/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#include <pwd.h>
#include <grp.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <thread.h>
#include <synch.h>
#include <syslog.h>
#include <deflt.h>
#include <mechglueP.h>
#include "../../cmd/gss/gsscred/gsscred.h"

static mutex_t uid_map_lock = DEFAULTMUTEX;
static int uid_map_opt = 0;

extern int _getgroupsbymember(const char *, gid_t[], int, int);

/* local function used to call a mechanisms pname_to_uid */
static OM_uint32 gss_pname_to_uid(OM_uint32*, const gss_name_t,
                        const gss_OID, uid_t *);

static OM_uint32 private_gsscred_expname_to_unix_cred(const gss_buffer_t,
                        uid_t *, gid_t *, gid_t **, int *);

/*
 * The gsscred functions will first attempt to call the
 * mechanism'm pname_to_uid function.  In case this function
 * returns an error or if it is not provided by a mechanism
 * then the functions will attempt to look up the principal
 * in the gsscred table.
 * It is envisioned that the pname_to_uid function will be
 * provided by only a few mechanism, which may have the principal
 * name to unix credential mapping inherently present.
 */

/*
 * Fetch gsscred options from conf file.
 */
static void
get_conf_options(int *uid_map)
{
        int  flags;
        char *ptr;
        void    *defp;
        static char *conffile = "/etc/gss/gsscred.conf";

        *uid_map = 0;
        if ((defp = defopen_r(conffile)) != NULL) {
                flags = defcntl_r(DC_GETFLAGS, 0, defp);
                /* ignore case */
                TURNOFF(flags, DC_CASE);
                (void) defcntl_r(DC_SETFLAGS, flags, defp);

                if ((ptr = defread_r("SYSLOG_UID_MAPPING=", defp)) != NULL &&
                    strcasecmp("yes", ptr) == 0) {
                        *uid_map = 1;
                }
                defclose_r(defp);
        }
}

void
gsscred_set_options()
{
        int u;

        get_conf_options(&u);
        (void) mutex_lock(&uid_map_lock);
        uid_map_opt = u;
        (void) mutex_unlock(&uid_map_lock);
}

static int
get_uid_map_opt()
{
        int u;

        (void) mutex_lock(&uid_map_lock);
        u = uid_map_opt;
        (void) mutex_unlock(&uid_map_lock);
        return (u);
}

/*
 * This routine accepts a name in export name format and retrieves
 * unix credentials associated with it.
 */

OM_uint32
gsscred_expname_to_unix_cred_ext(
        const gss_buffer_t expName,
        uid_t *uidOut,
        gid_t *gidOut,
        gid_t *gids[],
        int *gidsLen,
        int try_mech)
{
        gss_name_t intName;
        OM_uint32 minor, major;
        const char *mechStr = NULL;
        char *nameStr = NULL;
        char *whoami = "gsscred_expname_to_unix_cred";
        gss_buffer_desc namebuf;
        int debug = get_uid_map_opt();

        if (uidOut == NULL)
                return (GSS_S_CALL_INACCESSIBLE_WRITE);

        if (expName == NULL)
                return (GSS_S_CALL_INACCESSIBLE_READ);

        /* first check the mechanism for the mapping */
        if (gss_import_name(&minor, expName, (gss_OID)GSS_C_NT_EXPORT_NAME,
            &intName) == GSS_S_COMPLETE) {

                if (debug) {
                        gss_union_name_t uintName = (gss_union_name_t)intName;

                        if (uintName->mech_type)
                                mechStr = __gss_oid_to_mech(
                                    uintName->mech_type);

                        major = gss_display_name(&minor, intName,
                            &namebuf, NULL);
                        if (major == GSS_S_COMPLETE) {
                                nameStr = strdup(namebuf.value);
                                (void) gss_release_buffer(&minor, &namebuf);
                        }
                }

                if (try_mech) {
                        major = gss_pname_to_uid(&minor, intName,
                            NULL, uidOut);
                        if (major == GSS_S_COMPLETE) {

