package messages

import (
	
	

	
	
	
	
	
	
	
	
	
	
	
)

type marshalAPReq struct {
	PVNO      int            `asn1:"explicit,tag:0"`
	MsgType   int            `asn1:"explicit,tag:1"`
	APOptions asn1.BitString `asn1:"explicit,tag:2"`
	// Ticket needs to be a raw value as it is wrapped in an APPLICATION tag
	Ticket                 asn1.RawValue       `asn1:"explicit,tag:3"`
	EncryptedAuthenticator types.EncryptedData `asn1:"explicit,tag:4"`
}

// APReq implements RFC 4120 KRB_AP_REQ: https://tools.ietf.org/html/rfc4120#section-5.5.1.
type APReq struct {
	PVNO                   int                 `asn1:"explicit,tag:0"`
	MsgType                int                 `asn1:"explicit,tag:1"`
	APOptions              asn1.BitString      `asn1:"explicit,tag:2"`
	Ticket                 Ticket              `asn1:"explicit,tag:3"`
	EncryptedAuthenticator types.EncryptedData `asn1:"explicit,tag:4"`
	Authenticator          types.Authenticator `asn1:"optional"`
}

// NewAPReq generates a new KRB_AP_REQ struct.
func ( Ticket,  types.EncryptionKey,  types.Authenticator) (APReq, error) {
	var  APReq
	,  := encryptAuthenticator(, , )
	if  != nil {
		return , krberror.Errorf(, krberror.KRBMsgError, "error creating Authenticator for AP_REQ")
	}
	 = APReq{
		PVNO:                   iana.PVNO,
		MsgType:                msgtype.KRB_AP_REQ,
		APOptions:              types.NewKrbFlags(),
		Ticket:                 ,
		EncryptedAuthenticator: ,
	}
	return , nil
}

// Encrypt Authenticator
func encryptAuthenticator( types.Authenticator,  types.EncryptionKey,  Ticket) (types.EncryptedData, error) {
	var  types.EncryptedData
	,  := .Marshal()
	if  != nil {
		return , krberror.Errorf(, krberror.EncodingError, "marshaling error of EncryptedData form of Authenticator")
	}
	 := authenticatorKeyUsage(.SName)
	,  = crypto.GetEncryptedData(, , uint32(), .EncPart.KVNO)
	if  != nil {
		return , krberror.Errorf(, krberror.EncryptingError, "error encrypting Authenticator")
	}
	return , nil
}

// DecryptAuthenticator decrypts the Authenticator within the AP_REQ.
// sessionKey may simply be the key within the decrypted EncPart of the ticket within the AP_REQ.
func ( *APReq) ( types.EncryptionKey) error {
	 := authenticatorKeyUsage(.Ticket.SName)
	,  := crypto.DecryptEncPart(.EncryptedAuthenticator, , uint32())
	if  != nil {
		return fmt.Errorf("error decrypting authenticator: %v", )
	}
	 := .Authenticator.Unmarshal()
	if  != nil {
		return fmt.Errorf("error unmarshaling authenticator: %v", )
	}
	return nil
}

func authenticatorKeyUsage( types.PrincipalName) int {
	if .NameString[0] == "krbtgt" {
		return keyusage.TGS_REQ_PA_TGS_REQ_AP_REQ_AUTHENTICATOR
	}
	return keyusage.AP_REQ_AUTHENTICATOR
}

// Unmarshal bytes b into the APReq struct.
func ( *APReq) ( []byte) error {
	var  marshalAPReq
	,  := asn1.UnmarshalWithParams(, &, fmt.Sprintf("application,explicit,tag:%v", asnAppTag.APREQ))
	if  != nil {
		return krberror.Errorf(, krberror.EncodingError, "unmarshal error of AP_REQ")
	}
	if .MsgType != msgtype.KRB_AP_REQ {
		return NewKRBError(types.PrincipalName{}, "", errorcode.KRB_AP_ERR_MSG_TYPE, errorcode.Lookup(errorcode.KRB_AP_ERR_MSG_TYPE))
	}
	.PVNO = .PVNO
	.MsgType = .MsgType
	.APOptions = .APOptions
	.EncryptedAuthenticator = .EncryptedAuthenticator
	.Ticket,  = unmarshalTicket(.Ticket.Bytes)
	if  != nil {
		return krberror.Errorf(, krberror.EncodingError, "unmarshaling error of Ticket within AP_REQ")
	}
	return nil
}

