import os

import re

from k5test import *

# On macOS with System Integrity Protection enabled, this script hangs

# in the wait_for_prop() call after starting the first kpropd process,

# most likely due to signal restrictions preventing the listening

# child from informing the parent that a full resync was processed.

if which('csrutil'):

    out = subprocess.check_output(['csrutil', 'status'],

                                  universal_newlines=True)

    if 'status: enabled' in out:

        skip_rest('iprop tests', 'System Integrity Protection is enabled')

# Read lines from kpropd output until we are synchronized.  Error if

# full_expected is true and we didn't see a full propagation or vice

# versa.

def wait_for_prop(kpropd, full_expected, expected_old, expected_new):

    output('*** Waiting for sync from kpropd\n')

    full_seen = sleep_seen = False

    old_sno = new_sno = -1

    while True:

        line = kpropd.stdout.readline()

        if line == '':

            fail('kpropd process exited unexpectedly')

        output('kpropd: ' + line)

        m = re.match(r'Calling iprop_get_updates_1 \(sno=(\d+) ', line)

        if m:

            if not full_seen:

                old_sno = int(m.group(1))

            # Also record this as the new sno, in case we get back

            # UPDATE_NIL.

            new_sno = int(m.group(1))

        m = re.match(r'Got incremental updates \(sno=(\d+) ', line)

        if m:

            new_sno = int(m.group(1))

        if 'KDC is synchronized' in line or 'Incremental updates:' in line:

            break

        # After a full resync request, these lines could appear in

        # either order.

        if 'Waiting for' in line:

            sleep_seen = True

        if 'load process for full propagation completed' in line:

            full_seen = True

        # Detect some failure conditions.

        if 'Still waiting for full resync' in line:

            fail('kadmind gave consecutive full resyncs')

        if 'Rejected connection' in line:

            fail('kpropd rejected kprop connection')

        if 'get updates failed' in line:

            fail('iprop_get_updates failed')

        if 'permission denied' in line:

            fail('kadmind denied update')

        if 'error from master' in line or 'error returned from master' in line:

            fail('kadmind reported error')

        if 'invalid return' in line:

            fail('kadmind returned invalid result')

    if full_expected and not full_seen:

        fail('Expected full dump but saw only incremental')

    if full_seen and not full_expected:

        fail('Expected incremental prop but saw full dump')

    if old_sno != expected_old:

         fail('Expected old serial %d from kpropd sync' % expected_old)

    if new_sno != expected_new:

         fail('Expected new serial %d from kpropd sync' % expected_new)

    # Wait until kpropd is sleeping before continuing, to avoid races.

    # (This is imperfect since there's there is a short window between

    # the fprintf and the sleep; kpropd will need design changes to

    # fix that.)

    while True:

        line = kpropd.stdout.readline()

        output('kpropd: ' + line)

        if 'Waiting for' in line:

            break

    output('*** Sync complete\n')

# Verify the output of kproplog against the expected number of

# entries, first and last serial number, and a list of principal names

# for the update entrires.

def check_ulog(num, first, last, entries, env=None):

    out = realm.run([kproplog], env=env)

    if 'Number of entries : ' + str(num) + '\n' not in out:

        fail('Expected %d entries' % num)

    if last:

        firststr = first and str(first) or 'None'

        if 'First serial # : ' + firststr + '\n' not in out:

            fail('Expected first serial number %d' % first)

    laststr = last and str(last) or 'None'

    if 'Last serial # : ' + laststr + '\n' not in out:

        fail('Expected last serial number %d' % last)

    assert(len(entries) == num)

    ser = first - 1

    entindex = 0

    for line in out.splitlines():

        m = re.match(r'\tUpdate serial # : (\d+)$', line)

        if m:

            ser = ser + 1

            if m.group(1) != str(ser):

                fail('Expected serial number %d in update entry' % ser)

        m = re.match(r'\tUpdate principal : (.*)$', line)

        if m:

            eprinc = entries[ser - first]

            if eprinc == None:

                fail('Expected dummy update entry %d' % ser)

            elif m.group(1) != eprinc:

                fail('Expected princ %s in update entry %d' % (eprinc, ser))

        if line == '\tDummy entry':

            eprinc = entries[ser - first]

            if eprinc != None:

                fail('Expected princ %s in update entry %d' % (eprinc, ser))

