import os

import pytest

import testinfra.utils.ansible_runner

from tls_ciphers import ALL_CIPHERS


testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('parameters-mandatory')


def test_base_entry(host):
    """
    Tests if the base entry has been created correctly.
    """

    with host.sudo():

        base_dn = host.run("ldapsearch -H ldapi:/// -Q -LLL -Y EXTERNAL -b dc=local -s base")

        assert base_dn.rc == 0
        assert "dc: local" in base_dn.stdout.split("\n")
        assert "o: Private" in base_dn.stdout.split("\n")


def test_log_level(host):
    """
    Tests if the logging level has been set correctly.
    """

    with host.sudo():

        log_level = host.run('ldapsearch -H ldapi:/// -Q -LLL -Y EXTERNAL -b cn=config -s base olcLogLevel')

        assert log_level.rc == 0
        assert 'olcLogLevel: 256' in log_level.stdout


def test_certificate_validity_check_configuration(host):
    """
    Tests if certificate validity check configuration file has been deployed
    correctly.
    """

    inventory_hostname = host.ansible.get_variables()['inventory_hostname']

    config = host.file('/etc/check_certificate/%s_ldap.conf' % inventory_hostname)

    assert config.is_file
    assert config.user == 'root'
    assert config.group == 'root'
    assert config.mode == 0o644
    assert config.content_string == "/etc/ssl/certs/%s_ldap.pem" % inventory_hostname


def test_tls_configuration(host):
    """
    Tests if the TLS has been configured correctly and works.
    """

    starttls = host.run('ldapwhoami -Z -x -H ldap://parameters-mandatory.local/')
    assert starttls.rc == 0
    assert starttls.stdout == 'anonymous\n'

    tls = host.run('ldapwhoami -x -H ldaps://parameters-mandatory.local/')
    assert tls.rc == 0
    assert tls.stdout == 'anonymous\n'

    old_tls_versions_disabled = host.run("echo 'Q' | openssl s_client -no_tls1_2 -connect parameters-mandatory.local:636")
    assert old_tls_versions_disabled.rc != 0
    assert "CONNECTED" in old_tls_versions_disabled.stdout


# @TODO: Under Debian Stretch, the DHE ciphers are not usable due to a
# bug present in OpenLDAP 2.4.44. See
# https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/1656979 for
# details. It should be possible to fix this problem once switch to
# buster is made.
ENABLED_CIPHERS = [
    # "DHE-RSA-AES128-GCM-SHA256",
    # "DHE-RSA-AES256-GCM-SHA384",
    # "DHE-RSA-CHACHA20-POLY1305",
    "ECDHE-RSA-AES128-GCM-SHA256",
    "ECDHE-RSA-AES256-GCM-SHA384",
    "ECDHE-RSA-CHACHA20-POLY1305",
]

DISABLED_CIPHERS = sorted(list(set(ALL_CIPHERS)-set(ENABLED_CIPHERS)))


@pytest.mark.parametrize("cipher", ENABLED_CIPHERS)
def test_enabled_tls_ciphers(host, cipher):
    """
    Tests available TLS ciphers on the server.
    """

    hostname = host.run('hostname').stdout.strip()
    fqdn = hostname

    client = host.run("echo 'Q' | openssl s_client -cipher %s -connect %s:636", cipher, fqdn)
    assert client.rc == 0
    assert cipher in client.stdout


@pytest.mark.parametrize("cipher", DISABLED_CIPHERS)
def test_disabled_tls_ciphers(host, cipher):
    """
    Tests available TLS ciphers on the server.
    """

    hostname = host.run('hostname').stdout.strip()
    fqdn = hostname

    client = host.run("echo 'Q' | openssl s_client -cipher %s -connect %s:636", cipher, fqdn)
    assert client.rc != 0
    assert cipher not in client.stdout


def test_ssf_configuration(host):
    """
    Tests if the SSF olcSecurity configuration has been set-up correctly.
    """

    with host.sudo():
        ssf = host.run('ldapsearch -H ldapi:/// -Q -LLL -Y EXTERNAL -b cn=config olcSecurity')

        assert ssf.rc == 0
        assert "olcSecurity: ssf=128" in ssf.stdout


def test_permissions(host):
    """
    Tests if LDAP directory permissions have been set-up correctly.
    """

    with host.sudo():
        permissions = host.run("ldapsearch -o ldif-wrap=no -H ldapi:/// -Q -LLL -Y EXTERNAL -b 'olcDatabase={1}mdb,cn=config' -s base olcAccess olcAccess")

        expected_permissions = """olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn="cn=admin,dc=local" manage by * break
olcAccess: {1}to attrs=userPassword,shadowLastChange by self write by anonymous auth by * none
olcAccess: {2}to dn.base="" by * read
olcAccess: {3}to * by self write by dn="cn=admin,dc=local" write by users read by * none"""

        assert permissions.rc == 0
        assert expected_permissions in permissions.stdout


def test_services_login_entries(host):
    """
    Tests if the service/consumer login entries have been set correctly.
    """

    with host.sudo():

        entries = host.run("ldapsearch -H ldapi:/// -Q -LLL -Y EXTERNAL -s one -b ou=services,dc=local '(objectClass=simpleSecurityObject)'")

        assert entries.rc == 0
        assert entries.stdout == ""


def test_group_entries(host):
    """
    Tests that no group entries have been created out-of-the-box.
    """

    with host.sudo():

        entries = host.run("ldapsearch -H ldapi:/// -Q -LLL -Y EXTERNAL -s one -b ou=groups,dc=local '(objectClass=groupOfUniqueNames)'")

        assert entries.rc == 0
        assert entries.stdout == ""