/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License (the "License").

 * You may not use this file except in compliance with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.

 * Use is subject to license terms.

 */

package org.opensolaris.os.vp.client.common;

import java.io.*;

import java.net.MalformedURLException;

import java.security.*;

import java.security.cert.*;

import java.security.cert.Certificate;

import java.util.*;

import javax.management.*;

import javax.management.remote.*;

import org.opensolaris.os.rad.*;

import org.opensolaris.os.rad.api.pam.*;

import org.opensolaris.os.rad.jmx.RadConnector;

import org.opensolaris.os.vp.common.panel.MBeanUtil;

import org.opensolaris.os.vp.panel.common.ConnectionInfo;

import org.opensolaris.os.vp.panel.common.action.ActionAbortedException;

import org.opensolaris.os.vp.util.misc.*;

public abstract class RadLoginManager {

    //

    // Static data

    //

    public static final String TRUSTSTORE_PASSWORD = "trustpass";

    //

    // Instance data

    //

    private ConnectionManager connManager;

    //

    // Constructors

    //

    public RadLoginManager(ConnectionManager connManager) {

	this.connManager = connManager;

    }

    //

    // RadLoginManager methods

    //

    /**

     * Verify the given {@code Certificate} can be added to the truststore.

     * This default implementation does nothing.  Subclasses may wish to

     * override this method to display the {@code Certificate} details and

     * prompt for user confirmation.

     *

     * @param	    host

     *		    the owner of the {@code Certificate}

     *

     * @param	    certificate

     *		    the {@code Certificate} to verify

     *

     * @exception   ActionAbortedException

     *		    if the given {@code Certificate} cannot be added to the

     *		    truststore

     */

    protected abstract void acceptCertificate(

	String host, Certificate certificate) throws ActionAbortedException;

    /**

     * Checks to see if the login process has been cancelled.  Subclasses should

     * override this method if they provide a method for the user to cancel the

     * login process.  This default implementation does nothing.

     *

     * @exception   ActionAbortedException

     *		    if the action has been cancelled

     */

    protected void checkForCancel() throws ActionAbortedException {

    }

    /**

     * Creates an empty truststore file.

     */

    protected void createTrustStore(File truststore) throws KeyStoreException,

	IOException, NoSuchAlgorithmException, CertificateException {

	File truststoreDir = truststore.getParentFile();

	if (!truststoreDir.exists()) {

	    if (!truststoreDir.mkdirs()) {

		throw new IOException(

		    "could not create truststore directory: " +

		    truststoreDir.getAbsolutePath());

	    }

	}

	KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());

	char[] password = getTrustStorePassword().toCharArray();

	// Create empty keystore

	keyStore.load(null, password);

	FileOutputStream fos = new FileOutputStream(truststore);

	keyStore.store(fos, password);

	fos.close();

    }

    protected boolean handleCertFailure(String host, File truststore,

	Certificate certificate) throws ActionAbortedException,

	KeyStoreException, IOException, NoSuchAlgorithmException,

	CertificateException {

	KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());

	char[] password = getTrustStorePassword().toCharArray();

	// Load truststore

	FileInputStream fis = new FileInputStream(truststore);

	keyStore.load(fis, password);

	fis.close();

	checkForCancel();

	// Does the truststore already contain the certificate?

	String alias = keyStore.getCertificateAlias(certificate);

	if (alias != null)

		return false;

	boolean acceptNeeded = true;

	if (NetUtil.isLocalAddress(host)) {

	    FileInputStream certFileIn = null;

	    try {

		File certFile = new File("/etc/rad/cert.pem");

		certFileIn = new FileInputStream(certFile);

		Certificate localCert = CertificateFactory.

		    getInstance("X.509").generateCertificate(certFileIn);

		if (localCert.equals(certificate)) {

		    acceptNeeded = false;

		}

	    } catch (Throwable ignore) {

	    } finally {

		IOUtil.closeIgnore(certFileIn);

	    }

	}

	if (acceptNeeded) {

	    // Display the certificate, prompt user to accept

	    acceptCertificate(host, certificate);

	}

	// Add certificate

	alias = ((X509Certificate)certificate).getIssuerDN().toString();

	KeyStore.Entry entry =

	    new KeyStore.TrustedCertificateEntry(certificate);

	keyStore.setEntry(alias, entry, null);

	FileOutputStream fos = new FileOutputStream(truststore);

	keyStore.store(fos, password);

	fos.close();

	return true;

    }

    /**

     * Opens a connection to the server.

