/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */

/*

 * Copyright (C) 2007 Collabora Ltd.

 *

 * This program is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License as

 * published by the Free Software Foundation; either version 2 of the

 * License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public

 * License along with this program; if not, see <https://www.gnu.org/licenses>

 */

#include <config.h>

#include <stdio.h>

#include <string.h>

#include <glib.h>

#ifdef HAVE_GSSAPI

#include <gssapi/gssapi.h>

#endif

#include "lm-sock.h"

#include "lm-debug.h"

#include "lm-error.h"

#include "lm-internals.h"

#include "lm-message-queue.h"

#include "lm-misc.h"

#include "lm-ssl-internals.h"

#include "lm-parser.h"

#include "lm-sha.h"

#include "lm-connection.h"

#include "lm-utils.h"

#include "lm-old-socket.h"

#include "lm-sasl.h"

#include "md5.h"

typedef enum {

    AUTH_TYPE_PLAIN  = 1,

    AUTH_TYPE_DIGEST = 2,

    AUTH_TYPE_GSSAPI = 4,

} AuthType;

typedef enum {

    SASL_AUTH_STATE_NO_MECH,

    SASL_AUTH_STATE_PLAIN_STARTED,

    SASL_AUTH_STATE_DIGEST_MD5_STARTED,

    SASL_AUTH_STATE_DIGEST_MD5_SENT_AUTH_RESPONSE,

    SASL_AUTH_STATE_DIGEST_MD5_SENT_FINAL_RESPONSE,

    SASL_AUTH_STATE_GSSAPI_STARTED,

    SASL_AUTH_STATE_GSSAPI_SENT_AUTH_RESPONSE,

    SASL_AUTH_STATE_GSSAPI_SENT_FINAL_RESPONSE,

} SaslAuthState;

struct _LmSASL {

    LmConnection        *connection;

    AuthType             auth_type;

    SaslAuthState        state;

    LmAuthParameters    *auth_params;

    gchar               *server;

    gchar               *digest_md5_rspauth;

    LmMessageHandler    *features_cb;

    LmMessageHandler    *challenge_cb;

    LmMessageHandler    *success_cb;

    LmMessageHandler    *failure_cb;

    gboolean             features_received;

    gboolean             start_auth;

    LmSASLResultHandler  handler;

#ifdef HAVE_GSSAPI

    gss_ctx_id_t         gss_ctx;

    gss_name_t           gss_service;

#endif

};

#define XMPP_NS_SASL_AUTH "urn:ietf:params:xml:ns:xmpp-sasl"

static LmHandlerResult     sasl_features_cb  (LmMessageHandler *handler,

                                              LmConnection     *connection,

                                              LmMessage        *message,

                                              gpointer          user_data);

static LmHandlerResult     sasl_challenge_cb (LmMessageHandler *handler,

                                              LmConnection     *connection,

                                              LmMessage        *message,

                                              gpointer          user_data);

static LmHandlerResult     sasl_success_cb   (LmMessageHandler *handler,

                                              LmConnection     *connection,

                                              LmMessage        *message,

                                              gpointer          user_data);

static LmHandlerResult     sasl_failure_cb   (LmMessageHandler *handler,

                                              LmConnection     *connection,

                                              LmMessage        *message,

                                              gpointer          user_data);

#ifdef HAVE_GSSAPI

static gboolean

sasl_gssapi_handle_challenge (LmSASL *sasl, LmMessageNode *node);

static void

sasl_gssapi_fail (LmSASL     *sasl,

                  const char *message,

                  guint32     major_status,

                  guint32     minor_status)

{

    guint32         err_major_status;

    guint32         err_minor_status;

    guint32         msg_ctx = 0;

    gss_buffer_desc major_status_string = GSS_C_EMPTY_BUFFER;

    gss_buffer_desc minor_status_string = GSS_C_EMPTY_BUFFER;

    err_major_status = gss_display_status (&err_minor_status, major_status,

                                           GSS_C_GSS_CODE, GSS_C_NO_OID,

                                           &msg_ctx, &major_status_string);

    if (!GSS_ERROR(err_major_status)) {

        err_major_status = gss_display_status (&err_minor_status, minor_status,

                                               GSS_C_MECH_CODE, GSS_C_NULL_OID,

                                               &msg_ctx, &minor_status_string);

    }

    g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SASL, "GSSAPI: %s: %s, %s", message,

