#!/usr/bin/python3

# SPDX-License-Identifier: LGPL-2.1-or-later

# Copyright (c) 2019 Red Hat, Inc.
# Copyright (c) 2019 Tomáš Mráz <tmraz@fedoraproject.org>

from subprocess import call, CalledProcessError
from tempfile import mkstemp

import os

from .configgenerator import ConfigGenerator


class LibsshGenerator(ConfigGenerator):
	CONFIG_NAME = 'libssh'

	cipher_map = {
		'AES-256-GCM':'aes256-gcm@openssh.com',
		'AES-256-CTR':'aes256-ctr',
		'AES-128-GCM':'aes128-gcm@openssh.com',
		'AES-128-CTR':'aes128-ctr',
		'CHACHA20-POLY1305':'chacha20-poly1305@openssh.com',
		'CAMELLIA-256-GCM':'',
		'AES-128-CCM':'',
		'AES-256-CCM':'',
		'CAMELLIA-128-GCM':'',
		'AES-256-CBC':'aes256-cbc',
		'AES-128-CBC':'aes128-cbc',
		'CAMELLIA-256-CBC':'',
		'CAMELLIA-128-CBC':'',
		'RC4-128':'',
		'DES-CBC':'',
		'CAMELLIA-128-CTS':'',
		'3DES-CBC':'3des-cbc'
	}

	mac_map_etm = {
		'HMAC-MD5':'',
		'UMAC-64':'',
		'UMAC-128':'',
		'HMAC-SHA1':'hmac-sha1-etm@openssh.com',
		'HMAC-SHA2-256':'hmac-sha2-256-etm@openssh.com',
		'HMAC-SHA2-512':'hmac-sha2-512-etm@openssh.com'
	}

	mac_map = {
		'HMAC-MD5':'',
		'UMAC-64':'',
		'UMAC-128':'',
		'HMAC-SHA1':'hmac-sha1',
		'HMAC-SHA2-256':'hmac-sha2-256',
		'HMAC-SHA2-512':'hmac-sha2-512'
	}

	kx_map = {
		'ECDHE-SECP521R1-SHA2-512':'ecdh-sha2-nistp521',
		'ECDHE-SECP256R1-SHA2-384':'ecdh-sha2-nistp384',
		'ECDHE-SECP256R1-SHA2-256':'ecdh-sha2-nistp256',
		'ECDHE-X25519-SHA2-256':'curve25519-sha256,curve25519-sha256@libssh.org',
		'DHE-SHA1':'diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1',
		'DHE-SHA2-256':'diffie-hellman-group-exchange-sha256',
		'DHE-SHA2-512':'diffie-hellman-group16-sha512,diffie-hellman-group18-sha512'
	}

	sign_map = {
		'RSA-SHA1':'ssh-rsa,ssh-rsa-cert-v01@openssh.com',
		'DSA-SHA1':'ssh-dss,ssh-dss-cert-v01@openssh.com',
		'RSA-SHA2-256':'rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com',
		'RSA-SHA2-512':'rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com',
		'ECDSA-SHA2-256':'ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com',
		'ECDSA-SHA2-384':'ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com',
		'ECDSA-SHA2-512':'ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com',
		'EDDSA-ED25519':'ssh-ed25519,ssh-ed25519-cert-v01@openssh.com',
	}

	@classmethod
	def generate_config(cls, policy):
		p = policy.props
		cfg = ''
		sep = ','

		local_kx_map = dict(cls.kx_map)
		if p['min_dh_size'] <= 1024:
			local_kx_map['DHE-SHA1'] = local_kx_map['DHE-SHA1'] + ',diffie-hellman-group1-sha1'
		elif p['min_dh_size'] > 2048:
			local_kx_map['DHE-SHA1'] = 'diffie-hellman-group-exchange-sha1'
			local_kx_map['DHE-SHA2-256'] = 'diffie-hellman-group-exchange-sha256'

		s = ''
		for i in p['cipher']:
			try:
				s = cls.append(s, cls.cipher_map[i], sep)
			except KeyError:
				pass

		if s:
			cfg += 'Ciphers ' + s + '\n'

		s = ''
		for i in p['mac']:
			try:
				s = cls.append(s, cls.mac_map_etm[i], sep)
			except KeyError:
				pass
		for i in p['mac']:
			try:
				s = cls.append(s, cls.mac_map[i], sep)
			except KeyError:
				pass

		if s:
			cfg += 'MACs ' + s + '\n'

		s = ''
		for kx in p['key_exchange']:
		    for h in p['hash']:
		        if kx == 'ECDHE':
		            for g in p['group']:
		                try:
		                    val = cls.kx_map[kx + '-' + g + '-' + h]
		                    s = cls.append(s, val, sep)
		                except KeyError:
		                    pass
		        else:
		            try:
		                val = local_kx_map[kx + '-' + h]
		                s = cls.append(s, val, sep)
		            except KeyError:
		                pass

		if s:
			cfg += 'KexAlgorithms ' + s + '\n'

		s = ''
		for i in p['sign']:
			try:
				s = cls.append(s, cls.sign_map[i], sep)
			except KeyError:
				pass

		if s:
			cfg += 'HostKeyAlgorithms ' + s + '\n'
			cfg += 'PubkeyAcceptedKeyTypes ' + s + '\n'

		return cfg

	@classmethod
	def test_config(cls, config):
		return True
