# Copyright (c) 2017 VMware, Inc.
# All rights reserved. -- VMware Confidential
"""
Rsyslog patch module for setting TLS priorities.
"""
import logging
from l10n import msgMetadata as _T, localizedString as _

logger = logging.getLogger(__name__)
_TLS_CONF = '/etc/gnutls/default-priorities'


def getChanges():
    return _(_T("rsyslog.patches.tls_priority.summary",
                "Sets the TLS default priority options for Rsyslog."))


def doPatching(ctx):
    logger.info("Rsyslog tls_priority: being executed {0}".format(ctx))

    priorities = [
        'SYSTEM=NONE',
        '+AES-128-GCM:+AES-256-CBC:+AES-128-CBC',  # Ciphers
        '+ECDHE-RSA:+ECDHE-ECDSA:+RSA',  # Key exchange
        '+AEAD:+SHA384:+SHA256:+SHA1',  # MAC
        '+COMP-NULL',  # Compression algorithms
        '+VERS-TLS1.2',  # TLS versions
        '+SIGN-RSA-SHA224:+SIGN-RSA-SHA256',  # Signature algorithms
        '+SIGN-RSA-SHA384:+SIGN-RSA-SHA512',  # Signature algorithms
        '+SIGN-DSA-SHA224:+SIGN-DSA-SHA256',  # Signature algorithms
        '+SIGN-ECDSA-SHA224:+SIGN-ECDSA-SHA256',  # Signature algorithms
        '+SIGN-ECDSA-SHA384:+SIGN-ECDSA-SHA512',  # Signature algorithms
        '+CURVE-SECP256R1:+CURVE-SECP384R1',  # Elliptic curves
        '+CURVE-SECP521R1',  # Elliptic curves
        '+CTYPE-OPENPGP:+CTYPE-X509',  # Certificate type
        # Remove CAMELLIA ciphers
        '-CAMELLIA-256-CBC:-CAMELLIA-192-CBC:-CAMELLIA-128-CBC',
        '-CAMELLIA-256-GCM:-CAMELLIA-128-GCM']

    priority_str = ':'.join(priorities)

    with open(_TLS_CONF, 'w') as fp:
        fp.write(priority_str + '\n')
        fp.flush()
