#!/usr/bin/env python3

from flask import Flask, request, abort, make_response, \
                  render_template, redirect, url_for, \
                  json, jsonify, session, flash
from collections import namedtuple, OrderedDict
from subprocess import check_call, call
from fcntl import flock, LOCK_EX, LOCK_SH, LOCK_UN

import hashlib
import random
import shutil
import time
import glob
import sys
import re
import os

#app = Flask("ISABEL-2 Verifier") # That app name breaks Ubuntu 14.04 :-o
app = Flask("main")
app.secret_key = "6ab77f3c45447429c2ae163c260a626029519a66450e474c"

users_file = "/etc/freeradius/dpto2/users"
dhcp_hosts_file = "/etc/dnsmasq.d/dpto2/dhcp-hosts"
dhcp_opts_file = "/etc/dnsmasq.d/dpto2/dhcp-opts"
dnsmasq_leases = "/var/lib/misc/dnsmasq.leases"
impossible_mac = "ff:ff:ff:ff:ff:fe"

class Lock:
    def __init__(self, lockfile):
        self.lockfile = lockfile

    def __enter__(self):
        flock(self.lockfile, LOCK_EX)

    def __exit__(self, exc_type, exc_val, exc_tb):
        flock(self.lockfile, LOCK_UN)

class SharedLock(Lock):
    def __init__(self, lockfile):
        super().__init__(lockfile)

    def __enter__(self, exc_type, exc_val, exc_tb):
        flock(self.lockfile, LOCK_SH)

lock_file = open("/run/lock/dpto2.lock","w")
exclusive_lock = Lock(lock_file)
shared_lock = SharedLock(lock_file)

def reload_freeradius():
    call("./sendhup freeradius".split())

def reload_dnsmasq():
    call("./sendhup dnsmasq".split())

def nthash(password):
    return hashlib.new('md4',password.encode('utf-16le')).hexdigest().upper()

def create_user(username, password, creator):
    with exclusive_lock:
        f = open(users_file,"a")
        f.write('# created by {}\n{} NT-Password := "{}"\n'.format(creator, username, nthash(password)))
        f.close()
    reload_freeradius()

def delete_user(deluser):
    f = open(users_file)
    lines = f.readlines()
    f.close()
    timestamp = time.time()
    tempfile = "{}.{}".format(users_file, timestamp)
    f = open(tempfile,"w")
    createdby = None
    for line in lines:
        if re.search("#\s+created by", line):
            createdby = line
            continue
        if line.startswith(deluser):
            createdby = None
            continue
        if line.startswith("#"):
            f.write(line)
        else:
            if createdby:
                f.write(createdby)
            f.write(line)
            createdby = None
    f.close()
    rename(tempfile, users_file)
    reload_freeradius()

def load_users():
    users = []
    creator = None
    with open(users_file) as f:
        for l in f:
            l = l.strip()
            if l.startswith("#"):
                m = re.match("#\s+created by\s+(\S+)", l)
                if m:
                    creator = m.group(1)
                continue
            m = re.match("(^\S+).*-Password\s+:=\s+\"(\S+)\"", l)
            if m:
                users.append((m.group(1), m.group(2), creator))
                creator = None
    return users

def login_required(f):
    def g(*args, **kwargs):
        if not session.get('logged_in', False):
            return redirect(url_for('login', redirect_to=request.url))
        return f(*args, **kwargs)
    g.__name__ = f.__name__
    return g

@app.route("/login",methods=['GET','POST'])
def login():
    if session.get('logged_in',False):
        return redirect(url_for(request.args.get('redirect_to','admin')))
    if request.method == 'GET':
        return render_template("login.html")
    if request.method == 'POST':
        username = request.form.get("username",None)
        password = request.form.get("password",None)

        if username is None or password is None:
            return render_template("login.html",error=True,errormsg="invalid username or password")

        if username == 'guest':
            return render_template("login.html",error=True,errormsg="guest user has no admin privileges")

        try:
            check_login(username, password)
        except Exception as e:
            return render_template("login.html",error=True,errormsg=str(e))

        session['logged_in'] = True
        session['username'] = username
        return redirect(request.args.get('redirect_to','admin'))

@app.route("/")
def index():
    f = open(users_file)
    guestpass = "?"
    for line in f:
        if line.startswith("guest"):
            m = re.search(':=\s+"(.+?)"\s*$',line)
            if m:
                guestpass = m.group(1)
                break

    return render_template("index.html", guestpass=guestpass)

def check_login(username, password):
    for u,p,c in load_users():
        if u == username and p == nthash(password):
            return True
    raise ValueError("Invalid username or password")

