# -*- coding: utf-8 -*-

#

# Generate OpenSSL configuration file for AusweisApp2 from settings found

# in the application's 'config.json' file.

#

# Copyright (c) 2020 Björn Esser <besser82@fedoraproject.org>

#

# Permission is hereby granted, free of charge, to any person obtaining a copy

# of this software and associated documentation files (the "Software"), to deal

# in the Software without restriction, including without limitation the rights

# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

# copies of the Software, and to permit persons to whom the Software is

# furnished to do so, subject to the following conditions:

#

# The above copyright notice and this permission notice shall be included in all

# copies or substantial portions of the Software.

#

# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

# SOFTWARE.

import json, sys

def constant(f):

    def fset(self, value):

        raise TypeError

    def fget(self):

        return f()

    return property(fget, fset)

class _Const(object):

    @constant

    def CONF_OPTIONS():

        return [

                   'ciphers',

                   'ellipticCurves',

                   'signatureAlgorithms',

               ]

    @constant

    def CONF_SECTIONS():

        return [

                   'tlsSettings',

                   'tlsSettingsPsk',

                   'tlsSettingsRemoteReader',

                   'tlsSettingsRemoteReaderPairing',

               ]

    @constant

    def DEFAULT_CIPHERS_TLS13():

        return [

                   'TLS_AES_256_GCM_SHA384',

                   'TLS_AES_128_GCM_SHA256',

               ]

    @constant

    def KEYSIZE_EC_OPTION():

        return 'Ec'

    @constant

    def KEYSIZE_OPTIONS():

        return [

                   'Rsa',

                   'Dsa',

                   'Dh',

               ]

    @constant

    def KEYSIZE_SECTIONS():

        return [

                   'minStaticKeySizes',

                   'minEphemeralKeySizes',

               ]

    @constant

    def TLS_VERSIONS():

        return {

                   'TlsV1_2': (2, 'TLSv1.2'),

                   'TlsV1_3': (3, 'TLSv1.3'),

               }

CONST = _Const()

def get_min_ssl_sec_level(json_data):

    sec_level = 0

    min_keysize = sys.maxsize

    min_ecsize = sys.maxsize

    for section in CONST.KEYSIZE_SECTIONS:

        if section in json_data:

            for option in CONST.KEYSIZE_OPTIONS:

                if option in json_data[section]:

                    if min_keysize > json_data[section][option]:

                        min_keysize = json_data[section][option]

            if CONST.KEYSIZE_EC_OPTION in json_data[section]:

                    if min_ecsize > json_data[section][CONST.KEYSIZE_EC_OPTION]:

                        min_ecsize = json_data[section][CONST.KEYSIZE_EC_OPTION]

    if min_keysize >=  1000 and min_ecsize >= 160:

        sec_level = 1

    if min_keysize >=  2000 and min_ecsize >= 224:

        sec_level = 2

    if min_keysize >=  3000 and min_ecsize >= 256:

        sec_level = 3

    if min_keysize >=  7000 and min_ecsize >= 384:

        sec_level = 4

    if min_keysize >= 15000 and min_ecsize >= 512:

        sec_level = 5

    return sec_level

def get_proto_ver(json_data):

    conf_dict = {

                    'minProtocolVersion': list(CONST.TLS_VERSIONS.keys())[-1],

                    'maxProtocolVersion': list(CONST.TLS_VERSIONS.keys())[0],

                }

    for section in CONST.CONF_SECTIONS:

        if section in json_data:

            if 'protocolVersion' in json_data[section]:

                have = conf_dict['minProtocolVersion']

                want = json_data[section]['protocolVersion']

                if CONST.TLS_VERSIONS[want][0] < CONST.TLS_VERSIONS[have][0]:

                    conf_dict['minProtocolVersion'] = want

                have = conf_dict['maxProtocolVersion']

                if CONST.TLS_VERSIONS[want][0] > CONST.TLS_VERSIONS[have][0]:

                    conf_dict['maxProtocolVersion'] = want

    return conf_dict

def get_ssl_cipher_config(json_data):

    conf_dict = dict.fromkeys(CONST.CONF_OPTIONS)

    for option in CONST.CONF_OPTIONS:

        conf_dict[option] = list()

    for section in CONST.CONF_SECTIONS:

        if section in json_data:

            for option in CONST.CONF_OPTIONS:

                if option in json_data[section]:

                    for value in json_data[section][option]:

                        if option == 'ciphers' and value.startswith('TLS_'):

                            if not 'ciphers_tls13' in conf_dict:

                                conf_dict['ciphers_tls13'] = list()

                            if not value in conf_dict['ciphers_tls13']:

                                conf_dict['ciphers_tls13'].append(value)

                        else:

                            if not value in conf_dict[option]:

                                conf_dict[option].append(value)

    return conf_dict

def print_config_file(conf_dict, sec_level):

    max_tls_proto = CONST.TLS_VERSIONS[conf_dict['maxProtocolVersion']][0]

    prelude = (

                  '# This application specific OpenSSL configuration enables all cipher',

                  '# algorithms, elliptic curves, and signature algorithms, which are',

                  '# needed for AusweisApp2 to provide full functionality to the end-user.',

                  '# The order of the algorithms in the list is of no importance, as the',

                  '# application chooses the algorithm used for a connection from a preset',

                  '# list, that is ordered in descending preference.  This configuration',

                  '# also limits the minimum and maximum cryptographic protocol versions',

                  '# to a range needed by AusweisApp2.  Additionally FIPS mode is enforced.',

                  '# The settings used to generate this file have been taken from the',

                  '# \'config.json\' file, which can be found in the same directory as this',

                  '# configuration file.',

                  '',

                  'openssl_conf = AusweisApp2_conf',

                  '',

                  '[AusweisApp2_conf]',

                  'ssl_conf = AusweisApp2_OpenSSL',

                  '',

                  '[AusweisApp2_OpenSSL]',

                  'alg_section = AusweisApp2_evp',

                  'system_default = AusweisApp2_ciphers',

                  '',

                  '[AusweisApp2_evp]',

                  'fips_mode = yes',

                  '',

                  '[AusweisApp2_ciphers]',

              )

    print('%s' % '\n'.join(prelude))

    print('MinProtocol = %s' % (CONST.TLS_VERSIONS[conf_dict['minProtocolVersion']][1]))

    print('MaxProtocol = %s' % (CONST.TLS_VERSIONS[conf_dict['maxProtocolVersion']][1]))

    if max_tls_proto >= CONST.TLS_VERSIONS['TlsV1_3'][0]:

        if 'ciphers_tls13' in conf_dict:

            print('Cipherlist = %s' % (':'.join(conf_dict['ciphers_tls13'])))

        else:

            print('Cipherlist = %s' % (':'.join(CONST.DEFAULT_CIPHERS_TLS13)))

    print('CipherString = @SECLEVEL=%d:%s' % (sec_level, ':'.join(conf_dict['ciphers'])))

    print('Curves = %s' % (':'.join(conf_dict['ellipticCurves'])))

    print('SignatureAlgorithms = %s' % (':'.join(conf_dict['signatureAlgorithms'])))

def main():

    if not len(sys.argv) == 2:

        sys.exit('Usage: %s <path_to_config.json>' % sys.argv[0])

    with open(sys.argv[1], 'r') as conf_file:

        conf = json.load(conf_file)

    ssl_conf = get_proto_ver(conf)

    ssl_conf.update(get_ssl_cipher_config(conf))

    print_config_file(ssl_conf, get_min_ssl_sec_level(conf))

if __name__ == '__main__':

    main()