#! /usr/bin/python -E

#
# Copyright (C) 2006 Red Hat, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
#

PROGNAME="setroubleshoot"

import gettext
gettext.bindtextdomain(PROGNAME, "/usr/share/locale")
gettext.textdomain(PROGNAME)
try:
    gettext.install(PROGNAME, localedir="/usr/share/locale", unicode=1)
except IOError:
    import __builtin__
    __builtin__.__dict__['_'] = unicode

# This import must come before importing gtk to silence warnings
from setroubleshoot.gui_utils import *

import dbus
import dbus.glib
import dbus.service
import errno
import gobject 
import gtk
import os
import pynotify
import Queue
import re
import signal
import socket as Socket
import sys

from setroubleshoot.analyze import *
from setroubleshoot.config import cfg
from setroubleshoot.log import *
from setroubleshoot.runcmd import *
from setroubleshoot.signature import *
from setroubleshoot.util import *
from setroubleshoot.rpc import *
from setroubleshoot.rpc_interfaces import *

#------------------------------------------------------------------------------
status_icon = None
dbus_bus_name = cfg.get('session_dbus','bus_name')
# FIXME: why isn't this read from config file?
dbus_object_path = "/com/redhat/selinux/alert_object"


#------------------------------------------------------------------------------
def sighandler(signum, frame):
    log_program.debug("exiting on signal %s", signum)
    sys.exit()

def setup_sighandlers():
    signal.signal(signal.SIGHUP,  sighandler)
    signal.signal(signal.SIGQUIT, sighandler)
    signal.signal(signal.SIGTERM, sighandler)

def run_app():
    app = SEAlert()
    return app.main()    

def run_as_dbus_service():
    try:
        log_dbus.debug('starting service')
        dbus_service = DBusService(dbus_bus_name)
        app = SEAlert(dbus_service.presentation_manager)
        return app.main()    
    except dbus.DBusException, e:
        log_dbus.error('could not start dbus: %s', str(e))
        return False

def ask_dbus_to_show_browser():
    try:
        bus=dbus.SessionBus()
        proxy_obj=bus.get_object(dbus_bus_name, dbus_object_path)
        iface=dbus.Interface(proxy_obj, 'com.redhat.SEtroubleshootIface')
        iface.show_browser()    
        return True
    except dbus.DBusException, e:
        log_dbus.error('could not start dbus: %s', str(e))
        return False

def ask_dbus_to_quit_app():
    try:
        bus=dbus.SessionBus()
        proxy_obj=bus.get_object(dbus_bus_name, dbus_object_path)
        iface=dbus.Interface(proxy_obj, 'com.redhat.SEtroubleshootIface')
        iface.quit_app()    
        return True
    except dbus.DBusException, e:
        log_dbus.error('could not start dbus: %s', str(e))
        return False

def command_line_lookup_id(local_id):
    def lookup_local_id():
        log_rpc.debug("calling server to lookup id (%s)", local_id)
        async_rpc = cl.alert_client.lookup_local_id(local_id)
        async_rpc.add_callback(lookup_local_id_callback)
        async_rpc.add_errback(lookup_local_id_error)

    def lookup_local_id_callback(siginfo):
        print siginfo.format_text()
        cl.main_loop.quit()

    def lookup_local_id_error(method, errno, strerror):
        print "%s error (%d): %s" % (method, errno, strerror)
        cl.main_loop.quit()


    cl = SECommandLine(lookup_local_id)
    cl.run()

#------------------------------------------------------------------------------
class StatusIcon(gobject.GObject):
    __gsignals__ = {
        'show_browser':
        (gobject.SIGNAL_RUN_LAST, gobject.TYPE_NONE, ()),
        }

    def __init__(self):
        gobject.GObject.__init__(self)

        status_icon_file = cfg.get('alert','status_icon')
        self.status_icon = gtk.status_icon_new_from_file(status_icon_file)
        self.status_icon.set_visible(False)
        self.status_icon.set_blinking(False)
        self.status_icon.set_tooltip(_("SELinux AVC denial, click to view"))
        self.status_icon.connect("activate", self.browser_activate)

        pynotify.init("setroubleshoot")

    def calculate_notify_position(self, notify):
        self.get_icon_geometry()
        if self.orientation == gtk.ORIENTATION_HORIZONTAL:
            if self.icon_rect.y < self.screen_height / 2:
                # Panel Top Edge
                notify_x = self.icon_rect.x + self.icon_size/2
                notify_y = self.icon_rect.y + self.icon_size/2
            else:
                # Panel Bottom Edge
                notify_x = self.icon_rect.x + self.icon_size/2
                notify_y = self.icon_rect.y - self.icon_size/2
        elif self.orientation == gtk.ORIENTATION_VERTICAL:
            if self.icon_rect.x < self.screen_width / 2:
                # Panel Left Edge
                notify_x = self.icon_rect.x + self.icon_size/2
                notify_y = self.icon_rect.y + self.icon_size/2
            else:
                # Panel Right Edge
                notify_x = self.icon_rect.x - self.icon_size/2
                notify_y = self.icon_rect.y + self.icon_size/2
        else:
            raise ValueError("unknown orientation = %d" % self.orientation)

