/*      $OpenBSD: radius.c,v 1.6 2024/08/14 04:50:31 yasuoka Exp $ */

/*-
 * Copyright (c) 2009 Internet Initiative Japan Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE"AUTHOR" AND CONTRIBUTORS AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include <sys/socket.h>
#include <sys/uio.h>
#include <arpa/inet.h>

#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <openssl/md5.h>

#include "radius.h"

#include "radius_local.h"

static uint8_t radius_id_counter = 0;

static int
radius_check_packet_data(const RADIUS_PACKET_DATA * pdata, size_t length)
{
        const RADIUS_ATTRIBUTE  *attr;
        const RADIUS_ATTRIBUTE  *end;

        if (length < sizeof(RADIUS_PACKET_DATA))
                return (-1);
        if (length > 0xffff)
                return (-1);
        if (length != (size_t) ntohs(pdata->length))
                return (-1);

        attr = ATTRS_BEGIN(pdata);
        end = ATTRS_END(pdata);
        for (; attr < end; ATTRS_ADVANCE(attr)) {
                if (attr->length < 2)
                        return (-1);
                if (attr->type == RADIUS_TYPE_VENDOR_SPECIFIC) {
                        if (attr->length < 8)
                                return (-1);
                        if ((attr->vendor & htonl(0xff000000U)) != 0)
                                return (-1);
                        if (attr->length != attr->vlength + 6)
                                return (-1);
                }
        }

        if (attr != end)
                return (-1);

        return (0);
}

int
radius_ensure_add_capacity(RADIUS_PACKET * packet, size_t capacity)
{
        size_t   newsize;
        void    *newptr;

        /*
         * The maximum size is 64KB.
         * We use little bit smaller value for our safety(?).
         */
        if (ntohs(packet->pdata->length) + capacity > 0xfe00)
                return (-1);

        if (ntohs(packet->pdata->length) + capacity > packet->capacity) {
                newsize = ntohs(packet->pdata->length) + capacity +
                    RADIUS_PACKET_CAPACITY_INCREMENT;
                newptr = realloc(packet->pdata, newsize);
                if (newptr == NULL)
                        return (-1);
                packet->capacity = newsize;
                packet->pdata = (RADIUS_PACKET_DATA *)newptr;
        }
        return (0);
}

RADIUS_PACKET *
radius_new_request_packet(uint8_t code)
{
        RADIUS_PACKET   *packet;

        packet = malloc(sizeof(RADIUS_PACKET));
        if (packet == NULL)
                return (NULL);
        packet->pdata = malloc(RADIUS_PACKET_CAPACITY_INITIAL);
        if (packet->pdata == NULL) {
                free(packet);
                return (NULL);
        }
        packet->capacity = RADIUS_PACKET_CAPACITY_INITIAL;
        packet->request = NULL;
        packet->pdata->code = code;
        packet->pdata->id = radius_id_counter++;
        packet->pdata->length = htons(sizeof(RADIUS_PACKET_DATA));
        arc4random_buf(packet->pdata->authenticator,
            sizeof(packet->pdata->authenticator));

        return (packet);
}

RADIUS_PACKET *
radius_new_response_packet(uint8_t code, const RADIUS_PACKET * request)
{
        RADIUS_PACKET   *packet;

        packet = radius_new_request_packet(code);
        if (packet == NULL)
                return (NULL);
        packet->request = request;
        packet->pdata->id = request->pdata->id;

        return (packet);
}

RADIUS_PACKET *
radius_convert_packet(const void *pdata, size_t length)
{
        RADIUS_PACKET *packet;

        if (radius_check_packet_data((const RADIUS_PACKET_DATA *)pdata,
            length) != 0)
                return (NULL);
        packet = malloc(sizeof(RADIUS_PACKET));
        if (packet == NULL)
                return (NULL);
        packet->pdata = malloc(length);
        packet->capacity = length;
        packet->request = NULL;
        if (packet->pdata == NULL) {
                free(packet);
                return (NULL);
        }
        memcpy(packet->pdata, pdata, length);

        return (packet);
}

int
radius_delete_packet(RADIUS_PACKET * packet)
{
        free(packet->pdata);
        free(packet);
        return (0);
}

uint8_t
radius_get_code(const RADIUS_PACKET * packet)
{
        return (packet->pdata->code);
}

uint8_t
radius_get_id(const RADIUS_PACKET * packet)
{
        return (packet->pdata->id);
}

void
radius_update_id(RADIUS_PACKET * packet)
{
        packet->pdata->id = radius_id_counter++;
}

void
radius_set_id(RADIUS_PACKET * packet, uint8_t id)
{
        packet->pdata->id = id;
}

void
radius_get_authenticator(const RADIUS_PACKET * packet, void *authenticator)
{
        memcpy(authenticator, packet->pdata->authenticator, 16);
}

uint8_t *
radius_get_authenticator_retval(const RADIUS_PACKET * packet)
{
        return (packet->pdata->authenticator);
}

uint8_t *
radius_get_request_authenticator_retval(const RADIUS_PACKET * packet)
{
        if (packet->request == NULL)
                return (packet->pdata->authenticator);
        else
                return (packet->request->pdata->authenticator);
}

void
radius_set_request_packet(RADIUS_PACKET * packet,
    const RADIUS_PACKET * request)
{
        packet->request = request;
}

const RADIUS_PACKET *
radius_get_request_packet(const RADIUS_PACKET * packet)
{
        return (packet->request);
}

static void
radius_calc_authenticator(uint8_t * authenticator_dst,
    const RADIUS_PACKET * packet, const uint8_t * authenticator_src,
    const char *secret)
{
        MD5_CTX  ctx;

