File: manhole.py

package info (click to toggle)
mautrix-python 0.20.7-1
  • links: PTS, VCS
  • area: main
  • in suites: sid, trixie
  • size: 1,812 kB
  • sloc: python: 19,103; makefile: 16
file content (348 lines) | stat: -rw-r--r-- 10,741 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
# Copyright (c) 2022 Tulir Asokan
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
#
# Based on https://github.com/nhoad/aiomanhole Copyright (c) 2014, Nathan Hoad
from typing import Any, Callable, Dict, List, Optional, Set, Tuple, Type, Union
from abc import ABC, abstractmethod
from io import BytesIO, StringIO
from socket import SOL_SOCKET
from types import CodeType
import ast
import asyncio
import codeop
import contextlib
import functools
import inspect
import logging
import os
import pwd
import struct
import sys
import traceback

try:
    from socket import SO_PEERCRED
except ImportError:
    SO_PEERCRED = None

log = logging.getLogger("mau.manhole")


TOP_LEVEL_AWAIT = sys.version_info >= (3, 8)
ASYNC_EVAL_WRAPPER: str = """
async def __eval_async_expr():
    try:
        pass
    finally:
        globals().update(locals())
"""


def compile_async(tree: ast.AST) -> CodeType:
    flags = 0
    if TOP_LEVEL_AWAIT:
        flags += ast.PyCF_ALLOW_TOP_LEVEL_AWAIT
        node_to_compile = tree
    else:
        insert_returns(tree.body)
        wrapper_node: ast.AST = ast.parse(ASYNC_EVAL_WRAPPER, "<async eval wrapper>", "single")
        method_stmt = wrapper_node.body[0]
        try_stmt = method_stmt.body[0]
        try_stmt.body = tree.body
        node_to_compile = wrapper_node
    return compile(node_to_compile, "<manhole input>", "single", flags=flags)


# From https://gist.github.com/nitros12/2c3c265813121492655bc95aa54da6b9
def insert_returns(body: List[ast.AST]) -> None:
    if isinstance(body[-1], ast.Expr):
        body[-1] = ast.Return(body[-1].value)
        ast.fix_missing_locations(body[-1])
    elif isinstance(body[-1], ast.If):
        insert_returns(body[-1].body)
        insert_returns(body[-1].orelse)
    elif isinstance(body[-1], (ast.With, ast.AsyncWith)):
        insert_returns(body[-1].body)


class StatefulCommandCompiler(codeop.CommandCompiler):
    """A command compiler that buffers input until a full command is available."""

    buf: BytesIO

    def __init__(self) -> None:
        super().__init__()
        self.compiler = functools.partial(
            compile,
            optimize=1,
            flags=(
                ast.PyCF_ONLY_AST
                | codeop.PyCF_DONT_IMPLY_DEDENT
                | codeop.PyCF_ALLOW_INCOMPLETE_INPUT
            ),
        )
        self.buf = BytesIO()

    def is_partial_command(self) -> bool:
        return bool(self.buf.getvalue())

    def __call__(self, source: bytes, **kwargs: Any) -> Optional[CodeType]:
        buf = self.buf
        if self.is_partial_command():
            buf.write(b"\n")
        buf.write(source)

        code = self.buf.getvalue().decode("utf-8")
        codeobj = super().__call__(code, **kwargs)

        if codeobj:
            self.reset()
            return compile_async(codeobj)
        return None

    def reset(self) -> None:
        self.buf.seek(0)
        self.buf.truncate(0)


class Interpreter(ABC):
    @abstractmethod
    def __init__(self, namespace: Dict[str, Any], banner: Union[bytes, str]) -> None:
        pass

    @abstractmethod
    def close(self) -> None:
        pass

    @abstractmethod
    async def __call__(self, reader: asyncio.StreamReader, writer: asyncio.StreamWriter) -> None:
        pass


class AsyncInterpreter(Interpreter):
    """An interactive asynchronous interpreter."""

    reader: asyncio.StreamReader
    writer: asyncio.StreamWriter
    namespace: Dict[str, Any]
    banner: bytes
    compiler: StatefulCommandCompiler
    running: bool

    def __init__(self, namespace: Dict[str, Any], banner: Union[bytes, str]) -> None:
        super().__init__(namespace, banner)
        self.namespace = namespace
        self.banner = banner if isinstance(banner, bytes) else str(banner).encode("utf-8")
        self.compiler = StatefulCommandCompiler()

    async def send_exception(self) -> None:
        """When an exception has occurred, write the traceback to the user."""
        self.compiler.reset()

        exc = traceback.format_exc()
        self.writer.write(exc.encode("utf-8"))

        await self.writer.drain()

    async def execute(self, codeobj: CodeType) -> Tuple[Any, str]:
        with contextlib.redirect_stdout(StringIO()) as buf:
            if TOP_LEVEL_AWAIT:
                value = eval(codeobj, self.namespace)
                if codeobj.co_flags & inspect.CO_COROUTINE:
                    value = await value
            else:
                exec(codeobj, self.namespace)
                value = await eval("__eval_async_expr()", self.namespace)

        return value, buf.getvalue()

    async def handle_one_command(self) -> None:
        """Process a single command. May have many lines."""

        while True:
            await self.write_prompt()
            codeobj = await self.read_command()

            if codeobj is not None:
                await self.run_command(codeobj)
                return

    async def run_command(self, codeobj: CodeType) -> None:
        """Execute a compiled code object, and write the output back to the client."""
        try:
            value, stdout = await self.execute(codeobj)
        except Exception:
            await self.send_exception()
            return
        else:
            await self.send_output(value, stdout)

    async def write_prompt(self) -> None:
        writer = self.writer

        if self.compiler.is_partial_command():
            writer.write(b"... ")
        else:
            writer.write(b">>> ")

        await writer.drain()

    async def read_command(self) -> Optional[CodeType]:
        """Read a command from the user line by line.