# replica1 will receive updates from master, and replica2 will receive

# updates from replica1.  Because of the awkward way iprop and kprop

# port configuration currently works, we need separate config files

# for the replica and master sides of replica1, but they use the same

# DB and ulog file.

conf = {'realms': {'$realm': {'iprop_enable': 'true',

                              'iprop_logfile': '$testdir/db.ulog'}}}

conf_rep1 = {'realms': {'$realm': {'iprop_replica_poll': '600',

                                   'iprop_logfile': '$testdir/ulog.replica1'}},

             'dbmodules': {'db': {'database_name': '$testdir/db.replica1'}}}

conf_rep1m = {'realms': {'$realm': {'iprop_logfile': '$testdir/ulog.replica1',

                                    'iprop_port': '$port8'}},

              'dbmodules': {'db': {'database_name': '$testdir/db.replica1'}}}

conf_rep2 = {'realms': {'$realm': {'iprop_replica_poll': '600',

                                   'iprop_logfile': '$testdir/ulog.replica2',

                                   'iprop_port': '$port8'}},

             'dbmodules': {'db': {'database_name': '$testdir/db.replica2'}}}

conf_foo = {'libdefaults': {'default_realm': 'FOO'},

            'domain_realm': {hostname: 'FOO'}}

conf_rep3 = {'realms': {'$realm': {'iprop_replica_poll': '600',

                                   'iprop_logfile': '$testdir/ulog.replica3',

                                   'iprop_port': '$port8'},

                        'FOO': {'iprop_logfile': '$testdir/ulog.replica3'}},

            'dbmodules': {'db': {'database_name': '$testdir/db.replica3'}}}

krb5_conf_rep4 = {'domain_realm': {hostname: 'FOO'}}

conf_rep4 = {'realms': {'$realm': {'iprop_replica_poll': '600',

                                   'iprop_logfile': '$testdir/ulog.replica4',

                                   'iprop_port': '$port8'}},

             'dbmodules': {'db': {'database_name': '$testdir/db.replica4'}}}

for realm in multidb_realms(kdc_conf=conf, create_user=False,

                            start_kadmind=True):

    replica1 = realm.special_env('replica1', True, kdc_conf=conf_rep1)

    replica1m = realm.special_env('replica1m', True, krb5_conf=conf_foo,

                                  kdc_conf=conf_rep1m)

    replica2 = realm.special_env('replica2', True, kdc_conf=conf_rep2)

    # A default_realm and domain_realm that do not match the KDC's

    # realm.  The FOO realm iprop_logfile setting is needed to run

    # kproplog during a replica3 test, since kproplog has no realm

    # option.

    replica3 = realm.special_env('replica3', True, krb5_conf=conf_foo,

                                 kdc_conf=conf_rep3)

    # A default realm and a domain realm map that differ.

    replica4 = realm.special_env('replica4', True, krb5_conf=krb5_conf_rep4,

                                 kdc_conf=conf_rep4)

    # Define some principal names.  pr3 is long enough to cause internal

    # reallocs, but not long enough to grow the basic ulog entry size.

    pr1 = 'wakawaka@' + realm.realm

    pr2 = 'w@' + realm.realm

    c = 'chocolate-flavored-school-bus'

    cs = c + '/'

    pr3 = (cs + cs + cs + cs + cs + cs + cs + cs + cs + cs + cs + cs + c +

           '@' + realm.realm)

    # Create the kpropd ACL file.

    acl_file = os.path.join(realm.testdir, 'kpropd-acl')

    acl = open(acl_file, 'w')

    acl.write(realm.host_princ + '\n')

    acl.close()

    ulog = os.path.join(realm.testdir, 'db.ulog')

    if not os.path.exists(ulog):

        fail('update log not created: ' + ulog)

