/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at
 * trunk/opends/resource/legal-notices/OpenDS.LICENSE
 * or https://OpenDS.dev.java.net/OpenDS.LICENSE.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at
 * trunk/opends/resource/legal-notices/OpenDS.LICENSE.  If applicable,
 * add the following below this CDDL HEADER, with the fields enclosed
 * by brackets "[]" replaced with your own identifying information:
 *      Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 *
 *
 *      Copyright 2006-2008 Sun Microsystems, Inc.
 */
package org.opends.server.admin;

import static org.opends.server.loggers.ErrorLogger.logError;
import static org.opends.server.loggers.debug.DebugLogger.*;
import static org.opends.messages.AdminMessages.*;
import java.io.IOException;
import java.security.KeyStoreException;
import java.io.File;
import java.io.FileWriter;
import java.io.PrintWriter;
import java.net.InetAddress;
import java.security.cert.CertificateEncodingException;
import java.util.ArrayList;
import java.util.List;
import java.util.SortedSet;
import java.util.TreeSet;
import javax.naming.ldap.Rdn;
import org.opends.messages.Message;
import org.opends.server.admin.server.ConfigurationChangeListener;
import org.opends.server.admin.server.ServerManagementContext;
import org.opends.server.admin.std.meta.LDAPConnectionHandlerCfgDefn.
  SSLClientAuthPolicy;
import org.opends.server.admin.std.server.AdministrationConnectorCfg;
import org.opends.server.admin.std.server.ConnectionHandlerCfg;
import org.opends.server.admin.std.server.KeyManagerProviderCfg;
import org.opends.server.admin.std.server.FileBasedKeyManagerProviderCfg;
import org.opends.server.admin.std.server.FileBasedTrustManagerProviderCfg;
import org.opends.server.admin.std.server.LDAPConnectionHandlerCfg;
import org.opends.server.admin.std.server.RootCfg;
import org.opends.server.config.ConfigException;
import org.opends.server.core.SynchronousStrategy;
import org.opends.server.protocols.ldap.LDAPConnectionHandler;
import org.opends.server.types.AddressMask;
import org.opends.server.types.ConfigChangeResult;
import org.opends.server.types.DN;
import org.opends.server.types.InitializationException;
import org.opends.server.types.ResultCode;
import org.opends.server.util.CertificateManager;
import org.opends.server.admin.std.server.TrustManagerProviderCfg;
import org.opends.server.core.DirectoryServer;
import org.opends.server.loggers.ErrorLogger;
import org.opends.server.loggers.debug.DebugTracer;
import org.opends.server.types.DebugLogLevel;
import org.opends.server.types.DirectoryException;
import org.opends.server.types.FilePermission;
import org.opends.server.util.SetupUtils;

/**
 * This class is a wrapper on top of LDAPConnectionHandler to manage
 * the administration connector, which is an LDAPConnectionHandler with specific
 * (limited) configuration properties.
 */
public final class AdministrationConnector
  implements ConfigurationChangeListener<AdministrationConnectorCfg> {

  /**
   * Default Administration Connector port.
   */
  public static final int DEFAULT_ADMINISTRATION_CONNECTOR_PORT = 4444;

  /**
   * Validity (in days) of the generated certificate.
   */
  public static final int ADMIN_CERT_VALIDITY = 2 * 365;

 // Friendly name of the administration connector
  private static final String FRIENDLY_NAME = "Administration Connector";

  // The tracer object for the debug logger.
  private static final DebugTracer TRACER = getTracer();
  private LDAPConnectionHandler adminConnectionHandler;
  private AdministrationConnectorCfg config;  //
  // Predefined values for Administration Connector configuration
  //
  private static final String ADMIN_CLASS_NAME =
    "org.opends.server.protocols.ldap.LDAPConnectionHandler";
  private static final boolean ADMIN_ALLOW_LDAP_V2 = true;
  private static final boolean ADMIN_ALLOW_START_TLS = false;
  private static final SortedSet<AddressMask> ADMIN_ALLOWED_CLIENT =
    new TreeSet<AddressMask>();
  private static final SortedSet<AddressMask> ADMIN_DENIED_CLIENT =
    new TreeSet<AddressMask>();
  private static final boolean ADMIN_ENABLED = true;
  private static final boolean ADMIN_KEEP_STATS = true;
  private static final boolean ADMIN_USE_SSL = true;
  private static final int ADMIN_ACCEPT_BACKLOG = 128;
  private static final boolean ADMIN_ALLOW_TCP_REUSE_ADDRESS = true;
  private static final long ADMIN_MAX_BLOCKED_WRITE_TIME_LIMIT = 120000; // 2mn
  private static final int ADMIN_MAX_REQUEST_SIZE = 5000000; // 5 Mb
  private static final int ADMIN_NUM_REQUEST_HANDLERS = 1;
  private static final boolean ADMIN_SEND_REJECTION_NOTICE = true;
  private static final boolean ADMIN_USE_TCP_KEEP_ALIVE = true;
  private static final boolean ADMIN_USE_TCP_NO_DELAY = true;
  private static final SSLClientAuthPolicy ADMIN_SSL_CLIENT_AUTH_POLICY =
    SSLClientAuthPolicy.DISABLED;
  private static final SortedSet<String> ADMIN_SSL_CIPHER_SUITE =
    new TreeSet<String>();
  private static final SortedSet<String> ADMIN_SSL_PROTOCOL =
    new TreeSet<String>();

