UnivNautes

# -*- coding: utf-8 -*-

#

# UnivNautes

# Copyright (C) 2014  Entr'ouvert

#

# This program is free software: you can redistribute it and/or modify it under

# the terms of the GNU Affero General Public License as published by the Free

# Software Foundation, either version 3 of the License, or (at your option) any

# later version.

#

# This program is distributed in the hope that it will be useful, but WITHOUT

# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS

# FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more

# details.

#

# You should have received a copy of the GNU Affero General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

from django.core.management.base import BaseCommand, CommandError

from django.core.management import call_command

import os

import sys

import subprocess

from sp import pfconfigxml

import urllib2

from authentic2.saml.models import LibertyProvider

from django.conf import settings

from sp import pfconfigxml

METADATAS_DIR = os.path.join('/', 'var', 'db', 'univnautes-sp-federations')

def metadata_filename(codename, suffix=None):

    if not suffix:

        return os.path.join(METADATAS_DIR, codename, 'metadata.xml')

    else:

        return os.path.join(METADATAS_DIR, codename, 'metadata.xml.%s' % suffix)

def store_metadata(codename, fp):

    tempfilename = '/var/tmp/%s-metadata.xml-%s' % (codename, os.getpid())

    f = open(tempfilename, 'wb')

    f.write(fp.read())

    f.close()

    if not os.path.exists(METADATAS_DIR):

        os.mkdir(METADATAS_DIR, 0770)

    dir = os.path.join(METADATAS_DIR, codename)

    if not os.path.exists(dir):

        os.mkdir(dir, 0770)

    os.rename(tempfilename, metadata_filename(codename, 'downloaded'))

    # remove obsoletes files if they exist (just to be clean...)

    for suffix in ('bad_signature', 'disabled'):

        try:

            os.remove(metadata_filename(codename, suffix))

        except OSError:

            pass

def verify_metadata(codename, signcert):

    if not signcert:

        print 'warn: do not verify %s metadata (no certificate provided)' % codename

        ret = True

    else:

        metadata = metadata_filename(codename, 'downloaded')

        signcert_pem = metadata_filename(codename, 'signcert.pem')

        dir = os.path.join(METADATAS_DIR, codename)

        f = open(signcert_pem, 'wb')

        f.write(signcert)

        f.close()

        ret = 0 == subprocess.call(['xmlsec1', '--verify',

            '--pubkey-cert-pem', signcert_pem,

            '--id-attr:id', 'EntitiesDescriptor',

            metadata])

    if ret:

        os.rename(metadata, metadata_filename(codename))

    else:

        print 'warn: bad signature for %s metadata' % codename

        os.rename(metadata, metadata_filename(codename, 'bad_signature'))

    return ret

def disable(codename):

    print 'disable %s metadata' % str(codename)

    LibertyProvider.objects.filter(federation_source=codename).delete()

    dir = os.path.join(METADATAS_DIR, codename)

    try:

        os.rename(metadata_filename(codename), metadata_filename(codename, 'disabled'))

    except OSError:

        pass

class Command(BaseCommand):

    help = 'update all metadatas in %s' % METADATAS_DIR

    def handle(self, *args, **options):

        actives = set()

        federations = pfconfigxml.get_federations()

        for federation in federations:

            url = federation.get('url')

            codename = federation.get('codename')

            descr = federation.get('descr')

            signcert = federation.get('signcert')

            try:

                print 'download federation %s metadata from %s' % (str(codename), str(url))

                store_metadata(codename, urllib2.urlopen(url))

            except urllib2.HTTPError as e:

                print 'Error loading metadata (%s)' % str(e)

            except urllib2.URLError as e:

                print 'Error loading metadata (%s)' % str(e)

            else:

                if verify_metadata(codename, signcert):

                    actives.add(codename)

                    call_command('sync-metadata', metadata_filename(codename), source=codename, idp=True)

        present_in_filesystem = set(os.listdir(METADATAS_DIR))

        for codename in present_in_filesystem - actives:

            disable(codename)

        present_in_database = set([str(i['federation_source']) \

            for i in LibertyProvider.objects.distinct().values('federation_source').order_by('federation_source')])

        for codename in present_in_database - actives:

            disable(codename)

#!/bin/sh

COMMAND=$(basename $0 .sh)

# lock to avoid concurrent updates

LOCK=/var/run/univnautes-sp-$COMMAND.lock

if [ -r $LOCK ]

then

	PID=`cat $LOCK`

	echo "$COMMAND locked by $LOCK"

	ps waux | grep "$PID" | grep $COMMAND | grep -vq grep && exit

	echo "... but PID $PID is not a $COMMAND, continue"

fi

unlock() {

	rm -f $LOCK

	exit

}

trap unlock INT TERM EXIT

echo $$ > $LOCK

cd /usr/local/univnautes/sp

./manage.py $COMMAND