     *

     * @exception   ActionAbortedException

     *		    if the action is aborted

     */

    public ConnectionInfo getConnectionInfo(ConnectionInfo oldinfo)

	throws ActionAbortedException {

	// Repeat until a ConnectionInfo is created or an

	// ActionAbortedException is thrown

	while (true) {

	    // Retrieve login info, presumably from the user -- throws

	    // ActionAbortedException if user cancels

	    LoginInfo info = getLoginInfo();

	    try {

		return toConnectionInfo(info, oldinfo);

	    }

	    // Error logging in, display error and restart login process

	    catch (LoginFailedException e) {

		showError(e.getMessage(), e.getLoginField(), e.getCause());

	    }

	    // User has chosen to restart login process

	    catch (ActionAbortedException e) {

		// Do nothing

	    }

	}

    }

    public ConnectionManager getConnectionManager() {

	return connManager;

    }

    /**

     * Returns the information needed to login to the server.

     */

    protected abstract LoginInfo getLoginInfo() throws ActionAbortedException;

    /**

     * Gets the truststore file.

     */

    public abstract File getTrustStoreFile();

    /**

     * Gets the truststore password.  This default implementation returns

     * "{@code trustpass}".

     */

    public String getTrustStorePassword() {

	return TRUSTSTORE_PASSWORD;

    }

    /**

     * Sets the (localized) message and cause when an error occurs.  Subclasses

     * may wish to override this method -- this default implementation does

     * nothing.

     *

     * @param	    message

     *		    the localized message to display

     *

     * @param	    field

     *		    the login field that caused this error

     *

     * @param	    cause

     *		    the detailed cause of this error

     */

    protected void showError(String message, LoginField field,

	Throwable cause) {

    }

    /**

     * Sets the (localized) status of this {@code RadLoginManager}. Subclasses

     * may wish to override this method -- this default implementation does

     * nothing.

     */

    protected void showStatus(String status) {

    }

    //

    // Private methods

    //

	char[] uPassword) throws ObjectException {

	    List<String> response = new LinkedList<String>();

		    /* Assume it's Password: */

		    response.add(new String(uPassword));

		    break;

		}

	    }

	}

    }

    /**

     * Attempts to create a {@link ConnectionInfo} from the given {@link

     * LoginInfo}.

     *

     * @param oldinfo the previous connection, if any.

     */

    private ConnectionInfo toConnectionInfo(LoginInfo info,

        ConnectionInfo oldinfo)

	throws LoginFailedException, ActionAbortedException {

	// Throws LoginFailedException on bad data

	validate(info);

	String host = info.getHost();

	String user = info.getUser();

	String role = info.getRole();

	int port = info.getPort();

	// Search for an existing connection established for the specified

	// host/user

	ConnectionInfo cInfo =

	    getConnectionManager().getConnection(host, port, user, role);

	if (cInfo != null) {

	    return cInfo;

	}

	char[] uPassword = info.getUserPassword();

	char[] rPassword = info.getRolePassword();

	showStatus(Finder.getString(

	    "login.status.host.trusted", host, user));

	String urlString = "service:jmx:" + RadConnector.PROTOCOL_TLS + "://" +

	    host;

	if (port != -1) {

	    urlString += ":" + port;

	}

	try {

	    File truststore = getTrustStoreFile();

	    if (!truststore.exists())

		createTrustStore(truststore);

	    checkForCancel();

	    showStatus(Finder.getString("login.status.loggingin", host, user));

