# Unix SMB/CIFS implementation.
# Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
#

"""Tests for the Credentials Python bindings.

Note that this just tests the bindings work. It does not intend to test
the functionality, that's already done in other tests.
"""

from samba import credentials
import samba.tests
import os
import binascii
from samba.dcerpc import misc


class CredentialsTests(samba.tests.TestCaseInTempDir):

    def setUp(self):
        super().setUp()
        self.creds = credentials.Credentials()

    def test_set_username(self):
        self.creds.set_username("somebody")
        self.assertEqual("somebody", self.creds.get_username())

    def test_set_password(self):
        self.creds.set_password("S3CreT")
        self.assertEqual("S3CreT", self.creds.get_password())

    def test_set_utf16_password(self):
        password = 'S3cRet'
        passbytes = password.encode('utf-16-le')
        self.assertTrue(self.creds.set_utf16_password(passbytes))
        self.assertEqual(password, self.creds.get_password())

    def test_set_old_password(self):
        self.assertEqual(None, self.creds.get_old_password())
        self.assertTrue(self.creds.set_old_password("S3c0ndS3CreT"))
        self.assertEqual("S3c0ndS3CreT", self.creds.get_old_password())

    def test_set_old_utf16_password(self):
        password = '0ldS3cRet'
        passbytes = password.encode('utf-16-le')
        self.assertTrue(self.creds.set_old_utf16_password(passbytes))
        self.assertEqual(password, self.creds.get_old_password())

    def test_set_domain(self):
        self.creds.set_domain("ABMAS")
        self.assertEqual("ABMAS", self.creds.get_domain())
        self.assertEqual(self.creds.get_principal(), None)

    def test_set_realm(self):
        self.creds.set_realm("myrealm")
        self.assertEqual("MYREALM", self.creds.get_realm())
        self.assertEqual(self.creds.get_principal(), None)

    def test_parse_string_anon(self):
        self.creds.parse_string("%")
        self.assertEqual("", self.creds.get_username())
        self.assertEqual(None, self.creds.get_password())

    def test_parse_string_empty_pw(self):
        self.creds.parse_string("someone%")
        self.assertEqual("someone", self.creds.get_username())
        self.assertEqual("", self.creds.get_password())

    def test_parse_string_none_pw(self):
        self.creds.parse_string("someone")
        self.assertEqual("someone", self.creds.get_username())
        self.assertEqual(None, self.creds.get_password())

    def test_parse_string_user_pw_domain(self):
        self.creds.parse_string("dom\\someone%secr")
        self.assertEqual("someone", self.creds.get_username())
        self.assertEqual("secr", self.creds.get_password())
        self.assertEqual("DOM", self.creds.get_domain())

    def test_bind_dn(self):
        self.assertEqual(None, self.creds.get_bind_dn())
        self.creds.set_bind_dn("dc=foo,cn=bar")
        self.assertEqual("dc=foo,cn=bar", self.creds.get_bind_dn())

    def test_is_anon(self):
        self.creds.set_username("")
        self.assertTrue(self.creds.is_anonymous())
        self.creds.set_username("somebody")
        self.assertFalse(self.creds.is_anonymous())
        self.creds.set_anonymous()
        self.assertTrue(self.creds.is_anonymous())

    def test_workstation(self):
        # FIXME: This is uninitialised, it should be None
        #self.assertEqual(None, self.creds.get_workstation())
        self.creds.set_workstation("myworksta")
        self.assertEqual("myworksta", self.creds.get_workstation())

    def test_secure_channel_type(self):
        self.assertEqual(misc.SEC_CHAN_NULL,
                         self.creds.get_secure_channel_type())
        self.creds.set_secure_channel_type(misc.SEC_CHAN_BDC)
        self.assertEqual(misc.SEC_CHAN_BDC,
                         self.creds.get_secure_channel_type())

    def test_get_nt_hash(self):
        password = "geheim"
        hex_nthash = "c2ae1fe6e648846352453e816f2aeb93"
        self.creds.set_password(password)
        self.assertEqual(password, self.creds.get_password())
        self.assertEqual(binascii.a2b_hex(hex_nthash),
                         self.creds.get_nt_hash())

