#! /usr/bin/env python
# -*- coding: utf-8 -*-

import sys
import time
import base64
import hashlib
import netaddr
sys.path.append('/usr/scripts/')

import lc_ldap.shortcuts
import affich_tools
from gestion.gen_confs import gen_config
from socket import gethostname
from gestion import config
import config.dns

def short_name(fullhostname):
    return fullhostname.split(".")[0]

def reverse(net, ip):
    """Renvoie la zone DNS inverse correspondant au réseau et à
    l'adresse donnés, ainsi que le nombre d'éléments de l'ip a
    mettre dans le fichier de zone."""
    n = netaddr.IPNetwork(net)
    a = netaddr.IPAddress(ip)
    rev_dns_a = a.reverse_dns.split('.')[:-1]
    assert a in n
    if n.version == 4:
        if n.prefixlen == 8:
            return ('.'.join(rev_dns_a[3:]), 3)
        elif n.prefixlen == 16:
            return ('.'.join(rev_dns_a[2:]), 2)
        else:
            return ('.'.join(rev_dns_a[1:]), 1)
    elif n.version == 6:
        return ('.'.join(rev_dns_a[(128-n.prefixlen)/4:]), (128-n.prefixlen)/4)


class ResourceRecord(object):
    def __init__(self, type, name, value, ttl=None):
        self._type=type
        self._name=name
        self._value=value
        self._ttl=ttl

    def __str__(self):
        if self._ttl:
            return "%s\t%s\tIN\t%s\t%s" % (self._name, self._ttl, self._type, self._value)
        else:
            return "%s\tIN\t%s\t%s" % (self._name, self._type, self._value)
    def __repr__(self):
        return str(self)

class SOA(ResourceRecord):
    def __init__(self, master, email, serial, refresh, retry, expire, ttl):
        super(SOA, self).__init__('SOA', '@', '%s. %s. (\n    %s ; numero de serie\n    %s ; refresh (s)\n    %s ; retry (s)\n    %s ; expire (s)\n    %s ; TTL (s)\n    )' % (master, email, serial, refresh, retry, expire, ttl))
class A(ResourceRecord):
    def __init__(self, name, value, ttl=None):
        super(A, self).__init__('A', name, value, ttl)
class DS(ResourceRecord):
    def __init__(self, name, value, ttl=None):
        super(DS, self).__init__('DS', name, value, ttl)
class PTR(ResourceRecord):
    def __init__(self, name, value, ttl=None):
        super(PTR, self).__init__('PTR', name, value, ttl)
class AAAA(ResourceRecord):
    def __init__(self, name, value, ttl=None):
        super(AAAA, self).__init__('AAAA', name, value, ttl)
class TXT(ResourceRecord):
    def __init__(self, name, value, ttl=None):
        super(TXT, self).__init__('TXT', name, value, ttl)
class CNAME(ResourceRecord):
    def __init__(self, name, value, ttl=None):
        super(CNAME, self).__init__('CNAME', name, value, ttl)
class DNAME(ResourceRecord):
    def __init__(self, name, value, ttl=None):
        super(DNAME, self).__init__('DNAME', name, value, ttl)
class MX(ResourceRecord):
    def __init__(self, name, priority, value, ttl=None):
        super(MX, self).__init__('MX', name, '%s\t%s' % (priority, value), ttl)
class NS(ResourceRecord):
    def __init__(self, name, value, ttl=None):
        super(NS, self).__init__('NS', name, value, ttl)
class SPF(ResourceRecord):
    def __init__(self, name, value, ttl=None):
        super(SPF, self).__init__('SPF', name, value, ttl)
class SRV(ResourceRecord):
    def __init__(self, service, proto, priority, weight, port, target, ttl=None):
        super(SRV, self).__init__('SRV', '_%s._%s' % (service, proto), '%s\t%s\t%s\t%s' % (priority, weight, port, target), ttl)
class NAPTR(ResourceRecord):
    def __init__(self, name, order, preference, flag, service, replace_regexpr, value, ttl=None):
        super(NAPTR, self).__init__('NAPTR', name, '%s\t%s\t"%s"\t"%s"\t"%s"\t%s' % (order, preference, flag, service, replace_regexpr, value), ttl)
class SSHFP(ResourceRecord):
    def __init__(self, name, hash, algo, key, ttl=None):
        if not hash in config.sshfp_hash.keys():
            raise ValueError('Hash %s invalid, valid hash are %s' % (hash, ', '.join(config.sshfp_host.keys())))
        if not algo in config.sshfp_algo.keys():
            raise ValueError('Algo %s unknown, valid values are %s' % (algo, ', '.join(config.sshfp_algo.keys())))
        super(SSHFP, self).__init__('SSHFP', name, '%s\t%s\t%s' % (config.sshfp_algo[algo][0], config.sshfp_hash[hash], getattr(hashlib, hash)(base64.b64decode(key)).hexdigest()), ttl)