  /**
   * Initializes this administration connector provider based on the
   * information in the provided administration connector configuration.
   *
   * @param configuration
   *          The connection handler configuration that contains the
   *          information to use to initialize this connection
   *          handler.
   * @throws ConfigException
   *           If an unrecoverable problem arises in the process of
   *           performing the initialization as a result of the server
   *           configuration.
   * @throws InitializationException
   *           If a problem occurs during initialization that is not
   *           related to the server configuration.
   */
  public void initializeAdministrationConnector(
    AdministrationConnectorCfg configuration)
    throws ConfigException, InitializationException {

    this.config = configuration;

    // Create a fake LDAP connection handler configuration
    LDAPConnectionHandlerCfg ldapConnectionHandlerCfg =
      new FakeLDAPConnectionHandlerCfg(config);

    createSelfSignedCertifIfNeeded();

    // Administration Connector uses the LDAP connection handler implementation
    adminConnectionHandler =
      new LDAPConnectionHandler(new SynchronousStrategy(), FRIENDLY_NAME);
    adminConnectionHandler.
      initializeConnectionHandler(ldapConnectionHandlerCfg);
    adminConnectionHandler.setAdminConnectionHandler();

    // Register this as a change listener.
    config.addChangeListener(this);
  }

  /**
   * Create an instance of the administration connector.
   */
  public AdministrationConnector() {
    // Do nothing.
  }

  /**
   * Retrieves the connection handler linked to this administration connector.
   *
   * @return The connection handler linked to this administration connector.
   */
  public LDAPConnectionHandler getConnectionHandler() {
    return adminConnectionHandler;
  }

  /**
   * {@inheritDoc}
   */
  public boolean isConfigurationChangeAcceptable(
    AdministrationConnectorCfg configuration,
    List<Message> unacceptableReasons) {
    LDAPConnectionHandlerCfg cfg =
      new FakeLDAPConnectionHandlerCfg(configuration);
    return adminConnectionHandler.isConfigurationAcceptable(
      cfg, unacceptableReasons);
  }

  /**
   * {@inheritDoc}
   */
  public ConfigChangeResult applyConfigurationChange(
    AdministrationConnectorCfg configuration) {
    return new ConfigChangeResult(
      ResultCode.SUCCESS, true, new ArrayList<Message>());
  }

  /**
   * This private class implements a fake LDAP connection Handler configuration.
   * This allows to re-use the LDAPConnectionHandler as it is.
   *
   */
  private static class FakeLDAPConnectionHandlerCfg
    implements LDAPConnectionHandlerCfg {

    private final AdministrationConnectorCfg config;

    public FakeLDAPConnectionHandlerCfg(AdministrationConnectorCfg config) {
      this.config = config;
    }

    /**
     * {@inheritDoc}
     */
    public Class<? extends LDAPConnectionHandlerCfg> configurationClass() {
      return LDAPConnectionHandlerCfg.class;
    }

    /**
     * {@inheritDoc}
     */
    public void addLDAPChangeListener(
      ConfigurationChangeListener<LDAPConnectionHandlerCfg> listener) {
      // do nothing. change listener already added.
    }

    /**
     * {@inheritDoc}
     */
    public void removeLDAPChangeListener(
      ConfigurationChangeListener<LDAPConnectionHandlerCfg> listener) {
      // do nothing. change listener already added.
    }

    /**
     * {@inheritDoc}
     */
    public int getAcceptBacklog() {
      return ADMIN_ACCEPT_BACKLOG;
    }

    /**
     * {@inheritDoc}
     */
    public boolean isAllowLDAPV2() {
      return ADMIN_ALLOW_LDAP_V2;
    }

    /**
     * {@inheritDoc}
     */
    public boolean isAllowStartTLS() {
      return ADMIN_ALLOW_START_TLS;
    }

    /**
     * {@inheritDoc}
     */
    public boolean isAllowTCPReuseAddress() {
      return ADMIN_ALLOW_TCP_REUSE_ADDRESS;
    }

    /**
     * {@inheritDoc}
     */
    public String getJavaClass() {
      return ADMIN_CLASS_NAME;
    }