                                if (debug) {
                                        syslog(LOG_AUTH|LOG_DEBUG,
                                            "%s: mech provided local name"
                                            " mapping (%s, %s, %d)", whoami,
                                            mechStr ? mechStr : "<null>",
                                            nameStr ? nameStr : "<null>",
                                            *uidOut);
                                        free(nameStr);
                                }

                                (void) gss_release_name(&minor, &intName);
                                if (gids && gidsLen && gidOut)
                                        return (gss_get_group_info(*uidOut,
                                            gidOut, gids, gidsLen));
                                return (GSS_S_COMPLETE);
                        }
                }

                (void) gss_release_name(&minor, &intName);
        }

        /*
         * we fall back onto the gsscred table to provide the mapping
         * start by making sure that the expName is an export name buffer
         */
        major = private_gsscred_expname_to_unix_cred(expName, uidOut, gidOut,
            gids, gidsLen);

        if (debug && major == GSS_S_COMPLETE) {
                syslog(LOG_AUTH|LOG_DEBUG,
                    "%s: gsscred tbl provided"
                    " local name mapping (%s, %s, %d)",
                    whoami,
                    mechStr ? mechStr : "<unknown>",
                    nameStr ? nameStr : "<unknown>",
                    *uidOut);
                free(nameStr);
        } else if (debug) {
                syslog(LOG_AUTH|LOG_DEBUG,
                    "%s: gsscred tbl could NOT"
                    " provide local name mapping (%s, %s)",
                    whoami,
                    mechStr ? mechStr : "<unknown>",
                    nameStr ? nameStr : "<unknown>");
                free(nameStr);
        }

        return (major);

} /* gsscred_expname_to_unix_cred */

OM_uint32
gsscred_expname_to_unix_cred(
        const gss_buffer_t expName,
        uid_t *uidOut,
        gid_t *gidOut,
        gid_t *gids[],
        int *gidsLen)
{
        return (gsscred_expname_to_unix_cred_ext(expName, uidOut, gidOut, gids,
            gidsLen, 1));
}


static const char *expNameTokId = "\x04\x01";
static const int expNameTokIdLen = 2;
/*
 * private routine added to be called from gsscred_name_to_unix_cred
 * and gsscred_expName_to_unix_cred.
 */
static OM_uint32
private_gsscred_expname_to_unix_cred(expName, uidOut, gidOut, gids, gidsLen)
const gss_buffer_t expName;
uid_t *uidOut;
gid_t *gidOut;
gid_t *gids[];
int *gidsLen;
{

        if (expName->length < expNameTokIdLen ||
                (memcmp(expName->value, expNameTokId, expNameTokIdLen) != 0))
                return (GSS_S_DEFECTIVE_TOKEN);

        if (!gss_getGssCredEntry(expName, uidOut))
                return (GSS_S_FAILURE);

        /* did caller request group info also ? */
        if (gids && gidsLen && gidOut)
                return (gss_get_group_info(*uidOut, gidOut, gids, gidsLen));

        return (GSS_S_COMPLETE);
}

/*
 * Return a string of the authenticated name.
 * It's a bit of hack/workaround/longroad but the current intName
 * passed to gss_display_name insists on returning an empty string.
 *
 * Caller must free string memory.
 */
static
char *make_name_str(
        const gss_name_t intName,
        const gss_OID mechType)

{
        gss_buffer_desc expName = GSS_C_EMPTY_BUFFER;
        OM_uint32 major, minor;
        gss_name_t canonName;
        gss_name_t iName;
        gss_buffer_desc namebuf;

        if (major = gss_canonicalize_name(&minor, intName,
                                mechType, &canonName))
                return (NULL);

        major = gss_export_name(&minor, canonName, &expName);
        (void) gss_release_name(&minor, &canonName);
        if (major)
                return (NULL);

        if (gss_import_name(&minor, &expName,
                            (gss_OID)GSS_C_NT_EXPORT_NAME,
                            &iName) == GSS_S_COMPLETE) {

                major = gss_display_name(&minor, iName, &namebuf, NULL);
                if (major == GSS_S_COMPLETE) {
                        char *s;

