Passthrough.py

#!/usr/bin/env python

from __future__ import with_statement

import os
import sys

basedir = os.path.abspath(os.path.join(os.path.dirname(sys.argv[0]), '..'))
if (os.path.exists(os.path.join(basedir, 'setup.py')) and
    os.path.exists(os.path.join(basedir, 'src', 'pyfuse3.pyx'))):
    sys.path.insert(0, os.path.join(basedir, 'src'))

import errno
import random
import os.path
import time
from pymongo import MongoClient
import shutil
import pyclamd
import pyfuse3
from argparse import ArgumentParser
import errno
import logging
import stat as stat_m
from pyfuse3 import FUSEError
from os import fsencode, fsdecode
from collections import defaultdict
import trio
import codecs

import faulthandler
faulthandler.enable()


import pyfuse3
from pyfuse3 import FUSEError
from pymongo import MongoClient
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
import smtplib
import trio

cliente = MongoClient('mongodb://localhost:27017/')
mongo = cliente['fuse']

class Passthrough(pyfuse3.Operations):
    def __init__(self, root):
        # caminho do moutpoint
        super().__init__()
        self._inode_path_map = { pyfuse3.ROOT_INODE: root }
        self._lookup_cnt = defaultdict(lambda : 0)
        self._fd_inode_map = dict()
        self._inode_fd_map = dict()
        self._fd_open_count = dict()
        # variavel que indica que user esta autenticado
        self.autenticadoB = False
        # tempo em que foi requisitado o codigo
        self.tinicial = time.time()
        self.safenumber = 0
        self.lastContextt = None
        self.clamav = pyclamd.ClamdAgnostic()
    
    def _inode_to_path(self, inode):
        
        try:
            val = self._inode_path_map[inode]
        except KeyError:
            raise FUSEError(errno.ENOENT)

        if isinstance(val, set):
            # In case of hardlinks, pick any path
            val = next(iter(val))
        return val

    def _add_path(self, inode, path):
        self._lookup_cnt[inode] += 1

        # With hardlinks, one inode may map to multiple paths.
        if inode not in self._inode_path_map:
            self._inode_path_map[inode] = path
            return

        val = self._inode_path_map[inode]
        if isinstance(val, set):
            val.add(path)
        elif val != path:
            self._inode_path_map[inode] = { path, val }

    async def forget(self, inode_list):
        for (inode, nlookup) in inode_list:
            if self._lookup_cnt[inode] > nlookup:
                self._lookup_cnt[inode] -= nlookup
                continue
            assert inode not in self._inode_fd_map
            del self._lookup_cnt[inode]
            try:
                del self._inode_path_map[inode]
            except KeyError: # may have been deleted
                pass

    async def lookup(self, inode_p, name, ctx=None):
        self.autenticado(ctx)
        self.lastContextt = ctx
        
        if not self.autenticadoB:
            raise FUSEError(1)
        name = fsdecode(name)
        path = os.path.join(self._inode_to_path(inode_p), name)
        attr = self._getattr(path=path)
        if name != '.' and name != '..':
            self._add_path(attr.st_ino, path)
        return attr

    async def getattr(self, inode, ctx=None):
        if ctx == None:
            raise FUSEError(1)
        self.autenticado(ctx)
        self.lastContextt = ctx
        
        if not self.autenticadoB:
            raise FUSEError(1)
        if inode in self._inode_fd_map:
            return self._getattr(fd=self._inode_fd_map[inode])
        else:
            return self._getattr(path=self._inode_to_path(inode))

    def _getattr(self, path=None, fd=None):
        assert fd is None or path is None
        assert not(fd is None and path is None)
        try:
            if fd is None:
                stat = os.lstat(path)
            else:
                stat = os.fstat(fd)
        except OSError as exc:
            raise FUSEError(exc.errno)