    def test_get_ntlm_response(self):
        password = "SecREt01"
        hex_challenge = "0123456789abcdef"
        hex_nthash = "cd06ca7c7e10c99b1d33b7485a2ed808"
        hex_session_key = "3f373ea8e4af954f14faa506f8eebdc4"
        hex_ntlm_response = "25a98c1c31e81847466b29b2df4680f39958fb8c213a9cc6"
        self.creds.set_username("fred")
        self.creds.set_domain("nurk")
        self.creds.set_password(password)
        self.assertEqual(password, self.creds.get_password())
        self.assertEqual(binascii.a2b_hex(hex_nthash),
                         self.creds.get_nt_hash())
        response = self.creds.get_ntlm_response(flags=credentials.CLI_CRED_NTLM_AUTH,
                                                challenge=binascii.a2b_hex(hex_challenge))

        self.assertEqual(response["nt_response"], binascii.a2b_hex(hex_ntlm_response))
        self.assertEqual(response["nt_session_key"], binascii.a2b_hex(hex_session_key))
        self.assertEqual(response["flags"], credentials.CLI_CRED_NTLM_AUTH)

    def test_get_nt_hash_string(self):
        self.creds.set_password_will_be_nt_hash(True)
        hex_nthash = "c2ae1fe6e648846352453e816f2aeb93"
        self.creds.set_password(hex_nthash)
        self.assertEqual(None, self.creds.get_password())
        self.assertEqual(binascii.a2b_hex(hex_nthash),
                         self.creds.get_nt_hash())

    def test_set_cmdline_callbacks(self):
        self.creds.set_cmdline_callbacks()

    def test_authentication_requested(self):
        self.creds.set_username("")
        self.assertFalse(self.creds.authentication_requested())
        self.creds.set_username("somebody")
        self.assertTrue(self.creds.authentication_requested())

    def test_wrong_password(self):
        self.assertFalse(self.creds.wrong_password())

    def test_guess(self):
        creds = credentials.Credentials()
        lp = samba.tests.env_loadparm()
        os.environ["USER"] = "env_user"
        creds.guess(lp)
        self.assertEqual(creds.get_username(), "env_user")
        self.assertEqual(creds.get_domain(), lp.get("workgroup").upper())
        self.assertEqual(creds.get_realm(), None)
        self.assertEqual(creds.get_principal(), "env_user@%s" % creds.get_domain())
        self.assertEqual(creds.is_anonymous(), False)
        self.assertEqual(creds.authentication_requested(), False)

    def test_set_anonymous(self):
        creds = credentials.Credentials()
        lp = samba.tests.env_loadparm()
        os.environ["USER"] = "env_user"
        creds.guess(lp)
        creds.set_anonymous()
        self.assertEqual(creds.get_username(), "")
        self.assertEqual(creds.get_domain(), "")
        self.assertEqual(creds.get_realm(), None)
        self.assertEqual(creds.get_principal(), None)
        self.assertEqual(creds.is_anonymous(), True)
        self.assertEqual(creds.authentication_requested(), False)

    def test_parse_file_1(self):
        realm = "realm.example.com"
        domain = "dom"
        password = "pass"
        username = "user"

        passwd_file_name = os.path.join(self.tempdir, "parse_file")
        passwd_file_fd = open(passwd_file_name, 'x')
        passwd_file_fd.write("realm=%s\n" % realm)
        passwd_file_fd.write("domain=%s\n" % domain)
        passwd_file_fd.write("username=%s\n" % username)
        passwd_file_fd.write("password=%s\n" % password)
        passwd_file_fd.close()
        self.creds.parse_file(passwd_file_name)
        self.assertEqual(self.creds.get_username(), username)
        self.assertEqual(self.creds.get_password(), password)
        self.assertEqual(self.creds.get_domain(), domain.upper())
        self.assertEqual(self.creds.get_realm(), realm.upper())
        self.assertEqual(self.creds.get_principal(), "%s@%s" % (username, realm.upper()))
        self.assertEqual(self.creds.is_anonymous(), False)
        self.assertEqual(self.creds.authentication_requested(), True)
        os.unlink(passwd_file_name)

    def test_parse_file_2(self):
        realm = "realm.example.com"
        domain = "dom"
        password = "pass"
        username = "user"

