arturhoo / sns-twilio

A gateway between AWS' SNS and Twilio

sns-twilio

A gateway between AWS' SNS and Twilio. Since SNS only sends SMSes to the US, this Flask app exposes an HTTP endpoint for SNS, and then forwards the messages as SMSes worldwide thanks to Twilio.

There is a basic web interface for admin tasks.

Setup

General system requirements: build-essential, swig.

The python requirements are specified in requirements.txt.

A local_settings.py file must exist. Here is how it should be populated:

# Twilio settings
ACCOUNT_SID = "d41d8cd98f00b204e9800998ecf8427e"
AUTH_TOKEN = "df5ea29924d39c3be8785734f13169c6"
FROM_NUMBER = "[phone]"

# Flask settings
FLASK_SECRET_KEY = "2095497fef8978477de913f147446421"
SNS_ENDPOINT = "b113256183c5983c9989d8ff86cf62b4"
PRE_SUBJECT = ""

Deploying

We are running SNS-Twilio in production using:

• OS: Ubuntu Server 12.04
• Static server and reverse proxy: Nginx
• App server: uWSGI
• Monitoring: Supervisor

Here are the relevant configuration files:

/etc/nginx/sites-available/sns-twilio

server {
        listen PORT;
        server_name SERVER_NAME;

        location / { try_files $uri @yourapplication; }

        location @yourapplication {
                include uwsgi_params;
                uwsgi_pass unix:/tmp/sns-twilio.sock;
        }

        location /static {
                alias /PATH/TO/SNS-TWILIO/static/;
                autoindex off;
        }

        location /favicon.ico {
                alias /PATH/TO/SNS-TWILIO/static/favicon.ico;
        }

}

sns-twilio.ini

[uwsgi]
socket = /tmp/%n.sock
module = app:app
processes = 1
master = 1
logto = /var/log/uwsgi/%n.log
virtualenv = /PATH/TO/VIRTUALENV
chmod-socket = 777

/etc/supervisor/conf.d/sns-twilio.conf

[program:sns-twilio]
command=/PATH/TO/VIRTUALENV/bin/uwsgi --ini sns-twilio.ini
directory=/PATH/TO/SNS-TWILIO
user=USER
stdout_logfile=/var/log/supervisor/sns-twilio-out.log
stderr_logfile=/var/log/supervisor/sns-twilio-err.log
autostart=true

Thanks

• Flask
• SQL Alchemy
• M2Crypto
• Requests
• Bootstrap

License

MIT

sns-twilio's Issues

SNS signature verification code has a bug with certificate URL regexp

While refactoring the sns.py code to be more pythonic, I spotted a bug with the regular expression:
^https.*amazonaws\.com\/.*$

While it does match:
https://sns.us-east-1.amazonaws.com/SimpleNotificationService-1234.pem

It will also match:
https://mydomain.com/sns.us-east-1.amazonaws.com/SimpleNotificationService-1234.pem

It should be at least changed to
^https:\/\/[^\/]*amazonaws\.com\/.*$

However, I recommend changing it to
^https:\/\/sns\.[a-z0-9\-]+\.amazonaws\.com\/.*$

Any SigningCertURL is accepted at SNS authenticity check

It must me ensured it comes from AWS. References:

https://github.com/aws/aws-sdk-php/blob/master/src/Aws/Sns/MessageValidator/MessageValidator.php#L65-L69

$certUrl = Url::factory($message->get('SigningCertURL'));
if ('.amazonaws.com' != substr($certUrl->getHost(), -14)) {
    throw new CertificateFromUnrecognizedSourceException();
}

https://github.com/aws/aws-sdk-ruby/blob/master/lib/aws/sns/message.rb#L169

raise MessageWasNotAuthenticError, "cert is not hosted at AWS URL (https): #{url}" unless url =~ /^https.*amazonaws\.com\/.*$/i