        entry = pyfuse3.EntryAttributes()
        for attr in ('st_ino', 'st_mode', 'st_nlink', 'st_uid', 'st_gid',
                     'st_rdev', 'st_size', 'st_atime_ns', 'st_mtime_ns',
                     'st_ctime_ns'):
            setattr(entry, attr, getattr(stat, attr))
        entry.generation = 0
        entry.entry_timeout = 0
        entry.attr_timeout = 0
        entry.st_blksize = 512
        entry.st_blocks = ((entry.st_size+entry.st_blksize-1) // entry.st_blksize)

        return entry

    async def readlink(self, inode, ctx):
        self.autenticado(ctx)
        self.lastContextt = ctx
        
        if not self.autenticadoB:
            raise FUSEError(1)
        path = self._inode_to_path(inode)
        try:
            target = os.readlink(path)
        except OSError as exc:
            raise FUSEError(exc.errno)
        return fsencode(target)

    async def opendir(self, inode, ctx):
        self.autenticado(ctx)
        self.lastContextt = ctx
        
        if not self.autenticadoB:
            raise FUSEError(1)
        return inode

    async def readdir(self, inode, off, token):
        path = self._inode_to_path(inode)

        entries = []
        for name in os.listdir(path):
            if name == '.' or name == '..':
                continue
            attr = self._getattr(path=os.path.join(path, name))
            entries.append((attr.st_ino, name, attr))



        # This is not fully posix compatible. If there are hardlinks
        # (two names with the same inode), we don't have a unique
        # offset to start in between them. Note that we cannot simply
        # count entries, because then we would skip over entries
        # (or return them more than once) if the number of directory
        # entries changes between two calls to readdir().
        for (ino, name, attr) in sorted(entries):
            if ino <= off:
                continue
            if not pyfuse3.readdir_reply(
                token, fsencode(name), attr, ino):
                break
            self._add_path(attr.st_ino, os.path.join(path, name))

    async def unlink(self, inode_p, name, ctx):
        self.autenticado(ctx)
        self.lastContextt = ctx
        
        if not self.autenticadoB:
            raise FUSEError(1)
        
        name = fsdecode(name)
        parent = self._inode_to_path(inode_p)
        path = os.path.join(parent, name)
        try:
            inode = os.lstat(path).st_ino
            os.unlink(path)
        except OSError as exc:
            raise FUSEError(exc.errno)
        if inode in self._lookup_cnt:
            self._forget_path(inode, path)

    async def rmdir(self, inode_p, name, ctx):
        self.autenticado(ctx)
        self.lastContextt = ctx
        
        if not self.autenticadoB:
            raise FUSEError(1)
        
        name = fsdecode(name)
        parent = self._inode_to_path(inode_p)
        path = os.path.join(parent, name)
        try:
            inode = os.lstat(path).st_ino
            os.rmdir(path)
        except OSError as exc:
            raise FUSEError(exc.errno)
        if inode in self._lookup_cnt:
            self._forget_path(inode, path)

    def _forget_path(self, inode, path):
        val = self._inode_path_map[inode]
        if isinstance(val, set):
            val.remove(path)
            if len(val) == 1:
                self._inode_path_map[inode] = next(iter(val))
        else:
            del self._inode_path_map[inode]

    async def symlink(self, inode_p, name, target, ctx):
        self.autenticado(ctx)
        self.lastContextt = ctx
        
        if not self.autenticadoB:
            raise FUSEError(1)
        
        name = fsdecode(name)
        target = fsdecode(target)
        parent = self._inode_to_path(inode_p)
        path = os.path.join(parent, name)
        try:
            os.symlink(target, path)
            os.chown(path, ctx.uid, ctx.gid, follow_symlinks=False)
        except OSError as exc:
            raise FUSEError(exc.errno)
        stat = os.lstat(path)
        self._add_path(stat.st_ino, path)
        return await self.getattr(stat.st_ino,ctx)

    async def rename(self, inode_p_old, name_old, inode_p_new, name_new,
                     flags, ctx):
        self.autenticado(ctx)
        self.lastContextt = ctx
        
        if not self.autenticadoB:
            raise FUSEError(1)
        
        if flags != 0:
            raise FUSEError(errno.EINVAL)