        notify.set_hint("x", notify_x)
        notify.set_hint("y", notify_y)

    def get_icon_geometry(self):
        (self.screen, self.icon_rect, self.orientation) = \
                      self.status_icon.get_geometry()
        self.icon_size = self.status_icon.get_size()
        self.screen_width = self.screen.get_width()
        self.screen_height = self.screen.get_height()

        #print "rect=(%dx%d)(%d,%d) size=%d embedded=%s %s screen=(%dx%d)"  % \
        #      (self.icon_rect.width, self.icon_rect.height,
        #       self.icon_rect.x, self.icon_rect.y, self.icon_size,
        #       self.status_icon.is_embedded(),
        #       orientation_str[self.orientation],
        #       self.screen_width, self.screen_height)

    def display_notification(self):
        self.notify = pynotify.Notification(_("SELinux"),
                                            _("AVC denial, click icon to view"))
        self.calculate_notify_position(self.notify)
        self.notify.show()
        return False

    def display_new_alert_is_pending(self):
        log_alert.debug("display_new_alert_is_pending()")
        if self.status_icon.get_visible():
            return
        self.status_icon.set_visible(True)

        # HACK WARNING: The information returned from the status icon's
        # get_geometry() call is only valid at certain moments in
        # time, e.g. while it's displayed on the screen. When we set
        # its visibility to True that only queues a request for it to
        # be made visible, calling get_geometry after setting its
        # visibility to true is too soon for the position information
        # to be valid. Unforunately there is no signal emitted when
        # the position information is valid or changes. The most
        # reliable thing we can do for the time being is queue a
        # callback for a short duration in the future to display the
        # notification and hope the icon is visible and its display
        # informaiton is valid at the moment :-(

        if cfg.getboolean('alert','use_notification'):
            gobject.timeout_add(200, self.display_notification)
            
    def browser_activate(self, status_icon, data=None):
        self.status_icon.set_visible(False)
        self.notify.close()
        self.emit('show_browser')

gobject.type_register(StatusIcon)

#-----------------------------------------------------------------------------

class ServerConnectionHandler(RpcChannel, SETroubleshootServerInterface, SEAlertInterface, gobject.GObject):
    __gsignals__ = {
        'alert':
        (gobject.SIGNAL_RUN_LAST, gobject.TYPE_NONE, (gobject.TYPE_PYOBJECT,)),
        'connection_state_change':
        (gobject.SIGNAL_RUN_LAST, gobject.TYPE_NONE, (gobject.TYPE_PYOBJECT,)),
        'connection_pending_retry':
        (gobject.SIGNAL_RUN_LAST, gobject.TYPE_NONE, (gobject.TYPE_PYOBJECT,)),
        'signatures_updated': 
        (gobject.SIGNAL_RUN_LAST, gobject.TYPE_NONE, (gobject.TYPE_PYOBJECT,)),
        }

    def __init__(self):
        RpcChannel.__init__(self, self.on_connection_state_change, channel_type='sealert')
        gobject.GObject.__init__(self)
        self.retry_attemps = 0
        self.seconds_pending_till_connect_retry = 0
        self.report_connect_failure = True

    def on_connection_state_change(self, connection_state):
        log_rpc.debug("on_connection_state_change: state=%s channel=%s, type=%s",
                      connection_state, self.channel_name, self.channel_type)

        self.emit('connection_state_change', connection_state)

        if connection_state == 'closed':
            self.open_with_retry()
        elif connection_state == 'open':
            pass
        elif connection_state == 'retry':
            pass
        elif connection_state == 'hup':
            pass
        elif connection_state == 'error':
            pass
        elif connection_state == 'invalid':
            pass
        elif connection_state == 'timeout':
            pass
        else:
            log_rpc.error("on_connection_state_change: unknown state (%s) channel=%s type=%s",
                          connection_state, self.channel_name, self.channel_type)

    def open(self, socket_address = None):
        if socket_address is not None:
            self.socket_address = socket_address
            self.address_family, self.socket_type = get_socket_family_and_type(socket_address)
        if self.connection_state == 'open':
            return True
        try:
            self.socket = Socket.socket(self.address_family, self.socket_type)
            self.socket.connect(self.socket_address)
            self.io_watch_id = gobject.io_add_watch(self.socket, io_input_conditions, self.handle_client_io)
            self.retry_attemps = 0
            self.set_connection_state('open')
            self.report_connect_failure = True
            self.do_logon()
        except Socket.error, e:
            if self.report_connect_failure == True:
                log_rpc.error("attempt to open server connection failed: %s", e)
                self.report_connect_failure = False