@app.route("/admin",methods=['GET','POST'])
@login_required
def admin():
    if request.method == 'POST':
        deluser = request.form.get('deluser',None)
        if deluser is not None:
            if deluser == 'guest':
                return render_template("admin.html", delete_error=True, errormsg="Cannot delete guest user")
            delete_user(deluser)
            flash("User deleted succesfully")

        username = request.form.get('username',None)
        pass1 = request.form.get('password1',None)
        pass2 = request.form.get('password2',None)
        creator = session['username']
        if username is not None:
            if username == 'guest':
                return render_template("admin.html", create_error=True, errormsg="Cannot create guest user")
            if pass1 is None or \
               pass2 is None or \
               pass1 != pass2:
                return render_template("admin.html", create_error=True, errormsg="Passwords do not match")
            if pass1 == '':
                return render_template("admin.html", create_error=True, errormsg="Password cannot be empty")
            create_user(username,pass1,creator)
            flash("User created successfully")

    return render_template("admin.html")

def render_users_tree(tree):
    lines = []
    def _render(user, edges, is_last):
        lines.append((edges + (" └─" if is_last else " ├─"), user))
        n = len(tree[user])
        for i,u in enumerate(tree[user]):
            _render(u, edges + ("   " if is_last else " │ "), i == n - 1)
        return lines
    # root = tree(""); n = len(root)
    # for i,u in enumerate(root):
    _render("", "", True)
    return lines

@app.route("/users")
@login_required
def list_users():
    users = load_users()
    users_set = set(x[0] for x in users)
    tree = { "": [] }
    for user,passwd,creator in users:
        if user == "guest":
            continue
        tree[user] = []
        if creator is None:
            tree[""].append(user)
        else:
            if creator not in users_set:
                creator += " (invalid username)"
                tree[""].append(creator)
            tree[creator] = tree.get(creator,[]) + [user]
    lines = render_users_tree(tree)
    return render_template("users.html", users=lines)

mac_re = re.compile("(?:[0-9a-fA-F]{2}[:-]){5}[0-9a-fA-F]{2}")
ip_re_str = "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
ip_re = re.compile(ip_re_str)
DhcpHostLine = namedtuple("DhcpHostLine","macs ip tag")

def parse_dchp_host(line):
    macs = []
    ip = ""
    tag = None
    parts = line.split(",")
    for p in parts:
        p = p.strip()
        m = mac_re.match(p)
        if m:
            if m.group(0) != impossible_mac:
                macs.append(m.group(0))
            continue
        m = ip_re.match(p)
        if m:
            ip = m.group(0)
            continue
        if p.startswith("set:"):
            tag = p[4:]
    return DhcpHostLine(macs, ip, tag)

Ip = namedtuple("Ip","reserved_by dhcp_pool locked macs gw color")

def load_ips():
    ipmap = {}
    for i in range(1,255):
        ipmap[i] = Ip(
            reserved_by="",
            dhcp_pool=True,
            locked=False,
            macs=[],
            gw=None,
            color=None
        )
    ipmap[0] = ipmap[255] = Ip(
        reserved_by="",
        dhcp_pool=False,
        locked=False,
        macs=[],
        gw=None,
        color=None
    )
    prefix = None

    # Read custom gateways
    gws = {}
    with open(dhcp_opts_file) as f:
        for line in f:
            line = line.strip()
            if line.startswith("#"): continue
            m = re.match(
                    "tag:(client[0-9a-f]{12}),option:router,(" + ip_re_str + ")",
                    line
                )
            if m:
                gws[m.group(1)] = m.group(2)

    with open(dhcp_hosts_file) as f:
        meta = {}
        for line in f:
            line = line.strip()
            if line.startswith("#"):
                try:
                    meta = json.loads(line[1:])
                except:
                    meta = {}
                    continue
                if not isinstance(meta,dict):
                    meta = {}
                    continue
            if re.match("^[0-9a-fA-F]{2}:",line):
                r = parse_dchp_host(line)
                ip = int(r.ip.split(".")[-1])
                if prefix is None:
                    prefix = ".".join(r.ip.split(".")[:-1])
                ipmap[ip] = Ip(
                    reserved_by=meta.get("reserved-by",""),
                    dhcp_pool=False,
                    locked=meta.get("locked",False),
                    macs=r.macs,
                    gw=gws.get(r.tag, None),
                    color = meta.get("color", None)
                )
                meta = {}
    ipmap["prefix"] = prefix
    return ipmap

def load_leases():
    leases = {}
    with open(dnsmasq_leases) as f:
        for line in f:
            parts = line.strip().split()
            try:
                ip = int(parts[2].split(".")[-1])
            except IndexError:
                continue
            except ValueError:
                continue
            try:
                lease = [
                    int(parts[0]),  # expiration timestamp
                    parts[1],       # client mac address
                    parts[2],       # leased ip
                    parts[3],       # host name or * if no name sent
                    parts[4],       # client id or * if no id sent
                ]
            except IndexError:
                # line is shorter than I thought, skippping
                continue
            leases[ip] = lease
    return leases