    # Create the principal used to authenticate kpropd to kadmind.

    kiprop_princ = 'kiprop/' + hostname

    realm.extract_keytab(kiprop_princ, realm.keytab)

    # Create the initial replica databases.

    dumpfile = os.path.join(realm.testdir, 'dump')

    realm.run([kdb5_util, 'dump', dumpfile])

    realm.run([kdb5_util, 'load', dumpfile], replica1)

    realm.run([kdb5_util, 'load', dumpfile], replica2)

    realm.run([kdb5_util, '-r', realm.realm, 'load', dumpfile], replica3)

    realm.run([kdb5_util, 'load', dumpfile], replica4)

    # Reinitialize the master ulog so we know exactly what to expect in

    # it.

    realm.run([kproplog, '-R'])

    check_ulog(1, 1, 1, [None])

    # Make some changes to the master DB.

    realm.addprinc(pr1)

    realm.addprinc(pr3)

    realm.addprinc(pr2)

    realm.run([kadminl, 'modprinc', '-allow_tix', pr2])

    realm.run([kadminl, 'modprinc', '+allow_tix', pr2])

    check_ulog(6, 1, 6, [None, pr1, pr3, pr2, pr2, pr2])

    # Start kpropd for replica1 and get a full dump from master.

    mark('propagate M->1 full')

    kpropd1 = realm.start_kpropd(replica1, ['-d'])

    wait_for_prop(kpropd1, True, 1, 6)

    out = realm.run([kadminl, 'listprincs'], env=replica1)

    if pr1 not in out or pr2 not in out or pr3 not in out:

        fail('replica1 does not have all principals from master')

    check_ulog(1, 6, 6, [None], replica1)

    # Make a change and check that it propagates incrementally.

    mark('propagate M->1 incremental')

    realm.run([kadminl, 'modprinc', '-allow_tix', pr2])

    check_ulog(7, 1, 7, [None, pr1, pr3, pr2, pr2, pr2, pr2])

    kpropd1.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd1, False, 6, 7)

    check_ulog(2, 6, 7, [None, pr2], replica1)

    realm.run([kadminl, 'getprinc', pr2], env=replica1,

              expected_msg='Attributes: DISALLOW_ALL_TIX')

    # Start kadmind -proponly for replica1.  (Use the replica1m

    # environment which defines iprop_port to $port8.)

    replica1_out_dump_path = os.path.join(realm.testdir, 'dump.replica1.out')

    replica2_in_dump_path = os.path.join(realm.testdir, 'dump.replica2.in')

    replica2_kprop_port = str(realm.portbase + 9)

    kadmind_proponly = realm.start_server([kadmind, '-r', realm.realm,

                                           '-nofork', '-proponly',

                                           '-W', '-p', kdb5_util,

                                           '-K', kprop, '-k',

                                           replica2_kprop_port,

                                           '-F', replica1_out_dump_path],

                                          'starting...', replica1m)

    # Test similar default_realm and domain_realm map settings with -r realm.

    mark('propagate 1->3 full')

    replica3_in_dump_path = os.path.join(realm.testdir, 'dump.replica3.in')

    kpropd3 = realm.start_server([kpropd, '-d', '-D', '-r', realm.realm, '-P',

                                  replica2_kprop_port, '-f',

                                  replica3_in_dump_path, '-p', kdb5_util, '-a',

                                  acl_file, '-A', hostname], 'ready', replica3)

    wait_for_prop(kpropd3, True, 1, 7)

    out = realm.run([kadminl, '-r', realm.realm, 'listprincs'], env=replica3)

    if pr1 not in out or pr2 not in out or pr3 not in out:

        fail('replica3 does not have all principals from replica1')

    check_ulog(1, 7, 7, [None], env=replica3)

