commit()
+
+    tcp_thread = SocketServer(logger, app.app_context(), app.config.get("OTS_TCP_STREAMING_PORT"))
+    tcp_thread.start()
+    app.tcp_thread = tcp_thread
+
+    ssl_thread = SocketServer(logger, app.app_context(), app.config.get("OTS_SSL_STREAMING_PORT"), True)
+    ssl_thread.start()
+    app.ssl_thread = ssl_thread
+
+    if app.config.get("OTS_ENABLE_MUMBLE_AUTHENTICATION"):
+        logger.info("Starting mumble authentication handler")
+        mumble_daemon = MumbleIceDaemon(app, logger)
+        mumble_daemon.daemon = True
+        mumble_daemon.start()
+    else:
+        logger.info("Mumble authentication handler disabled")
+
+    app.start_time = datetime.now()
+
+    socketio.run(app, host="127.0.0.1", port=app.config.get("OTS_LISTENER_PORT"), debug=False, log_output=False)