        passwd_file_name = os.path.join(self.tempdir, "parse_file")
        passwd_file_fd = open(passwd_file_name, 'x')
        passwd_file_fd.write("realm=%s\n" % realm)
        passwd_file_fd.write("domain=%s\n" % domain)
        passwd_file_fd.write("username=%s\\%s\n" % (domain, username))
        passwd_file_fd.write("password=%s\n" % password)
        passwd_file_fd.close()
        self.creds.parse_file(passwd_file_name)
        self.assertEqual(self.creds.get_username(), username)
        self.assertEqual(self.creds.get_password(), password)
        self.assertEqual(self.creds.get_domain(), domain.upper())
        self.assertEqual(self.creds.get_realm(), realm.upper())
        self.assertEqual(self.creds.get_principal(), "%s@%s" % (username, realm.upper()))
        self.assertEqual(self.creds.is_anonymous(), False)
        self.assertEqual(self.creds.authentication_requested(), True)
        os.unlink(passwd_file_name)

    def test_parse_file_3(self):
        realm = "realm.example.com"
        domain = "domain"
        password = "password"
        username = "username"

        userdom = "userdom"

        passwd_file_name = os.path.join(self.tempdir, "parse_file")
        passwd_file_fd = open(passwd_file_name, 'x')
        passwd_file_fd.write("realm=%s\n" % realm)
        passwd_file_fd.write("domain=%s\n" % domain)
        passwd_file_fd.write("username=%s/%s\n" % (userdom, username))
        passwd_file_fd.write("password=%s\n" % password)
        passwd_file_fd.close()
        self.creds.parse_file(passwd_file_name)
        self.assertEqual(self.creds.get_username(), username)
        self.assertEqual(self.creds.get_password(), password)
        self.assertEqual(self.creds.get_domain(), userdom.upper())
        self.assertEqual(self.creds.get_realm(), userdom.upper())
        self.assertEqual(self.creds.get_principal(), "%s@%s" % (username, userdom.upper()))
        self.assertEqual(self.creds.is_anonymous(), False)
        self.assertEqual(self.creds.authentication_requested(), True)
        os.unlink(passwd_file_name)

    def test_parse_file_4(self):
        password = "password"
        username = "username"

        userdom = "userdom"

        passwd_file_name = os.path.join(self.tempdir, "parse_file")
        passwd_file_fd = open(passwd_file_name, 'x')
        passwd_file_fd.write("username=%s\\%s%%%s\n" % (userdom, username, password))
        passwd_file_fd.write("realm=ignorerealm\n")
        passwd_file_fd.write("domain=ignoredomain\n")
        passwd_file_fd.write("password=ignorepassword\n")
        passwd_file_fd.close()
        self.creds.parse_file(passwd_file_name)
        self.assertEqual(self.creds.get_username(), username)
        self.assertEqual(self.creds.get_password(), password)
        self.assertEqual(self.creds.get_domain(), userdom.upper())
        self.assertEqual(self.creds.get_realm(), userdom.upper())
        self.assertEqual(self.creds.get_principal(), "%s@%s" % (username, userdom.upper()))
        self.assertEqual(self.creds.is_anonymous(), False)
        self.assertEqual(self.creds.authentication_requested(), True)
        os.unlink(passwd_file_name)

    def test_parse_file_5(self):
        password = "password"
        username = "username"

        userdom = "userdom"

        passwd_file_name = os.path.join(self.tempdir, "parse_file")
        passwd_file_fd = open(passwd_file_name, 'x')
        passwd_file_fd.write("realm=ignorerealm\n")
        passwd_file_fd.write("username=%s\\%s%%%s\n" % (userdom, username, password))
        passwd_file_fd.write("domain=ignoredomain\n")
        passwd_file_fd.write("password=ignorepassword\n")
        passwd_file_fd.close()
        self.creds.parse_file(passwd_file_name)
        self.assertEqual(self.creds.get_username(), username)
        self.assertEqual(self.creds.get_password(), password)
        self.assertEqual(self.creds.get_domain(), userdom.upper())
        self.assertEqual(self.creds.get_realm(), userdom.upper())
        self.assertEqual(self.creds.get_principal(), "%s@%s" % (username, userdom.upper()))
        self.assertEqual(self.creds.is_anonymous(), False)
        self.assertEqual(self.creds.authentication_requested(), True)
        os.unlink(passwd_file_name)

    def test_parse_username_0(self):
        creds = credentials.Credentials()
        lp = samba.tests.env_loadparm()
        os.environ["USER"] = "env_user"
        creds.guess(lp)
        creds.parse_string("user")
        self.assertEqual(creds.get_username(), "user")
        self.assertEqual(creds.get_domain(), lp.get("workgroup").upper())
        self.assertEqual(creds.get_realm(), None)
        self.assertEqual(creds.get_principal(), "user@%s" % lp.get("workgroup").upper())
        self.assertEqual(creds.is_anonymous(), False)
        self.assertEqual(creds.authentication_requested(), True)