                        if (namebuf.value)
                                s = strdup(namebuf.value);

                        (void) gss_release_buffer(&minor, &namebuf);
                        (void) gss_release_buffer(&minor, &expName);
                        (void) gss_release_buffer(&minor, (gss_buffer_t)iName);
                        return (s);
                }
                (void) gss_release_buffer(&minor, (gss_buffer_t)iName);
        }

        (void) gss_release_buffer(&minor, &expName);
        return (NULL);
}

/*
 * This routine accepts a name in gss internal name format together with
 * a mechanim OID and retrieves a unix credentials for that entity.
 */
OM_uint32
gsscred_name_to_unix_cred_ext(
        const gss_name_t intName,
        const gss_OID mechType,
        uid_t *uidOut,
        gid_t *gidOut,
        gid_t *gids[],
        int *gidsLen,
        int try_mech)
{
        gss_name_t canonName;
        gss_buffer_desc expName = GSS_C_EMPTY_BUFFER;
        OM_uint32 major, minor;
        int debug = get_uid_map_opt();

        const char *mechStr;
        char *whoami = "gsscred_name_to_unix_cred";
        gss_buffer_desc namebuf;

        if (intName == NULL || mechType == NULL)
                return (GSS_S_CALL_INACCESSIBLE_READ);

        if (uidOut == NULL)
                return (GSS_S_CALL_INACCESSIBLE_WRITE);

        mechStr = __gss_oid_to_mech(mechType);

        /* first try the mechanism provided mapping */
        if (try_mech && gss_pname_to_uid(&minor, intName, mechType, uidOut)
            == GSS_S_COMPLETE) {

                if (debug) {
                        char *s = make_name_str(intName, mechType);
                        syslog(LOG_AUTH|LOG_DEBUG,
                            "%s: mech provided local name"
                            " mapping (%s, %s, %d)", whoami,
                            mechStr ? mechStr : "<null>",
                            s ? s : "<null>",
                            *uidOut);
                        free(s);
                }

                if (gids && gidsLen && gidOut)
                        return (gss_get_group_info(*uidOut, gidOut, gids,
                            gidsLen));
                return (GSS_S_COMPLETE);
        }
        /*
         * falling back onto the gsscred table to provide the mapping
         * start by canonicalizing the passed in name and then export it
         */
        if (major = gss_canonicalize_name(&minor, intName,
            mechType, &canonName))
                return (major);

        major = gss_export_name(&minor, canonName, &expName);
        (void) gss_release_name(&minor, &canonName);
        if (major)
                return (major);

        major = private_gsscred_expname_to_unix_cred(&expName, uidOut, gidOut,
            gids, gidsLen);


        if (debug) {
                gss_name_t iName;
                OM_uint32 maj;
                char *nameStr = NULL;

                if (gss_import_name(&minor, &expName,
                    (gss_OID)GSS_C_NT_EXPORT_NAME, &iName) == GSS_S_COMPLETE) {

                        maj = gss_display_name(&minor, iName, &namebuf,
                            NULL);
                        (void) gss_release_buffer(&minor, (gss_buffer_t)iName);
                        if (maj == GSS_S_COMPLETE) {
                                nameStr = strdup(namebuf.value);
                                (void) gss_release_buffer(&minor, &namebuf);
                        }
                }

                if (major == GSS_S_COMPLETE)
                        syslog(LOG_AUTH|LOG_DEBUG,
                            "%s: gsscred tbl provided"
                            " local name mapping (%s, %s, %d)",
                            whoami,
                            mechStr ? mechStr : "<unknown>",
                            nameStr ? nameStr : "<unknown>",
                            *uidOut);
                else
                        syslog(LOG_AUTH|LOG_DEBUG,
                            "%s: gsscred tbl could NOT"
                            " provide local name mapping (%s, %s)",
                            whoami,
                            mechStr ? mechStr : "<unknown>",
                            nameStr ? nameStr : "<unknown>");

                free(nameStr);
        }

        (void) gss_release_buffer(&minor, &expName);
        return (major);
} /* gsscred_name_to_unix_cred */