class ZoneBase(object):
    def __init__(self, zone_name):
        self._rrlist=[]
        self.zone_name = zone_name
  

    def __repr__(self):
        return "<%s %s>" % (self.__class__.__name__, self.zone_name)
    def __str__(self):
        ret=""";***********************************************************
; Ce fichier est genere par les scripts de gen_confs
; Les donnees proviennent de la base LDAP et de la conf
; presente au debut du script.
;
; NE PAS EDITER
;
;***********************************************************

$ORIGIN %s.
$TTL %s
""" % (self.zone_name, self.ttl)
        for rr in self._rrlist:
            ret+="%s\n" % rr
        return ret

    def add(self, rr):
        if isinstance(rr, ResourceRecord):
            self._rrlist.append(rr)
        else:
            raise ValueError("You can only add ResourceRecords to a Zone")
    def extend(self, rr_list):
        for rr in rr_list:
            self.add(rr)

    def write(self, path):
        with open(path, 'w') as f:
            f.write("%s" % self)



class ZoneClone(ZoneBase):
    def __init__(self, zone_name, zone_clone, soa):
        super(ZoneClone, self).__init__(zone_name)
        self.zone_clone = zone_clone
        self.ttl = zone_clone.ttl

        self.add(soa)
        self.add(DNAME('', "%s." % self.zone_clone.zone_name))
        for rr in self.zone_clone._rrlist[1:]:
            if rr._name in ['', '@']:
                self.add(rr)
            if rr._name in ["%s." % self.zone_clone.zone_name]:
                self.add(ResourceRecord(rr._type, "%s." % "%s.", rr._value))
                
        
class Zone(ZoneBase):
    def __init__(self, zone_name, ttl, soa, ns_list, ipv6=True, ipv4=True, bl_zone=[]):
        super(Zone, self).__init__(zone_name)
        self.ttl = ttl
        self.ipv4 = ipv4
        self.ipv6 = ipv6
        self.bl_zone = bl_zone

        self.add(soa)
        for ns in ns_list:
            self.add(NS('@', '%s.' % ns))


    def get_name(self, hostname):
        # le hostname fini bien par la zone courante, et il n'appartient pas à une sous-zone
        if str(hostname) == self.zone_name or str(hostname).endswith(".%s" % self.zone_name) and not reduce(lambda x,y: x or y, [str(hostname).endswith(".%s" % z) for z in self.bl_zone if z != self.zone_name and z.endswith(self.zone_name)] + [False]):
            ret=str(hostname)[0:- len(self.zone_name) -1]
            if ret == "":
                return "@"
            else:
                return ret
        else:
            return None

    def add_delegation(zone, server):
        zone = self.het_name(zone)
        if zone:
            self.add(NS('@', '%s.' % server))

    def add_a_record(self, nom, machine):
        if self.ipv4:
            for ip in machine.get('ipHostNumber', []):
                self.add(A(nom, ip))
                if self.ipv6:
                    if nom == '@':
                        self.add(A("v4", ip))
                    else:
                        self.add(A("%s.v4" % nom, ip))