@app.route("/ips")
@login_required
def ips():
    ipmap = load_ips()
    leases = load_leases()
    return render_template("ips.html", ipmap=ipmap, leases=leases)

def parse_macs(macs):
    r = []
    macs = macs.strip()
    parts = macs.split(',')
    for p in parts:
        p = p.strip()
        m = mac_re.match(p)
        if m:
            r.append(m.group(0).replace("-",":"))
    return r

def rename(src, dst):
    shutil.move(src, dst)
    shutil.copy(dst, src)
    copies = glob.glob(dst + ".[0-9]*")
    # sort from most recent to oldest
    copies = sorted(copies, key=lambda x: -float(x[len(dst)+1:]))
    # keep only the most recent 5
    for c in copies[5:]:
        print("Deleting", c)
        os.remove(c)

def write_dhcp_files(ipmap):
    timestamp = time.time()
    tempfile = "{}.{}".format(dhcp_hosts_file, timestamp)
    with open(tempfile,"w") as f:
        prefix = ipmap["prefix"]
        gws = {}
        for i in range(1,255):
            ip = ipmap[i]
            if ip.dhcp_pool:
                continue
            if ip.reserved_by or ip.locked:
                meta = OrderedDict()
                if ip.reserved_by:
                    meta['reserved-by'] = ip.reserved_by
                if ip.locked:
                    meta['locked'] = True
                if ip.color:
                    meta['color'] = ip.color
                print("# " + json.dumps(meta), file=f)
            if len(ip.macs) == 0:
                macs = impossible_mac
            else:
                macs = ",".join(ip.macs)
            settag = ""
            if ip.gw and len(ip.macs) > 0:
                tag = "client" + ip.macs[0].replace(":","").lower()
                settag = ",set:" + tag
                gws[tag] = ip.gw
            print("{},{}.{}{}".format(macs,prefix,i,settag), file=f)
    rename(tempfile, dhcp_hosts_file)

    # Write custom gateways file
    tempfile = "{}.{}".format(dhcp_opts_file, timestamp)
    with open(tempfile,"w") as f:
        for tag in gws:
            print(
                "tag:{},option:router,{}".format(tag,gws[tag]),
                file=f,
            )
    rename(tempfile, dhcp_opts_file)

@app.route("/ip/<int:last_byte>", methods=['GET', 'POST'])
@login_required
def ip(last_byte):
    valid_colors = "black red gold green blue purple".split()
    if request.method == 'POST':
        #print(request.form)

        reserved_by = request.form.get('reserved-by', '')[:100]
        dhcp_pool = request.form.get('dhcp-client', '') == 'pool'
        macs = parse_macs(request.form.get('dhcp-client-mac', ''))
        gw = request.form.get('dhcp-gw','')[:15]
        gw = gw if ip_re.match(gw) else None
        color = request.form.get('label-color', '')[:20]
        color = color if color in valid_colors else None

        with exclusive_lock:
            ipmap = load_ips()
            if not ipmap[last_byte].locked:
                ipmap[last_byte] = Ip(
                    reserved_by=reserved_by,
                    dhcp_pool=dhcp_pool,
                    locked=False,
                    macs=macs,
                    gw=gw,
                    color=color
                )
                write_dhcp_files(ipmap)
                reload_dnsmasq()

        return redirect(url_for('ips'))
    else:
        ipmap = load_ips()
        leases = load_leases()
        lease = None
        try:
            if last_byte in leases:
                lease = leases[last_byte]
                today = time.localtime().tm_wday
                expiry_t = time.localtime(int(lease[0]))
                expiry_day = expiry_t.tm_wday
                expiry_hour = time.strftime("%I:%M %p", expiry_t)
                if today == expiry_day:
                    lease[0] = "las " + expiry_hour
                elif (today + 1) % 7 == expiry_day:
                    lease[0] = "ma\N{LATIN SMALL LETTER N WITH TILDE}ana a las " + expiry_hour
                else:
                    lease[0] = time.strftime("%B %d, ", expiry_t) + expiry_hour
        except ValueError:
            pass
        except IndexError:
            pass

        addr = "{}.{}".format(ipmap["prefix"], last_byte)
        return render_template(
                "ip.html",
                addr=addr,
                valid_colors=valid_colors,
                meta=ipmap[last_byte],
                lease=lease,
        )

@app.route("/logout")
def logout():
    session.pop("logged_in",None)
    return redirect(url_for("index"))

if __name__ == '__main__':
    if "debug" in sys.argv:
        users_file = "users.dpto2"
        dhcp_hosts_file = "dhcp-hosts.dpto2"
        dhcp_opts_file = "dhcp-opts.dpto2"
    app.debug = True
    app.run(host="0.0.0.0")