module snmp.v3;

import c.net_snmp;
import snmp.types;
import snmp.oid;

private alias size_t = object.size_t;
import snmp.session : SNMPSession;
import snmp.pdu : SNMPResponse;

enum AuthProtocol { none, md5, sha1, sha256, sha384, sha512 }
enum PrivProtocol { none, des, aes128, aes192, aes256 }

enum SecurityLevel : int
{
    noAuthNoPriv = SNMP_SEC_LEVEL_NOAUTH,
    authNoPriv   = SNMP_SEC_LEVEL_AUTHNOPRIV,
    authPriv     = SNMP_SEC_LEVEL_AUTHPRIV,
}

private void authProtoOID(AuthProtocol p, out const(oid)* optr, out size_t olen) @trusted @nogc nothrow
{
    final switch (p)
    {
    case AuthProtocol.none:
        optr = usmNoAuthProtocol.ptr;          olen = usmNoAuthProtocol.length;          break;
    case AuthProtocol.md5:
        optr = usmHMACMD5AuthProtocol.ptr;     olen = usmHMACMD5AuthProtocol.length;     break;
    case AuthProtocol.sha1:
        optr = usmHMACSHA1AuthProtocol.ptr;    olen = usmHMACSHA1AuthProtocol.length;    break;
    case AuthProtocol.sha256:
        optr = usmHMAC192SHA256AuthProtocol.ptr; olen = usmHMAC192SHA256AuthProtocol.length; break;
    case AuthProtocol.sha384:
        optr = usmHMAC384SHA512AuthProtocol.ptr; olen = usmHMAC384SHA512AuthProtocol.length; break;
    case AuthProtocol.sha512:
        optr = usmHMAC384SHA512AuthProtocol.ptr; olen = usmHMAC384SHA512AuthProtocol.length; break;
    }
}

private void privProtoOID(PrivProtocol p, out const(oid)* optr, out size_t olen) @trusted @nogc nothrow
{
    final switch (p)
    {
    case PrivProtocol.none:
        optr = usmNoPrivProtocol.ptr;   olen = usmNoPrivProtocol.length;   break;
    case PrivProtocol.des:
        optr = usmDESPrivProtocol.ptr;  olen = usmDESPrivProtocol.length;  break;
    case PrivProtocol.aes128:
        optr = usmAESPrivProtocol.ptr;  olen = usmAESPrivProtocol.length;  break;
    case PrivProtocol.aes192:
        version (OSX) { optr = usmAESPrivProtocol.ptr; olen = usmAESPrivProtocol.length; }
        else           { optr = usmAES192PrivProtocol.ptr; olen = usmAES192PrivProtocol.length; }
        break;
    case PrivProtocol.aes256:
        version (OSX) { optr = usmAESPrivProtocol.ptr; olen = usmAESPrivProtocol.length; }
        else           { optr = usmAES256PrivProtocol.ptr; olen = usmAES256PrivProtocol.length; }
        break;
    }
}

/// SNMPv3/USM session. RAII via SNMPSession base destructor.
struct SNMPV3Session
{
    SNMPSession base;
    alias base this;

    @disable this(this);

    static SNMPV3Session open(
        scope const(char)* peername,
        scope const(char)* user,
        AuthProtocol auth      = AuthProtocol.sha1,
        scope const(char)* authPass = null,
        PrivProtocol priv      = PrivProtocol.none,
        scope const(char)* privPass = null,
        SecurityLevel level    = SecurityLevel.authNoPriv) @trusted @nogc nothrow
    {
        SNMPV3Session s;

        if (!peername || !user || !authPass)
            return s;

        import core.stdc.string : strlen;

        netsnmp_session sess;
        snmp_sess_init(&sess);

        // `version` is a D keyword — access via __traits
        __traits(getMember, sess, "version") = cast(long) SNMP_VERSION_3;
        sess.peername        = cast(char*) peername;
        sess.securityName    = cast(char*) user;
        sess.securityNameLen = strlen(user);
        sess.securityLevel   = cast(int) level;

        const(oid)* authOIDPtr;
        size_t authOIDLen;
        authProtoOID(auth, authOIDPtr, authOIDLen);
        sess.securityAuthProto    = cast(oid*) authOIDPtr;
        sess.securityAuthProtoLen = authOIDLen;
        sess.securityAuthKeyLen   = USM_AUTH_KU_LEN;

        if (auth != AuthProtocol.none && authPass)
        {
            if (generate_Ku(sess.securityAuthProto,
                    cast(uint) sess.securityAuthProtoLen,
                    cast(ubyte*) authPass, strlen(authPass),
                    sess.securityAuthKey.ptr,
                    &sess.securityAuthKeyLen) != SNMPERR_SUCCESS)
                return s;
        }

        const(oid)* privOIDPtr;
        size_t privOIDLen;
        privProtoOID(priv, privOIDPtr, privOIDLen);
        sess.securityPrivProto    = cast(oid*) privOIDPtr;
        sess.securityPrivProtoLen = privOIDLen;
        sess.securityPrivKeyLen   = USM_PRIV_KU_LEN;

        if (priv != PrivProtocol.none && privPass)
        {
            if (generate_Ku(sess.securityAuthProto,
                    cast(uint) sess.securityAuthProtoLen,
                    cast(ubyte*) privPass, strlen(privPass),
                    sess.securityPrivKey.ptr,
                    &sess.securityPrivKeyLen) != SNMPERR_SUCCESS)
                return s;
        }

        s.base.handle = snmp_open(&sess);
        return s;
    }

    static SNMPV3Session open(
        string peername,
        string user,
        AuthProtocol auth  = AuthProtocol.sha1,
        string authPass    = null,
        PrivProtocol priv  = PrivProtocol.none,
        string privPass    = null,
        SecurityLevel level = SecurityLevel.authNoPriv) @trusted nothrow
    {
        import std.string : toStringz;

        return open(peername.toStringz, user.toStringz, auth,
            authPass ? authPass.toStringz : null, priv,
            privPass ? privPass.toStringz : null, level);
    }
}

unittest
{
    init_snmp("snmp-d-v3-test");

    auto s = SNMPV3Session.open(
        cast(const(char)*) null, "noUser",
        AuthProtocol.sha1, "badPass",
        PrivProtocol.none, cast(const(char)*) null,
        SecurityLevel.authNoPriv);
    assert(!s.isOpen);

    auto s2 = SNMPV3Session.open(
        "udp:127.0.0.1:161", "noUser",
        AuthProtocol.sha1, "short",
        PrivProtocol.none, cast(const(char)*) null,
        SecurityLevel.authNoPriv);
    s2.close();
}