           (char *)major_status_string.value,

           (char *)minor_status_string.value);

    if (sasl->handler) {

        sasl->handler (sasl, sasl->connection, FALSE, "GSSAPI failure");

    }

    gss_release_buffer (&err_minor_status, &major_status_string);

    gss_release_buffer (&err_minor_status, &minor_status_string);

}

static gss_name_t

sasl_gssapi_get_creds (LmSASL *sasl)

{

    gss_buffer_desc token = GSS_C_EMPTY_BUFFER;

    gss_name_t      service_name = GSS_C_NO_NAME;

    guint32         major_status;

    guint32         minor_status;

    token.value        = g_strdup_printf ("xmpp@%s", sasl->server);

    token.length = strlen ((char *)token.value);

    if (token.value == NULL) {

        return GSS_C_NO_NAME;

    }

    major_status = gss_import_name (&minor_status, &token,

                                    GSS_C_NT_HOSTBASED_SERVICE,

                                    &service_name);

    if (GSS_ERROR(major_status)) {

        sasl_gssapi_fail (sasl, "while obtaining service principal",

                          major_status, minor_status);

        return GSS_C_NO_NAME;

    }

    return service_name;

}

static gboolean

sasl_gssapi_start (LmSASL *sasl, LmMessageNode *node)

{

    gchar           *response64;

    gss_buffer_desc  input_buffer_desc;

    gss_buffer_t     input_buffer;

    gss_buffer_desc  output_buffer_desc;

    gss_buffer_t     output_buffer;

    guint32          major_status;

    guint32          minor_status;

    sasl->gss_ctx = GSS_C_NO_CONTEXT;

    sasl->gss_service = sasl_gssapi_get_creds (sasl);

    if (sasl->gss_service == GSS_C_NO_NAME) {

        return FALSE;

    }

    sasl->state = SASL_AUTH_STATE_GSSAPI_STARTED;

    input_buffer_desc.value = NULL;

    input_buffer_desc.length = 0;

    input_buffer = &input_buffer_desc;

    output_buffer_desc.value = NULL;

    output_buffer_desc.length = 0;

    output_buffer = &output_buffer_desc;

    major_status = gss_init_sec_context (&minor_status,

                                         GSS_C_NO_CREDENTIAL,

                                         &sasl->gss_ctx,

                                         sasl->gss_service,

                                         GSS_C_NO_OID,

                                         GSS_C_MUTUAL_FLAG |

                                         GSS_C_REPLAY_FLAG |

                                         GSS_C_SEQUENCE_FLAG |

                                         GSS_C_INTEG_FLAG |

                                         GSS_C_CONF_FLAG,

                                         0,

                                         GSS_C_NO_CHANNEL_BINDINGS,

                                         input_buffer, NULL, output_buffer, NULL, NULL);

    if (GSS_ERROR(major_status)) {

        sasl_gssapi_fail (sasl, "during challenge/response",

                          major_status, minor_status);

        return FALSE;

    }

    if (major_status != GSS_S_CONTINUE_NEEDED) {

        sasl->state = SASL_AUTH_STATE_GSSAPI_SENT_AUTH_RESPONSE;

    }

    response64 = g_base64_encode ((const guchar *) output_buffer_desc.value,

                                  (gsize) output_buffer_desc.length);

    lm_message_node_set_value (node, response64);

    g_free (response64);

    return TRUE;

}

static gboolean

sasl_gssapi_handle_challenge (LmSASL *sasl, LmMessageNode *node)

{

    const gchar     *encoded;

    gchar           *response64;

    gss_buffer_t     input_buffer;

    gss_buffer_desc  input_buffer_desc;

    gss_buffer_t     output_buffer;

    gss_buffer_desc  output_buffer_desc;

    guint32          major_status;

    guint32          minor_status;

    gboolean         result;

    LmMessage       *msg;

    encoded = lm_message_node_get_value (node);

    if (encoded == NULL) {

        input_buffer_desc.value = NULL;

        input_buffer_desc.length = 0;

    } else {

        input_buffer_desc.value = g_base64_decode (encoded,

                                                 &input_buffer_desc.length);