    /**
     * {@inheritDoc}
     */
    public boolean isKeepStats() {
      return ADMIN_KEEP_STATS;
    }

    /**
     * {@inheritDoc}
     */
    public String getKeyManagerProvider() {
      return config.getKeyManagerProvider();
    }

    /**
     * {@inheritDoc}
     */
    public DN getKeyManagerProviderDN() {
      return config.getKeyManagerProviderDN();
    }

    /**
     * {@inheritDoc}
     */
    public SortedSet<InetAddress> getListenAddress() {
      return config.getListenAddress();
    }

    /**
     * {@inheritDoc}
     */
    public int getListenPort() {
      return config.getListenPort();
    }

    /**
     * {@inheritDoc}
     */
    public long getMaxBlockedWriteTimeLimit() {
      return ADMIN_MAX_BLOCKED_WRITE_TIME_LIMIT;
    }

    /**
     * {@inheritDoc}
     */
    public long getMaxRequestSize() {
      return ADMIN_MAX_REQUEST_SIZE;
    }

    /**
     * {@inheritDoc}
     */
    public int getNumRequestHandlers() {
      return ADMIN_NUM_REQUEST_HANDLERS;
    }

    /**
     * {@inheritDoc}
     */
    public boolean isSendRejectionNotice() {
      return ADMIN_SEND_REJECTION_NOTICE;
    }

    /**
     * {@inheritDoc}
     */
    public String getSSLCertNickname() {
      return config.getSSLCertNickname();
    }

    /**
     * {@inheritDoc}
     */
    public SortedSet<String> getSSLCipherSuite() {
      return ADMIN_SSL_CIPHER_SUITE;
    }

    /**
     * {@inheritDoc}
     */
    public SSLClientAuthPolicy getSSLClientAuthPolicy() {
      return ADMIN_SSL_CLIENT_AUTH_POLICY;
    }

    /**
     * {@inheritDoc}
     */
    public SortedSet<String> getSSLProtocol() {
      return ADMIN_SSL_PROTOCOL;
    }

    /**
     * {@inheritDoc}
     */
    public String getTrustManagerProvider() {
      return config.getTrustManagerProvider();
    }

    /**
     * {@inheritDoc}
     */
    public DN getTrustManagerProviderDN() {
      return config.getTrustManagerProviderDN();
    }

    /**
     * {@inheritDoc}
     */
    public boolean isUseSSL() {
      return ADMIN_USE_SSL;
    }

    /**
     * {@inheritDoc}
     */
    public boolean isUseTCPKeepAlive() {
      return ADMIN_USE_TCP_KEEP_ALIVE;
    }

    /**
     * {@inheritDoc}
     */
    public boolean isUseTCPNoDelay() {
      return ADMIN_USE_TCP_NO_DELAY;
    }

    /**
     * {@inheritDoc}
     */
    public void addChangeListener(
      ConfigurationChangeListener<ConnectionHandlerCfg> listener) {
      // do nothing. change listener already added.
    }

    /**
     * {@inheritDoc}
     */
    public void removeChangeListener(
      ConfigurationChangeListener<ConnectionHandlerCfg> listener) {
      // do nothing. change listener already added.
    }

    /**
     * {@inheritDoc}
     */
    public SortedSet<AddressMask> getAllowedClient() {
      return ADMIN_ALLOWED_CLIENT;
    }

    /**
     * {@inheritDoc}
     */
    public SortedSet<AddressMask> getDeniedClient() {
      return ADMIN_DENIED_CLIENT;
    }

    /**
     * {@inheritDoc}
     */
    public boolean isEnabled() {
      return ADMIN_ENABLED;
    }

    /**
     * {@inheritDoc}
     */
    public DN dn() {
      return config.dn();
    }
  }

  /**
   * Creates a self-signed JKS certificate if needed.
   */
  private void createSelfSignedCertifIfNeeded()
    throws InitializationException {

    try {

      // Check if certificate generation is needed
      String certAlias = config.getSSLCertNickname();
      KeyManagerProviderCfg keyMgrConfig =
        getAdminConnectorKeyManagerConfig(config.getKeyManagerProvider());
      TrustManagerProviderCfg trustMgrConfig =
        getAdminConnectorTrustManagerConfig(config.getTrustManagerProvider());

      if (!(keyMgrConfig instanceof FileBasedKeyManagerProviderCfg) ||
        !(trustMgrConfig instanceof FileBasedTrustManagerProviderCfg)) {
        // The default config has been changed, nothing to do
        return;
      }

      FileBasedKeyManagerProviderCfg fbKeyManagerConfig =
        (FileBasedKeyManagerProviderCfg) keyMgrConfig;
      String keystorePath =
        getFullPath(fbKeyManagerConfig.getKeyStoreFile());
      FileBasedTrustManagerProviderCfg fbTrustManagerConfig =
        (FileBasedTrustManagerProviderCfg) trustMgrConfig;
      String truststorePath =
        getFullPath(fbTrustManagerConfig.getTrustStoreFile());
      String pinFilePath = getFullPath(fbKeyManagerConfig.getKeyStorePinFile());