OM_uint32
gsscred_name_to_unix_cred(
        const gss_name_t intName,
        const gss_OID mechType,
        uid_t *uidOut,
        gid_t *gidOut,
        gid_t *gids[],
        int *gidsLen)
{
        return (gsscred_name_to_unix_cred_ext(intName, mechType,
            uidOut, gidOut, gids, gidsLen, 1));
}



/*
 * This routine accepts a unix uid, and retrieves the group id
 * and supplamentery group ids for that uid.
 * Callers should be aware that the supplamentary group ids
 * array may be empty even when this function returns success.
 */
OM_uint32
gss_get_group_info(uid, gidOut, gids, gidsLen)
const uid_t uid;
gid_t *gidOut;
gid_t *gids[];
int *gidsLen;
{
        struct passwd *pw;
        int maxgroups;

        /* check for output parameters */
        if (gidOut == NULL || gids == NULL || gidsLen == NULL)
                return (GSS_S_CALL_INACCESSIBLE_WRITE);

        *gids = NULL;
        *gidsLen = 0;

        /* determine maximum number of groups possible */
        maxgroups = sysconf(_SC_NGROUPS_MAX);
        if (maxgroups < 1)
            maxgroups = 16;

        if ((pw = getpwuid(uid)) == NULL)
            return (GSS_S_FAILURE);

        /*
         * we allocate for the maximum number of groups
         * we do not reclaim the space when the actual number
         * is lower, just set the size approprately.
         */
        *gids = (gid_t *)calloc(maxgroups, sizeof (gid_t));
        if (*gids == NULL)
            return (GSS_S_FAILURE);

        *gidOut = pw->pw_gid;
        (*gids)[0] = pw->pw_gid;
        *gidsLen = _getgroupsbymember(pw->pw_name, *gids, maxgroups, 1);
        /*
         * we will try to remove the duplicate entry from the groups
         * array.  This can cause the group array to be empty.
         */
        if (*gidsLen < 1)
        {
                free(*gids);
                *gids = NULL;
                return (GSS_S_FAILURE);
        } else if (*gidsLen == 1) {
                free(*gids);
                *gids = NULL;
                *gidsLen = 0;
        } else {
                /* length is atleast 2 */
                *gidsLen = *gidsLen -1;
                (*gids)[0] = (*gids)[*gidsLen];
        }

        return (GSS_S_COMPLETE);
} /* gss_get_group_info */


static OM_uint32
gss_pname_to_uid(minor, name, mech_type, uidOut)
OM_uint32 *minor;
const gss_name_t name;
const gss_OID mech_type;
uid_t *uidOut;
{
        gss_mechanism mech;
        gss_union_name_t intName;
        gss_name_t mechName = NULL;
        OM_uint32 major, tmpMinor;

        if (!minor)
                return (GSS_S_CALL_INACCESSIBLE_WRITE);

        *minor = 0;

        if (uidOut == NULL)
                return (GSS_S_CALL_INACCESSIBLE_WRITE);

        if (name == NULL)
                return (GSS_S_CALL_INACCESSIBLE_READ);

        intName = (gss_union_name_t)name;

        if (mech_type != NULL)
                mech = __gss_get_mechanism(mech_type);
        else {
                /*
                 * if this is a MN, then try using the mech
                 * from the name; otherwise ask for default
                 */
                mech = __gss_get_mechanism(intName->mech_type);
        }

        if (mech == NULL || mech->pname_to_uid == NULL)
                return (GSS_S_UNAVAILABLE);

        /* may need to import the name if this is not MN */
        if (intName->mech_type == NULL) {
                major = __gss_import_internal_name(minor,
                                mech_type, intName,
                                &mechName);
                if (major != GSS_S_COMPLETE)
                        return (major);
        } else
                mechName = intName->mech_name;


        /* now call the mechanism's pname function to do the work */
        major = mech->pname_to_uid(mech->context, minor, mechName, uidOut);

        if (intName->mech_name != mechName)
                (void) __gss_release_internal_name(&tmpMinor, &mech->mech_type,
                                &mechName);

        return (major);
} /* gss_pname_to_uid */