        Returns a code object suitable for execution.
        """

        reader = self.reader

        line = await reader.readline()
        if line == b"":
            raise ConnectionResetError()

        try:
            # skip the newline to make CommandCompiler work as advertised
            codeobj = self.compiler(line.rstrip(b"\n"))
        except SyntaxError:
            await self.send_exception()
            return None

        return codeobj

    async def send_output(self, value: str, stdout: str) -> None:
        """Write the output or value of the expression back to user.

        >>> 5
        5
        >>> print('cash rules everything around me')
        cash rules everything around me
        """

        writer = self.writer

        if value is not None:
            writer.write(f"{value!r}\n".encode("utf-8"))

        if stdout:
            writer.write(stdout.encode("utf-8"))

        await writer.drain()

    def close(self) -> None:
        if self.running:
            self.writer.close()
            self.running = False

    async def __call__(self, reader: asyncio.StreamReader, writer: asyncio.StreamWriter) -> None:
        """Main entry point for an interpreter session with a single client."""
        self.reader = reader
        self.writer = writer
        self.running = True

        if self.banner:
            writer.write(self.banner)
            await writer.drain()

        while self.running:
            try:
                await self.handle_one_command()
            except ConnectionResetError:
                writer.close()
                self.running = False
                break
            except Exception:
                log.exception("Exception in manhole REPL")
                self.writer.write(traceback.format_exc())
                await self.writer.drain()


class InterpreterFactory:
    namespace: Dict[str, Any]
    banner: bytes
    interpreter_class: Type[Interpreter]
    clients: List[Interpreter]
    whitelist: Set[int]
    _conn_id: int

    def __init__(
        self,
        namespace: Dict[str, Any],
        banner: Union[bytes, str],
        interpreter_class: Type[Interpreter],
        whitelist: Set[int],
    ) -> None:
        self.namespace = namespace or {}
        self.banner = banner
        self.interpreter_class = interpreter_class
        self.clients = []
        self.whitelist = whitelist
        self._conn_id = 0

    @property
    def conn_id(self) -> int:
        self._conn_id += 1
        return self._conn_id

    async def __call__(self, reader: asyncio.StreamReader, writer: asyncio.StreamWriter) -> None:
        sock = writer.transport.get_extra_info("socket")
        # TODO support non-linux OSes
        # I think FreeBSD uses SCM_CREDS
        creds = sock.getsockopt(SOL_SOCKET, SO_PEERCRED, struct.calcsize("3i"))
        pid, uid, gid = struct.unpack("3i", creds)
        user_info = pwd.getpwuid(uid)
        username = f"{user_info.pw_name} ({uid})" if user_info and user_info.pw_name else uid
        if len(self.whitelist) > 0 and uid not in self.whitelist:
            writer.write(b"You are not whitelisted to use the manhole.")
            log.warning(f"Non-whitelisted user {username} tried to connect from PID {pid}")
            await writer.drain()
            writer.close()
            return

        namespace = {**self.namespace}
        interpreter = self.interpreter_class(namespace=namespace, banner=self.banner)
        namespace["exit"] = interpreter.close
        self.clients.append(interpreter)
        conn_id = self.conn_id

        log.info(f"Manhole connection OPENED: {conn_id} from PID {pid} by {username}")
        await asyncio.create_task(interpreter(reader, writer))
        log.info(f"Manhole connection CLOSED: {conn_id} from PID {pid} by {username}")
        self.clients.remove(interpreter)


async def start_manhole(
    path: str,
    banner: str = "",
    namespace: Optional[Dict[str, Any]] = None,
    loop: asyncio.AbstractEventLoop = None,
    whitelist: Set[int] = None,
) -> Tuple[asyncio.AbstractServer, Callable[[], None]]:
    """
    Starts a manhole server on a given UNIX address.

    Args:
        path: The path to create the UNIX socket at.
        banner: The banner to show when clients connect.
        namespace: The globals to provide to connected clients.
        loop: The asyncio event loop to use.
        whitelist: List of user IDs to allow connecting.
    """
    if not SO_PEERCRED:
        raise ValueError("SO_PEERCRED is not supported on this platform")
    factory = InterpreterFactory(
        namespace=namespace,
        banner=banner,
        interpreter_class=AsyncInterpreter,
        whitelist=whitelist,
    )
    server = await asyncio.start_unix_server(factory, path=path)
    os.chmod(path, 0o666)

    def stop():
        for client in factory.clients:
            client.close()
        server.close()

    return server, stop