#!/usr/bin/python2.7
# -*- coding: utf-8 -*-
#
# UCS@school RADIUS 802.1X
#  NTLM-Authentication program
#
# Copyright (C) 2012-2017 Univention GmbH
#
# http://www.univention.de/
#
# All rights reserved.
#
# The source code of the software contained in this package
# as well as the source package itself are made available
# under the terms of the GNU Affero General Public License version 3
# (GNU AGPL V3) as published by the Free Software Foundation.
#
# Binary versions of this package provided by Univention to you as
# well as other copyrighted, protected or trademarked materials like
# Logos, graphics, fonts, specific documentations and configurations,
# cryptographic keys etc. are subject to a license agreement between
# you and Univention and not subject to the GNU AGPL V3.
#
# In the case you use the software under the terms of the GNU AGPL V3,
# the program is provided in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public
# License with the Debian GNU/Linux or Univention distribution in file
# /usr/share/common-licenses/AGPL-3; if not, see
# <http://www.gnu.org/licenses/>.

import optparse
import sys
import univention.admin.filter
import univention.config_registry
import univention.pyMsChapV2 as pyMsChapV2
import univention.uldap

userToGroup = {}  # { "user": ["group1", "group2", ], }
groupInfo = {}  # { "group1": (23, True, ), }


def loadInfo():
	configRegistry = univention.config_registry.ConfigRegistry()
	configRegistry.load()
	for key in configRegistry:
		if key.startswith('proxy/filter/usergroup/'):
			group = key[len('proxy/filter/usergroup/'):]
			users = configRegistry[key].split(',')
			for user in users:
				if user not in userToGroup:
					userToGroup[user] = []
				userToGroup[user].append(group)
		elif key.startswith('proxy/filter/groupdefault/'):
			group = key[len('proxy/filter/groupdefault/'):]
			rule = configRegistry[key]
			priority = 0
			try:
				priority = int(configRegistry.get('proxy/filter/setting/%s/priority' % (rule, ), ''))
			except ValueError:
				pass
			wlanEnabled = configRegistry.is_true('proxy/filter/setting/%s/wlan' % (rule, ))
			if wlanEnabled is not None:
				groupInfo[group] = (priority, wlanEnabled, )


SAMBA_ACCOUNT_FLAG_DISABLED = 'D'
SAMBA_ACCOUNT_FLAG_LOCKED = 'L'
DISALLOWED_SAMBA_ACCOUNT_FLAGS = frozenset((SAMBA_ACCOUNT_FLAG_DISABLED, SAMBA_ACCOUNT_FLAG_LOCKED, ))


def getNTPasswordHash(username, stationId):
	'stationId may be None if it was not supplied to the program'
	groups = userToGroup.get(username)
	if groups is None:
		return None
	groups = [groupInfo[group] for group in groups if group in groupInfo]
	if not groups:
		return None
	(maxPriority, _, ) = max(groups)
	if True not in [wlanEnabled for (priority, wlanEnabled, ) in groups if priority == maxPriority]:
		return None
	# user is authorized to use the W-LAN, retrieve NT-password-hash from LDAP and return it
	result = ldapConnection.search(filter=str(univention.admin.filter.expression('uid', username)), attr=['sambaNTPassword', 'sambaAcctFlags'])
	if not result:
		return None
	sambaAccountFlags = frozenset(result[0][1]['sambaAcctFlags'][0])
	if sambaAccountFlags & DISALLOWED_SAMBA_ACCOUNT_FLAGS:
		return None
	return result[0][1]['sambaNTPassword'][0].decode('hex')


def main():
	parser = optparse.OptionParser()
	parser.add_option('--request-nt-key', action='store_true', dest='requestNtKey')
	parser.add_option('--username', dest='Username')
	parser.add_option('--challenge', dest='Challenge')
	parser.add_option('--nt-response', dest='Response')
	parser.add_option('--station-id', dest='stationId')
	(options, args, ) = parser.parse_args()
	if not options.requestNtKey:
		print 'Missing required parameter --request-nt-key!'
		return 1
	if not options.Username:
		print 'Missing required parameter --username!'
		return 1
	if not options.Challenge:
		print 'Missing required parameter --challenge!'
		return 1
	if not options.Response:
		print 'Missing required parameter --nt-response!'
		return 1
	if not options.stationId:
		stationId = None
	else:
		# safely decode station id (fails with exception on mis-formatted id, thus returning 1)
		stationId = options.stationId
		stationId = stationId[0:2] + stationId[3:5] + stationId[6:8] + stationId[9:11] + stationId[12:14] + stationId[15:17]
		stationId = stationId.decode('hex')
	options.Challenge = options.Challenge.decode('hex')
	options.Response = options.Response.decode('hex')
	PasswordHash = getNTPasswordHash(options.Username, stationId)
	if PasswordHash and pyMsChapV2.ChallengeResponse(options.Challenge, PasswordHash) == options.Response:
		print 'NT_KEY: %s' % (pyMsChapV2.HashNtPasswordHash(PasswordHash).encode('hex').upper(), )
		return 0
	else:
		print 'Logon failure (0xc000006d)'
		return 1


if __name__ == "__main__":
	ldapConnection = univention.uldap.getMachineConnection()
	loadInfo()
	sys.exit(main())