                
            self.set_connection_state('error')
            return False
        return True
            
    def get_retry_interval(self):
        if self.retry_attemps < 5:
            return 5
        else:
            return 60

    def retry_countdown(self):
        self.seconds_pending_till_connect_retry -= 1
        if self.seconds_pending_till_connect_retry <= 0:
            self.open_with_retry()
            return False
        else:
            self.emit('connection_pending_retry', self.seconds_pending_till_connect_retry)
            return True

    def open_with_retry(self, socket_address = None):
        self.emit('connection_pending_retry', 0)
        if not self.open(socket_address):
            self.set_connection_state('retry')
            self.retry_attemps += 1
            self.seconds_pending_till_connect_retry = self.get_retry_interval()
            gobject.timeout_add(1*1000, self.retry_countdown)
            return False
        return False
        
    def do_logon(self):
        username = get_identity()
        self.channel_name = username
        self.username = username
        self.logon(self.channel_type, username, 'passwd')

    # ------

    def alert(self, siginfo):
        log_alert.debug("received alert")
        self.emit('alert', siginfo)

    def signatures_updated(self, criteria):
        log_rpc.debug('signatures_updated criteria=%s', criteria)
        self.emit('signatures_updated', criteria)
        
    def logfile_progress(self, logfile_id, progress):
        print "got logfile_progress signal logfile_id=%s progress=%s" % (logfile_id, progress)

gobject.type_register(ServerConnectionHandler)

#-----------------------------------------------------------------------------

class PresentationManager(gobject.GObject):
    __gsignals__ = {
        'show_browser':
        (gobject.SIGNAL_RUN_LAST, gobject.TYPE_NONE, ()),
        'quit_app':
        (gobject.SIGNAL_RUN_LAST, gobject.TYPE_NONE, ()),
        }

    def __init__(self):
        gobject.GObject.__init__(self)

    def show_browser(self):
        self.emit('show_browser')

    def quit_app(self):
        self.emit('quit_app')

gobject.type_register(PresentationManager)

#-----------------------------------------------------------------------------

class DBusService(dbus.service.Object):
    def __init__(self, bus_name):
        bus = dbus.SessionBus()
        bus_name = dbus.service.BusName(dbus_bus_name, bus=bus)
        dbus.service.Object.__init__(self, bus_name, dbus_object_path)

        self.presentation_manager = PresentationManager()

    @dbus.service.method("com.redhat.SEtroubleshootIface")
    def show_browser(self):
        log_dbus.debug('show_browser() called',)
        self.presentation_manager.show_browser()
        return ""

    @dbus.service.method("com.redhat.SEtroubleshootIface")
    def quit_app(self):
        log_dbus.debug('quit_app() called')
        self.presentation_manager.quit_app()


#-----------------------------------------------------------------------------

class SEAlert(object):
    """
    The SEAlert object represents a gui client for setroubleshoot. It
    processes alerts and presents the user with an appropriate user
    interface for handling the alert. Most of the interface code
    is in BrowserApplet and StatusIcon. This class is mainly a central
    hub for processing the alerts.
    """
    def __init__(self, presentation_manager=None):
        if get_display() is None:
            print >> sys.stderr, "cannot open X display, exiting ..."
            sys.exit(1)
        from setroubleshoot.browser import BrowserApplet

        if presentation_manager is None:
            self.presentation_manager = PresentationManager()
            gobject.idle_add(self.show_browser_at_startup)
        else:
            self.presentation_manager = presentation_manager

        self.browser = None
        self.browser_visible = False

        self.status_icon = StatusIcon()
        self.status_icon.connect('show_browser', self.on_show_browser)


        self.alert_client = ServerConnectionHandler()
        self.alert_client.open_with_retry(get_server_address('local_fault_server'))

        self.browser = BrowserApplet()
        self.browser.server = self.alert_client
        self.presentation_manager.connect('show_browser', self.on_show_browser)
        self.presentation_manager.connect('quit_app', self.on_quit)
        self.alert_client.connect('alert', self.alert)
        self.alert_client.connect('connection_state_change', self.browser.on_connection_state_change)
        self.alert_client.connect('connection_pending_retry', self.browser.on_connection_pending_retry)
        self.alert_client.connect('signatures_updated', self.browser.signatures_updated)
        self.browser.window.connect('show', self.on_browser_show)
        self.browser.window.connect('hide', self.on_browser_hide)