    def add_aaaa_record(self, nom, machine):
        if self.ipv6:
            for ip in machine.get('ip6HostNumber', []):
                if len(machine['dnsIpv6'])<1 or machine['dnsIpv6'][0].value:
                    self.add(AAAA(nom, ip))
                if self.ipv4:
                    if nom == '@':
                        self.add(AAAA("v6", ip))
                    else:
                        self.add(AAAA("%s.v6" % nom, ip))

    def add_sshfp_record(self, nom, machine):
        for sshkey in machine.get('sshFingerprint', []):
            algo_txt, key = str(sshkey).split()[:2]
            algo=config.sshfs_ralgo[algo_txt][1]
            for hash in config.sshfp_hash.keys():
                self.add(SSHFP(nom, hash, algo, key))
                if self.ipv4 and self.ipv6:
                    if nom == '@':
                        self.add(SSHFP("v4", hash, algo, key))
                        self.add(SSHFP("v6", hash, algo, key))
                    else:
                        self.add(SSHFP("%s.v4" % nom, hash, algo, key))
                        self.add(SSHFP("%s.v6" % nom, hash, algo, key))

    def add_machine(self, machine):
        for host in machine['host']:
            nom=self.get_name(host)
            if nom is None: continue

            self.add_a_record(nom, machine)
            self.add_aaaa_record(nom, machine)
            self.add_sshfp_record(nom, machine)


        if machine['host']:
            for alias in machine.get('hostAlias', []):
                if str(alias) in self.bl_zone and str(alias) != self.zone_name:
                    continue
                alias = self.get_name(alias)
                if alias is None: continue
                to_nom, to_zone = str(machine['host'][0]).split('.', 1)
                if alias in ['@', '%s.' % self.zone_name]:
                    self.add_a_record(alias, machine)
                    self.add_aaaa_record(alias, machine)
                    self.add_sshfp_record(alias, machine)  
                elif to_zone == self.zone_name:
                    self.add(CNAME(alias, "%s" % to_nom))
                    if self.ipv4 and self.ipv6:
                        self.add(CNAME("%s.v4" % alias, "%s.v4" % to_nom))
                        self.add(CNAME("%s.v6" % alias, "%s.v6" % to_nom))
                else:
                    self.add(CNAME(alias, "%s." % machine['host'][0]))
                        

class ZoneReverse(Zone):
    def __init__(self, net, ttl, soa, ns_list):
        self.net = net
        zone_name = reverse(net, net.split('/')[0])[0]
        if '.' in net:
            ipv6=False
            ipv4=True
        elif ':' in net:
            ipv6=True
            ipv4=False
        else:
            raise ValueError("net should be an ipv4 ou ipv6 network")
        super(ZoneReverse, self).__init__(zone_name, ttl, soa, ns_list, ipv6=ipv6, ipv4=ipv4)


    def add_machine(self, machine):
        if machine['host']:
            if self.ipv4:
                attr = 'ipHostNumber'
            elif self.ipv6:
                attr = 'ip6HostNumber'
            else:
                raise ValueError("A reverse zone should be ipv6 or ipv6")
            for ip in machine[attr]:
                try:
                    zone, length = reverse(self.net, str(ip))
                    nom = '.'.join(ip.value.reverse_dns.split('.')[:length])
                    if zone != self.zone_name:
                        continue
                    if attr != 'ip6HostNumber' or len(machine['dnsIpv6'])<1 or machine['dnsIpv6'][0].value: # Hack pour envoyer le reverse vers l'adresse .v6 dans le cas où dnsIpv6 = False
                       self.add(PTR(nom, '%s.' % machine['host'][0]))
                    else:
                        rev_nom, rev_zone = str(machine['host'][0]).split('.', 1)
                        self.add(PTR(nom, '%s.v6.%s.' % (rev_nom, rev_zone)))
                except AssertionError:
                    pass


class dns(gen_config) :
    ######################################PARTIE DE CONFIGURATION