        name_old = fsdecode(name_old)
        name_new = fsdecode(name_new)
        parent_old = self._inode_to_path(inode_p_old)
        parent_new = self._inode_to_path(inode_p_new)
        path_old = os.path.join(parent_old, name_old)
        path_new = os.path.join(parent_new, name_new)
        try:
            os.rename(path_old, path_new)
            inode = os.lstat(path_new).st_ino
        except OSError as exc:
            raise FUSEError(exc.errno)
        if inode not in self._lookup_cnt:
            return

        val = self._inode_path_map[inode]
        if isinstance(val, set):
            assert len(val) > 1
            val.add(path_new)
            val.remove(path_old)
        else:
            assert val == path_old
            self._inode_path_map[inode] = path_new

    async def link(self, inode, new_inode_p, new_name, ctx):
        self.autenticado(ctx)
        self.lastContextt = ctx
        
        if not self.autenticadoB:
            raise FUSEError(1)
        
        new_name = fsdecode(new_name)
        parent = self._inode_to_path(new_inode_p)
        path = os.path.join(parent, new_name)
        try:
            os.link(self._inode_to_path(inode), path, follow_symlinks=False)
        except OSError as exc:
            raise FUSEError(exc.errno)
        self._add_path(inode, path)
        return await self.getattr(inode,ctx)

    async def setattr(self, inode, attr, fields, fh, ctx):
        # We use the f* functions if possible so that we can handle
        # a setattr() call for an inode without associated directory
        # handle.
        self.autenticado(ctx)
        self.lastContextt = ctx
        
        if not self.autenticadoB:
            raise FUSEError(1)
        
        if fh is None:
            path_or_fh = self._inode_to_path(inode)
            truncate = os.truncate
            chmod = os.chmod
            chown = os.chown
            stat = os.lstat
        else:
            path_or_fh = fh
            truncate = os.ftruncate
            chmod = os.fchmod
            chown = os.fchown
            stat = os.fstat

        try:
            if fields.update_size:
                truncate(path_or_fh, attr.st_size)

            if fields.update_mode:
                # Under Linux, chmod always resolves symlinks so we should
                # actually never get a setattr() request for a symbolic
                # link.
                assert not stat_m.S_ISLNK(attr.st_mode)
                chmod(path_or_fh, stat_m.S_IMODE(attr.st_mode))

            if fields.update_uid:
                chown(path_or_fh, attr.st_uid, -1, follow_symlinks=False)

            if fields.update_gid:
                chown(path_or_fh, -1, attr.st_gid, follow_symlinks=False)

            if fields.update_atime and fields.update_mtime:
                if fh is None:
                    os.utime(path_or_fh, None, follow_symlinks=False,
                             ns=(attr.st_atime_ns, attr.st_mtime_ns))
                else:
                    os.utime(path_or_fh, None,
                             ns=(attr.st_atime_ns, attr.st_mtime_ns))
            elif fields.update_atime or fields.update_mtime:
                # We can only set both values, so we first need to retrieve the
                # one that we shouldn't be changing.
                oldstat = stat(path_or_fh)
                if not fields.update_atime:
                    attr.st_atime_ns = oldstat.st_atime_ns
                else:
                    attr.st_mtime_ns = oldstat.st_mtime_ns
                if fh is None:
                    os.utime(path_or_fh, None, follow_symlinks=False,
                             ns=(attr.st_atime_ns, attr.st_mtime_ns))
                else:
                    os.utime(path_or_fh, None,
                             ns=(attr.st_atime_ns, attr.st_mtime_ns))

        except OSError as exc:
            raise FUSEError(exc.errno)

        return await self.getattr(inode,ctx)

    async def mknod(self, inode_p, name, mode, rdev, ctx):
        self.autenticado(ctx)
        self.lastContextt = ctx
        
        if not self.autenticadoB:
            raise FUSEError(1)
        
        path = os.path.join(self._inode_to_path(inode_p), fsdecode(name))
        try:
            os.mknod(path, mode=(mode & ~ctx.umask), device=rdev)
            os.chown(path, ctx.uid, ctx.gid)
        except OSError as exc:
            raise FUSEError(exc.errno)
        attr = self._getattr(path=path)
        self._add_path(attr.st_ino, path)
        return attr