        MD5_Init(&ctx);
        MD5_Update(&ctx, (unsigned char *)packet->pdata, 4);
        MD5_Update(&ctx, (unsigned char *)authenticator_src, 16);
        MD5_Update(&ctx,
            (unsigned char *)packet->pdata->attributes,
            radius_get_length(packet) - 20);
        MD5_Update(&ctx, (unsigned char *)secret, strlen(secret));
        MD5_Final((unsigned char *)authenticator_dst, &ctx);
}

static void
radius_calc_response_authenticator(uint8_t * authenticator_dst,
    const RADIUS_PACKET * packet, const char *secret)
{
        radius_calc_authenticator(authenticator_dst,
            packet, packet->request->pdata->authenticator, secret);
}

int
radius_check_response_authenticator(const RADIUS_PACKET * packet,
    const char *secret)
{
        uint8_t authenticator[16];

        radius_calc_response_authenticator(authenticator, packet, secret);
        return (timingsafe_bcmp(authenticator, packet->pdata->authenticator,
            16));
}

void
radius_set_response_authenticator(RADIUS_PACKET * packet,
    const char *secret)
{
        radius_calc_response_authenticator(packet->pdata->authenticator,
            packet, secret);
}

static void
radius_calc_accounting_request_authenticator(uint8_t * authenticator_dst,
    const RADIUS_PACKET * packet, const char *secret)
{
        uint8_t  zero[16];

        memset(zero, 0, sizeof(zero));
        radius_calc_authenticator(authenticator_dst,
            packet, zero, secret);
}

void
radius_set_accounting_request_authenticator(RADIUS_PACKET * packet,
    const char *secret)
{
        radius_calc_accounting_request_authenticator(
            packet->pdata->authenticator, packet, secret);
}

int
radius_check_accounting_request_authenticator(const RADIUS_PACKET * packet,
    const char *secret)
{
        uint8_t authenticator[16];

        radius_calc_accounting_request_authenticator(authenticator, packet,
            secret);
        return (timingsafe_bcmp(authenticator, packet->pdata->authenticator,
            16));
}


uint16_t
radius_get_length(const RADIUS_PACKET * packet)
{
        return (ntohs(packet->pdata->length));
}


const void *
radius_get_data(const RADIUS_PACKET * packet)
{
        return (packet->pdata);
}

RADIUS_PACKET *
radius_recvfrom(int s, int flags, struct sockaddr * sa, socklen_t * slen)
{
        char     buf[0x10000];
        ssize_t  n;

        n = recvfrom(s, buf, sizeof(buf), flags, sa, slen);
        if (n <= 0)
                return (NULL);

        return (radius_convert_packet(buf, (size_t) n));
}

int
radius_sendto(int s, const RADIUS_PACKET * packet,
    int flags, const struct sockaddr * sa, socklen_t slen)
{
        ssize_t  n;

        n = sendto(s, packet->pdata, radius_get_length(packet), flags, sa,
            slen);
        if (n != radius_get_length(packet))
                return (-1);

        return (0);
}

RADIUS_PACKET *
radius_recv(int s, int flags)
{
        char     buf[0x10000];
        ssize_t  n;

        n = recv(s, buf, sizeof(buf), flags);
        if (n <= 0)
                return (NULL);

        return (radius_convert_packet(buf, (size_t) n));
}

int
radius_send(int s, const RADIUS_PACKET * packet, int flags)
{
        ssize_t  n;

        n = send(s, packet->pdata, radius_get_length(packet), flags);
        if (n != radius_get_length(packet))
                return (-1);

        return (0);
}

RADIUS_PACKET *
radius_recvmsg(int s, struct msghdr * msg, int flags)
{
        struct iovec     iov;
        char             buf[0x10000];
        ssize_t          n;

        if (msg->msg_iov != NULL || msg->msg_iovlen != 0)
                return (NULL);

        iov.iov_base = buf;
        iov.iov_len = sizeof(buf);
        msg->msg_iov = &iov;
        msg->msg_iovlen = 1;
        n = recvmsg(s, msg, flags);
        msg->msg_iov = NULL;
        msg->msg_iovlen = 0;
        if (n <= 0)
                return (NULL);

        return (radius_convert_packet(buf, (size_t) n));
}

int
radius_sendmsg(int s, const RADIUS_PACKET * packet,
    const struct msghdr * msg, int flags)
{
        struct msghdr    msg0;
        struct iovec     iov;
        ssize_t          n;

        if (msg->msg_iov != NULL || msg->msg_iovlen != 0)
                return (-1);

        iov.iov_base = packet->pdata;
        iov.iov_len = radius_get_length(packet);
        msg0 = *msg;
        msg0.msg_iov = &iov;
        msg0.msg_iovlen = 1;
        n = sendmsg(s, &msg0, flags);
        if (n != radius_get_length(packet))
                return (-1);

        return (0);
}