    ### Fichiers à écrire
    # Répertoire d'écriture des fichiers de zone
    DNS_DIR = '/etc/bind/generated/' # Avec un / à la fin
    DNSSEC_DIR = '/etc/bind/signed/' # Avec un / à la fin
    # Fichier de définition des zones pour le maître
    DNS_CONF = DNS_DIR + 'zones_crans'

    # Fichier de définition des zones pour les esclaves géré par BCfg2
    DNS_CONF_BCFG2 = "/var/lib/bcfg2/Cfg/etc/bind/generated/zones_crans/zones_crans"

    ### Liste DNS
    # Le premier doit être le  maitre

    ### Liste des délégations de zone
    # Pour les demandes de ces zones, le DNS dira d'aller voir les serveurs listés ici
    # Pour les noms des serveurs on met le nom sans point à la fin
    # { nom_de_zone : [ ns1, ns2, ...]
    DELEG = {}

    ### Serveurs de mail
    # format : [ priorité serveur , .... ]
    MXs = [
        MX('@',10, 'redisdead.crans.org.'),
        MX('@',20, 'ovh.crans.org.'),
        MX('@',25, 'freebox.crans.org.'),
    ]
    SRVs = {
       'crans.org': [
            SRV('jabber', 'tcp', 5, 0, 5269, 'xmpp'),
            SRV('xmpp-server', 'tcp', 5, 0, 5269, 'xmpp'),
            SRV('xmpp-client', 'tcp', 5, 0, 5222, 'xmpp'),
            SRV('sip', 'udp', 5, 0, 5060, 'asterisk'),
            SRV('sip', 'tcp', 5, 0, 5060, 'asterisk'),
            SRV('sips', 'tcp', 5, 0, 5061, 'asterisk'),
         ]
    }
    NATPRs = { 
       'crans.org' : [
              NAPTR('@', 5, 100, "S", "SIPS+D2T", "", '_sips._tcp.crans.org.', ttl=86400),
              NAPTR('@', 10, 100, "S", "SIP+D2U", "", '_sip._udp.crans.org.', ttl=86400),
              NAPTR('@', 15, 100, "S", "SIP+D2T", "", '_sip._tcp.crans.org.', ttl=86400),
        ]
    }

    # DS à publier dans zone parentes : { parent : [ zone. TTL IN DS key_id algo_id 1 hash ] }
    # ex : { 'crans.eu' :  ['wifi.crans.eu.             86400   IN      DS      33131 8 1 3B573B0E2712D8A8B1B0C3'] }
    # /!\ Il faut faire attention au rollback des keys, il faudrait faire quelque chose d'automatique avec opendnssec
    DSs = {
        'crans.eu': [
            DS('wifi', '37582 8 2 51809b508e450d8fec44572a3fa31754c27507465775c7d1c86570abd7a21024'),
            DS('v6','12562 8 2 0a8e92398c5213cf2907b79f0fa8bd7db6729e0d2f6ca7443ac5a4b8441e38bd'),
          ],
        'v6.crans.eu' : [
            DS('wifi','1799 8 2 52a40a7dfb3e9c88aee032c21c59be756c8d3de29149c408ed8b699d83e30032'),
         ],
        'crans.org': [
            DS('v6','23641 8 2 3fff97a2581f0f2f49257b4914d5badf8ccb0a49c5a6f4cbf2f520b97de332d0'),
            DS('adm','565 8 2 498f6cd5bcf291aae4129700a7569fa6e9a86821185bd655f0b9efc6a3bf547e'),
            DS('ferme','35156 8 2 b63a1443b3d7434429e879e046bc8ba89056cdcb4b9c3566853e64fd521895b8'),
            DS('wifi','41320 8 2 024799c1d53f1e827f03d17bc96709b85ee1c05d77eb0ebeadcfbe207ee776a4'),
            DS('tv','30910 8 2 3317f684081867ab94402804fbb3cd187e29655cc7f34cb92c938183fe0b71f5'),
          ],
        'v6.crans.org' : [
            DS('adm','1711 8 2 f154eeb8eb346d2ca5cffb3f9cc464a17c0c4d69ee425b4fe44eaed7f5dd253b'),
            DS('ferme','44434 8 2 fb87cb4216599cb6574add543078a9e48d0e50438483386585a9960557434ab0'),
            DS('wifi','59539 8 2 dbe86f2f2e92d6a27bd1436f03ec1588f2948a2aa02124de0383be801cced85e'),
         ]
    }


