"""
"""

# Created on 2015.04.08
#
# Author: Giovanni Cannata
#
# Copyright 2015 - 2020 Giovanni Cannata
#
# This file is part of ldap3.
#
# ldap3 is free software: you can redistribute it and/or modify
# it under the terms of the GNU Lesser General Public License as published
# by the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# ldap3 is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public License
# along with ldap3 in the COPYING and COPYING.LESSER files.
# If not, see <http://www.gnu.org/licenses/>.

# original code by Hugh Cole-Baker, modified by Peter Foley, modified again by Azaria Zornberg
# it needs the gssapi package
import base64
import socket

from ...core.exceptions import LDAPPackageUnavailableError, LDAPCommunicationError
from ...core.rdns import ReverseDnsSetting, get_hostname_by_addr, is_ip_addr

posix_gssapi_unavailable = True
try:
    # noinspection PyPackageRequirements,PyUnresolvedReferences
    import gssapi
    from gssapi.raw import ChannelBindings
    posix_gssapi_unavailable = False
except ImportError:
    pass

windows_gssapi_unavailable = True
# only attempt to import winkerberos if gssapi is unavailable
if posix_gssapi_unavailable:
    try:
        import winkerberos
        windows_gssapi_unavailable = False
    except ImportError:
        raise LDAPPackageUnavailableError('package gssapi (or winkerberos) missing')

from .sasl import send_sasl_negotiation, abort_sasl_negotiation


NO_SECURITY_LAYER = 1
INTEGRITY_PROTECTION = 2
CONFIDENTIALITY_PROTECTION = 4


def get_channel_bindings(ssl_socket):
    try:
        server_certificate = ssl_socket.getpeercert(True)
    except:
        # it is not SSL socket
        return None
    try:
        from cryptography import x509
        from cryptography.hazmat.backends import default_backend
        from cryptography.hazmat.primitives import hashes
    except ImportError:
        raise LDAPPackageUnavailableError('package cryptography missing')
    cert = x509.load_der_x509_certificate(server_certificate, default_backend())
    hash_algorithm = cert.signature_hash_algorithm
    # According to https://tools.ietf.org/html/rfc5929#section-4.1, we have to convert the the hash function for md5 and sha1
    if hash_algorithm.name in ('md5', 'sha1'):
        digest = hashes.Hash(hashes.SHA256(), default_backend())
    else:
        digest = hashes.Hash(hash_algorithm, default_backend())
    digest.update(server_certificate)
    application_data = b'tls-server-end-point:' + digest.finalize()
    # posix gssapi and windows winkerberos use different channel bindings classes
    if not posix_gssapi_unavailable:
        return ChannelBindings(application_data=application_data)
    else:
        return winkerberos.channelBindings(application_data=application_data)


def sasl_gssapi(connection, controls):
    """
    Performs a bind using the Kerberos v5 ("GSSAPI") SASL mechanism
    from RFC 4752. Does not support any security layers, only authentication!

    sasl_credentials can be empty or a tuple with one or two elements.
    The first element determines which service principal to request a ticket for and can be one of the following:

    - None or False, to use the hostname from the Server object
    - True to perform a reverse DNS lookup to retrieve the canonical hostname for the hosts IP address
    - A string containing the hostname

    The optional second element is what authorization ID to request.

    - If omitted or None, the authentication ID is used as the authorization ID
    - If a string, the authorization ID to use. Should start with "dn:" or "user:".

    The optional third element is a raw gssapi credentials structure which can be used over
    the implicit use of a krb ccache.
    """
    if not posix_gssapi_unavailable:
        return _posix_sasl_gssapi(connection, controls)
    else:
        return _windows_sasl_gssapi(connection, controls)