        # If there is no presentation mananger make sure when the
        # user closes the window the whole application exits. When running
        # in "alert" mode we want the application to persist in the background
        if presentation_manager is None:
            self.browser.window_delete_hides = False

    def main(self):
        log_program.debug('creating main GUI application')
        try:
            gtk.main()
        except KeyboardInterrupt, e:
            sys.exit()

    def alert(self, alert_client, siginfo):
        log_alert.debug("evaluating alert")
        def alert_filter_result(result):
            if result == 'display':
                self.status_icon.display_new_alert_is_pending()

        self.browser.server.evaluate_alert_filter(
            siginfo.sig, self.alert_client.username
            ).add_callback(alert_filter_result)

    def show_browser_at_startup(self):
        self.presentation_manager.show_browser()
        return False

    def show_browser(self):
        self.browser.present()
        # FIXME, this is weird
        self.alert_client.emit('connection_state_change', self.alert_client.connection_state)
        return True

    def on_quit(self, widget):
        gtk.main_quit()

    def on_show_browser(self, widget):
        self.show_browser()

    def on_browser_show(self, widget):
        self.browser_visible = True

    def on_browser_hide(self, widget):
        self.browser_visible = False

#-----------------------------------------------------------------------------

class SECommandLine(object):
    def __init__(self, func):
        self.func = func

        self.alert_client = ServerConnectionHandler()
        self.alert_client.connect('connection_state_change', self.on_connection_state_change)
        self.main_loop = gobject.MainLoop()


    def on_connection_state_change(self, alert_client, connection_state):
        log_program.debug("on_connection_state_change: state=%s", connection_state)

        if connection_state == 'closed':
            pass
        elif connection_state == 'open':
            self.func()
        elif connection_state == 'retry':
            pass
        elif connection_state == 'hup':
            pass
        elif connection_state == 'error':
            print >> sys.stderr, "failed to connect to server"
            sys.exit(1)
        elif connection_state == 'invalid':
            pass
        elif connection_state == 'timeout':
            pass
        else:
            log_rpc.error("on_connection_state_change: unknown state (%s) channel=%s type=%s",
                          connection_state, self.channel_name, self.channel_type)

    def run(self):
        log_program.debug('executing command line application')
        self.alert_client.open(get_server_address('local_fault_server'))
        try:
            self.main_loop.run()
        except KeyboardInterrupt, e:
            sys.exit()

#-----------------------------------------------------------------------------

# -- Main --
if __name__ == '__main__':
    setup_sighandlers()
        
    def usage():
        print _('''
        -b --browser        Launch the browser
        -h --help           Show this message
        -s --service        Start sealert as a dbus service
        -S --noservice      Start sealert without dbus service as stand alone app
        -l --lookupid id    Lookup alert by id	
        -a --analyze file   Scan a log file, analyze it's AVC's
        -v --verbose        Start in verbose mode
        ''')
        
    import getopt
    
    try:
        opts, args = getopt.getopt(sys.argv[1:], 'bhqsSl:a:v',
                     ['help','browser','quit','service','noservice','lookupid=',
                      'analyze=','verbose'])
    except getopt.GetoptError:
        # print help information and exit:
        usage()
        sys.exit(2)
    verbose=False
    for o, a in opts:
        if o in ('-h', '--help'):
            usage()
            sys.exit()

        if o in ('-b', '--browser'):
            log_dbus.debug("cmdline arg -b, calling ask_dbus_to_show_browser()")
            if not ask_dbus_to_show_browser():
                print >> sys.stderr, "could not attach to desktop process, running standalone"
                
        if o in ('-q', '--quit'):
            log_dbus.debug("cmdline arg -q, calling ask_dbus_to_quit_app()")
            if not ask_dbus_to_quit_app():
                print >> sys.stderr, "could not attach to desktop process"
                
        if o in ('-s', '--service'):
            log_dbus.debug("cmdline arg -s, calling run_as_dbus_service()")
            run_as_dbus_service()

        if o in ('-S', '--noservice'):
            log_program.debug("cmdline arg -S, calling run_app()")
            run_app()

        if o in ('-l', '--lookupid'):
            local_id = a
            log_program.debug("cmdline arg -l, calling command_line_lookup_id(%s)", local_id)
            command_line_lookup_id(local_id)

        if o in ('-a', '--analyze'):
            logfile = a
            log_program.debug("cmdline arg -a, calling analyze_logfile(%s)", logfile)
            analyze_logfile(logfile)

        if o in ('-v', '--verbose'):
            verbose=True