    hostname = short_name(gethostname())
    serial = int(time.time()) + 1000000000
    TTL = 3600

    if hostname ==  short_name(config.dns.DNSs[0]):
        restart_cmd = '/usr/sbin/ods-signer sign --all && /etc/init.d/bind9 reload'
    else:
        restart_cmd = '/etc/init.d/bind9 reload'


    def gen_soa(self, ns_list, serial, ttl):
        return SOA(ns_list[0], 'root.crans.org', serial, 21600, 3600, 1209600, ttl)


    def populate_zones(self, zones, machines):
        self.anim.iter=len(zones.values())
        for zone in zones.values():
            zone.extend(self.MXs)
            for rr_type in [self.SRVs, self.NATPRs, self.DSs]:
                if zone.zone_name in rr_type.keys():
                    zone.extend(rr_type[zone.zone_name])
            for m in machines:
                zone.add_machine(m)
            self.anim.cycle()
        return zones

    def gen_zones_ldap(self, ttl, ns_list, serial, zones={}, zones_ldap=config.dns.zones_ldap):
        for zone in zones_ldap:
            zones[zone]=Zone(zone, ttl, self.gen_soa(ns_list, serial, ttl), ns_list, bl_zone=config.dns.zones_direct)
        return zones

    def gen_zones_reverse(self, ttl, ns_list, serial, zones={},
        zones_reverse_v4=config.dns.zones_reverse, zones_reverse_v6=config.dns.zones_reverse_v6):
        # reverse ipv4
        for net in zones_reverse_v4:
            net = netaddr.IPNetwork(net)
            if net.prefixlen > 24:
                subnets = net.subnet(32)
            elif net.prefixlen > 16:
                subnets = net.subnet(24)
            elif net.prefixlen > 8:
                subnets = net.subnet(16)
            else:
                subnets = net.subnet(8)
            for subnet in subnets:
                zones[str(subnet)]=ZoneReverse(str(subnet), ttl, self.gen_soa(ns_list, serial, ttl), ns_list)
        # reverse ipv6
        for net in zones_reverse_v6:
            zones[net]=ZoneReverse(net, ttl, self.gen_soa(ns_list, serial, ttl), ns_list)
        return zones

    def gen_zones_clone(self, ttl, ns_list, serial, zones={}):
        for zone_clone, zones_alias in config.dns.zone_alias.items():
            for zone in zones_alias:
                zones[zone]=ZoneClone(zone, zones[zone_clone], self.gen_soa(ns_list, serial, ttl))
                for rr_type in [self.SRVs, self.NATPRs, self.DSs]:
                    if zones[zone].zone_name in rr_type.keys():
                        zones[zone].extend(rr_type[zones[zone].zone_name])
        return zones


    def gen_zones(self, ttl, serial, ns_list, populate=True):
        zones = {}
        self.gen_zones_ldap(ttl, ns_list, serial, zones)
        self.gen_zones_reverse(ttl, ns_list, serial, zones)

        if populate:
            conn = lc_ldap.shortcuts.lc_ldap_admin()
            machines = conn.search(u"mid=*", sizelimit=10000)
            machines.extend(conn.machinesMulticast())
            self.populate_zones(zones, machines)