// Marshal APReq struct.
func ( *APReq) () ([]byte, error) {
	 := marshalAPReq{
		PVNO:                   .PVNO,
		MsgType:                .MsgType,
		APOptions:              .APOptions,
		EncryptedAuthenticator: .EncryptedAuthenticator,
	}
	var  []byte
	,  := .Ticket.Marshal()
	if  != nil {
		return , 
	}
	.Ticket = asn1.RawValue{
		Class:      asn1.ClassContextSpecific,
		IsCompound: true,
		Tag:        3,
		Bytes:      ,
	}
	,  := asn1.Marshal()
	if  != nil {
		return , krberror.Errorf(, krberror.EncodingError, "marshaling error of AP_REQ")
	}
	 = asn1tools.AddASNAppTag(, asnAppTag.APREQ)
	return , nil
}

// Verify an AP_REQ using service's keytab, spn and max acceptable clock skew duration.
// The service ticket encrypted part and authenticator will be decrypted as part of this operation.
func ( *APReq) ( *keytab.Keytab,  time.Duration,  types.HostAddress,  *types.PrincipalName) (bool, error) {
	// Decrypt ticket's encrypted part with service key
	//TODO decrypt with service's session key from its TGT is use-to-user. Need to figure out how to get TGT.
	//if types.IsFlagSet(&a.APOptions, flags.APOptionUseSessionKey) {
	//	err := a.Ticket.Decrypt(tgt.DecryptedEncPart.Key)
	//	if err != nil {
	//		return false, krberror.Errorf(err, krberror.DecryptingError, "error decrypting encpart of ticket provided using session key")
	//	}
	//} else {
	//	err := a.Ticket.DecryptEncPart(*kt, &a.Ticket.SName)
	//	if err != nil {
	//		return false, krberror.Errorf(err, krberror.DecryptingError, "error decrypting encpart of service ticket provided")
	//	}
	//}
	 := &.Ticket.SName
	if  != nil {
		 = 
	}
	 := .Ticket.DecryptEncPart(, )
	if  != nil {
		return false, krberror.Errorf(, krberror.DecryptingError, "error decrypting encpart of service ticket provided")
	}

	// Check time validity of ticket
	,  := .Ticket.Valid()
	if  != nil || ! {
		return , 
	}

	// Check client's address is listed in the client addresses in the ticket
	if len(.Ticket.DecryptedEncPart.CAddr) > 0 {
		//If client addresses are present check if any of them match the source IP that sent the APReq
		//If there is no match return KRB_AP_ERR_BADADDR error.
		if !types.HostAddressesContains(.Ticket.DecryptedEncPart.CAddr, ) {
			return false, NewKRBError(.Ticket.SName, .Ticket.Realm, errorcode.KRB_AP_ERR_BADADDR, "client address not within the list contained in the service ticket")
		}
	}

	// Decrypt authenticator with session key from ticket's encrypted part
	 = .DecryptAuthenticator(.Ticket.DecryptedEncPart.Key)
	if  != nil {
		return false, NewKRBError(.Ticket.SName, .Ticket.Realm, errorcode.KRB_AP_ERR_BAD_INTEGRITY, "could not decrypt authenticator")
	}

	// Check CName in authenticator is the same as that in the ticket
	if !.Authenticator.CName.Equal(.Ticket.DecryptedEncPart.CName) {
		return false, NewKRBError(.Ticket.SName, .Ticket.Realm, errorcode.KRB_AP_ERR_BADMATCH, "CName in Authenticator does not match that in service ticket")
	}

	// Check the clock skew between the client and the service server
	 := .Authenticator.CTime.Add(time.Duration(.Authenticator.Cusec) * time.Microsecond)
	 := time.Now().UTC()
	if .Sub() >  || .Sub() >  {
		return false, NewKRBError(.Ticket.SName, .Ticket.Realm, errorcode.KRB_AP_ERR_SKEW, fmt.Sprintf("clock skew with client too large. greater than %v seconds", ))
	}
	return true, nil
}