def _common_determine_target_name(connection):
    """ Common logic for determining our target name for kerberos negotiation, regardless of whether we are using
    gssapi on a posix system or winkerberos on windows.
    Returns a string in the form "ldap@" + a target hostname.
    The hostname can either be user specified, come from the connection, or resolved using reverse DNS based
    on parameters set in sasl_credentials.
    The default if no sasl_credentials are specified is to use the host in the connection server object.
    """
    # if we don't have any sasl_credentials specified, or the first entry is False (which is the legacy equivalent
    # to ReverseDnsSetting.OFF that has value 0) then our gssapi name is just
    if (not connection.sasl_credentials or len(connection.sasl_credentials) == 0
            or not connection.sasl_credentials[0]):
        return 'ldap@' + connection.server.host
    # older code will still be using a boolean True for the equivalent of
    # ReverseDnsSetting.REQUIRE_RESOLVE_ALL_ADDRESSES
    if connection.sasl_credentials[0] is True:
        hostname = get_hostname_by_addr(connection.socket.getpeername()[0])
        target_name = 'ldap@' + hostname
    elif connection.sasl_credentials[0] in ReverseDnsSetting.SUPPORTED_VALUES:
        rdns_setting = connection.sasl_credentials[0]
        # if the rdns_setting is OFF then we won't enter any branch here and will leave hostname as server host,
        # so we'll just use the server host, whatever it is
        peer_ip = connection.socket.getpeername()[0]
        hostname = connection.server.host
        if rdns_setting == ReverseDnsSetting.REQUIRE_RESOLVE_ALL_ADDRESSES:
            # resolve our peer ip and use it as our target name
            hostname = get_hostname_by_addr(peer_ip)
        elif rdns_setting == ReverseDnsSetting.REQUIRE_RESOLVE_IP_ADDRESSES_ONLY:
            # resolve our peer ip (if the server host is an ip address) and use it as our target name
            if is_ip_addr(hostname):
                hostname = get_hostname_by_addr(peer_ip)
        elif rdns_setting == ReverseDnsSetting.OPTIONAL_RESOLVE_ALL_ADDRESSES:
            # try to resolve our peer ip in dns and if we can, use it as our target name.
            # if not, just use the server host
            resolved_hostname = get_hostname_by_addr(peer_ip, success_required=False)
            if resolved_hostname is not None:
                hostname = resolved_hostname
        elif rdns_setting == ReverseDnsSetting.OPTIONAL_RESOLVE_IP_ADDRESSES_ONLY:
            # try to resolve our peer ip in dns if our server host is an ip. if we can, use it as our target
            #  name. if not, just use the server host
            if is_ip_addr(hostname):
                resolved_hostname = get_hostname_by_addr(peer_ip, success_required=False)
                if resolved_hostname is not None:
                    hostname = resolved_hostname
        # construct our target name
        target_name = 'ldap@' + hostname
    else:  # string hostname directly provided
        target_name = 'ldap@' + connection.sasl_credentials[0]
    return target_name


def _common_determine_authz_id_and_creds(connection):
    """ Given our connection, figure out the authorization id (i.e. the kerberos principal) and kerberos credentials
    being used for our SASL bind.
    On posix systems, we can actively negotiate with raw credentials and receive a kerberos client ticket during our
    SASL bind. So credentials can be specified.
    However, on windows systems, winkerberos expects to use the credentials cached by the system because windows
    machines are generally domain-joined. So no initiation is supported, as the TGT must already be valid prior
    to beginning the SASL bind, and the windows system credentials will be used as needed with that.
    """
    authz_id = b""
    creds = None
    # the default value for credentials is only something we should instantiate on systems using the
    # posix GSSAPI, as windows kerberos expects that a tgt already exists (i.e. the machine is domain-joined)
    # and does not support initiation from raw credentials
    if not posix_gssapi_unavailable:
        creds = gssapi.Credentials(name=gssapi.Name(connection.user), usage='initiate', store=connection.cred_store) if connection.user else None
    if connection.sasl_credentials:
        if len(connection.sasl_credentials) >= 2 and connection.sasl_credentials[1]:
            authz_id = connection.sasl_credentials[1].encode("utf-8")
        if len(connection.sasl_credentials) >= 3 and connection.sasl_credentials[2]:
            if posix_gssapi_unavailable:
                raise LDAPPackageUnavailableError('The winkerberos package does not support specifying raw  credentials'
                                                  'to initiate GSSAPI Kerberos communication. A ticket granting ticket '
                                                  'must have already been obtained for the user before beginning a '
                                                  'SASL bind.')
            raw_creds = connection.sasl_credentials[2]
            creds = gssapi.Credentials(base=raw_creds, usage='initiate', store=connection.cred_store)
    return authz_id, creds


def _common_process_end_token_get_security_layers(negotiated_token):
    """ Process the response we got at the end of our SASL negotiation wherein the server told us what
    minimum security layers we need, and return a bytearray for the client security layers we want.
    This function throws an error on a malformed token from the server.
    The ldap3 library does not support security layers, and only supports authentication with kerberos,
    so an error will be thrown for any tokens that indicate a security layer requirement.
    """
    if len(negotiated_token) != 4:
        raise LDAPCommunicationError("Incorrect response from server")

    server_security_layers = negotiated_token[0]
    if not isinstance(server_security_layers, int):
        server_security_layers = ord(server_security_layers)
    if server_security_layers in (0, NO_SECURITY_LAYER):
        if negotiated_token[1:] != '\x00\x00\x00':
            raise LDAPCommunicationError("Server max buffer size must be 0 if no security layer")
    if not (server_security_layers & NO_SECURITY_LAYER):
        raise LDAPCommunicationError("Server requires a security layer, but this is not implemented")