        # Doit être fait après populate_zones lorsque l'on a l'intention d'écrire les fichiers de zone
        # En effet, la génération de la zone clone dépend du contenue de la zone originale
        self.gen_zones_clone(ttl, ns_list, serial, zones)
        return zones


    def gen_tv(self, populate=True):
        self.anim = affich_tools.anim('\tgénération de la zone tv')
        zones = {}
        serial = self.serial
        self.gen_zones_reverse(self.TTL, config.dns.DNSs, serial, zones, zones_reverse_v4=config.NETs['multicast'], zones_reverse_v6=[])
        self.gen_zones_ldap(self.TTL, config.dns.DNSs, serial, zones, zones_ldap=[config.dns.zone_tv])

        if populate:
            conn = lc_ldap.shortcuts.lc_ldap_admin()
            machines=conn.machinesMulticast()
            self.populate_zones(zones, machines)

            for zone in zones.values():
                zone.write(self.DNS_DIR  + 'db.' + zone.zone_name)

        self.anim.reinit()
        print affich_tools.OK
        return zones

    def gen_master(self):
        # Syntaxe utilisée dans le fichier DNS_CONF pour définir une zone sur le maître
        zone_template="""
zone "%(zone_name)s" {
    type master;
    file "%(zone_path)s";
};
"""
        zones = self.gen_zones(self.TTL, self.serial, config.dns.DNSs)
        with open(self.DNS_CONF, 'w') as f:
            for zone in zones.values():
                zone.write(self.DNS_DIR  + 'db.' + zone.zone_name)
                if zone.zone_name in config.dns.zones_dnssec:
                    zone_path = self.DNSSEC_DIR  + 'db.' + zone.zone_name
                else:
                    zone_path = self.DNS_DIR  + 'db.' + zone.zone_name
                f.write(zone_template % {'zone_name' : zone.zone_name, 'zone_path' : zone_path})

    def gen_slave(self):
        zone_template="""
zone "%(zone_name)s" {
    type slave;
    file "%(zone_path)s";
    masters { %(master_ip)s; };
};
"""
        zones = self.gen_zones(self.TTL, self.serial, config.dns.DNSs, populate=False)
        with open(self.DNS_CONF_BCFG2, 'w') as f:
            for zone in zones.values():
                if zone.zone_name in config.dns.zones_dnssec:
                    zone_path = self.DNSSEC_DIR  + 'db.' + zone.zone_name
                else:
                    zone_path = self.DNS_DIR  + 'db.' + zone.zone_name
                f.write(zone_template % {'zone_name' : zone.zone_name, 'zone_path' : zone_path, 'master_ip' : config.dns.master})

    def _gen(self):
        self.gen_master()

    def __str__(self):
        return "DNS"


if __name__ == '__main__' :
    hostname = short_name(gethostname())
    if hostname == short_name(config.bcfg2_main):
        print "Reconfiguration du fichier de BCfg2 pour configurer le bind d'un serveur en esclave (pensez à lancer bcfg2 sur les esclaves)."
        c = dns()
        c.gen_slave()
    elif hostname == short_name(config.dns.DNSs[0]):
        print "Serveur maître :"
        c = dns()
        zones = c.gen_tv()
        import subprocess
        for zone in zones.values():
            if zone.zone_name in config.dns.zones_dnssec:
                args=("/usr/sbin/ods-signer sign %s" % zone.zone_name).split()
                p=subprocess.Popen(args,stdout=subprocess.PIPE,stderr=subprocess.PIPE)
                ret=p.communicate()
                print ret[0].strip()
                if ret[1].strip():
                    print ret[1].strip()
        print "Ce serveur est également serveur maitre pour les autres zones dns, mais leur reconfiguration se fait par generate."
    elif hostname in map(lambda fullhostname : short_name(fullhostname),config.dns.DNSs[1:]):
        print "Ce serveur est esclave! Lancez ce script sur %s, puis lancez bcfg2 ici" % bcfg2_main
    else:
        print "Ce serveur ne correspond à rien pour la configuration DNS."