	    Map<String, Object> env = new HashMap<String, Object>();

	    env.put(RadConnector.KEY_TLS_TRUSTSTORE,

		truststore.getAbsolutePath());

	    env.put(RadConnector.KEY_TLS_TRUSTPASS,

		getTrustStorePassword());

	    JMXServiceURL url = new JMXServiceURL(urlString);

	    JMXConnector connector =

		JMXConnectorFactory.newJMXConnector(url, null);

	    for (;;) {

		RadTrustManager mtm = null;

		try {

		    mtm = new RadTrustManager();

		    env.put(RadConnector.KEY_TLS_RADMANAGER, mtm);

		    checkForCancel();

		    connector.connect(env);

		    break;

		} catch (IOException e) {

		    if (mtm.getBadChain() == null || !handleCertFailure(host,

			truststore, mtm.getBadChain()[0])) {

			throw e;

		    }

		}

	    }

	    MBeanServerConnection mbsc = connector.getMBeanServerConnection();

	    AuthenticatorMXBean abean = JMX.newMXBeanProxy(mbsc,

		MBeanUtil.makeObjectName("org.opensolaris.os.rad",

		"authentication"), AuthenticatorMXBean.class);

	    if (role != null) {

	    }

	    abean.complete();

	    return new ConnectionInfo(host, port, user, role, connector);

	}

	catch (ObjectException e) {

	    throw new LoginFailedException(

		Finder.getString("login.err.security"), e,

		LoginField.USER_PASSWORD);

	}

	// Thrown by createTrustStore

	catch (KeyStoreException e) {

	    throw new LoginFailedException(

		Finder.getString("login.err.keystore"), e);

	}

	// Thrown by createTrustStore

	catch (NoSuchAlgorithmException e) {

	    throw new LoginFailedException(

		Finder.getString("login.err.keystore"), e);

	}

	// Thrown by getDaemonCertificateChain

	catch (CertificateException e) {

	    throw new LoginFailedException(

		Finder.getString("login.err.nocerts", host), e,

		LoginField.HOST);

	}

	// Thrown by getDaemonCertificateChain, new JMXServiceURL

	catch (MalformedURLException e) {

	    e.printStackTrace();

	    throw new LoginFailedException(

		Finder.getString("login.err.url.invalid", urlString),

		e, LoginField.HOST);

	}

	// Thrown by JMXConnector.connect()

	catch (SecurityException e) {

	    throw new LoginFailedException(

		Finder.getString("login.err.security"), e,

		LoginField.USER_PASSWORD);

	}

	// Thrown by JMXConnector methods

	catch (IOException e) {

	    throw new LoginFailedException(

		Finder.getString("login.err.io", host), e);

	}

	finally {

	    // Before throwing any of the above exceptions

	    checkForCancel();

	}

    }

    /**

     * Runs a simple validation test of the given {@code LoginInfo}.

     *

     * @param	    info

     *		    the data to validate

     *

     * @exception   ActionAbortedException

     *		    if the action has been cancelled

     *

     * @exception   LoginFailedException

     *		    if the data is invalid

     */

    private void validate(LoginInfo info)

	throws ActionAbortedException, LoginFailedException {

	checkForCancel();

	showStatus(Finder.getString("login.status.field.validation"));

	String host = info.getHost();

	if (host == null || host.isEmpty()) {

	    throw new LoginFailedException(

		Finder.getString("login.err.host.empty"),

		LoginField.HOST);

	}

	String port = info.getPortStr();

	if (port != null && !port.isEmpty()) {

	    try {

		info.setPort(Integer.parseInt(port));

	    } catch (NumberFormatException e) {

		throw new LoginFailedException(

		    Finder.getString("login.err.port.invalid", port),

		    LoginField.PORT);

	    }

	}

	String user = info.getUser();

	if (user == null || user.isEmpty()) {

	    throw new LoginFailedException(

		Finder.getString("login.err.user.empty"),

		LoginField.USER);

	}

    }

}