#!/usr/bin/python

### Checkpoint FW-1 HTTP/S authentication script
### aka. Client Authentication Remote System (CARS)
### for Linux, Unix, Windows, Cygwin and MacOSX

### Distributed under the terms of the GNU GPL license
### Copyright 2005, Dag Wieers <dag@wieers.com>

url = 'https://esni.be.ibm.com:950/'	### <- for Belgium
#url = 'https://158.98.131.244:950/'	### <- for Luxembourg

def remove(e):
	'Remove previous DATA entries from tuple list elements'
	return e[0] != 'DATA'

def handle_req(req, data=None, input=None):
	'Prepare input tuple list, handle request and return data tuple list from HTML output'
	if data:
		data = filter(remove, data)
		if input: data.append(('DATA', urllib.quote_plus(input)))
		req.add_data(urllib.urlencode(data, True))
	return re.findall('NAME="(\S+)"\s+VALUE="(\S+)"', urllib2.urlopen(req).read(4096))

class CARSError(Exception):
	pass

try:
	import sys, urllib, urllib2, getpass, re
	req = urllib2.Request(url)
	phase1 = handle_req(req)
	if not phase1: raise CARSError, 'Checkpoint FW-1 (CARS) webserver is not working properly, report to Network team.'

	try: login = sys.argv[1]
	except: login = raw_input('Username [%s]: ' % getpass.getuser())
	if not login: login = getpass.getuser()

	phase2 = handle_req(req, phase1, login)
	if not phase2: raise CARSError, 'Unknown error [2], report to Dag Wieers <dag@wieers.com>'

	try: password = sys.argv[2]
	except: password = getpass.getpass('Password: ')

	phase3 = handle_req(req, phase2, password)
	if not phase3: raise CARSError, 'Access denied - wrong user name or password'

	phase4 = handle_req(req, phase3, '1')
	if phase4: raise CARSError, 'Unknown error [4], report to Dag Wieers <dag@wieers.com>'

except urllib2.URLError, e:
	print 'Failed to connect to Checkpoint FW-1 (CARS) webserver at %s\n' % url, e.reason[1]
	sys.exit(e.reason[0])
except CARSError, e:
	print 'Failed to authenticate with Checkpoint FW-1 (CARS) webserver at %s\n' % url, e
	sys.exit(1)
except EOFError:
	print
except KeyboardInterrupt:
	print
except:
	print 'Unknown error, report to Dag Wieers <dag@wieers.com>\n'
	raise