| import hashlib |
| import hmac |
| import json |
| import logging |
| import time |
| |
| from google.appengine.api import app_identity |
| from google.appengine.api import mail |
| from google.appengine.ext import ndb |
| import webapp2 |
| from webapp2_extras import jinja2 |
| |
| import gatekeeper_mailer |
| |
| |
| class MailerSecret(ndb.Model): |
| """Model to represent the shared secret for the mail endpoint.""" |
| secret = ndb.StringProperty() |
| |
| |
| class BaseHandler(webapp2.RequestHandler): |
| """Provide a cached Jinja environment to each request.""" |
| @webapp2.cached_property |
| def jinja2(self): |
| # Returns a Jinja2 renderer cached in the app registry. |
| return jinja2.get_jinja2(app=self.app) |
| |
| def render_response(self, _template, **context): |
| # Renders a template and writes the result to the response. |
| rv = self.jinja2.render_template(_template, **context) |
| self.response.write(rv) |
| |
| |
| class MainPage(BaseHandler): |
| def get(self): |
| context = {'title': 'Chromium Gatekeeper Mailer'} |
| self.render_response('main_mailer.html', **context) |
| |
| |
| class Email(BaseHandler): |
| @staticmethod |
| def linear_compare(a, b): |
| """Scan through the entire string even if a mismatch is detected early. |
| |
| This thwarts timing attacks attempting to guess the key one byte at a |
| time. |
| """ |
| if len(a) != len(b): |
| return False |
| result = 0 |
| for x, y in zip(a, b): |
| result |= ord(x) ^ ord(y) |
| return result == 0 |
| |
| @staticmethod |
| def _validate_message(message, url, secret): |
| """Cryptographically validates the message.""" |
| mytime = time.time() |
| |
| if abs(mytime - message['time']) > 60: |
| logging.error('message was rejected due to time') |
| return False |
| |
| cleaned_url = url.rstrip('/') + '/' |
| cleaned_message_url = message['url'].rstrip('/') + '/' |
| |
| if cleaned_message_url != cleaned_url: |
| logging.error('message URL did not match: %s vs %s', cleaned_message_url, |
| cleaned_url) |
| return False |
| |
| hasher = hmac.new(str(secret), message['message'], hashlib.sha256) |
| hasher.update(str(message['time'])) |
| hasher.update(str(message['salt'])) |
| |
| client_hash = hasher.hexdigest() |
| |
| return Email.linear_compare(client_hash, message['hmac-sha256']) |
| |
| @staticmethod |
| def _verify_json(build_data): |
| """Verifies that the submitted JSON contains all the proper fields.""" |
| fields = ['waterfall_url', |
| 'build_url', |
| 'project_name', |
| 'builderName', |
| 'steps', |
| 'unsatisfied', |
| 'revisions', |
| 'blamelist', |
| 'result', |
| 'number', |
| 'changes', |
| 'reason', |
| 'recipients'] |
| |
| for field in fields: |
| if field not in build_data: |
| logging.error('build_data did not contain field %s' % field) |
| return False |
| |
| step_fields = ['started', |
| 'text', |
| 'results', |
| 'name', |
| 'logs', |
| 'urls'] |
| |
| if not build_data['steps']: |
| logging.error('build_data did not contain any steps') |
| return False |
| for step in build_data['steps']: |
| for field in step_fields: |
| if field not in step: |
| logging.error('build_step did not contain field %s' % field) |
| return False |
| |
| return True |
| |
| def post(self): |
| blob = self.request.get('json') |
| if not blob: |
| self.response.out.write('no json data sent') |
| logging.error('error no json sent') |
| self.error(400) |
| return |
| |
| message = {} |
| try: |
| message = json.loads(blob) |
| except ValueError as e: |
| self.response.out.write('couldn\'t decode json') |
| logging.error('error decoding incoming json: %s' % e) |
| self.error(400) |
| return |
| |
| secret = MailerSecret.get_or_insert('mailer_secret').secret |
| if not secret: |
| self.response.out.write('unauthorized') |
| logging.critical('mailer shared secret has not been set!') |
| self.error(500) |
| return |
| |
| if not self._validate_message(message, self.request.url, secret): |
| self.response.out.write('unauthorized') |
| logging.error('incoming message did not validate') |
| self.error(403) |
| return |
| |
| try: |
| build_data = json.loads(message['message']) |
| except ValueError as e: |
| self.response.out.write('couldn\'t decode payload json') |
| logging.error('error decoding incoming json: %s' % e) |
| self.error(400) |
| return |
| |
| if not self._verify_json(build_data): |
| logging.error('error verifying incoming json: %s' % build_data) |
| self.response.out.write('json build format is incorrect') |
| self.error(400) |
| return |
| |
| # Emails can only come from the app ID, so we split on '@' here just in |
| # case the user specified a full email address. |
| from_addr_prefix = build_data.get('from_addr', 'buildbot').split('@')[0] |
| from_addr = from_addr_prefix + '@%s.appspotmail.com' % ( |
| app_identity.get_application_id()) |
| |
| subject_template = build_data.get('subject_template') |
| |
| recipients = ', '.join(build_data['recipients']) |
| |
| template = gatekeeper_mailer.MailTemplate(build_data['waterfall_url'], |
| build_data['build_url'], |
| build_data['project_name'], |
| from_addr, |
| subject=subject_template) |
| |
| |
| text_content, html_content, subject = template.genMessageContent(build_data) |
| |
| mail_override = ['stip@chromium.org', |
| 'gatekeeper-ng@chromium-gatekeeper-sentry.appspotmail.com'] |
| |
| whitelist = ['jschuh'] |
| |
| for alias in whitelist: |
| for domain in ('@chromium.org', '@google.com'): |
| candidate = alias + domain |
| if candidate in recipients: |
| mail_override.append(candidate) |
| |
| message = mail.EmailMessage(sender=from_addr, |
| subject=subject, |
| #to=recipients, |
| to=mail_override, |
| body=text_content, |
| html=html_content) |
| logging.info('sending email to %s', recipients) |
| logging.info('sending from %s', from_addr) |
| logging.info('subject is %s', subject) |
| message.send() |
| self.response.out.write('email sent') |
| |
| |
| app = webapp2.WSGIApplication([('/mailer', MainPage), |
| ('/mailer/email', Email)], |
| debug=True) |