    async def mkdir(self, inode_p, name, mode, ctx):
        self.autenticado(ctx)
        self.lastContextt = ctx
        
        if not self.autenticadoB:
            raise FUSEError(1)
        
        path = os.path.join(self._inode_to_path(inode_p), fsdecode(name))
        try:
            os.mkdir(path, mode=(mode & ~ctx.umask))
            os.chown(path, ctx.uid, ctx.gid)
        except OSError as exc:
            raise FUSEError(exc.errno)
        attr = self._getattr(path=path)
        self._add_path(attr.st_ino, path)
        return attr

    async def statfs(self, ctx):
        self.autenticado(ctx)
        self.lastContextt = ctx
        
        if not self.autenticadoB:
            raise FUSEError(1)
        
        root = self._inode_path_map[pyfuse3.ROOT_INODE]
        stat_ = pyfuse3.StatvfsData()
        try:
            statfs = os.statvfs(root)
        except OSError as exc:
            raise FUSEError(exc.errno)
        for attr in ('f_bsize', 'f_frsize', 'f_blocks', 'f_bfree', 'f_bavail',
                     'f_files', 'f_ffree', 'f_favail'):
            setattr(stat_, attr, getattr(statfs, attr))
        stat_.f_namemax = statfs.f_namemax - (len(root)+1)
        return stat_

    async def open(self, inode, flags, ctx):
        self.autenticado(ctx)
        self.lastContextt = ctx
        
        if not self.autenticadoB:
            raise FUSEError(1)
        
        fdt = os.open(self._inode_to_path(inode), os.O_RDONLY)
        os.lseek(fdt, 0, 0) 
        buffe = os.read(fdt,os.stat(self._inode_to_path(inode)).st_size)
        self.backupFile = buffe
        os.close(fdt)
        
        if inode in self._inode_fd_map:
            print("AKI")
            fd = self._inode_fd_map[inode]
            print("Foi buscar o File descriptor " +  str(fd) )
            self._fd_open_count[fd] += 1
            return pyfuse3.FileInfo(fh=fd)
        assert flags & os.O_CREAT == 0
        
        try:
            fd = os.open(self._inode_to_path(inode), flags)
            print("Abriu o file descriptor " + str(fd))
        except OSError as exc:
            raise FUSEError(exc.errno)
        self._inode_fd_map[inode] = fd
        self._fd_inode_map[fd] = inode
        self._fd_open_count[fd] = 1
        return pyfuse3.FileInfo(fh=fd)

    async def create(self, inode_p, name, mode, flags, ctx):
        self.autenticado(ctx)
        self.lastContextt = ctx
        if not self.autenticadoB:
            raise FUSEError(1)
        
        path = os.path.join(self._inode_to_path(inode_p), fsdecode(name))
        try:
            fd = os.open(path, flags | os.O_CREAT | os.O_TRUNC)
            print("Criou o ficheiro " + str(fd))
            os.read(fd,1)
        except OSError as exc:
            raise FUSEError(exc.errno)
        attr = self._getattr(fd=fd)
        self._add_path(attr.st_ino, path)
        self._inode_fd_map[attr.st_ino] = fd
        self._fd_inode_map[fd] = attr.st_ino
        self._fd_open_count[fd] = 1
        return (fd, attr)

    async def read(self, fd, offset, length):
        os.lseek(fd, offset, os.SEEK_SET)
        return os.read(fd, length)

    async def write(self, fd, offset, buf):
        #se 92% dos elementos inseridos estiverem com uma presença similar á probabilidade média
        # de todos os elementos é copiado o ficheiro por segrança
        inodel = self._fd_inode_map[fd]
        path = self._inode_to_path(inodel)
        print("Caminho -> " + path)
        print(buf)
        virus = self.clamav.scan_stream((codecs.getdecoder("unicode_escape")(buf)[0]).encode("utf-8"))
        print(virus)
        if not virus is None:
            print("Encontrou Virus")
            mongo.virus.insert({"userId": self.lastContextt.uid, "time": time.time(), "virus": virus })
            return os.write(fd,self.backupFile)
        
        if not self.entropia(buf):
            