    # Test an incremental propagation for the kpropd -r case.

    mark('propagate M->1->3 incremental')

    realm.run([kadminl, 'modprinc', '-maxlife', '20 minutes', pr1])

    check_ulog(8, 1, 8, [None, pr1, pr3, pr2, pr2, pr2, pr2, pr1])

    kpropd1.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd1, False, 7, 8)

    check_ulog(3, 6, 8, [None, pr2, pr1], replica1)

    realm.run([kadminl, 'getprinc', pr1], env=replica1,

              expected_msg='Maximum ticket life: 0 days 00:20:00')

    kpropd3.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd3, False, 7, 8)

    check_ulog(2, 7, 8, [None, pr1], replica3)

    realm.run([kadminl, '-r', realm.realm, 'getprinc', pr1], env=replica3,

              expected_msg='Maximum ticket life: 0 days 00:20:00')

    stop_daemon(kpropd3)

    # Test dissimilar default_realm and domain_realm map settings (no

    # -r realm).

    mark('propagate 1->4 full')

    replica4_in_dump_path = os.path.join(realm.testdir, 'dump.replica4.in')

    kpropd4 = realm.start_server([kpropd, '-d', '-D', '-P',

                                  replica2_kprop_port, '-f',

                                  replica4_in_dump_path, '-p', kdb5_util,

                                  '-a', acl_file, '-A', hostname], 'ready',

                                 replica4)

    wait_for_prop(kpropd4, True, 1, 8)

    out = realm.run([kadminl, 'listprincs'], env=replica4)

    if pr1 not in out or pr2 not in out or pr3 not in out:

        fail('replica4 does not have all principals from replica1')

    stop_daemon(kpropd4)

    # Start kpropd for replica2.  The -A option isn't needed since

    # we're talking to the same host as master (we specify it anyway

    # to exercise the code), but replica2 defines iprop_port to $port8

    # so it will talk to replica1.  Get a full dump from replica1.

    mark('propagate 1->2 full')

    kpropd2 = realm.start_server([kpropd, '-d', '-D', '-P',

                                  replica2_kprop_port, '-f',

                                  replica2_in_dump_path, '-p', kdb5_util,

                                  '-a', acl_file, '-A', hostname], 'ready',

                                 replica2)

    wait_for_prop(kpropd2, True, 1, 8)

    check_ulog(2, 7, 8, [None, pr1], replica2)

    out = realm.run([kadminl, 'listprincs'], env=replica1)

    if pr1 not in out or pr2 not in out or pr3 not in out:

        fail('replica2 does not have all principals from replica1')

    # Make another change and check that it propagates incrementally

    # to both replicas.

    mark('propagate M->1->2 incremental')

    realm.run([kadminl, 'modprinc', '-maxrenewlife', '22 hours', pr1])

    check_ulog(9, 1, 9, [None, pr1, pr3, pr2, pr2, pr2, pr2, pr1, pr1])

    kpropd1.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd1, False, 8, 9)

    check_ulog(4, 6, 9, [None, pr2, pr1, pr1], replica1)

    realm.run([kadminl, 'getprinc', pr1], env=replica1,

              expected_msg='Maximum renewable life: 0 days 22:00:00\n')

    kpropd2.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd2, False, 8, 9)

    check_ulog(3, 7, 9, [None, pr1, pr1], replica2)

    realm.run([kadminl, 'getprinc', pr1], env=replica2,

              expected_msg='Maximum renewable life: 0 days 22:00:00\n')

    # Reset the ulog on replica1 to force a full resync from master.

    # The resync will use the old dump file and then propagate

    # changes.  replica2 should still be in sync with replica1 after

    # the resync, so make sure it doesn't take a full resync.

    mark('propagate M->1->2 full')

    realm.run([kproplog, '-R'], replica1)

    check_ulog(1, 1, 1, [None], replica1)

    kpropd1.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd1, True, 1, 9)

    check_ulog(4, 6, 9, [None, pr2, pr1, pr1], replica1)

    kpropd2.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd2, False, 9, 9)

    check_ulog(3, 7, 9, [None, pr1, pr1], replica2)