    def test_parse_username_1(self):
        creds = credentials.Credentials()
        lp = samba.tests.env_loadparm()
        os.environ["USER"] = "env_user"
        creds.guess(lp)
        realm = "realm.example.com"
        creds.set_realm(realm, credentials.SMB_CONF)
        creds.parse_string("user")
        self.assertEqual(creds.get_username(), "user")
        self.assertEqual(creds.get_domain(), lp.get("workgroup").upper())
        self.assertEqual(creds.get_realm(), realm.upper())
        self.assertEqual(creds.get_principal(), "user@%s" % realm.upper())
        self.assertEqual(creds.is_anonymous(), False)
        self.assertEqual(creds.authentication_requested(), True)

    def test_parse_username_with_domain_0(self):
        creds = credentials.Credentials()
        lp = samba.tests.env_loadparm()
        os.environ["USER"] = "env_user"
        creds.guess(lp)
        creds.parse_string("domain\\user")
        self.assertEqual(creds.get_username(), "user")
        self.assertEqual(creds.get_domain(), "DOMAIN")
        self.assertEqual(creds.get_realm(), None)
        self.assertEqual(creds.get_principal(), "user@DOMAIN")
        self.assertEqual(creds.is_anonymous(), False)
        self.assertEqual(creds.authentication_requested(), True)

    def test_parse_username_with_domain_1(self):
        creds = credentials.Credentials()
        lp = samba.tests.env_loadparm()
        os.environ["USER"] = "env_user"
        creds.guess(lp)
        realm = "realm.example.com"
        creds.set_realm(realm, credentials.SMB_CONF)
        self.assertEqual(creds.get_username(), "env_user")
        self.assertEqual(creds.get_domain(), lp.get("workgroup").upper())
        self.assertEqual(creds.get_realm(), realm.upper())
        self.assertEqual(creds.get_principal(), "env_user@%s" % realm.upper())
        creds.set_principal("unknown@realm.example.com")
        self.assertEqual(creds.get_username(), "env_user")
        self.assertEqual(creds.get_domain(), lp.get("workgroup").upper())
        self.assertEqual(creds.get_realm(), realm.upper())
        self.assertEqual(creds.get_principal(), "unknown@realm.example.com")
        creds.parse_string("domain\\user")
        self.assertEqual(creds.get_username(), "user")
        self.assertEqual(creds.get_domain(), "DOMAIN")
        self.assertEqual(creds.get_realm(), realm.upper())
        self.assertEqual(creds.get_principal(), "user@DOMAIN")
        self.assertEqual(creds.is_anonymous(), False)
        self.assertEqual(creds.authentication_requested(), True)

    def test_parse_username_with_domain_2(self):
        creds = credentials.Credentials()
        lp = samba.tests.env_loadparm()
        os.environ["USER"] = "env_user"
        creds.guess(lp)
        realm = "realm.example.com"
        creds.set_realm(realm, credentials.SPECIFIED)
        self.assertEqual(creds.get_username(), "env_user")
        self.assertEqual(creds.get_domain(), lp.get("workgroup").upper())
        self.assertEqual(creds.get_realm(), realm.upper())
        self.assertEqual(creds.get_principal(), "env_user@%s" % realm.upper())
        creds.set_principal("unknown@realm.example.com")
        self.assertEqual(creds.get_username(), "env_user")
        self.assertEqual(creds.get_domain(), lp.get("workgroup").upper())
        self.assertEqual(creds.get_realm(), realm.upper())
        self.assertEqual(creds.get_principal(), "unknown@realm.example.com")
        creds.parse_string("domain\\user")
        self.assertEqual(creds.get_username(), "user")
        self.assertEqual(creds.get_domain(), "DOMAIN")
        self.assertEqual(creds.get_realm(), "DOMAIN")
        self.assertEqual(creds.get_principal(), "user@DOMAIN")
        self.assertEqual(creds.is_anonymous(), False)
        self.assertEqual(creds.authentication_requested(), True)