            
            
            names = path.split("/")
            dirpath = ""
            for i in range(1,len(names)-1):
            	dirpath = dirpath + "/" + names[i]
            if len(names) > 1:
            	dirpath = dirpath + "/"
            try:
                #cria diretoria com permissões de leitura apenas
                if not os.path.isdir("/safe"):
                    os.mkdir("safe")
                    print("Created Safe")
            except:
                print("directory exists!!")
            file_path = names[len(names)-1]
            #copia para o diretório safe
            if not os.path.isdir("safe/" + dirpath):
            	os.system("mkdir -p " + "safe/"+ dirpath)
            
            #renomeia o ficheiro guardado para precaver vários ataques diferentes
            
            try:
                file_d = os.open("safe/" + dirpath + str(self.safenumber)+ file_path,os.O_WRONLY | os.O_TRUNC | os.O_CREAT)
                os.lseek(file_d,0,0)
                os.write(file_d,self.backupFile)
                os.close(file_d)
            	#shutil.copyfile(path,"safe/" + dirpath + str(self.safenumber)+ file_path,follow_symlinks=True)
            	#os.system("cp " + path + " " + names[0] + "/" + "safe/" + dirpath + str(self.safenumber)+ file_path)
                os.system("chmod 0200 " +"safe/" + dirpath + str(self.safenumber)+ file_path)
            except :
                print("Deu Exception")
            self.safenumber += 1
            mongo.ransomware.insert({"userId": self.lastContextt.uid, "time": time.time()})
        os.lseek(fd, offset, os.SEEK_SET)
        return os.write(fd, buf)

    async def release(self, fd):
        print("Entrei no Release")
        if self._fd_open_count[fd] > 1:
            self._fd_open_count[fd] -= 1
            print("decrementou 1")
            return

        del self._fd_open_count[fd]
        inode = self._fd_inode_map[fd]
        del self._inode_fd_map[inode]
        del self._fd_inode_map[fd]
        try:
            os.close(fd)
            print("fechou " + str(fd)) 
        except OSError as exc:
            raise FUSEError(exc.errno)

    
    def autenticado(self,ctx):
        # Vai buscar user
        timedif = 0
        #print("Acesso feito por" + str(ctx.uid))
        resultado = mongo.log.find_one({"userId": str(ctx.uid),"acess": "valid"})
        if not resultado == None:
            timedif = time.time() - resultado["time"]
            self.autenticadoB = True
        
        # user tem 2 mnutos de acesso
        if self.autenticadoB == True and timedif > 120000000:
            mongo.log.update({"userId": str(ctx.uid),"acess": "valid"},{"userId": str(ctx.uid),"time": resultado["time"],"acess": "invalid"})
            self.autenticadoB = False
           
    def entropia(self,buf):
        ocorrencias = {}
        for c in buf:
            if c in ocorrencias:
                ocorrencias[c] = ocorrencias[c] + 1
            else:
                ocorrencias[c] = 1
        prob = []
        length = len(buf)
        # calcula probabilidade de cada elemento distinto
        for c in ocorrencias:
            prob.append(ocorrencias[c]/length)
            length2 = len(ocorrencias)
            randomelements = 0
        probmedia = 1/len(ocorrencias)
        # Caso 92% dos elementos ou mais tenham uma distribuicao entre  48% e 52% assume-se que e um elemento usado para cifrar
        for p in prob:
            if p > (probmedia -0.02) and p < (probmedia + 0.02):
                randomelements += 1
        if randomelements/length2 > 0.92:
            return True
        return False



def main(mountpoint, root):
    passt = Passthrough(root)
    fuse_options = set()
    fuse_options.add('fsname=passthroughfs')
    fuse_options.add('allow_other')
    
    
    try:
        pyfuse3.init(passt,mountpoint,fuse_options)
        trio.run(pyfuse3.main)
    except:
        pyfuse3.close(unmount=False)
        raise


if __name__ == '__main__':
    main(sys.argv[2], sys.argv[1])