# Copyright (C) 2015, 2016 GoSecure Inc.
"""
Telnet Transport and Authentication for the Honeypot

@author: Olivier Bilodeau <obilodeau@gosecure.ca>
"""
from __future__ import annotations


import struct

from twisted.conch.telnet import (
    ECHO,
    LINEMODE,
    NAWS,
    SGA,
    AuthenticatingTelnetProtocol,
    ITelnetProtocol,
)
from twisted.python import log

from cowrie.core.config import CowrieConfig
from cowrie.core.credentials import UsernamePasswordIP


class HoneyPotTelnetAuthProtocol(AuthenticatingTelnetProtocol):
    """
    TelnetAuthProtocol that takes care of Authentication. Once authenticated this
    protocol is replaced with HoneyPotTelnetSession.
    """

    loginPrompt = b"login: "
    passwordPrompt = b"Password: "
    windowSize = [40, 80]

    def connectionMade(self):
        # self.transport.negotiationMap[NAWS] = self.telnet_NAWS
        # Initial option negotation. Want something at least for Mirai
        # for opt in (NAWS,):
        #    self.transport.doChain(opt).addErrback(log.err)

        # I need to doubly escape here since my underlying
        # CowrieTelnetTransport hack would remove it and leave just \n
        self.transport.write(self.factory.banner.replace(b"\n", b"\r\r\n"))
        self.transport.write(self.loginPrompt)

    def connectionLost(self, reason):
        """
        Fires on pre-authentication disconnects
        """
        AuthenticatingTelnetProtocol.connectionLost(self, reason)

    def telnet_User(self, line):
        """
        Overridden to conditionally kill 'WILL ECHO' which confuses clients
        that don't implement a proper Telnet protocol (most malware)
        """
        self.username = line  # .decode()
        # only send ECHO option if we are chatting with a real Telnet client
        self.transport.willChain(ECHO)
        # FIXME: this should be configurable or provided via filesystem
        self.transport.write(self.passwordPrompt)
        return "Password"

    def telnet_Password(self, line):
        username, password = self.username, line  # .decode()
        del self.username

        def login(ignored):
            self.src_ip = self.transport.getPeer().host
            creds = UsernamePasswordIP(username, password, self.src_ip)
            d = self.portal.login(creds, self.src_ip, ITelnetProtocol)
            d.addCallback(self._cbLogin)
            d.addErrback(self._ebLogin)

        # are we dealing with a real Telnet client?
        if self.transport.options:
            # stop ECHO
            # even if ECHO negotiation fails we still want to attempt a login
            # this allows us to support dumb clients which is common in malware
            # thus the addBoth: on success and on exception (AlreadyNegotiating)
            self.transport.wontChain(ECHO).addBoth(login)
        else:
            # process login
            login("")

        return "Discard"

    def telnet_Command(self, command):
        self.transport.protocol.dataReceived(command + b"\r")
        return "Command"

    def _cbLogin(self, ial):
        """
        Fired on a successful login
        """
        interface, protocol, logout = ial
        protocol.windowSize = self.windowSize
        self.protocol = protocol
        self.logout = logout
        self.state = "Command"

        self.transport.write(b"\n")

        # Remove the short timeout of the login prompt.
        self.transport.setTimeout(
            CowrieConfig.getint("honeypot", "interactive_timeout", fallback=300)
        )

        # replace myself with avatar protocol
        protocol.makeConnection(self.transport)
        self.transport.protocol = protocol

    def _ebLogin(self, failure):
        # TODO: provide a way to have user configurable strings for wrong password
        self.transport.wontChain(ECHO)
        self.transport.write(b"\nLogin incorrect\n")
        self.transport.write(self.loginPrompt)
        self.state = "User"

    def telnet_NAWS(self, data):
        """
        From TelnetBootstrapProtocol in twisted/conch/telnet.py
        """
        if len(data) == 4:
            width, height = struct.unpack("!HH", b"".join(data))
            self.windowSize = [height, width]
        else:
            log.msg("Wrong number of NAWS bytes")

    def enableLocal(self, opt):
        if opt == ECHO:
            return True
        # TODO: check if twisted now supports SGA (see git commit c58056b0)
        elif opt == SGA:
            return False
        else:
            return False

    def enableRemote(self, opt):
        # TODO: check if twisted now supports LINEMODE (see git commit c58056b0)
        if opt == LINEMODE:
            return False
        elif opt == NAWS:
            return True
        elif opt == SGA:
            return True
        else:
            return False

[((51, 8, 51, 65), 'twisted.conch.telnet.AuthenticatingTelnetProtocol.connectionLost', 'AuthenticatingTelnetProtocol.connectionLost', ({(51, 52, 51, 56): 'self', (51, 58, 51, 64): 'reason'}, {}), '(self, reason)', False, 'from twisted.conch.telnet import ECHO, LINEMODE, NAWS, SGA, AuthenticatingTelnetProtocol, ITelnetProtocol\n'), ((71, 20, 71, 71), 'cowrie.core.credentials.UsernamePasswordIP', 'UsernamePasswordIP', ({(71, 39, 71, 47): 'username', (71, 49, 71, 57): 'password', (71, 59, 71, 70): 'self.src_ip'}, {}), '(username, password, self.src_ip)', False, 'from cowrie.core.credentials import UsernamePasswordIP\n'), ((107, 12, 107, 80), 'cowrie.core.config.CowrieConfig.getint', 'CowrieConfig.getint', (), '', False, 'from cowrie.core.config import CowrieConfig\n'), ((129, 12, 129, 49), 'twisted.python.log.msg', 'log.msg', ({(129, 20, 129, 48): '"""Wrong number of NAWS bytes"""'}, {}), "('Wrong number of NAWS bytes')", False, 'from twisted.python import log\n')]