      // Check that either we do not have any file,
      // or we have the 3 required files (keystore, truststore, pin file)
      boolean keystore = false;
      boolean truststore = false;
      boolean pinFile = false;
      int nbFiles = 0;
      if (new File(keystorePath).exists()) {
        keystore = true;
        nbFiles++;
      }
      if (new File(truststorePath).exists()) {
        truststore = true;
        nbFiles++;
      }
      if (new File(pinFilePath).exists()) {
        pinFile = true;
        nbFiles++;
      }
      if (nbFiles == 3) {
        // nothing to do
        return;
      }
      if (nbFiles != 0) {
        // 1 or 2 files are missing : error
        String err = "";
        if (!keystore) {
          err += keystorePath + " ";
        }
        if (!truststore) {
          err += truststorePath + " ";
        }
        if (!pinFile) {
          err += pinFilePath + " ";
        }
        Message message =
          ERR_ADMIN_CERTIFICATE_GENERATION_MISSING_FILES.get(err);
        logError(message);
        throw new InitializationException(message);
      }

      // Generate a password
      String pwd = new String(SetupUtils.createSelfSignedCertificatePwd());

      // Generate a self-signed certificate
      CertificateManager certManager = new CertificateManager(
        getFullPath(fbKeyManagerConfig.getKeyStoreFile()),
        fbKeyManagerConfig.getKeyStoreType(),
        pwd);
      String subjectDN = "cn=" +
        Rdn.escapeValue(InetAddress.getLocalHost().getHostName()) +
        ",O=" + FRIENDLY_NAME + " Self-Signed Certificate";
      certManager.generateSelfSignedCertificate(
        certAlias, subjectDN, ADMIN_CERT_VALIDITY);

      // Export the certificate
      String tempCertPath = getFullPath("config" + File.separator +
        "admin-cert.txt");
      SetupUtils.exportCertificate(certManager, certAlias,
        tempCertPath);

      // Create a new trust store and import the server certificate into it
      CertificateManager trustManager = new CertificateManager(
        truststorePath,
        CertificateManager.KEY_STORE_TYPE_JKS,
        pwd);
      trustManager.addCertificate(certAlias, new File(tempCertPath));

      // Generate a password file
      if (!new File(pinFilePath).exists()) {
        FileWriter file = new FileWriter(pinFilePath);
        PrintWriter out = new PrintWriter(file);
        out.println(pwd);
        out.flush();
        out.close();
        file.close();
      }

      // Change the password file permission if possible
      if (FilePermission.canSetPermissions()) {
        try {
          if (!FilePermission.setPermissions(new File(pinFilePath),
            new FilePermission(0600))) {
            // Log a warning that the permissions were not set.
            Message message =
              WARN_ADMIN_SET_PERMISSIONS_FAILED.get(pinFilePath);
            ErrorLogger.logError(message);
          }
        } catch (DirectoryException e) {
          // Log a warning that the permissions were not set.
          Message message = WARN_ADMIN_SET_PERMISSIONS_FAILED.get(pinFilePath);
          ErrorLogger.logError(message);
        }
      }

      // Delete the exported certificate
      File f = new File(tempCertPath);
      f.delete();

    } catch (ConfigException e) {
      handleCertifExceptions(e);
    } catch (KeyStoreException e) {
      handleCertifExceptions(e);
    } catch (IOException e) {
      handleCertifExceptions(e);
    } catch (CertificateEncodingException e) {
      handleCertifExceptions(e);
    }
  }

  private void handleCertifExceptions(Exception e) throws
    InitializationException {
    if (debugEnabled()) {
      TRACER.debugCaught(DebugLogLevel.ERROR, e);
    }
    Message message = ERR_ADMIN_CERTIFICATE_GENERATION.get(e.getMessage());
    logError(message);
    throw new InitializationException(message);
  }

  private KeyManagerProviderCfg getAdminConnectorKeyManagerConfig(String name)
    throws ConfigException {
    RootCfg root = ServerManagementContext.getInstance().getRootConfiguration();
    return root.getKeyManagerProvider(name);
  }

  private TrustManagerProviderCfg getAdminConnectorTrustManagerConfig(
    String name)
    throws ConfigException {
    RootCfg root =
      ServerManagementContext.getInstance().getRootConfiguration();
    return root.getTrustManagerProvider(name);
  }

  private static String getFullPath(String path) {
    File file = new File(path);
    if (!file.isAbsolute()) {
      path = DirectoryServer.getInstanceRoot() + File.separator + path;
    }

    return path;
  }
}
