#! /usr/bin/python2 -E
# Authors: Rob Crittenden <rcritten@redhat.com>
#
# Copyright (C) 2011  Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
#

import sys
import os
import shutil

from ipapython import ipautil
from ipapython import services as ipaservices

from ipaserver.install import installutils
from ipaserver.install.installutils import (
    private_ccache, create_replica_config)
from ipaserver.install import dsinstance, cainstance, bindinstance
from ipaserver.install.replication import replica_conn_check
from ipapython import version
from ipalib import api
from ipapython.dn import DN
from ipapython.config import IPAOptionParser
from ipapython import sysrestore
from ipapython import dogtag
from ipapython.ipa_log_manager import *

log_file_name = "/var/log/ipareplica-ca-install.log"
REPLICA_INFO_TOP_DIR = None


def parse_options():
    usage = "%prog [options] REPLICA_FILE"
    parser = IPAOptionParser(usage=usage, version=version.VERSION)
    parser.add_option("-d", "--debug", dest="debug", action="store_true",
                      default=False, help="gather extra debugging information")
    parser.add_option("-p", "--password", dest="password", sensitive=True,
                      help="Directory Manager (existing master) password")
    parser.add_option("-w", "--admin-password", dest="admin_password", sensitive=True,
                      help="Admin user Kerberos password used for connection check")
    parser.add_option("--no-host-dns", dest="no_host_dns", action="store_true",
                      default=False,
                      help="Do not use DNS for hostname lookup during installation")
    parser.add_option("--skip-conncheck", dest="skip_conncheck", action="store_true",
                      default=False, help="skip connection check to remote master")
    parser.add_option("--skip-schema-check", dest="skip_schema_check", action="store_true",
                      default=False, help="skip check for updated CA DS schema on the remote master")
    parser.add_option("-U", "--unattended", dest="unattended", action="store_true",
                      default=False, help="unattended installation never prompts the user")

    options, args = parser.parse_args()
    safe_options = parser.get_safe_opts(options)

    if len(args) != 1:
        parser.error("you must provide a file generated by ipa-replica-prepare")

    return safe_options, options, args[0]


def get_dirman_password():
    return installutils.read_password("Directory Manager (existing master)", confirm=False, validate=False)


def install_dns_records(config, options):

    if not bindinstance.dns_container_exists(config.master_host_name,
                                             ipautil.realm_to_suffix(config.realm_name),
                                             dm_password=config.dirman_password):
        return

    bind = bindinstance.BindInstance(dm_password=config.dirman_password)
    try:
        api.Backend.ldap2.connect(bind_dn=DN(('cn', 'Directory Manager')),
                                  bind_pw=config.dirman_password)
        bind.add_ipa_ca_dns_records(config.host_name, config.domain_name)
    finally:
        if api.Backend.ldap2.isconnected():
            api.Backend.ldap2.disconnect()


def main():
    safe_options, options, filename = parse_options()

    if os.geteuid() != 0:
        sys.exit("\nYou must be root to run this script.\n")

    standard_logging_setup(log_file_name, debug=options.debug)

    root_logger.debug('%s was invoked with argument "%s" and options: %s' % (sys.argv[0], filename, safe_options))
    root_logger.debug('IPA version %s' % version.VENDOR_VERSION)

    if not ipautil.file_exists(filename):
        sys.exit("Replica file %s does not exist" % filename)

    global sstore
    sstore = sysrestore.StateFile('/var/lib/ipa/sysrestore')

    if not dsinstance.DsInstance().is_configured():
        sys.exit("IPA server is not configured on this system.\n")

    api.bootstrap(in_server=True)
    api.finalize()

    if api.env.ra_plugin == 'selfsign':
        sys.exit('A selfsign CA can not be added')

    # get the directory manager password
    dirman_password = options.password
    if not dirman_password:
        if options.unattended:
            sys.exit('Directory Manager password required')
        try:
            dirman_password = get_dirman_password()
        except KeyboardInterrupt:
            sys.exit(0)
        if dirman_password is None:
            sys.exit("Directory Manager password required")

    if not options.admin_password and not options.skip_conncheck and \
            options.unattended:
        sys.exit('admin password required')

    config = create_replica_config(dirman_password, filename, options)
    config.setup_ca = True

    if not ipautil.file_exists(config.dir + "/cacert.p12"):
        print 'CA cannot be installed in CA-less setup.'
        sys.exit(1)

    if not options.skip_conncheck:
        replica_conn_check(
            config.master_host_name, config.host_name, config.realm_name, True,
            config.ca_ds_port, options.admin_password)

    if options.skip_schema_check:
        root_logger.info("Skipping CA DS schema check")
    else:
        cainstance.replica_ca_install_check(config)

    # Configure the CA if necessary
    CA = cainstance.install_replica_ca(config, postinstall=True)

    # We need to ldap_enable the CA now that DS is up and running
    CA.ldap_enable('CA', config.host_name, config.dirman_password,
                   ipautil.realm_to_suffix(config.realm_name))

    # This is done within stopped_service context, which restarts CA
    CA.enable_client_auth_to_db(CA.dogtag_constants.CS_CFG_PATH)

    # Install CA DNS records
    install_dns_records(config, options)

    # We need to restart apache as we drop a new config file in there
    ipaservices.knownservices.httpd.restart(capture_output=True)

    #update dogtag version in config file
    try:
        fd = open("/etc/ipa/default.conf", "a")
        fd.write(
            "dogtag_version=%s\n" % dogtag.install_constants.DOGTAG_VERSION)
        fd.close()
    except IOError, e:
        print "Failed to update /etc/ipa/default.conf"
        root_logger.error(str(e))
        sys.exit(1)

fail_message = '''
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
'''

if __name__ == '__main__':
    try:
        with private_ccache():
            installutils.run_script(main, log_file_name=log_file_name,
                                    operation_name='ipa-ca-install',
                                    fail_message=fail_message)
    finally:
        # always try to remove decrypted replica file
        try:
            if REPLICA_INFO_TOP_DIR:
                shutil.rmtree(REPLICA_INFO_TOP_DIR)
        except OSError:
            pass