    # Make another change and check that it propagates incrementally to

    # both replicas.

    mark('propagate M->1->2 incremental (after reset)')

    realm.run([kadminl, 'modprinc', '+allow_tix', pr2])

    check_ulog(10, 1, 10, [None, pr1, pr3, pr2, pr2, pr2, pr2, pr1, pr1, pr2])

    kpropd1.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd1, False, 9, 10)

    check_ulog(5, 6, 10, [None, pr2, pr1, pr1, pr2], replica1)

    realm.run([kadminl, 'getprinc', pr2], env=replica1,

              expected_msg='Attributes:\n')

    kpropd2.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd2, False, 9, 10)

    check_ulog(4, 7, 10, [None, pr1, pr1, pr2], replica2)

    realm.run([kadminl, 'getprinc', pr2], env=replica2,

              expected_msg='Attributes:\n')

    # Create a policy and check that it propagates via full resync.

    mark('propagate M->1->2 full (new policy)')

    realm.run([kadminl, 'addpol', '-minclasses', '2', 'testpol'])

    check_ulog(1, 1, 1, [None])

    kpropd1.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd1, True, 10, 1)

    check_ulog(1, 1, 1, [None], replica1)

    realm.run([kadminl, 'getpol', 'testpol'], env=replica1,

              expected_msg='Minimum number of password character classes: 2')

    kpropd2.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd2, True, 10, 1)

    check_ulog(1, 1, 1, [None], replica2)

    realm.run([kadminl, 'getpol', 'testpol'], env=replica2,

              expected_msg='Minimum number of password character classes: 2')

    # Modify the policy and test that it also propagates via full resync.

    mark('propagate M->1->2 full (policy change)')

    realm.run([kadminl, 'modpol', '-minlength', '17', 'testpol'])

    check_ulog(1, 1, 1, [None])

    kpropd1.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd1, True, 1, 1)

    check_ulog(1, 1, 1, [None], replica1)

    realm.run([kadminl, 'getpol', 'testpol'], env=replica1,

              expected_msg='Minimum password length: 17')

    kpropd2.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd2, True, 1, 1)

    check_ulog(1, 1, 1, [None], replica2)

    realm.run([kadminl, 'getpol', 'testpol'], env=replica2,

              expected_msg='Minimum password length: 17')

    # Delete the policy and test that it propagates via full resync.

    mark('propgate M->1->2 full (policy delete)')

    realm.run([kadminl, 'delpol', 'testpol'])

    check_ulog(1, 1, 1, [None])

    kpropd1.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd1, True, 1, 1)

    check_ulog(1, 1, 1, [None], replica1)

    realm.run([kadminl, 'getpol', 'testpol'], env=replica1, expected_code=1,

              expected_msg='Policy does not exist')

    kpropd2.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd2, True, 1, 1)

    check_ulog(1, 1, 1, [None], replica2)

    realm.run([kadminl, 'getpol', 'testpol'], env=replica2, expected_code=1,

              expected_msg='Policy does not exist')

    # Modify a principal on the master and test that it propagates

    # incrementally.

    mark('propagate M->1->2 incremental (after policy changes)')

    realm.run([kadminl, 'modprinc', '-maxlife', '10 minutes', pr1])

    check_ulog(2, 1, 2, [None, pr1])

    kpropd1.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd1, False, 1, 2)

    check_ulog(2, 1, 2, [None, pr1], replica1)

    realm.run([kadminl, 'getprinc', pr1], env=replica1,

              expected_msg='Maximum ticket life: 0 days 00:10:00')

    kpropd2.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd2, False, 1, 2)

    check_ulog(2, 1, 2, [None, pr1], replica2)

    realm.run([kadminl, 'getprinc', pr1], env=replica2,

              expected_msg='Maximum ticket life: 0 days 00:10:00')