    def test_parse_username_with_realm(self):
        creds = credentials.Credentials()
        lp = samba.tests.env_loadparm()
        os.environ["USER"] = "env_user"
        creds.guess(lp)
        creds.parse_string("user@samba.org")
        self.assertEqual(creds.get_username(), "user@samba.org")
        self.assertEqual(creds.get_domain(), "")
        self.assertEqual(creds.get_realm(), "SAMBA.ORG")
        self.assertEqual(creds.get_principal(), "user@samba.org")
        self.assertEqual(creds.is_anonymous(), False)
        self.assertEqual(creds.authentication_requested(), True)

    def test_parse_username_pw(self):
        creds = credentials.Credentials()
        lp = samba.tests.env_loadparm()
        os.environ["USER"] = "env_user"
        creds.guess(lp)
        creds.parse_string("user%pass")
        self.assertEqual(creds.get_username(), "user")
        self.assertEqual(creds.get_password(), "pass")
        self.assertEqual(creds.get_domain(), lp.get("workgroup"))
        self.assertEqual(creds.get_realm(), None)
        self.assertEqual(creds.get_principal(), "user@%s" % lp.get("workgroup"))
        self.assertEqual(creds.is_anonymous(), False)
        self.assertEqual(creds.authentication_requested(), True)

    def test_parse_username_with_domain_pw(self):
        creds = credentials.Credentials()
        lp = samba.tests.env_loadparm()
        os.environ["USER"] = "env_user"
        creds.guess(lp)
        creds.parse_string("domain\\user%pass")
        self.assertEqual(creds.get_username(), "user")
        self.assertEqual(creds.get_domain(), "DOMAIN")
        self.assertEqual(creds.get_password(), "pass")
        self.assertEqual(creds.get_realm(), None)
        self.assertEqual(creds.get_principal(), "user@DOMAIN")
        self.assertEqual(creds.is_anonymous(), False)
        self.assertEqual(creds.authentication_requested(), True)

    def test_parse_username_with_realm_pw(self):
        creds = credentials.Credentials()
        lp = samba.tests.env_loadparm()
        os.environ["USER"] = "env_user"
        creds.guess(lp)
        creds.parse_string("user@samba.org%pass")
        self.assertEqual(creds.get_username(), "user@samba.org")
        self.assertEqual(creds.get_domain(), "")
        self.assertEqual(creds.get_password(), "pass")
        self.assertEqual(creds.get_realm(), "SAMBA.ORG")
        self.assertEqual(creds.get_principal(), "user@samba.org")
        self.assertEqual(creds.is_anonymous(), False)
        self.assertEqual(creds.authentication_requested(), True)

    def test_smb_signing(self):
        creds = credentials.Credentials()
        self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_DEFAULT)
        creds.set_smb_signing(credentials.SMB_SIGNING_REQUIRED)
        self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_REQUIRED)

    def test_smb_signing_set_conf(self):
        lp = samba.tests.env_loadparm()

        creds = credentials.Credentials()
        creds.set_conf(lp)
        self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_DEFAULT)
        creds.set_smb_signing(credentials.SMB_SIGNING_OFF)
        self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_OFF)
        creds.set_conf(lp)
        self.assertEqual(creds.get_smb_signing(), credentials.SMB_SIGNING_OFF)

    def test_smb_ipc_signing(self):
        creds = credentials.Credentials()
        self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED)
        creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF)
        self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF)

    def test_smb_ipc_signing_set_conf(self):
        lp = samba.tests.env_loadparm()

        creds = credentials.Credentials()
        creds.set_conf(lp)
        self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_REQUIRED)
        creds.set_smb_ipc_signing(credentials.SMB_SIGNING_OFF)
        self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF)
        creds.set_conf(lp)
        self.assertEqual(creds.get_smb_ipc_signing(), credentials.SMB_SIGNING_OFF)

    def test_smb_encryption(self):
        creds = credentials.Credentials()
        self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_DEFAULT)
        creds.set_smb_encryption(credentials.SMB_ENCRYPTION_REQUIRED)
        self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_REQUIRED)

    def test_smb_encryption_set_conf(self):
        lp = samba.tests.env_loadparm()

        creds = credentials.Credentials()
        creds.set_conf(lp)
        self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_DEFAULT)
        creds.set_smb_encryption(credentials.SMB_ENCRYPTION_OFF)
        self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_OFF)
        creds.set_conf(lp)
        self.assertEqual(creds.get_smb_encryption(), credentials.SMB_ENCRYPTION_OFF)