    # this is here to encourage anyone implementing client security layers to do it
    # for both windows and posix
    client_security_layers = bytearray([NO_SECURITY_LAYER, 0, 0, 0])
    return client_security_layers

def _posix_sasl_gssapi(connection, controls):
    """ Performs a bind using the Kerberos v5 ("GSSAPI") SASL mechanism
    from RFC 4752 using the gssapi package that works natively on most
    posix operating systems.
    """
    target_name = gssapi.Name(_common_determine_target_name(connection), gssapi.NameType.hostbased_service)
    authz_id, creds = _common_determine_authz_id_and_creds(connection)

    ctx = gssapi.SecurityContext(name=target_name, mech=gssapi.MechType.kerberos, creds=creds,
                                 channel_bindings=get_channel_bindings(connection.socket))
    in_token = None
    try:
        while True:
            out_token = ctx.step(in_token)
            if out_token is None:
                out_token = ''
            result = send_sasl_negotiation(connection, controls, out_token)
            in_token = result['saslCreds']
            try:
                # This raised an exception in gssapi<1.1.2 if the context was
                # incomplete, but was fixed in
                # https://github.com/pythongssapi/python-gssapi/pull/70
                if ctx.complete:
                    break
            except gssapi.exceptions.MissingContextError:
                pass

        unwrapped_token = ctx.unwrap(in_token)
        client_security_layers = _common_process_end_token_get_security_layers(unwrapped_token.message)
        out_token = ctx.wrap(bytes(client_security_layers)+authz_id, False)
        return send_sasl_negotiation(connection, controls, out_token.message)
    except (gssapi.exceptions.GSSError, LDAPCommunicationError):
        abort_sasl_negotiation(connection, controls)
        raise


def _windows_sasl_gssapi(connection, controls):
    """ Performs a bind using the Kerberos v5 ("GSSAPI") SASL mechanism
    from RFC 4752 using the winkerberos package that works natively on most
    windows operating systems.
    """
    target_name = _common_determine_target_name(connection)
    # initiation happens before beginning the SASL bind when using windows kerberos
    authz_id, _ = _common_determine_authz_id_and_creds(connection)
    gssflags = (
            winkerberos.GSS_C_MUTUAL_FLAG |
            winkerberos.GSS_C_SEQUENCE_FLAG |
            winkerberos.GSS_C_INTEG_FLAG |
            winkerberos.GSS_C_CONF_FLAG
    )
    _, ctx = winkerberos.authGSSClientInit(target_name, gssflags=gssflags)

    in_token = b''
    try:
        negotiation_complete = False
        while not negotiation_complete:
            # GSSAPI is a "client goes first" SASL mechanism. Send the first "response" to the server and
            # recieve its first challenge.
            # Despite this, we can get channel binding, which includes CBTs for windows environments computed from
            # the peer certificate, before starting.
            status = winkerberos.authGSSClientStep(ctx, base64.b64encode(in_token).decode('utf-8'),
                                                   channel_bindings=get_channel_bindings(connection.socket))
            # figure out if we're done with our sasl negotiation
            negotiation_complete = (status == winkerberos.AUTH_GSS_COMPLETE)
            out_token = winkerberos.authGSSClientResponse(ctx) or ''
            out_token_bytes = base64.b64decode(out_token)
            result = send_sasl_negotiation(connection, controls, out_token_bytes)
            in_token = result['saslCreds'] or b''

        winkerberos.authGSSClientUnwrap( ctx,base64.b64encode(in_token).decode('utf-8'))
        negotiated_token = ''
        if winkerberos.authGSSClientResponse(ctx):
            negotiated_token = base64.standard_b64decode(winkerberos.authGSSClientResponse(ctx))
        client_security_layers = _common_process_end_token_get_security_layers(negotiated_token)
        # manually construct a message indicating use of authorization-only layer
        # see winkerberos example: https://github.com/mongodb/winkerberos/blob/master/test/test_winkerberos.py
        authz_only_msg = base64.b64encode(bytes(client_security_layers) + authz_id).decode('utf-8')
        winkerberos.authGSSClientWrap(ctx, authz_only_msg)
        out_token = winkerberos.authGSSClientResponse(ctx) or ''

        return send_sasl_negotiation(connection, controls, base64.b64decode(out_token))
    except (winkerberos.GSSError, LDAPCommunicationError):
        abort_sasl_negotiation(connection, controls)
        raise