    # Delete a principal and test that it propagates incrementally.

    mark('propagate M->1->2 incremental (princ delete)')

    realm.run([kadminl, 'delprinc', pr3])

    check_ulog(3, 1, 3, [None, pr1, pr3])

    kpropd1.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd1, False, 2, 3)

    check_ulog(3, 1, 3, [None, pr1, pr3], replica1)

    realm.run([kadminl, 'getprinc', pr3], env=replica1, expected_code=1,

              expected_msg='Principal does not exist')

    kpropd2.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd2, False, 2, 3)

    check_ulog(3, 1, 3, [None, pr1, pr3], replica2)

    realm.run([kadminl, 'getprinc', pr3], env=replica2, expected_code=1,

              expected_msg='Principal does not exist')

    # Rename a principal and test that it propagates incrementally.

    mark('propagate M->1->2 incremental (princ rename)')

    renpr = "quacked@" + realm.realm

    realm.run([kadminl, 'renprinc', pr1, renpr])

    check_ulog(6, 1, 6, [None, pr1, pr3, renpr, pr1, renpr])

    kpropd1.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd1, False, 3, 6)

    check_ulog(6, 1, 6, [None, pr1, pr3, renpr, pr1, renpr], replica1)

    realm.run([kadminl, 'getprinc', pr1], env=replica1, expected_code=1,

              expected_msg='Principal does not exist')

    realm.run([kadminl, 'getprinc', renpr], env=replica1)

    kpropd2.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd2, False, 3, 6)

    check_ulog(6, 1, 6, [None, pr1, pr3, renpr, pr1, renpr], replica2)

    realm.run([kadminl, 'getprinc', pr1], env=replica2, expected_code=1,

              expected_msg='Principal does not exist')

    realm.run([kadminl, 'getprinc', renpr], env=replica2)

    pr1 = renpr

    # Reset the ulog on the master to force a full resync.

    mark('propagate M->1->2 full (ulog reset)')

    realm.run([kproplog, '-R'])

    check_ulog(1, 1, 1, [None])

    kpropd1.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd1, True, 6, 1)

    check_ulog(1, 1, 1, [None], replica1)

    kpropd2.send_signal(signal.SIGUSR1)

    wait_for_prop(kpropd2, True, 6, 1)

    check_ulog(1, 1, 1, [None], replica2)

    # Stop the kprop daemons so we can test kpropd -t.

    realm.stop_kpropd(kpropd1)

    stop_daemon(kpropd2)

    stop_daemon(kadmind_proponly)

    mark('kpropd -t')

    # Test the case where no updates are needed.

    out = realm.run_kpropd_once(replica1, ['-d'])

    if 'KDC is synchronized' not in out:

        fail('Expected synchronized from kpropd -t')

    check_ulog(1, 1, 1, [None], replica1)

    # Make a change on the master and fetch it incrementally.

    realm.run([kadminl, 'modprinc', '-maxlife', '5 minutes', pr1])

    check_ulog(2, 1, 2, [None, pr1])

    out = realm.run_kpropd_once(replica1, ['-d'])

    if 'Got incremental updates (sno=2 ' not in out:

        fail('Expected full dump and synchronized from kpropd -t')

    check_ulog(2, 1, 2, [None, pr1], replica1)

    realm.run([kadminl, 'getprinc', pr1], env=replica1,

              expected_msg='Maximum ticket life: 0 days 00:05:00')

    # Propagate a policy change via full resync.

    realm.run([kadminl, 'addpol', '-minclasses', '3', 'testpol'])

    check_ulog(1, 1, 1, [None])

    out = realm.run_kpropd_once(replica1, ['-d'])

    if ('Full propagation transfer finished' not in out or

        'KDC is synchronized' not in out):

        fail('Expected full dump and synchronized from kpropd -t')

    check_ulog(1, 1, 1, [None], replica1)

    realm.run([kadminl, 'getpol', 'testpol'], env=replica1,

              expected_msg='Minimum number of password character classes: 3')

success('iprop tests')