    }

    input_buffer = &input_buffer_desc;

    output_buffer_desc.value = NULL;

    output_buffer_desc.length = 0;

    output_buffer = &output_buffer_desc;

    if (sasl->state == SASL_AUTH_STATE_GSSAPI_STARTED) {

        major_status = gss_init_sec_context (&minor_status,

                                             GSS_C_NO_CREDENTIAL,

                                             &sasl->gss_ctx,

                                             sasl->gss_service,

                                             GSS_C_NO_OID,

                                             GSS_C_MUTUAL_FLAG |

                                             GSS_C_REPLAY_FLAG |

                                             GSS_C_SEQUENCE_FLAG |

                                             GSS_C_INTEG_FLAG |

                                             GSS_C_CONF_FLAG,

                                             0,

                                             GSS_C_NO_CHANNEL_BINDINGS,

                                             input_buffer, NULL, output_buffer, NULL, NULL);

        if (GSS_ERROR(major_status)) {

            sasl_gssapi_fail (sasl, "during challenge/response",

                              major_status, minor_status);

            return FALSE;

        }

        if (major_status != GSS_S_CONTINUE_NEEDED) {

            sasl->state = SASL_AUTH_STATE_GSSAPI_SENT_AUTH_RESPONSE;

        }

        major_status = gss_release_buffer (&minor_status, input_buffer);

        if (major_status != GSS_S_COMPLETE) {

            return FALSE;

        }

    } else if (sasl->state == SASL_AUTH_STATE_GSSAPI_SENT_AUTH_RESPONSE) {

        gchar *features;

        major_status = gss_unwrap (&minor_status, sasl->gss_ctx,

                                   input_buffer, output_buffer,

                                   NULL, NULL);

        if (GSS_ERROR(major_status)) {

            sasl_gssapi_fail (sasl, "while unwrapping server capabilities",

                              major_status, minor_status);

            return FALSE;

        }

        major_status = gss_release_buffer (&minor_status, input_buffer);

        if (major_status != GSS_S_COMPLETE) {

            return FALSE;

        }

        major_status = gss_release_buffer (&minor_status, output_buffer);

        if (major_status != GSS_S_COMPLETE) {

            return FALSE;

        }

        input_buffer_desc.length = 4 + strlen(lm_auth_parameters_get_username (sasl->auth_params));

        features = g_malloc (input_buffer_desc.length);

        features[0] = 1;

        features[1] = 0xFF;

        features[2] = 0xFF;

        features[3] = 0xFF;

        strcpy(features+4, lm_auth_parameters_get_username (sasl->auth_params));

        input_buffer_desc.value = features;

        major_status = gss_wrap (&minor_status, sasl->gss_ctx,

                                 0, /* Just integrity checking here */

                                 GSS_C_QOP_DEFAULT,

                                 input_buffer,

                                 NULL,

                                 output_buffer);

        g_free (features);

        if (GSS_ERROR(major_status)) {

            sasl_gssapi_fail (sasl, "while wrapping required features",

                              major_status, minor_status);

            return FALSE;

        }

    } else {

        g_assert_not_reached ();

    }

    msg = lm_message_new (NULL, LM_MESSAGE_TYPE_RESPONSE);

    lm_message_node_set_attributes (msg->node,

                                    "xmlns", XMPP_NS_SASL_AUTH,

                                    NULL);

    if (output_buffer_desc.value != NULL) {

        response64 = g_base64_encode ((const guchar *) output_buffer_desc.value,

                                      (gsize) output_buffer_desc.length);

    } else {

        response64 = g_strdup ("");

    }

    major_status = gss_release_buffer (&minor_status, output_buffer);

    if (major_status != GSS_S_COMPLETE) {

        g_free (response64);

        lm_message_unref (msg);

        return FALSE;

    }

    lm_message_node_set_value (msg->node, response64);

    result = lm_connection_send (sasl->connection, msg, NULL);

    g_free (response64);

    lm_message_unref (msg);

    if (!result) {

        g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_NET,

               "Failed to send SASL response\n");

        return FALSE;

    }

    return TRUE;

}

static gboolean

sasl_gssapi_finish (LmSASL *sasl, LmMessageNode *node)

{

    OM_uint32 /* major_status, */ minor_status;

    if (sasl->gss_service != GSS_C_NO_NAME) {

        /* major_status = */

        (void) gss_release_name (&minor_status, &sasl->gss_service);

    }

    if (sasl->gss_ctx != GSS_C_NO_CONTEXT) {

        /* major_status = */

        (void) gss_delete_sec_context (&minor_status, &sasl->gss_ctx,

                                       GSS_C_NO_BUFFER);

    }

    return TRUE;

}

#endif

/* DIGEST-MD5 mechanism code from libgibber */

static gchar *

sasl_strndup_unescaped (const gchar *str, gsize len)

{

    const gchar *s;